@hawkeyexl/manni 4.1.0 → 4.3.0

package/dist/{chunk-I57KBF45.js → chunk-DP2ZA3WH.js}

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name2 in all)
-    __defProp(target, name2, { get: all[name2], enumerable: true });
-};
+import {
+  ToolError,
+  errorMessage
+} from "./chunk-IOYXPBCL.js";
 
 // package.json
 var package_default = {
   name: "@hawkeyexl/manni",
-  version: "4.1.0",
+  version: "4.3.0",
   description: "One command line for documentation that is meant to be checked. `manni meta` validates the presence and format of document metadata (Markdown frontmatter and more) against JSON Schema, built for CI. Formerly docmeta.",
   type: "module",
   bin: {
@@ -23,11 +22,21 @@ var package_default = {
       types: "./dist/index.d.ts",
       import: "./dist/index.js"
     },
+    "./graph/runtime": {
+      types: "./dist/graph/runtime.d.ts",
+      import: "./dist/graph/runtime.js"
+    },
+    "./graph/embed": {
+      types: "./dist/graph/embed.d.ts",
+      import: "./dist/graph/embed.js"
+    },
     "./package.json": "./package.json"
   },
   files: [
     "dist",
     "schemas",
+    "plugin",
+    "shapes",
     "templates"
   ],
   repository: {
@@ -46,11 +55,12 @@ var package_default = {
   },
   scripts: {
     prebuild: "npm run check:deps",
-    build: "tsup",
-    dev: "tsup --watch",
+    build: "node scripts/clean-dist.mjs && tsup",
+    dev: "node scripts/clean-dist.mjs && tsup --watch",
     pretest: "npm run check:deps",
     test: "vitest run",
     "test:watch": "vitest",
+    "test:graph:real": "vitest run --config vitest.graph-real.config.ts",
     "test:coverage": "vitest run --coverage",
     pretypecheck: "npm run check:deps",
     typecheck: "tsc --noEmit",
@@ -64,6 +74,7 @@ var package_default = {
     "docs:check-api": "node scripts/check-api-reference.mjs",
     "docs:check-links": "node scripts/check-doc-links.mjs",
     "docs:check-docevals": "node dist/cli.js docevals run --deterministic-only --no-generate",
+    "docs:check-graph": "node scripts/check-docs-graph.mjs",
     "docs:check-tables": "node scripts/check-table-rows.mjs",
     "docs:check-versions": "node scripts/check-versions.mjs",
     "docs:sync-versions": "node scripts/sync-versions.mjs",
@@ -94,6 +105,8 @@ var package_default = {
     "@asciidoctor/core": "^3.0.4",
     "@axe-core/playwright": "^4.13.0",
     "@hawkeyexl/inference": "^0.4.0",
+    "@inquirer/prompts": "^7.10.1",
+    "@types/n3": "^1.26.3",
     "@xmldom/xmldom": "^0.9.12",
     ajv: "^8.17.1",
     "ajv-draft-04": "^1.0.0",
@@ -102,10 +115,13 @@ var package_default = {
     "fast-glob": "^3.3.2",
     "github-slugger": "^2.0.0",
     "mdast-util-to-string": "^4.0.0",
+    minisearch: "^7.2.0",
+    n3: "^1.26.0",
     parse5: "^8.0.1",
     picocolors: "^1.1.1",
     picomatch: "^4.0.7",
     "playwright-core": "^1.63.0",
+    "rdf-validate-shacl": "^0.6.5",
     "remark-frontmatter": "^5.0.0",
     "remark-gfm": "^4.0.1",
     "remark-mdx": "^3.1.1",
@@ -118,31 +134,42 @@ var package_default = {
   devDependencies: {
     "@commitlint/cli": "^21.2.2",
     "@commitlint/config-conventional": "^21.2.2",
+    "@comunica/query-sparql-rdfjs-lite": "^5.3.0",
     "@eslint/js": "^10.0.1",
+    "@rdfjs/types": "^2.0.1",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^12.0.8",
     "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "^14.1.1",
+    "@types/jsonld": "^1.5.15",
     "@types/mdast": "^4.0.4",
     "@types/node": "^26.3.0",
     "@types/picomatch": "^4.0.3",
     "@types/unist": "^3.0.3",
+    "@types/yauzl": "^3.4.0",
     "@vitest/coverage-v8": "^4.1.11",
     eslint: "^10.9.1",
     globals: "^17.11.0",
     husky: "^9.1.7",
+    jsonld: "^9.0.0",
+    "rdfxml-streaming-parser": "^3.3.0",
     "semantic-release": "^25.0.9",
     tsup: "^8.3.5",
     typescript: "^6.0.3",
     "typescript-eslint": "^8.68.0",
-    vitest: "^4.1.11"
+    vitest: "^4.1.11",
+    yauzl: "^3.4.0"
   },
   peerDependencies: {
+    "@huggingface/transformers": ">=4",
     "node-llama-cpp": "^3.19.0"
   },
   peerDependenciesMeta: {
+    "@huggingface/transformers": {
+      optional: true
+    },
     "node-llama-cpp": {
       optional: true
     }
@@ -610,30 +637,6 @@ import { realpathSync as realpathSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { CommanderError } from "commander";
 
-// src/shared/errors.ts
-var ToolError = class extends Error {
-  /** clig.dev: 2 is operational/usage; 1 is reserved for findings. */
-  exitCode = 2;
-  constructor(message) {
-    super(message);
-    this.name = "ToolError";
-  }
-};
-function errorMessage(err) {
-  if (err instanceof Error) return err.message;
-  if (typeof err === "string") return err;
-  if (typeof err === "number" || typeof err === "bigint") return String(err);
-  if (typeof err === "object" && err !== null && "message" in err && typeof err.message === "string") {
-    return err.message;
-  }
-  try {
-    const json = JSON.stringify(err);
-    if (json !== void 0) return json;
-  } catch {
-  }
-  return String(err);
-}
-
 // src/shared/program-name.ts
 var name = "manni";
 function programName() {
@@ -8311,44 +8314,881 @@ var __default46 = {
   }
 };
 
