@hawkeyexl/manni 4.10.0 → 4.11.0

package/dist/{chunk-KBG463UK.js → chunk-GV56WGL2.js}

@@ -1,30 +1,19 @@
 #!/usr/bin/env node
 import {
-  CHECK_NAME,
-  DEFAULT_BASELINE_PATH,
   DERIVED_KEYWORD,
   DERIVED_STALE_SCHEMA,
-  DERIVE_SOURCES,
   DocmetaError,
   FILE_SCHEMA_KEY,
-  LEGACY_BASELINE_PATH,
   ManifestCache,
-  PROVENANCE_FIELD,
-  STAMPED_DATE_FIELDS,
   STDIN_LABEL,
   STDIN_TOKEN,
-  assertNonEmpty,
   blockLines,
-  canonicalSchemaRef,
   classifyRef,
   colOf,
   collectSchemaPins,
   colonEnd,
-  compareDerived,
   contentEnd,
   deepEqual,
-  derivableFields,
-  deriveCovers,
   detectEol,
   detectStyle,
   emptySource,
@@ -35,34 +24,25 @@ import {
   gitignoreOptions,
   insertKey,
   integrityOf,
-  isBuiltinField,
-  isErrorSeverity,
   keyLines,
   keyString,
   lineEnd,
   loadConfig,
   loadSchema,
   locateFrontmatter,
-  managedFields,
   positionForFactory,
   publishedBuiltins,
   rangeOf,
   rebaseConfigSchemaRefs,
   replaceBlockValue,
   replaceFlowValue,
-  resolveBaselineRequest,
   resolveElements,
-  resolveRunConfig,
   resolveSchemaSetWithSource,
   resolveTargetSet,
   schemaLoadOptions,
   schemaTrustRoot,
-  settleBaseline,
-  staleFindings,
-  supportedExtensions,
-  toJsonText,
   writeFileAtomic
-} from "./chunk-G7XD4QH5.js";
+} from "./chunk-VSEBFHAY.js";
 import {
   STDIN_LINES_MARKER
 } from "./chunk-YEUYKR62.js";
@@ -87,104 +67,40 @@ import {
   pageManifestPath,
   parseCollections,
   sameFile
-} from "./chunk-6M5VJOC2.js";
+} from "./chunk-QLWC7MKD.js";
 import {
   ToolError,
   errorMessage
 } from "./chunk-G3T47CFV.js";
 
-// src/meta/commands/validate.ts
-import { readFile as readFile6 } from "node:fs/promises";
-
-// src/meta/core/external-metadata.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { isAbsolute, relative as relative2, resolve as resolve2, sep } from "node:path";
-import {
-  LineCounter,
-  isMap as isMap2,
-  isNode,
-  isScalar,
-  isSeq,
-  parseDocument as parseDocument2
-} from "yaml";
-
-// src/shared/manifest-cas.ts
-import { readFile } from "node:fs/promises";
-import { posix } from "node:path";
-var COMMIT_ATTEMPTS = 5;
-function conflictRefusal(file) {
-  return `${file} changed under the command while it was being written. Nothing was written to it. Re-run the command.`;
-}
-function heldManifest(path, file, before, absent = false) {
-  return { path, file, before, text: before, ops: [], bases: /* @__PURE__ */ new Map(), absent };
-}
-function encodeValue(value) {
-  return value === void 0 ? "absent" : JSON.stringify(value);
-}
-function baseKey(at2) {
-  const entry = at2.join === "path" ? posix.normalize(at2.entry) : at2.entry;
-  return `${entry}\0${at2.key}`;
-}
-function rebaseable(held, op, codec) {
-  const at2 = baseKey(op);
-  if (held.bases.has(at2)) return;
-  held.bases.set(at2, {
-    entry: op.entry,
-    key: op.key,
-    join: op.join,
-    value: encodeValue(codec.read(held.before, op))
-  });
+// src/shared/cli-options.ts
+import { basename, relative } from "node:path";
+function collect(value, prev) {
+  return prev.concat([value]);
 }
-function rebase(held, current, codec) {
-  for (const base of held.bases.values()) {
-    if (encodeValue(codec.read(current, base)) !== base.value) return void 0;
-  }
-  let text2 = current;
-  for (const op of held.ops) text2 = codec.apply(text2, op);
-  return text2;
+function splitList(value) {
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
 }
-function rebaseline(held) {
-  held.before = held.text;
-  held.ops = [];
-  held.bases.clear();
-  held.absent = false;
+var STDIN_REQUIRES_AS = "Reading from stdin (`-`) requires --as <format> to choose an extractor.";
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
 }
-async function settle(held, io) {
-  for (let attempt = 1; attempt <= COMMIT_ATTEMPTS; attempt++) {
-    let current;
-    try {
-      current = await io.read(held.path);
-    } catch (error) {
-      if (held.absent && isMissing(error)) {
