@hawkeyexl/manni 1.0.0 → 1.1.0

package/dist/{chunk-L7HN3AWA.js → chunk-7SE7XDCL.js}

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hawkeyexl/manni",
-  version: "1.0.0",
+  version: "1.1.0",
   description: "One command line for documentation that is meant to be checked. `manni meta` validates the presence and format of document metadata (Markdown frontmatter and more) against JSON Schema, built for CI. Formerly docmeta.",
   type: "module",
   bin: {
@@ -208,6 +208,11 @@ function parseCollections(raw, source, toError) {
         `${source}: ${where}.name "${name2}" collides with the docs table every query reads. Pick another name, such as "site" or "pages".`
       );
     }
+    if (folded === "derived" || folded === "_derived_rows" || folded === "resolved") {
+      throw toError(
+        `${source}: ${where}.name "${name2}" collides with the derived table a query builds beside docs (the derived view, its _derived_rows table, and the resolved view over both). Pick another name.`
+      );
+    }
     if (folded.startsWith("sqlite_")) {
       throw toError(
         `${source}: ${where}.name "${name2}" starts with "sqlite_", which SQLite reserves for its own objects. Pick another name.`
@@ -396,6 +401,19 @@ var ToolError = class extends Error {
     this.name = "ToolError";
   }
 };
+function errorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  if (typeof err === "object" && err !== null && "message" in err && typeof err.message === "string") {
+    return err.message;
+  }
+  try {
+    const json = JSON.stringify(err);
+    if (json !== void 0) return json;
+  } catch {
+  }
+  return String(err);
+}
 
 // src/meta/types.ts
 var DocmetaError = class extends ToolError {
@@ -424,8 +442,8 @@ var RENAME_ATTEMPTS = 3;
 function errorCode(err) {
   return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
 }
-var wait = (ms) => new Promise((resolve14) => {
-  setTimeout(resolve14, ms);
+var wait = (ms) => new Promise((resolve17) => {
+  setTimeout(resolve17, ms);
 });
 async function writeFileAtomic(path, contents) {
   const tmp = join(
@@ -619,11 +637,11 @@ import { resolve as resolvePath } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 
 // src/meta/core/json-text.ts
-function stripBom(text) {
-  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+function stripBom(text2) {
+  return text2.charCodeAt(0) === 65279 ? text2.slice(1) : text2;
 }
-function detectJsonIndent(text) {
-  return /^\{\s*\n([ \t]+)/.exec(text)?.[1] ?? "  ";
+function detectJsonIndent(text2) {
+  return /^\{\s*\n([ \t]+)/.exec(text2)?.[1] ?? "  ";
 }
 function toJsonText(value) {
   return JSON.stringify(value);
@@ -2892,6 +2910,11 @@ function assertPublishableBuiltinId(id) {
       `Built-in id "${id}" is not publishable: the "external" first segment is reserved for external-metadata finding identities (external:owned, external:duplicate, proposal 0037).`
     );
   }
+  if (first === "derived") {
+    throw new Error(
+      `Built-in id "${id}" is not publishable: the "derived" first segment is reserved for derived finding identities (derived:stale).`
+    );
+  }
 }
 for (const id of BUILTINS.keys()) assertPublishableBuiltinId(id);
 function listBuiltins() {
@@ -3019,8 +3042,8 @@ var SCHEMA_KEYS = [
   "multipleOf"
 ];
 var RETRY_DELAY_MS = 500;
-var wait2 = (ms) => new Promise((resolve14) => {
-  setTimeout(resolve14, ms);
+var wait2 = (ms) => new Promise((resolve17) => {
+  setTimeout(resolve17, ms);
 });
 var RetryableFetchError = class extends DocmetaError {
 };
@@ -3029,12 +3052,12 @@ function isAbort(err) {
   return name2 === "TimeoutError" || name2 === "AbortError";
 }
 var JSON_PARSE_EXCERPT = /^Unexpected token '[\s\S]', (?:\.\.\.)?"([\s\S]*)"(?:\.\.\.)? is not valid JSON$/;
-function lineColumn(text, index) {
+function lineColumn(text2, index) {
   let line = 1;
   let column = 1;
-  const stop = Math.min(index, text.length);
+  const stop = Math.min(index, text2.length);
   for (let i = 0; i < stop; i++) {
-    if (text.charCodeAt(i) === 10) {
+    if (text2.charCodeAt(i) === 10) {
       line += 1;
       column = 1;
     } else {
@@ -3043,12 +3066,12 @@ function lineColumn(text, index) {
   }
   return `line ${line} column ${column}`;
 }
-function withoutFileExcerpt(message, text) {
+function withoutFileExcerpt(message, text2) {
   const match = JSON_PARSE_EXCERPT.exec(message);
   if (!match) return message;
   const quoted = match[1];
-  const at = quoted === void 0 || quoted === "" ? -1 : text.indexOf(quoted);
-  return at < 0 ? "unexpected token" : `unexpected token at ${lineColumn(text, at)}`;
+  const at = quoted === void 0 || quoted === "" ? -1 : text2.indexOf(quoted);
+  return at < 0 ? "unexpected token" : `unexpected token at ${lineColumn(text2, at)}`;
 }
 function excerpt(raw, limit = 200) {
   const flat = raw.replace(/\s+/g, " ").trim();
@@ -3113,7 +3136,7 @@ async function requestSchema(ref, timeoutMs, timedOut) {
   } catch (err) {
     if (isAbort(err)) throw timedOut;
     throw new RetryableFetchError(
-      `Failed to fetch schema "${ref}": ${err.message}`
+      `Failed to fetch schema "${ref}": ${errorMessage(err)}`
     );
   }
   if (!res.ok) {
@@ -3145,7 +3168,7 @@ async function fetchSchemaBytes(ref, options = {}) {
     if (err instanceof DocmetaError) throw err;
     if (isAbort(err)) throw timedOut;
     throw new DocmetaError(
-      `Failed to fetch schema "${ref}": ${err.message}`
+      `Failed to fetch schema "${ref}": ${errorMessage(err)}`
     );
   }
   const raw = stripBom(bytes.toString("utf8"));
@@ -3154,7 +3177,7 @@ async function fetchSchemaBytes(ref, options = {}) {
     parsed2 = JSON.parse(raw);
   } catch (err) {
     throw new DocmetaError(
-      `Schema "${ref}" did not return valid JSON: ${err.message}`
+      `Schema "${ref}" did not return valid JSON: ${errorMessage(err)}`
     );
   }
   return { bytes, schema: assertFetchedSchema(ref, parsed2, raw) };
@@ -3262,12 +3285,12 @@ async function loadSchema(ref, options = {}) {
   if (pin?.integrity !== void 0) {
     assertIntegrity(ref, bytes, pin, pin.integrity);
   }
-  const text = stripBom(bytes.toString("utf8"));
+  const text2 = stripBom(bytes.toString("utf8"));
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch (err) {
     throw new DocmetaError(
-      `Schema file "${ref}" is not valid JSON: ${withoutFileExcerpt(err.message, text)}`
+      `Schema file "${ref}" is not valid JSON: ${withoutFileExcerpt(errorMessage(err), text2)}`
     );
   }
 }
@@ -3990,9 +4013,9 @@ function mergeToml(inner, patch, deletions = []) {
   if (insertAt >= lines.length) out.push(...appended);
   return out.join("\n");
 }
-function parseJsonBlockText(text) {
-  if (text.trim() === "") return {};
-  const parsed2 = JSON.parse(text);
+function parseJsonBlockText(text2) {
+  if (text2.trim() === "") return {};
+  const parsed2 = JSON.parse(text2);
   if (parsed2 == null || typeof parsed2 !== "object" || Array.isArray(parsed2)) {
     throw new DocmetaError(
       "Cannot rewrite front matter: the root must be an object."
@@ -4000,14 +4023,14 @@ function parseJsonBlockText(text) {
   }
   return parsed2;
 }
-function parseBlock(flavor, text) {
+function parseBlock(flavor, text2) {
   switch (flavor) {
     case "json":
-      return parseJsonBlockText(text);
+      return parseJsonBlockText(text2);
     case "toml":
-      return text.trim() === "" ? {} : parseToml2(text);
+      return text2.trim() === "" ? {} : parseToml2(text2);
     case "yaml": {
-      const doc = parseDocument2(text);
+      const doc = parseDocument2(text2);
       if (doc.errors.length > 0) {
         throw new DocmetaError(
           `Cannot rewrite invalid YAML front matter: ${doc.errors[0]?.message ?? "parse error"}`
@@ -4147,10 +4170,10 @@ function parseTitle(lines) {
   if (FIELD.test(first)) return { next: i };
   const over = adornment(first);
   if (over) {
-    const text = lines[i + 1] ?? "";
+    const text2 = lines[i + 1] ?? "";
     const under2 = adornment(lines[i + 2] ?? "");
-    if (text.trim() !== "" && !FIELD.test(text) && under2 != null && under2.char === over.char && under2.length === over.length && over.length >= text.trim().length) {
-      return { title: text.trim(), line: i + 2, next: i + 3 };
+    if (text2.trim() !== "" && !FIELD.test(text2) && under2 != null && under2.char === over.char && under2.length === over.length && over.length >= text2.trim().length) {
+      return { title: text2.trim(), line: i + 2, next: i + 3 };
     }
     return { next: i };
   }
@@ -4516,13 +4539,13 @@ function isMetadataAttribute(name2) {
   return name2 !== "xmlns" && !name2.startsWith("xmlns:");
 }
 function elementText(el, allowEmpty = false) {
-  let text = "";
+  let text2 = "";
   for (let n = el.firstChild; n; n = n.nextSibling) {
     if (n.nodeType === 1) return void 0;
-    if (n.nodeType === 3 || n.nodeType === 4) text += n.nodeValue ?? "";
+    if (n.nodeType === 3 || n.nodeType === 4) text2 += n.nodeValue ?? "";
   }
-  if (!allowEmpty && text.trim() === "") return void 0;
-  return text.trim();
+  if (!allowEmpty && text2.trim() === "") return void 0;
+  return text2.trim();
 }
 function ditaLiftedElements(container) {
   const out = /* @__PURE__ */ new Map();
@@ -4559,15 +4582,15 @@ function own(table, key) {
 function liftableChildren(root) {
   const out = /* @__PURE__ */ new Map();
   for (const child of childElements(root)) {
-    const text = elementText(child);
-    if (text === void 0) continue;
+    const text2 = elementText(child);
+    if (text2 === void 0) continue;
     const key = liftKey(root.nodeName, child.nodeName);
     const group = out.get(key);
     if (group) {
       group.els.push(child);
-      group.values.push(typeValue3(text));
+      group.values.push(typeValue3(text2));
     } else {
-      out.set(key, { els: [child], values: [typeValue3(text)] });
+      out.set(key, { els: [child], values: [typeValue3(text2)] });
     }
   }
   return out;
@@ -4917,7 +4940,7 @@ function ownLift(container, element) {
   const lifts = DITA_LIFTS[container];
   return lifts && Object.prototype.hasOwnProperty.call(lifts, element) ? lifts[element] : void 0;
 }
-function newElementEdits(content, starts, root, shape, items, emit, escape) {
+function newElementEdits(content, starts, root, shape, items2, emit, escape) {
   const eol = content.includes(CRLF) ? CRLF : LF;
   const liftRootEl = liftRoot(root, shape);
   const tagsFor = (item) => {
@@ -4931,7 +4954,7 @@ function newElementEdits(content, starts, root, shape, items, emit, escape) {
     });
   };
   const byContainer = /* @__PURE__ */ new Map();
-  for (const item of items) {
+  for (const item of items2) {
     const group = byContainer.get(item.container);
     if (group) group.push(item);
     else byContainer.set(item.container, [item]);
@@ -5179,7 +5202,7 @@ function applyXml(original, patch, options = {}) {
     before = readXml(original, options.filePath, { elements: options.elements });
   } catch (err) {
     throw new DocmetaError(
-      `Refusing to write metadata: ${err.message}`
+      `Refusing to write metadata: ${errorMessage(err)}`
     );
   }
   const content = before.body;
@@ -5278,13 +5301,13 @@ function assertNoElementCollision(key, root) {
   );
 }
 function emitScalar(key, value) {
-  const text = stringifyYaml(value).replace(/\n$/, "");
-  if (text.includes("\n")) {
+  const text2 = stringifyYaml(value).replace(/\n$/, "");
+  if (text2.includes("\n")) {
     throw new DocmetaError(
       `Refusing to write "${key}": the value needs more than one line, which an XML attribute cannot hold. Set it manually.`
     );
   }
-  return text;
+  return text2;
 }
 function escapeAttr(value, quote) {
   const escaped = value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -5314,7 +5337,7 @@ function verify2(next, before, patch, options) {
     }).data;
   } catch (err) {
     throw new DocmetaError(
-      `Refusing to write XML metadata: the rewritten document did not parse (${err.message}).`
+      `Refusing to write XML metadata: the rewritten document did not parse (${errorMessage(err)}).`
     );
   }
   if (!deepEqual(actual, expected)) {
@@ -5355,13 +5378,13 @@ var HEAD_NOT_METADATA = /* @__PURE__ */ new Set(["script", "style"]);
 var HEAD_SINGLETONS = /* @__PURE__ */ new Set(["title", "base"]);
 var elementName = (el) => el ? el.tagName.toLowerCase() : "";
 function headText(el, allowEmpty = false) {
-  let text = "";
+  let text2 = "";
   for (const node of el.childNodes) {
     if (defaultTreeAdapter.isElementNode(node)) return void 0;
-    if (defaultTreeAdapter.isTextNode(node)) text += node.value;
+    if (defaultTreeAdapter.isTextNode(node)) text2 += node.value;
   }
-  if (!allowEmpty && text.trim() === "") return void 0;
-  return text.trim();
+  if (!allowEmpty && text2.trim() === "") return void 0;
+  return text2.trim();
 }
 function liftableHeadChildren(head) {
   const out = /* @__PURE__ */ new Map();
@@ -5369,15 +5392,15 @@ function liftableHeadChildren(head) {
     if (!defaultTreeAdapter.isElementNode(node)) continue;
     const name2 = node.tagName.toLowerCase();
     if (HEAD_NOT_METADATA.has(name2)) continue;
-    const text = headText(node);
-    if (text === void 0) continue;
+    const text2 = headText(node);
+    if (text2 === void 0) continue;
     const key = liftKey("head", name2);
     const group = out.get(key);
     if (group) {
       group.els.push(node);
-      group.texts.push(text);
+      group.texts.push(text2);
     } else {
-      out.set(key, { els: [node], texts: [text] });
+      out.set(key, { els: [node], texts: [text2] });
     }
   }
   return out;
@@ -5426,8 +5449,8 @@ function readHtml(source, options) {
       } else if (node.tagName === "title") {
         if (data.title === void 0) {
           const first = node.childNodes[0];
-          const text = first && defaultTreeAdapter.isTextNode(first) ? first.value : "";
-          setKey("title", text, { kind: "title", el: node }, line, location?.startCol);
+          const text2 = first && defaultTreeAdapter.isTextNode(first) ? first.value : "";
+          setKey("title", text2, { kind: "title", el: node }, line, location?.startCol);
         }
       } else if (node.tagName === "meta") {
         const key = attrValue(node, "name") ?? attrValue(node, "property");
@@ -5571,8 +5594,8 @@ function elementTextEdit2(el, key, emitted) {
 }
 function insertEdit2(content, head, at, tags) {
   const { eol, indent } = headStyle(content, head, at);
-  const text = tags.map((t) => `${eol}${indent}${t}`).join("");
-  return { start: at, end: at, text };
+  const text2 = tags.map((t) => `${eol}${indent}${t}`).join("");
+  return { start: at, end: at, text: text2 };
 }
 function headStyle(content, head, at) {
   for (const child of head.childNodes) {
@@ -5608,13 +5631,13 @@ function attrValueSpan2(content, start, end) {
   return { start: i, end, quote: DQ3, wrap: true };
 }
 function emitScalar2(key, value) {
-  const text = stringifyYaml2(value).replace(/\n$/, "");
-  if (text.includes("\n")) {
+  const text2 = stringifyYaml2(value).replace(/\n$/, "");
+  if (text2.includes("\n")) {
     throw new DocmetaError(
       `Refusing to write "${key}": the value needs more than one line, which an HTML attribute cannot hold. Set it manually.`
     );
   }
-  return text;
+  return text2;
 }
 function escapeAttr2(value, quote) {
   const escaped = value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -5977,11 +6000,11 @@ async function loadExternalMetadata(collections, opts) {
   const byField = /* @__PURE__ */ new Map();
   const entries = [];
   for (const { collection, manifest } of configured) {
-    let text;
+    let text2;
     let file;
     if (classifyRef(manifest.file).kind === "url") {
       file = manifest.file;
-      text = await fetchExternalMetadata(manifest.file, {
+      text2 = await fetchExternalMetadata(manifest.file, {
         ...manifest.tokenEnv !== void 0 ? { tokenEnv: manifest.tokenEnv } : {},
         ...opts.offline !== void 0 ? { offline: opts.offline } : {},
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
@@ -5990,32 +6013,32 @@ async function loadExternalMetadata(collections, opts) {
     } else {
       const abs = isAbsolute2(manifest.file) ? manifest.file : resolve5(opts.configDir, manifest.file);
       file = reportedPath(abs, opts.base);
-      text = await readManifest(abs, file);
+      text2 = await readManifest(abs, file);
     }
     for (const key of manifest.keys) {
       const list = owners.get(key);
       if (list) list.push({ collection, file });
       else owners.set(key, [{ collection, file }]);
     }
-    const join7 = externalMetadataJoin(manifest);
+    const join8 = externalMetadataJoin(manifest);
     let target;
-    if (join7 === PATH_JOIN) {
+    if (join8 === PATH_JOIN) {
       target = byPath;
     } else {
-      const existing = byField.get(join7);
+      const existing = byField.get(join8);
       if (existing) target = existing;
       else {
         target = /* @__PURE__ */ new Map();
-        byField.set(join7, target);
+        byField.set(join8, target);
       }
     }
     parseManifest(
       manifest,
       collection,
-      text,
+      text2,
       file,
       opts.configDir,
-      join7,
+      join8,
       target,
       entries
     );
@@ -6032,9 +6055,9 @@ async function readManifest(abs, file) {
     );
   }
 }
-function parseManifest(manifest, collection, text, file, configDir, join7, target, entries) {
+function parseManifest(manifest, collection, text2, file, configDir, join8, target, entries) {
   const lc = new LineCounter2();
-  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(
@@ -6045,7 +6068,7 @@ function parseManifest(manifest, collection, text, file, configDir, join7, targe
   if (root === null || isScalar2(root) && root.value === null) return;
   if (!isMap3(root)) {
     throw new DocmetaError(
-      `Manifest ${file}: the manifest must be a mapping from document ${join7 === PATH_JOIN ? "path" : `"${join7}"`} to owned keys.`
+      `Manifest ${file}: the manifest must be a mapping from document ${join8 === PATH_JOIN ? "path" : `"${join8}"`} to owned keys.`
     );
   }
   const owned = new Set(manifest.keys);
@@ -6070,7 +6093,7 @@ function parseManifest(manifest, collection, text, file, configDir, join7, targe
         `Manifest ${where}: "${spelled}" must be a mapping of owned keys to values.`
       );
     }
-    const indexKey = join7 === PATH_JOIN ? resolve5(configDir, spelled) : spelled;
+    const indexKey = join8 === PATH_JOIN ? resolve5(configDir, spelled) : spelled;
     const values = target.get(indexKey) ?? /* @__PURE__ */ new Map();
     for (const kv of pair.value.items) {
       const key = isScalar2(kv.key) ? String(kv.key.value) : String(kv.key);
@@ -6096,8 +6119,8 @@ function parseManifest(manifest, collection, text, file, configDir, join7, targe
     target.set(indexKey, values);
     entries.push({
       collection,
-      join: join7,
-      ...join7 === PATH_JOIN ? { abs: indexKey } : {},
+      join: join8,
+      ...join8 === PATH_JOIN ? { abs: indexKey } : {},
       spelled,
       file,
       ...entryLine === void 0 ? {} : { line: entryLine }
@@ -6212,6 +6235,97 @@ function orphanError(orphans) {
   );
 }
 
+// src/meta/core/derive/types.ts
+var DERIVABLE_FIELDS = [
+  "created",
+  "last-updated",
+  "authors",
+  "owner",
+  "reviewed-by",
+  "last-reviewed"
+];
+function isBuiltinField(x) {
+  return DERIVABLE_FIELDS.includes(x);
+}
+var DERIVE_SOURCES = ["git", "codeowners", "github", "gitlab", "command"];
+function isDeriveSource(x) {
+  return DERIVE_SOURCES.includes(x);
+}
+function derivableFields(commands) {
+  return [...DERIVABLE_FIELDS, ...Object.keys(commands ?? {}).sort()];
+}
+var DERIVED_STALE_SCHEMA = "derived:stale";
+var DERIVED_KEYWORD = "derived";
+function compareDerived(field, asserted, derived) {
+  const base = {
+    field,
+    ...asserted !== void 0 ? { asserted } : {}
+  };
+  if (derived == null) {
+    return { ...base, derived: null, status: "unknown", written: false };
+  }
+  const status = asserted === void 0 ? "unset" : deepEqual2(asserted, derived.value) ? "current" : "stale";
+  return {
+    ...base,
+    derived: derived.value,
+    source: derived.source,
+    evidence: derived.evidence,
+    status,
+    written: false
+  };
+}
+function staleFindings(fields, lineFor) {
+  const findings = [];
+  for (const f of fields) {
+    if (f.status !== "stale" && f.status !== "unset") continue;
+    const instancePath = `/${escapePointerSegment(f.field)}`;
+    const line = lineFor(instancePath);
+    const says = `${f.source ?? "a source"} says ${fmt(f.derived)}`;
+    const trail = f.evidence === void 0 ? "" : ` (${f.evidence})`;
+    const head = f.status === "stale" ? `${f.field} says ${fmt(f.asserted)}` : `${f.field} is not set`;
+    findings.push({
+      schema: DERIVED_STALE_SCHEMA,
+      keyword: DERIVED_KEYWORD,
+      subject: f.field,
+      instancePath,
+      message: `${head}; ${says}${trail} \u2014 run manni meta derive`,
+      ...line !== void 0 ? { line } : {}
+    });
+  }
+  return findings;
+}
+function fmt(value) {
+  if (typeof value === "string") return value;
+  return toJsonText(value) ?? String(value);
+}
+function deepEqual2(a, b) {
+  if (isList(a) || isList(b)) {
+    if (!isList(a) || !isList(b) || a.length !== b.length) return false;
+    const unused = [...b];
+    for (const x of a) {
+      const i = unused.findIndex((y) => deepEqual2(x, y));
+      if (i === -1) return false;
+      unused.splice(i, 1);
+    }
+    return true;
+  }
+  if (isPlainObject(a) || isPlainObject(b)) {
+    if (!isPlainObject(a) || !isPlainObject(b)) return false;
+    const keys = Object.keys(a);
+    if (keys.length !== Object.keys(b).length) return false;
+    return keys.every(
+      (k) => Object.hasOwn(b, k) && deepEqual2(a[k], b[k])
+    );
+  }
+  return toJsonText(a) === toJsonText(b);
+}
+function isList(v) {
+  return Array.isArray(v);
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !isList(v) && !(v instanceof Date);
+}
+
 // src/meta/core/config.ts
 import { resolve as resolve7 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
@@ -6240,20 +6354,20 @@ var MOOSE_CONFIG_NAMES = [
   "moose.config.yml"
 ];
 async function readDocument(path, source, opts) {
-  let text;
+  let text2;
   try {
-    text = await readFile4(path, "utf8");
+    text2 = await readFile4(path, "utf8");