-// src/meta/schemas/tgdp-strict/1.1.json
-var __default47 = {
+// src/meta/schemas/tgdp-strict/1.1.json
+var __default47 = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "tgdp:templates-strict:1.1",
+  title: "The Good Docs Project templates strict overlay v1.1",
+  description: "The strict overlay for tgdp:templates:1.1. Stack it beside the open schema, which owns the key and the required rule. It closes `type` to the 25 template slugs and requires no key.",
+  additionalProperties: true,
+  type: "object",
+  properties: {
+    type: {
+      enum: [
+        "api-getting-started",
+        "api-reference",
+        "bug-report",
+        "changelog",
+        "code-of-conduct",
+        "code-of-conduct-incident-record",
+        "code-of-conduct-remediation-record",
+        "code-of-conduct-response-plan",
+        "concept",
+        "contact-support",
+        "contributing-guide",
+        "glossary",
+        "how-to",
+        "installation-guide",
+        "our-team",
+        "quickstart",
+        "readme",
+        "reference",
+        "release-notes",
+        "sdk-overview",
+        "style-guide",
+        "terminology-system",
+        "troubleshooting",
+        "tutorial",
+        "user-personas"
+      ],
+      description: "Stacked beside tgdp:templates:1.1, strict closes `type` to the 25 template slugs. That is the check tgdp:templates:1.0 makes in one file."
+    }
+  }
+};
+
+// src/meta/schemas/artifact-evals/1.1.0.json
+var __default48 = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "manni:artifact-evals:1.1.0",
+  title: "manni artifact-evals vocabulary v1.1.0",
+  description: "Eval declarations for instruction artifacts - skills, agent definitions, and project-rules files: assertions about what must have held in an agent session that used the artifact. A manni common vocabulary sharing the entry shape of manni:evals:1.0.0. The page-side keys appear here one level down - `metadata.evals` (one assertion or the list), `metadata.eval-skip`, and `metadata.meta-provenance`, the page-level attribution record of manni:ai-context:1.0.0 with the same entry shape - because an artifact's top-level frontmatter is the host tool's contract and `metadata` is its sanctioned extension bag; there is no container object inside it - the list is the value. `metadata` stays open so other tools' members pass untouched, and the `eval-` prefix is reserved and enforced inside it: an unrecognized `eval-*` member is rejected, the same loud-typo guard as the page side.",
+  type: "object",
+  additionalProperties: true,
+  properties: {
+    metadata: {
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        evals: {
+          type: [
+            "string",
+            "array"
+          ],
+          minLength: 1,
+          minItems: 1,
+          items: {
+            $ref: "#/$defs/evalEntry"
+          },
+          description: "The evals for this artifact: one AI-judged assertion as a string, or a non-empty list of entries \u2014 string shorthands, or closed objects with a required id. An empty list is not a declaration; an artifact with no evals omits the key. Ids are unique within an artifact: two entries claiming one id is an error, not a last-one-wins override. JSON Schema cannot express that over a mixed-shape array - `uniqueItems` is whole-item equality - so it is a requirement on implementations, stated here so every tool agrees on the rule."
+        },
+        "eval-skip": {
+          type: "boolean",
+          default: false,
+          description: "Skip this artifact's evals entirely \u2014 reported as skipped, never silently ignored. The page-side key, one level down; default false."
+        },
+        "meta-provenance": {
+          type: "array",
+          minItems: 1,
+          items: {
+            $ref: "#/$defs/metaProvenanceEntry"
+          },
+          description: "Attribution for machine-proposed metadata, one entry per model (consumers merge by generated-by; the schema dedupes identical entries): which evals (by id) and which fields (by JSON Pointer) it proposed, at what confidence. A human deletes an entry once those are reviewed, so a surviving entry means unreviewed machine metadata. The page-level `meta-provenance`, one level down, with the entry shape repeated byte for byte. The name does not start with `eval-`, so the prefix guard does not apply to it.",
+          uniqueItems: true
+        }
+      },
+      patternProperties: {
+        "^eval-(?!skip$)": false
+      },
+      "x-manni-location": "external"
+    }
+  },
+  $defs: {
+    metaProvenanceEntry: {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "generated-by"
+      ],
+      anyOf: [
+        {
+          required: [
+            "fields"
+          ]
+        },
+        {
+          required: [
+            "evals"
+          ]
+        }
+      ],
+      description: "One model's proposals: which metadata values and which evals it proposed, at what confidence. At least one of `fields` or `evals` is required, because an entry naming neither says nothing.",
+      properties: {
+        "generated-by": {
+          type: "string",
+          minLength: 1,
+          description: "Model or agent that proposed the fields or evals."
+        },
+        fields: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string",
+            pattern: "^/"
+          },
+          uniqueItems: true,
+          description: "The metadata values it proposed, as JSON Pointers: the same form `validate` reports. `/intent` names a top-level key and `/graph/label` reaches into a block. Pointers let one entry shape cover every vocabulary stacked on the document."
+        },
+        evals: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string",
+            pattern: "^[a-z0-9][a-z0-9-]*$"
+          },
+          uniqueItems: true,
+          description: "The evals it proposed, by kebab id, so a reordered eval list does not orphan them."
+        },
+        confidence: {
+          type: "object",
+          propertyNames: {
+            pattern: "^(?:/.*|[a-z0-9][a-z0-9-]*)$"
+          },
+          additionalProperties: {
+            type: "number",
+            minimum: 0,
+            maximum: 1
+          },
+          description: "Model confidence, 0..1, keyed by a pointer from `fields` or an id from `evals`. The two key forms cannot collide: a pointer starts with `/` and an id cannot. A confidence attached to a malformed key fails here instead of dangling."
+        }
+      }
+    },
+    evalEntry: {
+      if: {
+        type: "string"
+      },
+      then: {
+        type: "string",
+        minLength: 1
+      },
+      else: {
+        $ref: "#/$defs/inlineEval"
+      },
+      description: "One eval: a string shorthand (an AI-judged assertion at error severity \u2014 the legitimately id-less form), or a closed object. Branched with if/then rather than oneOf so a fault inside the object form is reported once, against the key that is wrong."
+    },
+    inlineEval: {
+      type: "object",
+      required: [
+        "id"
+      ],
+      properties: {
+        id: {
+          type: "string",
+          pattern: "^[a-z0-9][a-z0-9-]*$",
+          description: "Unique (per artifact) kebab-case identifier. Required on the object form \u2014 position-derived names orphan cached verdicts whenever entries move; if an eval is worth an object, it is worth a stable name."
+        },
+        assertion: {
+          type: "string",
+          minLength: 1,
+          description: "What must have held in the session that used this artifact."
+        },
+        type: {
+          $ref: "#/$defs/evalType"
+        },
+        grader: {
+          $ref: "#/$defs/grader"
+        },
+        provider: {
+          type: "string",
+          minLength: 1,
+          description: "Which configured inference provider or agent judges an `ai`-graded eval. Legal values are whatever the inference dependency supports, validated at run time; omit for the config default."
+        },
+        model: {
+          type: "string",
+          minLength: 1,
+          description: "Model that judges an `ai`-graded eval, within `provider`. Legal values are whatever the inference dependency supports, validated at run time; omit for the config default. Two uses: an eval that matters can name a stronger judge than the default, and an eval can name a judge other than the model that produced the session it grades - a model asked whether its own session followed the rules is the sharpest form of self-preference bias there is. Meaningful only on `ai` evals."
+        },
+        runs: {
+          type: "integer",
+          minimum: 1,
+          maximum: 50,
+          description: "Ensemble runs for this eval, overriding the tool's configured default. Lets a high-stakes or known-flaky assertion buy more agreement than a cheap one, which a corpus-wide setting cannot. Capped because it multiplies cost directly. Meaningful only on `ai` evals."
+        },
+        command: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string",
+            minLength: 1
+          },
+          description: "Command to execute for command-graded evals. {trace} is replaced with the session trace path \u2014 the artifact-side analog of the page side's {file} \u2014 and exit 0 (or `success-exit-codes`) is a pass. Omitting it is the generation contract: tooling generates a check script from the assertion, then writes `command` and `generated-assertion-hash` back. Legal only alongside `grader: command`."
+        },
+        "success-exit-codes": {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "integer"
+          },
+          default: [
+            0
+          ],
+          description: "Exit codes that count as a pass."
+        },
+        "timeout-ms": {
+          type: "integer",
+          minimum: 1,
+          description: "Timeout for command-graded evals."
+        },
+        "generated-assertion-hash": {
+          type: "string",
+          description: "sha256 of the assertion when the check script was generated \u2014 written back alongside `command`, and never legal without it. A mismatch with the current assertion triggers regeneration."
+        },
+        options: {
+          type: "object",
+          description: "Grader-specific options; validated by the grader at run time, deliberately outside this schema \u2014 a grader's options evolve on the grader's schedule."
+        },
+        severity: {
+          $ref: "#/$defs/severity"
+        },
+        weight: {
+          type: "number",
+          exclusiveMinimum: 0,
+          default: 1,
+          description: "Relative contribution to an aggregate score across evals. Does not change this eval's own pass/fail, nor its severity: an eval still passes or fails on its own terms, and weight only decides how much that outcome moves a run total. Zero is excluded deliberately - a weightless eval is a silent disable, and `skip` already means that, loudly."
+        },
+        "severity-map": {
+          type: "object",
+          additionalProperties: {
+            $ref: "#/$defs/severity"
+          },
+          description: "Maps a tool grader's own severities onto eval severities. Meaningful only on `tool:*` evals \u2014 imported from the page side to keep the entry vocabularies congruent."
+        },
+        skip: {
+          type: "boolean"
+        },
+        evidence: {
+          type: "string",
+          minLength: 1,
+          description: "Hint telling the judge where in the session to look."
+        },
+        target: {
+          $ref: "#/$defs/target"
+        },
+        examples: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            pass: {
+              $ref: "#/$defs/anchorList"
+            },
+            fail: {
+              $ref: "#/$defs/anchorList"
+            }
+          },
+          description: "Anchor examples of passing and failing behavior for the judge \u2014 one or several each."
+        }
+      },
+      additionalProperties: false,
+      dependentRequired: {
+        "generated-assertion-hash": [
+          "command"
+        ]
+      },
+      allOf: [
+        {
+          if: {
+            properties: {
+              grader: {
+                const: "ai"
+              }
+            },
+            required: [
+              "grader"
+            ]
+          },
+          then: {
+            required: [
+              "assertion"
+            ]
+          }
+        },
+        {
+          if: {
+            not: {
+              required: [
+                "grader"
+              ]
+            }
+          },
+          then: {
+            required: [
+              "assertion"
+            ],
+            description: "No grader means the `ai` default, so the assertion the judge reads is required."
+          }
+        },
+        {
+          if: {
+            properties: {
+              grader: {
+                const: "human"
+              }
+            },
+            required: [
+              "grader"
+            ]
+          },
+          then: {
+            required: [
+              "assertion"
+            ]
+          }
+        },
+        {
+          if: {
+            properties: {
+              grader: {
+                const: "command"
+              }
+            },
+            required: [
+              "grader"
+            ]
+          },
+          then: {
+            anyOf: [
+              {
+                required: [
+                  "assertion"
+                ]
+              },
+              {
+                required: [
+                  "command"
+                ]
+              }
+            ],
+            description: "A command eval carries either the assertion its script is generated from, or the command itself - the generation contract writes the second from the first."
+          }
+        },
+        {
+          if: {
+            required: [
+              "command"
+            ]
+          },
+          then: {
+            properties: {
+              grader: {
+                const: "command"
+              }
+            },
+            required: [
+              "grader"
+            ],
+            description: "An entry carrying an executable command must say grader: command."
+          }
+        },
+        {
+          if: {
+            anyOf: [
+              {
+                required: [
+                  "success-exit-codes"
+                ]
+              },
+              {
+                required: [
+                  "timeout-ms"
+                ]
+              }
+            ]
+          },
+          then: {
+            properties: {
+              grader: {
+                const: "command"
+              }
+            },
+            required: [
+              "grader"
+            ],
+            description: "success-exit-codes and timeout-ms configure command execution, so they are legal only alongside grader: command \u2014 present, or generated later under the generation contract."
+          }
+        },
+        {