-        await io.write(held.path, held.text);
-        held.absent = false;
-        return;
-      }
-      const reason = error instanceof Error ? error.message : String(error);
-      throw io.toError(`Manifest ${held.file} could not be read: ${reason}`);
-    }
-    if (!held.absent && current === held.before) {
-      await io.write(held.path, held.text);
-      return;
-    }
-    const replayed = rebase(held, current, io.codec);
-    if (replayed === void 0) throw io.toError(conflictRefusal(held.file));
-    held.before = current;
-    held.text = replayed;
-    held.absent = false;
-  }
-  throw io.toError(conflictRefusal(held.file));
+function configOption(value) {
+  if (value === false) return { noConfig: true };
+  return typeof value === "string" ? { configPath: value } : {};
 }
-function isMissing(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+function explicitFalse(value) {
+  return value === false ? false : void 0;
 }
-async function readManifestOrEmpty(absPath, perPage) {
-  try {
-    return await readFile(absPath, "utf8");
-  } catch (e) {
-    if (perPage && isMissing(e)) return "";
-    throw e;
-  }
+function reportConfig(toStdout, cwd) {
+  return (info) => {
+    const where = (relative(cwd, info.dir) || ".").replace(/\\/g, "/");
+    const line = `Using ${basename(info.path)} (${where})
+`;
+    (toStdout ? process.stdout : process.stderr).write(line);
+  };
 }
 
 // src/meta/core/external-metadata-fetch.ts
@@ -280,29 +196,29 @@ async function readCapped(url, res, maxBytes) {
 
 // src/shared/encryption-key.ts
 import { spawnSync } from "node:child_process";
-import { readFile as readFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname2, join as join2, relative, resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+import { basename as basename3, dirname as dirname2, join as join2, relative as relative2, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { isMap, parseDocument, parse as parseYaml, stringify } from "yaml";
 
 // src/shared/write-file.ts
 import { chmod, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { basename as basename2, dirname, join } from "node:path";
 var LOCKED = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
 var RENAME_ATTEMPTS = 3;
 function errorCode(err) {
   return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
 }
-var wait = (ms) => new Promise((resolve8) => {
-  setTimeout(resolve8, ms);
+var wait = (ms) => new Promise((resolve4) => {
+  setTimeout(resolve4, ms);
 });
-async function writeTextAtomic(path, text2) {
+async function writeTextAtomic(path, text) {
   const tmp = join(
     dirname(path),
-    `.${basename(path)}.manni-${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`
+    `.${basename2(path)}.manni-${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`
   );
   try {
-    await writeFile(tmp, text2, "utf8");
+    await writeFile(tmp, text, "utf8");
     try {
       const { mode } = await stat(path);
       await chmod(tmp, mode);
@@ -343,14 +259,14 @@ function resolveEncryptionKey(opts) {
   return { key: void 0, source: "none" };
 }
 function relativeSource(cwd, path) {
-  return relative(resolve(cwd), path).replace(/\\/g, "/");
+  return relative2(resolve(cwd), path).replace(/\\/g, "/");
 }
 function errorCode2(err) {
   return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
 }
 async function readIfPresent(path) {
   try {
-    return await readFile2(path, "utf8");
+    return await readFile(path, "utf8");
   } catch (err) {
     if (errorCode2(err) === "ENOENT") return null;
     throw err;
@@ -362,21 +278,21 @@ async function fileTarget(file, toError) {
       `${file.source} is a single-tool config file, which cannot hold the family ${ENCRYPTION_KEY_FIELD}. Move its keys under the tool's section in ${FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"}, or set ${ENCRYPTION_KEY_ENV}.`
     );
   }
-  const text2 = await readIfPresent(file.path);
-  return { path: file.path, source: file.source, text: text2 ?? file.text };