   } catch {
     return null;
   }
-  return { text, doc: parseMapping(text, source, opts) };
+  return { text: text2, doc: parseMapping(text2, source, opts) };
 }
-function parseMapping(text, source, opts) {
+function parseMapping(text2, source, opts) {
   let raw;
   try {
-    raw = parseYaml(text);
+    raw = parseYaml(text2);
   } catch (err) {
-    throw opts.toError(`${source}: invalid YAML: ${err.message}`);
+    throw opts.toError(`${source}: invalid YAML: ${errorMessage(err)}`);
   }
   if (raw == null) return null;
   if (typeof raw !== "object" || Array.isArray(raw)) {
@@ -6365,15 +6479,36 @@ function asElementPaths(value, where, source) {
     try {
       parseElementPath(path);
     } catch (err) {
-      throw new DocmetaError(`${source}: ${where} \u2014 ${err.message}`);
+      throw new DocmetaError(`${source}: ${where} \u2014 ${errorMessage(err)}`);
     }
   }
   return list;
 }
 var OVERRIDE_KEYS = ["collection", "files", "schemas", "elements"];
 var CHECK_KEYS = ["name", "query"];
+var DERIVE_KEYS = ["fields", "sources", "codeowners", "commands"];
+var DERIVE_COMMAND_KEYS = ["run", "timeout"];
+var BUILTIN_CLAIMED_BY = {
+  created: "git",
+  "last-updated": "git",
+  authors: "git",
+  owner: "codeowners",
+  "reviewed-by": "GitHub or GitLab",
+  "last-reviewed": "GitHub or GitLab"
+};
+var DERIVED_TABLE_RESERVED = /* @__PURE__ */ new Set(["_path", "_sources"]);
+var DERIVABLE_LIST = `Derivable fields: ${DERIVABLE_FIELDS.join(", ")}, or any key with an entry in derive.commands.`;
 var CHECK_NAME = /^[a-z0-9][a-z0-9._-]*$/;
-var RESERVED_CHECK_NAMES = /* @__PURE__ */ new Set(["query"]);
+var RESERVED_CHECK_NAMES = /* @__PURE__ */ new Map([
+  [
+    "query",
+    "`manni meta query --check` files its ad-hoc findings as check:query, and a configured check with the same name would share their identity"
+  ],
+  [
+    "derive",
+    "`manni meta derive` is a verb of its own, and a check reporting as check:derive would read as its findings"
+  ]
+]);
 var FILL_KEYS = [
   "provider",
   "model",
@@ -6386,6 +6521,7 @@ var CONFIG_KEYS = [
   "schemas",
   "overrides",
   "checks",
+  "derive",
   "baseline",
   "allowEmpty",
   "respectGitignore",
@@ -6496,13 +6632,13 @@ function parseSchemaEntry(entry, where, source) {
   }
   return parsed2;
 }
-function parseConfig(text, source) {
+function parseConfig(text2, source) {
   let raw;
   try {
-    raw = parseYaml2(text);
+    raw = parseYaml2(text2);
   } catch (err) {
     throw new DocmetaError(
-      `${source}: invalid YAML: ${err.message}`
+      `${source}: invalid YAML: ${errorMessage(err)}`
     );
   }
   return parseConfigValue(raw, source);
@@ -6564,15 +6700,170 @@ function assertNoMovedKeys(raw, source) {
     }
   }
 }
-function assertOverrideCollections(config, collections, source) {
+function inSection(message, source, section) {
+  return section === void 0 ? message : withSection(message, source, section);
+}
+function assertOverrideCollections(config, collections, source, section) {
   const names = new Set(collections.map((c) => c.name));
   for (const [i, ov] of (config.overrides ?? []).entries()) {
     if (ov.collection === void 0 || names.has(ov.collection)) continue;
     const defined = collections.length === 0 ? "(none)" : collections.map((c) => c.name).join(", ");
     throw new DocmetaError(
-      `${source}: overrides[${i}].collection names "${ov.collection}", which collections: does not define. Defined: ${defined}.`
+      inSection(
+        `${source}: overrides[${i}].collection names "${ov.collection}", which collections: does not define. Defined: ${defined}.`,
+        source,
+        section
+      )
+    );
+  }
+}
+function manifestOwning(key, collections) {
+  for (const [c, collection] of collections.entries()) {
+    for (const [e, manifest] of collection.externalMetadata.entries()) {
+      if (manifest.keys.includes(key)) {
+        return { collection: c, name: collection.name, entry: e, file: manifest.file };
+      }
+    }
+  }
+  return void 0;
+}
+function assertManagedFieldsUnowned(config, collections, source, section) {
+  const refuse = (path, owner) => {
+    const message = `${source}: ${path} is owned by collections[${owner.collection}].externalMetadata[${owner.entry}] (${owner.file}) \u2014 a managed field has one authority, and a manifest key already has one. Drop it from one side.`;
+    throw new DocmetaError(
+      inSection(message, source, section)
+    );
+  };
+  for (const key of Object.keys(config.derive?.commands ?? {})) {
+    const owner = manifestOwning(key, collections);
+    if (owner !== void 0) refuse(`derive.commands.${key}`, owner);
+  }
+  for (const [i, field] of (config.derive?.fields ?? []).entries()) {
+    const owner = manifestOwning(field, collections);
+    if (owner !== void 0) refuse(`derive.fields[${i}] "${field}"`, owner);
+  }
+}
+function parseDerive(raw, source) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new DocmetaError(
+      `${source}: "derive" must be a mapping. Write it as \`derive:\` with \`fields:\` beneath it.`
+    );
+  }
+  const e = raw;
+  rejectUnknownKeys2(e, DERIVE_KEYS, '"derive"', source);
+  if (e.fields === void 0 && e.sources === void 0 && e.codeowners === void 0 && e.commands === void 0) {
+    throw new DocmetaError(
+      `${source}: "derive" sets nothing. Give it \`fields:\` to manage, \`commands:\` to derive from a command, or \`sources:\` or \`codeowners:\` to shape the reads.`
+    );
+  }
+  const commands = e.commands === void 0 ? void 0 : parseDeriveCommands(e.commands, source);
+  if (e.fields !== void 0 && (!Array.isArray(e.fields) || e.fields.length === 0 || e.fields.some((f) => typeof f !== "string"))) {
+    throw new DocmetaError(
+      `${source}: derive.fields must be a non-empty list of field names. ${DERIVABLE_LIST}`
+    );
+  }
+  const fields = [];
+  (e.fields ?? []).forEach((f, i) => {
+    if (!isBuiltinField(f) && !(commands !== void 0 && Object.hasOwn(commands, f))) {
+      throw new DocmetaError(
+        `${source}: derive.fields[${i}] "${f}" is not derivable. ${DERIVABLE_LIST}`
+      );
+    }
+    if (fields.includes(f)) {
+      throw new DocmetaError(`${source}: derive.fields lists "${f}" twice.`);
+    }
+    fields.push(f);
+  });
+  const derive = { fields };
+  if (e.sources !== void 0) {
+    if (!Array.isArray(e.sources) || e.sources.length === 0 || e.sources.some((s) => typeof s !== "string")) {
+      throw new DocmetaError(
+        `${source}: derive.sources must be a non-empty list of source names. Sources: ${DERIVE_SOURCES.join(", ")}.`
+      );
+    }
+    const sources = [];
+    e.sources.forEach((s, i) => {
+      if (!isDeriveSource(s)) {
+        throw new DocmetaError(
+          `${source}: derive.sources[${i}] "${s}" is not a source. Sources: ${DERIVE_SOURCES.join(", ")}.`
+        );
+      }
+      if (sources.includes(s)) {
+        throw new DocmetaError(`${source}: derive.sources lists "${s}" twice.`);
+      }
+      sources.push(s);
+    });
+    derive.sources = sources;
+  }
+  if (e.codeowners !== void 0) {
+    if (typeof e.codeowners !== "string" || e.codeowners.trim() === "") {
+      throw new DocmetaError(
+        `${source}: derive.codeowners must be a non-empty path to a CODEOWNERS file, relative to the config file.`
+      );
+    }
+    derive.codeowners = e.codeowners;
+  }
+  if (commands !== void 0) derive.commands = commands;
+  return derive;
+}
+function parseDeriveCommands(raw, source) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new DocmetaError(
+      `${source}: derive.commands must be a mapping of field name to command.`
     );
   }
+  const commands = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (key.trim() === "") {
+      throw new DocmetaError(`${source}: derive.commands has an empty field name.`);
+    }
+    if (key === FILE_SCHEMA_KEY) {
+      throw new DocmetaError(
+        `${source}: derive.commands may not derive "${FILE_SCHEMA_KEY}" \u2014 a command never chooses the schema a document is judged by.`
+      );
+    }
+    if (isBuiltinField(key)) {
+      throw new DocmetaError(
+        `${source}: derive.commands.${key} targets a field ${BUILTIN_CLAIMED_BY[key]} already derives; a command may only derive a field no built-in source claims.`
+      );
+    }
+    if (DERIVED_TABLE_RESERVED.has(key)) {
+      throw new DocmetaError(
+        `${source}: derive.commands.${key} collides with a column of the derived table a query builds (${[...DERIVED_TABLE_RESERVED].join(", ")}). Pick another field name.`
+      );
+    }
+    const where = `derive.commands.${key}`;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      throw new DocmetaError(
+        `${source}: ${where} must be a mapping with \`run:\` beneath it.`
+      );
+    }
+    const c = value;
+    rejectUnknownKeys2(c, DERIVE_COMMAND_KEYS, where, source);
+    if (!Array.isArray(c.run) || c.run.length === 0) {
+      throw new DocmetaError(
+        `${source}: ${where}.run must be a non-empty list of strings, the program first.`
+      );
+    }
+    const run2 = [];
+    c.run.forEach((arg, j) => {
+      if (typeof arg !== "string" || arg.trim() === "") {
+        throw new DocmetaError(`${source}: ${where}.run[${j}] must be a non-empty string.`);
+      }
+      run2.push(arg);
+    });
+    const command = { run: run2 };
+    if (c.timeout !== void 0) {
+      if (typeof c.timeout !== "number" || !Number.isInteger(c.timeout) || c.timeout <= 0) {
+        throw new DocmetaError(
+          `${source}: ${where}.timeout must be a whole number of seconds, greater than zero.`
+        );
+      }
+      command.timeout = c.timeout;
+    }
+    commands[key] = command;
+  }
+  return commands;
 }
 function parseConfigDocument(raw, source) {
   if (raw == null) return {};
@@ -6629,6 +6920,9 @@ function parseConfigDocument(raw, source) {
   if (obj.checks !== void 0) {
     config.checks = parseChecks(obj.checks, source);
   }
+  if (obj.derive !== void 0) {
+    config.derive = parseDerive(obj.derive, source);
+  }
   if (obj.elements !== void 0) {
     config.elements = asElementPaths(obj.elements, "elements", source);
   }
@@ -6690,9 +6984,10 @@ function parseChecks(value, source) {
         `${source}: checks[${i}].name "${e.name}" must match [a-z0-9][a-z0-9._-]* and not end in ".json" \u2014 the name is part of each finding's identity (check:<name>).`
       );
     }
-    if (RESERVED_CHECK_NAMES.has(e.name)) {
+    const reserved = RESERVED_CHECK_NAMES.get(e.name);
+    if (reserved !== void 0) {
       throw new DocmetaError(
-        `${source}: checks[${i}].name "${e.name}" is reserved \u2014 \`manni meta query --check\` files its ad-hoc findings as check:${e.name}, and a configured check with the same name would share their identity. Pick another name.`
+        `${source}: checks[${i}].name "${e.name}" is reserved \u2014 ${reserved}. Pick another name.`
       );
     }
     if (seen.has(e.name)) {
@@ -6795,8 +7090,8 @@ function parseFill(value, source) {
   return fill;
 }
 function schemaTrustRoot(cwd, configDir) {
-  const git = findGitRoot(cwd);
-  if (git !== null) return { dir: git, source: "git" };
+  const git2 = findGitRoot(cwd);
+  if (git2 !== null) return { dir: git2, source: "git" };
   if (configDir !== void 0) return { dir: resolve7(configDir), source: "config" };
   return { dir: resolve7(cwd), source: "cwd" };
 }
@@ -6805,7 +7100,8 @@ async function loadConfig(explicitPath, cwd = process.cwd()) {
   if (file === null) return null;
   const section = file.wrapped ? META_SECTION : void 0;
   const config = parseConfigValue(file.value, file.source, section);
-  assertOverrideCollections(config, file.collections, file.source);
+  assertOverrideCollections(config, file.collections, file.source, section);
+  assertManagedFieldsUnowned(config, file.collections, file.source, section);
   return {
     config,
     path: file.path,
@@ -6900,16 +7196,22 @@ function createDocsTable(db, entries, dataColumns) {
     `INSERT INTO docs VALUES (${["?", "?", "?", "?", ...dataColumns.map(() => "?")].join(", ")})`
   );
   db.exec("BEGIN");
-  for (const { label, extracted } of entries) {
-    insert.run(
-      label,
-      extracted.format,
-      extracted.present ? 1 : 0,
-      JSON.stringify(extracted.data),
-      ...dataColumns.map((c) => bindValue(extracted.data[c]))
-    );
+  let committed = false;
+  try {
+    for (const { label, extracted } of entries) {
+      insert.run(
+        label,
+        extracted.format,
+        extracted.present ? 1 : 0,
+        JSON.stringify(extracted.data),
+        ...dataColumns.map((c) => bindValue(extracted.data[c]))
+      );
+    }
+    db.exec("COMMIT");
+    committed = true;
+  } finally {
+    if (!committed) db.exec("ROLLBACK");
   }
-  db.exec("COMMIT");
 }
 function registerLineFor(db, entries) {
   const byLabel = new Map(entries.map((e) => [e.label, e.extracted]));
@@ -6984,7 +7286,7 @@ function isParamName(name2) {
   return PARAM_NAME_HEAD.exec(name2)?.[0] === name2;
 }
 function collectNamedParameters(sql) {
-  const tokens = [];
+  const tokens2 = [];
   const seen = /* @__PURE__ */ new Set();
   const prefixOf = /* @__PURE__ */ new Map();
   let i = 0;
@@ -7014,14 +7316,14 @@ function collectNamedParameters(sql) {
       prefixOf.set(m[0], ch);
       if (!seen.has(token)) {
         seen.add(token);
-        tokens.push(token);
+        tokens2.push(token);
       }
       i += 1 + m[0].length;
     } else {
       i++;
     }
   }
-  return tokens;
+  return tokens2;
 }
 function stripLeadingTrivia(sql) {
   let i = 0;
@@ -7034,16 +7336,16 @@ function stripLeadingTrivia(sql) {
     return sql.slice(i);
   }
 }
-function isTrivia(text) {
+function isTrivia(text2) {
   let i = 0;
-  while (i < text.length) {
-    const ch = text[i];
+  while (i < text2.length) {
+    const ch = text2[i];
     if (ch === void 0 || /\s/.test(ch) || ch === ";") {
       i++;
       continue;
     }
-    if (startsComment(text, i)) {
-      i = skipComment(text, i);
+    if (startsComment(text2, i)) {
+      i = skipComment(text2, i);
       continue;
     }
     return false;
@@ -7055,8 +7357,8 @@ function loadSqlite() {
   sqliteModule ??= (async () => {
     const original = process.emitWarning.bind(process);
     const filtered = (warning, ...rest) => {
-      const text = typeof warning === "string" ? warning : warning.message;
-      if (text.includes("SQLite is an experimental feature")) return;
+      const text2 = typeof warning === "string" ? warning : warning.message;
+      if (text2.includes("SQLite is an experimental feature")) return;
       Reflect.apply(original, process, [warning, ...rest]);
     };
     process.emitWarning = filtered;
@@ -7248,7 +7550,7 @@ var Validator = class {
       return ajv.compile(schema);
     } catch (err) {
       throw new DocmetaError(
-        `Schema "${ref}" failed to compile: ${err.message}`
+        `Schema "${ref}" failed to compile: ${errorMessage(err)}`
       );
     }
   }
@@ -7332,116 +7634,1748 @@ function toFieldError(schema, e, lineFor, colFor, locate) {
   };
 }
 
-// src/meta/commands/validate.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
-import { resolve as resolve9, extname as extname2 } from "node:path";
-
-// src/meta/core/baseline.ts
+// src/meta/core/derive/cache.ts
 import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile5 } from "node:fs/promises";
-import { relative as relative7, resolve as resolve8 } from "node:path";
-var DEFAULT_BASELINE_PATH = ".manni-baseline.json";
-var LEGACY_BASELINE_PATH = ".docmeta-baseline.json";
-var BASELINE_VERSION = 1;
-var FINGERPRINT_RE = /^[0-9a-f]{16}$/;
-function canonicalFilePath(file, ctx) {
-  if (!ctx) return file;
-  const from = ctx.runBase ?? ctx.base;
-  return relative7(ctx.base, resolve8(from, file)).replace(/\\/g, "/");
-}
-function canonicalSchemaRef(ref, ctx) {
-  if (!ctx) return ref;
-  if (classifyRef(ref).kind !== "file") return ref;
-  const abs = resolve8(ctx.cwd, ref);
-  return relative7(ctx.base, abs).replace(/\\/g, "/");
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join as join5 } from "node:path";
+var REVIEW_CACHE_DIR = ".manni/meta/review-cache";
+var REVIEW_CACHE_VERSION = 1;
+var ReviewCache = class {
+  constructor(dir, enabled) {
+    this.dir = dir;
+    this.enabled = enabled;
+  }
+  dir;
+  enabled;
+  entryPath(key) {
+    const digest = createHash3("sha256").update(key).digest("hex");
+    return join5(this.dir, `${digest}.json`);
+  }
+  /** The cached change, or `undefined` for a miss. Never `null`: nulls are not stored. */
+  get(key) {
+    if (!this.enabled) return void 0;
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(this.entryPath(key), "utf8"));
+    } catch {
+      return void 0;
+    }
+    if (!isRecord(raw)) return void 0;
+    if (raw.version !== REVIEW_CACHE_VERSION || raw.key !== key) return void 0;
+    const change2 = readChange(raw.change);
+    return change2 ?? void 0;
+  }
+  set(key, value) {
+    if (!this.enabled) return;
+    const entry = { version: REVIEW_CACHE_VERSION, key, change: value };
+    const path = this.entryPath(key);
+    const tmp = `${path}.${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`;
+    try {
+      mkdirSync(this.dir, { recursive: true });
+      writeFileSync(tmp, `${JSON.stringify(entry, null, 2)}
+`, "utf8");
+      renameSync(tmp, path);
+    } catch {
+      try {
+        rmSync(tmp, { force: true });
+      } catch {
+      }
+    }
+  }
+};
+function cachedClient(client, cache, identity) {
+  return {
+    detect: () => client.detect(),
+    status: () => client.status(),
+    async mergedChangeFor(sha) {
+      if (identity === null) return client.mergedChangeFor(sha);
+      const key = `${identity.host}/${identity.project}/${sha}`;
+      const hit = cache.get(key);
+      if (hit !== void 0) return hit;
+      const change2 = await client.mergedChangeFor(sha);
+      if (change2 !== null) cache.set(key, change2);
+      return change2;
+    }
+  };
 }
-function fingerprint(e, ctx) {
-  const parts = [
-    canonicalSchemaRef(e.schema, ctx),
-    e.instancePath,
-    e.keyword,
-    e.subject ?? ""
-  ];
-  return createHash3("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function serializeBaseline(baseline) {
-  const entries = /* @__PURE__ */ Object.create(null);
-  for (const file of Object.keys(baseline.entries).sort()) {
-    entries[file] = [...baseline.entries[file] ?? []].sort();
+function readChange(v) {
+  if (!isRecord(v)) return null;
+  const { id, mergedAt, approvals } = v;
+  if (typeof id !== "number" || typeof mergedAt !== "string") return null;
+  if (!Array.isArray(approvals)) return null;
+  const read = [];
+  for (const a of approvals) {
+    if (!isRecord(a)) return null;
+    if (typeof a.login !== "string" || typeof a.submittedAt !== "string") return null;
+    read.push({ login: a.login, submittedAt: a.submittedAt });
   }
-  return `${JSON.stringify(
-    {
-      version: baseline.version,
-      generatedWith: baseline.generatedWith,
-      entries
-    },
-    null,
-    2
-  )}
-`;
+  return { id, mergedAt, approvals: read };
 }
-function bad(source, detail) {
-  throw new DocmetaError(`Baseline "${source}": ${detail}`);
+
+// src/meta/core/derive/spawn.ts
+import { spawn as spawn2 } from "node:child_process";
+var DEFAULT_TIMEOUT_MS2 = 3e4;
+var MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+var BinMissing = class extends Error {
+};
+function run(bin, args, opts) {
+  return new Promise((settle, reject) => {
+    let done = false;
+    const finish = (r) => {
+      if (done) return;
+      done = true;
+      settle(r);
+    };
+    const fail = (err) => {
+      if (done) return;
+      done = true;
+      reject(err);
+    };
+    let child;
+    try {
+      child = spawn2(bin, [...opts.prefixArgs ?? [], ...args], {
+        cwd: opts.cwd,
+        windowsHide: true
+      });
+    } catch (err) {
+      fail(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let tooLarge = false;
+    const stop = (r) => {
+      clearTimeout(timer);
+      child.kill();
+      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
+      finish({ code: null, ...r });
+    };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+      if (stdout.length > MAX_OUTPUT_BYTES) {
+        tooLarge = true;
+        stop({ stdout, stderr, timedOut, tooLarge });
+      }
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+      if (stderr.length > MAX_OUTPUT_BYTES) {
+        tooLarge = true;
+        stop({ stdout, stderr, timedOut, tooLarge });
+      }
+    });
+    child.stdin.end();
+    const timer = setTimeout(() => {
+      timedOut = true;
+      stop({ stdout, stderr, timedOut, tooLarge });
+    }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      fail(err.code === "ENOENT" ? new BinMissing(err.message) : err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({ code, stdout, stderr, timedOut, tooLarge });
+    });
+  });
 }
-function parseBaseline(text, source) {
-  let raw;
+function commandLine(bin, args) {
+  return [bin, ...args].join(" ");
+}
+function lastLine(text2) {
+  const lines = text2.split(/\r?\n/).filter((l) => l.trim() !== "");
+  return lines.at(-1) ?? "";
+}
+
+// src/meta/core/derive/command.ts
+var PATH_PLACEHOLDER = "{path}";
+function isPerFile(command) {
+  return command.run.some((arg) => arg.includes(PATH_PLACEHOLDER));
+}
+function argvFor(command, label) {
+  return command.run.map((arg) => arg.split(PATH_PLACEHOLDER).join(label));
+}
+function valueOf(stdout) {
+  const text2 = stdout.trim();
+  if (text2 === "") return null;
+  if (!/^[{["]/.test(text2)) return text2;
   try {
-    raw = JSON.parse(stripBom(text));
-  } catch (err) {
-    bad(source, `invalid JSON: ${err.message}`);
-  }
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    bad(source, "top level must be an object.");
-  }
-  const obj = raw;
-  if (obj.version !== BASELINE_VERSION) {
-    bad(
-      source,
-      `unsupported version ${JSON.stringify(obj.version)} (this manni writes version ${BASELINE_VERSION}). Re-record it with \`manni meta validate --write-baseline\`.`
-    );
+    return JSON.parse(text2);
+  } catch {
+    return text2;
   }
-  const generatedWith = typeof obj.generatedWith === "string" ? obj.generatedWith : "";
-  const rawEntries = obj.entries;
-  if (typeof rawEntries !== "object" || rawEntries === null || Array.isArray(rawEntries)) {