+          if: {
+            anyOf: [
+              {
+                required: [
+                  "provider"
+                ]
+              },
+              {
+                required: [
+                  "model"
+                ]
+              },
+              {
+                required: [
+                  "runs"
+                ]
+              }
+            ]
+          },
+          then: {
+            properties: {
+              grader: {
+                const: "ai"
+              }
+            },
+            description: "provider, model and runs configure the AI judge, so they are legal only on an `ai` eval. `grader` is not required alongside them because `ai` is the default."
+          }
+        }
+      ]
+    },
+    evalType: {
+      enum: [
+        "capability",
+        "regression"
+      ],
+      default: "regression",
+      description: "`capability` probes a boundary and is expected to fail sometimes; `regression` protects behavior that already works. Reported, not enforced."
+    },
+    severity: {
+      enum: [
+        "error",
+        "warning",
+        "notice"
+      ],
+      default: "error",
+      description: "Only error-severity failures fail the eval; warning and notice report but pass. The three levels are the family scale in manni's shared severity, so a finding reads the same in every tool. Default error \u2014 the string shorthand implies it."
+    },
+    grader: {
+      anyOf: [
+        {
+          type: "string",
+          pattern: "^(tool:)?[a-z0-9][a-z0-9-]*$"
+        },
+        {
+          enum: [
+            "ai",
+            "human",
+            "command",
+            "tool-usage",
+            "skill-invoked",
+            "file-access",
+            "turn-count",
+            "cost",
+            "regex",
+            "json-output",
+            "tool-order"
+          ]
+        }
+      ],
+      default: "ai",
+      description: "How the assertion is checked: the AI judge (`ai`); a human review queue (`human` \u2014 judged per session, since every trace is new, unlike the page side where a verdict persists until the page changes); an executable check over the trace (`command`); a deterministic session grader \u2014 `tool-usage`, `tool-order`, `skill-invoked`, `file-access`, `turn-count`, `cost`, `regex`, `json-output`; or a `tool:<kebab>` integration, the page side's namespace, accepted here so one grader spelling ports across both eval vocabularies. Recommended values, not a closed list: any kebab name is legal and validated against the grader registry at run time, so a new grader never needs a schema version \u2014 the one cost is that a stale or misspelled grader name passes this schema and is rejected by the registry instead."
+    },
+    anchorList: {
+      if: {
+        type: "array"
+      },
+      then: {
+        type: "array",
+        minItems: 1,
+        uniqueItems: true,
+        items: {
+          type: "string",
+          minLength: 1
+        }
+      },
+      else: {
+        type: "string",
+        minLength: 1
+      },
+      description: "One anchor example, or a non-empty list of them."
+    },
+    target: {
+      if: {
+        type: "object"
+      },
+      then: {
+        type: "object",
+        additionalProperties: false,
+        required: [
+          "source",
+          "path"
+        ],
+        properties: {
+          source: {
+            const: "file"
+          },
+          path: {
+            type: "string",
+            minLength: 1,
+            description: "Path to the file to grade, relative to the session's working directory."
+          }
+        }
+      },
+      else: {
+        enum: [
+          "transcript",
+          "last-message",
+          "files",
+          "artifact"
+        ]
+      },
+      default: "transcript",
+      description: "What the grader receives: the whole session (`transcript`), the final assistant message (`last-message`), the list of files the session wrote (`files`), the instruction artifact itself (`artifact`), or a named file. Distinct from `evidence`, which hints where to look within what is graded - this selects the bytes themselves, and it is structural, so deterministic graders honour it too. Named `target` rather than `focus` for that reason: a regex grader has no focus, it has a target. Branched with if/then rather than oneOf so a fault inside the object form is reported once, against the key that is wrong."
+    }
+  }
+};
+
+// src/meta/schemas/artifact-evals-strict/1.1.0.json
+var __default49 = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "manni:artifact-evals-strict:1.1.0",
+  title: "manni artifact-evals strict overlay v1.1.0",
+  description: "The strict overlay for manni:artifact-evals:1.1.0. Stack it beside the open vocabulary, which owns every key, every required rule and every conditional. Inside `metadata`, it narrows provider and model names, exit codes, companion paths and the assertion hash as manni:evals-strict:1.0.0 does. It also closes `grader` to the named graders and `tool:` integrations.",
+  additionalProperties: true,
+  type: "object",
+  properties: {
+    metadata: {
+      description: "Strict narrows the object entries of `metadata.evals`. A string shorthand passes as the open vocabulary reads it, and every other member of `metadata` passes untouched.",
+      properties: {
+        evals: {
+          items: {
+            $ref: "#/$defs/entry"
+          }
+        },
+        "meta-provenance": {
+          description: "Strict holds each entry to the rules the ai-context overlay applies to the same shape. `generated-by` is a model id with no spaces, and each pointer is well formed.",
+          items: {
+            properties: {
+              "generated-by": {
+                pattern: "^[A-Za-z0-9][A-Za-z0-9._:/\\\\@-]*$",
+                description: "A model id of letters in either case, digits, `.`, `_`, `:`, `/`, `\\`, `@` and `-`, with no spaces. A Windows path to a local model passes."
+              },
+              fields: {
+                items: {
+                  pattern: "^(?:/(?:[^~/]|~[01])*)+$",
+                  description: "A JSON Pointer in which every `~` begins an RFC 6901 escape, `~0` or `~1`."
+                }
+              },
+              confidence: {
+                propertyNames: {
+                  pattern: "^(?:(?:/(?:[^~/]|~[01])*)+|[a-z0-9][a-z0-9-]*)$",
+                  description: "A well-formed JSON Pointer, or a kebab eval id."
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  $defs: {
+    entry: {
+      description: "The rules strict adds to an object entry.",
+      properties: {
+        grader: {
+          anyOf: [
+            {
+              enum: [
+                "ai",
+                "human",
+                "command",
+                "tool-usage",
+                "skill-invoked",
+                "file-access",
+                "turn-count",
+                "cost",
+                "regex",
+                "json-output",
+                "tool-order"
+              ]
+            },
+            {
+              type: "string",
+              pattern: "^tool:[a-z0-9][a-z0-9-]*$"
+            }
+          ],
+          description: "One of the eleven named graders, or a `tool:<kebab>` integration. Strict accepts no other kebab name."
+        },
+        provider: {
+          pattern: "^[a-z0-9][a-z0-9-]*$",
+          description: "A kebab provider name, such as `anthropic` or `llama-cpp`."
+        },
+        model: {
+          pattern: "^[A-Za-z0-9][A-Za-z0-9._:/\\\\@-]*$",
+          description: "A model id of letters in either case, digits, `.`, `_`, `:`, `/`, `\\`, `@` and `-`, with no spaces. A Windows path to a local model passes."
+        },
+        "success-exit-codes": {
+          uniqueItems: true,
+          items: {
+            type: "integer",
+            minimum: 0,
+            maximum: 255
+          },
+          description: "Distinct exit codes, each from 0 to 255, the range a process can return."
+        },
+        target: {
+          properties: {
+            path: {
+              pattern: "^(?![\\\\/~])(?![A-Za-z]:)(?![A-Za-z][A-Za-z0-9+.-]*://).+$",
+              description: "A relative path. It starts with no `/`, `\\` or `~`, no drive letter, and no URL scheme."
+            }
+          }
+        },
+        "generated-assertion-hash": {
+          pattern: "^sha256-[0-9a-f]{64}$",
+          description: "`sha256-` and sixty-four lowercase hex digits."
+        }
+      }
+    }
+  }
+};
+
+// src/meta/schemas/stewardship/1.1.0.json
+var __default50 = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "manni:stewardship:1.1.0",
+  title: "manni stewardship vocabulary v1.1.0",
+  description: "Is this page cared for? This vocabulary covers attribution, ownership, review, the document's own dates, and the anchors that make drift detectable. Every field records a fact a person asserts about the document, not one a tool reads off the file. That is why `created`, `last-updated` and `authors` are here. Git records when a path changed and who committed the change, not when the document was written or who wrote it. Those part company at every migration, split, squashed import, typo fix and bulk frontmatter sweep. A published page carries no repo, so a stamped date travels with the document where a derived one cannot. The cost is that a hand-typed `last-updated` goes stale quietly, and no JSON Schema can catch that. The review dates are records, not freshness gates. Tooling that can read a clock derives the due date from `last-reviewed` and `review-interval`. Version 1.1.0 adds `x-manni-graph-output: false` to `owner`, `stakeholders` and `reviewed-by`. Those three name people, so a published graph leaves them out: its Turtle, its JSON-LD, its iiRDS package and its search index. Validation is the same as in 1.0.0.",
+  type: "object",
+  additionalProperties: true,
+  properties: {
+    authors: {
+      type: [
+        "string",
+        "object",
+        "array"
+      ],
+      description: "Who wrote the page: a name, a list of names, or the structured person objects MyST and Docusaurus define. Attribution rather than answerability \u2014 `owner` is the party on the hook for the page now, and the two part company the moment an author moves on. Not a `stringList`, and not the only field here that isn't: `verified-against` and `source-of-truth` take the same string-or-object-or-list shape, as `entryList`. `authors` keeps its own inline copy rather than sharing that definition, because MyST and Docusaurus claim this key too and the composability law holds it at their loosest published definition, which `entryList`'s uniqueness and member floors go past. List members are names or person objects \u2014 never bare numbers or nulls. Never empty in any form: minLength, minItems and minProperties each bind to their own type and are ignored for the others.",
+      items: {
+        type: [
+          "string",
+          "object"
+        ]
+      },
+      minLength: 1,
+      minItems: 1,
+      minProperties: 1,
+      "x-manni-location": "external"
+    },
+    owner: {
+      $ref: "#/$defs/stringList",
+      description: "The person or team answerable for this page \u2014 the one required field of every docs-ownership system from Backstage to GitLab. A name, a handle, a chat channel, a team slug, or a list of them; write the spelling people can actually reach. A published graph does not carry it, because it names people.",
+      "x-manni-location": "external",
+      "x-manni-graph-output": false
+    },
+    stakeholders: {
+      $ref: "#/$defs/stringList",
+      description: "Who has a stake in this page being right: the feature's engineer, the product owner, the support lead who fields its tickets. The standing parties to consult before changing the page \u2014 where `reviewed-by` records who actually did the last pass. Page-level on purpose: the right stakeholders differ page by page, and project-wide ones belong in your project docs, not in every file's frontmatter. A published graph does not carry it, because it names people.",
+      "x-manni-location": "external",
+      "x-manni-graph-output": false
+    },
+    "reviewed-by": {
+      $ref: "#/$defs/stringList",
+      description: "Who last reviewed the page. Named `reviewed-by` rather than `reviewers` because MyST already defines `reviewers` as scholarly person objects. A published graph does not carry it, because it names people.",
+      "x-manni-location": "external",
+      "x-manni-graph-output": false
+    },
+    created: {
+      $ref: "#/$defs/w3cdtf",
+      description: "When the document was written, as a W3CDTF date. The document's date, not the file's: a page migrated from a CMS, imported from another repo, split out of a longer one, or landed through a squashed history has a path in this repo that is younger than the content it holds, and `git log` can only report the path. Where the two agree, git agreeing is a bonus rather than the source.",
+      "x-manni-location": "external"
+    },
+    "last-updated": {
+      $ref: "#/$defs/w3cdtf",
+      description: "When the content last changed in a way a reader would notice, as a W3CDTF date. The editorial fact, not the file's: a commit date also moves for a typo fix, a link sweep, a formatting pass and a bulk frontmatter migration, none of which change what the page says. Distinct from `last-reviewed`, which records the page being checked and found still true \u2014 an update changes the content, a review confirms it, and a page can have either without the other. Spelled with the `last-` prefix for exactly the reason `last-reviewed` carries one: both name the most recent instance of a repeating event, and the two read as the pair they are. That also keeps the key clear of every neighbour's spelling of the same fact, which are `lastmod`, `last_update`, `lastUpdated` and `article:modified_time`. A stale value here is the accepted cost of stamping a date instead of deriving one, and a check comparing it against the repo's own last-change date is the tooling answer, not a schema's.",
+      "x-manni-location": "page"
+    },
+    "last-reviewed": {
+      $ref: "#/$defs/w3cdtf",
+      description: "When the page was last reviewed, as a W3CDTF date. The field freshness tooling reads to derive review deadlines. A record, not a freshness gate \u2014 JSON Schema cannot compare a date to today.",
+      "x-manni-location": "external"
+    },
+    "review-interval": {
+      type: "string",
+      pattern: "^P(?:\\d+W|(?=\\d|T\\d)(?:\\d+Y)?(?:\\d+M)?(?:\\d+D)?(?:T(?=\\d)(?:\\d+H)?(?:\\d+M)?(?:\\d+S)?)?)$",
+      description: "How often the page should be reviewed, as an ISO 8601 duration: `P90D`, `P1Y`. ISO rather than `90d` so the value is machine-comparable. With `last-reviewed`, this is everything review tooling needs to derive the due date \u2014 a stored due date would only ever agree with them or lie.",
+      "x-manni-location": "external"
+    },
+    "verified-against": {