+  const text = await readIfPresent(file.path);
+  return { path: file.path, source: file.source, text: text ?? file.text };
 }
 async function defaultTarget(cwd) {
   const root = findGitRoot(cwd) ?? resolve(cwd);
   for (const name of FAMILY_CONFIG_NAMES) {
     const path2 = join2(root, name);
-    const text2 = await readIfPresent(path2);
-    if (text2 !== null) return { path: path2, source: relativeSource(cwd, path2), text: text2 };
+    const text = await readIfPresent(path2);
+    if (text !== null) return { path: path2, source: relativeSource(cwd, path2), text };
   }
   const path = join2(root, FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml");
   return { path, source: relativeSource(cwd, path), text: null };
 }
-function withKey(text2, key, previous, source, toError) {
-  const doc = parseDocument(text2);
+function withKey(text, key, previous, source, toError) {
+  const doc = parseDocument(text);
   const [first] = doc.errors;
   if (first !== void 0) {
     throw toError(`${source}: invalid YAML: ${first.message}`);
@@ -421,16 +337,16 @@ async function writeEncryptionKey(opts) {
     );
   }
   const target = file === null ? await defaultTarget(opts.cwd) : await fileTarget(file, toError);
-  const text2 = target.text === null ? stringify({
+  const text = target.text === null ? stringify({
     [ENCRYPTION_KEY_FIELD]: key,
     ...typeof previous === "string" ? { [ENCRYPTION_KEY_PREVIOUS_FIELD]: previous } : {}
   }) : withKey(target.text, key, previous, target.source, toError);
-  verify(target.text, text2, key, previous, target.source, toError);
-  if (opts.dryRun !== true) await writeTextAtomic(target.path, text2);
+  verify(target.text, text, key, previous, target.source, toError);
+  if (opts.dryRun !== true) await writeTextAtomic(target.path, text);
   return { path: target.path, source: target.source, created: target.text === null };
 }
 function isIgnoredByGit(path) {
-  const result = spawnSync("git", ["check-ignore", "-q", "--", basename2(path)], {
+  const result = spawnSync("git", ["check-ignore", "-q", "--", basename3(path)], {
     cwd: dirname2(path),
     stdio: "ignore",
     windowsHide: true
@@ -491,8 +407,8 @@ function valueAt(data, pointer) {
   let node = data;
   for (const seg of segments(pointer)) {
     if (Array.isArray(node)) {
-      const items2 = node;
-      node = /^\d+$/.test(seg) ? items2[Number(seg)] : void 0;
+      const items = node;
+      node = /^\d+$/.test(seg) ? items[Number(seg)] : void 0;
     } else if (isRecord(node)) {
       node = Object.hasOwn(node, seg) ? node[seg] : void 0;
     } else {
@@ -507,10 +423,10 @@ function withValueAt(root, pointer, value) {
     const seg = parts[i];
     if (seg === void 0) return value;
     if (Array.isArray(node)) {
-      const items2 = [...node];
-      if (!/^\d+$/.test(seg) || Number(seg) >= items2.length) return node;
-      items2[Number(seg)] = set(items2[Number(seg)], i + 1);
-      return items2;
+      const items = [...node];
+      if (!/^\d+$/.test(seg) || Number(seg) >= items.length) return node;
+      items[Number(seg)] = set(items[Number(seg)], i + 1);
+      return items;
     }
     if (isRecord(node) && Object.hasOwn(node, seg)) {
       return { ...node, [seg]: set(node[seg], i + 1) };
@@ -647,6 +563,97 @@ function redactedDerived(f) {
   };
 }
 
+// src/meta/core/external-metadata.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { isAbsolute, relative as relative3, resolve as resolve2, sep } from "node:path";
+import {
+  LineCounter,
+  isMap as isMap2,
+  isNode,
+  isScalar,
+  isSeq,
+  parseDocument as parseDocument2
+} from "yaml";
+
+// src/shared/manifest-cas.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { posix } from "node:path";
+var COMMIT_ATTEMPTS = 5;
+function conflictRefusal(file) {
+  return `${file} changed under the command while it was being written. Nothing was written to it. Re-run the command.`;
+}
+function heldManifest(path, file, before, absent = false) {