-    bad(source, '"entries" must be an object mapping file paths to fingerprints.');
+}
+async function deriveFromCommands(inputs, commands, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const fields = Object.keys(commands);
+  if (fields.length === 0 || inputs.length === 0) {
+    return { status: { available: true }, records };
   }
-  const entries = /* @__PURE__ */ Object.create(null);
-  for (const [file, value] of Object.entries(
-    rawEntries
-  )) {
-    if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) {
-      bad(source, `entries["${file}"] must be a list of fingerprint strings.`);
-    }
-    const malformed = value.find((v) => !FINGERPRINT_RE.test(v));
-    if (malformed !== void 0) {
-      bad(
-        source,
-        `entries["${file}"] contains ${JSON.stringify(malformed)}, which is not a fingerprint (16 lowercase hex characters).`
-      );
+  for (const input of inputs) records.set(input.label, {});
+  for (const field of fields) {
+    const command = commands[field];
+    if (command === void 0) continue;
+    if (isPerFile(command)) {
+      for (const [label, record] of records) {
+        const outcome = await runOne(field, argvFor(command, label), command.timeoutMs, opts);
+        if ("reason" in outcome) return unavailable2(outcome.reason);
+        record[field] = outcome.value;
+      }
+    } else {
+      const outcome = await runOne(field, command.run, command.timeoutMs, opts);
+      if ("reason" in outcome) return unavailable2(outcome.reason);
+      for (const record of records.values()) record[field] = outcome.value;
     }
-    entries[file] = value;
   }
-  return { version: BASELINE_VERSION, generatedWith, entries };
+  return { status: { available: true }, records };
 }
-async function readBaseline(absPath, source) {
-  let text;
-  try {
-    text = await readFile5(absPath, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    throw new DocmetaError(
-      `Baseline "${source}" could not be read: ${err.message}`
-    );
-  }
-  return parseBaseline(text, source);
+function unavailable2(reason) {
+  return { status: { available: false, reason }, records: /* @__PURE__ */ new Map() };
 }
-async function writeBaselineFile(absPath, baseline, source) {
+async function runOne(field, argv, timeoutMs, opts) {
+  const [program, ...args] = argv;
+  const where = `(derive.commands.${field})`;
+  if (program === void 0) {
+    return { reason: `no program to run ${where}` };
+  }
+  const line = argv.join(" ");
+  let result;
   try {
-    await writeFileAtomic(absPath, serializeBaseline(baseline));
+    result = await run(opts.spawn?.bin ?? program, args, {
+      ...opts.spawn,
+      cwd: opts.spawn?.cwd ?? opts.cwd,
+      timeoutMs
+    });
   } catch (err) {
-    throw new DocmetaError(
-      `Baseline "${source}" could not be written: ${err.message}`
+    if (err instanceof BinMissing) {
+      return { reason: `\`${program}\` is not on PATH ${where}` };
+    }
+    return { reason: `\`${line}\` could not be run: ${errorMessage(err)} ${where}` };
+  }
+  if (result.timedOut) {
+    return { reason: `\`${line}\` timed out after ${String(timeoutMs / 1e3)}s ${where}` };
+  }
+  if (result.tooLarge) {
+    return {
+      reason: `\`${line}\` wrote more than ${String(MAX_OUTPUT_BYTES / (1024 * 1024))} MiB; a command reports one field's value ${where}`
+    };
+  }
+  if (result.code !== 0) {
+    const last = lastLine(result.stderr);
+    const detail = last === "" ? "no output on stderr" : last;
+    const exit = result.code === null ? "killed by a signal" : `exit ${String(result.code)}`;
+    return { reason: `\`${line}\` failed (${exit}): ${detail} ${where}` };
+  }
+  const value = valueOf(result.stdout);
+  return { value: value === null ? null : { value, source: "command", evidence: line } };
+}
+
+// src/meta/core/derive/reviews.ts
+import { resolve as resolvePath3 } from "node:path";
+function parseOriginUrl(url) {
+  const trimmed = url.trim();
+  if (trimmed === "") return null;
+  if (isLocalPath(trimmed)) return null;
+  const scp = /^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(trimmed);
+  if (scp) {
+    const host = scp[1];
+    const path = scp[2];
+    if (host === void 0 || path === void 0) return null;
+    if (/^[A-Za-z]$/.test(host)) return null;
+    return project(host, path);
+  }
+  let parsed2;
+  try {
+    parsed2 = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (!/^(https?|ssh|git):$/.test(parsed2.protocol)) return null;
+  if (parsed2.hostname === "") return null;
+  return project(parsed2.hostname, parsed2.pathname);
+}
+function isLocalPath(s) {
+  return s.startsWith("/") || s.startsWith("./") || s.startsWith("../") || s.startsWith("\\\\");
+}
+function project(host, path) {
+  const segments = path.replace(/\.git$/, "").split("/").filter((s) => s !== "");
+  if (segments.length < 2) return null;
+  return { host, project: segments.join("/") };
+}
+function identityFromOrigin(host, project2, requested) {
+  const name2 = host.toLowerCase();
+  if (name2.includes("github")) return { kind: "github", host, project: project2 };
+  if (name2.includes("gitlab")) return { kind: "gitlab", host, project: project2 };
+  const only = requested !== void 0 && requested.length === 1 ? requested[0] : void 0;
+  return only === void 0 ? null : { kind: only, host, project: project2 };
+}
+var UnknownHostClient = class {
+  constructor(host) {
+    this.host = host;
+  }
+  host;
+  detect() {
+    return Promise.resolve(null);
+  }
+  status() {
+    return Promise.resolve({
+      available: false,
+      reason: `the origin remote is ${this.host}, which names neither GitHub nor GitLab; list exactly one of github, gitlab in derive.sources to say which it is`
+    });
+  }
+  mergedChangeFor() {
+    return Promise.resolve(null);
+  }
+};
+function httpStatus(stderr) {
+  const m = /\b(?:HTTP\s+(\d{3})|(\d{3})\s+Not\s+Found)\b/i.exec(stderr);
+  const code = m?.[1] ?? m?.[2];
+  return code === void 0 ? null : Number(code);
+}
+function isNotFound(r) {
+  const status = httpStatus(r.stderr);
+  return status === 404 || status === 422;
+}
+var CliClient = class {
+  constructor(identity, spawnOpts) {
+    this.identity = identity;
+    this.spawnOpts = spawnOpts;
+  }
+  identity;
+  spawnOpts;
+  detect() {
+    return Promise.resolve(this.identity);
+  }
+  async status() {
+    if (this.identity === null) {
+      return { available: false, reason: "no origin remote to tell GitHub from GitLab" };
+    }
+    const { host } = this.identity;
+    let r;
+    try {
+      r = await this.run(["auth", "status", "--hostname", host]);
+    } catch (err) {
+      if (err instanceof BinMissing) {
+        return {
+          available: false,
+          reason: `${this.tool} is not on PATH (origin is ${host}); install ${this.tool} and run ${this.tool} auth login`
+        };
+      }
+      throw err;
+    }
+    if (r.timedOut) throw this.timeout(["auth", "status", "--hostname", host]);
+    if (r.code !== 0) {
+      return {
+        available: false,
+        reason: `${this.tool} is not authenticated for ${host}; run ${this.tool} auth login`
+      };
+    }
+    return { available: true };
+  }
+  async mergedChangeFor(sha) {
+    if (this.identity === null) return null;
+    return this.lookup(this.identity, sha);
+  }
+  get bin() {
+    return this.spawnOpts.bin ?? this.tool;
+  }
+  run(args) {
+    return run(this.bin, args, this.spawnOpts);
+  }
+  timeout(args) {
+    const ms = this.spawnOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+    return new DocmetaError(
+      `${commandLine(this.tool, args)} timed out after ${ms}ms`
+    );
+  }
+  /**
+   * Run a call whose stdout is JSON. A not-found answer is `null`; any other
+   * failure throws, naming the command the user can re-run by hand. The
+   * message quotes the tool's own name rather than `bin`, which under test
+   * is `node`.
+   */
+  async json(args) {
+    let r;
+    try {
+      r = await this.run(args);
+    } catch (err) {
+      if (err instanceof BinMissing) {
+        throw new DocmetaError(
+          `${commandLine(this.tool, args)} failed: ${this.tool} is not on PATH`
+        );
+      }
+      throw err;
+    }
+    const cmd = commandLine(this.tool, args);
+    if (r.timedOut) throw this.timeout(args);
+    if (r.tooLarge) {
+      throw new DocmetaError(`${cmd} wrote more output than manni will read`);
+    }
+    if (r.code !== 0) {
+      if (isNotFound(r)) return null;
+      const detail = lastLine(r.stderr) || lastLine(r.stdout);
+      const exit = r.code === null ? "signal" : `exit ${r.code}`;
+      throw new DocmetaError(
+        `${cmd} failed (${exit})${detail === "" ? "" : `: ${detail}`}`
+      );
+    }
+    try {
+      return JSON.parse(r.stdout);
+    } catch {
+      throw new DocmetaError(`${cmd} did not return JSON`);
+    }
+  }
+};
+function isRecord2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function items(v) {
+  return Array.isArray(v) ? v.filter(isRecord2) : [];
+}
+function numberOf(v) {
+  return typeof v === "number" && Number.isInteger(v) ? v : null;
+}
+function stringOf(v) {
+  return typeof v === "string" && v !== "" ? v : null;
+}
+function timestampOf(v) {
+  if (v === void 0) return void 0;
+  return stringOf(v);
+}
+function normalizeLogin(login) {
+  return login.replace(/\[bot\]$/, "");
+}
+function latestApprovals(reviews) {
+  const latest = /* @__PURE__ */ new Map();
+  for (const r of reviews) {
+    if (r.state !== "APPROVED") continue;
+    const key = normalizeLogin(r.login);
+    const seen = latest.get(key);
+    if (seen === void 0 || r.submittedAt > seen.submittedAt) {
+      latest.set(key, { login: r.login, submittedAt: r.submittedAt });
+    }
+  }
+  return byTime([...latest.values()]);
+}
+function byTime(approvals) {
+  return [...approvals].sort(
+    (a, b) => a.submittedAt < b.submittedAt ? -1 : a.submittedAt > b.submittedAt ? 1 : 0
+  );
+}
+var GitHubClient = class extends CliClient {
+  tool = "gh";
+  async lookup(identity, sha) {
+    const { host, project: project2 } = identity;
+    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
+    let candidates = items(await api(`repos/${project2}/commits/${sha}/pulls`)).map(
+      (p) => ({ number: numberOf(p.number), mergedAt: timestampOf(p.merged_at) })
+    );
+    if (candidates.length === 0) {
+      const found = await this.json([
+        "pr",
+        "list",
+        "--search",
+        sha,
+        "--state",
+        "merged",
+        "--json",
+        "number,mergedAt",
+        "-R",
+        `${host}/${project2}`
+      ]);
+      candidates = items(found).map((p) => ({
+        number: numberOf(p.number),
+        mergedAt: timestampOf(p.mergedAt)
+      }));
+    }
+    for (const c of candidates) {
+      if (c.number === null) continue;
+      let mergedAt = c.mergedAt;
+      if (mergedAt === void 0) {
+        const pr = await api(`repos/${project2}/pulls/${c.number}`);
+        mergedAt = isRecord2(pr) ? stringOf(pr.merged_at) ?? null : null;
+      }
+      if (mergedAt === null) continue;
+      const raw = [];
+      for (let page = 1; ; page += 1) {
+        const batch = items(
+          await api(`repos/${project2}/pulls/${c.number}/reviews?per_page=100&page=${page}`)
+        );
+        raw.push(...batch);
+        if (batch.length < 100) break;
+      }
+      const reviews = raw.map((r) => ({
+        login: isRecord2(r.user) ? stringOf(r.user.login) : null,
+        state: stringOf(r.state),
+        submittedAt: stringOf(r.submitted_at)
+      })).filter(
+        (r) => r.login !== null && r.state !== null && r.submittedAt !== null
+      );
+      return { id: c.number, mergedAt, approvals: latestApprovals(reviews) };
+    }
+    return null;
+  }
+};
+var GitLabClient = class extends CliClient {
+  tool = "glab";
+  async lookup(identity, sha) {
+    const { host } = identity;
+    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
+    const merged = items(
+      await api(`projects/:fullpath/repository/commits/${sha}/merge_requests`)
+    ).map((mr) => ({ iid: numberOf(mr.iid), mergedAt: stringOf(mr.merged_at) })).find(
+      (mr) => mr.iid !== null && mr.mergedAt !== null
+    );
+    if (merged === void 0) return null;
+    const answer = await api(`projects/:fullpath/merge_requests/${merged.iid}/approvals`);
+    const approvedBy = isRecord2(answer) ? items(answer.approved_by) : [];
+    const approvals = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of approvedBy) {
+      const login = isRecord2(entry.user) ? stringOf(entry.user.username) : null;
+      if (login === null) continue;
+      const key = normalizeLogin(login);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      approvals.push({ login, submittedAt: merged.mergedAt });
+    }
+    return { id: merged.iid, mergedAt: merged.mergedAt, approvals };
+  }
+};
+async function createReviewClient(root, opts) {
+  const spawnOpts = { ...opts.spawn, cwd: opts.spawn?.cwd ?? root };
+  const origin = await originUrl(root);
+  const parsed2 = origin === null ? null : parseOriginUrl(origin);
+  const identity = parsed2 === null ? null : identityFromOrigin(parsed2.host, parsed2.project, opts.requested);
+  if (parsed2 !== null && identity === null) return new UnknownHostClient(parsed2.host);
+  const client = identity?.kind === "gitlab" ? new GitLabClient(identity, spawnOpts) : new GitHubClient(identity, spawnOpts);
+  const cache = new ReviewCache(resolvePath3(root, opts.cacheDir), opts.cache);
+  return cachedClient(client, cache, identity);
+}
+async function originUrl(root) {
+  try {
+    const r = await run("git", ["remote", "get-url", "origin"], { cwd: root });
+    if (r.code !== 0 || r.timedOut || r.tooLarge) return null;
+    return stringOf(r.stdout.trim());
+  } catch {
+    return null;
+  }
+}
+var NOTHING = { "reviewed-by": null, "last-reviewed": null };
+async function deriveFromReviews(inputs, client) {
+  const records = /* @__PURE__ */ new Map();
+  const status = await client.status();
+  if (!status.available) return { status, records };
+  const identity = await client.detect();
+  const kind = identity?.kind ?? "github";
+  const bySha = /* @__PURE__ */ new Map();
+  const changeFor = (sha) => {
+    let pending = bySha.get(sha);
+    if (pending === void 0) {
+      pending = client.mergedChangeFor(sha);
+      bySha.set(sha, pending);
+    }
+    return pending;
+  };
+  for (const input of inputs) {
+    if (input.sha === null) {
+      records.set(input.label, NOTHING);
+      continue;
+    }
+    const change2 = await changeFor(input.sha);
+    records.set(input.label, factsFrom(change2, kind));
+  }
+  return { status, records };
+}
+function factsFrom(change2, kind) {
+  if (change2 === null || change2.approvals.length === 0) return NOTHING;
+  const ordered = byTime(change2.approvals);
+  const latest = ordered.at(-1);
+  if (latest === void 0) return NOTHING;
+  const evidence = kind === "gitlab" ? `gitlab MR !${change2.id}` : `github PR #${change2.id}`;
+  const dateEvidence = kind === "gitlab" ? `${evidence} (merge date; GitLab records no approval time)` : evidence;
+  return {
+    "reviewed-by": {
+      value: ordered.map((a) => a.login),
+      source: kind,
+      evidence
+    },
+    "last-reviewed": {
+      value: utcDate(latest.submittedAt),
+      source: kind,
+      evidence: dateEvidence
+    }
+  };
+}
+function utcDate(iso) {
+  const ms = Date.parse(iso);
+  if (Number.isNaN(ms)) return iso;
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+// src/meta/core/derive/index.ts
+import { dirname as dirname7, resolve as resolve9 } from "node:path";
+
+// src/meta/core/derive/codeowners.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { readFile as readFile5 } from "node:fs/promises";
+import { dirname as dirname5, relative as relative7, resolve as resolve8, sep as sep4 } from "node:path";
+import picomatch4 from "picomatch";
+var CODEOWNERS_LOCATIONS = [
+  ".github/CODEOWNERS",
+  "CODEOWNERS",
+  "docs/CODEOWNERS",
+  ".gitlab/CODEOWNERS"
+];
+function findCodeowners(root, explicit) {
+  if (explicit !== void 0) {
+    const path = resolve8(root, explicit);
+    return existsSync2(path) ? path : null;
+  }
+  for (const loc of CODEOWNERS_LOCATIONS) {
+    const path = resolve8(root, ...loc.split("/"));
+    if (existsSync2(path)) return path;
+  }
+  return null;
+}
+var SECTION_HEADER = /^(\^?)\[([^\]]+)\](?:\[(\d+)\])?(.*)$/;
+var TOKEN = /(?:\\.|[^\s\\])+/g;
+function parseCodeowners(text2, path, label) {
+  const rules = [];
+  const sections = [];
+  let current;
+  const lines = text2.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const raw = lines[i] ?? "";
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[") || line.startsWith("^[")) {
+      const m = SECTION_HEADER.exec(line);
+      if (!m) continue;
+      const [, caret, rawName, approvals, rest] = m;
+      const name2 = (rawName ?? "").trim();
+      if (name2 === "") continue;
+      const owners2 = tokens(rest ?? "");
+      const existing = sections.find(
+        (s) => s.name.toLowerCase() === name2.toLowerCase()
+      );
+      if (existing) {
+        if (owners2.length > 0) existing.defaultOwners = owners2;
+        current = existing;
+        continue;
+      }
+      const section = {
+        name: name2,
+        optional: caret === "^",
+        ...approvals !== void 0 ? { approvals: Number(approvals) } : {},
+        defaultOwners: owners2
+      };
+      sections.push(section);
+      current = section;
+      continue;
+    }
+    const [first, ...owners] = tokens(line);
+    if (first === void 0) continue;
+    const pattern = unescapePattern(first);
+    if (pattern === "" || pattern === "/") continue;
+    rules.push({
+      pattern,
+      owners,
+      line: i + 1,
+      ...current ? { section: current.name } : {}
+    });
+  }
+  return { path, label, rules, sections };
+}
+function tokens(s) {
+  return s.match(TOKEN) ?? [];
+}
+function unescapePattern(token) {
+  return token.replace(/\\ /g, " ").replace(/^\\#/, "#");
+}
+function ownersFor(file, relPath) {
+  const matchers = matchersFor(file);
+  const defaults = new Map(file.sections.map((s) => [s.name, s.defaultOwners]));
+  const order = [void 0, ...file.sections.map((s) => s.name)];
+  const winners = /* @__PURE__ */ new Map();
+  file.rules.forEach((rule, i) => {
+    if (matchers[i]?.(relPath)) winners.set(rule.section, rule);
+  });
+  if (winners.size === 0) return null;
+  const owners = [];
+  let line = 0;
+  let lineFromOwner = false;
+  for (const section of order) {
+    const rule = winners.get(section);
+    if (!rule) continue;
+    const chosen = rule.owners.length > 0 ? rule.owners : (section === void 0 ? void 0 : defaults.get(section)) ?? [];
+    if (chosen.length > 0) {
+      line = rule.line;
+      lineFromOwner = true;
+    } else if (!lineFromOwner) {
+      line = rule.line;
+    }
+    for (const o of chosen) if (!owners.includes(o)) owners.push(o);
+  }
+  return { owners, line };
+}
+var matcherCache2 = /* @__PURE__ */ new WeakMap();
+function matchersFor(file) {
+  let matchers = matcherCache2.get(file);
+  if (!matchers) {
+    matchers = file.rules.map((r) => picomatch4(toGlobs(r.pattern), PICOMATCH));
+    matcherCache2.set(file, matchers);
+  }
+  return matchers;
+}
+var PICOMATCH = { dot: true, windows: false };
+function toGlobs(pattern) {
+  let p = pattern;
+  const dirOnly = p.endsWith("/");
+  if (dirOnly) p = p.slice(0, -1);
+  let anchored = false;
+  if (p.startsWith("/")) {
+    anchored = true;
+    p = p.slice(1);
+  } else if (p.includes("/") && !p.startsWith("**/")) {
+    anchored = true;
+  }
+  const base = anchored || p.startsWith("**/") ? p : `**/${p}`;
+  if (dirOnly) return [`${base}/**`];
+  const last = p.slice(p.lastIndexOf("/") + 1);
+  return /[*?[]/.test(last) ? [base] : [base, `${base}/**`];
+}
+var NOT_FOUND_REASON = `no CODEOWNERS file found (looked for ${CODEOWNERS_LOCATIONS.join(", ")})`;
+async function deriveFromCodeowners(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const explicitPath = opts.explicit === void 0 ? void 0 : resolve8(opts.configDir ?? process.cwd(), opts.explicit);
+  if (explicitPath !== void 0 && !existsSync2(explicitPath)) {
+    return {
+      status: { available: false, reason: `CODEOWNERS not found at ${explicitPath}` },
+      records
+    };
+  }
+  const byRoot = /* @__PURE__ */ new Map();
+  const rootCache = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const dir = dirname5(input.absPath);
+    let root = rootCache.get(dir);
+    if (root === void 0) {
+      root = opts.rootOf(input.absPath);
+      rootCache.set(dir, root);
+    }
+    if (root === null) continue;
+    const bucket = byRoot.get(root);
+    if (bucket) bucket.push(input);
+    else byRoot.set(root, [input]);
+  }
+  let found = 0;
+  const parsed2 = /* @__PURE__ */ new Map();
+  for (const [root, bucket] of byRoot) {
+    const path = explicitPath ?? findCodeowners(root);
+    if (path === null) {
+      for (const input of bucket) records.set(input.label, null);
+      continue;
+    }
+    found += 1;
+    const label = toPosix2(relative7(opts.configDir ?? root, path));
+    const key = `${path}\0${label}`;
+    let file = parsed2.get(key);
+    if (!file) {
+      file = readFile5(path, "utf8").then(
+        (text2) => parseCodeowners(text2, path, label)
+      );
+      parsed2.set(key, file);
+    }
+    let owners;
+    try {
+      owners = await file;
+    } catch (err) {
+      return {
+        status: {
+          available: false,
+          reason: `CODEOWNERS at ${label} could not be read: ${errorMessage(err)}`
+        },
+        records
+      };
+    }
+    for (const input of bucket) {
+      const rel = toPosix2(relative7(root, input.absPath));
+      const hit = ownersFor(owners, rel);
+      records.set(
+        input.label,
+        hit === null ? null : {
+          value: hit.owners,
+          source: "codeowners",
+          evidence: `${label}:${hit.line}`
+        }
+      );
+    }
+  }
+  if (byRoot.size === 0) {
+    return {
+      status: { available: false, reason: "no git repository contains the documents" },
+      records
+    };
+  }
+  if (found === 0 && explicitPath === void 0) {
+    return { status: { available: true, reason: NOT_FOUND_REASON }, records };
+  }
+  return { status: { available: true }, records };