+      $ref: "#/$defs/entryList",
+      description: 'The product version, API revision, or spec the content was last verified against. A string is the short spelling \u2014 `operator 1.4.2` \u2014 and an object the checkable one, such as `{name: operator, version: 1.4.2}`, which a drift check can compare without parsing prose. A list says a page was verified against more than one thing, such as the operator and the cluster it runs on. What turns "reviewed" into "reviewed against something".',
+      "x-manni-location": "external"
+    },
+    "source-of-truth": {
+      $ref: "#/$defs/entryList",
+      description: "Where reality lives for this page: a repo path, an API spec, a schema file. A string names it, an object structures it \u2014 `{path: charts/operator/values.yaml, kind: helm-values}` \u2014 and a list carries several, because a page usually answers to more than one source. The anchor a drift check compares the page against; a page without one cannot be drift-monitored.",
+      "x-manni-location": "external"
+    }
+  },
+  $defs: {
+    stringList: {
+      if: {
+        type: "array"
+      },
+      then: {
+        type: "array",
+        minItems: 1,
+        uniqueItems: true,
+        items: {
+          type: "string",
+          minLength: 1
+        }
+      },
+      else: {
+        type: "string",
+        minLength: 1
+      },
+      description: "One non-empty string, or a non-empty list of unique ones \u2014 the same shape as the `labelList` of manni:graph:1.0.0."
+    },
+    entryList: {
+      type: [
+        "string",
+        "object",
+        "array"
+      ],
+      items: {
+        $comment: "The parent's keyword-per-type pattern again, one level down: minLength binds to a string member, minProperties to an object one, and each is ignored for the other. Repeated here rather than hoisted because a member's floor is a different assertion from the whole value's.",
+        type: [
+          "string",
+          "object"
+        ],
+        minLength: 1,
+        minProperties: 1
+      },
+      minLength: 1,
+      minItems: 1,
+      minProperties: 1,
+      uniqueItems: true,
+      description: 'One entry, or a non-empty list of unique ones, where an entry is a non-empty string or a non-empty object. The shape `authors` carries, made a definition because two more fields need it: the short human spelling and the structured machine-checkable one, without minting a second field name for the same fact. Object keys are left open on purpose, and the recommendations live in each field\'s description. Every non-empty floor binds to its own type \u2014 minLength for the string, minProperties for the object, minItems and uniqueItems for the list \u2014 and `items` repeats the first two, so `""`, `[]`, `{}`, `[""]` and `[{}]` all fail. Unlike `authors`, no other schema claims the keys that use this, so the family is free to set that floor.',
+      $comment: "minLength, minItems, minProperties and uniqueItems each apply to one instance type and are ignored for the others; that is what lets one subschema hold three shapes without an anyOf whose errors name all three branches."
+    },
+    w3cdtf: {
+      type: "string",
+      pattern: "^[0-9]{4}(-(0[1-9]|1[0-2])(-(0[1-9]|[12][0-9]|3[01])(T([01][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9](\\.[0-9]+)?)?(Z|[+-]([01][0-9]|2[0-3]):[0-5][0-9]))?)?)?$",
+      description: "A W3CDTF date, permitting reduced precision: `2026`, `2026-08`, `2026-08-23`, or a full timestamp \u2014 in which case the timezone designator is required, as the W3CDTF profile itself mandates (no local-time form). Field-ranged (month 01-12, day 01-31, hour 00-23) so an impossible date fails here rather than becoming Invalid Date in the tooling that derives review deadlines; not calendar-exact \u2014 February 31 is a reviewer's catch."
+    }
+  }
+};
+
+// src/meta/schemas/stewardship-strict/1.1.0.json
+var __default51 = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "tgdp:templates-strict:1.1",
-  title: "The Good Docs Project templates strict overlay v1.1",
-  description: "The strict overlay for tgdp:templates:1.1. Stack it beside the open schema, which owns the key and the required rule. It closes `type` to the 25 template slugs and requires no key.",
+  $id: "manni:stewardship-strict:1.1.0",
+  title: "manni stewardship strict overlay v1.1.0",
+  description: "The strict overlay for manni:stewardship:1.1.0. Stack it beside the open vocabulary. It narrows the form of values the open vocabulary already claims and requires no key.",
   additionalProperties: true,
   type: "object",
   properties: {
-    type: {
-      enum: [
-        "api-getting-started",
-        "api-reference",
-        "bug-report",
-        "changelog",
-        "code-of-conduct",
-        "code-of-conduct-incident-record",
-        "code-of-conduct-remediation-record",
-        "code-of-conduct-response-plan",
-        "concept",
-        "contact-support",
-        "contributing-guide",
-        "glossary",
-        "how-to",
-        "installation-guide",
-        "our-team",
-        "quickstart",
-        "readme",
-        "reference",
-        "release-notes",
-        "sdk-overview",
-        "style-guide",
-        "terminology-system",
-        "troubleshooting",
-        "tutorial",
-        "user-personas"
+    authors: {
+      type: "array",
+      uniqueItems: true,
+      items: {
+        pattern: "^\\S(?:.*\\S)?$",
+        required: [
+          "name"
+        ],
+        properties: {
+          name: {
+            type: "string",
+            pattern: "^\\S(?:.*\\S)?$"
+          },
+          email: {
+            type: "string",
+            pattern: "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$"
+          },
+          url: {
+            type: "string",
+            pattern: "^https?://\\S+$"
+          }
+        }
+      },
+      description: "Strict takes authors as a list of unique entries. A string entry is one line with no surrounding space. A person object names the person, and its `email` and `url` are well formed."
+    },
+    owner: {
+      $ref: "#/$defs/handles",
+      description: "Strict holds each owner to a handle a GitHub or GitLab CODEOWNERS file accepts, in the string form and the list form alike."
+    },
+    stakeholders: {
+      $ref: "#/$defs/names",
+      description: "Strict holds each stakeholder to one line with no surrounding space. A stakeholder is a person or team, named in any form."
+    },
+    "reviewed-by": {
+      $ref: "#/$defs/names",
+      description: "Strict holds each reviewer to one line with no surrounding space. `manni meta derive` writes review-API logins and commit-trailer names, so no handle form is required."
+    },
+    created: {
+      $ref: "#/$defs/date",
+      description: "Strict holds the creation date to an RFC 3339 full date or date-time. A year or month alone fails, and so does a timestamp without seconds."
+    },
+    "last-updated": {
+      $ref: "#/$defs/date",
+      description: "Strict holds the update date to an RFC 3339 full date or date-time. A year or month alone fails, and so does a timestamp without seconds."
+    },
+    "last-reviewed": {
+      $ref: "#/$defs/date",
+      description: "Strict holds the review date to an RFC 3339 full date or date-time. A year or month alone fails, and so does a timestamp without seconds."
+    },
+    "verified-against": {
+      required: [
+        "name",
+        "version"
       ],
-      description: "Stacked beside tgdp:templates:1.1, strict closes `type` to the 25 template slugs. That is the check tgdp:templates:1.0 makes in one file."
+      items: {
+        required: [
+          "name",
+          "version"
+        ]
+      },
+      description: "Strict requires an object entry to carry `name` and `version`, alone or in a list. The version's format stays free, and a string entry is unchanged. The top-level `required` holds the single-object form, and `items` holds each object in a list, since `required` applies only to an object."
+    },
+    "source-of-truth": {
+      $ref: "#/$defs/source",
+      items: {
+        $ref: "#/$defs/source"
+      },
+      description: "Strict requires an object entry to carry `path` or `url`, alone or in a list. A string entry is one id, path or URL on one line with no surrounding space. The top-level `$ref` holds the string and single-object forms, and `items` holds each entry in a list, since `required` applies only to an object."
+    }
+  },
+  $defs: {
+    handles: {
+      pattern: "^(?:@@?[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?(?:/[A-Za-z0-9._-]+)*|[^\\s@]+@[^\\s@]+\\.[^\\s@]+)$",
+      items: {
+        pattern: "^(?:@@?[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?(?:/[A-Za-z0-9._-]+)*|[^\\s@]+@[^\\s@]+\\.[^\\s@]+)$"
+      },
+      description: "A handle a CODEOWNERS file accepts, as a string or as each member of a list. That is `@user`, `@org/team`, a GitLab nested group or `@@role`, or an email address."
+    },
+    names: {
+      pattern: "^\\S(?:.*\\S)?$",
+      items: {
+        pattern: "^\\S(?:.*\\S)?$"
+      },
+      description: "One line with no surrounding space, as a string or as each member of a list."
+    },
+    date: {
+      type: "string",
+      pattern: "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])(?:T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](?:\\.[0-9]+)?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9]))?$",
+      description: "An RFC 3339 full date, or a date-time with seconds and an offset."
+    },
+    source: {
+      pattern: "^\\S(?:.*\\S)?$",
+      anyOf: [
+        {
+          required: [
+            "path"
+          ]
+        },
+        {
+          required: [
+            "url"
+          ]
+        }
+      ],
+      description: "A source entry. A string is one id, path or URL on one line with no surrounding space. An object carries `path` or `url`."
     }
   }
 };
@@ -8401,7 +9241,15 @@ var BUILTINS = /* @__PURE__ */ new Map([
   ["manni:graph-strict:1.0.0", __default44],
   ["manni:citations-strict:1.0.0", __default45],
   ["tgdp:templates:1.1", __default46],
-  ["tgdp:templates-strict:1.1", __default47]
+  ["tgdp:templates-strict:1.1", __default47],
+  ["manni:artifact-evals:1.1.0", __default48],
+  ["manni:artifact-evals-strict:1.1.0", __default49],
+  ["manni:stewardship:1.1.0", __default50],
+  ["manni:stewardship-strict:1.1.0", __default51]
+]);
+var ANNOTATION_ONLY_PREDECESSORS = /* @__PURE__ */ new Map([
+  ["manni:stewardship:1.1.0", "manni:stewardship:1.0.0"],
+  ["manni:stewardship-strict:1.1.0", "manni:stewardship-strict:1.0.0"]
 ]);
 function assertPublishableBuiltinId(id) {
   const first = id.split(":")[0];
@@ -8494,7 +9342,11 @@ var PUBLISHED_PATHS = [
   ["graph-strict/1.0.0.json", "manni:graph-strict:1.0.0"],
   ["citations-strict/1.0.0.json", "manni:citations-strict:1.0.0"],
   ["tgdp/1.1.json", "tgdp:templates:1.1"],
-  ["tgdp-strict/1.1.json", "tgdp:templates-strict:1.1"]
+  ["tgdp-strict/1.1.json", "tgdp:templates-strict:1.1"],
+  ["artifact-evals/1.1.0.json", "manni:artifact-evals:1.1.0"],
+  ["artifact-evals-strict/1.1.0.json", "manni:artifact-evals-strict:1.1.0"],
+  ["stewardship/1.1.0.json", "manni:stewardship:1.1.0"],
+  ["stewardship-strict/1.1.0.json", "manni:stewardship-strict:1.1.0"]
 ];
 var PUBLISHED_ALIAS = new Map(
   PUBLISHED_PATHS.map(([path, id]) => [`${PUBLISHED_BASE}${path}`, id])
@@ -8850,7 +9702,7 @@ var DEFAULT_SCHEMAS = Object.freeze([
   "manni:core:1.0.0",
   "manni:audience:1.0.0",
   "manni:structure:1.0.0",
-  "manni:stewardship:1.0.0",
+  "manni:stewardship:1.1.0",
   "manni:lifecycle:1.0.0",
   "manni:ai-context:1.0.0",
   "manni:evals:1.0.0",
@@ -8858,7 +9710,14 @@ var DEFAULT_SCHEMAS = Object.freeze([
   "manni:citations:1.0.0"
 ]);
 var FILE_SCHEMA_KEY = "$schema";
-var DEFAULT_SCHEMA_SET = new Set(DEFAULT_SCHEMAS);
+function vocabularyOf(id) {
+  const parts = id.split(":");
+  if (parts.length !== 3) return void 0;
+  return `${parts[0] ?? ""}:${parts[1] ?? ""}`;
+}
+var DEFAULT_VOCABULARIES = new Set(
+  DEFAULT_SCHEMAS.map(vocabularyOf).filter((v) => v !== void 0)
+);
 function schemaEntryRef(entry) {
   return typeof entry === "string" ? entry : entry.ref;
 }
@@ -8969,14 +9828,34 @@ function withStrict(refs, registered2) {
     out.push(ref);
     const strictId = strictIdOf(ref);
     if (strictId === void 0) continue;
-    if (DEFAULT_SCHEMA_SET.has(ref) && isBuiltinId(strictId)) out.push(strictId);
+    const vocabulary = vocabularyOf(ref);
+    const isDefault = vocabulary !== void 0 && DEFAULT_VOCABULARIES.has(vocabulary);
+    if (isDefault && isBuiltinId(ref) && isBuiltinId(strictId)) out.push(strictId);
     else if (registered2?.has(ref) === true && registered2.has(strictId)) out.push(strictId);
   }
   return dedupe(out);
 }
+function withoutReplacedVersions(set, listed) {
+  const explicit = /* @__PURE__ */ new Set();
+  for (const ref of listed) {
+    if (!isBuiltinId(ref)) continue;
+    explicit.add(ref);
+    const strictId = strictIdOf(ref);
+    if (strictId !== void 0) explicit.add(strictId);
+  }
+  const pinned = new Set(
+    [...explicit].map(vocabularyOf).filter((v) => v !== void 0)
+  );
+  return set.filter((ref) => {
+    if (explicit.has(ref) || !isBuiltinId(ref)) return true;
+    const vocabulary = vocabularyOf(ref);
+    return vocabulary === void 0 || !pinned.has(vocabulary);
+  });
+}
 function joined(listed, defaults, strict, registered2) {
   const set = dedupe([...defaults ? DEFAULT_SCHEMAS : [], ...listed]);
-  return strict ? withStrict(set, registered2) : set;
+  const paired = strict ? withStrict(set, registered2) : set;
+  return defaults ? withoutReplacedVersions(paired, listed) : paired;
 }
 function isDefaultSetOnly(resolved) {
   if (!resolved.defaults) return false;
@@ -10709,6 +11588,14 @@ function schemaTrustRoot(cwd, configDir) {
 async function loadConfig(explicitPath, cwd = process.cwd()) {
   const file = explicitPath ? await readConfigFile(explicitPath, cwd, CONFIG_FILE) : await findConfigFile(cwd, CONFIG_FILE);
   if (file === null) return null;
+  return loadedFrom(file);
+}
+async function loadMetaSection(explicitPath, cwd = process.cwd()) {
+  if (explicitPath === void 0) return loadConfig(void 0, cwd);
+  const file = await readConfigFile(explicitPath, cwd, CONFIG_FILE);
+  return file.wrapped ? loadedFrom(file) : null;
+}
+async function loadedFrom(file) {
   const section = file.wrapped ? META_SECTION : void 0;
   const config = parseConfigValue(file.value, file.source, section);
   assertOverrideCollections(config, file.collections, file.source, section);
@@ -11050,8 +11937,9 @@ function canonicalSchemaRef(ref, ctx) {
   return relative7(ctx.base, abs).replace(/\\/g, "/");
 }
 function fingerprint(e, ctx) {
+  const ref = canonicalSchemaRef(e.schema, ctx);
   const parts = [
-    canonicalSchemaRef(e.schema, ctx),
+    ANNOTATION_ONLY_PREDECESSORS.get(ref) ?? ref,
     e.instancePath,
     e.keyword,
     e.subject ?? ""
@@ -11412,9 +12300,7 @@ function renderSarif(results, opts = {}) {
   )}`;
 }
 
