@hawkeyexl/manni 2.0.1 → 2.1.0

package/dist/{chunk-PDNSN5UJ.js → chunk-2DC2GSRH.js}

@@ -8,7 +8,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "@hawkeyexl/manni",
-  version: "2.0.1",
+  version: "2.1.0",
   description: "One command line for documentation that is meant to be checked. `manni meta` validates the presence and format of document metadata (Markdown frontmatter and more) against JSON Schema, built for CI. Formerly docmeta.",
   type: "module",
   bin: {
@@ -124,6 +124,85 @@ var package_default = {
   }
 };
 
+// src/shared/run.ts
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { CommanderError } from "commander";
+
+// src/shared/errors.ts
+var ToolError = class extends Error {
+  /** clig.dev: 2 is operational/usage; 1 is reserved for findings. */
+  exitCode = 2;
+  constructor(message) {
+    super(message);
+    this.name = "ToolError";
+  }
+};
+function errorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  if (typeof err === "number" || typeof err === "bigint") return String(err);
+  if (typeof err === "object" && err !== null && "message" in err && typeof err.message === "string") {
+    return err.message;
+  }
+  try {
+    const json = JSON.stringify(err);
+    if (json !== void 0) return json;
+  } catch {
+  }
+  return String(err);
+}
+
+// src/shared/program-name.ts
+var name = "manni";
+function programName() {
+  return name;
+}
+function setProgramName(value) {
+  name = value;
+}
+
+// src/shared/run.ts
+function fail(err) {
+  const msg = err instanceof ToolError ? err.message : `Unexpected error: ${errorMessage(err)}`;
+  process.stderr.write(`${programName()}: ${msg}
+`);
+  process.exit(2);
+}
+var STDIN_LINES_MARKER = "\0";
+var STDIN_WITH_LINES = /^-(:[1-9][0-9]*(?:-[1-9][0-9]*)?)$/;
+function normalizeStdinArgv(argv) {
+  return argv.map((arg) => {
+    const lines = STDIN_WITH_LINES.exec(arg)?.[1];
+    return lines === void 0 ? arg : `${STDIN_LINES_MARKER}${lines}`;
+  });
+}
+async function runProgram(program, argv = process.argv) {
+  setProgramName(program.name());
+  try {
+    await program.parseAsync(normalizeStdinArgv(argv));
+  } catch (err) {
+    if (err instanceof CommanderError) {
+      process.exitCode = err.exitCode === 0 ? 0 : 2;
+      return;
+    }
+    throw err;
+  }
+}
+function isMainModule(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return realpathSync(entry) === fileURLToPath(moduleUrl);
+  } catch {
+    return false;
+  }
+}
+function runIfMain(moduleUrl, build) {
+  if (!isMainModule(moduleUrl)) return;
+  runProgram(build()).catch(fail);
+}
+
 // src/shared/collections.ts
 import picomatch2 from "picomatch";
 
@@ -392,13 +471,53 @@ function isMember(collection, relPath) {
   return !collection.exclude.some((glob) => matchesFileGlob(relPath, glob));
 }
 function normalizeEntry(entry) {
-  const posix2 = entry.replace(/\\/g, "/").replace(/^\.\//, "");
-  return posix2.endsWith("/") ? posix2.slice(0, -1) : posix2;
+  const posix4 = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+  return posix4.endsWith("/") ? posix4.slice(0, -1) : posix4;
 }
 function isGlob(entry) {
   return picomatch2.scan(entry).isGlob;
 }
 
+// src/meta/core/integrity.ts
+import { createHash } from "node:crypto";
+var INTEGRITY_ALGORITHM = "sha256";
+var INTEGRITY_SHAPE = `${INTEGRITY_ALGORITHM}-<64 hex characters>`;
+var INTEGRITY_RE = new RegExp(`^${INTEGRITY_ALGORITHM}-([0-9a-f]{64})$`);
+function integrityOf(bytes) {
+  return `${INTEGRITY_ALGORITHM}-${createHash(INTEGRITY_ALGORITHM).update(bytes).digest("hex")}`;
+}
+function isIntegrity(value) {
+  return INTEGRITY_RE.test(value);
+}
+function toLf(bytes) {
+  const out = new Uint8Array(bytes.length);
+  let n = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    const byte = bytes[i];
+    if (byte === void 0) continue;
+    if (byte === 13 && bytes[i + 1] === 10) continue;
+    out[n++] = byte;
+  }
+  return out.subarray(0, n);
+}
+function toCrlf(bytes) {
+  const lf = toLf(bytes);
+  const out = new Uint8Array(lf.length * 2);
+  let n = 0;
+  for (let i = 0; i < lf.length; i++) {
+    const byte = lf[i];
+    if (byte === void 0) continue;
+    if (byte === 10) out[n++] = 13;
+    out[n++] = byte;
+  }
+  return out.subarray(0, n);
+}
+function diagnoseIntegrity(bytes, expected) {
+  if (integrityOf(toLf(bytes)) === expected) return "line-endings";
+  if (integrityOf(toCrlf(bytes)) === expected) return "line-endings";
+  return "content";
+}
+
 // src/meta/extractors/frontmatter.ts
 import { parseDocument, LineCounter, isMap, isSeq, isScalar } from "yaml";
 import { parse as parseToml } from "smol-toml";
@@ -453,22 +572,22 @@ function locateFrontmatter(content) {
   while (cursor <= body.length) {
     const nl = body.indexOf("\n", cursor);
     const hasNl = nl !== -1;
-    const lineEnd = hasNl ? nl : body.length;
-    const hadCr = lineEnd > cursor && body.charCodeAt(lineEnd - 1) === 13;
-    const line = body.slice(cursor, hadCr ? lineEnd - 1 : lineEnd);
+    const lineEnd2 = hasNl ? nl : body.length;
+    const hadCr = lineEnd2 > cursor && body.charCodeAt(lineEnd2 - 1) === 13;
+    const line = body.slice(cursor, hadCr ? lineEnd2 - 1 : lineEnd2);
     if (fence.isClose(line)) {
       return {
         flavor: fence.flavor,
         openStart: bom,
         innerStart: innerStart + bom,
         innerEnd: cursor + bom,
-        closeEnd: (hasNl ? lineEnd + 1 : lineEnd) + bom,
+        closeEnd: (hasNl ? lineEnd2 + 1 : lineEnd2) + bom,
         eol,
         firstContentLine: 2
       };
     }
     if (!hasNl) break;
-    cursor = lineEnd + 1;
+    cursor = lineEnd2 + 1;
   }
   return null;
 }
@@ -607,30 +726,6 @@ function extractFrontmatter(content, format) {
   }
 }
 
-// src/shared/errors.ts
-var ToolError = class extends Error {
-  /** clig.dev: 2 is operational/usage; 1 is reserved for findings. */
-  exitCode = 2;
-  constructor(message) {
-    super(message);
-    this.name = "ToolError";
-  }
-};
-function errorMessage(err) {
-  if (err instanceof Error) return err.message;
-  if (typeof err === "string") return err;
-  if (typeof err === "number" || typeof err === "bigint") return String(err);
-  if (typeof err === "object" && err !== null && "message" in err && typeof err.message === "string") {
-    return err.message;
-  }
-  try {
-    const json = JSON.stringify(err);
-    if (json !== void 0) return json;
-  } catch {
-  }
-  return String(err);
-}
-
 // src/meta/types.ts
 function isErrorSeverity(e) {
   return e.severity === void 0 || e.severity === "error";
@@ -1204,8 +1299,8 @@ function ditaShape(content, root, filePath) {
   const lower = filePath?.toLowerCase() ?? "";
   const byExtension2 = (lower.endsWith(".dita") || lower.endsWith(".ditamap")) && DITA_ROOTS.has(name2);
   if (!byDoctype && !byClass && !byArch && !byExtension2) return void 0;
-  const isMap6 = /^\s*[-+]\s+map\//.test(cls) || MAP_ROOTS.has(name2) || lower.endsWith(".ditamap");
-  return isMap6 ? { kind: "map", container: "topicmeta", preamble: /* @__PURE__ */ new Set(["title"]) } : {
+  const isMap7 = /^\s*[-+]\s+map\//.test(cls) || MAP_ROOTS.has(name2) || lower.endsWith(".ditamap");
+  return isMap7 ? { kind: "map", container: "topicmeta", preamble: /* @__PURE__ */ new Set(["title"]) } : {
     kind: "topic",
     container: "metadata",
     preamble: /* @__PURE__ */ new Set([
@@ -2633,24 +2728,13 @@ function listFormats() {
 // src/meta/core/write-file.ts
 import { writeFile, rename, rm, stat, chmod } from "node:fs/promises";
 import { dirname, join, basename } from "node:path";
-
-// src/shared/program-name.ts
-var name = "manni";
-function programName() {
-  return name;
-}
-function setProgramName(value) {
-  name = value;
-}
-
-// src/meta/core/write-file.ts
 var LOCKED = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
 var RENAME_ATTEMPTS = 3;
 function errorCode(err) {
   return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
 }
-var wait = (ms) => new Promise((resolve18) => {
-  setTimeout(resolve18, ms);
+var wait = (ms) => new Promise((resolve19) => {
+  setTimeout(resolve19, ms);
 });
 async function writeFileAtomic(path, contents) {
   const tmp = join(
@@ -2691,7 +2775,7 @@ async function writeFileAtomic(path, contents) {
 }
 
 // src/meta/core/schema-cache.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { mkdir, readFile, stat as stat2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 var SCHEMA_CACHE_DIR = ".manni/meta/schema-cache";
@@ -2721,7 +2805,7 @@ var SchemaCache = class {
    * directory.
    */
   entryPath(url) {
-    const key = createHash("sha256").update(url).digest("hex");
+    const key = createHash2("sha256").update(url).digest("hex");
     return join2(this.dir, `${key}.json`);
   }
   /**
@@ -2798,46 +2882,6 @@ var SchemaCache = class {
   }
 };
 