+}
+function toPosix2(p) {
+  return p.split(sep4).join("/");
+}
+
+// src/meta/core/derive/git.ts
+import { constants as bufferConstants } from "node:buffer";
+import { spawn as spawn3 } from "node:child_process";
+import { dirname as dirname6, extname as extname2, relative as relative8, sep as sep5 } from "node:path";
+var DEFAULT_BULK_THRESHOLD = 32;
+var NULL_SHA = "0".repeat(40);
+var MAX_GIT_OUTPUT_BYTES = Math.min(
+  512 * 1024 * 1024,
+  bufferConstants.MAX_STRING_LENGTH
+);
+var HistoryTooLarge = class extends Error {
+};
+var BlobsUnreadable = class extends Error {
+  constructor(detail) {
+    super(detail);
+    this.detail = detail;
+  }
+  detail;
+};
+function bodyOf(content, fenced) {
+  if (fenced !== true) return content;
+  const loc = locateFrontmatter(content);
+  if (!loc) return content;
+  return content.slice(0, loc.openStart) + content.slice(loc.closeEnd);
+}
+async function deriveFromGit(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const byRoot = groupByRoot(inputs);
+  if (byRoot.size === 0) {
+    return {
+      status: {
+        available: false,
+        reason: "no git repository contains the documents"
+      },
+      records
+    };
+  }
+  const threshold = opts.bulkThreshold ?? DEFAULT_BULK_THRESHOLD;
+  const maxBytes = opts.maxOutputBytes ?? MAX_GIT_OUTPUT_BYTES;
+  const reasons = [];
+  for (const [root, bucket] of byRoot) {
+    const run2 = (args, stdin) => runGit(args, root, stdin, maxBytes);
+    const shallow = await run2(["rev-parse", "--is-shallow-repository"]);
+    if (shallow.missing) {
+      return {
+        status: { available: false, reason: "git is not on PATH" },
+        records: /* @__PURE__ */ new Map()
+      };
+    }
+    if (shallow.code !== 0) {
+      reasons.push(`git could not read the repository at ${root}`);
+      continue;
+    }
+    if (text(shallow).trim() === "true") {
+      reasons.push(
+        `this checkout is shallow; use actions/checkout with fetch-depth: 0 (${root})`
+      );
+      continue;
+    }
+    let histories;
+    let blobs;
+    try {
+      histories = bucket.length <= threshold ? await perFileHistories(run2, bucket) : await bulkHistories(run2, bucket);
+      if (histories === null) {
+        reasons.push(`git could not read the history at ${root}`);
+        continue;
+      }
+      blobs = await fetchBlobs(run2, neededBlobs(histories));
+    } catch (err) {
+      if (err instanceof BlobsUnreadable) {
+        reasons.push(`git cat-file could not read the history (${root}): ${err.detail}`);
+        continue;
+      }
+      if (!(err instanceof HistoryTooLarge)) throw err;
+      reasons.push(`git history is too large to read in one pass (${root})`);
+      continue;
+    }
+    for (const entry of bucket) {
+      const history = histories.get(entry.rel) ?? [];
+      records.set(
+        entry.input.label,
+        judge(entry.input, root, history, blobs, opts.now)
+      );
+    }
+  }
+  if (reasons.length > 0) {
+    return {
+      status: { available: false, reason: reasons.join("; ") },
+      records: /* @__PURE__ */ new Map()
+    };
+  }
+  return { status: { available: true }, records };
+}
+function groupByRoot(inputs) {
+  const rootOf = /* @__PURE__ */ new Map();
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const dir = dirname6(input.absPath);
+    let root = rootOf.get(dir);
+    if (root === void 0) {
+      root = findGitRoot(dir);
+      rootOf.set(dir, root);
+    }
+    if (root === null) continue;
+    const rel = relative8(root, input.absPath).split(sep5).join("/");
+    const bucket = byRoot.get(root);
+    if (bucket) bucket.push({ input, rel });
+    else byRoot.set(root, [{ input, rel }]);
+  }
+  return byRoot;
+}
+var RECORD_FORMAT = "--format=%x1e%H%x00%aI%x00%an%x00%ae%x00%(trailers:key=Co-authored-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Reviewed-by,valueonly,unfold,separator=%x1f)";
+var LOG_ARGS = [
+  "-c",
+  "core.quotePath=false",
+  "log",
+  "--raw",
+  "-M",
+  "--no-abbrev",
+  RECORD_FORMAT
+];
+async function perFileHistories(run2, bucket) {
+  const histories = /* @__PURE__ */ new Map();
+  for (const entry of bucket) {
+    const out = await run2([...LOG_ARGS, "--follow", "--", pathspec(entry.rel)]);
+    if (out.tooLarge) throw new HistoryTooLarge();
+    if (out.code !== 0) {
+      if (await isUnbornHead(run2)) return histories;
+      return null;
+    }
+    const attributed = attribute(parseLog(text(out)), [entry.rel]);
+    histories.set(entry.rel, attributed.get(entry.rel) ?? []);
+  }
+  return histories;
+}
+async function bulkHistories(run2, bucket) {
+  const out = await run2(LOG_ARGS);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) {
+    if (await isUnbornHead(run2)) return /* @__PURE__ */ new Map();
+    return null;
+  }
+  return attribute(
+    parseLog(text(out)),
+    bucket.map((e) => e.rel)
+  );
+}
+function pathspec(rel) {
+  return /[*?[\]]/.test(rel) ? `:(literal)${rel}` : rel;
+}
+async function isUnbornHead(run2) {
+  const out = await run2(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
+  return !out.missing && out.code !== 0;
+}
+function parseLog(text2) {
+  const records = [];
+  for (const chunk of text2.split("")) {
+    if (chunk === "") continue;
+    const nl = chunk.indexOf("\n");
+    const header = nl === -1 ? chunk : chunk.slice(0, nl);
+    const fields = header.split("\0");
+    const sha = fields[0];
+    if (sha === void 0 || sha === "") continue;
+    const raw = [];
+    if (nl !== -1) {
+      for (const line of chunk.slice(nl + 1).split("\n")) {
+        const entry = parseRawLine(line);
+        if (entry) raw.push(entry);
+      }
+    }
+    records.push({
+      sha,
+      authorDate: fields[1] ?? "",
+      authorName: fields[2] ?? "",
+      authorEmail: fields[3] ?? "",
+      coAuthors: splitTrailers(fields[4]),
+      reviewedBy: splitTrailers(fields[5]),
+      raw
+    });
+  }
+  return records;
+}
+function splitTrailers(field) {
+  if (field === void 0 || field === "") return [];
+  return field.split("").map((s) => s.trim()).filter((s) => s !== "");
+}
+function parseRawLine(line) {
+  if (!line.startsWith(":")) return null;
+  const tab = line.indexOf("	");
+  if (tab === -1) return null;
+  const meta = line.slice(1, tab).split(" ");
+  const oldBlob = meta[2];
+  const newBlob = meta[3];
+  const status = meta[4];
+  if (oldBlob === void 0 || newBlob === void 0 || status === void 0) {
+    return null;
+  }
+  const paths = line.slice(tab + 1).split("	").map(unquotePath);
+  const first = paths[0];
+  if (first === void 0) return null;
+  const second = paths[1];
+  const renamed = status.startsWith("R") || status.startsWith("C");
+  return {
+    status,
+    oldBlob,
+    newBlob,
+    oldPath: first,
+    newPath: renamed && second !== void 0 ? second : first
+  };
+}
+function unquotePath(p) {
+  if (p.length < 2 || !p.startsWith('"') || !p.endsWith('"')) return p;
+  const inner = p.slice(1, -1);
+  const bytes = [];
+  for (let i = 0; i < inner.length; i += 1) {
+    const ch = inner[i];
+    if (ch !== "\\") {
+      bytes.push(...Buffer.from(ch ?? "", "utf8"));
+      continue;
+    }
+    const next = inner[i + 1];
+    if (next === void 0) break;
+    const octal = /^[0-7]{3}/.exec(inner.slice(i + 1));
+    if (octal) {
+      bytes.push(parseInt(octal[0], 8));
+      i += 3;
+      continue;
+    }
+    const simple = {
+      a: 7,
+      b: 8,
+      t: 9,
+      n: 10,
+      v: 11,
+      f: 12,
+      r: 13,
+      '"': 34,
+      "\\": 92
+    };
+    const code = simple[next];
+    if (code === void 0) bytes.push(...Buffer.from(next, "utf8"));
+    else bytes.push(code);
+    i += 1;
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function attribute(records, wanted) {
+  const histories = /* @__PURE__ */ new Map();
+  const tracked = /* @__PURE__ */ new Map();
+  for (const rel of wanted) {
+    histories.set(rel, []);
+    tracked.set(rel, rel);
+  }
+  for (const record of records) {
+    if (record.raw.length === 0) continue;
+    const byNewPath = /* @__PURE__ */ new Map();
+    for (const entry of record.raw) byNewPath.set(entry.newPath, entry);
+    for (const [rel, current] of tracked) {
+      const entry = byNewPath.get(current);
+      if (!entry) continue;
+      histories.get(rel)?.push({
+        sha: record.sha,
+        authorDate: record.authorDate,
+        authorName: record.authorName,
+        authorEmail: record.authorEmail,
+        coAuthors: record.coAuthors,
+        reviewedBy: record.reviewedBy,
+        oldBlob: entry.oldBlob === NULL_SHA ? null : entry.oldBlob,
+        newBlob: entry.newBlob === NULL_SHA ? null : entry.newBlob,
+        pathAtCommit: entry.newPath
+      });
+      if (entry.oldPath !== entry.newPath) tracked.set(rel, entry.oldPath);
+    }
+  }
+  return histories;
+}
+function neededBlobs(histories) {
+  const shas = /* @__PURE__ */ new Set();
+  for (const history of histories.values()) {
+    for (const h of history) {
+      if (h.oldBlob !== null) shas.add(h.oldBlob);
+      if (h.newBlob !== null) shas.add(h.newBlob);
+    }
+  }
+  return shas;
+}
+async function fetchBlobs(run2, shas) {
+  const blobs = /* @__PURE__ */ new Map();
+  if (shas.size === 0) return blobs;
+  const out = await run2(["cat-file", "--batch"], `${[...shas].join("\n")}
+`);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  const buf = out.raw;
+  let cursor = 0;
+  while (cursor < buf.length) {
+    const nl = buf.indexOf(10, cursor);
+    if (nl === -1) break;
+    const header = buf.toString("utf8", cursor, nl).split(" ");
+    cursor = nl + 1;
+    const sha = header[0];
+    const kind = header[1];
+    const size = Number(header[2]);
+    if (sha === void 0 || kind !== "blob" || !Number.isFinite(size)) {
+      continue;
+    }
+    blobs.set(sha, buf.toString("utf8", cursor, cursor + size));
+    cursor += size + 1;
+  }
+  return blobs;
+}
+var git = (value, evidence) => ({
+  value,
+  source: "git",
+  evidence
+});
+function judge(input, root, history, blobs, now) {
+  const fenced = input.extracted.fenced;
+  const extractor = extractorFor(input);
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const stampsOf = (sha) => {
+    if (sha === null) return {};
+    const content = blobs.get(sha);
+    return content === void 0 ? {} : extractStamps(extractor, content, input.absPath);
+  };
+  const bodyChanging = [...history].reverse().filter((h) => !sameBody(blobBody(h.newBlob), blobBody(h.oldBlob)));
+  const oldest = history[history.length - 1];
+  const newestBody = bodyChanging[bodyChanging.length - 1];
+  const head = history[0];
+  const headBlob = head === void 0 ? null : head.newBlob;
+  const created = oldest === void 0 ? null : createdOf(oldest, stampsOf(oldest.newBlob));
+  const workingChanged = !sameBody(
+    bodyOf(input.content, fenced),
+    headBlob === null ? null : blobBody(headBlob)
+  );
+  let lastUpdated;
+  let lastBodyCommit;
+  if (workingChanged) {
+    lastBodyCommit = null;
+    const working = input.extracted.data["last-updated"];
+    const committed = stampsOf(headBlob)["last-updated"];
+    lastUpdated = working !== void 0 && working !== null && !sameValue(working, committed) ? git(working, "stamped in working tree") : git(localDate(now()), "uncommitted body change");
+  } else if (newestBody === void 0) {
+    lastBodyCommit = null;
+    lastUpdated = null;
+  } else {
+    lastBodyCommit = newestBody.sha;
+    lastUpdated = lastUpdatedOf(
+      newestBody,
+      stampsOf(newestBody.newBlob),
+      stampsOf(newestBody.oldBlob)
+    );
+  }
+  const authors = bodyChanging.length === 0 ? null : authorsOf(bodyChanging);
+  let reviewedBy = null;
+  let lastReviewed = null;
+  if (!workingChanged && newestBody !== void 0 && newestBody.reviewedBy.length > 0) {
+    const evidence = `Reviewed-by trailer in ${short(newestBody.sha)}`;
+    reviewedBy = git(newestBody.reviewedBy.map(nameOf), evidence);
+    lastReviewed = git(datePart(newestBody.authorDate), evidence);
+  }
+  return {
+    created,
+    "last-updated": lastUpdated,
+    authors,
+    "reviewed-by": reviewedBy,
+    "last-reviewed": lastReviewed,
+    lastBodyCommit,
+    root
+  };
+}
+function createdOf(oldest, stamps) {
+  const stamp = stamps["created"];
+  if (stamp !== void 0 && stamp !== null) {
+    return git(stamp, `stamped in ${short(oldest.sha)}`);
+  }
+  const date = datePart(oldest.authorDate);
+  return git(date, `added in ${short(oldest.sha)} (${date})`);
+}
+function lastUpdatedOf(commit, after, before) {
+  const stamp = after["last-updated"];
+  if (stamp !== void 0 && stamp !== null && !sameValue(stamp, before["last-updated"])) {
+    return git(stamp, `stamped in ${short(commit.sha)}`);
+  }
+  const date = datePart(commit.authorDate);
+  return git(date, `body changed in ${short(commit.sha)} (${date})`);
+}
+function authorsOf(bodyChanging) {
+  const seen = /* @__PURE__ */ new Set();
+  const names = [];
+  const add = (name2, email) => {
+    if (name2 === "" || name2.endsWith("[bot]")) return;
+    const key = email === null || email === "" ? `name:${name2.toLowerCase()}` : email.toLowerCase();
+    if (seen.has(key)) return;
+    seen.add(key);
+    names.push(name2);
+  };
+  for (const h of bodyChanging) {
+    add(h.authorName, h.authorEmail);
+    for (const co of h.coAuthors) add(nameOf(co), emailOf(co));
+  }
+  const n = bodyChanging.length;
+  return git(names, `${n} body-changing ${n === 1 ? "commit" : "commits"}`);
+}
+function extractorFor(input) {
+  return extractorByName(input.extracted.format) ?? extractorForExtension(extname2(input.absPath));
+}
+function extractStamps(extractor, content, filePath) {
+  if (!extractor) return {};
+  try {
+    return extractor.extract(content, filePath).data;
+  } catch {
+    return {};
+  }
+}
+function sameBody(a, b) {
+  if (a === null || b === null) return a === b;
+  return a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
+}
+function sameValue(a, b) {
+  return toJsonText(a) === toJsonText(b);
+}
+var short = (sha) => sha.slice(0, 7);
+var datePart = (iso) => iso.slice(0, 10);
+function localDate(d) {
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
+function nameOf(trailer) {
+  const lt = trailer.lastIndexOf("<");
+  return (lt === -1 ? trailer : trailer.slice(0, lt)).trim();
+}
+function emailOf(trailer) {
+  const m = /<([^>]*)>\s*$/.exec(trailer);
+  return m?.[1]?.trim() ?? null;
+}
+function text(out) {
+  try {
+    return out.raw.toString("utf8");
+  } catch {
+    throw new HistoryTooLarge();
+  }
+}
+function runGit(args, cwd, stdin, maxBytes) {
+  return new Promise((settle, reject) => {
+    let done = false;
+    const finish = (out) => {
+      if (done) return;
+      done = true;
+      settle(out);
+    };
+    const fail = (err) => {
+      if (done) return;
+      done = true;
+      reject(err instanceof Error ? err : new Error(String(err)));
+    };
+    const failed = (missing) => ({
+      code: null,
+      raw: Buffer.alloc(0),
+      missing,
+      tooLarge: false
+    });
+    let child;
+    try {
+      child = spawn3("git", args, { cwd, windowsHide: true });
+    } catch {
+      finish(failed(true));
+      return;
+    }
+    let chunks = [];
+    let total = 0;
+    let tooLarge = false;
+    child.stdout.on("data", (chunk) => {
+      if (tooLarge) return;
+      total += chunk.length;
+      if (total > maxBytes) {
+        tooLarge = true;
+        chunks = [];
+        child.kill();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    child.stderr.resume();
+    child.on("error", (err) => {
+      finish(failed(err.code === "ENOENT"));
+    });
+    child.stdin.on("error", () => {
+    });
+    child.on("close", (code) => {
+      try {
+        const raw = tooLarge ? Buffer.alloc(0) : Buffer.concat(chunks);
+        finish({ code, raw, missing: false, tooLarge });
+      } catch (err) {
+        fail(err);
+      }
+    });
+    if (stdin === void 0) child.stdin.end();
+    else child.stdin.end(stdin);
+  });
+}
+
+// src/meta/core/derive/index.ts
+var FIELD_SOURCES = {
+  created: ["git"],
+  "last-updated": ["git"],
+  authors: ["git"],
+  owner: ["codeowners"],
+  "reviewed-by": ["github", "gitlab", "git"],
+  "last-reviewed": ["github", "gitlab", "git"]
+};
+var REVIEW_SOURCES = ["github", "gitlab"];
+var HOST_NAME = {
+  github: "GitHub",
+  gitlab: "GitLab"
+};
+function sourcesFor(field, commands) {
+  if (isBuiltinField(field)) return FIELD_SOURCES[field];
+  if (commands !== void 0 && Object.hasOwn(commands, field)) return ["command"];
+  return [];
+}
+function consultedSources(fields, sources, commands) {
+  const needed = /* @__PURE__ */ new Set();
+  for (const field of fields) {
+    for (const s of sourcesFor(field, commands)) needed.add(s);
+  }
+  return sources.filter((s) => needed.has(s));
+}
+function assertSourcesAvailable(sources, hint) {
+  for (const name2 of Object.keys(sources)) {
+    const status = sources[name2];
+    if (status === void 0 || status.available) continue;
+    const reason = status.reason ?? "it could not answer";
+    throw new DocmetaError(
+      `${name2} source unavailable: ${reason}${hint === void 0 ? "" : `; ${hint}`}`
+    );
+  }
+}
+async function deriveMetadata(inputs, ctx) {
+  const consulted = new Set(consultedSources(ctx.fields, ctx.sources, ctx.commands));
+  const sources = {};
+  let git2 = /* @__PURE__ */ new Map();
+  if (consulted.has("git")) {
+    const result = await deriveFromGit(inputs, { cwd: ctx.cwd, now: ctx.now });
+    sources.git = result.status;
+    git2 = result.records;
+  }
+  const rootCache = /* @__PURE__ */ new Map();
+  const rootOf = (absPath) => {
+    const dir = dirname7(absPath);
+    let root = rootCache.get(dir);
+    if (root === void 0) {
+      root = findGitRoot(dir);
+      rootCache.set(dir, root);
+    }
+    return root;
+  };
+  const rootFor = (input) => git2.get(input.label)?.root ?? rootOf(input.absPath);
+  let owners = /* @__PURE__ */ new Map();
+  if (consulted.has("codeowners")) {
+    const result = await deriveFromCodeowners(inputs, {
+      explicit: ctx.codeowners,
+      configDir: ctx.configDir,
+      rootOf
+    });
+    sources.codeowners = result.status;
+    owners = result.records;
+  }
+  const requested = REVIEW_SOURCES.filter((s) => consulted.has(s));
+  let reviews = /* @__PURE__ */ new Map();
+  if (requested.length > 0) {
+    if (!consulted.has("git")) {
+      for (const s of requested) {
+        sources[s] = {
+          available: false,
+          reason: `the ${s} source needs the git source to find each document's commits; add git to sources`
+        };
+      }
+    } else if (sources.git?.available === false) {
+      for (const s of requested) {
+        sources[s] = {
+          available: false,
+          reason: `the git source could not answer, so the ${s} source cannot locate any commit`
+        };
+      }
+    } else {
+      const result = await deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested);
+      Object.assign(sources, result.status);
+      reviews = result.records;
+    }
+  }
+  let commanded = /* @__PURE__ */ new Map();
+  const doomed = Object.values(sources).some((s) => !s.available);
+  if (consulted.has("command") && ctx.commands !== void 0 && !doomed) {
+    const wanted = new Set(ctx.fields);
+    const commands = Object.fromEntries(
+      Object.entries(ctx.commands).filter(([field]) => wanted.has(field))
+    );
+    if (Object.keys(commands).length > 0) {
+      const result = await deriveFromCommands(inputs, commands, { cwd: ctx.configDir ?? ctx.cwd });
+      sources.command = result.status;
+      commanded = result.records;
+    }
+  }
+  const records = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const fields = {};
+    const g = git2.get(input.label);
+    const r = reviews.get(input.label);
+    const c = commanded.get(input.label);
+    for (const field of ctx.fields) {
+      let value = null;
+      for (const source of sourcesFor(field, ctx.commands)) {
+        if (!consulted.has(source)) continue;
+        const candidate = valueFrom(source, field, g, r, owners.get(input.label), c);
+        if (candidate !== null) {
+          value = candidate;
+          break;
+        }
+      }
+      fields[field] = value;
+    }
+    records.set(input.label, { file: input.label, fields });
+  }
+  return { records, sources };
+}
+function valueFrom(source, field, git2, reviews, owner, commanded) {
+  switch (source) {
+    case "git":
+      if (git2 === void 0 || !isBuiltinField(field) || field === "owner") return null;
+      return git2[field];
+    case "command":
+      return commanded?.[field] ?? null;
+    case "codeowners":
+      return field === "owner" ? owner ?? null : null;
+    case "github":
+    case "gitlab": {
+      if (reviews === void 0) return null;
+      if (field !== "reviewed-by" && field !== "last-reviewed") return null;
+      const fact = reviews[field];
+      return fact !== null && fact.source === source ? fact : null;
+    }
+  }
+}
+async function deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested) {
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const root = rootFor(input);
+    if (root === null) continue;
+    const bucket = byRoot.get(root) ?? [];
+    bucket.push(input);
+    byRoot.set(root, bucket);
+  }
+  const status = {};
+  const records = /* @__PURE__ */ new Map();
+  const unavailable3 = (which, reason) => {
+    for (const s of which) status[s] = { available: false, reason };
+    return { status, records: /* @__PURE__ */ new Map() };
+  };
+  if (byRoot.size === 0) {
+    return unavailable3(requested, "no git repository contains the documents");
+  }
+  const cacheDir = resolve9(ctx.configDir ?? ctx.cwd, REVIEW_CACHE_DIR);
+  for (const [root, bucket] of byRoot) {
+    const client = ctx.reviews ?? await createReviewClient(root, { cwd: ctx.cwd, cache: ctx.cache, cacheDir, requested });
+    const identity = await client.detect();
+    if (identity === null) {
+      const s = await client.status();
+      return unavailable3(requested, s.reason ?? "no origin remote to tell GitHub from GitLab");
+    }
+    const source = identity.kind;
+    if (!requested.includes(source)) {
+      return unavailable3(
+        requested,
+        `the origin remote is ${identity.host}, which is ${HOST_NAME[source]}; add ${source} to sources, or drop reviewed-by and last-reviewed from the managed fields`