-// src/meta/reporters/junit.ts
-var SUITE_NAME = "manni";
-var CLASS_NAME = "manni.validate";
+// src/shared/xml.ts
 var XML_ENTITIES = {
   "&": "&amp;",
   "<": "&lt;",
@@ -11434,6 +12320,10 @@ function xmlEscape(value) {
   }
   return out;
 }
+
+// src/meta/reporters/junit.ts
+var SUITE_NAME = "manni";
+var CLASS_NAME = "manni.validate";
 var attr = (name2, value) => ` ${name2}="${xmlEscape(value)}"`;
 function renderJunit(results, opts = {}) {
   const tests = results.length;
@@ -11483,6 +12373,16 @@ function shouldColor(opts) {
   if (env.NO_COLOR != null && env.NO_COLOR !== "") return false;
   return Boolean(opts.isTTY);
 }
+function colorFor(command, isTTY, env) {
+  const noColor = colorOwner(command).opts().color === false;
+  return shouldColor({ noColor, isTTY, env });
+}
+function colorOwner(command) {
+  for (let c = command; c !== null; c = c.parent) {
+    if (c.options.some((o) => o.long === "--no-color")) return c;
+  }
+  return command;
+}
 
 // src/shared/github.ts
 function escapeWorkflowCommandMessage(message) {
@@ -11720,7 +12620,7 @@ async function readCapped(url, res, maxBytes) {
 }
 