-// src/meta/core/integrity.ts
-import { createHash as createHash2 } from "node:crypto";
-var INTEGRITY_ALGORITHM = "sha256";
-var INTEGRITY_SHAPE = `${INTEGRITY_ALGORITHM}-<64 hex characters>`;
-var INTEGRITY_RE = new RegExp(`^${INTEGRITY_ALGORITHM}-([0-9a-f]{64})$`);
-function integrityOf(bytes) {
-  return `${INTEGRITY_ALGORITHM}-${createHash2(INTEGRITY_ALGORITHM).update(bytes).digest("hex")}`;
-}
-function isIntegrity(value) {
-  return INTEGRITY_RE.test(value);
-}
-function toLf(bytes) {
-  const out = new Uint8Array(bytes.length);
-  let n = 0;
-  for (let i = 0; i < bytes.length; i++) {
-    const byte = bytes[i];
-    if (byte === void 0) continue;
-    if (byte === 13 && bytes[i + 1] === 10) continue;
-    out[n++] = byte;
-  }
-  return out.subarray(0, n);
-}
-function toCrlf(bytes) {
-  const lf = toLf(bytes);
-  const out = new Uint8Array(lf.length * 2);
-  let n = 0;
-  for (let i = 0; i < lf.length; i++) {
-    const byte = lf[i];
-    if (byte === void 0) continue;
-    if (byte === 10) out[n++] = 13;
-    out[n++] = byte;
-  }
-  return out.subarray(0, n);
-}
-function diagnoseIntegrity(bytes, expected) {
-  if (integrityOf(toLf(bytes)) === expected) return "line-endings";
-  if (integrityOf(toCrlf(bytes)) === expected) return "line-endings";
-  return "content";
-}
-
 // src/meta/core/schema-registry.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { resolve as resolvePath } from "node:path";
@@ -5243,8 +5287,8 @@ var SCHEMA_KEYS = [
   "multipleOf"
 ];
 var RETRY_DELAY_MS = 500;
-var wait2 = (ms) => new Promise((resolve18) => {
-  setTimeout(resolve18, ms);
+var wait2 = (ms) => new Promise((resolve19) => {
+  setTimeout(resolve19, ms);
 });
 var RetryableFetchError = class extends DocmetaError {
 };
@@ -5659,8 +5703,10 @@ var DERIVABLE_FIELDS = [
   "authors",
   "owner",
   "reviewed-by",
-  "last-reviewed"
+  "last-reviewed",
+  "provenance"
 ];
+var PROVENANCE_FIELD = "provenance";
 function isBuiltinField(x) {
   return DERIVABLE_FIELDS.includes(x);
 }
@@ -6145,7 +6191,7 @@ function asElementPaths(value, where, source) {
 }
 var OVERRIDE_KEYS = ["collection", "files", "schemas", "elements"];
 var CHECK_KEYS = ["name", "query"];
-var DERIVE_KEYS = ["fields", "sources", "codeowners", "commands"];
+var DERIVE_KEYS = ["fields", "sources", "codeowners", "commands", "machines"];
 var DERIVE_COMMAND_KEYS = ["run", "timeout"];
 var BUILTIN_CLAIMED_BY = {
   created: "git",
@@ -6153,7 +6199,8 @@ var BUILTIN_CLAIMED_BY = {
   authors: "git",
   owner: "codeowners",
   "reviewed-by": "GitHub or GitLab",
-  "last-reviewed": "GitHub or GitLab"
+  "last-reviewed": "GitHub or GitLab",
+  provenance: "git"
 };
 var DERIVED_TABLE_RESERVED = /* @__PURE__ */ new Set(["_path", "_sources"]);
 var DERIVABLE_LIST = `Derivable fields: ${DERIVABLE_FIELDS.join(", ")}, or any key with an entry in derive.commands.`;
@@ -6398,6 +6445,7 @@ function assertManagedFieldsUnowned(config, collections, source, section) {
     if (owner !== void 0) refuse(`derive.commands.${key}`, owner);
   }
   for (const [i, field] of (config.derive?.fields ?? []).entries()) {
+    if (field === PROVENANCE_FIELD) continue;
     const owner = manifestOwning(field, collections);
     if (owner !== void 0) refuse(`derive.fields[${i}] "${field}"`, owner);
   }
@@ -6410,9 +6458,9 @@ function parseDerive(raw, source) {
   }
   const e = raw;
   rejectUnknownKeys2(e, DERIVE_KEYS, '"derive"', source);
-  if (e.fields === void 0 && e.sources === void 0 && e.codeowners === void 0 && e.commands === void 0) {
+  if (e.fields === void 0 && e.sources === void 0 && e.codeowners === void 0 && e.commands === void 0 && e.machines === void 0) {
     throw new DocmetaError(
-      `${source}: "derive" sets nothing. Give it \`fields:\` to manage, \`commands:\` to derive from a command, or \`sources:\` or \`codeowners:\` to shape the reads.`
+      `${source}: "derive" sets nothing. Give it \`fields:\` to manage, \`commands:\` to derive from a command, or \`sources:\`, \`codeowners:\` or \`machines:\` to shape the reads.`
     );
   }
   const commands = e.commands === void 0 ? void 0 : parseDeriveCommands(e.commands, source);
@@ -6463,6 +6511,24 @@ function parseDerive(raw, source) {
     derive.codeowners = e.codeowners;
   }
   if (commands !== void 0) derive.commands = commands;
+  if (e.machines !== void 0) {
+    if (!Array.isArray(e.machines) || e.machines.length === 0 || e.machines.some((m) => typeof m !== "string")) {
+      throw new DocmetaError(
+        `${source}: derive.machines must be a non-empty list of globs, matched against a trailer's name and its email. Default: ["*[bot]"].`
+      );
+    }
+    const machines = [];
+    e.machines.forEach((m, i) => {
+      if (m.trim() === "") {
+        throw new DocmetaError(`${source}: derive.machines[${i}] is blank; a glob must name something.`);
+      }
+      if (machines.includes(m)) {
+        throw new DocmetaError(`${source}: derive.machines lists "${m}" twice.`);
+      }
+      machines.push(m);
+    });
+    derive.machines = machines;
+  }
   return derive;
 }
 function parseDeriveCommands(raw, source) {
@@ -7743,8 +7809,8 @@ var RENAME_ATTEMPTS2 = 3;
 function errorCode2(err) {
   return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
 }
-var wait3 = (ms) => new Promise((resolve18) => {
-  setTimeout(resolve18, ms);
+var wait3 = (ms) => new Promise((resolve19) => {
+  setTimeout(resolve19, ms);
 });
 async function writeTextAtomic(path, text2) {
   const tmp = join5(
@@ -8970,8 +9036,8 @@ var ReviewCache = class {
     }
     if (!isRecord2(raw)) return void 0;
     if (raw.version !== REVIEW_CACHE_VERSION || raw.key !== key) return void 0;
-    const change2 = readChange(raw.change);
-    return change2 ?? void 0;
+    const change = readChange(raw.change);
+    return change ?? void 0;
   }
   set(key, value) {
     if (!this.enabled) return;
@@ -9000,9 +9066,9 @@ function cachedClient(client, cache, identity) {
       const key = `${identity.host}/${identity.project}/${sha}`;
       const hit = cache.get(key);
       if (hit !== void 0) return hit;
-      const change2 = await client.mergedChangeFor(sha);
-      if (change2 !== null) cache.set(key, change2);
-      return change2;
+      const change = await client.mergedChangeFor(sha);
+      if (change !== null) cache.set(key, change);
+      return change;
     }
   };
 }
@@ -9037,7 +9103,7 @@ function run(bin, args, opts) {
       done = true;
       settle(r);
     };
-    const fail = (err) => {
+    const fail2 = (err) => {
       if (done) return;
       done = true;
       reject(err);
@@ -9049,7 +9115,7 @@ function run(bin, args, opts) {
         windowsHide: true
       });
     } catch (err) {
-      fail(err instanceof Error ? err : new Error(String(err)));
+      fail2(err instanceof Error ? err : new Error(String(err)));
       return;
     }
     let stdout = "";
@@ -9085,7 +9151,7 @@ function run(bin, args, opts) {
     }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2);
     child.on("error", (err) => {
       clearTimeout(timer);
-      fail(err.code === "ENOENT" ? new BinMissing(err.message) : err);
+      fail2(err.code === "ENOENT" ? new BinMissing(err.message) : err);
     });
     child.on("close", (code) => {
       clearTimeout(timer);
@@ -9496,17 +9562,17 @@ async function deriveFromReviews(inputs, client) {
       records.set(input.label, NOTHING);
       continue;
     }
-    const change2 = await changeFor(input.sha);
-    records.set(input.label, factsFrom(change2, kind));
+    const change = await changeFor(input.sha);
+    records.set(input.label, factsFrom(change, kind));
   }
   return { status, records };
 }
-function factsFrom(change2, kind) {
-  if (change2 === null || change2.approvals.length === 0) return NOTHING;
-  const ordered = byTime(change2.approvals);
+function factsFrom(change, kind) {
+  if (change === null || change.approvals.length === 0) return NOTHING;
+  const ordered = byTime(change.approvals);
   const latest = ordered.at(-1);
   if (latest === void 0) return NOTHING;
-  const evidence = kind === "gitlab" ? `gitlab MR !${change2.id}` : `github PR #${change2.id}`;
+  const evidence = kind === "gitlab" ? `gitlab MR !${change.id}` : `github PR #${change.id}`;
   const dateEvidence = kind === "gitlab" ? `${evidence} (merge date; GitLab records no approval time)` : evidence;
   return {
     "reviewed-by": {
@@ -9744,87 +9810,631 @@ function toPosix2(p) {
 // src/meta/core/derive/git.ts
 import { constants as bufferConstants } from "node:buffer";
 import { spawn as spawn3 } from "node:child_process";
-import { dirname as dirname8, extname as extname2, relative as relative10, sep as sep5 } from "node:path";
-var DEFAULT_BULK_THRESHOLD = 32;
-var NULL_SHA = "0".repeat(40);
-var MAX_GIT_OUTPUT_BYTES = Math.min(
-  512 * 1024 * 1024,
-  bufferConstants.MAX_STRING_LENGTH
-);
-var HistoryTooLarge = class extends Error {
-};
-var BlobsUnreadable = class extends Error {
-  constructor(detail) {
-    super(detail);
-    this.detail = detail;
+import { dirname as dirname8, extname as extname2, isAbsolute as isAbsolute5, posix as posix2, relative as relative10, sep as sep5 } from "node:path";
+import { parse as parseYaml4 } from "yaml";
+
+// src/shared/pin.ts
+var LineRangeError = class extends ToolError {
+  constructor(message) {
+    super(message);
+    this.name = "LineRangeError";
   }
-  detail;
 };
-function bodyOf(content, fenced) {
-  if (fenced !== true) return content;
-  const loc = locateFrontmatter(content);
-  if (!loc) return content;
-  return content.slice(0, loc.openStart) + content.slice(loc.closeEnd);
+function normalizeText(text2) {
+  const body = text2.charCodeAt(0) === 65279 ? text2.slice(1) : text2;
+  return body.replace(/\r\n/g, "\n");
+}
+function splitLines(text2) {
+  const parts = normalizeText(text2).split("\n");
+  if (parts.length > 0 && parts[parts.length - 1] === "") parts.pop();
+  return parts;
+}
+function sliceLines(lines, range, label) {
+  const start = range?.start;
+  if (start === void 0) return lines.join("\n");
+  const end = range?.end ?? start;
+  if (end < start) {
+    throw new LineRangeError(`${label ?? "the source"} range ${String(start)}-${String(end)} ends before it starts.`);
+  }
+  if (start > lines.length || end > lines.length) {
+    const first = start > lines.length ? start : end;
+    throw new LineRangeError(`${label ?? "the source"} has ${lines.length} lines; line ${first} is out of range.`);
+  }
+  return lines.slice(start - 1, end).join("\n");
+}
+function hashRange(text2, range, key) {
+  return hashLines(sliceLines(splitLines(text2), range), key);
+}
+function hashLines(joined, key) {
+  return key === void 0 ? integrityOf(Buffer.from(joined, "utf8")) : keyedPin(joined, key);
+}
+function isKeyedPin(pin) {
+  return pin.startsWith(KEYED_PIN_PREFIX);
+}
+function pinOfLines(lines, range) {
+  if (range.start < 1 || range.end > lines.length || range.end < range.start) return void 0;
+  return hashLines(lines.slice(range.start - 1, range.end).join("\n"));
+}
+var MOVE_WINDOW_LINES = 2e3;
+var MOVE_BUDGET_BYTES = 64 * 1024 * 1024;
+var MAX_RANGE_LINES = 5e3;
+function findWindows(lines, length, pin, key, opts) {
+  const starts = [];
+  const lastStart = lines.length - length + 1;
+  if (length < 1 || lastStart < 1) return { starts, truncated: false };
+  const joined = (start) => lines.slice(start - 1, start - 1 + length).join("\n");
+  const original = opts?.original;
+  if (original !== void 0) {
+    const first = original[0];
+    for (let start = 1; start <= lastStart; start++) {
+      if (lines[start - 1] !== first) continue;
+      let same = true;
+      for (let i = 1; i < length; i++) {
+        if (lines[start - 1 + i] !== original[i]) {
+          same = false;
+          break;
+        }
+      }
+      if (same && hashLines(joined(start), key) === pin) starts.push(start);
+    }
+    return { starts, truncated: false };
+  }
+  const budget = opts?.budget ?? MOVE_BUDGET_BYTES;
+  const around = opts?.around ?? 1;
+  const bandStart = Math.max(1, around - MOVE_WINDOW_LINES);
+  const bandEnd = Math.min(lastStart, around + MOVE_WINDOW_LINES);
+  const order = [];
+  for (let start = bandStart; start <= bandEnd; start++) order.push(start);
+  for (let start = 1; start < bandStart; start++) order.push(start);
+  for (let start = bandEnd + 1; start <= lastStart; start++) order.push(start);
+  let spent = 0;
+  for (const start of order) {
+    const text2 = joined(start);
+    const bytes = Buffer.byteLength(text2, "utf8");
+    if (spent + bytes > budget) return { starts, truncated: true };
+    spent += bytes;
+    if (hashLines(text2, key) === pin) starts.push(start);
+  }
+  return { starts, truncated: false };
+}
+var RANGE_SPEC = /^([1-9][0-9]*)(?:-([1-9][0-9]*))?$/;
+function parseLines(spec) {
+  if (typeof spec === "number") {
+    return Number.isInteger(spec) && spec >= 1 ? { start: spec, end: spec } : void 0;
+  }
+  const m = RANGE_SPEC.exec(spec);
+  const startText = m?.[1];
+  if (startText === void 0) return void 0;
+  const start = Number(startText);
+  const endText = m?.[2];
+  const end = endText === void 0 ? start : Number(endText);
+  return end < start ? void 0 : { start, end };
+}
+function lineSpec(lines) {
+  return lines.start === lines.end ? lines.start : `${String(lines.start)}-${String(lines.end)}`;
+}
+function spellLines(lines) {
+  return String(lineSpec(lines));
+}
+function toFileLines(lines, bodyLine) {
+  return { start: bodyLine + lines.start - 1, end: bodyLine + lines.end - 1 };
+}
+function toBodyLines(lines, bodyLine) {
+  return { start: lines.start - bodyLine + 1, end: lines.end - bodyLine + 1 };
+}
+function splitPageArgument(arg) {
+  const text2 = arg.startsWith(STDIN_LINES_MARKER) ? `-${arg.slice(STDIN_LINES_MARKER.length)}` : arg;
+  const m = /:([1-9][0-9]*)(?:-([1-9][0-9]*))?$/.exec(text2);
+  const head = m === null ? text2 : text2.slice(0, m.index);
+  if (m === null || head === "") return { page: arg };
+  const start = Number(m[1]);
+  const end = m[2] === void 0 ? start : Number(m[2]);
+  if (end < start) {
+    throw new LineRangeError(`Invalid range "${arg}": end line ${end} is before start line ${start}.`);
+  }
+  return { page: head, lines: { start, end } };
 }
-async function deriveFromGit(inputs, opts) {
-  const records = /* @__PURE__ */ new Map();
-  const byRoot = groupByRoot(inputs);
-  if (byRoot.size === 0) {
-    return {
-      status: {
-        available: false,
-        reason: "no git repository contains the documents"
-      },
-      records
-    };
+
+// src/meta/core/derive/provenance.ts
+import picomatch5 from "picomatch";
+var ZERO_SHA = "0000000000000000000000000000000000000000";
+var DEFAULT_MACHINES = ["*[bot]"];
+var PROVENANCE_POINTER = "/provenance";
+var PLAIN_PIN = /^sha256-[0-9a-f]{64}$/;
+function provenanceEntries(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) continue;
+    const record = item;
+    const machine = record["generated-by"];
+    const lines = record.lines;
+    const integrity = record.integrity;
+    if (typeof machine !== "string" || machine === "") continue;
+    if (typeof lines !== "string" && typeof lines !== "number") continue;
+    if (parseLines(lines) === void 0) continue;
+    if (typeof integrity !== "string" || !PLAIN_PIN.test(integrity)) continue;
+    out.push({ ...record, "generated-by": machine, lines, integrity });
   }
-  const threshold = opts.bulkThreshold ?? DEFAULT_BULK_THRESHOLD;
-  const maxBytes = opts.maxOutputBytes ?? MAX_GIT_OUTPUT_BYTES;
-  const reasons = [];
-  for (const [root, bucket] of byRoot) {
-    const run2 = (args, stdin) => runGit(args, root, stdin, maxBytes);
-    const shallow = await run2(["rev-parse", "--is-shallow-repository"]);
-    if (shallow.missing) {
-      return {
-        status: { available: false, reason: "git is not on PATH" },
-        records: /* @__PURE__ */ new Map()
-      };
+  return out;
+}
+function readProvenancePage(content, opts) {
+  const lines = splitLines(content);
+  const loc = opts?.fenced === false ? null : locateFrontmatter(content);
+  if (loc === null) return { lines, bodyLine: 1, body: lines, stamp: [] };
+  const head = content.slice(0, loc.closeEnd);
+  const newlines = head.split("\n").length - 1;
+  const bodyLine = newlines + (head.endsWith("\n") ? 1 : 2);
+  let stamp = [];
+  try {
+    stamp = provenanceEntries(extractFrontmatter(content, "markdown").data.provenance);
+  } catch {
+    stamp = [];
+  }
+  return { lines, bodyLine, body: lines.slice(bodyLine - 1), stamp };
+}
+var HEADER = /^([0-9a-f]{40}(?:[0-9a-f]{24})?) ([1-9][0-9]*) ([1-9][0-9]*)(?: ([1-9][0-9]*))?$/;
+var ALL_ZERO = /^0+$/;
+function parseLinePorcelain(text2) {
+  const rows = text2.split("\n");
+  if (rows.length > 0 && rows[rows.length - 1] === "") rows.pop();
+  const out = [];
+  let i = 0;
+  while (i < rows.length) {
+    const headerRow = rows[i] ?? "";
+    const m = HEADER.exec(headerRow);
+    const sha = m?.[1];
+    const orig = m?.[2];
+    const final = m?.[3];
+    if (sha === void 0 || orig === void 0 || final === void 0) {
+      throw new Error(`porcelain: expected a header at row ${i + 1}, got ${JSON.stringify(headerRow)}`);
+    }
+    const finalLine = Number(final);
+    const count = m?.[4];
+    const fields = /* @__PURE__ */ new Map();
+    i++;
+    for (let row = rows[i]; row !== void 0 && !row.startsWith("	"); row = rows[i]) {
+      const space2 = row.indexOf(" ");
+      if (space2 === -1) fields.set(row, true);
+      else fields.set(row.slice(0, space2), row.slice(space2 + 1));
+      i++;
     }
-    if (shallow.code !== 0) {
-      reasons.push(`git could not read the repository at ${root}`);
-      continue;
+    const contentRow = rows[i];
+    if (contentRow === void 0) throw new Error(`porcelain: line ${finalLine} has no content row`);
+    const author = fields.get("author");
+    const filename = fields.get("filename");
+    if (typeof author !== "string" || typeof filename !== "string") {
+      throw new Error(`porcelain: line ${finalLine} has no full header; run blame with --line-porcelain`);
     }
-    if (text(shallow).trim() === "true") {
-      reasons.push(
-        `this checkout is shallow; use actions/checkout with fetch-depth: 0 (${root})`
-      );
+    const mail = fields.get("author-mail");
+    const previous = fields.get("previous");
+    const space = typeof previous === "string" ? previous.indexOf(" ") : -1;
+    out.push({
+      sha,
+      origLine: Number(orig),
+      finalLine,
+      ...count !== void 0 ? { groupCount: Number(count) } : {},
+      author,
+      authorMail: typeof mail === "string" ? mail.replace(/^<(.*)>$/, "$1") : "",
+      filename,
+      ...typeof previous === "string" && space !== -1 ? { previous: { sha: previous.slice(0, space), filename: previous.slice(space + 1) } } : {},
+      boundary: fields.get("boundary") === true,
+      uncommitted: ALL_ZERO.test(sha),
+      content: contentRow.slice(1)
+    });
+    i++;
+  }
+  return out;
+}
+var IDENTITY_GLOB = { literalBrackets: true, dot: true, bash: true };
+function machineIdentity(value, machines) {
+  const m = /^(.*?)\s*<([^>]*)>\s*$/.exec(value);
+  const name2 = m === null ? value.trim() : m[1] ?? "";
+  const email = m === null ? "" : m[2] ?? "";
+  const match = (s) => s !== "" && machines.some((glob) => picomatch5.isMatch(s, glob, IDENTITY_GLOB));
+  if (!match(name2) && !match(email)) return void 0;
+  return name2 !== "" ? name2 : email;
+}
+function stampEvidence(commit, origLine, fenced) {
+  if (commit.blob === void 0) return void 0;
+  const page = readProvenancePage(commit.blob, fenced === void 0 ? void 0 : { fenced });
+  const body = origLine - page.bodyLine + 1;
+  if (body < 1) return void 0;
+  for (const entry of commit.stamp === void 0 ? page.stamp : provenanceEntries(commit.stamp)) {
+    const span = parseLines(entry.lines);
+    if (span === void 0 || body < span.start || body > span.end) continue;
+    if (pinOfLines(page.body, span) === entry.integrity) return entry["generated-by"];
+  }
+  return void 0;
+}
+function recordedEvidence(line, ctx) {
+  if (line.uncommitted) return { rule: 5, sha: line.sha };
+  const commit = ctx.commits.get(line.sha);
+  if (commit === void 0) throw new Error(`no commit ${line.sha}`);
+  const stamped = stampEvidence(commit, line.origLine, ctx.fenced);
+  if (stamped !== void 0) return { machine: stamped, rule: 2, sha: line.sha };
+  const generated = commit.trailers.generatedBy.map((v) => v.trim()).find((v) => v !== "");
+  if (generated !== void 0) return { machine: generated, rule: 3, sha: line.sha };
+  for (const value of commit.trailers.coAuthoredBy) {
+    const machine = machineIdentity(value.trim(), ctx.machines);
+    if (machine !== void 0) return { machine, rule: 4, sha: line.sha };
+  }
+  return { rule: 5, sha: line.sha };
+}
+function resolveLineEvidence(line, ctx) {
+  if (line.uncommitted && ctx.generatedBy !== void 0 && ctx.generatedBy !== "") {
+    return { machine: ctx.generatedBy, rule: 1, sha: line.sha };
+  }
+  return recordedEvidence(line, ctx);
+}
+function pinOf(lines, span) {
+  const pin = pinOfLines(lines, span);
+  if (pin === void 0) throw new Error(`provenance: lines ${spellLines(span)} fall outside the body`);
+  return pin;
+}
+function contextOf(input) {
+  return {
+    commits: input.commits,
+    machines: input.machines ?? DEFAULT_MACHINES,
+    ...input.generatedBy !== void 0 ? { generatedBy: input.generatedBy } : {},
+    ...input.fenced !== void 0 ? { fenced: input.fenced } : {}
+  };
+}
+function readOptions(fenced) {
+  return fenced === void 0 ? void 0 : { fenced };
+}
+function deriveProvenance(input) {
+  const page = readProvenancePage(input.content, readOptions(input.fenced));
+  const ctx = contextOf(input);
+  const evidenceByLine = /* @__PURE__ */ new Map();
+  for (const line of input.blame) {
+    const body = line.finalLine - page.bodyLine + 1;
+    if (body < 1) continue;
+    evidenceByLine.set(body, resolveLineEvidence(line, ctx));
+  }
+  const groups = [];
+  let open3;
+  for (let n = 1; n <= page.body.length; n++) {
+    const evidence = evidenceByLine.get(n);
+    const machine = evidence?.machine;
+    if (open3 !== void 0 && machine === open3.machine && n === open3.end + 1) {
+      open3.end = n;
+      continue;
+    }
+    if (open3 !== void 0) groups.push(open3);
+    open3 = machine === void 0 || evidence === void 0 ? void 0 : { machine, start: n, end: n, first: evidence };
+  }
+  if (open3 !== void 0) groups.push(open3);
+  return {
+    page,
+    evidenceByLine,
+    derived: groups.map((g) => {
+      const span = { start: g.start, end: g.end };
+      return {
+        entry: { "generated-by": g.machine, lines: lineSpec(span), integrity: pinOf(page.body, span) },
+        span,
+        evidence: g.first
+      };
+    })
+  };
+}
+function nearest(candidates, recorded) {
+  let best;
+  for (const c of candidates) {
+    const d = Math.abs(c.span.start - recorded.start);
+    if (best === void 0 || d < best.d || d === best.d && c.span.start < best.c.span.start) best = { c, d };
+  }
+  return best?.c;
+}
+var sameSpan = (a, b) => a.start === b.start && a.end === b.end;
+function scanEvidence(evidenceByLine, span, machine) {
+  let anyMachine = false;
+  for (let n = span.start; n <= span.end; n++) {
+    const evidence = evidenceByLine.get(n);
+    if (evidence?.machine === void 0) continue;
+    anyMachine = true;
+    if (evidence.machine !== machine) return { contradiction: evidence, anyMachine };
+  }
+  return { anyMachine };
+}
+function compareProvenance(stamped, derivation) {
+  const { page, evidenceByLine, derived } = derivation;
+  const claimed = /* @__PURE__ */ new Set();
+  const results = [];
+  for (const entry of provenanceEntries(stamped)) {
+    const recorded = parseLines(entry.lines);
+    if (recorded === void 0) continue;
+    const machine = entry["generated-by"];
+    const takenHere = [...claimed].some((d) => sameSpan(d.span, recorded));
+    if (!takenHere && pinOfLines(page.body, recorded) === entry.integrity) {
+      const here = scanEvidence(evidenceByLine, recorded, machine);
+      if (here.contradiction === void 0) {
+        const exact = derived.find(
+          (d) => !claimed.has(d) && sameSpan(d.span, recorded) && d.entry.integrity === entry.integrity
+        );
+        if (exact !== void 0) claimed.add(exact);
+        results.push({ status: "current", entry, span: recorded, ...here.anyMachine ? {} : { noEvidence: true } });
+        continue;
+      }
+    }
+    const pool = derived.filter((d) => !claimed.has(d) && d.entry.integrity === entry.integrity);
+    const hit = nearest(pool, recorded);
+    if (hit !== void 0) {
+      claimed.add(hit);
+      if (hit.entry["generated-by"] !== machine) {
+        results.push({ status: "stale", entry, span: hit.span, evidence: hit.evidence });
+      } else {
+        results.push({ status: sameSpan(hit.span, recorded) ? "current" : "moved", entry, span: hit.span });
+      }
+      continue;
+    }
+    const width = recorded.end - recorded.start + 1;
+    const claimedSpans = [...claimed].map((d) => d.span);
+    const windows = findWindows(page.body, width, entry.integrity, void 0, { around: recorded.start, budget: Infinity }).starts.map((start) => ({ span: { start, end: start + width - 1 } })).filter((w) => !claimedSpans.some((s) => sameSpan(s, w.span)));
+    const found = nearest(windows, recorded);
+    if (found === void 0) {
+      results.push({ status: "changed", entry, span: recorded });
+      continue;
+    }
+    const { contradiction, anyMachine } = scanEvidence(evidenceByLine, found.span, machine);
+    if (contradiction !== void 0) {
+      results.push({ status: "stale", entry, span: found.span, evidence: contradiction });
+      continue;
+    }
+    results.push({
+      status: sameSpan(found.span, recorded) ? "current" : "moved",
+      entry,
+      span: found.span,
+      ...anyMachine ? {} : { noEvidence: true }
+    });
+  }
+  const covering = results.map((r) => r.span);
+  for (const d of derived) {
+    if (claimed.has(d)) continue;
+    let uncovered = false;
+    for (let n = d.span.start; n <= d.span.end && !uncovered; n++) {
+      uncovered = !covering.some((s) => n >= s.start && n <= s.end);
+    }
+    if (uncovered) results.push({ status: "unset", entry: d.entry, span: d.span, evidence: d.evidence });
+  }
+  return results;
+}
+function planProvenanceWrite(comparisons, derivation) {
+  const kept = [];
+  for (const r of comparisons) {
+    if (r.status === "current") kept.push({ entry: r.entry, start: r.span.start });
+    else if (r.status === "moved") kept.push({ entry: { ...r.entry, lines: lineSpec(r.span) }, start: r.span.start });
+  }
+  const same = (a, b) => a["generated-by"] === b["generated-by"] && String(a.lines) === String(b.lines) && a.integrity === b.integrity;
+  const out = [...kept];
+  for (const d of derivation.derived) {
+    if (!kept.some((k) => same(k.entry, d.entry))) out.push({ entry: d.entry, start: d.span.start });
+  }
+  return out.sort((a, b) => a.start - b.start).map((k) => k.entry);
+}
+var short = (sha) => sha.slice(0, 7);
+function fileSpelling(span, bodyLine) {
+  return spellLines(toFileLines(span, bodyLine));
+}
+function evidenceText(evidence) {
+  if (evidence?.machine === void 0) return "pin";
+  return evidence.rule === 1 ? "uncommitted" : `blame ${short(evidence.sha)}`;
+}
+function evidenceRef(evidence) {
+  if (evidence === void 0) return "no evidence";
+  return evidence.rule === 1 ? "uncommitted" : short(evidence.sha);
+}
+function rangeResults(comparisons, bodyLine) {
+  return comparisons.map((r) => {
+    const lines = fileSpelling(r.span, bodyLine);
+    const recorded = parseLines(r.entry.lines);
+    const from = recorded === void 0 ? void 0 : fileSpelling(recorded, bodyLine);
+    const machine = r.entry["generated-by"];
+    switch (r.status) {
+      case "stale":
+        return {
+          lines,
+          "generated-by": r.evidence?.machine ?? machine,
+          integrity: r.entry.integrity,
+          status: r.status,
+          evidence: evidenceText(r.evidence),
+          ...from !== void 0 ? { from: { lines: from, "generated-by": machine } } : {},
+          written: false
+        };
+      case "moved":
+        return {
+          lines,
+          "generated-by": machine,
+          integrity: r.entry.integrity,
+          status: r.status,
+          evidence: "pin",
+          ...from !== void 0 ? { from: { lines: from, "generated-by": machine } } : {},
+          written: false
+        };
+      case "unset":
+        return { lines, "generated-by": machine, integrity: r.entry.integrity, status: r.status, evidence: evidenceText(r.evidence), written: false };
+      case "current":
+      case "changed":
+        return { lines, "generated-by": machine, integrity: r.entry.integrity, status: r.status, evidence: "pin", written: false };
+    }
+  });
+}
+function provenanceFindings(comparisons, bodyLine) {
+  const findings = [];
+  for (const r of comparisons) {
+    const machine = r.entry["generated-by"];
+    const lines = fileSpelling(r.span, bodyLine);
+    let message;
+    switch (r.status) {
+      case "changed":
+        message = `provenance lines ${lines} changed since ${machine} wrote them`;
+        break;
+      case "stale":
+        message = `provenance lines ${lines} say ${machine}; blame says ${r.evidence?.machine ?? "another machine"} (${evidenceRef(r.evidence)})`;
+        break;
+      case "unset":
+        message = `provenance is unset for lines ${lines}; blame says ${machine} (${evidenceRef(r.evidence)})`;
+        break;
+      case "current":
+      case "moved":
+        continue;
+    }
+    findings.push({
+      schema: DERIVED_STALE_SCHEMA,
+      keyword: DERIVED_KEYWORD,
+      subject: `provenance ${r.entry.integrity}`,
+      instancePath: PROVENANCE_POINTER,
+      message: `${message} \u2014 run manni meta derive`,
+      line: toFileLines(r.span, bodyLine).start
+    });
+  }
+  return findings;
+}
+function renderProvenanceValue(entries, bodyLine) {
+  return entries.map((e) => {
+    const span = parseLines(e.lines);
+    const lines = span === void 0 ? String(e.lines) : fileSpelling(span, bodyLine);
+    return `lines ${lines} ${e["generated-by"]}`;
+  }).join("; ");
+}
+function parseProvenanceTarget(arg) {
+  try {
+    return splitPageArgument(arg);
+  } catch (err) {
+    if (err instanceof LineRangeError) throw new DocmetaError(`${arg} ends before it starts.`);
+    throw err;
+  }
+}
+function attributeRange(input) {
+  const { target } = input;
+  const { page: path, lines: range } = parseProvenanceTarget(target);
+  if (range === void 0) throw new Error(`provenance: ${target} names no lines`);
+  const page = readProvenancePage(input.content, readOptions(input.fenced));
+  if (range.end > page.lines.length) {
+    throw new DocmetaError(
+      `${path} has no lines ${spellLines(range)}: the file ends at line ${page.lines.length}.`
+    );
+  }
+  if (range.start < page.bodyLine) {
+    throw new DocmetaError(
+      `${target} reaches into the frontmatter; provenance pins body lines, which start at line ${page.bodyLine}.`
+    );
+  }
+  const ctx = contextOf(input);
+  for (const line of input.blame) {
+    if (line.finalLine < range.start || line.finalLine > range.end) continue;
+    const evidence = recordedEvidence(line, ctx);
+    if (evidence.machine !== void 0 && evidence.machine !== input.generatedBy) {
+      throw new DocmetaError(
+        `${target}: blame attributes these lines to ${evidence.machine} (${short(evidence.sha)}); --generated-by cannot overrule a recorded machine.`
+      );
+    }
+  }
+  const span = toBodyLines(range, page.bodyLine);
+  return { "generated-by": input.generatedBy, lines: lineSpec(span), integrity: pinOf(page.body, span) };
+}
+
+// src/meta/core/derive/git.ts
+var DEFAULT_BULK_THRESHOLD = 32;
+var NULL_SHA = "0".repeat(40);
+var MAX_GIT_OUTPUT_BYTES = Math.min(
+  512 * 1024 * 1024,
+  bufferConstants.MAX_STRING_LENGTH
+);
+var HistoryTooLarge = class extends Error {
+};
+var BlobsUnreadable = class extends Error {
+  constructor(detail) {
+    super(detail);
+    this.detail = detail;
+  }
+  detail;
+};
+var BlameUnreadable = class extends Error {
+  constructor(rel, detail) {
+    super(rel);
+    this.rel = rel;
+    this.detail = detail;
+  }
+  rel;
+  detail;
+};
+function bodyOf(content, fenced) {
+  if (fenced !== true) return content;
+  const loc = locateFrontmatter(content);
+  if (!loc) return content;
+  return content.slice(0, loc.openStart) + content.slice(loc.closeEnd);
+}
+async function deriveFromGit(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const byRoot = groupByRoot(inputs);
+  if (byRoot.size === 0) {
+    return {
+      status: {
+        available: false,
+        reason: "no git repository contains the documents"
+      },
+      records
+    };
+  }
+  const threshold = opts.bulkThreshold ?? DEFAULT_BULK_THRESHOLD;
+  const machines = opts.machines ?? DEFAULT_MACHINES;
+  const wantsProvenance = opts.fields?.includes(PROVENANCE_FIELD) ?? false;
+  const maxBytes = opts.maxOutputBytes ?? MAX_GIT_OUTPUT_BYTES;
+  const reasons = [];
+  for (const [root, bucket] of byRoot) {
+    const run2 = (args, stdin) => runGit(args, root, stdin, maxBytes);
+    const shallow = await run2(["rev-parse", "--is-shallow-repository"]);
+    if (shallow.missing) {
+      return {
+        status: { available: false, reason: "git is not on PATH" },
+        records: /* @__PURE__ */ new Map()
+      };
+    }
+    if (shallow.code !== 0) {
+      reasons.push(`git could not read the repository at ${root}`);
+      continue;
+    }
+    if (text(shallow).trim() === "true") {
+      reasons.push(
+        `this checkout is shallow; use actions/checkout with fetch-depth: 0 (${root})`
+      );
       continue;
     }
-    let histories;
-    let blobs;
     try {
-      histories = bucket.length <= threshold ? await perFileHistories(run2, bucket) : await bulkHistories(run2, bucket);
+      const histories = bucket.length <= threshold ? await perFileHistories(run2, bucket) : await bulkHistories(run2, bucket);
       if (histories === null) {
         reasons.push(`git could not read the history at ${root}`);
         continue;
       }
-      blobs = await fetchBlobs(run2, neededBlobs(histories));
+      const blobs = await fetchBlobs(run2, neededBlobs(histories));
+      for (const entry of bucket) {
+        const history = histories.get(entry.rel) ?? [];
+        const facts = judge(entry.input, root, history, blobs, opts.now, machines);
+        if (wantsProvenance) {
+          const derived = await provenanceFor(run2, root, entry, history, blobs, {
+            machines,
+            ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
+          });
+          facts.provenance = derived.value;
+          facts.provenanceDerivation = derived.derivation;
+        }
+        records.set(entry.input.label, facts);
+      }
     } catch (err) {
       if (err instanceof BlobsUnreadable) {
         reasons.push(`git cat-file could not read the history (${root}): ${err.detail}`);
         continue;
       }
+      if (err instanceof BlameUnreadable) {
+        const why = err.detail === "" ? "" : `: ${err.detail}`;
+        reasons.push(`git blame could not read ${err.rel} (${root})${why}`);
+        continue;
+      }
       if (!(err instanceof HistoryTooLarge)) throw err;
       reasons.push(`git history is too large to read in one pass (${root})`);
       continue;
     }
-    for (const entry of bucket) {
-      const history = histories.get(entry.rel) ?? [];
-      records.set(
-        entry.input.label,
-        judge(entry.input, root, history, blobs, opts.now)
-      );
-    }
   }
   if (reasons.length > 0) {
     return {
@@ -9852,7 +10462,7 @@ function groupByRoot(inputs) {
   }
   return byRoot;
 }
-var RECORD_FORMAT = "--format=%x1e%H%x00%aI%x00%an%x00%ae%x00%(trailers:key=Co-authored-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Reviewed-by,valueonly,unfold,separator=%x1f)";
+var RECORD_FORMAT = "--format=%x1e%H%x00%aI%x00%an%x00%ae%x00%(trailers:key=Co-authored-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Reviewed-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Generated-by,valueonly,unfold,separator=%x1f)";
 var LOG_ARGS = [
   "-c",
   "core.quotePath=false",
@@ -9918,6 +10528,7 @@ function parseLog(text2) {
       authorEmail: fields[3] ?? "",
       coAuthors: splitTrailers(fields[4]),
       reviewedBy: splitTrailers(fields[5]),
+      generatedBy: splitTrailers(fields[6]),
       raw
     });
   }
@@ -10008,6 +10619,7 @@ function attribute(records, wanted) {
         authorEmail: record.authorEmail,
         coAuthors: record.coAuthors,
         reviewedBy: record.reviewedBy,
+        generatedBy: record.generatedBy,
         oldBlob: entry.oldBlob === NULL_SHA ? null : entry.oldBlob,
         newBlob: entry.newBlob === NULL_SHA ? null : entry.newBlob,
         pathAtCommit: entry.newPath
@@ -10057,7 +10669,7 @@ var git = (value, evidence) => ({
   source: "git",
   evidence
 });
-function judge(input, root, history, blobs, now) {
+function judge(input, root, history, blobs, now, machines) {
   const fenced = input.extracted.fenced;
   const extractor = extractorFor(input);
   const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
@@ -10094,11 +10706,11 @@ function judge(input, root, history, blobs, now) {
       stampsOf(newestBody.oldBlob)
     );
   }
-  const authors = bodyChanging.length === 0 ? null : authorsOf(bodyChanging);
+  const authors = bodyChanging.length === 0 ? null : authorsOf(bodyChanging, machines);
   let reviewedBy = null;
   let lastReviewed = null;
   if (!workingChanged && newestBody !== void 0 && newestBody.reviewedBy.length > 0) {
-    const evidence = `Reviewed-by trailer in ${short(newestBody.sha)}`;
+    const evidence = `Reviewed-by trailer in ${short2(newestBody.sha)}`;
     reviewedBy = git(newestBody.reviewedBy.map(nameOf), evidence);
     lastReviewed = git(datePart(newestBody.authorDate), evidence);
   }
@@ -10108,6 +10720,7 @@ function judge(input, root, history, blobs, now) {
     authors,
     "reviewed-by": reviewedBy,
     "last-reviewed": lastReviewed,
+    provenance: null,
     lastBodyCommit,
     root
   };
@@ -10115,24 +10728,26 @@ function judge(input, root, history, blobs, now) {
 function createdOf(oldest, stamps) {
   const stamp = stamps["created"];
   if (stamp !== void 0 && stamp !== null) {
-    return git(stamp, `stamped in ${short(oldest.sha)}`);
+    return git(stamp, `stamped in ${short2(oldest.sha)}`);
   }
   const date = datePart(oldest.authorDate);
-  return git(date, `added in ${short(oldest.sha)} (${date})`);
+  return git(date, `added in ${short2(oldest.sha)} (${date})`);
 }
 function lastUpdatedOf(commit, after, before) {
   const stamp = after["last-updated"];
   if (stamp !== void 0 && stamp !== null && !sameValue(stamp, before["last-updated"])) {
-    return git(stamp, `stamped in ${short(commit.sha)}`);
+    return git(stamp, `stamped in ${short2(commit.sha)}`);
   }
   const date = datePart(commit.authorDate);
-  return git(date, `body changed in ${short(commit.sha)} (${date})`);
+  return git(date, `body changed in ${short2(commit.sha)} (${date})`);
 }
-function authorsOf(bodyChanging) {
+function authorsOf(bodyChanging, machines) {
   const seen = /* @__PURE__ */ new Set();
   const names = [];
   const add = (name2, email) => {
-    if (name2 === "" || name2.endsWith("[bot]")) return;
+    if (name2 === "") return;
+    const identity = email === null || email === "" ? name2 : `${name2} <${email}>`;
+    if (machineIdentity(identity, machines) !== void 0) return;
     const key = email === null || email === "" ? `name:${name2.toLowerCase()}` : email.toLowerCase();
     if (seen.has(key)) return;
     seen.add(key);
@@ -10145,6 +10760,204 @@ function authorsOf(bodyChanging) {
   const n = bodyChanging.length;
   return git(names, `${n} body-changing ${n === 1 ? "commit" : "commits"}`);
 }
+function provenanceFenced(extracted) {
+  return extracted.fenced === true || extracted.format === "markdown" || extracted.format === "mdx";
+}
+var OUTSIDE_RANGE = "outside-the-attributed-range";
+var ATTRIBUTED = ":attributed";
+async function provenanceFor(run2, root, entry, history, blobs, opts) {
+  const { input, rel } = entry;
+  const fenced = provenanceFenced(input.extracted);
+  const blame = await blameOf(run2, rel, input.content);
+  const commits = await commitEvidence(run2, root, entry, blame, history, blobs, input.provenanceManifest);
+  const base = { content: input.content, commits, machines: opts.machines, fenced };
+  let derivation;
+  const attribution = input.attribution;
+  if (attribution !== void 0) {
+    const ranges = attribution.targets.flatMap((target) => {
+      attributeRange({ ...base, blame, target, generatedBy: attribution.generatedBy });
+      const range = parseProvenanceTarget(target).lines;
+      return range === void 0 ? [] : [range];
+    });
+    const inRange = (line) => ranges.some((range) => line.finalLine >= range.start && line.finalLine <= range.end);
+    const attributed = new Map(commits);
+    const trailers = { generatedBy: [attribution.generatedBy], coAuthoredBy: [] };
+    attributed.set(OUTSIDE_RANGE, { sha: OUTSIDE_RANGE, trailers: { generatedBy: [], coAuthoredBy: [] } });
+    const rekeyed = blame.map((line) => {
+      if (inRange(line)) {
+        if (line.uncommitted) return line;
+        const sha = `${line.sha}${ATTRIBUTED}`;
+        attributed.set(sha, { sha, trailers });
+        return { ...line, sha };
+      }
+      return line.uncommitted ? { ...line, sha: OUTSIDE_RANGE, uncommitted: false } : line;
+    });
+    derivation = deriveProvenance({
+      ...base,
+      commits: attributed,
+      generatedBy: attribution.generatedBy,
+      blame: rekeyed
+    });
+  } else {
+    derivation = deriveProvenance({
+      ...base,
+      blame,
+      ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
+    });
+  }
+  const entries = derivation.derived.map((d) => d.entry);
+  return {
+    value: entries.length === 0 ? null : git(entries, provenanceEvidence(derivation)),
+    derivation
+  };
+}
+function provenanceEvidence(derivation) {
+  const shas = [];
+  let uncommitted = false;
+  for (const range of derivation.derived) {
+    for (let n = range.span.start; n <= range.span.end; n++) {
+      const evidence = derivation.evidenceByLine.get(n);
+      if (evidence?.machine === void 0) continue;
+      if (evidence.rule === 1) uncommitted = true;
+      else if (!shas.includes(evidence.sha)) shas.push(evidence.sha);
+    }
+  }
+  const first = shas[0];
+  if (first === void 0) return "uncommitted";
+  const parts = [`blame ${short2(first)}`];
+  if (shas.length > 1) parts.push(`${String(shas.length)} commits`);
+  if (uncommitted) parts.push("uncommitted");
+  return parts.join(", ");
+}
+async function blameOf(run2, rel, content) {
+  const out = await run2([
+    "-c",
+    "core.quotePath=false",
+    "blame",
+    "--no-ignore-revs-file",
+    "--line-porcelain",
+    "--",
+    rel
+  ]);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) {
+    const inHead = await run2(["cat-file", "-e", `HEAD:${rel}`]);
+    if (inHead.code !== 0) {
+      return splitLines(content).map((line, i) => ({
+        sha: ZERO_SHA,
+        origLine: i + 1,
+        finalLine: i + 1,
+        author: "Not Committed Yet",
+        authorMail: "not.committed.yet",
+        filename: rel,
+        boundary: false,
+        uncommitted: true,
+        content: line
+      }));
+    }
+    throw new BlameUnreadable(rel, out.stderr.trim());
+  }
+  return parseLinePorcelain(text(out));
+}
+async function commitEvidence(run2, root, entry, blame, history, blobs, manifest) {
+  const pathAt = /* @__PURE__ */ new Map();
+  for (const line of blame) {
+    if (!line.uncommitted && !pathAt.has(line.sha)) pathAt.set(line.sha, unquotePath(line.filename));
+  }
+  const shas = [...pathAt.keys()];
+  const commits = /* @__PURE__ */ new Map();
+  if (shas.length === 0) return commits;
+  const trailers = /* @__PURE__ */ new Map();
+  const pageBlob = /* @__PURE__ */ new Map();
+  for (const h of history) {
+    trailers.set(h.sha, { generatedBy: h.generatedBy, coAuthoredBy: h.coAuthors });
+    const blob = h.newBlob === null ? void 0 : blobs.get(h.newBlob);
+    if (blob !== void 0) pageBlob.set(h.sha, blob);
+  }
+  const unlogged = shas.filter((sha) => !trailers.has(sha));
+  if (unlogged.length > 0) {
+    const out = await run2(["log", "--no-walk=unsorted", RECORD_FORMAT, ...unlogged]);
+    if (out.tooLarge) throw new HistoryTooLarge();
+    if (out.code !== 0) throw new BlobsUnreadable(`git log exit ${String(out.code)}`);
+    for (const record of parseLog(text(out))) {
+      trailers.set(record.sha, { generatedBy: record.generatedBy, coAuthoredBy: record.coAuthors });
+    }
+  }
+  const manifestRel = manifest === void 0 ? void 0 : insideRoot(root, manifest.absPath);
+  const specs = [];
+  for (const sha of shas) {
+    if (!pageBlob.has(sha)) specs.push(`${sha}:${pathAt.get(sha) ?? ""}`);
+    if (manifestRel !== void 0) specs.push(`${sha}:${manifestRel}`);
+  }
+  const fetched = await fetchSpecs(run2, specs);
+  for (const sha of shas) {
+    const blob = pageBlob.get(sha) ?? fetched.get(`${sha}:${pathAt.get(sha) ?? ""}`);
+    commits.set(sha, {
+      sha,
+      trailers: trailers.get(sha) ?? { generatedBy: [], coAuthoredBy: [] },
+      ...blob !== void 0 ? { blob } : {},
+      ...manifest !== void 0 ? {
+        stamp: manifestRel === void 0 ? [] : manifestStamp(
+          fetched.get(`${sha}:${manifestRel}`),
+          manifest.join === "path" ? entryAt(manifest.entry, entry.rel, pathAt.get(sha) ?? entry.rel) : manifest.entry,
+          manifest.join
+        )
+      } : {}
+    });
+  }
+  return commits;
+}
+function insideRoot(root, abs) {
+  const rel = relative10(root, abs);
+  if (rel === "" || rel.startsWith("..") || isAbsolute5(rel)) return void 0;
+  return rel.split(sep5).join("/");
+}
+function entryAt(entry, rel, relAtCommit) {
+  if (relAtCommit === rel) return entry;
+  const fromHere = posix2.relative(posix2.dirname(rel), relAtCommit);
+  return posix2.join(posix2.dirname(entry), fromHere);
+}
+function manifestStamp(text2, key, join10) {
+  if (text2 === void 0) return [];
+  let data;
+  try {
+    data = parseYaml4(text2);
+  } catch {
+    return [];
+  }
+  if (!isRecord4(data)) return [];
+  for (const [candidate, value] of Object.entries(data)) {
+    const same = join10 === "path" ? posix2.normalize(candidate) === posix2.normalize(key) : candidate === key;
+    if (same && isRecord4(value)) return provenanceEntries(value[PROVENANCE_FIELD]);
+  }
+  return [];
+}
+function isRecord4(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+async function fetchSpecs(run2, specs) {
+  const found = /* @__PURE__ */ new Map();
+  if (specs.length === 0) return found;
+  const out = await run2(["cat-file", "--batch"], `${specs.join("\n")}
+`);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  const buf = out.raw;
+  let cursor = 0;
+  for (const spec of specs) {
+    const nl = buf.indexOf(10, cursor);
+    if (nl === -1) break;
+    const header = buf.toString("utf8", cursor, nl);
+    cursor = nl + 1;
+    if (header.endsWith(" missing") || header.endsWith(" ambiguous")) continue;
+    const parts = header.split(" ");
+    const size = Number(parts[2]);
+    if (!Number.isFinite(size)) break;
+    if (parts[1] === "blob") found.set(spec, buf.toString("utf8", cursor, cursor + size));
+    cursor += size + 1;
+  }
+  return found;
+}
 function extractorFor(input) {
   return extractorByName(input.extracted.format) ?? extractorForExtension(extname2(input.absPath));
 }
@@ -10163,7 +10976,7 @@ function sameBody(a, b) {
 function sameValue(a, b) {
   return toJsonText(a) === toJsonText(b);
 }
-var short = (sha) => sha.slice(0, 7);
+var short2 = (sha) => sha.slice(0, 7);
 var datePart = (iso) => iso.slice(0, 10);
 function localDate(d) {
   const pad2 = (n) => String(n).padStart(2, "0");
@@ -10177,6 +10990,7 @@ function emailOf(trailer) {
   const m = /<([^>]*)>\s*$/.exec(trailer);
   return m?.[1]?.trim() ?? null;
 }
+var MAX_STDERR_BYTES = 16 * 1024;
 function text(out) {
   try {
     return out.raw.toString("utf8");
@@ -10192,7 +11006,7 @@ function runGit(args, cwd, stdin, maxBytes) {
       done = true;
       settle(out);
     };
-    const fail = (err) => {
+    const fail2 = (err) => {
       if (done) return;
       done = true;
       reject(err instanceof Error ? err : new Error(String(err)));
@@ -10201,7 +11015,8 @@ function runGit(args, cwd, stdin, maxBytes) {
       code: null,
       raw: Buffer.alloc(0),
       missing,
-      tooLarge: false
+      tooLarge: false,
+      stderr: ""
     });
     let child;
     try {
@@ -10224,7 +11039,14 @@ function runGit(args, cwd, stdin, maxBytes) {
       }
       chunks.push(chunk);
     });
-    child.stderr.resume();
+    const errChunks = [];
+    let errTotal = 0;
+    child.stderr.on("data", (chunk) => {
+      if (errTotal >= MAX_STDERR_BYTES) return;
+      const kept = chunk.subarray(0, MAX_STDERR_BYTES - errTotal);
+      errTotal += kept.length;
+      errChunks.push(kept);
+    });
     child.on("error", (err) => {
       finish(failed(err.code === "ENOENT"));
     });
@@ -10233,9 +11055,10 @@ function runGit(args, cwd, stdin, maxBytes) {
     child.on("close", (code) => {
       try {
         const raw = tooLarge ? Buffer.alloc(0) : Buffer.concat(chunks);
-        finish({ code, raw, missing: false, tooLarge });
+        const stderr = Buffer.concat(errChunks).toString("utf8");
+        finish({ code, raw, missing: false, tooLarge, stderr });
       } catch (err) {
-        fail(err);
+        fail2(err);
       }
     });
     if (stdin === void 0) child.stdin.end();
@@ -10250,7 +11073,8 @@ var FIELD_SOURCES = {
   authors: ["git"],
   owner: ["codeowners"],
   "reviewed-by": ["github", "gitlab", "git"],
-  "last-reviewed": ["github", "gitlab", "git"]
+  "last-reviewed": ["github", "gitlab", "git"],
+  provenance: ["git"]
 };
 var REVIEW_SOURCES = ["github", "gitlab"];
 var HOST_NAME = {
@@ -10284,10 +11108,20 @@ async function deriveMetadata(inputs, ctx) {
   const sources = {};
   let git2 = /* @__PURE__ */ new Map();
   if (consulted.has("git")) {
-    const result = await deriveFromGit(inputs, { cwd: ctx.cwd, now: ctx.now });
+    const result = await deriveFromGit(inputs, {
+      cwd: ctx.cwd,
+      now: ctx.now,
+      fields: ctx.fields,
+      ...ctx.generatedBy !== void 0 ? { generatedBy: ctx.generatedBy } : {},
+      ...ctx.machines !== void 0 ? { machines: ctx.machines } : {}
+    });
     sources.git = result.status;
     git2 = result.records;
   }
+  const provenance = /* @__PURE__ */ new Map();
+  for (const [label, facts] of git2) {
+    if (facts.provenanceDerivation !== void 0) provenance.set(label, facts.provenanceDerivation);
+  }
   const rootCache = /* @__PURE__ */ new Map();
   const rootOf = (absPath) => {
     const dir = dirname9(absPath);
@@ -10365,7 +11199,7 @@ async function deriveMetadata(inputs, ctx) {
     }
     records.set(input.label, { file: input.label, fields });
   }
-  return { records, sources };
+  return { records, sources, ...provenance.size > 0 ? { provenance } : {} };
 }
 function valueFrom(source, field, git2, reviews, owner, commanded) {
   switch (source) {
@@ -10448,6 +11282,9 @@ function commandsOf(config) {
   }
   return out;
 }
+function machinesOf(config) {
+  return config?.machines ?? DEFAULT_MACHINES;
+}
 