+      );
+    }
+    const result = await deriveFromReviews(
+      bucket.map((input) => ({
+        label: input.label,
+        sha: git2.get(input.label)?.lastBodyCommit ?? null
+      })),
+      client
+    );
+    if (!result.status.available) {
+      status[source] = result.status;
+      return { status, records: /* @__PURE__ */ new Map() };
+    }
+    status[source] = result.status;
+    for (const [label, facts] of result.records) records.set(label, facts);
+  }
+  return { status, records };
+}
+
+// src/meta/core/derive/config.ts
+var DEFAULT_COMMAND_TIMEOUT_MS = 6e4;
+function commandsOf(config) {
+  if (config?.commands === void 0) return void 0;
+  const out = {};
+  for (const [field, c] of Object.entries(config.commands)) {
+    out[field] = {
+      run: c.run,
+      timeoutMs: c.timeout === void 0 ? DEFAULT_COMMAND_TIMEOUT_MS : Math.round(c.timeout * 1e3)
+    };
+  }
+  return out;
+}
+
+// src/meta/core/derive/table.ts
+var DERIVED_VIEW = "derived";
+var DERIVED_ROWS = "_derived_rows";
+var RESOLVED_VIEW = "resolved";
+var ORIGIN_COLUMN = "_origin";
+var SOURCES_COLUMN = "_sources";
+function derivedColumns(commands) {
+  return ["_path", ...derivableFields(commands), SOURCES_COLUMN];
+}
+function mentionsDerived(sql) {
+  return /\b(?:from|join|update|into|table|view)\s+(?:"derived"|derived\b)/i.test(sql);
+}
+function fieldsForSql(sql, fields) {
+  if (sql.includes("*") || /\b_(?:sources|origin)\b/i.test(sql)) return [...fields];
+  return fields.filter(
+    (field) => new RegExp(`(?<![\\w-])${escapeRegExp(field)}(?![\\w-])`, "i").test(sql)
+  );
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function createDerivedView(db, records, columns) {
+  const quoted = columns.map(quoteIdent);
+  db.exec(
+    `CREATE TABLE ${DERIVED_ROWS} (${quoted.map((c, i) => i === 0 ? `${c} TEXT PRIMARY KEY` : `${c} TEXT`).join(", ")})`
+  );
+  const insert = db.prepare(
+    `INSERT INTO ${DERIVED_ROWS} VALUES (${quoted.map(() => "?").join(", ")})`
+  );
+  const fields = columns.slice(1, -1);
+  db.exec("BEGIN");
+  let committed = false;
+  try {
+    for (const [label, record] of records) {
+      const sources = {};
+      const values = fields.map((field) => {
+        const derived = record.fields[field];
+        if (derived == null) return null;
+        sources[field] = { source: derived.source, evidence: derived.evidence };
+        return bindValue(derived.value);
+      });
+      insert.run(label, ...values, JSON.stringify(sources));
+    }
+    db.exec("COMMIT");
+    committed = true;
+  } finally {
+    if (!committed) db.exec("ROLLBACK");
+  }
+  db.exec(`CREATE VIEW ${DERIVED_VIEW} AS SELECT * FROM ${DERIVED_ROWS}`);
+}
+function resolvedColumns(docsColumns, commands) {
+  const columns = ["_path"];
+  const seen = /* @__PURE__ */ new Set(["_path", ORIGIN_COLUMN, SOURCES_COLUMN]);
+  for (const column of docsColumns) {
+    if (seen.has(column) || RESERVED.has(column)) continue;
+    seen.add(column);
+    columns.push(column);
+  }
+  for (const field of derivableFields(commands)) {
+    if (seen.has(field)) continue;
+    seen.add(field);
+    columns.push(field);
+  }
+  columns.push(ORIGIN_COLUMN, SOURCES_COLUMN);
+  return columns;
+}
+function mentionsResolved(sql) {
+  return /\b(?:from|join|update|into|table|view)\s+(?:"resolved"|resolved\b)/i.test(sql);
+}
+function jsonPath(field) {
+  return `$.${JSON.stringify(field)}`;
+}
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function createResolvedView(db, docsColumns, commands) {
+  const columns = resolvedColumns(docsColumns, commands);
+  const fields = columns.slice(1, -2);
+  const inDocs = new Set(docsColumns);
+  const inDerived = new Set(derivableFields(commands));
+  const selects = [`d.${quoteIdent("_path")} AS ${quoteIdent("_path")}`];
+  const origin = [];
+  for (const field of fields) {
+    const path = sqlString(jsonPath(field));
+    const asserted = `json_type(d.${quoteIdent("_data")}, ${path}) IS NOT NULL`;
+    const assertedValue = inDocs.has(field) ? `d.${quoteIdent(field)}` : `d.${quoteIdent("_data")} ->> ${path}`;
+    if (inDerived.has(field)) {
+      const derivedValue = `r.${quoteIdent(field)}`;
+      selects.push(
+        `CASE WHEN ${asserted} THEN ${assertedValue} ELSE ${derivedValue} END AS ${quoteIdent(field)}`
+      );
+      origin.push(
+        `${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' WHEN ${derivedValue} IS NOT NULL THEN 'derived' END`
+      );
+    } else {
+      selects.push(`${assertedValue} AS ${quoteIdent(field)}`);
+      origin.push(`${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' END`);
+    }
+  }
+  selects.push(
+    `json_patch('{}', json_object(${origin.join(", ")})) AS ${quoteIdent(ORIGIN_COLUMN)}`
+  );
+  selects.push(`r.${quoteIdent(SOURCES_COLUMN)} AS ${quoteIdent(SOURCES_COLUMN)}`);
+  db.exec(
+    `CREATE VIEW ${RESOLVED_VIEW} AS SELECT ${selects.join(", ")} FROM docs d LEFT JOIN ${DERIVED_ROWS} r USING (${quoteIdent("_path")})`
+  );
+}
+async function deriveForTable(inputs, ctx, hint, fields) {
+  const derive = ctx.config?.derive;
+  const commands = commandsOf(derive);
+  const result = await deriveMetadata(inputs, {
+    cwd: ctx.cwd,
+    base: ctx.base,
+    ...ctx.configDir !== void 0 ? { configDir: ctx.configDir } : {},
+    sources: derive?.sources ?? [...DERIVE_SOURCES],
+    fields,
+    ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
+    ...commands !== void 0 ? { commands } : {},
+    cache: ctx.cache,
+    now: ctx.now ?? (() => /* @__PURE__ */ new Date())
+  });
+  assertSourcesAvailable(result.sources, hint);
+  return result.records;
+}
+
+// src/meta/commands/validate.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { readFile as readFile7 } from "node:fs/promises";
+import { resolve as resolve11, extname as extname3 } from "node:path";
+
+// src/meta/core/baseline.ts
+import { createHash as createHash4 } from "node:crypto";
+import { readFile as readFile6 } from "node:fs/promises";
+import { relative as relative9, resolve as resolve10 } from "node:path";
+var DEFAULT_BASELINE_PATH = ".manni-baseline.json";
+var LEGACY_BASELINE_PATH = ".docmeta-baseline.json";
+var BASELINE_VERSION = 1;
+var FINGERPRINT_RE = /^[0-9a-f]{16}$/;
+function canonicalFilePath(file, ctx) {
+  if (!ctx) return file;
+  const from = ctx.runBase ?? ctx.base;
+  return relative9(ctx.base, resolve10(from, file)).replace(/\\/g, "/");
+}
+function canonicalSchemaRef(ref, ctx) {
+  if (!ctx) return ref;
+  if (classifyRef(ref).kind !== "file") return ref;
+  const abs = resolve10(ctx.cwd, ref);
+  return relative9(ctx.base, abs).replace(/\\/g, "/");
+}
+function fingerprint(e, ctx) {
+  const parts = [
+    canonicalSchemaRef(e.schema, ctx),
+    e.instancePath,
+    e.keyword,
+    e.subject ?? ""
+  ];
+  return createHash4("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
+}
+function serializeBaseline(baseline) {
+  const entries = /* @__PURE__ */ Object.create(null);
+  for (const file of Object.keys(baseline.entries).sort()) {
+    entries[file] = [...baseline.entries[file] ?? []].sort();
+  }
+  return `${JSON.stringify(
+    {
+      version: baseline.version,
+      generatedWith: baseline.generatedWith,
+      entries
+    },
+    null,
+    2
+  )}
+`;
+}
+function bad(source, detail) {
+  throw new DocmetaError(`Baseline "${source}": ${detail}`);
+}
+function parseBaseline(text2, source) {
+  let raw;
+  try {
+    raw = JSON.parse(stripBom(text2));
+  } catch (err) {
+    bad(source, `invalid JSON: ${errorMessage(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    bad(source, "top level must be an object.");
+  }
+  const obj = raw;
+  if (obj.version !== BASELINE_VERSION) {
+    bad(
+      source,
+      `unsupported version ${JSON.stringify(obj.version)} (this manni writes version ${BASELINE_VERSION}). Re-record it with \`manni meta validate --write-baseline\`.`
+    );
+  }
+  const generatedWith = typeof obj.generatedWith === "string" ? obj.generatedWith : "";
+  const rawEntries = obj.entries;
+  if (typeof rawEntries !== "object" || rawEntries === null || Array.isArray(rawEntries)) {
+    bad(source, '"entries" must be an object mapping file paths to fingerprints.');
+  }
+  const entries = /* @__PURE__ */ Object.create(null);
+  for (const [file, value] of Object.entries(
+    rawEntries
+  )) {
+    if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) {
+      bad(source, `entries["${file}"] must be a list of fingerprint strings.`);
+    }
+    const malformed = value.find((v) => !FINGERPRINT_RE.test(v));
+    if (malformed !== void 0) {
+      bad(
+        source,
+        `entries["${file}"] contains ${JSON.stringify(malformed)}, which is not a fingerprint (16 lowercase hex characters).`
+      );
+    }
+    entries[file] = value;
+  }
+  return { version: BASELINE_VERSION, generatedWith, entries };
+}
+async function readBaseline(absPath, source) {
+  let text2;
+  try {
+    text2 = await readFile6(absPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw new DocmetaError(
+      `Baseline "${source}" could not be read: ${errorMessage(err)}`
+    );
+  }
+  return parseBaseline(text2, source);
+}
+async function writeBaselineFile(absPath, baseline, source) {
+  try {
+    await writeFileAtomic(absPath, serializeBaseline(baseline));
+  } catch (err) {
+    throw new DocmetaError(
+      `Baseline "${source}" could not be written: ${errorMessage(err)}`
     );
   }
 }
@@ -7560,8 +9494,8 @@ function synthesizeMessage(extras, row) {
   const pairs = extras.flatMap((c) => {
     const value = row[c];
     if (value === null || value === void 0) return [];
-    const text = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : JSON.stringify(value);
-    return [`${c}=${text}`];
+    const text2 = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : JSON.stringify(value);
+    return [`${c}=${text2}`];
   });
   return pairs.length > 0 ? pairs.join(", ") : "check matched";
 }
@@ -7571,9 +9505,26 @@ async function runChecks(checks, entries, ctx = {}) {
   const { DatabaseSync } = await loadSqlite();
   const db = new DatabaseSync(":memory:");
   try {
-    createDocsTable(db, entries, corpusDataColumns(entries));
+    const dataColumns = corpusDataColumns(entries);
+    createDocsTable(db, entries, dataColumns);
     registerLineFor(db, entries);
     createCollectionViews(db, collectCollections(entries, ctx));
+    const wantsDerived = checks.filter(
+      (c) => mentionsDerived(c.query) || mentionsResolved(c.query)
+    );
+    if (wantsDerived.length > 0) {
+      if (ctx.derive === void 0) {
+        throw new DocmetaError(
+          `check "${wantsDerived[0]?.name ?? ""}": the SQL names the derived or resolved table, but this run cannot derive. Run it through \`manni meta validate\`, or drop the reference.`
+        );
+      }
+      const commands = ctx.commands;
+      const readable = derivableFields(commands);
+      const fields = /* @__PURE__ */ new Set();
+      for (const c of wantsDerived) for (const f of fieldsForSql(c.query, readable)) fields.add(f);
+      createDerivedView(db, await ctx.derive([...fields]), derivedColumns(commands));
+      createResolvedView(db, dataColumns, commands);
+    }
     db.exec("PRAGMA query_only = 1");
     const loaded = new Set(entries.map((e) => e.label));
     for (const check of checks) {
@@ -7583,17 +9534,17 @@ async function runChecks(checks, entries, ctx = {}) {
           `check "${check.name}": ${head.split(/\s/, 1)[0]?.toUpperCase() ?? "that statement"} is refused: it can write outside the docs table.`
         );
       }
-      let tokens;
+      let tokens2;
       try {
-        tokens = collectNamedParameters(check.query);
+        tokens2 = collectNamedParameters(check.query);
       } catch (err) {
         throw new DocmetaError(
-          `check "${check.name}": ${err.message}`
+          `check "${check.name}": ${errorMessage(err)}`
         );
       }
-      if (tokens.length > 0) {
+      if (tokens2.length > 0) {
         throw new DocmetaError(
-          `check "${check.name}": the SQL references ${tokens.join(", ")}, but checks bind no parameters \u2014 an unbound name binds NULL and matches nothing, so the gate would pass on a typo. Inline the value in the SQL.`
+          `check "${check.name}": the SQL references ${tokens2.join(", ")}, but checks bind no parameters \u2014 an unbound name binds NULL and matches nothing, so the gate would pass on a typo. Inline the value in the SQL.`
         );
       }
       let columns;
@@ -7604,7 +9555,7 @@ async function runChecks(checks, entries, ctx = {}) {
         columns = stmt.columns().map((c) => c.name);
         rows = stmt.all();
       } catch (err) {
-        const message = err.message;
+        const message = errorMessage(err);
         throw new DocmetaError(
           message.includes("attempt to write a readonly database") ? `check "${check.name}": ${message} \u2014 checks are read-only by design; a check is a SELECT over the projection. Edit the corpus with \`manni meta query\` instead.` : `check "${check.name}": ${message}`
         );
@@ -7638,17 +9589,17 @@ function parseErrorResult(file, format, message, keyword) {
 }
 function resolveBaselineRequest(opts, configured, configDir, cwd) {
   const named = (label) => ({
-    absPath: resolve9(cwd, label),
+    absPath: resolve11(cwd, label),
     label
   });
   const implied = () => {
     const base = configDir ?? cwd;
     if (configured !== void 0) {
-      return { absPath: resolve9(base, configured), label: configured };
+      return { absPath: resolve11(base, configured), label: configured };
     }
-    const current = resolve9(base, DEFAULT_BASELINE_PATH);
-    const legacy = resolve9(base, LEGACY_BASELINE_PATH);
-    if (!existsSync2(current) && existsSync2(legacy)) {
+    const current = resolve11(base, DEFAULT_BASELINE_PATH);
+    const legacy = resolve11(base, LEGACY_BASELINE_PATH);
+    if (!existsSync3(current) && existsSync3(legacy)) {
       warn(
         `"${LEGACY_BASELINE_PATH}" is the pre-rename baseline file name. Rename it to "${DEFAULT_BASELINE_PATH}".`
       );
@@ -7667,6 +9618,13 @@ function resolveBaselineRequest(opts, configured, configDir, cwd) {
   if (configured) return { ...implied(), write: false };
   return null;
 }
+function once(fn) {
+  let pending;
+  return () => {
+    pending ??= fn();
+    return pending;
+  };
+}
 async function runValidate(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const {
@@ -7759,6 +9717,39 @@ async function runValidate(opts) {
   }
   const checksWillRun = configuredChecks.length > 0 && opts.checks !== false && !scoped;
   const checkEntries = [];
+  const deriveConfig = config?.derive;
+  const deriveWillRun = deriveConfig !== void 0 && deriveConfig.fields.length > 0 && opts.derive !== false;
+  const derivedChecks = checksWillRun ? configuredChecks.filter((c) => mentionsDerived(c.query) || mentionsResolved(c.query)) : [];
+  const checksNeedDerived = derivedChecks.length > 0;
+  const deriveInputs = [];
+  const keepDeriveInputs = deriveWillRun || checksNeedDerived;
+  const deriveCommands = commandsOf(deriveConfig);
+  const deriveFields = new Set(deriveWillRun ? deriveConfig.fields : []);
+  const readable = derivableFields(deriveCommands);
+  for (const c of derivedChecks) for (const f of fieldsForSql(c.query, readable)) deriveFields.add(f);
+  const derivedOnce = once(async () => {
+    const derived = await deriveMetadata(deriveInputs, {
+      cwd,
+      base,
+      ...configDir !== void 0 ? { configDir } : {},
+      sources: deriveConfig?.sources ?? [...DERIVE_SOURCES],
+      fields: [...deriveFields],
+      ...deriveConfig?.codeowners !== void 0 ? { codeowners: deriveConfig.codeowners } : {},
+      ...deriveCommands !== void 0 ? { commands: deriveCommands } : {},
+      cache: opts.cache ?? true,
+      now: opts.now ?? (() => /* @__PURE__ */ new Date())
+    });
+    assertSourcesAvailable(
+      derived.sources,
+      deriveWillRun ? "pass --no-derive to skip the comparison, or narrow derive.sources" : "narrow derive.sources in manni.config.yaml"
+    );
+    for (const [name2, status] of Object.entries(derived.sources)) {
+      if (status.available && status.reason !== void 0) {
+        opts.onNotice?.(`${name2}: ${status.reason}`);
+      }
+    }
+    return derived;
+  });
   const processOne = async (label, content, extension) => {
     const extractor = forcedExtractor ?? extractorForExtension(extension);
     if (!extractor) {
@@ -7775,10 +9766,13 @@ async function runValidate(opts) {
     } catch (err) {
       if (err instanceof DocmetaError) throw err;
       results.push(
-        parseErrorResult(label, extractor.name, err.message, "parse")
+        parseErrorResult(label, extractor.name, errorMessage(err), "parse")
       );
       return;
     }
+    if (keepDeriveInputs && label !== STDIN_LABEL) {
+      deriveInputs.push({ label, absPath: resolve11(base, label), content, extracted });
+    }
     const merged = mergeExternalMetadata(label, extracted, externalMetadata, members, base);
     extracted = merged.extracted;
     for (const j of merged.joins) {
@@ -7807,7 +9801,7 @@ async function runValidate(opts) {
       });
     } catch (err) {
       results.push(
-        parseErrorResult(label, extractor.name, err.message, "schema")
+        parseErrorResult(label, extractor.name, errorMessage(err), "schema")
       );
       return;
     }
@@ -7859,8 +9853,8 @@ async function runValidate(opts) {
     await processOne(STDIN_LABEL, content, forcedExtractor.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile6(resolve9(base, file), "utf8");
-    await processOne(file, content, extname2(file));
+    const content = await readFile7(resolve11(base, file), "utf8");
+    await processOne(file, content, extname3(file));
   }
   if (externalMetadata) {
     const byLabel = new Map(results.map((r) => [r.file, r]));
@@ -7904,7 +9898,16 @@ async function runValidate(opts) {
         // corpus see the same collections.
         collections: declaredCollections,
         ...configDir !== void 0 ? { configDir } : {},
-        base
+        base,
+        // A check that names the `derived` table (0040) gets the same view
+        // `query` builds, from the run's one derivation — which already
+        // covers every field the checks can read, so the list handed back
+        // here is not needed. Built only when asked for, because building
+        // it spawns git.
+        derive: async () => (await derivedOnce()).records,
+        // Its columns include the configured commands' keys (0042), which a
+        // check's context cannot read from a config since 0041.
+        ...deriveCommands !== void 0 ? { commands: deriveCommands } : {}
       });
       const byFile = new Map(results.map((r) => [r.file, r]));
       for (const [file, errs] of findings) {
@@ -7919,6 +9922,24 @@ async function runValidate(opts) {
       }
     }
   }
+  if (deriveWillRun && deriveInputs.length > 0) {
+    const derived = await derivedOnce();
+    const byFile = new Map(results.map((r) => [r.file, r]));
+    for (const input of deriveInputs) {
+      const record = derived.records.get(input.label);
+      const result = byFile.get(input.label);
+      if (!record || !result) continue;
+      const findings = staleFindings(
+        deriveConfig.fields.map(
+          (field) => compareDerived(field, input.extracted.data[field], record.fields[field])
+        ),
+        input.extracted.lineFor
+      );
+      if (findings.length === 0) continue;
+      result.errors.push(...findings);
+      result.ok = false;
+    }
+  }
   const frame = { cwd, base: configDir ?? cwd, runBase: base };
   const { results: reported, baseline } = await settleBaseline(
     results,
@@ -7979,8 +10000,8 @@ async function settleBaseline(results, request, ctx) {
 }
 
 // src/meta/commands/get.ts
-import { readFile as readFile7 } from "node:fs/promises";
-import { resolve as resolve10, extname as extname3 } from "node:path";
+import { readFile as readFile8 } from "node:fs/promises";
+import { resolve as resolve12, extname as extname4 } from "node:path";
 async function runGet(opts) {
   const cwd = opts.cwd ?? process.cwd();
   if (opts.fields.length === 0) {
@@ -8040,6 +10061,11 @@ async function runGet(opts) {
     base,
     offline: opts.offline ?? config?.offline ?? false
   });
+  const commands = commandsOf(config?.derive) ?? {};
+  const deriving = opts.derived !== false;
+  const derivableFields2 = deriving ? opts.fields.filter((f) => isBuiltinField(f) || Object.hasOwn(commands, f)) : [];
+  const deriveInputs = [];
+  const carried = /* @__PURE__ */ new Map();
   const readOne = (label, content, extension) => {
     const extractor = forced ?? extractorForExtension(extension);
     if (!extractor) {
@@ -8050,15 +10076,18 @@ async function runGet(opts) {
     const members = membersFor(label);
     let extracted;
     try {
-      extracted = mergeExternalMetadata(
-        label,
-        extractor.extract(content, label, {
-          elements: resolveElements(label, config, members)
-        }),
-        externalMetadata,
-        members,
-        base
-      ).extracted;
+      const own2 = extractor.extract(content, label, {
+        elements: resolveElements(label, config, members)
+      });
+      if (deriving && label !== STDIN_LABEL) {
+        deriveInputs.push({
+          label,
+          absPath: resolve12(base, label),
+          content,
+          extracted: own2
+        });
+      }
+      extracted = mergeExternalMetadata(label, own2, externalMetadata, members, base).extracted;
     } catch (err) {
       if (err instanceof DocmetaError) throw err;
       const reason = err instanceof Error ? err.message : String(err);
@@ -8066,7 +10095,12 @@ async function runGet(opts) {
       return;
     }
     const values = {};
-    for (const f of opts.fields) values[f] = resolveField(extracted.data, f);
+    const carries = {};
+    for (const f of opts.fields) {
+      values[f] = resolveField(extracted.data, f);
+      carries[f] = carriesField(extracted.data, f);
+    }
+    carried.set(label, carries);
     out.push({ file: label, present: extracted.present, values });
   };
   if (usingStdin) {
@@ -8075,14 +10109,78 @@ async function runGet(opts) {
         "Reading from stdin (`-`) requires --as <format> to choose an extractor."