 // src/meta/core/external-metadata.ts
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 import { isAbsolute as isAbsolute5, relative as relative9, resolve as resolve14, sep as sep4 } from "node:path";
 import {
   LineCounter as LineCounter3,
@@ -11732,6 +12632,7 @@ import {
 } from "yaml";
 
 // src/shared/manifest-cas.ts
+import { readFile as readFile5 } from "node:fs/promises";
 import { posix as posix3 } from "node:path";
 var COMMIT_ATTEMPTS = 5;
 function conflictRefusal(file) {
@@ -11800,10 +12701,18 @@ async function settle(held, io) {
 function isMissing(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
+async function readManifestOrEmpty(absPath, perPage) {
+  try {
+    return await readFile5(absPath, "utf8");
+  } catch (e) {
+    if (perPage && isMissing(e)) return "";
+    throw e;
+  }
+}
 
 // src/shared/encryption-key.ts
 import { spawnSync } from "node:child_process";
-import { readFile as readFile5 } from "node:fs/promises";
+import { readFile as readFile6 } from "node:fs/promises";
 import { basename as basename4, dirname as dirname6, join as join7, relative as relative8, resolve as resolve13 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { isMap as isMap5, parseDocument as parseDocument4, parse as parseYaml3, stringify as stringify2 } from "yaml";
@@ -11873,7 +12782,7 @@ function errorCode3(err) {
 }
 async function readIfPresent(path) {
   try {
-    return await readFile5(path, "utf8");
+    return await readFile6(path, "utf8");
   } catch (err) {
     if (errorCode3(err) === "ENOENT") return null;
     throw err;
@@ -12387,7 +13296,7 @@ function outsideRefusal(manifest, collection, pageRel) {
 }
 async function readPageManifest(abs, file) {
   try {
-    return await readFile6(abs, "utf8");
+    return await readFile7(abs, "utf8");
   } catch (err) {
     if (isMissing(err)) return "";
     throw unreadable(file, err);
@@ -12395,7 +13304,7 @@ async function readPageManifest(abs, file) {
 }
 async function readManifest(abs, file) {
   try {
-    return await readFile6(abs, "utf8");
+    return await readFile7(abs, "utf8");
   } catch (err) {
     throw unreadable(file, err);
   }
@@ -12992,6 +13901,9 @@ function isFieldLocation(value) {
   return value === "page" || value === "external";
 }
 
+// src/meta/core/graph-output.ts
+var GRAPH_OUTPUT_KEYWORD = "x-manni-graph-output";
+
 // src/meta/core/validator.ts
 import * as AjvDraft07Ns from "ajv";
 import * as Ajv2019Ns from "ajv/dist/2019.js";
@@ -13023,6 +13935,7 @@ function buildAjv(dialect, coerceTypes = false) {
   if (dialect === "draft7") ajv.addMetaSchema(draft06MetaSchema);
   registerEncryptKeyword(ajv);
   registerLocationKeyword(ajv);
+  registerGraphOutputKeyword(ajv);
   registerBuiltins(ajv, dialect);
   return ajv;
 }
@@ -13071,6 +13984,28 @@ function registerLocationKeyword(ajv) {
 function isLocationShapeError(err) {
   return err instanceof Error && err.message.includes(`"${LOCATION_KEYWORD}"`);
 }
+var graphOutputRecorder;
+function registerGraphOutputKeyword(ajv) {
+  ajv.addKeyword({
+    keyword: GRAPH_OUTPUT_KEYWORD,
+    metaSchema: { type: "boolean" },
+    errors: false,
+    validate: (schema, _data, _parent, cxt) => {
+      if (graphOutputRecorder !== void 0 && typeof schema === "boolean") {
+        const key = topLevelKey(cxt?.instancePath ?? "");
+        if (key !== void 0) {
+          const seen = graphOutputRecorder.get(key);
+          if (seen) seen.add(schema);
+          else graphOutputRecorder.set(key, /* @__PURE__ */ new Set([schema]));
+        }
+      }
+      return true;
+    }
+  });
+}
+function isGraphOutputShapeError(err) {
+  return err instanceof Error && err.message.includes(`"${GRAPH_OUTPUT_KEYWORD}"`);
+}
 function marksSchemaExternal(schema) {
   const properties = schema["properties"];
   if (typeof properties !== "object" || properties === null) return false;
@@ -13081,7 +14016,7 @@ function marksSchemaExternal(schema) {
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function definiteLocationConflict(root) {
+function definiteMarkConflict(root, keyword, isMark) {
   const marks = /* @__PURE__ */ new Map();
   const localRef = (node, embedded) => {
     const ref = node["$ref"];
@@ -13109,8 +14044,8 @@ function definiteLocationConflict(root) {
     if (!isRecord2(node) || visited.has(node)) return;
     visited.add(node);
     const inner = isEmbedded(node, embedded);
-    const mark = node[LOCATION_KEYWORD];
-    if (isFieldLocation(mark)) {
+    const mark = node[keyword];
+    if (isMark(mark)) {
       const seen = marks.get(key);
       if (seen) seen.add(mark);
       else marks.set(key, /* @__PURE__ */ new Set([mark]));
@@ -13240,12 +14175,22 @@ var Validator = class {
         `${ref}: "${FILE_SCHEMA_KEY}" cannot be stored in external metadata.`
       );
     }
-    const contradicted = definiteLocationConflict(schema);
+    const contradicted = definiteMarkConflict(schema, LOCATION_KEYWORD, isFieldLocation);
     if (contradicted !== void 0) {
       throw new DocmetaError(
         `${ref}: "${LOCATION_KEYWORD}" says both "page" and "external" for "${contradicted}".`
       );
     }
+    const graphContradicted = definiteMarkConflict(
+      schema,
+      GRAPH_OUTPUT_KEYWORD,
+      (value) => typeof value === "boolean"
+    );
+    if (graphContradicted !== void 0) {
+      throw new DocmetaError(
+        `${ref}: "${GRAPH_OUTPUT_KEYWORD}" says both true and false for "${graphContradicted}".`
+      );
+    }
     try {
       const ajv = this.ajvFor(dialectOf(schema));
       const id = typeof schema["$id"] === "string" ? schema["$id"] : void 0;
@@ -13267,6 +14212,11 @@ var Validator = class {
           `${ref}: "${LOCATION_KEYWORD}" must be "page" or "external".`
         );
       }
+      if (isGraphOutputShapeError(err)) {
+        throw new DocmetaError(
+          `${ref}: "${GRAPH_OUTPUT_KEYWORD}" must be true or false.`
+        );
+      }
       throw new DocmetaError(
         `Schema "${ref}" failed to compile: ${errorMessage(err)}`
       );
@@ -13356,6 +14306,45 @@ var Validator = class {
     }
     return claimed;
   }
+  /**
+   * Whether each top-level key of `data` belongs in a published graph under
+   * `refs`, as its `x-manni-graph-output` mark says. A key no schema marks has no
+   * entry, which the caller reads as `true`: absent means harvested.
+   *
+   * A first pass with the recording keyword, as `locationPreferences` runs, so
+   * a mark counts exactly where validation would evaluate it, and a mark nested
+   * inside `graph` is ignored. Only present values are marked: Ajv applies a
+   * property's subschema to a property that exists. `$schema` is stripped
+   * first, as validation does.
+   *
+   * Refs are evaluated in order and a later ref's mark wins, so a house schema
+   * listed after a vocabulary refines it. A schema that says both on paths
+   * every document takes is refused when it compiles. A ref whose conditional
+   * branches say both `true` and `false` gives that key no preference: with
+   * `allErrors`, Ajv evaluates failing branches too, so neither value is that
+   * ref's answer and an earlier ref's stands.
+   */
+  async graphOutputPreferences(data, refs) {
+    const { [FILE_SCHEMA_KEY]: _omit, ...subject } = data;
+    void _omit;
+    const preferences = /* @__PURE__ */ new Map();
+    for (const ref of refs) {
+      const fn = await this.compile(ref);
+      const seen = /* @__PURE__ */ new Map();
+      graphOutputRecorder = seen;
+      try {
+        fn(subject);
+      } finally {
+        graphOutputRecorder = void 0;
+      }
+      for (const [key, values] of seen) {
+        const [value, ...others] = [...values];
+        if (value === void 0 || others.length > 0) continue;
+        preferences.set(key, value);
+      }
+    }
+    return preferences;
+  }
   /**
    * Validate `data` against every schema in `refs`. Returns all violations,
    * each tagged with the schema that produced it and a source line via
@@ -14026,7 +15015,7 @@ import { dirname as dirname9, resolve as resolve16 } from "node:path";
 
 // src/meta/core/derive/codeowners.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 import { dirname as dirname7, relative as relative11, resolve as resolve15, sep as sep6 } from "node:path";
 import picomatch4 from "picomatch";
 var CODEOWNERS_LOCATIONS = [
@@ -14190,7 +15179,7 @@ async function deriveFromCodeowners(inputs, opts) {
     const key = `${path}\0${label}`;
     let file = parsed2.get(key);
     if (!file) {
-      file = readFile7(path, "utf8").then(
+      file = readFile8(path, "utf8").then(
         (text2) => parseCodeowners(text2, path, label)
       );
       parsed2.set(key, file);
@@ -16078,7 +17067,7 @@ async function deriveForTable(inputs, ctx, hint, fields) {
 }
 
 // src/meta/commands/validate.ts
-import { readFile as readFile9 } from "node:fs/promises";
+import { readFile as readFile10 } from "node:fs/promises";
 
 // src/meta/core/page-marks.ts
 function pageMarks(opts) {
@@ -16114,17 +17103,20 @@ function lazyValidator(opts) {
   let built;
   return () => opts.validator instanceof Validator ? opts.validator : built ??= opts.validator();
 }
+function pageSchemaSet(opts, label, probe, memberOf2) {
+  return resolveSchemaSetWithSource({
+    filePath: label,
+    fileSchema: probe[FILE_SCHEMA_KEY],
+    ...opts.cliSchemas !== void 0 ? { cliSchemas: [...opts.cliSchemas] } : {},
+    config: opts.config,
+    memberOf: opts.memberOf?.(label) ?? memberOf2,
+    fileBase: opts.cwd,
+    trustRoot: opts.trustRoot
+  }).schemas;
+}
 function pageRefs(opts, label, probe, memberOf2) {
   try {
-    return resolveSchemaSetWithSource({
-      filePath: label,
-      fileSchema: probe[FILE_SCHEMA_KEY],
-      ...opts.cliSchemas !== void 0 ? { cliSchemas: [...opts.cliSchemas] } : {},
-      config: opts.config,
-      memberOf: opts.memberOf?.(label) ?? memberOf2,
-      fileBase: opts.cwd,
-      trustRoot: opts.trustRoot
-    }).schemas;
+    return pageSchemaSet(opts, label, probe, memberOf2);
   } catch (err) {
     if (err instanceof DocmetaError) return void 0;
     throw err;
@@ -16153,9 +17145,32 @@ async function configMarks(configPath, cwd) {
     trustRoot: schemaTrustRoot(cwd, loaded.dir)
   });
 }
+async function metaSection(configPath, cwd) {
+  const loaded = await loadConfig(configPath, cwd);
+  if (loaded === null) return null;
+  return rebaseConfigSchemaRefs(loaded.config, loaded.dir, cwd);
+}
+function familyMarks(opts) {
+  let built;
+  const defaults = () => pageMarks({
+    validator: marksValidator({ config: null, cwd: opts.cwd, configDir: opts.configDir }),
+    config: null,
+    cwd: opts.cwd,
+    trustRoot: schemaTrustRoot(opts.cwd, opts.configDir)
+  });
+  return () => built ??= (async () => {
+    if (opts.configPath === void 0) return defaults();
+    try {
+      return await configMarks(opts.configPath, opts.cwd) ?? defaults();
+    } catch (err) {
+      if (err instanceof DocmetaError) return defaults();
+      throw err;
+    }
+  })();
+}
 