 // src/meta/core/derive/table.ts
 var DERIVED_VIEW = "derived";
@@ -10462,10 +11299,11 @@ function mentionsDerived(sql) {
   return /\b(?:from|join|update|into|table|view)\s+(?:"derived"|derived\b)/i.test(sql);
 }
 function fieldsForSql(sql, fields) {
-  if (sql.includes("*") || /\b_(?:sources|origin)\b/i.test(sql)) return [...fields];
-  return fields.filter(
-    (field) => new RegExp(`(?<![\\w-])${escapeRegExp(field)}(?![\\w-])`, "i").test(sql)
-  );
+  const named = (field) => new RegExp(`(?<![\\w-])${escapeRegExp(field)}(?![\\w-])`, "i").test(sql);
+  if (sql.includes("*") || /\b_(?:sources|origin)\b/i.test(sql)) {
+    return fields.filter((field) => field !== PROVENANCE_FIELD || named(field));
+  }
+  return fields.filter(named);
 }
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -10559,16 +11397,18 @@ function createResolvedView(db, docsColumns, commands) {
 async function deriveForTable(inputs, ctx, hint, fields) {
   const derive = ctx.config?.derive;
   const commands = commandsOf(derive);
+  const managesProvenance = derive?.fields.includes(PROVENANCE_FIELD) === true && !fields.includes(PROVENANCE_FIELD);
   const result = await deriveMetadata(inputs, {
     cwd: ctx.cwd,
     base: ctx.base,
     ...ctx.configDir !== void 0 ? { configDir: ctx.configDir } : {},
     sources: derive?.sources ?? [...DERIVE_SOURCES],
-    fields,
+    fields: managesProvenance ? [...fields, PROVENANCE_FIELD] : fields,
     ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
     ...commands !== void 0 ? { commands } : {},
     cache: ctx.cache,
-    now: ctx.now ?? (() => /* @__PURE__ */ new Date())
+    now: ctx.now ?? (() => /* @__PURE__ */ new Date()),
+    machines: machinesOf(derive)
   });
   assertSourcesAvailable(result.sources, hint);
   return result.records;
@@ -10576,7 +11416,7 @@ async function deriveForTable(inputs, ctx, hint, fields) {
 