       );
     }
-    readOne("<stdin>", opts.stdinContent ?? "", forced.extensions[0] ?? "");
+    readOne(STDIN_LABEL, opts.stdinContent ?? "", forced.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile7(resolve10(base, file), "utf8");
-    readOne(file, content, extname3(file));
+    const content = await readFile8(resolve12(base, file), "utf8");
+    readOne(file, content, extname4(file));
+  }
+  if (deriving) {
+    await attachResolved(out, deriveInputs, {
+      fields: opts.fields,
+      derivable: derivableFields2,
+      carried,
+      run: {
+        cwd,
+        base,
+        configDir,
+        config,
+        cache: opts.cache ?? true,
+        now: opts.now ?? (() => /* @__PURE__ */ new Date())
+      }
+    });
   }
   return out;
 }
+async function attachResolved(out, inputs, opts) {
+  const { run: run2 } = opts;
+  const derive = run2.config?.derive;
+  const commands = commandsOf(derive);
+  const records = opts.derivable.length === 0 || inputs.length === 0 ? /* @__PURE__ */ new Map() : await (async () => {
+    const result = await deriveMetadata(inputs, {
+      cwd: run2.cwd,
+      base: run2.base,
+      ...run2.configDir !== void 0 ? { configDir: run2.configDir } : {},
+      sources: derive?.sources ?? [...DERIVE_SOURCES],
+      fields: opts.derivable,
+      ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
+      ...commands !== void 0 ? { commands } : {},
+      cache: run2.cache,
+      now: run2.now
+    });
+    assertSourcesAvailable(
+      result.sources,
+      "pass --no-derived, or narrow derive.sources"
+    );
+    return result.records;
+  })();
+  for (const r of out) {
+    if (r.error !== void 0) continue;
+    const record = records.get(r.file);
+    const derived = {};
+    for (const field of opts.derivable) {
+      derived[field] = record?.fields[field] ?? null;
+    }
+    const carries = opts.carried.get(r.file) ?? {};
+    const resolved = {};
+    const origin = {};
+    for (const field of opts.fields) {
+      const evidence = derived[field];
+      if (carries[field] === true) {
+        resolved[field] = r.values[field];
+        origin[field] = "asserted";
+      } else if (evidence != null) {
+        resolved[field] = evidence.value;
+        origin[field] = "derived";
+      } else {
+        resolved[field] = void 0;
+      }
+    }
+    if (opts.derivable.length > 0) r.derived = derived;
+    r.resolved = resolved;
+    r.origin = origin;
+  }
+}
 function resolveField(data, field) {
   const segments = field.startsWith("/") ? parseJsonPointer(field) : field.split(".");
   const descended = descend(data, segments);
@@ -8092,6 +10190,23 @@ function resolveField(data, field) {
   }
   return void 0;
 }
+function carriesField(data, field) {
+  const segments = field.startsWith("/") ? parseJsonPointer(field) : field.split(".");
+  if (carriesPath(data, segments)) return true;
+  return !field.startsWith("/") && field.includes(".") && Object.prototype.hasOwnProperty.call(data, field);
+}
+function carriesPath(data, segments) {
+  const last = segments.at(-1);
+  if (last === void 0) return true;
+  const parent = segments.length === 1 ? data : descend(data, segments.slice(0, -1));
+  if (Array.isArray(parent)) {
+    return /^\d+$/.test(last) && Number(last) < parent.length;
+  }
+  if (parent !== null && typeof parent === "object") {
+    return Object.prototype.hasOwnProperty.call(parent, last);
+  }
+  return false;
+}
 function descend(data, segments) {
   let current = data;
   for (const segment of segments) {
@@ -8114,9 +10229,9 @@ function parseJsonPointer(pointer) {
 }
 
 // src/meta/commands/schemas.ts
-import { existsSync as existsSync3 } from "node:fs";
-import { mkdir as mkdir2, readFile as readFile8 } from "node:fs/promises";
-import { dirname as dirname5, extname as extname4, isAbsolute as isAbsolute4, join as join5, relative as relative8, resolve as resolve11, sep as sep4 } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile9 } from "node:fs/promises";
+import { dirname as dirname8, extname as extname5, isAbsolute as isAbsolute4, join as join6, relative as relative10, resolve as resolve13, sep as sep6 } from "node:path";
 import { parseDocument as parseDocument4, parse as parseYaml3, stringify } from "yaml";
 function getSchemasInfo() {
   return { builtins: listBuiltins(), formats: listFormats() };
@@ -8124,7 +10239,7 @@ function getSchemasInfo() {
 var DEFAULT_VENDOR_DIR = "./schema";
 var DEFAULT_CONFIG_NAME = "manni.config.yaml";
 function posixRelative(from, to) {
-  return relative8(from, to).split(sep4).join("/");
+  return relative10(from, to).split(sep6).join("/");
 }
 function vendorFileName(url) {
   let parsed2;
@@ -8149,20 +10264,20 @@ function vendorFileName(url) {
   if (!name2.toLowerCase().endsWith(".json")) name2 += ".json";
   return name2;
 }
-async function assertNotIgnored(absFile, absDir, cwd, onNotice, text = VENDOR_IGNORE_TEXT) {
+async function assertNotIgnored(absFile, absDir, cwd, onNotice, text2 = VENDOR_IGNORE_TEXT) {
   const relFile = posixRelative(cwd, absFile);
   const relDir = posixRelative(cwd, absDir);
   const candidates = [relFile];
   if (relDir !== "" && !relDir.startsWith("..")) candidates.push(relDir);
   const answer = await gitIgnored(candidates, cwd);
   if (!answer.available) {
-    onNotice?.(text.unchecked(relDir || "."));
+    onNotice?.(text2.unchecked(relDir || "."));
     return;
   }
   const ignoredDir = answer.ignored.has(relDir);
   const ignoredFile = answer.ignored.has(relFile);
   if (!ignoredDir && !ignoredFile) return;
-  throw new DocmetaError(text.refusal(ignoredDir ? relDir : relFile));
+  throw new DocmetaError(text2.refusal(ignoredDir ? relDir : relFile));
 }
 var VENDOR_IGNORE_TEXT = {
   refusal: (target) => `Refusing to vendor into "${target}": git reports it as ignored. A vendored schema has to be committed \u2014 an ignored copy validates on this machine and is simply missing in CI, where the failure reads as a schema nobody changed. Vendor into a directory your repository tracks (\`--dir\`, default \`${DEFAULT_VENDOR_DIR}\`), or drop the .gitignore rule covering this path.`,
@@ -8193,12 +10308,12 @@ function renderConfig(existing, entries, section) {
   doc.setIn(section === void 0 ? ["schemas"] : [section, "schemas"], entries);
   return doc.toString();
 }
-function reparseConfig(text, source, section) {
+function reparseConfig(text2, source, section) {
   if (section === void 0) {
-    parseConfig(text, source);
+    parseConfig(text2, source);
     return;
   }
-  const doc = parseYaml3(text);
+  const doc = parseYaml3(text2);
   parseConfigValue(doc[section], source, section);
 }
 async function runVendorSchema(opts) {
@@ -8210,10 +10325,10 @@ async function runVendorSchema(opts) {
     );
   }
   const loaded = await loadConfig(opts.configPath, cwd);
-  const configPath = loaded?.path ?? resolve11(cwd, DEFAULT_CONFIG_NAME);
+  const configPath = loaded?.path ?? resolve13(cwd, DEFAULT_CONFIG_NAME);
   const configDir = loaded?.dir ?? cwd;
-  const absDir = resolve11(cwd, opts.dir ?? DEFAULT_VENDOR_DIR);
-  const absFile = join5(absDir, vendorFileName(url));
+  const absDir = resolve13(cwd, opts.dir ?? DEFAULT_VENDOR_DIR);
+  const absFile = join6(absDir, vendorFileName(url));
   await assertNotIgnored(absFile, absDir, cwd, opts.onNotice);
   const fromConfig = posixRelative(configDir, absFile);
   const ref = isAbsolute4(fromConfig) || fromConfig === "" ? absFile : fromConfig.startsWith(".") ? fromConfig : `./${fromConfig}`;
@@ -8230,8 +10345,8 @@ async function runVendorSchema(opts) {
     );
   }
   let unchanged = false;
-  if (existsSync3(absFile)) {
-    const current = await readFile8(absFile);
+  if (existsSync4(absFile)) {
+    const current = await readFile9(absFile);
     unchanged = bytes.equals(current);
     if (!unchanged && !folded.replaced) {
       throw new DocmetaError(
@@ -8241,11 +10356,11 @@ async function runVendorSchema(opts) {
   }
   await mkdir2(absDir, { recursive: true });
   await writeFileAtomic(absFile, bytes);
-  const existing = loaded ? await readFile8(configPath, "utf8") : null;
+  const existing = loaded ? await readFile9(configPath, "utf8") : null;
   const section = loaded ? loaded.section : META_SECTION;
-  const text = renderConfig(existing, folded.entries, section);
-  reparseConfig(text, posixRelative(cwd, configPath) || DEFAULT_CONFIG_NAME, section);
-  await writeFileAtomic(configPath, text);
+  const text2 = renderConfig(existing, folded.entries, section);
+  reparseConfig(text2, posixRelative(cwd, configPath) || DEFAULT_CONFIG_NAME, section);
+  await writeFileAtomic(configPath, text2);
   return {
     url,
     file: posixRelative(cwd, absFile),
@@ -8392,15 +10507,15 @@ async function runInferSchema(opts) {
   }
   let absOut;
   if (opts.out !== void 0) {
-    absOut = resolve11(cwd, opts.out);
+    absOut = resolve13(cwd, opts.out);
     await assertNotIgnored(
       absOut,
-      dirname5(absOut),
+      dirname8(absOut),
       cwd,
       opts.onNotice,
       DRAFT_IGNORE_TEXT
     );
-    if (existsSync3(absOut)) {
+    if (existsSync4(absOut)) {
       throw new DocmetaError(
         `"${posixRelative(cwd, absOut) || opts.out}" already exists, and \`schemas infer\` will not overwrite it. The draft is a starting point you then edit, so clobbering it would throw away the edits. Pass a different --out path, or remove that file first.`
       );
@@ -8479,8 +10594,8 @@ async function runInferSchema(opts) {
     scanOne(STDIN_LABEL, opts.stdinContent ?? "", forced.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile8(resolve11(base, file), "utf8");
-    scanOne(file, content, extname4(file));
+    const content = await readFile9(resolve13(base, file), "utf8");
+    scanOne(file, content, extname5(file));
   }
   for (const u of unreadable) {
     opts.onNotice?.(`could not read metadata from "${u.file}": ${u.message}`);
@@ -8521,7 +10636,7 @@ async function runInferSchema(opts) {
   };
   const keys = kept.map(({ sawEmptyString: _drop, ...rest }) => rest);
   if (absOut !== void 0) {
-    await mkdir2(dirname5(absOut), { recursive: true });
+    await mkdir2(dirname8(absOut), { recursive: true });
     await writeFileAtomic(absOut, `${JSON.stringify(draft, null, 2)}
 `);
   }
@@ -8539,9 +10654,9 @@ async function runInferSchema(opts) {
 
 // src/meta/commands/query.ts
 import { randomBytes } from "node:crypto";
-import { existsSync as existsSync4 } from "node:fs";
-import { mkdir as mkdir3, open, readFile as readFile9, rename as rename2, rm as rm2 } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute5, resolve as resolve12, extname as extname5, sep as sep5 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { mkdir as mkdir3, open, readFile as readFile10, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname9, isAbsolute as isAbsolute5, resolve as resolve14, extname as extname6, sep as sep7 } from "node:path";
 import { parseDocument as parseDocument5, isMap as isMap4, isSeq as isSeq2, isScalar as isScalar3 } from "yaml";
 async function runQuery(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -8646,16 +10761,11 @@ async function runQuery(opts) {
       );
     }
     const members = membersFor(label);
-    const extracted = mergeExternalMetadata(
-      label,
-      extractor.extract(content, label, {
-        elements: resolveElements(label, config, members)
-      }),
-      externalMetadata,
-      members,
-      base
-    ).extracted;
-    entries.push({ label, extracted, extractor });
+    const own2 = extractor.extract(content, label, {
+      elements: resolveElements(label, config, members)
+    });
+    const extracted = mergeExternalMetadata(label, own2, externalMetadata, members, base).extracted;
+    entries.push({ label, extracted, extractor, own: own2, content });
   };
   if (usingStdin) {
     if (!forced) {
@@ -8672,15 +10782,17 @@ async function runQuery(opts) {
     readOne(STDIN_LABEL, opts.stdinContent ?? "", ext);
   }
   for (const file of files) {
-    const content = await readFile9(resolve12(base, file), "utf8");
-    readOne(file, content, extname5(file));
+    const content = await readFile10(resolve14(base, file), "utf8");
+    readOne(file, content, extname6(file));
   }
-  const db = opts.db === void 0 ? void 0 : { resolved: resolve12(cwd, opts.db), display: opts.db };
-  const run = await runSql(sql, entries, {
+  const db = opts.db === void 0 ? void 0 : { resolved: resolve14(cwd, opts.db), display: opts.db };
+  const run2 = await runSql(sql, entries, {
     target: db,
     params: boundParams,
     ...opts.schemas !== void 0 && opts.schemas.length > 0 ? { cliSchemas: opts.schemas } : {},
     write: !opts.dryRun,
+    cache: opts.cache ?? true,
+    ...opts.now !== void 0 ? { now: opts.now } : {},
     base,
     config,
     cwd,
@@ -8692,9 +10804,10 @@ async function runQuery(opts) {
     collections,
     declaredCollections,
     memberships: membersFor,
+    managed: new Set(config?.derive?.fields ?? []),
     onNotice: opts.onNotice
   });
-  return { ...run, frame: { cwd, base: configDir ?? cwd, runBase: base } };
+  return { ...run2, frame: { cwd, base: configDir ?? cwd, runBase: base } };
 }
 function bindParams(params) {
   const out = /* @__PURE__ */ Object.create(null);
@@ -8733,16 +10846,28 @@ async function prepareDbTarget(resolved, display) {
 }
 var MissingCollectionView = class extends Error {
 };
+var MissingDerivedTable = class extends Error {
+};
 function refuseSqlError(err) {
-  const message = err.message;
+  const message = errorMessage(err);
   if (message.includes("UNIQUE constraint failed: docs._path")) {
     throw new DocmetaError("That _path already exists in the corpus.");
   }
   const viewWrite = /cannot modify (.+?) because it is a view/.exec(message);
   const viewName = viewWrite?.[1];
   if (viewName !== void 0) {
+    if (viewName.toLowerCase() === DERIVED_VIEW) {
+      throw new DocmetaError(
+        `SQL error: ${message}; a collection or the derived table is read-only \u2014 the derived table is recomputed from the evidence on every run. Change the evidence, or stamp it into the documents with manni meta derive.`
+      );
+    }
+    if (viewName.toLowerCase() === RESOLVED_VIEW) {
+      throw new DocmetaError(
+        `SQL error: ${message}; the resolved table is read-only \u2014 it is \`docs\` and the evidence joined, so write to docs, or stamp the evidence with manni meta derive.`
+      );
+    }
     throw new DocmetaError(
-      `SQL error: ${message}; a collection is read-only \u2014 write through docs: UPDATE docs \u2026 WHERE _path IN (SELECT _path FROM "${viewName.replaceAll('"', '""')}").`
+      `SQL error: ${message}; a collection or the derived table is read-only \u2014 write through docs: UPDATE docs \u2026 WHERE _path IN (SELECT _path FROM "${viewName.replaceAll('"', '""')}").`
     );
   }
   throw new DocmetaError(`SQL error: ${message}`);
@@ -8755,7 +10880,7 @@ async function runSql(sql, entries, ctx) {
   );
   const { DatabaseSync } = await loadSqlite();
   if (target) {
-    await mkdir3(dirname6(target.resolved), { recursive: true });
+    await mkdir3(dirname9(target.resolved), { recursive: true });
     await prepareDbTarget(target.resolved, target.display);
   }
   let db;
@@ -8763,7 +10888,7 @@ async function runSql(sql, entries, ctx) {
     db = new DatabaseSync(target ? target.resolved : ":memory:");
   } catch (err) {
     throw new DocmetaError(
-      `Cannot open "${target?.display ?? ":memory:"}": ${err.message}`
+      `Cannot open "${target?.display ?? ":memory:"}": ${errorMessage(err)}`
     );
   }
   const dbInfo = target ? {
@@ -8771,6 +10896,7 @@ async function runSql(sql, entries, ctx) {
     files: entries.length,
     columns: SYSTEM_COLUMNS.length + dataColumns.length
   } : void 0;
+  const derivedTable = { built: false };
   try {
     createDocsTable(db, entries, dataColumns);
     let viewsBuilt = false;
@@ -8787,9 +10913,36 @@ async function runSql(sql, entries, ctx) {
       viewsBuilt = true;
     };
     if (target) buildViews();
+    const buildDerived = async () => {
+      if (derivedTable.built) return;
+      const inputs = entries.filter((e) => e.label !== STDIN_LABEL).map((e) => ({
+        label: e.label,
+        absPath: resolve14(ctx.base, e.label),
+        content: e.content,
+        extracted: e.own
+      }));
+      const commands = commandsOf(ctx.config?.derive);
+      const records = await deriveForTable(
+        inputs,
+        {
+          cwd: ctx.cwd,
+          base: ctx.base,
+          ...ctx.configDir !== void 0 ? { configDir: ctx.configDir } : {},
+          config: ctx.config,
+          cache: ctx.cache,
+          ...ctx.now !== void 0 ? { now: ctx.now } : {}
+        },
+        "narrow derive.sources in manni.config.yaml",
+        fieldsForSql(sql, derivableFields(commands))
+      );
+      createDerivedView(db, records, derivedColumns(commands));
+      createResolvedView(db, dataColumns, commands);
+      derivedTable.built = true;
+    };
     if (sql === "") {
       return { columns: [], rows: [], ...dbInfo ? { db: dbInfo } : {} };
     }
+    if (mentionsDerived(sql) || mentionsResolved(sql)) await buildDerived();
     const head = stripLeadingTrivia(sql);
     if (/^(attach|vacuum)\b/i.test(head)) {
       throw new DocmetaError(
@@ -8811,11 +10964,15 @@ async function runSql(sql, entries, ctx) {
         stmt = db.prepare(sql);
         columns = stmt.columns().map((c) => c.name);
       } catch (err) {
-        const message = err.message;
+        const message = errorMessage(err);
         const missing = missingTableName(message);
         if (missing !== void 0 && !viewsBuilt && namesConfiguredCollection(missing, ctx.declaredCollections)) {
           throw new MissingCollectionView();
         }
+        const missingBare = missing?.replace(/^(main|temp)\./i, "").toLowerCase();
+        if (!derivedTable.built && (missingBare === DERIVED_VIEW || missingBare === RESOLVED_VIEW)) {
+          throw new MissingDerivedTable();
+        }
         refuseSqlError(err);
       }
       const before = snapshotRows(db);
@@ -8874,11 +11031,20 @@ async function runSql(sql, entries, ctx) {
     try {
       return await runOnce();
     } catch (err) {
+      if (err instanceof MissingDerivedTable) {
+        await buildDerived();
+        return await runOnce();
+      }
       if (!(err instanceof MissingCollectionView)) throw err;
       buildViews();
       return await runOnce();
     }
   } finally {
+    if (target && derivedTable.built) {
+      db.exec(
+        `DROP VIEW IF EXISTS ${RESOLVED_VIEW}; DROP VIEW IF EXISTS ${DERIVED_VIEW}; DROP TABLE IF EXISTS ${DERIVED_ROWS}`
+      );
+    }
     db.close();
   }
 }
@@ -9030,21 +11196,21 @@ function appendedColumnDef(before, after) {
   const comma = /^\s*,\s*/.exec(appended);
   return comma ? appended.slice(comma[0].length) : void 0;
 }
-function skipWs(text, from) {
+function skipWs(text2, from) {
   let i = from;
-  while (i < text.length && /\s/.test(text[i] ?? "")) i++;
+  while (i < text2.length && /\s/.test(text2[i] ?? "")) i++;
   return i;
 }
-function indexOfCheck(text, from) {
+function indexOfCheck(text2, from) {
   let i = from;
-  while (i < text.length) {
-    const ch = text[i];
-    if (startsStringOrIdent(text, i)) {
-      i = skipStringOrIdent(text, i);
-    } else if (startsComment(text, i)) {
-      i = skipComment(text, i);
+  while (i < text2.length) {
+    const ch = text2[i];
+    if (startsStringOrIdent(text2, i)) {
+      i = skipStringOrIdent(text2, i);
+    } else if (startsComment(text2, i)) {
+      i = skipComment(text2, i);
     } else if (ch !== void 0 && /[A-Za-z_]/.test(ch)) {
-      const m = /^[A-Za-z_][A-Za-z0-9_]*/.exec(text.slice(i));
+      const m = /^[A-Za-z_][A-Za-z0-9_]*/.exec(text2.slice(i));
       const word = m?.[0] ?? "";
       if (word.toUpperCase() === "CHECK") return i;
       i += Math.max(word.length, 1);
@@ -9054,17 +11220,17 @@ function indexOfCheck(text, from) {
   }
   return -1;
 }
-function matchingParenEnd(text, open2) {
+function matchingParenEnd(text2, open2) {
   let depth = 0;
   let i = open2;
-  while (i < text.length) {
-    const ch = text[i];
-    if (startsStringOrIdent(text, i)) {
-      i = skipStringOrIdent(text, i);
+  while (i < text2.length) {
+    const ch = text2[i];
+    if (startsStringOrIdent(text2, i)) {
+      i = skipStringOrIdent(text2, i);
       continue;
     }
-    if (startsComment(text, i)) {
-      i = skipComment(text, i);
+    if (startsComment(text2, i)) {
+      i = skipComment(text2, i);
       continue;
     }
     if (ch === "(") depth++;
@@ -9084,9 +11250,9 @@ function enumForAddedColumn(catalogBefore, catalogAfter, key, mapped) {
   };
   const def = appendedColumnDef(catalogBefore, catalogAfter);
   if (def === void 0) {
-    const count = (text) => {
+    const count = (text2) => {
       let n = 0;
-      for (let i2 = indexOfCheck(text, 0); i2 !== -1; i2 = indexOfCheck(text, i2 + 5)) {
+      for (let i2 = indexOfCheck(text2, 0); i2 !== -1; i2 = indexOfCheck(text2, i2 + 5)) {
         n++;
       }
       return n;
@@ -9199,8 +11365,8 @@ var FORK_IGNORE_TEXT = {
   refusal: (target) => `Refusing to fork into "${target}": git reports it as ignored. The forked schema must be committed \u2014 an ignored copy validates on this machine and is simply missing in CI, where the failure reads as a schema nobody changed. Drop the .gitignore rule covering this path, or evolve a tracked local schema instead.`,
   unchecked: (where) => `could not check .gitignore for "${where}" (no repository here, or no git on PATH). The forked schema must be committed \u2014 make sure this path is tracked.`
 };
-function matchEol(reference, text) {
-  return reference.includes("\r\n") ? text.replace(/\n/g, "\r\n") : text;
+function matchEol(reference, text2) {
+  return reference.includes("\r\n") ? text2.replace(/\n/g, "\r\n") : text2;
 }
 function displayPath(ctx, abs) {
   const rel = posixRelative(ctx.base, abs);
@@ -9214,14 +11380,14 @@ function assertSchemaWriteWithin(ctx, abs) {
   );
 }
 function foldPath(p) {
-  const abs = resolve12(p);
+  const abs = resolve14(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function filePinsByPath(ctx) {
   const byPath = /* @__PURE__ */ new Map();
   for (const [ref, pin] of collectSchemaPins(ctx.config)) {