+  return { path, file, before, text: before, ops: [], bases: /* @__PURE__ */ new Map(), absent };
+}
+function encodeValue(value) {
+  return value === void 0 ? "absent" : JSON.stringify(value);
+}
+function baseKey(at2) {
+  const entry = at2.join === "path" ? posix.normalize(at2.entry) : at2.entry;
+  return `${entry}\0${at2.key}`;
+}
+function rebaseable(held, op, codec) {
+  const at2 = baseKey(op);
+  if (held.bases.has(at2)) return;
+  held.bases.set(at2, {
+    entry: op.entry,
+    key: op.key,
+    join: op.join,
+    value: encodeValue(codec.read(held.before, op))
+  });
+}
+function rebase(held, current, codec) {
+  for (const base of held.bases.values()) {
+    if (encodeValue(codec.read(current, base)) !== base.value) return void 0;
+  }
+  let text = current;
+  for (const op of held.ops) text = codec.apply(text, op);
+  return text;
+}
+function rebaseline(held) {
+  held.before = held.text;
+  held.ops = [];
+  held.bases.clear();
+  held.absent = false;
+}
+async function settle(held, io) {
+  for (let attempt = 1; attempt <= COMMIT_ATTEMPTS; attempt++) {
+    let current;
+    try {
+      current = await io.read(held.path);
+    } catch (error) {
+      if (held.absent && isMissing(error)) {
+        await io.write(held.path, held.text);
+        held.absent = false;
+        return;
+      }
+      const reason = error instanceof Error ? error.message : String(error);
+      throw io.toError(`Manifest ${held.file} could not be read: ${reason}`);
+    }
+    if (!held.absent && current === held.before) {
+      await io.write(held.path, held.text);
+      return;
+    }
+    const replayed = rebase(held, current, io.codec);
+    if (replayed === void 0) throw io.toError(conflictRefusal(held.file));
+    held.before = current;
+    held.text = replayed;
+    held.absent = false;
+  }
+  throw io.toError(conflictRefusal(held.file));
+}
+function isMissing(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function readManifestOrEmpty(absPath, perPage) {
+  try {
+    return await readFile2(absPath, "utf8");
+  } catch (e) {
+    if (perPage && isMissing(e)) return "";
+    throw e;
+  }
+}
+
 // src/meta/core/external-metadata.ts
 var EXTERNAL_OWNED_SCHEMA = "external:owned";
 var EXTERNAL_DUPLICATE_SCHEMA = "external:duplicate";
@@ -658,7 +665,7 @@ var perPageRules = /* @__PURE__ */ new WeakMap();
 var strayEntries = /* @__PURE__ */ new WeakSet();
 var posix2 = (p) => p.split(sep).join("/");
 function reportedPath(abs, base) {
-  const rel = relative2(base, abs);
+  const rel = relative3(base, abs);
   return rel === "" ? "." : posix2(rel);
 }
 function reported(of, file) {
@@ -689,18 +696,18 @@ async function loadExternalMetadata(collections, opts) {
       rules.push({ collection: declared, manifest, configDir: opts.configDir });
       continue;
     }
-    const join5 = externalMetadataJoin(manifest);
+    const join4 = externalMetadataJoin(manifest);
     let parsed;
     let file;
     if (classifyRef(manifest.file).kind === "url") {
       file = manifest.file;
-      const text2 = await fetchExternalMetadata(manifest.file, {
+      const text = await fetchExternalMetadata(manifest.file, {
         ...manifest.tokenEnv !== void 0 ? { tokenEnv: manifest.tokenEnv } : {},
         ...opts.offline !== void 0 ? { offline: opts.offline } : {},
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
         ...opts.env !== void 0 ? { env: opts.env } : {}
       });
-      parsed = parseManifest(manifest, collection, text2, file, opts.configDir, join5, ownership(declared, manifest));
+      parsed = parseManifest(manifest, collection, text, file, opts.configDir, join4, ownership(declared, manifest));
     } else {
       const abs = isAbsolute(manifest.file) ? manifest.file : resolve2(opts.configDir, manifest.file);
       const label = reportedPath(abs, opts.base);
@@ -716,7 +723,7 @@ async function loadExternalMetadata(collections, opts) {
         // this run's spelling onto every value and entry instead.