 // src/meta/commands/validate.ts
 import { readFile as readFile8 } from "node:fs/promises";
-import { resolve as resolve12, extname as extname3 } from "node:path";
+import { resolve as resolve13, extname as extname3 } from "node:path";
 
 // src/meta/core/checks.ts
 var CHECK_KEYWORD = "check";
@@ -10713,6 +11553,71 @@ async function runChecks(checks, entries, ctx = {}) {
   return merged;
 }
 
+// src/meta/core/derive/provenance-place.ts
+import { isAbsolute as isAbsolute6, relative as relative11, resolve as resolve12, sep as sep6 } from "node:path";
+var toPosix3 = (p) => p.split(sep6).join("/");
+function provenanceManifests(collections, configDir, base) {
+  const out = [];
+  for (const collection of collections) {
+    for (const manifest of collection.externalMetadata) {
+      if (!manifest.keys.includes(PROVENANCE_FIELD)) continue;
+      if (classifyRef(manifest.file).kind === "url") {
+        throw new DocmetaError(
+          `collection ${collection.name}: ${PROVENANCE_FIELD} cannot come from a URL manifest, because manni meta derive writes it.`
+        );
+      }
+      const absPath = isAbsolute6(manifest.file) ? manifest.file : resolve12(configDir, manifest.file);
+      const rel = relative11(base, absPath);
+      out.push({
+        collection: collection.name,
+        absPath,
+        file: rel === "" ? "." : toPosix3(rel),
+        join: externalMetadataJoin(manifest)
+      });
+    }
+  }
+  return out;
+}
+function provenancePlace(label, data, manifests, collections, configDir, base) {
+  if (manifests.length === 0) return void 0;
+  const members = new Set(memberOf(collections, configDir, base, label));
+  const owning = manifests.filter((m) => members.has(m.collection));
+  const [manifest, second] = owning;
+  if (manifest === void 0) return void 0;
+  if (second !== void 0) {
+    throw new DocmetaError(
+      `${label} is in collections ${manifest.collection} and ${second.collection}, and both keep ${PROVENANCE_FIELD} in a manifest.`
+    );
+  }
+  if (manifest.join === PATH_JOIN) {
+    const entry = toPosix3(relative11(configDir, resolve12(base, label)));
+    return { manifest, absPath: manifest.absPath, entry, join: manifest.join };
+  }
+  const value = data[manifest.join];
+  if (typeof value !== "string" && typeof value !== "number") {
+    throw new DocmetaError(
+      `${label} carries no ${manifest.join}, which ${manifest.file} joins on, so its ${PROVENANCE_FIELD} has no entry there.`
+    );
+  }
+  return { manifest, absPath: manifest.absPath, entry: String(value), join: manifest.join };
+}
+function readerManifests(collections, configDir, base) {
+  const local = collections.map((c) => ({
+    ...c,
+    externalMetadata: c.externalMetadata.filter((m) => classifyRef(m.file).kind !== "url")
+  }));
+  return provenanceManifests(local, configDir, base);
+}
+function readerPlace(label, data, manifests, collections, configDir, base) {
+  try {
+    const place = provenancePlace(label, data, manifests, collections, configDir, base);
+    return place === void 0 ? void 0 : { absPath: place.absPath, entry: place.entry, join: place.join };
+  } catch (err) {
+    if (err instanceof DocmetaError) return void 0;
+    throw err;
+  }
+}
+
 // src/meta/commands/validate.ts
 function parseErrorResult(file, format, message, keyword) {
   const err = {
@@ -10836,6 +11741,7 @@ async function runValidate(opts) {
   const deriveFields = new Set(deriveWillRun ? deriveConfig.fields : []);
   const readable = derivableFields(deriveCommands);
   for (const c of derivedChecks) for (const f of fieldsForSql(c.query, readable)) deriveFields.add(f);
+  const provenanceManifests2 = keepDeriveInputs && deriveFields.has(PROVENANCE_FIELD) ? readerManifests(declaredCollections, configDir ?? cwd, base) : [];
   const derivedOnce = once(async () => {
     const derived = await deriveMetadata(deriveInputs, {
       cwd,
@@ -10846,7 +11752,8 @@ async function runValidate(opts) {
       ...deriveConfig?.codeowners !== void 0 ? { codeowners: deriveConfig.codeowners } : {},
       ...deriveCommands !== void 0 ? { commands: deriveCommands } : {},
       cache: opts.cache ?? true,
-      now: opts.now ?? (() => /* @__PURE__ */ new Date())
+      now: opts.now ?? (() => /* @__PURE__ */ new Date()),
+      machines: machinesOf(deriveConfig)
     });
     assertSourcesAvailable(
       derived.sources,
@@ -10880,7 +11787,14 @@ async function runValidate(opts) {
       return;
     }
     if (keepDeriveInputs && label !== STDIN_LABEL) {
-      deriveInputs.push({ label, absPath: resolve12(base, label), content, extracted });
+      const place = provenanceManifests2.length === 0 ? void 0 : readerPlace(label, extracted.data, provenanceManifests2, declaredCollections, configDir ?? cwd, base);
+      deriveInputs.push({
+        label,
+        absPath: resolve13(base, label),
+        content,
+        extracted,
+        ...place !== void 0 ? { provenanceManifest: place } : {}
+      });
     }
     const merged = mergeExternalMetadata(label, extracted, externalMetadata, members, base, {
       encryptionKey
@@ -10993,7 +11907,7 @@ async function runValidate(opts) {
     await processOne(STDIN_LABEL, content, forcedExtractor.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile8(resolve12(base, file), "utf8");
+    const content = await readFile8(resolve13(base, file), "utf8");
     await processOne(file, content, extname3(file));
   }
   if (unverified > 0) opts.onNotice?.(unverifiedWarning(unverified));
@@ -11083,18 +11997,23 @@ async function runValidate(opts) {
         }
         marked = [...managed.marked, ...await validator.markedPointers(stamped, managed.refs)];
       }
-      const findings = staleFindings(
-        fields.map((field) => {
-          const compared = compareDerived(
-            field,
-            managed !== void 0 ? managed.data[field] : input.extracted.data[field],
-            record.fields[field]
+      const asserted = (field) => managed !== void 0 ? managed.data[field] : input.extracted.data[field];
+      const findings = fields.flatMap((field) => {
+        if (field === PROVENANCE_FIELD) {
+          const derivation = derived.provenance?.get(input.label);
+          if (derivation === void 0) return [];
+          return provenanceFindings(
+            compareProvenance(provenanceEntries(asserted(field)), derivation),
+            derivation.page.bodyLine
           );
-          const at2 = pointerOf(field);
-          return marked.some((p) => isAtOrUnder(p, at2)) ? redactedDerived(compared) : compared;
-        }),
-        input.extracted.lineFor
-      );
+        }
+        const compared = compareDerived(field, asserted(field), record.fields[field]);
+        const at2 = pointerOf(field);
+        return staleFindings(
+          [marked.some((p) => isAtOrUnder(p, at2)) ? redactedDerived(compared) : compared],
+          input.extracted.lineFor
+        );
+      });
       if (findings.length === 0) continue;
       result.errors.push(...findings);
       result.ok = false;
@@ -11132,13 +12051,13 @@ async function runValidate(opts) {
 