 // src/meta/core/relocation.ts
-import { access, readFile as readFile8, stat as stat7, unlink } from "node:fs/promises";
+import { access, readFile as readFile9, stat as stat7, unlink } from "node:fs/promises";
 import { basename as basename5, extname as extname3, isAbsolute as isAbsolute8, join as join9, relative as relative13, resolve as resolve17, sep as sep8 } from "node:path";
 import picomatch6 from "picomatch";
 import {
@@ -16904,13 +17919,13 @@ async function planRelocation(ctx, request) {
     let unreadable2;
     if (beyond) {
       try {
-        content = await readFile8(absPath, "utf8");
+        content = await readFile9(absPath, "utf8");
         own2 = extractor.extract(content, label, { elements }).data;
       } catch (err) {
         unreadable2 = (errorMessage(err).split("\n")[0] ?? "").replace(/:\s*$/, "");
       }
     } else {
-      content = await readFile8(absPath, "utf8");
+      content = await readFile9(absPath, "utf8");
       try {
         own2 = extractor.extract(content, label, { elements }).data;
       } catch (err) {
@@ -17351,7 +18366,7 @@ function assertNoStrandedEntries(m, index, pages2, configDir, fileOf) {
 }
 async function readManifestText(path, file, perPage) {
   try {
-    return await readFile8(path, "utf8");
+    return await readFile9(path, "utf8");
   } catch (err) {
     if (perPage && isMissing(err)) return null;
     throw new DocmetaError(`Manifest ${file} could not be read: ${errorMessage(err)}`);
@@ -17381,7 +18396,7 @@ function keyLines2(text2, join12) {
 async function configTarget(ctx, configDir) {
   if (ctx.configPath !== void 0) {
     try {
-      const text2 = await readFile8(ctx.configPath, "utf8");
+      const text2 = await readFile9(ctx.configPath, "utf8");
       return { path: ctx.configPath, text: text2, disk: text2 };
     } catch (err) {
       if (err.code !== "ENOENT") {
@@ -17395,7 +18410,7 @@ async function configTarget(ctx, configDir) {
   for (const name2 of FAMILY_CONFIG_NAMES) {
     const path = join9(configDir, name2);
     try {
-      const text2 = await readFile8(path, "utf8");
+      const text2 = await readFile9(path, "utf8");
       return { path, text: text2, disk: text2 };
     } catch {
     }
@@ -17581,7 +18596,7 @@ async function applyRelocation(ctx, plan, io = {}) {
   for (const w of plan.writes) {
     let now;
     try {
-      now = await readFile8(w.path, "utf8");
+      now = await readFile9(w.path, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw new DocmetaError(`${label(w)} could not be read: ${errorMessage(err)}`);
@@ -17990,6 +19005,36 @@ function stampManifests(label, data, collections, configDir, base, marked, field
   return out;
 }
 
+// src/shared/cli-options.ts
+import { basename as basename6, relative as relative15 } from "node:path";
+function collect(value, prev) {
+  return prev.concat([value]);
+}
+function splitList(value) {
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+var STDIN_REQUIRES_AS = "Reading from stdin (`-`) requires --as <format> to choose an extractor.";
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function configOption(value) {
+  if (value === false) return { noConfig: true };
+  return typeof value === "string" ? { configPath: value } : {};
+}
+function explicitFalse(value) {
+  return value === false ? false : void 0;
+}
+function reportConfig(toStdout, cwd) {
+  return (info) => {
+    const where = (relative15(cwd, info.dir) || ".").replace(/\\/g, "/");
+    const line = `Using ${basename6(info.path)} (${where})
+`;
+    (toStdout ? process.stdout : process.stderr).write(line);
+  };
+}
+
 // src/meta/commands/validate.ts
 function parseErrorResult(file, format, message, keyword) {
   const err = {
@@ -18378,13 +19423,13 @@ async function runValidate(opts) {
     const content = opts.stdinContent ?? "";
     if (!forcedExtractor) {
       throw new DocmetaError(
-        "Reading from stdin (`-`) requires --as <format> to choose an extractor."
+        STDIN_REQUIRES_AS
       );
     }
     await processOne(STDIN_LABEL, content, forcedExtractor.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile9(resolve19(base, file), "utf8");
+    const content = await readFile10(resolve19(base, file), "utf8");
     await processOne(file, content, extname4(file));
   }
   if (unverified > 0) opts.onNotice?.(unverifiedWarning(unverified));
@@ -18530,7 +19575,7 @@ async function runValidate(opts) {
 }
 
 // src/meta/commands/get.ts
-import { readFile as readFile10 } from "node:fs/promises";
+import { readFile as readFile11 } from "node:fs/promises";
 import { resolve as resolve20, extname as extname5 } from "node:path";
 async function runGet(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -18670,13 +19715,13 @@ async function runGet(opts) {
   if (usingStdin) {
     if (!forced) {
       throw new DocmetaError(
-        "Reading from stdin (`-`) requires --as <format> to choose an extractor."
+        STDIN_REQUIRES_AS
       );
     }
     await readOne(STDIN_LABEL, opts.stdinContent ?? "", forced.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile10(resolve20(base, file), "utf8");
+    const content = await readFile11(resolve20(base, file), "utf8");
     await readOne(file, content, extname5(file));
   }
   if (deriving) {
@@ -18802,8 +19847,8 @@ function parseJsonPointer(pointer) {
 
 // src/meta/commands/schemas.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile11 } from "node:fs/promises";
-import { dirname as dirname10, extname as extname6, isAbsolute as isAbsolute10, join as join10, relative as relative15, resolve as resolve21, sep as sep10 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile12 } from "node:fs/promises";
+import { dirname as dirname10, extname as extname6, isAbsolute as isAbsolute10, join as join10, relative as relative16, resolve as resolve21, sep as sep10 } from "node:path";
 import { parseDocument as parseDocument8, parse as parseYaml6, stringify as stringify4 } from "yaml";
 function getSchemasInfo(registered2) {
   return {
@@ -18815,7 +19860,7 @@ function getSchemasInfo(registered2) {
 var DEFAULT_VENDOR_DIR = "./schema";
 var DEFAULT_CONFIG_NAME = "manni.config.yaml";
 function posixRelative(from, to) {
-  return relative15(from, to).split(sep10).join("/");
+  return relative16(from, to).split(sep10).join("/");
 }
 function vendorFileName(url) {
   let parsed2;
@@ -18922,7 +19967,7 @@ async function runVendorSchema(opts) {
   }
   let unchanged = false;
   if (existsSync4(absFile)) {
-    const current = await readFile11(absFile);
+    const current = await readFile12(absFile);
     unchanged = bytes.equals(current);
     if (!unchanged && !folded.replaced) {
       throw new DocmetaError(
@@ -18932,7 +19977,7 @@ async function runVendorSchema(opts) {
   }
   await mkdir3(absDir, { recursive: true });
   await writeFileAtomic(absFile, bytes);
-  const existing = loaded ? await readFile11(configPath, "utf8") : null;
+  const existing = loaded ? await readFile12(configPath, "utf8") : null;
   const section = loaded ? loaded.section : META_SECTION;
   const text2 = renderConfig(existing, folded.entries, section);
   reparseConfig(text2, posixRelative(cwd, configPath) || DEFAULT_CONFIG_NAME, section);
@@ -19074,7 +20119,7 @@ async function runInferSchema(opts) {
   }
   if (usingStdin && !forced) {
     throw new DocmetaError(
-      "Reading from stdin (`-`) requires --as <format> to choose an extractor."
+      STDIN_REQUIRES_AS
     );
   }
   let absOut;
@@ -19184,7 +20229,7 @@ async function runInferSchema(opts) {
     await scanOne(STDIN_LABEL, opts.stdinContent ?? "", forced.extensions[0] ?? "");
   }
   for (const file of files) {
-    const content = await readFile11(resolve21(base, file), "utf8");
+    const content = await readFile12(resolve21(base, file), "utf8");
     await scanOne(file, content, extname6(file));
   }
   for (const u of unreadable2) {
@@ -19245,7 +20290,7 @@ async function runInferSchema(opts) {
 // src/meta/commands/query.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { existsSync as existsSync5 } from "node:fs";
-import { mkdir as mkdir4, open as open2, readFile as readFile12, rename as rename3, rm as rm3 } from "node:fs/promises";
+import { mkdir as mkdir4, open as open2, readFile as readFile13, rename as rename3, rm as rm3 } from "node:fs/promises";
 import { dirname as dirname11, isAbsolute as isAbsolute11, resolve as resolve22, extname as extname7, sep as sep11 } from "node:path";
 