         JSON.stringify([
           collection,
-          join5,
+          join4,
           opts.configDir,
           variantOf(declared, manifest)
         ]),
@@ -726,7 +733,7 @@ async function loadExternalMetadata(collections, opts) {
           await readManifest(abs, label),
           label,
           opts.configDir,
-          join5,
+          join4,
           ownership(declared, manifest)
         )
       );
@@ -740,14 +747,14 @@ async function loadExternalMetadata(collections, opts) {
       else owners.set(key, [{ collection, file }]);
     }
     let target;
-    if (join5 === PATH_JOIN) {
+    if (join4 === PATH_JOIN) {
       target = byPath;
     } else {
-      const existing = byField.get(join5);
+      const existing = byField.get(join4);
       if (existing) target = existing;
       else {
         target = /* @__PURE__ */ new Map();
-        byField.set(join5, target);
+        byField.set(join4, target);
       }
     }
     for (const [indexKey, values] of parsed.values) {
@@ -782,14 +789,14 @@ function variantOf(declared, manifest) {
 }
 async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
   const collection = declared.name;
-  const join5 = externalMetadataJoin(manifest);
+  const join4 = externalMetadataJoin(manifest);
   const implied = manifest.keys === void 0 ? { collection: declared, manifest, file: manifest.file, files: /* @__PURE__ */ new Set() } : void 0;
   for (const key of manifest.keys ?? []) {
     const list2 = into.owners.get(key);
     if (list2) list2.push({ collection, file: manifest.file });
     else into.owners.set(key, [{ collection, file: manifest.file }]);
   }
-  const target = indexFor(join5, into);
+  const target = indexFor(join4, into);
   for (const pageAbs of opts.pages ?? []) {
     const resolved = pageManifestPath(manifest.file, opts.configDir, pageAbs);
     if ("outside" in resolved) {
@@ -798,7 +805,7 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
       }
       continue;
     }
-    const rel = posix2(relative2(opts.configDir, pageAbs));
+    const rel = posix2(relative3(opts.configDir, pageAbs));
     if (!isMember(declared, rel)) continue;
     const earlier = resolvedBy.get(resolved.abs);
     if (earlier !== void 0 && earlier !== pageAbs) {
@@ -811,14 +818,14 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
     const label = reportedPath(resolved.abs, opts.base);
     const parsed = await parsedManifests.parse(
       resolved.abs,
-      JSON.stringify([collection, join5, opts.configDir, variantOf(declared, manifest)]),
+      JSON.stringify([collection, join4, opts.configDir, variantOf(declared, manifest)]),
       async () => parseManifest(
         manifest,
         collection,
         await readPageManifest(resolved.abs, label),
         label,
         opts.configDir,
-        join5,
+        join4,
         ownership(declared, manifest)
       )
     );
@@ -832,7 +839,7 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
       );
     }
     for (const [indexKey, values] of parsed.values) {
-      const key = join5 === PATH_JOIN ? pageAbs : indexKey;
+      const key = join4 === PATH_JOIN ? pageAbs : indexKey;
       const merged = target.get(key) ?? /* @__PURE__ */ new Map();
       for (const [owned, value] of values) merged.set(owned, reported(value, label));
       target.set(key, merged);
@@ -846,12 +853,12 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
   }
   return implied;
 }
-function indexFor(join5, into) {
-  if (join5 === PATH_JOIN) return into.byPath;
-  const existing = into.byField.get(join5);
+function indexFor(join4, into) {
+  if (join4 === PATH_JOIN) return into.byPath;
+  const existing = into.byField.get(join4);
   if (existing) return existing;
   const created = /* @__PURE__ */ new Map();
-  into.byField.set(join5, created);