 // src/meta/commands/get.ts
 import { readFile as readFile9 } from "node:fs/promises";
-import { resolve as resolve13, extname as extname4 } from "node:path";
+import { resolve as resolve14, extname as extname4 } from "node:path";
 async function runGet(opts) {
   const cwd = opts.cwd ?? process.cwd();
   if (opts.fields.length === 0) {
     throw new DocmetaError("Specify at least one field to get.");
   }
-  const { config, inputs, base, configDir, collections, fromCollections, configFile } = await resolveRunConfig({
+  const { config, inputs, base, configDir, collections, declaredCollections, fromCollections, configFile } = await resolveRunConfig({
     cwd,
     configPath: opts.configPath,
     noConfig: opts.noConfig,
@@ -11197,7 +12116,10 @@ async function runGet(opts) {
   const deriving = opts.derived !== false;
   const derivableFields2 = deriving ? opts.fields.filter((f) => isBuiltinField(f) || Object.hasOwn(commands, f)) : [];
   const deriveInputs = [];
+  const wantsProvenance = opts.fields.includes(PROVENANCE_FIELD);
+  const provenanceManifests2 = deriving && derivableFields2.includes(PROVENANCE_FIELD) ? readerManifests(declaredCollections, configDir ?? cwd, base) : [];
   const carried = /* @__PURE__ */ new Map();
+  const bodyLines = /* @__PURE__ */ new Map();
   const readOne = (label, content, extension) => {
     const extractor = forced ?? extractorForExtension(extension);
     if (!extractor) {
@@ -11212,13 +12134,18 @@ async function runGet(opts) {
         elements: resolveElements(label, config, members)
       });
       if (deriving && label !== STDIN_LABEL) {
+        const place = provenanceManifests2.length === 0 ? void 0 : readerPlace(label, own2.data, provenanceManifests2, declaredCollections, configDir ?? cwd, base);
         deriveInputs.push({
           label,
-          absPath: resolve13(base, label),
+          absPath: resolve14(base, label),
           content,
-          extracted: own2
+          extracted: own2,
+          ...place !== void 0 ? { provenanceManifest: place } : {}
         });
       }
+      if (wantsProvenance) {
+        bodyLines.set(label, readProvenancePage(content, { fenced: provenanceFenced(own2) }).bodyLine);
+      }
       extracted = mergeExternalMetadata(label, own2, externalMetadata, members, base, {
         encryptionKey: joinKey
       }).extracted;
@@ -11235,7 +12162,13 @@ async function runGet(opts) {
       carries[f] = carriesField(extracted.data, f);
     }
     carried.set(label, carries);
-    out.push({ file: label, present: extracted.present, values });
+    const bodyLine = bodyLines.get(label);
+    out.push({
+      file: label,
+      present: extracted.present,
+      values,
+      ...bodyLine !== void 0 ? { provenance: { bodyLine } } : {}
+    });
   };
   if (usingStdin) {
     if (!forced) {
@@ -11246,7 +12179,7 @@ async function runGet(opts) {
     readOne(STDIN_LABEL, opts.stdinContent ?? "", forced.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile9(resolve13(base, file), "utf8");
+    const content = await readFile9(resolve14(base, file), "utf8");
     readOne(file, content, extname4(file));
   }
   if (deriving) {
@@ -11269,6 +12202,7 @@ async function runGet(opts) {
 async function attachResolved(out, inputs, opts) {
   const { run: run2 } = opts;
   const derive = run2.config?.derive;
+  let provenance = /* @__PURE__ */ new Map();
   const commands = commandsOf(derive);
   const records = opts.derivable.length === 0 || inputs.length === 0 ? /* @__PURE__ */ new Map() : await (async () => {
     const result = await deriveMetadata(inputs, {
@@ -11280,12 +12214,14 @@ async function attachResolved(out, inputs, opts) {
       ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
       ...commands !== void 0 ? { commands } : {},
       cache: run2.cache,
-      now: run2.now
+      now: run2.now,
+      machines: machinesOf(derive)
     });
     assertSourcesAvailable(
       result.sources,
       "pass --no-derived, or narrow derive.sources"
     );
+    if (result.provenance !== void 0) provenance = result.provenance;
     return result.records;
   })();
   for (const r of out) {
@@ -11313,6 +12249,11 @@ async function attachResolved(out, inputs, opts) {
     if (opts.derivable.length > 0) r.derived = derived;
     r.resolved = resolved;
     r.origin = origin;
+    const derivation = provenance.get(r.file);
+    if (r.provenance !== void 0 && derivation !== void 0) {
+      const comparisons = compareProvenance(provenanceEntries(r.values[PROVENANCE_FIELD]), derivation);
+      r.provenance.current = comparisons.every((c) => c.status === "current");
+    }
   }
 }
 function resolveField(data, field) {
@@ -11365,15 +12306,15 @@ function parseJsonPointer(pointer) {
 // src/meta/commands/schemas.ts
 import { existsSync as existsSync4 } from "node:fs";
 import { mkdir as mkdir2, readFile as readFile10 } from "node:fs/promises";
-import { dirname as dirname10, extname as extname5, isAbsolute as isAbsolute5, join as join8, relative as relative11, resolve as resolve14, sep as sep6 } from "node:path";
-import { parseDocument as parseDocument5, parse as parseYaml4, stringify as stringify2 } from "yaml";
+import { dirname as dirname10, extname as extname5, isAbsolute as isAbsolute7, join as join8, relative as relative12, resolve as resolve15, sep as sep7 } from "node:path";
+import { parseDocument as parseDocument5, parse as parseYaml5, stringify as stringify2 } from "yaml";
 function getSchemasInfo() {
   return { builtins: listBuiltins(), formats: listFormats() };
 }
 var DEFAULT_VENDOR_DIR = "./schema";
 var DEFAULT_CONFIG_NAME = "manni.config.yaml";
 function posixRelative(from, to) {
-  return relative11(from, to).split(sep6).join("/");
+  return relative12(from, to).split(sep7).join("/");
 }
 function vendorFileName(url) {
   let parsed2;
@@ -11447,7 +12388,7 @@ function reparseConfig(text2, source, section) {
     parseConfig(text2, source);
     return;
   }
-  const doc = parseYaml4(text2);
+  const doc = parseYaml5(text2);
   parseConfigValue(doc[section], source, section);
 }
 async function runVendorSchema(opts) {
@@ -11459,13 +12400,13 @@ async function runVendorSchema(opts) {
     );
   }
   const loaded = await loadConfig(opts.configPath, cwd);
-  const configPath = loaded?.path ?? resolve14(cwd, DEFAULT_CONFIG_NAME);
+  const configPath = loaded?.path ?? resolve15(cwd, DEFAULT_CONFIG_NAME);
   const configDir = loaded?.dir ?? cwd;
-  const absDir = resolve14(cwd, opts.dir ?? DEFAULT_VENDOR_DIR);
+  const absDir = resolve15(cwd, opts.dir ?? DEFAULT_VENDOR_DIR);
   const absFile = join8(absDir, vendorFileName(url));
   await assertNotIgnored(absFile, absDir, cwd, opts.onNotice);
   const fromConfig = posixRelative(configDir, absFile);
-  const ref = isAbsolute5(fromConfig) || fromConfig === "" ? absFile : fromConfig.startsWith(".") ? fromConfig : `./${fromConfig}`;
+  const ref = isAbsolute7(fromConfig) || fromConfig === "" ? absFile : fromConfig.startsWith(".") ? fromConfig : `./${fromConfig}`;
   const { bytes } = await fetchSchemaBytes(url, {
     ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
     ...opts.maxBytes !== void 0 ? { maxBytes: opts.maxBytes } : {}
@@ -11642,7 +12583,7 @@ async function runInferSchema(opts) {
   }
   let absOut;
   if (opts.out !== void 0) {
-    absOut = resolve14(cwd, opts.out);
+    absOut = resolve15(cwd, opts.out);
     await assertNotIgnored(
       absOut,
       dirname10(absOut),
@@ -11730,7 +12671,7 @@ async function runInferSchema(opts) {
     scanOne(STDIN_LABEL, opts.stdinContent ?? "", forced.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile10(resolve14(base, file), "utf8");
+    const content = await readFile10(resolve15(base, file), "utf8");
     scanOne(file, content, extname5(file));
   }
   for (const u of unreadable) {
@@ -11792,7 +12733,7 @@ async function runInferSchema(opts) {
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { existsSync as existsSync5 } from "node:fs";
 import { mkdir as mkdir3, open as open2, readFile as readFile11, rename as rename3, rm as rm3 } from "node:fs/promises";
-import { dirname as dirname11, isAbsolute as isAbsolute6, resolve as resolve15, extname as extname6, sep as sep7 } from "node:path";
+import { dirname as dirname11, isAbsolute as isAbsolute8, resolve as resolve16, extname as extname6, sep as sep8 } from "node:path";
 
 // src/shared/prompt.ts
 import { createInterface } from "node:readline";
@@ -12009,10 +12950,10 @@ async function runQuery(opts) {
     readOne(STDIN_LABEL, opts.stdinContent ?? "", ext);
   }
   for (const file of files) {
-    const content = await readFile11(resolve15(base, file), "utf8");
+    const content = await readFile11(resolve16(base, file), "utf8");
     readOne(file, content, extname6(file));
   }
-  const db = opts.db === void 0 ? void 0 : { resolved: resolve15(cwd, opts.db), display: opts.db };
+  const db = opts.db === void 0 ? void 0 : { resolved: resolve16(cwd, opts.db), display: opts.db };
   const run2 = await runSql(sql, entries, {
     target: db,
     params: boundParams,
@@ -12143,13 +13084,21 @@ async function runSql(sql, entries, ctx) {
     if (target) buildViews();
     const buildDerived = async () => {
       if (derivedTable.built) return;
-      const inputs = entries.filter((e) => e.label !== STDIN_LABEL).map((e) => ({
-        label: e.label,
-        absPath: resolve15(ctx.base, e.label),
-        content: e.content,
-        extracted: e.own
-      }));
       const commands = commandsOf(ctx.config?.derive);
+      const fields = fieldsForSql(sql, derivableFields(commands));
+      const provenanceDerived = fields.includes(PROVENANCE_FIELD) || ctx.config?.derive?.fields.includes(PROVENANCE_FIELD) === true;
+      const manifestRoot = ctx.configDir ?? ctx.cwd;
+      const manifests = provenanceDerived ? readerManifests(ctx.declaredCollections, manifestRoot, ctx.base) : [];
+      const inputs = entries.filter((e) => e.label !== STDIN_LABEL).map((e) => {
+        const place = manifests.length === 0 ? void 0 : readerPlace(e.label, e.own.data, manifests, ctx.declaredCollections, manifestRoot, ctx.base);
+        return {
+          label: e.label,
+          absPath: resolve16(ctx.base, e.label),
+          content: e.content,
+          extracted: e.own,
+          ...place !== void 0 ? { provenanceManifest: place } : {}
+        };
+      });
       const records = await deriveForTable(
         inputs,
         {
@@ -12161,7 +13110,7 @@ async function runSql(sql, entries, ctx) {
           ...ctx.now !== void 0 ? { now: ctx.now } : {}
         },
         "narrow derive.sources in manni.config.yaml",
-        fieldsForSql(sql, derivableFields(commands))
+        fields
       );
       createDerivedView(db, records, derivedColumns(commands));
       createResolvedView(db, dataColumns, commands);
@@ -12603,20 +13552,20 @@ function displayPath(ctx, abs) {
 }
 function assertSchemaWriteWithin(ctx, abs) {
   const within = posixRelative(ctx.trustRoot.dir, abs);
-  if (within !== "" && !within.startsWith("..") && !isAbsolute6(within)) return;
+  if (within !== "" && !within.startsWith("..") && !isAbsolute8(within)) return;
   throw new DocmetaError(
     `The resolved schema "${abs}" lives outside ${ctx.trustRoot.dir}; DDL edits schemas inside the repository. Evolve it where it lives, or vendor a copy in.`
   );
 }
 function foldPath(p) {
-  const abs = resolve15(p);
+  const abs = resolve16(p);
   return process.platform === "win32" ? abs.toLowerCase() : abs;
 }
 function filePinsByPath(ctx) {
   const byPath = /* @__PURE__ */ new Map();
   for (const [ref, pin] of collectSchemaPins(ctx.config)) {
     if (classifyRef(ref).kind !== "file") continue;
-    byPath.set(foldPath(resolve15(ctx.cwd, ref)), pin);
+    byPath.set(foldPath(resolve16(ctx.cwd, ref)), pin);
   }
   return byPath;
 }
@@ -12644,7 +13593,7 @@ async function loadSetMembers(refs, ctx) {
       });
       continue;
     }
-    const abs = resolve15(ctx.cwd, ref);
+    const abs = resolve16(ctx.cwd, ref);
     const canon = foldPath(abs);
     if (seenFiles.has(canon)) continue;
     seenFiles.add(canon);
@@ -12849,7 +13798,7 @@ async function planSchemaMutation(ops, entries, ctx) {
     const [, name2, ver] = target.builtinId.split(":");
     const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "-");
     const forkName = `${safe(name2 ?? "schema")}-${safe(ver ?? "0")}.local.json`;
-    schemaAbs = resolve15(ctx.configDir ?? ctx.cwd, "schemas", forkName);
+    schemaAbs = resolve16(ctx.configDir ?? ctx.cwd, "schemas", forkName);
     assertSchemaWriteWithin(ctx, schemaAbs);
     if (existsSync5(schemaAbs)) {
       throw new DocmetaError(
@@ -13016,7 +13965,7 @@ async function planConfigEdit(ctx, edit, runRefs) {
     }
     return void 0;
   };
-  const rebaseRaw = (raw) => classifyRef(raw).kind === "file" && !isAbsolute6(raw) ? resolve15(configDir, raw) : raw;
+  const rebaseRaw = (raw) => classifyRef(raw).kind === "file" && !isAbsolute8(raw) ? resolve16(configDir, raw) : raw;
   const wantSet = runRefs.map(rebaseRaw).sort().join("\n");
   const seqResolvesToRunSet = (node) => {
     if (!isSeq3(node)) return false;
@@ -13061,7 +14010,7 @@ async function planConfigEdit(ctx, edit, runRefs) {
       if (!isMap5(item)) continue;
       const raw = rawRefOf(item);
       if (raw === void 0 || classifyRef(raw).kind !== "file") continue;
-      const abs = isAbsolute6(raw) ? raw : resolve15(configDir, raw);
+      const abs = isAbsolute8(raw) ? raw : resolve16(configDir, raw);
       if (foldPath(abs) !== wantPath) continue;
       pinFrom = item.get("integrity");
       item.set("integrity", edit.integrity.value);
@@ -13282,7 +14231,7 @@ function buildChanges(diff, entries, sentinel, ctx, renameHints = [], booleanAdd
         `"${file}": no writable format for that extension.`
       );
     }
-    if (existsSync5(resolve15(ctx.base, file))) {
+    if (existsSync5(resolve16(ctx.base, file))) {
       throw new DocmetaError(
         `"${file}" already exists; INSERT creates new files only.`
       );
@@ -13301,7 +14250,7 @@ function buildChanges(diff, entries, sentinel, ctx, renameHints = [], booleanAdd
         `"${from}" -> "${to}": a rename may not change the extension.`
       );
     }
-    if (existsSync5(resolve15(ctx.base, to))) {
+    if (existsSync5(resolve16(ctx.base, to))) {
       throw new DocmetaError(
         `"${to}" already exists; the rename would overwrite it.`
       );
@@ -13330,13 +14279,13 @@ function validateNewPath(p, base) {
   const refuse = (why) => {
     throw new DocmetaError(`"${p}" is not a usable path: ${why}.`);
   };
-  if (isAbsolute6(p)) refuse("it is absolute");
+  if (isAbsolute8(p)) refuse("it is absolute");
   if (p.split(/[\\/]/).some((segment) => segment === "..")) {
     refuse("it traverses upward");
   }
-  const abs = resolve15(base, p);
-  if (abs === resolve15(base)) refuse("it points at the corpus root, not a file");
-  if (!abs.startsWith(resolve15(base) + sep7)) refuse("it escapes the corpus");
+  const abs = resolve16(base, p);
+  if (abs === resolve16(base)) refuse("it points at the corpus root, not a file");
+  if (!abs.startsWith(resolve16(base) + sep8)) refuse("it escapes the corpus");
 }
 function refuseExternalMetadataWrites(changes, entries, ctx) {
   const index = ctx.externalMetadata;
@@ -13365,7 +14314,7 @@ function refuseExternalMetadataWrites(changes, entries, ctx) {
       continue;
     }
     if ("renamed" in c) {
-      const entry = index.byPath.get(resolve15(ctx.base, c.file));
+      const entry = index.byPath.get(resolve16(ctx.base, c.file));
       if (entry !== void 0 && entry.size > 0) {
         const manifest = [...entry.values()][0]?.file ?? "manifest";
         throw new DocmetaError(
@@ -13400,8 +14349,8 @@ function readableJoinValue(held, ctx) {
   return opened.ok ? opened.value : held;
 }
 var sealedWrites = /* @__PURE__ */ new WeakMap();
-function writtenValue(change2, key, value) {
-  const sealed = sealedWrites.get(change2)?.get(key);
+function writtenValue(change, key, value) {
+  const sealed = sealedWrites.get(change)?.get(key);
   return sealed === void 0 ? value : sealed;
 }
 async function sealMarkedWrites(changes, entries, ctx) {
@@ -13503,14 +14452,14 @@ async function applyChanges(changes, entries, ctx, schemaPlan) {
   const pendingWrites = [];
   const pendingRenames = [];
   for (const [label, ops] of grouped) {
-    const path = resolve15(ctx.base, label);
+    const path = resolve16(ctx.base, label);
     if (ops.renamedTo !== void 0) {
       if (!existsSync5(path)) {
         throw new DocmetaError(
           `"${label}" is gone from disk since it was read; re-run the query.`
         );
       }
-      const toDisk = resolve15(ctx.base, ops.renamedTo);
+      const toDisk = resolve16(ctx.base, ops.renamedTo);
       if (existsSync5(toDisk)) {
         throw new DocmetaError(
           `"${ops.renamedTo}" appeared on disk since the plan; re-run the query.`
@@ -13754,7 +14703,7 @@ function skipExpression(sql, from) {
 