 // src/shared/prompt.ts
@@ -19591,7 +20636,7 @@ async function runQuery(opts) {
   if (usingStdin) {
     if (!forced) {
       throw new DocmetaError(
-        "Reading from stdin (`-`) requires --as <format> to choose an extractor."
+        STDIN_REQUIRES_AS
       );
     }
     const ext = forced.extensions[0];
@@ -19603,7 +20648,7 @@ async function runQuery(opts) {
     await readOne(STDIN_LABEL, opts.stdinContent ?? "", ext);
   }
   for (const file of files) {
-    const content = await readFile12(resolve22(base, file), "utf8");
+    const content = await readFile13(resolve22(base, file), "utf8");
     await readOne(file, content, extname7(file));
   }
   const db = opts.db === void 0 ? void 0 : { resolved: resolve22(cwd, opts.db), display: opts.db };
@@ -20263,7 +21308,7 @@ async function loadSetMembers(refs, ctx) {
     seenFiles.add(canon);
     let text2;
     try {
-      text2 = await readFile12(abs, "utf8");
+      text2 = await readFile13(abs, "utf8");
     } catch {
       throw new DocmetaError(
         `Schema file not found: "${ref}" (looked at ${abs}).`
@@ -20620,7 +21665,7 @@ async function planConfigEdit(ctx, edit, runRefs) {
   if (configPath === void 0 || configDir === void 0) {
     return { changes: [], repointed: false };
   }
-  const text2 = await readFile12(configPath, "utf8");
+  const text2 = await readFile13(configPath, "utf8");
   const doc = parseDocument10(stripBom2(text2));
   const display = displayPath(ctx, configPath);
   const rawRefOf = (item) => {
@@ -21087,7 +22132,7 @@ async function planManifestEdits(changes, entries, ctx, renameHints) {
       let text2;
       let expected;
       try {
-        text2 = await readFile12(home.absPath, "utf8");
+        text2 = await readFile13(home.absPath, "utf8");
         expected = text2;
       } catch (err) {
         if (!home.perPage || !isMissing(err)) {
@@ -21523,7 +22568,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan, manifestWrites =
     }
     const entry = byLabel.get(label);
     if (!entry) throw new DocmetaError(`No loaded entry for "${label}".`);
-    const content = await readFile12(path, "utf8");
+    const content = await readFile13(path, "utf8");
     const members = ctx.memberships(label);
     const current = (await mergeWithMarks(
       label,
@@ -21595,7 +22640,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan, manifestWrites =
     }
     let now;
     try {
-      now = await readFile12(w.path, "utf8");
+      now = await readFile13(w.path, "utf8");
     } catch {
       now = void 0;
     }
@@ -21608,7 +22653,7 @@ async function applyChanges(changes, entries, ctx, schemaPlan, manifestWrites =
   for (const m of manifestWrites) {
     let now;
     try {
-      now = await readFile12(m.path, "utf8");
+      now = await readFile13(m.path, "utf8");
     } catch {
       now = null;
     }
@@ -21741,7 +22786,7 @@ function skipExpression(sql, from) {
 }
 
 // src/meta/commands/fill.ts
-import { readFile as readFile15 } from "node:fs/promises";
+import { readFile as readFile16 } from "node:fs/promises";
 import { resolve as resolve24, extname as extname9, join as join11 } from "node:path";
 import {
   completeValidatedJSON,
@@ -22161,7 +23206,7 @@ function single(alternatives2) {
 }
 
 // src/meta/commands/fill-hints.ts
-import { readFile as readFile13 } from "node:fs/promises";
+import { readFile as readFile14 } from "node:fs/promises";
 import { extname as extname8, resolve as resolve23 } from "node:path";
 
 // src/shared/reference-fields.ts
@@ -22275,7 +23320,7 @@ async function readIds(collection, opts) {
     const path = resolve23(opts.configDir, file);
     let id;
     try {
-      id = extractor.extract(await readFile13(path, "utf8"), file).data.id;
+      id = extractor.extract(await readFile14(path, "utf8"), file).data.id;
     } catch {
       continue;
     }
@@ -22294,7 +23339,7 @@ function termLabelSource() {
 }
 
 // src/meta/core/manifest-writes.ts
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 var manifestCodec = {
   apply(text2, op) {
     const where = { entry: op.entry, key: op.key, join: op.join, file: op.file };
@@ -22310,7 +23355,7 @@ function applyManifestOp(text2, op) {
 async function holdManifestFile(path, file, perPage = false) {
   let before;
   try {
-    before = await readFile14(path, "utf8");
+    before = await readFile15(path, "utf8");
   } catch (err) {
     if (perPage && isMissing(err)) return heldManifest(path, file, "", true);
     throw new DocmetaError(`Manifest ${file} could not be read: ${errorMessage(err)}`);
@@ -22327,7 +23372,7 @@ async function settleManifest(held, io = {}) {
     codec: manifestCodec,
     // A per-page manifest (proposal 0058) may be the first file in its directory.
     write: io.write ?? ((at2, text2) => writeFileAtomic(at2, text2, { createParents: true })),
-    read: io.read ?? ((at2) => readFile14(at2, "utf8")),
+    read: io.read ?? ((at2) => readFile15(at2, "utf8")),
     toError: (message) => new DocmetaError(message)
   });
   rebaseline(held);
@@ -22585,7 +23630,7 @@ async function runFill(opts) {
   }
   if (usingStdin && !forcedExtractor) {
     throw new DocmetaError(
-      "Reading from stdin (`-`) requires --as <format> to choose an extractor."
+      STDIN_REQUIRES_AS
     );
   }
   const threshold = requireNumber(
@@ -23441,7 +24486,7 @@ async function runFill(opts) {
   const prepareAll = async () => ({
     stdin: usingStdin ? await prepareOne("<stdin>", opts.stdinContent ?? "", forcedExtractor?.extensions[0] ?? "") : void 0,
     files: await mapConcurrent(files, concurrency, async (file) => {
-      const content = await readFile15(resolve24(base, file), "utf8");
+      const content = await readFile16(resolve24(base, file), "utf8");
       return prepareOne(file, content, extname9(file));
     })
   });
@@ -23859,8 +24904,8 @@ async function mapConcurrent(items2, limit, fn) {
 }
 
 // src/meta/commands/derive.ts
-import { readFile as readFile16 } from "node:fs/promises";
-import { extname as extname10, relative as relative16, resolve as resolve25, sep as sep12 } from "node:path";
+import { readFile as readFile17 } from "node:fs/promises";
+import { extname as extname10, relative as relative17, resolve as resolve25, sep as sep12 } from "node:path";
 var GENERATED_BY_ENV = "MANNI_GENERATED_BY";
 var SOURCE_HINT = "narrow --sources or --fields";
 async function runDerive(opts) {
@@ -23978,7 +25023,7 @@ async function runDerive(opts) {
   const files = fromCollections ? retainMembers(walked, membersFor) : walked;
   const rangesByPage = /* @__PURE__ */ new Map();
   for (const t of targets) {
-    const label = relative16(base, resolve25(base, t.page)).split(sep12).join("/");
+    const label = relative17(base, resolve25(base, t.page)).split(sep12).join("/");
     if (!files.includes(label)) {
       throw new DocmetaError(
         `${t.target} does not name one file that derive reads; a range names lines of one file.`
@@ -24012,7 +25057,7 @@ async function runDerive(opts) {
         });
         continue;
       }
-      const content = await readFile16(absPath, "utf8");
+      const content = await readFile17(absPath, "utf8");
       const elements = resolveElements(label, config, membersFor(label));
       try {
         loaded2.set(label, {
@@ -25207,10 +26252,10 @@ function cellFrom(value) {
 }
 
 export {
-  __export,
   package_default,
   palette,
   shouldColor,
+  colorFor,
   matchesFileGlob,
   hasPagePlaceholder,
   pageManifestPath,
@@ -25225,8 +26270,6 @@ export {
   generateEncryptionKey,
   encryptValue,
   decryptValue,
-  ToolError,
-  errorMessage,
   assertKnownProvider,
   assertModelHasProvider,
   PROVIDERS_KEY,
@@ -25255,6 +26298,13 @@ export {
   runIfMain,
   escapeWorkflowCommandMessage,
   escapeWorkflowCommandProperty,
+  collect,
+  splitList,
+  STDIN_REQUIRES_AS,
+  readStdin,
+  configOption,
+  explicitFalse,
+  reportConfig,
   INTEGRITY_SHAPE,
   integrityOf,
   isIntegrity,
@@ -25309,7 +26359,9 @@ export {
   schemaCacheDir,
   SchemaCache,
   __default31 as __default,
-  __default34 as __default2,
+  __default33 as __default2,
+  __default34 as __default3,
+  __default48 as __default4,
   listBuiltins,
   classifyRef,
   fetchSchemaBytes,
@@ -25333,10 +26385,13 @@ export {
   staleFindings,
   LEGACY_CONFIG_NAMES,
   parseConfig,
+  urlManifestMessage,
   schemaTrustRoot,
   loadConfig,
+  loadMetaSection,
   resolveRunConfig,
   renderSarif,
+  xmlEscape,
   renderJunit,
   REPORT_FORMATS,
   formatList,
@@ -25356,10 +26411,12 @@ export {
   rebaseable,
   settle,
   isMissing,
+  readManifestOrEmpty,
   EXTERNAL_METADATA_FETCH_TIMEOUT_MS,
   EXTERNAL_METADATA_FETCH_MAX_BYTES,
   fetchExternalMetadata,
   META_CONTEXT,
+  lazyKey,
   withValueAt,
   EXTERNAL_OWNED_SCHEMA,
   EXTERNAL_DUPLICATE_SCHEMA,
@@ -25381,10 +26438,14 @@ export {
   LOCATION_KEYWORD,
   LOCATION_EXTERNAL_SCHEMA,
   LOCATION_PAGE_SCHEMA,
+  GRAPH_OUTPUT_KEYWORD,
   Validator,
   pageMarks,
+  pageSchemaSet,
   marksValidator,
   configMarks,
+  metaSection,
+  familyMarks,
   relocateFailed,
   relocationContext,
   keyHome,
@@ -25454,4 +26515,4 @@ export {
   renderQuery,
   renderQueryCsv
 };
-//# sourceMappingURL=chunk-I57KBF45.js.map
+//# sourceMappingURL=chunk-DP2ZA3WH.js.map