+  into.byField.set(join4, created);
   return created;
 }
 function outsideRefusal(manifest, collection, pageRel) {
@@ -881,11 +888,11 @@ function unreadable(file, err) {
   const reason = err instanceof Error ? err.message : String(err);
   return new DocmetaError(`Manifest ${file} could not be read: ${reason}`);
 }
-function parseManifest(manifest, collection, text2, file, configDir, join5, owns) {
+function parseManifest(manifest, collection, text, file, configDir, join4, owns) {
   const target = /* @__PURE__ */ new Map();
   const entries = [];
   const lc = new LineCounter();
-  const doc = parseDocument2(text2, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument2(text, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(
@@ -897,7 +904,7 @@ function parseManifest(manifest, collection, text2, file, configDir, join5, owns
     return { values: target, entries };
   if (!isMap2(root)) {
     throw new DocmetaError(
-      `Manifest ${file}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
+      `Manifest ${file}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
     );
   }
   const lineAt = (node) => {
@@ -921,7 +928,7 @@ function parseManifest(manifest, collection, text2, file, configDir, join5, owns
         `Manifest ${where}: "${spelled}" must be a mapping of owned keys to values.`
       );
     }
-    const indexKey = join5 === PATH_JOIN ? resolve2(configDir, spelled) : spelled;
+    const indexKey = join4 === PATH_JOIN ? resolve2(configDir, spelled) : spelled;
     const values = target.get(indexKey) ?? /* @__PURE__ */ new Map();
     for (const kv of pair.value.items) {
       const key = isScalar(kv.key) ? String(kv.key.value) : String(kv.key);
@@ -947,8 +954,8 @@ function parseManifest(manifest, collection, text2, file, configDir, join5, owns
     target.set(indexKey, values);
     entries.push({
       collection,
-      join: join5,
-      ...join5 === PATH_JOIN ? { abs: indexKey } : {},
+      join: join4,
+      ...join4 === PATH_JOIN ? { abs: indexKey } : {},
       spelled,
       file,
       ...entryLine === void 0 ? {} : { line: entryLine }
@@ -1209,6 +1216,9 @@ function isFieldLocation(value) {
   return value === "page" || value === "external";
 }
 
+// src/meta/core/graph-output.ts
+var GRAPH_OUTPUT_KEYWORD = "x-manni-graph-output";
+
 // src/meta/core/validator.ts
 import * as AjvDraft07Ns from "ajv";
 import * as Ajv2019Ns from "ajv/dist/2019.js";
@@ -1216,11 +1226,6 @@ import * as Ajv2020Ns from "ajv/dist/2020.js";
 import * as AjvDraft04Ns from "ajv-draft-04";
 import * as addFormatsNs from "ajv-formats";
 import { createRequire } from "node:module";
-
-// src/meta/core/graph-output.ts
-var GRAPH_OUTPUT_KEYWORD = "x-manni-graph-output";
-
-// src/meta/core/validator.ts
 var draft06MetaSchema = createRequire(import.meta.url)(
   "ajv/dist/refs/json-schema-draft-06.json"
 );
@@ -1835,23 +1840,6 @@ function familyMarks(opts) {
   })();
 }
 
-// src/meta/core/relocation.ts
-import { access, readFile as readFile4, stat as stat2, unlink } from "node:fs/promises";
-import { basename as basename3, extname, isAbsolute as isAbsolute3, join as join3, relative as relative4, resolve as resolve3, sep as sep3 } from "node:path";
-import picomatch from "picomatch";
-import {
-  LineCounter as LineCounter3,
-  isMap as isMap4,
-  isNode as isNode3,
-  isScalar as isScalar3,
-  isSeq as isSeq2,
-  parse as parseYaml2,
-  parseDocument as parseDocument4
-} from "yaml";
-
-// src/meta/core/collections.ts
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolvePath, sep as sep2 } from "node:path";
-
 // src/meta/core/projection.ts
 var SYSTEM_COLUMNS = ["_path", "_format", "_present", "_data"];
 var RESERVED = new Set(SYSTEM_COLUMNS);
@@ -1982,7 +1970,7 @@ function isParamName(name) {