 // src/meta/commands/fill.ts
 import { readFile as readFile12 } from "node:fs/promises";
-import { resolve as resolve16, extname as extname7, join as join9 } from "node:path";
+import { resolve as resolve17, extname as extname7, join as join9 } from "node:path";
 import {
   completeValidatedJSON,
   makeProvider,
@@ -13769,7 +14718,7 @@ import {
 } from "@hawkeyexl/inference";
 
 // src/meta/commands/fill-prompt.ts
-var FILL_PROMPT_VERSION = 3;
+var FILL_PROMPT_VERSION = 4;
 var DEFAULT_CHUNK_CHARS = 12e3;
 function splitBody(body, chunkChars) {
   if (body.length <= chunkChars) return [body];
@@ -13877,6 +14826,8 @@ function buildUserPrompt(params) {
 }
 
 // src/meta/commands/fill.ts
+var META_PROVENANCE_KEY = "meta-provenance";
+var PROVENANCE_KEYS = /* @__PURE__ */ new Set(["provenance", META_PROVENANCE_KEY]);
 var DEFAULT_THRESHOLD = 0.7;
 var DEFAULT_CONCURRENCY = 4;
 var DEFAULT_PROVIDER = "auto";
@@ -14157,7 +15108,7 @@ async function runFill(opts) {
       only
     );
     const managedSkips = proposed.filter((c) => managed.has(c.key)).map((c) => ({
-      field: `/${c.key}`,
+      field: pointerOf(c.key),
       required: c.required,
       confidence: 0,
       reasoning: "managed by derive",
@@ -14181,6 +15132,7 @@ async function runFill(opts) {
     const inPlace = view.plain.flatMap((pointer) => {
       const key = topLevelKeyOf(pointer);
       if (key === void 0 || only !== void 0 && !only.has(key)) return [];
+      if (PROVENANCE_KEYS.has(key)) return [];
       if (externalMetadata?.owners.has(key) === true) return [];
       if (candidates.some((c) => c.key === key)) return [];
       return [{ key, pointer, value: extracted.data[key] }];
@@ -14224,7 +15176,11 @@ async function runFill(opts) {
       sha256(content)
     ]);
     const hit = candidates.length > 0 ? cache?.get(cacheKey) : void 0;
-    const existing = redactForModel(extracted.data, [...view.marked, ...probeMarks]);
+    const existing = Object.fromEntries(
+      Object.entries(redactForModel(extracted.data, [...view.marked, ...probeMarks])).filter(
+        ([key]) => !PROVENANCE_KEYS.has(key)
+      )
+    );
     let proposals = {};
     if (hit) {
       cachedCount++;
@@ -14377,7 +15333,8 @@ async function runFill(opts) {
         ...opts.includeContent ? { content } : {}
       };
     }
-    const finalMarks = writable.length > 0 ? await validator.markedPointers({ ...view.data, ...patchOf(writable) }, schemaSet) : /* @__PURE__ */ new Set();
+    const plainPatch = patchOf(writable);
+    const finalMarks = writable.length > 0 ? await validator.markedPointers({ ...view.data, ...plainPatch }, schemaSet) : /* @__PURE__ */ new Set();
     const patch = {};
     for (const f of writable) {
       const key = keyOf(f);
@@ -14403,6 +15360,23 @@ async function runFill(opts) {
         encrypted: true
       });
     }
+    let metaProvenance;
+    if (writable.length > 0) {
+      const owner = externalMetadata?.owners.get(META_PROVENANCE_KEY)?.find((o) => members.includes(o.collection));
+      const merged2 = owner === void 0 ? mergeMetaProvenance(extracted.data[META_PROVENANCE_KEY], identity.model, writable) : void 0;
+      if (owner !== void 0) {
+        metaProvenance = { written: false, skipReason: "manifest-owned", manifest: owner.file };
+      } else if (merged2 === void 0 || await addsFindings(
+        (data) => validator.validate(data, schemaSet, extracted.lineFor, extracted.colFor).then((errors) => settleFindings(errors, view, extracted)),
+        { ...view.data, ...plainPatch },
+        merged2.list
+      )) {
+        metaProvenance = { written: false, skipReason: "schema-mismatch" };
+      } else {
+        patch[META_PROVENANCE_KEY] = merged2.list;
+        metaProvenance = { written: true, entry: merged2.entry };
+      }
+    }
     let next;
     try {
       next = extractor.apply(content, patch, {
@@ -14410,17 +15384,25 @@ async function runFill(opts) {
         elements
       });
     } catch (err) {
-      return errorResult(
-        label,
-        extractor.name,
-        errorMessage(err),
-        schemaSet,
-        fields
-      );
+      const withoutEntry = metaProvenance?.written === true ? tryApply(extractor, content, withoutKey(patch, META_PROVENANCE_KEY), {
+        filePath: label,
+        elements
+      }) : void 0;
+      if (withoutEntry === void 0) {
+        return errorResult(
+          label,
+          extractor.name,
+          errorMessage(err),
+          schemaSet,
+          fields
+        );
+      }
+      next = withoutEntry;
+      metaProvenance = { written: false, skipReason: "unwritable" };
     }
     const changed = next !== content;
     if (changed && !dryRun && label !== "<stdin>") {
-      await writeFileAtomic(resolve16(base, label), next);
+      await writeFileAtomic(resolve17(base, label), next);
     }
     return {
       file: label,
@@ -14428,7 +15410,8 @@ async function runFill(opts) {
       schemas: schemaSet,
       fields,
       changed,
-      ...opts.includeContent ? { content: next } : {}
+      ...opts.includeContent ? { content: next } : {},
+      ...metaProvenance === void 0 ? {} : { metaProvenance }
     };
   };
   const results = [];
@@ -14442,7 +15425,7 @@ async function runFill(opts) {
     );
   }
   const fileResults = await mapConcurrent(files, concurrency, async (file) => {
-    const content = await readFile12(resolve16(base, file), "utf8");
+    const content = await readFile12(resolve17(base, file), "utf8");
     return processOne(file, content, extname7(file));
   });
   results.push(...fileResults);
@@ -14461,7 +15444,57 @@ function topKey(instancePath) {
   const seg = instancePath.slice(1).split("/")[0] ?? "";
   return seg.replace(/~1/g, "/").replace(/~0/g, "~");
 }
-var keyOf = (f) => f.field.slice(1);
+var keyOf = (f) => topKey(f.field);
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeMetaProvenance(held, model, written) {
+  if (held !== void 0 && !Array.isArray(held)) return void 0;
+  const list = held === void 0 ? [] : [...held];
+  const at2 = list.findIndex((e) => isPlainRecord(e) && e["generated-by"] === model);
+  const prior = list[at2];
+  const kept = isPlainRecord(prior) ? prior : {};
+  const fields = Array.isArray(kept.fields) ? kept.fields.filter((p) => typeof p === "string") : [];
+  const confidence = {};
+  if (isPlainRecord(kept.confidence)) {
+    for (const [k, v] of Object.entries(kept.confidence)) {
+      if (typeof v === "number") confidence[k] = v;
+    }
+  }
+  for (const f of written) {
+    if (!fields.includes(f.field)) fields.push(f.field);
+    confidence[f.field] = f.confidence;
+  }
+  const entry = { ...kept, "generated-by": model, fields, confidence };
+  if (at2 === -1) list.push(entry);
+  else list[at2] = entry;
+  return { list, entry };
+}
+async function addsFindings(validate, without, list) {
+  const identity = (e) => JSON.stringify([e.schema, e.instancePath, e.keyword, e.subject ?? null, e.message]);
+  const before = /* @__PURE__ */ new Map();
+  for (const e of await validate(without)) {
+    const key = identity(e);
+    before.set(key, (before.get(key) ?? 0) + 1);
+  }
+  for (const e of await validate({ ...without, [META_PROVENANCE_KEY]: list })) {
+    const key = identity(e);
+    const left = before.get(key) ?? 0;
+    if (left === 0) return true;
+    before.set(key, left - 1);
+  }
+  return false;
+}
+function withoutKey(patch, key) {
+  return Object.fromEntries(Object.entries(patch).filter(([k]) => k !== key));
+}
+function tryApply(extractor, content, patch, options) {
+  try {
+    return extractor.apply?.(content, patch, options);
+  } catch {
+    return void 0;
+  }
+}
 var IN_PLACE_REASONING = "The page held this value in plain text; its schema marks it x-manni-encrypt, so it was encrypted.";
 var CIPHERTEXT_IN_TEXT = /~[A-Za-z0-9_-]{82,}/g;
 function contentForModel(content, extractor, existing, held, supplied, options) {
@@ -14470,10 +15503,13 @@ function contentForModel(content, extractor, existing, held, supplied, options)
     if (!Object.hasOwn(held, key) || supplied(pointerOf(key))) continue;
     if (toJsonText(value) !== toJsonText(held[key])) patch[key] = value;
   }
+  const deletions = [...PROVENANCE_KEYS].filter(
+    (key) => Object.hasOwn(held, key) && !supplied(pointerOf(key))
+  );
   let text2 = content;
-  if (Object.keys(patch).length > 0 && extractor.apply !== void 0) {
+  if ((Object.keys(patch).length > 0 || deletions.length > 0) && extractor.apply !== void 0) {
     try {
-      text2 = extractor.apply(content, patch, options);
+      text2 = extractor.apply(content, patch, { ...options, deletions });
     } catch {
     }
   }
@@ -14511,7 +15547,7 @@ function collectCandidates(schemas, data, errors, only) {
     for (const [key, raw] of Object.entries(
       properties
     )) {
-      if (key === FILE_SCHEMA_KEY) continue;
+      if (key === FILE_SCHEMA_KEY || PROVENANCE_KEYS.has(key)) continue;
       if (only && !only.has(key)) continue;
       if (typeof raw !== "object" || raw === null || Array.isArray(raw)) continue;
       const present = Object.prototype.hasOwnProperty.call(data, key);
@@ -14677,7 +15713,7 @@ function gate(candidates, proposals, threshold) {
     const proposal = proposals[c.key];
     if (proposal == null) {
       return {
-        field: `/${c.key}`,
+        field: pointerOf(c.key),
         required: c.required,
         confidence: 0,
         reasoning: "",
@@ -14687,7 +15723,7 @@ function gate(candidates, proposals, threshold) {
     }
     const passes = proposal.confidence >= threshold;
     return {
-      field: `/${c.key}`,
+      field: pointerOf(c.key),
       required: c.required,
       confidence: proposal.confidence,
       reasoning: proposal.reasoning,
@@ -14786,10 +15822,434 @@ async function mapConcurrent(items2, limit, fn) {
 