     if (classifyRef(ref).kind !== "file") continue;
-    byPath.set(foldPath(resolve12(ctx.cwd, ref)), pin);
+    byPath.set(foldPath(resolve14(ctx.cwd, ref)), pin);
   }
   return byPath;
 }
@@ -9249,13 +11415,13 @@ async function loadSetMembers(refs, ctx) {
       });
       continue;
     }
-    const abs = resolve12(ctx.cwd, ref);
+    const abs = resolve14(ctx.cwd, ref);
     const canon = foldPath(abs);
     if (seenFiles.has(canon)) continue;
     seenFiles.add(canon);
-    let text;
+    let text2;
     try {
-      text = await readFile9(abs, "utf8");
+      text2 = await readFile10(abs, "utf8");
     } catch {
       throw new DocmetaError(
         `Schema file not found: "${ref}" (looked at ${abs}).`
@@ -9263,7 +11429,7 @@ async function loadSetMembers(refs, ctx) {
     }
     const pin = pins.get(canon);
     if (pin?.integrity !== void 0) {
-      if (integrityOf(Buffer.from(text, "utf8")) !== pin.integrity) {
+      if (integrityOf(Buffer.from(text2, "utf8")) !== pin.integrity) {
         throw new DocmetaError(
           `Schema "${ref}" does not match its recorded integrity; its contents have moved since it was vendored. Re-vendor it before evolving it.`
         );
@@ -9271,7 +11437,7 @@ async function loadSetMembers(refs, ctx) {
     }
     let parsed2;
     try {
-      parsed2 = JSON.parse(stripBom(text));
+      parsed2 = JSON.parse(stripBom(text2));
     } catch {
       throw new DocmetaError(
         `Schema "${ref}" is not valid JSON, so DDL cannot read it. Fix the file first.`
@@ -9286,7 +11452,7 @@ async function loadSetMembers(refs, ctx) {
       ref,
       kind: "file",
       abs,
-      text,
+      text: text2,
       schema: parsed2
     });
   }
@@ -9331,7 +11497,7 @@ async function planSchemaMutation(ops, entries, ctx) {
           onNotice: ctx.onNotice
         });
       } catch (err) {
-        throw new DocmetaError(`"${e.label}": ${err.message}`);
+        throw new DocmetaError(`"${e.label}": ${errorMessage(err)}`);
       }
       sources.add(resolved.source);
       if (resolved.overrideIndex !== void 0) {
@@ -9454,16 +11620,16 @@ async function planSchemaMutation(ops, entries, ctx) {
     const [, name2, ver] = target.builtinId.split(":");
     const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "-");
     const forkName = `${safe(name2 ?? "schema")}-${safe(ver ?? "0")}.local.json`;
-    schemaAbs = resolve12(ctx.configDir ?? ctx.cwd, "schemas", forkName);
+    schemaAbs = resolve14(ctx.configDir ?? ctx.cwd, "schemas", forkName);
     assertSchemaWriteWithin(ctx, schemaAbs);
-    if (existsSync4(schemaAbs)) {
+    if (existsSync5(schemaAbs)) {
       throw new DocmetaError(
         `"${displayPath(ctx, schemaAbs)}" already exists; refusing to overwrite it with a fork of ${target.builtinId}.`
       );
     }
     await assertNotIgnored(
       schemaAbs,
-      dirname6(schemaAbs),
+      dirname9(schemaAbs),
       ctx.cwd,
       ctx.onNotice,
       FORK_IGNORE_TEXT
@@ -9610,8 +11776,8 @@ async function planConfigEdit(ctx, edit, runRefs) {
   if (configPath === void 0 || configDir === void 0) {
     return { changes: [], repointed: false };
   }
-  const text = await readFile9(configPath, "utf8");
-  const doc = parseDocument5(stripBom(text));
+  const text2 = await readFile10(configPath, "utf8");
+  const doc = parseDocument5(stripBom(text2));
   const display = displayPath(ctx, configPath);
   const rawRefOf = (item) => {
     if (isScalar3(item) && typeof item.value === "string") return item.value;
@@ -9621,7 +11787,7 @@ async function planConfigEdit(ctx, edit, runRefs) {
     }
     return void 0;
   };
-  const rebaseRaw = (raw) => classifyRef(raw).kind === "file" && !isAbsolute5(raw) ? resolve12(configDir, raw) : raw;
+  const rebaseRaw = (raw) => classifyRef(raw).kind === "file" && !isAbsolute5(raw) ? resolve14(configDir, raw) : raw;
   const wantSet = runRefs.map(rebaseRaw).sort().join("\n");
   const seqResolvesToRunSet = (node) => {
     if (!isSeq2(node)) return false;
@@ -9666,7 +11832,7 @@ async function planConfigEdit(ctx, edit, runRefs) {
       if (!isMap4(item)) continue;
       const raw = rawRefOf(item);
       if (raw === void 0 || classifyRef(raw).kind !== "file") continue;
-      const abs = isAbsolute5(raw) ? raw : resolve12(configDir, raw);
+      const abs = isAbsolute5(raw) ? raw : resolve14(configDir, raw);
       if (foldPath(abs) !== wantPath) continue;
       pinFrom = item.get("integrity");
       item.set("integrity", edit.integrity.value);
@@ -9698,8 +11864,8 @@ async function planConfigEdit(ctx, edit, runRefs) {
   return {
     write: {
       path: configPath,
-      content: matchEol(text, doc.toString({ lineWidth: 0 })),
-      expected: text
+      content: matchEol(text2, doc.toString({ lineWidth: 0 })),
+      expected: text2
     },
     changes,
     repointed
@@ -9882,12 +12048,12 @@ function buildChanges(diff, entries, sentinel, ctx, renameHints = [], booleanAdd
       }
     }
     validateNewPath(file, ctx.base);
-    if (!extractorForExtension(extname5(file))?.apply) {
+    if (!extractorForExtension(extname6(file))?.apply) {
       throw new DocmetaError(
         `"${file}": no writable format for that extension.`
       );
     }
-    if (existsSync4(resolve12(ctx.base, file))) {
+    if (existsSync5(resolve14(ctx.base, file))) {
       throw new DocmetaError(
         `"${file}" already exists; INSERT creates new files only.`
       );
@@ -9901,12 +12067,12 @@ function buildChanges(diff, entries, sentinel, ctx, renameHints = [], booleanAdd
   }
   for (const { from, to } of diff.renamedFiles) {
     validateNewPath(to, ctx.base);
-    if (extname5(to).toLowerCase() !== extname5(from).toLowerCase()) {
+    if (extname6(to).toLowerCase() !== extname6(from).toLowerCase()) {
       throw new DocmetaError(
         `"${from}" -> "${to}": a rename may not change the extension.`
       );
     }
-    if (existsSync4(resolve12(ctx.base, to))) {
+    if (existsSync5(resolve14(ctx.base, to))) {
       throw new DocmetaError(
         `"${to}" already exists; the rename would overwrite it.`
       );
@@ -9914,8 +12080,23 @@ function buildChanges(diff, entries, sentinel, ctx, renameHints = [], booleanAdd
     changes.push({ file: from, renamed: to, written: false });
   }
   refuseExternalMetadataWrites(changes, entries, ctx);
+  refuseManagedWrites(changes, entries, ctx);
   return changes;
 }
+function refuseManagedWrites(changes, entries, ctx) {
+  if (ctx.managed.size === 0) return;
+  const refuse = (key) => {
+    throw new DocmetaError(
+      `"${key}" is managed by derive; run manni meta derive instead.`
+    );
+  };
+  const data = new Map(entries.map((e) => [e.label, e.extracted.data]));
+  for (const c of changes) {
+    if ("schema" in c || "config" in c || "renamed" in c) continue;
+    const keys = "cleared" in c ? Object.keys(data.get(c.file) ?? {}) : "created" in c ? Object.keys(c.to) : "renamedFrom" in c ? [c.key, c.renamedFrom] : [c.key];
+    for (const key of keys) if (ctx.managed.has(key)) refuse(key);
+  }
+}
 function validateNewPath(p, base) {
   const refuse = (why) => {
     throw new DocmetaError(`"${p}" is not a usable path: ${why}.`);
@@ -9924,9 +12105,9 @@ function validateNewPath(p, base) {
   if (p.split(/[\\/]/).some((segment) => segment === "..")) {
     refuse("it traverses upward");
   }
-  const abs = resolve12(base, p);
-  if (abs === resolve12(base)) refuse("it points at the corpus root, not a file");
-  if (!abs.startsWith(resolve12(base) + sep5)) refuse("it escapes the corpus");
+  const abs = resolve14(base, p);
+  if (abs === resolve14(base)) refuse("it points at the corpus root, not a file");
+  if (!abs.startsWith(resolve14(base) + sep7)) refuse("it escapes the corpus");
 }
 function refuseExternalMetadataWrites(changes, entries, ctx) {
   const index = ctx.externalMetadata;
@@ -9955,7 +12136,7 @@ function refuseExternalMetadataWrites(changes, entries, ctx) {
       continue;
     }
     if ("renamed" in c) {
-      const entry = index.byPath.get(resolve12(ctx.base, c.file));
+      const entry = index.byPath.get(resolve14(ctx.base, c.file));
       if (entry !== void 0 && entry.size > 0) {
         const manifest = [...entry.values()][0]?.file ?? "manifest";
         throw new DocmetaError(
@@ -10008,15 +12189,15 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
   const pendingWrites = [];
   const pendingRenames = [];
   for (const [label, ops] of grouped) {
-    const path = resolve12(ctx.base, label);
+    const path = resolve14(ctx.base, label);
     if (ops.renamedTo !== void 0) {
-      if (!existsSync4(path)) {
+      if (!existsSync5(path)) {
         throw new DocmetaError(
           `"${label}" is gone from disk since it was read; re-run the query.`
         );
       }
-      const toDisk = resolve12(ctx.base, ops.renamedTo);
-      if (existsSync4(toDisk)) {
+      const toDisk = resolve14(ctx.base, ops.renamedTo);
+      if (existsSync5(toDisk)) {
         throw new DocmetaError(
           `"${ops.renamedTo}" appeared on disk since the plan; re-run the query.`
         );
@@ -10025,13 +12206,13 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
       continue;
     }
     if (ops.created !== void 0) {
-      const extractor = extractorForExtension(extname5(label));
+      const extractor = extractorForExtension(extname6(label));
       if (!extractor?.apply) {
         throw new DocmetaError(
           `"${label}": no writable format for that extension.`
         );
       }
-      if (existsSync4(path)) {
+      if (existsSync5(path)) {
         throw new DocmetaError(
           `"${label}" appeared on disk since the plan; re-run the query.`
         );
@@ -10040,7 +12221,9 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
         path,
         content: extractor.apply("", ops.created, {
           filePath: label,
-          elements: resolveElements(label, ctx.config)
+          // The new file's memberships, from its path alone. An INSERT has to
+          // write through the element set a read of that file would use.
+          elements: resolveElements(label, ctx.config, ctx.memberships(label))
         }),
         ensureDir: true
       });
@@ -10048,7 +12231,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
     }
     const entry = byLabel.get(label);
     if (!entry) throw new DocmetaError(`No loaded entry for "${label}".`);
-    const content = await readFile9(path, "utf8");
+    const content = await readFile10(path, "utf8");
     const members = ctx.memberships(label);
     const current = mergeExternalMetadata(
       label,
@@ -10088,7 +12271,9 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
     }
     const applied = entry.extractor.apply(content, ops.patch, {
       filePath: label,
-      elements: resolveElements(label, ctx.config),
+      // The memberships the read above used. Without them a collection-scoped
+      // element the read found has nowhere to be written.
+      elements: resolveElements(label, ctx.config, members),
       deletions: ops.deletions
     });
     if (ops.deletions.length > 0) {
@@ -10114,7 +12299,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
   for (const w of schemaWrites) {
     const display = displayPath(ctx, w.path);
     if (w.expected === void 0) {
-      if (existsSync4(w.path)) {
+      if (existsSync5(w.path)) {
         throw new DocmetaError(
           `"${display}" appeared on disk since the plan; re-run the query.`
         );
@@ -10123,7 +12308,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
     }
     let now;
     try {
-      now = await readFile9(w.path, "utf8");
+      now = await readFile10(w.path, "utf8");
     } catch {
       now = void 0;
     }
@@ -10134,10 +12319,10 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
     }
   }
   const dirs = /* @__PURE__ */ new Set();
-  for (const w of schemaWrites) dirs.add(dirname6(w.path));
-  for (const r of pendingRenames) dirs.add(dirname6(r.to));
+  for (const w of schemaWrites) dirs.add(dirname9(w.path));
+  for (const r of pendingRenames) dirs.add(dirname9(r.to));
   for (const p of pendingWrites) {
-    if (p.ensureDir) dirs.add(dirname6(p.path));
+    if (p.ensureDir) dirs.add(dirname9(p.path));
   }
   for (const d of dirs) await mkdir3(d, { recursive: true });
   const writeSchema = async () => {
@@ -10151,7 +12336,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
       await rename2(r.from, r.to);
     } catch (err) {
       throw new DocmetaError(
-        `Cannot move "${r.from}" to "${r.to}": ${err.message}`
+        `Cannot move "${r.from}" to "${r.to}": ${errorMessage(err)}`
       );
     }
   }
@@ -10252,8 +12437,8 @@ function skipExpression(sql, from) {
 }
 
 // src/meta/commands/fill.ts
-import { readFile as readFile10 } from "node:fs/promises";
-import { resolve as resolve13, extname as extname6, join as join6 } from "node:path";
+import { readFile as readFile11 } from "node:fs/promises";
+import { resolve as resolve15, extname as extname7, join as join7 } from "node:path";
 import {
   completeValidatedJSON,
   makeProvider,
@@ -10455,6 +12640,7 @@ async function runFill(opts) {
   );
   const dryRun = Boolean(opts.dryRun);
   const only = opts.fields != null ? new Set(opts.fields) : void 0;
+  const managed = new Set(config?.derive?.fields ?? []);
   const requestedProvider = opts.provider ?? config?.fill?.provider ?? DEFAULT_PROVIDER;
   const providerName = opts.local === true && requestedProvider === "auto" ? "llama-cpp" : requestedProvider;
   const model = opts.model ?? config?.fill?.model;
@@ -10514,13 +12700,13 @@ async function runFill(opts) {
         provider = construct();
       } catch (err) {
         throw new DocmetaError(
-          err instanceof InferenceError ? err.message : `Could not construct the "${providerName}" provider: ${err.message}`
+          err instanceof InferenceError ? err.message : `Could not construct the "${providerName}" provider: ${errorMessage(err)}`
         );
       }
     }
     return provider;
   };
-  const cache = opts.cache === false ? void 0 : new JsonCache(join6(cwd, CACHE_DIR), true, "manni");
+  const cache = opts.cache === false ? void 0 : new JsonCache(join7(cwd, CACHE_DIR), true, "manni");
   const pricing = pricingFor(identity.model);
   const validator = new Validator(schemaOptions);
   let costUsd = 0;
@@ -10564,7 +12750,7 @@ async function runFill(opts) {
       );
       extracted = merged.extracted;
     } catch (err) {
-      return errorResult(label, extractor.name, err.message);
+      return errorResult(label, extractor.name, errorMessage(err));
     }
     let resolved;
     try {
@@ -10582,7 +12768,7 @@ async function runFill(opts) {
         onNotice: opts.onNotice
       });
     } catch (err) {
-      return errorResult(label, extractor.name, err.message);
+      return errorResult(label, extractor.name, errorMessage(err));
     }
     const schemaSet = resolved.schemas;
     let schemas;
@@ -10604,12 +12790,21 @@ async function runFill(opts) {
       }
       return errorResult(label, extractor.name, err.message);
     }
-    const candidates = collectCandidates(
+    const proposed = collectCandidates(
       schemas,
       extracted.data,
       existingErrors,
       only
     );
+    const managedSkips = proposed.filter((c) => managed.has(c.key)).map((c) => ({
+      field: `/${c.key}`,
+      required: c.required,
+      confidence: 0,
+      reasoning: "managed by derive",
+      written: false,
+      skipReason: "managed"
+    }));
+    const candidates = proposed.filter((c) => !managed.has(c.key));
     const ownedCandidates = externalMetadata ? candidates.flatMap((c) => {
       const owner = externalMetadata.owners.get(c.key)?.[0];
       return owner === void 0 ? [] : [{ key: c.key, file: owner.file }];
@@ -10628,7 +12823,7 @@ async function runFill(opts) {
         file: label,
         format: extractor.name,
         schemas: schemaSet,
-        fields: [],
+        fields: managedSkips,
         changed: false,
         ...opts.includeContent ? { content } : {}
       };
@@ -10636,7 +12831,7 @@ async function runFill(opts) {
     try {
       extractor.apply(content, {}, { filePath: label, elements });
     } catch (err) {
-      return errorResult(label, extractor.name, err.message, schemaSet);
+      return errorResult(label, extractor.name, errorMessage(err), schemaSet);
     }
     const cacheKey = buildCacheKey([
       identity.provider,
@@ -10674,7 +12869,7 @@ async function runFill(opts) {
         return errorResult(
           label,
           extractor.name,
-          `Could not build a proposal schema from ${schemaSet.join(", ")}: ${err.message}`,
+          `Could not build a proposal schema from ${schemaSet.join(", ")}: ${errorMessage(err)}`,
           schemaSet
         );
       }
@@ -10697,9 +12892,9 @@ async function runFill(opts) {
             break;
           }
           inFlight++;
-          let run;
+          let run2;
           try {
-            run = await completeValidatedJSON({
+            run2 = await completeValidatedJSON({
               provider: getProvider(),
               system: FILL_SYSTEM_PROMPT,
               user: buildUserPrompt({
@@ -10712,22 +12907,22 @@ async function runFill(opts) {
               schema: envelope,
               validate
             });
-            costUsd += costOfUsage(run.usage, pricing);
+            costUsd += costOfUsage(run2.usage, pricing);
             turnsUsed++;
           } finally {
             inFlight--;
           }
-          if (run.error != null && looksLikeOverflow(run.error)) {
+          if (run2.error != null && looksLikeOverflow(run2.error)) {
             overflowed = true;
-            failure = run.error;
+            failure = run2.error;
             break;
           }
-          if (run.error != null || run.result == null) {
-            failure = run.error ?? "The model returned no proposal.";
+          if (run2.error != null || run2.result == null) {
+            failure = run2.error ?? "The model returned no proposal.";
             break;
           }
-          usageTotal = addUsage(usageTotal, run.usage);
-          collected.push(run.result);
+          usageTotal = addUsage(usageTotal, run2.usage);
+          collected.push(run2.result);
         }
         if (overflowed && attempt < 2) {
           usageTotal = void 0;
@@ -10760,7 +12955,7 @@ async function runFill(opts) {
       proposals = mergeProposals(sets);
       cache?.set(cacheKey, { proposals, ...usageTotal ? { usage: usageTotal } : {} });
     }
-    const fields = gate(candidates, proposals, threshold);
+    const fields = [...managedSkips, ...gate(candidates, proposals, threshold)];
     const accepted = fields.filter((f) => f.written);
     if (accepted.length > 0) {
       const merged2 = { ...extracted.data, ...patchOf(accepted) };
@@ -10802,14 +12997,14 @@ async function runFill(opts) {
       return errorResult(
         label,
         extractor.name,
-        err.message,
+        errorMessage(err),
         schemaSet,
         fields
       );
     }
     const changed = next !== content;
     if (changed && !dryRun && label !== "<stdin>") {
-      await writeFileAtomic(resolve13(base, label), next);
+      await writeFileAtomic(resolve15(base, label), next);
     }
     return {
       file: label,
@@ -10831,8 +13026,8 @@ async function runFill(opts) {
     );
   }
   const fileResults = await mapConcurrent(files, concurrency, async (file) => {
-    const content = await readFile10(resolve13(base, file), "utf8");
-    return processOne(file, content, extname6(file));
+    const content = await readFile11(resolve15(base, file), "utf8");
+    return processOne(file, content, extname7(file));
   });
   results.push(...fileResults);
   return {
@@ -11015,8 +13210,8 @@ function plannedFor(schemas) {
 }
 function withRenamedRefs(node, renames) {
   if (Array.isArray(node)) {
-    const items = node;
-    return items.map((item) => withRenamedRefs(item, renames));
+    const items2 = node;
+    return items2.map((item) => withRenamedRefs(item, renames));
   }
   if (typeof node !== "object" || node === null) return node;
   const out = {};
@@ -11102,7 +13297,7 @@ async function resolveIdentity(spec) {
     return await resolveProviderIdentityAsync(spec);
   } catch (err) {
     throw new DocmetaError(
-      err instanceof InferenceError ? err.message : `Could not resolve provider "${spec.provider}": ${err.message}`
+      err instanceof InferenceError ? err.message : `Could not resolve provider "${spec.provider}": ${errorMessage(err)}`
     );
   }
 }
@@ -11130,16 +13325,16 @@ function summarize(results, costUsd, cached) {
     cached
   };
 }
-async function mapConcurrent(items, limit, fn) {
-  const out = new Array(items.length);
+async function mapConcurrent(items2, limit, fn) {
+  const out = new Array(items2.length);
   let next = 0;
   const workers = Array.from(
-    { length: Math.max(1, Math.min(limit, items.length)) },
+    { length: Math.max(1, Math.min(limit, items2.length)) },
     async () => {
       for (; ; ) {
         const i = next++;
-        const item = items[i];
-        if (i >= items.length || item === void 0) return;
+        const item = items2[i];
+        if (i >= items2.length || item === void 0) return;
         out[i] = await fn(item);
       }
     }
@@ -11148,6 +13343,252 @@ async function mapConcurrent(items, limit, fn) {
   return out;
 }
 
+// src/meta/commands/derive.ts
+import { readFile as readFile12 } from "node:fs/promises";
+import { extname as extname8, resolve as resolve16 } from "node:path";
+var SOURCE_HINT = "narrow --sources or --fields";
+async function runDerive(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const { config, inputs, base, configDir, collections, declaredCollections, fromCollections } = await resolveRunConfig({
+    cwd,
+    configPath: opts.configPath,
+    noConfig: opts.noConfig,
+    inputs: opts.inputs,
+    ...opts.collections !== void 0 ? { collections: opts.collections } : {},
+    onConfigLoaded: opts.onConfigLoaded
+  });
+  if (inputs.includes(STDIN_TOKEN)) {
+    throw new DocmetaError("cannot derive <stdin>: no history behind it");
+  }
+  if (inputs.length === 0) {
+    throw new DocmetaError(
+      "No files to derive. Pass paths/globs, or declare a collection under `collections:` in manni.config.yaml."
+    );
+  }
+  const commands = commandsOf(config?.derive);
+  const fields = resolveFields(opts.fields, config?.derive?.fields, commands);
+  for (const field of fields) {
+    const owner = manifestOwning(field, declaredCollections);
+    if (owner !== void 0) {
+      throw new DocmetaError(
+        `"${field}" is owned by the manifest ${owner.file} on collection ${owner.name}; a managed field has one authority, and a manifest key already has one.`
+      );
+    }
+  }
+  const sources = resolveSources(opts.sources, config?.derive?.sources);
+  const check = Boolean(opts.check);
+  const dryRun = Boolean(opts.dryRun) || check;
+  const forcedExtractor = opts.as ? extractorByName(opts.as) : void 0;
+  if (opts.as && !forcedExtractor) {
+    throw new DocmetaError(
+      `Unknown format "${opts.as}". Known formats: ${listFormats().map((f) => f.name).join(", ")}.`
+    );
+  }
+  const allowEmpty = opts.allowEmpty ?? config?.allowEmpty;
+  const exts = opts.exts ?? forcedExtractor?.extensions;
+  const exclude = opts.exclude ?? [];
+  const membersFor = (label) => memberOf(collections, configDir ?? cwd, base, label);
+  const { files: walked, gitignoreSkipped } = await resolveTargetSet({
+    inputs,
+    exts,
+    exclude,
+    cwd: base,
+    allowEmpty,
+    ...gitignoreOptions({
+      flag: opts.respectGitignore,
+      configured: config?.respectGitignore,
+      onNotice: opts.onNotice
+    })
+  });
+  const files = fromCollections ? retainMembers(walked, membersFor) : walked;
+  assertNonEmpty({
+    files,
+    inputs,
+    usingStdin: false,
+    allowEmpty,
+    exclude,
+    exts,
+    gitignoreSkipped,
+    action: "derived"
+  });
+  const loaded = /* @__PURE__ */ new Map();
+  const errors = /* @__PURE__ */ new Map();
+  for (const label of files) {
+    const absPath = resolve16(base, label);
+    const extractor = forcedExtractor ?? extractorForExtension(extname8(label));
+    if (!extractor) {
+      errors.set(label, {
+        format: "unknown",
+        message: `Unsupported file type "${extname8(label)}". Supported: ${supportedExtensions().join(", ")}. Use --as to override.`
+      });
+      continue;
+    }
+    const content = await readFile12(absPath, "utf8");
+    const elements = resolveElements(label, config, membersFor(label));
+    try {
+      loaded.set(label, {
+        label,
+        absPath,
+        content,
+        format: extractor.name,
+        elements,
+        extracted: extractor.extract(content, label, { elements }),
+        apply: extractor.apply
+      });
+    } catch (err) {
+      errors.set(label, { format: extractor.name, message: errorMessage(err) });
+    }
+  }
+  const derived = await deriveMetadata([...loaded.values()], {
+    cwd,
+    base,
+    configDir,
+    sources,
+    fields,
+    codeowners: config?.derive?.codeowners,
+    commands,
+    cache: opts.cache ?? true,
+    now: opts.now ?? (() => /* @__PURE__ */ new Date()),
+    reviews: opts.reviews
+  });
+  assertSourcesAvailable(derived.sources, SOURCE_HINT);
+  for (const [name2, status] of Object.entries(derived.sources)) {
+    if (status.available && status.reason !== void 0) {
+      opts.onNotice?.(`${name2}: ${status.reason}`);
+    }
+  }
+  const results = [];
+  for (const label of files) {
+    const failure = errors.get(label);
+    if (failure) {
+      results.push(errorResult2(label, failure.format, failure.message, check));
+      continue;
+    }
+    const doc = loaded.get(label);
+    if (!doc) continue;
+    const record = derived.records.get(label);
+    const compared = fields.map(
+      (field) => compareDerived(field, doc.extracted.data[field], record?.fields[field])
+    );
+    const pending = compared.filter((f) => f.status === "stale" || f.status === "unset");
+    let changed = false;
+    if (pending.length > 0) {
+      if (typeof doc.apply !== "function") {
+        if (!dryRun) {
+          results.push(
+            errorResult2(
+              label,
+              doc.format,
+              `The "${doc.format}" format is read-only; manni meta derive cannot write metadata back to it.`,
+              check,
+              compared
+            )
+          );
+          continue;
+        }
+        changed = true;
+      } else {
+        const patch = {};
+        for (const f of pending) patch[f.field] = f.derived;
+        let next;
+        try {
+          next = doc.apply(doc.content, patch, { filePath: label, elements: doc.elements });
+        } catch (err) {
+          results.push(errorResult2(label, doc.format, errorMessage(err), check, compared));
+          continue;
+        }
+        changed = next !== doc.content;
+        if (changed && !dryRun) {
+          await writeFileAtomic(doc.absPath, next);
+          for (const f of pending) f.written = true;
+        }
+      }
+    }
+    results.push({
+      file: label,
+      format: doc.format,
+      fields: compared,
+      changed,
+      ...check ? { findings: staleFindings(compared, doc.extracted.lineFor) } : {}
+    });
+  }
+  return {
+    results,
+    summary: summarize2(results),
+    dryRun,
+    check,
+    sources: derived.sources,
+    frame: { cwd, base: configDir ?? cwd, runBase: base }
+  };
+}
+function resolveFields(flag, configured, commands) {
+  const names = flag ?? configured;
+  if (names === void 0 || names.length === 0) {
+    throw new DocmetaError(
+      "nothing to derive: set derive.fields in manni.config.yaml or pass --fields"
+    );
+  }
+  const out = [];
+  for (const name2 of names) {
+    if (!isBuiltinField(name2) && !(commands !== void 0 && Object.hasOwn(commands, name2))) {
+      throw new DocmetaError(
+        `"${name2}" is not derivable; derivable fields are ${DERIVABLE_FIELDS.join(", ")}, or any key with an entry in derive.commands`
+      );
+    }
+    if (!out.includes(name2)) out.push(name2);
+  }
+  return out;
+}
+function resolveSources(flag, configured) {
+  const names = flag ?? configured ?? DERIVE_SOURCES;
+  const out = [];
+  for (const name2 of names) {
+    if (!isDeriveSource(name2)) {
+      throw new DocmetaError(
+        `"${name2}" is not a source; sources are ${DERIVE_SOURCES.join(", ")}`
+      );
+    }
+    if (!out.includes(name2)) out.push(name2);
+  }
+  return out;
+}
+function errorResult2(file, format, message, check, fields = []) {
+  return {
+    file,
+    format,
+    fields,
+    changed: false,
+    error: message,
+    ...check ? {
+      findings: [
+        { schema: "(parse)", instancePath: "", message, keyword: "parse" }
+      ]
+    } : {}
+  };
+}
+function summarize2(results) {
+  const summary = {
+    files: results.length,
+    changed: 0,
+    written: 0,
+    stale: 0,
+    unset: 0,
+    unknown: 0,
+    errors: 0
+  };
+  for (const r of results) {
+    if (r.changed) summary.changed++;
+    if (r.error !== void 0) summary.errors++;
+    for (const f of r.fields) {
+      if (f.written) summary.written++;
+      if (f.status === "stale") summary.stale++;
+      else if (f.status === "unset") summary.unset++;
+      else if (f.status === "unknown") summary.unknown++;
+    }
+  }
+  return summary;
+}
+
 // src/meta/reporters/sarif.ts
 import { isAbsolute as isAbsolute6 } from "node:path";
 
@@ -11157,11 +13598,13 @@ var PARSE_ERROR_RULE = "manni/parse-error";
 var SCHEMA_ERROR_RULE = "manni/schema-error";
 var EXTERNAL_OWNED_RULE = "external:owned/external";
 var EXTERNAL_DUPLICATE_RULE = "external:duplicate/external";
+var DERIVED_STALE_RULE = "derived:stale/derived";
 var RESERVED_RULES = {
   [PARSE_ERROR_RULE]: "The document's metadata block could not be parsed.",
   [SCHEMA_ERROR_RULE]: "No schema set could be resolved for the document.",
   [EXTERNAL_OWNED_RULE]: "The document carries a key a manifest owns; the manifest is the only place that key may be set.",
-  [EXTERNAL_DUPLICATE_RULE]: "Two documents carry the same value of a manifest's join field, so one manifest entry matched both."
+  [EXTERNAL_DUPLICATE_RULE]: "Two documents carry the same value of a manifest's join field, so one manifest entry matched both.",
+  [DERIVED_STALE_RULE]: "A managed field whose value differs from what git, CODEOWNERS or the GitHub or GitLab review record says; run `manni meta derive` to refresh it."
 };
 function ruleIdFor(e, frame) {
   if (e.schema === SYNTHETIC_SCHEMA) {
@@ -11488,14 +13931,14 @@ var FILL_FORMAT_LIST = formatList(FILL_FORMATS);
 function isFillFormat(value) {
   return FILL_FORMATS.includes(value);
 }
-function renderFillJson(run) {
-  return JSON.stringify(run, null, 2);
+function renderFillJson(run2) {
+  return JSON.stringify(run2, null, 2);
 }
 var score = (n) => n.toFixed(2);
-function renderFillPretty(run, opts = {}) {
+function renderFillPretty(run2, opts = {}) {
   const c = palette(opts.color ?? false);
   const lines = [];
-  for (const result of run.results) {
+  for (const result of run2.results) {
     if (result.error != null) {
       lines.push(`${c.red("\u2717")} ${result.file}`);
       lines.push(`    ${result.error}`);
@@ -11519,7 +13962,7 @@ function renderFillPretty(run, opts = {}) {
     if (low.length > 0) {
       lines.push(
         c.dim(
-          `    below ${run.threshold}: ${low.map((f) => `${f.field} ${score(f.confidence)}`).join(", ")}`
+          `    below ${run2.threshold}: ${low.map((f) => `${f.field} ${score(f.confidence)}`).join(", ")}`
         )
       );
     }
@@ -11527,14 +13970,14 @@ function renderFillPretty(run, opts = {}) {
       lines.push(c.dim(`    ${f.skipReason ?? "skipped"}: ${f.field}`));
     }
   }
-  const { summary } = run;
-  const verb = run.dryRun ? "would be written" : "written";
+  const { summary } = run2;
+  const verb = run2.dryRun ? "would be written" : "written";
   const parts = [
     // Which provider ran decides what the proposals and the cost mean, and
     // under `auto` it is not something the user chose — so say it rather than
     // making them pass -f json to find out.
-    `${run.provider}/${run.model}`,
-    `Threshold ${run.threshold}`,
+    `${run2.provider}/${run2.model}`,
+    `Threshold ${run2.threshold}`,
     `${summary.files} file${summary.files === 1 ? "" : "s"}`,
     `${summary.written} field${summary.written === 1 ? "" : "s"} ${verb}`,
     `${summary.skipped} skipped`
@@ -11552,7 +13995,7 @@ function renderFillPretty(run, opts = {}) {
       )
     );
   }
-  if (run.turnsSpent) {
+  if (run2.turnsSpent) {
     lines.push(
       c.yellow("--max-turns reached; some files were not processed.")
     );
@@ -11563,9 +14006,9 @@ function formatValue(value) {
   if (typeof value === "string") return value;
   return toJsonText(value) ?? String(value);
 }
-function renderFillGithub(run) {
+function renderFillGithub(run2) {
   const lines = [];
-  for (const result of run.results) {
+  for (const result of run2.results) {
     const file = escapeWorkflowCommandProperty(result.file);
     if (result.error != null) {
       lines.push(
@@ -11575,7 +14018,7 @@ function renderFillGithub(run) {
     }
     for (const f of result.fields) {
       if (!f.required || f.written) continue;
-      const why = f.skipReason === "low-confidence" ? `confidence ${score(f.confidence)} is below the ${run.threshold} threshold` : f.skipReason ?? "skipped";
+      const why = f.skipReason === "low-confidence" ? `confidence ${score(f.confidence)} is below the ${run2.threshold} threshold` : f.skipReason ?? "skipped";
       const msg = escapeWorkflowCommandMessage(
         `[fill] ${f.field} is required and was not filled (${why})`
       );
@@ -11584,14 +14027,14 @@ function renderFillGithub(run) {
   }
   return lines.join("\n");
 }
-function renderFill(format, run, opts = {}) {
+function renderFill(format, run2, opts = {}) {
   switch (format) {
     case "json":
-      return renderFillJson(run);
+      return renderFillJson(run2);
     case "github":
-      return renderFillGithub(run);
+      return renderFillGithub(run2);
     case "pretty":
-      return renderFillPretty(run, opts);
+      return renderFillPretty(run2, opts);
     default: {
       const unreachable = format;
       throw new DocmetaError(
@@ -11601,12 +14044,137 @@ function renderFill(format, run, opts = {}) {
   }
 }
 
+// src/meta/reporters/derive.ts
+var DERIVE_FORMATS = ["pretty", "json", "github", "sarif", "junit"];
+var DERIVE_FORMAT_LIST = formatList(DERIVE_FORMATS);
+function isDeriveFormat(value) {
+  return DERIVE_FORMATS.includes(value);
+}
+var JUNIT_CLASSNAME = "manni.derive";
+function renderDerive(run2, format, opts = {}) {
+  if (run2.check) {
+    const { results, summary } = asValidation(run2);
+    return render(format, results, summary, {
+      classname: JUNIT_CLASSNAME,
+      ...opts
+    });
+  }
+  switch (format) {
+    case "json":
+      return JSON.stringify(run2, null, 2);
+    case "pretty":
+      return renderDerivePretty(run2, opts);
+    case "github":
+    case "sarif":
+    case "junit":
+      throw new DocmetaError(
+        `${format} is a findings format, which only --check produces`
+      );
+    default: {
+      const unreachable = format;
+      throw new DocmetaError(
+        `Unknown report format ${JSON.stringify(unreachable)}. Use ${DERIVE_FORMAT_LIST}.`
+      );
+    }
+  }
+}
+function asValidation(run2) {
+  const results = run2.results.map((r) => {
+    const errors = r.findings ?? [];
+    return { file: r.file, format: r.format, ok: errors.length === 0, schemas: [], errors };
+  });
+  const failed = results.filter((r) => !r.ok).length;
+  return {
+    results,
+    summary: {
+      files: results.length,
+      passed: results.length - failed,
+      failed,
+      errors: results.reduce((n, r) => n + r.errors.length, 0)
+    }
+  };
+}
+var plural2 = (n, noun) => `${n} ${noun}${n === 1 ? "" : "s"}`;
+function renderDerivePretty(run2, opts = {}) {
+  const c = palette(opts.color ?? false);
+  const lines = [];
+  for (const result of run2.results) {
+    if (result.error !== void 0) {
+      lines.push(`${c.red("\u2717")} ${result.file}`);
+      lines.push(`    ${result.error}`);
+      continue;
+    }
+    const pending = result.fields.filter((f) => f.status === "stale" || f.status === "unset");
+    if (pending.length === 0) {
+      if (opts.quiet) continue;
+      lines.push(`${result.file}  ${c.dim("current")}${unknownNote(result, c.dim)}`);
+      continue;
+    }
+    lines.push(result.file);
+    const nameWidth = Math.max(...pending.map((f) => f.field.length));
+    const changeWidth = Math.max(...pending.map((f) => change(f).length));
+    for (const f of pending) {
+      const name2 = c.cyan(f.field.padEnd(nameWidth));
+      const from = f.status === "unset" ? c.dim("(unset)") : c.dim(fmt2(f.asserted));
+      const to = c.green(fmt2(f.derived));
+      const pad = " ".repeat(changeWidth - change(f).length);
+      const trail = c.dim(`(${f.source ?? "a source"}: ${f.evidence ?? "no evidence"})`);
+      lines.push(`    ${name2}  ${from} \u2192 ${to}${pad}  ${trail}`);
+    }
+    const note = unknownNote(result, c.dim);
+    if (note !== "") lines.push(`   ${note}`);
+  }
+  const s = run2.summary;
+  const parts = [plural2(s.files, "file")];
+  if (run2.dryRun) {
+    parts.push(`${s.changed} would change`, plural2(s.stale + s.unset, "field"));
+  } else {
+    parts.push(`${s.changed} changed`, `${plural2(s.written, "field")} written`);
+  }
+  if (s.errors > 0) parts.push(plural2(s.errors, "error"));
+  let footer = parts.join(", ");
+  if (run2.dryRun) footer += " \u2014 dry run, nothing written";
+  if (lines.length > 0) lines.push("");
+  lines.push(s.errors > 0 ? c.yellow(footer) : footer);
+  return lines.join("\n");
+}
+function change(f) {
+  const from = f.status === "unset" ? "(unset)" : fmt2(f.asserted);
+  return `${from} \u2192 ${fmt2(f.derived)}`;
+}
+function unknownNote(result, dim) {
+  const unknown = result.fields.filter((f) => f.status === "unknown").map((f) => f.field);
+  if (unknown.length === 0) return "";
+  return dim(`  (${unknown.join(", ")}: no source could answer)`);
+}
+function fmt2(value) {
+  if (typeof value === "string") return value;
+  return toJsonText(value) ?? String(value);
+}
+
 // src/meta/reporters/get.ts
 function stringifyValue(value) {
   if (value === void 0) return "(unset)";
   if (typeof value === "string") return value;
   return JSON.stringify(value);
 }
+function evidenceOf(d) {
+  const repeated = ` (${stringifyValue(d.value)})`;
+  return d.evidence.endsWith(repeated) ? d.evidence.slice(0, -repeated.length) : d.evidence;
+}
+function annotation(r, field) {
+  const origin = r.origin?.[field];
+  if (origin === void 0) return "";
+  const d = r.derived?.[field] ?? null;
+  if (origin === "derived") {
+    return d == null ? "" : ` (derived, ${d.source}: ${evidenceOf(d)})`;
+  }
+  if (d == null) return " (asserted)";
+  if (compareDerived(field, r.resolved?.[field], d).status === "current") {
+    return " (asserted)";
+  }
+  return ` (asserted; ${d.source} says ${stringifyValue(d.value)}, ${evidenceOf(d)})`;
+}
 function renderGet(results, fields, opts = {}) {
   const c = palette(opts.color ?? false);
   const lines = [];
@@ -11615,9 +14183,14 @@ function renderGet(results, fields, opts = {}) {
       lines.push(`${c.dim(`${r.file}:`)} ${c.red(`(parse) ${r.error}`)}`);
       continue;
     }
-    if (opts.quiet && fields.every((f) => r.values[f] === void 0)) continue;
+    const effective = r.resolved ?? r.values;
+    if (opts.quiet && fields.every((f) => effective[f] === void 0)) continue;
     for (const f of fields) {
-      lines.push(`${c.dim(`${r.file}:`)} ${f}=${stringifyValue(r.values[f])}`);
+      const note = annotation(r, f);
+      const suffix = note === "" ? "" : c.dim(note);
+      lines.push(
+        `${c.dim(`${r.file}:`)} ${f}=${stringifyValue(effective[f])}${suffix}`
+      );
     }
   }
   return lines.join("\n");
@@ -11628,21 +14201,21 @@ function cell(value) {
   if (value === null) return "(null)";
   return typeof value === "bigint" ? String(value) : stringifyValue(value);
 }
-function renderQuery(run, opts = {}) {
+function renderQuery(run2, opts = {}) {
   const c = palette(opts.color ?? false);
-  if (run.changes) return renderChanges(run.changes, c, opts);
+  if (run2.changes) return renderChanges(run2.changes, c, opts);
   const lines = [];
-  if (run.rows.length > 0) {
-    const widths = run.columns.map(
-      (col) => Math.max(col.length, ...run.rows.map((r) => cell(r[col]).length))
+  if (run2.rows.length > 0) {
+    const widths = run2.columns.map(
+      (col) => Math.max(col.length, ...run2.rows.map((r) => cell(r[col]).length))
     );
-    const pad = (text, i) => i === run.columns.length - 1 ? text : text.padEnd(widths[i] ?? 0);
-    lines.push(run.columns.map((col, i) => c.bold(pad(col, i))).join("  "));
-    for (const row of run.rows) {
-      lines.push(run.columns.map((col, i) => pad(cell(row[col]), i)).join("  "));
+    const pad = (text2, i) => i === run2.columns.length - 1 ? text2 : text2.padEnd(widths[i] ?? 0);
+    lines.push(run2.columns.map((col, i) => c.bold(pad(col, i))).join("  "));
+    for (const row of run2.rows) {
+      lines.push(run2.columns.map((col, i) => pad(cell(row[col]), i)).join("  "));
     }
   }
-  const n = run.rows.length;
+  const n = run2.rows.length;
   const count = `${n} row${n === 1 ? "" : "s"}`;
   lines.push(
     opts.check ? n > 0 ? c.red(`\u2717 ${count} \u2014 check failed`) : c.green(`\u2713 ${count}`) : c.dim(count)
@@ -11650,15 +14223,15 @@ function renderQuery(run, opts = {}) {
   return lines.join("\n");
 }
 var CSV_NEEDS_QUOTING = /[",\n\r]/;
-function renderQueryCsv(run) {
+function renderQueryCsv(run2) {
   const field = (value) => {
     if (value === null || value === void 0) return "";
-    const text = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : stringifyValue(value);
-    return CSV_NEEDS_QUOTING.test(text) ? `"${text.replaceAll('"', '""')}"` : text;
+    const text2 = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : stringifyValue(value);
+    return CSV_NEEDS_QUOTING.test(text2) ? `"${text2.replaceAll('"', '""')}"` : text2;
   };
   return [
-    run.columns.map(field).join(","),
-    ...run.rows.map((row) => run.columns.map((c) => field(row[c])).join(","))
+    run2.columns.map(field).join(","),
+    ...run2.rows.map((row) => run2.columns.map((c) => field(row[c])).join(","))
   ].join("\n");
 }
 function renderChanges(changes, c, opts) {
@@ -11727,6 +14300,7 @@ export {
   palette,
   shouldColor,
   ToolError,
+  errorMessage,
   programName,
   setProgramName,
   externalMetadataUrlProblem,
@@ -11778,12 +14352,46 @@ export {
   orphanEntries,
   orphanJoins,
   orphanError,
+  DERIVABLE_FIELDS,
+  isBuiltinField,
+  DERIVE_SOURCES,
+  isDeriveSource,
+  DERIVED_STALE_SCHEMA,
+  DERIVED_KEYWORD,
+  compareDerived,
+  staleFindings,
   parseConfig,
   loadConfig,
   resolveRunConfig,
   isParamName,
   memberOf,
   Validator,
+  REVIEW_CACHE_DIR,
+  REVIEW_CACHE_VERSION,
+  ReviewCache,
+  cachedClient,
+  BinMissing,
+  run,
+  PATH_PLACEHOLDER,
+  isPerFile,
+  argvFor,
+  valueOf,
+  deriveFromCommands,
+  parseOriginUrl,
+  identityFromOrigin,
+  GitHubClient,
+  GitLabClient,
+  createReviewClient,
+  deriveFromReviews,
+  FIELD_SOURCES,
+  sourcesFor,
+  consultedSources,
+  assertSourcesAvailable,
+  deriveMetadata,
+  RESOLVED_VIEW,
+  resolvedColumns,
+  mentionsResolved,
+  createResolvedView,
   rowsToFindings,
   runValidate,
   runGet,
@@ -11794,6 +14402,7 @@ export {
   runInferSchema,
   runQuery,
   runFill,
+  runDerive,
   renderSarif,
   renderJunit,
   REPORT_FORMATS,
@@ -11814,9 +14423,13 @@ export {
   isFillFormat,
   renderFillGithub,
   renderFill,
+  DERIVE_FORMATS,
+  DERIVE_FORMAT_LIST,
+  isDeriveFormat,
+  renderDerive,
   stringifyValue,
   renderGet,
   renderQuery,
   renderQueryCsv
 };
-//# sourceMappingURL=chunk-L7HN3AWA.js.map
+//# sourceMappingURL=chunk-7SE7XDCL.js.map