 // src/meta/commands/derive.ts
 import { readFile as readFile13 } from "node:fs/promises";
-import { extname as extname8, resolve as resolve17 } from "node:path";
+import { extname as extname8, relative as relative13, resolve as resolve18, sep as sep9 } from "node:path";
+
+// src/meta/core/external-metadata-write.ts
+import { posix as posix3 } from "node:path";
+import {
+  LineCounter as LineCounter3,
+  isMap as isMap6,
+  isNode as isNode2,
+  isPair,
+  isScalar as isScalar4,
+  isSeq as isSeq4,
+  parseDocument as parseDocument7,
+  stringify as stringify3
+} from "yaml";
+function spliceManifestValue(text2, options) {
+  const { entry, key, value, file } = options;
+  const join10 = options.join ?? PATH_JOIN;
+  const at2 = (line2) => {
+    const name2 = file === void 0 ? "Manifest" : `Manifest ${file}`;
+    if (line2 === void 0) return name2;
+    return file === void 0 ? `${name2} line ${String(line2)}` : `${name2}:${String(line2)}`;
+  };
+  if (key === FILE_SCHEMA_KEY) {
+    throw new DocmetaError(
+      `${at2()}: refusing to write "${FILE_SCHEMA_KEY}" for "${entry}"; a manifest never chooses the schema a document is judged by. Use "overrides" in the config.`
+    );
+  }
+  if (value === void 0) {
+    throw new DocmetaError(`${at2()}: refusing to write "${key}" for "${entry}" with no value.`);
+  }
+  const eol = detectEol(text2);
+  const lc = new LineCounter3();
+  const doc = parseDocument7(text2, { lineCounter: lc, uniqueKeys: false });
+  const problem = doc.errors[0];
+  if (problem) {
+    throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
+  }
+  const keyLine = (node) => {
+    const r = rangeOf(node);
+    return r ? lc.linePos(r[0]).line : void 0;
+  };
+  const same = join10 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const root = doc.contents;
+  let spelled = entry;
+  let edit;
+  if (root === null || isScalar4(root) && root.value === null && emptySource(text2, root)) {
+    edit = startManifest(text2, entry, key, value, eol);
+  } else if (!isMap6(root)) {
+    throw new DocmetaError(
+      `${at2()}: the manifest must be a mapping from document ${join10 === PATH_JOIN ? "path" : `"${join10}"`} to owned keys.`
+    );
+  } else {
+    const style = detectStyle(text2, root, eol);
+    const matches = root.items.filter((p) => same(keyString(p.key), entry));
+    const [first, second] = matches;
+    if (first && second) {
+      throw new DocmetaError(
+        `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
+      );
+    }
+    if (first === void 0) {
+      if (root.flow === true && root.items.length > 0) {
+        throw new DocmetaError(
+          `${at2()}: the manifest is a flow mapping ({ \u2026 }), which this writer does not add entries to. Rewrite it in block style.`
+        );
+      }
+      edit = appendEntry(text2, root, entry, key, value, style);
+    } else {
+      spelled = keyString(first.key);
+      const where = at2(keyLine(first.key));
+      const v = first.value;
+      if (!isMap6(v)) {
+        throw new DocmetaError(`${where}: "${spelled}" must be a mapping of owned keys to values.`);
+      }
+      const hits = v.items.filter((kv) => keyString(kv.key) === key);
+      const [hit, again] = hits;
+      if (hit && again) {
+        throw new DocmetaError(
+          `${at2(keyLine(again.key))}: "${spelled}" sets "${key}" twice (first at line ${String(keyLine(hit.key) ?? "?")}). Remove one.`
+        );
+      }
+      const flowRefusal = () => new DocmetaError(
+        `${where}: "${spelled}" is a flow mapping ({ \u2026 }), which this writer does not add keys to. Rewrite the entry in block style.`
+      );
+      const formRefusal = () => new DocmetaError(
+        `${where}: "${spelled}" writes a key in a form this writer does not edit. Write it as "${key}: \u2026".`
+      );
+      let made;
+      if (v.flow === true) {
+        if (hit) made = replaceFlowValue(text2, hit, value);
+        else if (v.items.length === 0) made = fillEmptyEntry(text2, first, key, value, style);
+        else throw flowRefusal();
+        if (!made) throw hit ? flowRefusal() : formRefusal();
+      } else {
+        made = hit ? replaceBlockValue(text2, hit, value, style) : insertKey(text2, v, key, value, style);
+        if (!made) throw formRefusal();
+      }
+      edit = made;
+    }
+  }
+  const out = text2.slice(0, edit.start) + edit.insert + text2.slice(edit.end);
+  const line = readBack(
+    doc,
+    out,
+    spelled,
+    key,
+    value,
+    (why) => new DocmetaError(
+      `${at2()}: writing "${key}" for "${entry}" did not read back as written, so nothing was written. ${why}`
+    )
+  );
+  return { text: out, line };
+}
+function removeManifestKey(text2, options) {
+  const { entry, key, file } = options;
+  const join10 = options.join ?? PATH_JOIN;
+  const at2 = (line) => {
+    const name2 = file === void 0 ? "Manifest" : `Manifest ${file}`;
+    if (line === void 0) return name2;
+    return file === void 0 ? `${name2} line ${String(line)}` : `${name2}:${String(line)}`;
+  };
+  const eol = detectEol(text2);
+  const lc = new LineCounter3();
+  const doc = parseDocument7(text2, { lineCounter: lc, uniqueKeys: false });
+  const problem = doc.errors[0];
+  if (problem) {
+    throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
+  }
+  const keyLine = (node) => {
+    const r = rangeOf(node);
+    return r ? lc.linePos(r[0]).line : void 0;
+  };
+  const root = doc.contents;
+  if (root === null || isScalar4(root) && root.value === null) return { text: text2 };
+  if (!isMap6(root)) {
+    throw new DocmetaError(
+      `${at2()}: the manifest must be a mapping from document ${join10 === PATH_JOIN ? "path" : `"${join10}"`} to owned keys.`
+    );
+  }
+  const same = join10 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const matches = root.items.filter((p) => same(keyString(p.key), entry));
+  const [first, second] = matches;
+  if (first && second) {
+    throw new DocmetaError(
+      `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
+    );
+  }
+  if (first === void 0) return { text: text2 };
+  const spelled = keyString(first.key);
+  const where = at2(keyLine(first.key));
+  const v = first.value;
+  if (!isMap6(v)) {
+    throw new DocmetaError(`${where}: "${spelled}" must be a mapping of owned keys to values.`);
+  }
+  const hits = v.items.filter((kv) => keyString(kv.key) === key);
+  const [hit, again] = hits;
+  if (hit && again) {
+    throw new DocmetaError(
+      `${at2(keyLine(again.key))}: "${spelled}" sets "${key}" twice (first at line ${String(keyLine(hit.key) ?? "?")}). Remove one.`
+    );
+  }
+  if (hit === void 0) return { text: text2 };
+  const whole = v.items.length === 1;
+  if (!whole && v.flow === true) {
+    throw new DocmetaError(
+      `${where}: "${spelled}" is a flow mapping ({ \u2026 }), which this writer does not remove keys from. Rewrite the entry in block style.`
+    );
+  }
+  const from = rangeOf(whole ? first.key : hit.key);
+  const to = whole ? contentEnd(text2, v) : contentEnd(text2, hit.value) ?? contentEnd(text2, hit.key);
+  if (!from || to === void 0) {
+    throw new DocmetaError(
+      `${where}: "${spelled}" writes a key in a form this writer does not edit. Write it as "${key}: \u2026".`
+    );
+  }
+  let start = text2.lastIndexOf("\n", from[0] - 1) + 1;
+  let end = lineEnd(text2, to);
+  if (text2.startsWith(eol, end)) end += eol.length;
+  else if (start >= eol.length) start -= eol.length;
+  if (whole) {
+    if (text2.slice(start - 2 * eol.length, start) === eol + eol) start -= eol.length;
+    else if (start === 0 && text2.startsWith(eol, end)) end += eol.length;
+  }
+  const out = text2.slice(0, start) + text2.slice(end);
+  const after = parseDocument7(out, { uniqueKeys: false });
+  const fail2 = (why) => new DocmetaError(
+    `${at2()}: removing "${key}" for "${entry}" did not read back as removed, so nothing was written. ${why}`
+  );
+  if (after.errors[0]) throw fail2(`The result is not valid YAML: ${after.errors[0].message}`);
+  const was = doc.toJS({ maxAliasCount: 100 });
+  const wasRoot = isRecord5(was) ? was : {};
+  const wasEntry = wasRoot[spelled];
+  const rest = Object.fromEntries(
+    Object.entries(isRecord5(wasEntry) ? wasEntry : {}).filter(([k]) => k !== key)
+  );
+  const kept = Object.entries(wasRoot).filter(([k]) => k !== spelled);
+  if (Object.keys(rest).length > 0) kept.push([spelled, rest]);
+  const now = after.toJS({ maxAliasCount: 100 });
+  const expected = kept.length === 0 ? null : Object.fromEntries(kept);
+  if (!deepEqual(now ?? null, expected)) throw fail2("Another value in the manifest would have changed.");
+  return { text: out };
+}
+function startManifest(text2, entry, key, value, eol) {
+  const style = { step: 2, indentSeq: true, eol };
+  const block = blockLines({ [entry]: { [key]: value } }, 0, style);
+  let insert;
+  if (text2 === "" || text2.endsWith("\n")) insert = block + eol;
+  else insert = eol + block;
+  return { start: text2.length, end: text2.length, insert };
+}
+function appendEntry(text2, root, entry, key, value, style) {
+  const body = { [entry]: { [key]: value } };
+  if (root.flow === true) {
+    const r = rangeOf(root);
+    const start = r ? r[0] : text2.length;
+    const end = contentEnd(text2, root) ?? start;
+    return { start, end, insert: blockLines(body, colOf(text2, start), style) };
+  }
+  const firstKey = rangeOf(root.items[0]?.key);
+  const col = firstKey ? colOf(text2, firstKey[0]) : 0;
+  const pos = lineEnd(text2, contentEnd(text2, root) ?? text2.length);
+  const last = root.items.at(-1);
+  const spaced = root.items.length > 1 && isNode2(last?.key) && last.key.spaceBefore === true;
+  return {
+    start: pos,
+    end: pos,
+    insert: style.eol + (spaced ? style.eol : "") + blockLines(body, col, style)
+  };
+}
+function insertKey(text2, entryMap, key, value, style) {
+  const firstKey = rangeOf(entryMap.items[0]?.key);
+  const end = contentEnd(text2, entryMap);
+  if (!firstKey || end === void 0) return void 0;
+  const pos = lineEnd(text2, end);
+  return {
+    start: pos,
+    end: pos,
+    insert: style.eol + blockLines({ [key]: value }, colOf(text2, firstKey[0]), style)
+  };
+}
+function fillEmptyEntry(text2, entryPair, key, value, style) {
+  const start = colonEnd(text2, entryPair);
+  const keyRange = rangeOf(entryPair.key);
+  const end = contentEnd(text2, entryPair.value);
+  if (start === void 0 || !keyRange || end === void 0) return void 0;
+  const col = colOf(text2, keyRange[0]) + style.step;
+  return { start, end, insert: style.eol + blockLines({ [key]: value }, col, style) };
+}
+function replaceBlockValue(text2, pair, value, style) {
+  const colon = colonEnd(text2, pair);
+  const keyRange = rangeOf(pair.key);
+  if (colon === void 0 || !keyRange) return void 0;
+  const keyCol = colOf(text2, keyRange[0]);
+  let start = colon;
+  let ownLine = false;
+  let i = colon;
+  while (text2.charAt(i) === " " || text2.charAt(i) === "	") i++;
+  if (text2.charAt(i) === "#") {
+    start = lineEnd(text2, i);
+    ownLine = true;
+  }
+  const old = pair.value;
+  const oldEnd = isScalar4(old) && old.value === null && emptySource(text2, old) ? start : contentEnd(text2, old) ?? start;
+  const end = Math.max(start, oldEnd);
+  let insert = afterColon(value, keyCol, style);
+  if (ownLine && !insert.startsWith(style.eol)) {
+    insert = style.eol + " ".repeat(keyCol + style.step) + insert.trimStart();
+  }
+  return { start, end, insert };
+}
+function replaceFlowValue(text2, pair, value) {
+  const r = rangeOf(pair.value);
+  if (!r || emptySource(text2, pair.value)) return void 0;
+  const end = contentEnd(text2, pair.value) ?? r[1];
+  return { start: r[0], end, insert: flowText(value) };
+}
+function readBack(before, out, spelled, key, value, fail2) {
+  const lc = new LineCounter3();
+  const after = parseDocument7(out, { lineCounter: lc, uniqueKeys: false });
+  const problem = after.errors[0];
+  if (problem) throw fail2(`The result is not valid YAML: ${problem.message}`);
+  const was = before.toJS({ maxAliasCount: 100 });
+  const now = after.toJS({ maxAliasCount: 100 });
+  const wasRoot = isRecord5(was) ? was : {};
+  const wasEntry = wasRoot[spelled];
+  const expected = {
+    ...wasRoot,
+    [spelled]: { ...isRecord5(wasEntry) ? wasEntry : {}, [key]: value }
+  };
+  const nowEntry = isRecord5(now) ? now[spelled] : void 0;
+  if (!isRecord5(nowEntry) || !deepEqual(nowEntry[key], value)) {
+    throw fail2(
+      "The value reads back differently. A Date, an undefined member, or another value YAML cannot hold does not survive the trip."
+    );
+  }
+  if (!deepEqual(now, expected)) {
+    throw fail2("Another value in the manifest would have changed.");
+  }
+  const root = after.contents;
+  const pair = isMap6(root) ? root.items.find((p) => keyString(p.key) === spelled) : void 0;
+  const entryMap = pair?.value;
+  const kv = isMap6(entryMap) ? entryMap.items.find((p) => keyString(p.key) === key) : void 0;
+  const r = rangeOf(kv?.value) ?? rangeOf(kv?.key);
+  if (!r) throw fail2("The written value could not be found again.");
+  return lc.linePos(r[0]).line;
+}
+function blockLines(pair, col, style) {
+  const s = stringify3(pair, { lineWidth: 0, indent: style.step, indentSeq: style.indentSeq });
+  return indentLines(s.replace(/\n$/, "").split("\n"), col, 0).join(style.eol);
+}
+function afterColon(value, col, style) {
+  const s = stringify3({ k: value }, { lineWidth: 0, indent: style.step, indentSeq: style.indentSeq });
+  const lines = s.replace(/\n$/, "").slice("k:".length).split("\n");
+  return indentLines(lines, col, 1).join(style.eol);
+}
+function indentLines(lines, col, from) {
+  const pad2 = " ".repeat(col);
+  return lines.map((l, i) => i < from || l === "" ? l : pad2 + l);
+}
+function flowText(value) {
+  const s = stringify3(value, { lineWidth: 0, collectionStyle: "flow" }).replace(/\n$/, "");
+  return s.includes("\n") ? JSON.stringify(value) : s;
+}
+function detectEol(text2) {
+  const i = text2.indexOf("\n");
+  return i > 0 && text2.charAt(i - 1) === "\r" ? "\r\n" : "\n";
+}
+function detectStyle(text2, root, eol) {
+  let step = 2;
+  for (const pair of root.items) {
+    const v = pair.value;
+    const entryKey = rangeOf(pair.key);
+    const ownedKey = isMap6(v) && v.flow !== true ? rangeOf(v.items[0]?.key) : void 0;
+    if (entryKey && ownedKey) {
+      const d = colOf(text2, ownedKey[0]) - colOf(text2, entryKey[0]);
+      if (d > 0) {
+        step = d;
+        break;
+      }
+    }
+  }
+  return { step, indentSeq: seqIndented(text2, root) ?? true, eol };
+}
+function seqIndented(text2, node) {
+  if (isMap6(node)) {
+    for (const pair of node.items) {
+      const v = pair.value;
+      if (isSeq4(v) && v.flow !== true && v.items.length > 0) {
+        const k = rangeOf(pair.key);
+        const s = rangeOf(v);
+        if (k && s) return colOf(text2, s[0]) > colOf(text2, k[0]);
+      }
+      const inner = seqIndented(text2, v);
+      if (inner !== void 0) return inner;
+    }
+  } else if (isSeq4(node)) {
+    for (const item of node.items) {
+      const inner = seqIndented(text2, item);
+      if (inner !== void 0) return inner;
+    }
+  }
+  return void 0;
+}
+function contentEnd(text2, node) {
+  if (isMap6(node) && node.flow !== true) {
+    const last = node.items.at(-1);
+    if (last) return contentEnd(text2, last.value) ?? contentEnd(text2, last.key);
+  } else if (isSeq4(node) && node.flow !== true) {
+    const last = node.items.at(-1);
+    if (last !== void 0) {
+      return isPair(last) ? contentEnd(text2, last.value) ?? contentEnd(text2, last.key) : contentEnd(text2, last);
+    }
+  }
+  const r = rangeOf(node);
+  if (!r) return void 0;
+  let end = r[1];
+  while (end > r[0] && /\s/.test(text2.charAt(end - 1))) end--;
+  return end;
+}
+function colonEnd(text2, pair) {
+  const r = rangeOf(pair.key);
+  if (!r) return void 0;
+  let i = r[1];
+  while (text2.charAt(i) === " " || text2.charAt(i) === "	") i++;
+  return text2.charAt(i) === ":" ? i + 1 : void 0;
+}
+function lineEnd(text2, i) {
+  const j = text2.indexOf("\n", i);
+  if (j < 0) return text2.length;
+  return j > 0 && text2.charAt(j - 1) === "\r" ? j - 1 : j;
+}
+function colOf(text2, offset) {
+  if (offset === 0) return 0;
+  let start = text2.lastIndexOf("\n", offset - 1) + 1;
+  if (start === 0 && text2.startsWith("\uFEFF")) start = 1;
+  return offset - start;
+}
+function rangeOf(node) {
+  return isNode2(node) ? node.range ?? void 0 : void 0;
+}
+function emptySource(text2, node) {
+  const r = rangeOf(node);
+  return !r || text2.slice(r[0], r[1]).trim() === "";
+}
+function keyString(key) {
+  return isScalar4(key) ? String(key.value) : String(key);
+}
+function isRecord5(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+
+// src/meta/commands/derive.ts
+var GENERATED_BY_ENV = "MANNI_GENERATED_BY";
 var SOURCE_HINT = "narrow --sources or --fields";
 async function runDerive(opts) {
   const cwd = opts.cwd ?? process.cwd();
+  const targets = [];
+  const typedInputs = opts.inputs.map((arg) => {
+    if (arg === STDIN_TOKEN) return arg;
+    const { page, lines } = parseProvenanceTarget(arg);
+    if (lines === void 0) return arg;
+    if (page === STDIN_TOKEN) return STDIN_TOKEN;
+    targets.push({ target: arg, page });
+    return page;
+  });
+  const env = opts.env ?? process.env;
+  const flagGeneratedBy = machineName(opts.generatedBy);
+  const generatedBy = opts.generatedBy !== void 0 ? flagGeneratedBy : machineName(env[GENERATED_BY_ENV]);
   const {
     config,
     inputs,
@@ -14803,7 +16263,7 @@ async function runDerive(opts) {
     cwd,
     configPath: opts.configPath,
     noConfig: opts.noConfig,
-    inputs: opts.inputs,
+    inputs: typedInputs,
     ...opts.collections !== void 0 ? { collections: opts.collections } : {},
     onConfigLoaded: opts.onConfigLoaded
   });
@@ -14817,7 +16277,20 @@ async function runDerive(opts) {
   }
   const commands = commandsOf(config?.derive);
   const fields = resolveFields(opts.fields, config?.derive?.fields, commands);
+  const wantsProvenance = fields.includes(PROVENANCE_FIELD);
+  const firstTarget = targets[0];
+  if (firstTarget !== void 0 && generatedBy === void 0) {
+    throw new DocmetaError(
+      `${firstTarget.target} names lines, which only --generated-by uses. Pass --generated-by, or drop the range.`
+    );
+  }
+  if ((flagGeneratedBy !== void 0 || firstTarget !== void 0) && !wantsProvenance) {
+    throw new DocmetaError(
+      "--generated-by attributes provenance, which is not in --fields. Add provenance, or drop --generated-by."
+    );
+  }
   for (const field of fields) {
+    if (field === PROVENANCE_FIELD) continue;
     const owner = manifestOwning(field, declaredCollections);
     if (owner !== void 0) {
       throw new DocmetaError(
@@ -14880,6 +16353,18 @@ async function runDerive(opts) {
     })
   });
   const files = fromCollections ? retainMembers(walked, membersFor) : walked;
+  const rangesByPage = /* @__PURE__ */ new Map();
+  for (const t of targets) {
+    const label = relative13(base, resolve18(base, t.page)).split(sep9).join("/");
+    if (!files.includes(label)) {
+      throw new DocmetaError(
+        `${t.target} does not name one file that derive reads; a range names lines of one file.`
+      );
+    }
+    const named = rangesByPage.get(label) ?? [];
+    if (!named.includes(t.target)) named.push(t.target);
+    rangesByPage.set(label, named);
+  }
   assertNonEmpty({
     files,
     inputs,
@@ -14893,7 +16378,7 @@ async function runDerive(opts) {
   const loaded = /* @__PURE__ */ new Map();
   const errors = /* @__PURE__ */ new Map();
   for (const label of files) {
-    const absPath = resolve17(base, label);
+    const absPath = resolve18(base, label);
     const extractor = forcedExtractor ?? extractorForExtension(extname8(label));
     if (!extractor) {
       errors.set(label, {
@@ -14918,6 +16403,38 @@ async function runDerive(opts) {
       errors.set(label, { format: extractor.name, message: errorMessage(err) });
     }
   }
+  const provenanceRoot = configDir ?? cwd;
+  const manifests = wantsProvenance ? provenanceManifests(declaredCollections, provenanceRoot, base) : [];
+  const provenanceCollections = declaredCollections.map((c) => ({
+    ...c,
+    externalMetadata: c.externalMetadata.filter((m) => m.keys.includes(PROVENANCE_FIELD))
+  })).filter((c) => c.externalMetadata.length > 0);
+  const provenanceIndex = manifests.length === 0 ? null : await loadExternalMetadata(provenanceCollections, { configDir: provenanceRoot, base });
+  const places = /* @__PURE__ */ new Map();
+  for (const doc of loaded.values()) {
+    if (!wantsProvenance) break;
+    const place = provenancePlace(
+      doc.label,
+      doc.extracted.data,
+      manifests,
+      declaredCollections,
+      provenanceRoot,
+      base
+    );
+    if (place !== void 0) {
+      places.set(doc.label, place);
+      doc.provenanceManifest = { absPath: place.absPath, entry: place.entry, join: place.join };
+    }
+    const named = rangesByPage.get(doc.label);
+    if (named !== void 0 && generatedBy !== void 0) {
+      doc.attribution = { targets: named, generatedBy };
+    }
+  }
+  const stampOf = (doc) => {
+    if (!places.has(doc.label)) return doc.extracted.data[PROVENANCE_FIELD];
+    const members = memberOf(provenanceCollections, provenanceRoot, base, doc.label);
+    return mergeExternalMetadata(doc.label, doc.extracted, provenanceIndex, members, base).extracted.data[PROVENANCE_FIELD];
+  };
   const derived = await deriveMetadata([...loaded.values()], {
     cwd,
     base,
@@ -14928,7 +16445,9 @@ async function runDerive(opts) {
     commands,
     cache: opts.cache ?? true,
     now: opts.now ?? (() => /* @__PURE__ */ new Date()),
-    reviews: opts.reviews
+    reviews: opts.reviews,
+    machines: machinesOf(config?.derive),
+    ...generatedBy !== void 0 ? { generatedBy } : {}
   });
   assertSourcesAvailable(derived.sources, SOURCE_HINT);
   for (const [name2, status] of Object.entries(derived.sources)) {
@@ -14997,6 +16516,20 @@ async function runDerive(opts) {
     }
     return holder[field];
   };
+  const heldManifests = /* @__PURE__ */ new Map();
+  const holdManifest = async (manifest) => {
+    const already = heldManifests.get(manifest.absPath);
+    if (already !== void 0) return already;
+    let before;
+    try {
+      before = await readFile13(manifest.absPath, "utf8");
+    } catch (err) {
+      throw new DocmetaError(`Manifest ${manifest.file} could not be read: ${errorMessage(err)}`);
+    }
+    const held = { path: manifest.absPath, before, text: before };
+    heldManifests.set(manifest.absPath, held);
+    return held;
+  };
   const results = [];
   for (const label of files) {
     const failure = errors.get(label);
@@ -15016,12 +16549,49 @@ async function runDerive(opts) {
       const at2 = pointerOf(field);
       return marks.marked.some((p) => isAtOrUnder(p, at2));
     };
+    const place = places.get(label);
+    const provenance = wantsProvenance ? judgeProvenance(stampOf(doc), derived.provenance?.get(label), record?.fields[PROVENANCE_FIELD] ?? null, place) : void 0;
     const compared = fields.map(
-      (field) => compareDerived(field, marks.data[field], record?.fields[field])
+      (field) => field === PROVENANCE_FIELD && provenance !== void 0 ? provenance.field : compareDerived(field, marks.data[field], record?.fields[field])
     );
-    const shown = () => compared.map((f) => isMarked(f.field) ? redactedDerived(f) : f);
-    const pending = compared.filter((f) => f.status === "stale" || f.status === "unset");
+    const shown = () => compared.map(
+      (f) => f.field !== PROVENANCE_FIELD && isMarked(f.field) ? redactedDerived(f) : f
+    );
+    const findingsOf = (reported2) => reported2.flatMap(
+      (f) => f.field === PROVENANCE_FIELD && provenance?.judged !== void 0 ? provenanceFindings(provenance.judged.comparisons, provenance.judged.derivation.page.bodyLine) : staleFindings([f], doc.extracted.lineFor)
+    );
+    if (provenance?.judged !== void 0 && flagGeneratedBy !== void 0 && doc.attribution === void 0 && ![...provenance.judged.derivation.evidenceByLine.values()].some((e) => e.rule === 1)) {
+      opts.onNotice?.(
+        `${label}: no uncommitted body lines; --generated-by attributes only what is not yet committed.`
+      );
+    }
+    const stale = (f) => f.status === "stale" || f.status === "unset";
+    const toManifest = provenance !== void 0 && place !== void 0 && stale(provenance.field) ? provenance : void 0;
+    const pending = compared.filter((f) => stale(f) && !(f.field === PROVENANCE_FIELD && toManifest !== void 0));
+    const onPage = pending.find((f) => f.field === PROVENANCE_FIELD);
+    if (onPage !== void 0 && !provenanceFenced(doc.extracted)) {
+      results.push(
+        errorResult2(
+          label,
+          doc.format,
+          `provenance cannot be stamped into the page: in the "${doc.format}" format the metadata is part of the body it pins. Keep provenance in an externalMetadata manifest.`,
+          check,
+          shown()
+        )
+      );
+      continue;
+    }
     let changed = false;
+    if (toManifest?.judged !== void 0 && place !== void 0) {
+      const held = await holdManifest(place.manifest);
+      const before = held.text;
+      const where = { entry: place.entry, key: PROVENANCE_FIELD, join: place.join, file: place.manifest.file };
+      held.text = toManifest.judged.plan.length === 0 ? removeManifestKey(held.text, where).text : spliceManifestValue(held.text, { ...where, value: toManifest.judged.plan }).text;
+      if (held.text !== before) {
+        changed = true;
+        if (!dryRun) markWritten(toManifest.field);
+      }
+    }
     if (pending.length > 0) {
       if (typeof doc.apply !== "function") {
         if (!dryRun) {
@@ -15039,20 +16609,37 @@ async function runDerive(opts) {
         changed = true;
       } else {
         const patch = {};
+        const deletions = [];
         for (const f of pending) {
+          if (f.field === PROVENANCE_FIELD) {
+            if (Array.isArray(f.derived) && f.derived.length === 0) deletions.push(f.field);
+            else patch[f.field] = f.derived;
+            continue;
+          }
           patch[f.field] = isMarked(f.field) ? await sealField(f.field, f.derived, marks.marked) : f.derived;
         }
+        const apply = doc.apply;
+        const write = (value) => apply(doc.content, value, {
+          filePath: label,
+          elements: doc.elements,
+          ...deletions.length > 0 ? { deletions } : {}
+        });
         let next;
         try {
-          next = doc.apply(doc.content, patch, { filePath: label, elements: doc.elements });
+          next = write(patch);
+          const plan = patch[PROVENANCE_FIELD];
+          const shift = bodyShift(doc.content, next);
+          if (shift > 0 && Array.isArray(plan)) {
+            next = write({ ...patch, [PROVENANCE_FIELD]: shiftEntries(provenanceEntries(plan), shift) });
+          }
         } catch (err) {
           results.push(errorResult2(label, doc.format, errorMessage(err), check, shown()));
           continue;
         }
-        changed = next !== doc.content;
-        if (changed && !dryRun) {
+        changed = changed || next !== doc.content;
+        if (next !== doc.content && !dryRun) {
           await writeFileAtomic(doc.absPath, next);
-          for (const f of pending) f.written = true;
+          for (const f of pending) markWritten(f);
         }
       }
     }
@@ -15062,18 +16649,32 @@ async function runDerive(opts) {
       format: doc.format,
       fields: reported,
       changed,
-      ...check ? { findings: staleFindings(reported, doc.extracted.lineFor) } : {}
+      ...check ? { findings: findingsOf(reported) } : {}
     });
   }
+  if (!dryRun) {
+    for (const held of heldManifests.values()) {
+      if (held.text !== held.before) await writeFileAtomic(held.path, held.text);
+    }
+  }
+  const summary = summarize2(results);
   return {
     results,
-    summary: summarize2(results),
+    summary: wantsProvenance ? { ...summary, ranges: countRanges(results) } : summary,
     dryRun,
     check,
     sources: derived.sources,
     frame: { cwd, base: configDir ?? cwd, runBase: base }
   };
 }
+function deriveFailed(run2) {
+  if (run2.summary.errors > 0) return true;
+  return run2.check && run2.results.some((r) => (r.findings ?? []).length > 0);
+}
+function machineName(value) {
+  const name2 = value?.trim();
+  return name2 === void 0 || name2 === "" ? void 0 : name2;
+}
 function resolveFields(flag, configured, commands) {
   const names = flag ?? configured;
   if (names === void 0 || names.length === 0) {
@@ -15141,6 +16742,59 @@ function summarize2(results) {
   }
   return summary;
 }
+function markWritten(field) {
+  field.written = true;
+  for (const range of field.ranges ?? []) {
+    if (range.status !== "current") range.written = true;
+  }
+}
+function countRanges(results) {
+  let n = 0;
+  for (const r of results) {
+    for (const f of r.fields) n += (f.ranges ?? []).filter((range) => range.written).length;
+  }
+  return n;
+}
+function judgeProvenance(asserted, derivation, value, place) {
+  const base = {
+    field: PROVENANCE_FIELD,
+    ...asserted !== void 0 ? { asserted } : {},
+    ...place !== void 0 ? { manifest: place.manifest.file } : {}
+  };
+  if (derivation === void 0) {
+    return { field: { ...base, derived: null, status: "unknown", written: false } };
+  }
+  const comparisons = compareProvenance(provenanceEntries(asserted), derivation);
+  const plan = planProvenanceWrite(comparisons, derivation);
+  const settled = comparisons.every((c) => c.status === "current");
+  const status = settled ? "current" : asserted === void 0 || comparisons.every((c) => c.status === "unset") ? "unset" : "stale";
+  return {
+    field: {
+      ...base,
+      derived: plan,
+      source: "git",
+      ...value !== null ? { evidence: value.evidence } : {},
+      status,
+      written: false,
+      ranges: rangeResults(comparisons, derivation.page.bodyLine)
+    },
+    judged: { derivation, comparisons, plan }
+  };
+}
+function bodyShift(before, after) {
+  const was = readProvenancePage(before).body;
+  const now = readProvenancePage(after).body;
+  const shift = now.length - was.length;
+  if (shift <= 0) return 0;
+  return now.slice(shift).join("\n") === was.join("\n") ? shift : 0;
+}
+function shiftEntries(entries, shift) {
+  return entries.map((e) => {
+    const span = parseLines(e.lines);
+    if (span === void 0) return e;
+    return { ...e, lines: lineSpec({ start: span.start + shift, end: span.end + shift }) };
+  });
+}
 
 // src/meta/reporters/fill.ts
 var FILL_FORMATS = ["pretty", "json", "github"];
@@ -15176,6 +16830,26 @@ function renderFillPretty(run2, opts = {}) {
         `    ${c.cyan(f.field)}  ${formatValue(f.value)}  ${c.dim(score(f.confidence))}`
       );
     }
+    const record = result.metaProvenance;
+    if (record?.written === true) {
+      lines.push(
+        `    ${c.cyan("meta-provenance")}  ${record.entry["generated-by"]}: ${record.entry.fields.join(", ")}`
+      );
+    } else if (record?.skipReason === "schema-mismatch") {
+      lines.push(
+        c.dim("    meta-provenance not written: this page's schemas do not allow it")
+      );
+    } else if (record?.skipReason === "manifest-owned") {
+      lines.push(
+        c.dim(
+          `    meta-provenance not written: owned by manifest ${record.manifest}, which manni meta fill does not write`
+        )
+      );
+    } else if (record?.skipReason === "unwritable") {
+      lines.push(
+        c.dim(`    meta-provenance not written: ${result.format} metadata cannot hold it`)
+      );
+    }
     if (low.length > 0) {
       lines.push(
         c.dim(
@@ -15327,26 +17001,49 @@ function renderDerivePretty(run2, opts = {}) {
       lines.push(`${result.file}  ${c.dim("current")}${unknownNote(result, c.dim)}`);
       continue;
     }
-    lines.push(result.file);
-    const nameWidth = Math.max(...pending.map((f) => f.field.length));
-    const changeWidth = Math.max(...pending.map((f) => change(f).length));
+    const page = [];
+    const held = /* @__PURE__ */ new Map();
     for (const f of pending) {
-      const name2 = c.cyan(f.field.padEnd(nameWidth));
-      const from = f.status === "unset" ? c.dim("(unset)") : c.dim(fmt2(f.asserted));
-      const to = c.green(fmt2(f.derived));
-      const pad2 = " ".repeat(changeWidth - change(f).length);
-      const trail = c.dim(`(${f.source ?? "a source"}: ${f.evidence ?? "no evidence"})`);
-      lines.push(`    ${name2}  ${from} \u2192 ${to}${pad2}  ${trail}`);
+      if (f.ranges === void 0) {
+        page.push(fieldRow(f, c));
+        continue;
+      }
+      const rows = f.ranges.filter((r) => r.status !== "current").map((r) => rangeRow(f, r, c));
+      if (f.manifest === void 0) page.push(...rows);
+      else held.set(f.manifest, [...held.get(f.manifest) ?? [], ...rows]);
+    }
+    const all = [...page, ...[...held.values()].flat()];
+    const nameWidth = Math.max(...all.map((r) => r.name.length));
+    const changeWidth = Math.max(...all.map((r) => r.plain.length));
+    const print = (row) => {
+      const pad2 = " ".repeat(changeWidth - row.plain.length);
+      lines.push(`    ${c.cyan(row.name.padEnd(nameWidth))}  ${row.change}${pad2}  ${row.trail}`);
+    };
+    if (page.length > 0 || held.size === 0) lines.push(result.file);
+    page.forEach(print);
+    for (const [manifest, rows] of held) {
+      lines.push(`${manifest} ${c.dim(`(for ${result.file})`)}`);
+      rows.forEach(print);
     }
     const note = unknownNote(result, c.dim);
     if (note !== "") lines.push(`   ${note}`);
   }
   const s = run2.summary;
   const parts = [plural2(s.files, "file")];
+  const provenance = run2.results.flatMap((r) => r.fields.filter((f) => f.ranges !== void 0));
+  const provenanceFields = provenance.filter((f) => run2.dryRun ? f.status === "stale" || f.status === "unset" : f.written).length;
   if (run2.dryRun) {
-    parts.push(`${s.changed} would change`, plural2(s.stale + s.unset, "field"));
+    const ranges = provenance.reduce((n, f) => n + (f.ranges ?? []).filter((r) => r.status !== "current").length, 0);
+    const fields = s.stale + s.unset - provenanceFields;
+    parts.push(`${s.changed} would change`);
+    if (fields > 0 || ranges === 0) parts.push(plural2(fields, "field"));
+    if (ranges > 0) parts.push(plural2(ranges, "range"));
   } else {
-    parts.push(`${s.changed} changed`, `${plural2(s.written, "field")} written`);
+    const ranges = s.ranges ?? 0;
+    const fields = s.written - provenanceFields;
+    parts.push(`${s.changed} changed`);
+    if (fields > 0 || ranges === 0) parts.push(`${plural2(fields, "field")} written`);
+    if (ranges > 0) parts.push(`${plural2(ranges, "range")} written`);
   }
   if (s.errors > 0) parts.push(plural2(s.errors, "error"));
   let footer = parts.join(", ");
@@ -15355,9 +17052,47 @@ function renderDerivePretty(run2, opts = {}) {
   lines.push(s.errors > 0 ? c.yellow(footer) : footer);
   return lines.join("\n");
 }
-function change(f) {
+function fieldRow(f, c) {
   const from = f.status === "unset" ? "(unset)" : fmt2(f.asserted);
-  return `${from} \u2192 ${fmt2(f.derived)}`;
+  const to = fmt2(f.derived);
+  return {
+    name: f.field,
+    change: `${c.dim(from)} \u2192 ${c.green(to)}`,
+    plain: `${from} \u2192 ${to}`,
+    trail: c.dim(`(${f.source ?? "a source"}: ${f.evidence ?? "no evidence"})`)
+  };
+}
+function rangeRow(f, r, c) {
+  const head = `lines ${r.lines}: `;
+  const machine = r["generated-by"];
+  let from;
+  let to;
+  switch (r.status) {
+    case "moved":
+      from = "";
+      to = `moved from ${r.from?.lines ?? r.lines}`;
+      break;
+    case "stale":
+      from = r.from?.["generated-by"] ?? "(unset)";
+      to = machine;
+      break;
+    case "changed":
+      from = machine;
+      to = "re-derived";
+      break;
+    case "unset":
+    case "current":
+      from = "(unset)";
+      to = machine;
+      break;
+  }
+  const arrow = from === "" ? "" : `${from} \u2192 `;
+  return {
+    name: f.field,
+    change: `${head}${from === "" ? "" : `${c.dim(from)} \u2192 `}${c.green(to)}`,
+    plain: `${head}${arrow}${to}`,
+    trail: c.dim(`(${f.source ?? "git"}: ${r.evidence})`)
+  };
 }
 function unknownNote(result, dim) {
   const unknown = result.fields.filter((f) => f.status === "unknown").map((f) => f.field);
@@ -15375,6 +17110,15 @@ function stringifyValue(value) {
   if (typeof value === "string") return value;
   return JSON.stringify(value);
 }
+function valueOf2(r, field, value) {
+  if (field !== PROVENANCE_FIELD || r.provenance === void 0) return stringifyValue(value);
+  if (value === void 0 || value === null) return "(unset)";
+  const entries = provenanceEntries(value);
+  if (!Array.isArray(value) || entries.length !== value.length || entries.length === 0) {
+    return stringifyValue(value);
+  }
+  return renderProvenanceValue(entries, r.provenance.bodyLine);
+}
 function evidenceOf(d) {
   const repeated = ` (${stringifyValue(d.value)})`;
   return d.evidence.endsWith(repeated) ? d.evidence.slice(0, -repeated.length) : d.evidence;
@@ -15386,6 +17130,10 @@ function annotation(r, field) {
   if (origin === "derived") {
     return d == null ? "" : ` (derived, ${d.source}: ${evidenceOf(d)})`;
   }
+  if (field === PROVENANCE_FIELD && r.provenance !== void 0) {
+    if (r.provenance.current !== false) return " (asserted)";
+    return ` (asserted; ${d?.source ?? "git"} says ${valueOf2(r, field, d?.value)})`;
+  }
   if (d == null) return " (asserted)";
   if (compareDerived(field, r.resolved?.[field], d).status === "current") {
     return " (asserted)";
@@ -15406,7 +17154,7 @@ function renderGet(results, fields, opts = {}) {
       const note = annotation(r, f);
       const suffix = note === "" ? "" : c.dim(note);
       lines.push(
-        `${c.dim(`${r.file}:`)} ${f}=${stringifyValue(effective[f])}${suffix}`
+        `${c.dim(`${r.file}:`)} ${f}=${valueOf2(r, f, effective[f])}${suffix}`
       );
     }
   }
@@ -15520,7 +17268,8 @@ export {
   ToolError,
   errorMessage,
   programName,
-  setProgramName,
+  fail,
+  runIfMain,
   externalMetadataUrlProblem,
   parseCollections,
   selectCollections,
@@ -15530,8 +17279,6 @@ export {
   generateEncryptionKey,
   encryptValue,
   decryptValue,
-  KEYED_PIN_PREFIX,
-  keyedPin,
   findGitRoot,
   notice,
   findConfigFile,
@@ -15540,6 +17287,27 @@ export {
   readFamilyConfigFile,
   escapeWorkflowCommandMessage,
   escapeWorkflowCommandProperty,
+  INTEGRITY_SHAPE,
+  integrityOf,
+  isIntegrity,
+  LineRangeError,
+  normalizeText,
+  splitLines,
+  sliceLines,
+  hashRange,
+  hashLines,
+  isKeyedPin,
+  pinOfLines,
+  MOVE_WINDOW_LINES,
+  MOVE_BUDGET_BYTES,
+  MAX_RANGE_LINES,
+  findWindows,
+  parseLines,
+  lineSpec,
+  spellLines,
+  toFileLines,
+  toBodyLines,
+  splitPageArgument,
   ENCRYPTION_KEY_ENV,
   resolveEncryptionKey,
   writeEncryptionKey,
@@ -15553,7 +17321,6 @@ export {
   extractFrontmatter,
   isErrorSeverity,
   DocmetaError,
-  deepEqual,
   toJsonText,
   applyFrontmatter,
   extractorForExtension,
@@ -15570,9 +17337,6 @@ export {
   DEFAULT_TTL_HOURS,
   schemaCacheDir,
   SchemaCache,
-  INTEGRITY_SHAPE,
-  integrityOf,
-  isIntegrity,
   listBuiltins,
   classifyRef,
   fetchSchemaBytes,
@@ -15581,7 +17345,6 @@ export {
   resolveBaselineRequest,
   settleBaseline,
   DEFAULT_SCHEMAS,
-  FILE_SCHEMA_KEY,
   schemaEntryRef,
   collectSchemaPins,
   rebaseConfigSchemaRefs,
@@ -15629,6 +17392,7 @@ export {
   orphanEntries,
   orphanJoins,
   orphanError,
+  spliceManifestValue,
   isParamName,
   memberOf,
   Validator,
@@ -15669,6 +17433,7 @@ export {
   runQuery,
   runFill,
   runDerive,
+  deriveFailed,
   FILL_FORMATS,
   FILL_FORMAT_LIST,
   isFillFormat,
@@ -15683,4 +17448,4 @@ export {
   renderQuery,
   renderQueryCsv
 };
-//# sourceMappingURL=chunk-PDNSN5UJ.js.map
+//# sourceMappingURL=chunk-2DC2GSRH.js.map