   return PARAM_NAME_HEAD.exec(name)?.[0] === name;
 }
 function collectNamedParameters(sql) {
-  const tokens2 = [];
+  const tokens = [];
   const seen = /* @__PURE__ */ new Set();
   const prefixOf = /* @__PURE__ */ new Map();
   let i = 0;
@@ -2012,14 +2000,14 @@ function collectNamedParameters(sql) {
       prefixOf.set(m[0], ch);
       if (!seen.has(token)) {
         seen.add(token);
-        tokens2.push(token);
+        tokens.push(token);
       }
       i += 1 + m[0].length;
     } else {
       i++;
     }
   }
-  return tokens2;
+  return tokens;
 }
 function stripLeadingTrivia(sql) {
   let i = 0;
@@ -2032,16 +2020,16 @@ function stripLeadingTrivia(sql) {
     return sql.slice(i);
   }
 }
-function isTrivia(text2) {
+function isTrivia(text) {
   let i = 0;
-  while (i < text2.length) {
-    const ch = text2[i];
+  while (i < text.length) {
+    const ch = text[i];
     if (ch === void 0 || /\s/.test(ch) || ch === ";") {
       i++;
       continue;
     }
-    if (startsComment(text2, i)) {
-      i = skipComment(text2, i);
+    if (startsComment(text, i)) {
+      i = skipComment(text, i);
       continue;
     }
     return false;
@@ -2053,8 +2041,8 @@ function loadSqlite() {
   sqliteModule ??= (async () => {
     const original = process.emitWarning.bind(process);
     const filtered = (warning, ...rest) => {
-      const text2 = typeof warning === "string" ? warning : warning.message;
-      if (text2.includes("SQLite is an experimental feature")) return;
+      const text = typeof warning === "string" ? warning : warning.message;
+      if (text.includes("SQLite is an experimental feature")) return;
       Reflect.apply(original, process, [warning, ...rest]);
     };
     process.emitWarning = filtered;
@@ -2068,10 +2056,11 @@ function loadSqlite() {
 }
 
 // src/meta/core/collections.ts
+import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolvePath, sep as sep2 } from "node:path";
 function memberOf(collections, configDir, base, label) {
   if (collections.length === 0) return [];
   if (label === STDIN_LABEL) return [];
-  const rel = relative3(configDir, resolvePath(base, label)).split(sep2).join("/");
+  const rel = relative4(configDir, resolvePath(base, label)).split(sep2).join("/");
   if (isAbsolute2(rel)) return [];
   return collections.filter((c) => isMember(c, rel)).map((c) => c.name);
 }
@@ -2108,6 +2097,20 @@ function createCollectionViews(db, collections) {
   }
 }
 
+// src/meta/core/relocation.ts
+import { access, readFile as readFile4, stat as stat2, unlink } from "node:fs/promises";
+import { basename as basename4, extname, isAbsolute as isAbsolute3, join as join3, relative as relative5, resolve as resolve3, sep as sep3 } from "node:path";
+import picomatch from "picomatch";
+import {
+  LineCounter as LineCounter3,
+  isMap as isMap4,
+  isNode as isNode3,
+  isScalar as isScalar3,
+  isSeq as isSeq2,
+  parse as parseYaml2,
+  parseDocument as parseDocument4
+} from "yaml";
+
 // src/meta/core/external-metadata-write.ts
 import { posix as posix3 } from "node:path";
 import {
@@ -2118,9 +2121,9 @@ import {
   parseDocument as parseDocument3,
   stringify as stringify2
 } from "yaml";
-function spliceManifestValue(text2, options) {
+function spliceManifestValue(text, options) {
   const { entry, key, value, file } = options;
-  const join5 = options.join ?? PATH_JOIN;
+  const join4 = options.join ?? PATH_JOIN;
   const at2 = (line2) => {
     const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
     if (line2 === void 0) return name;
@@ -2134,9 +2137,9 @@ function spliceManifestValue(text2, options) {
   if (value === void 0) {
     throw new DocmetaError(`${at2()}: refusing to write "${key}" for "${entry}" with no value.`);
   }
-  const eol = detectEol(text2);
+  const eol = detectEol(text);
   const lc = new LineCounter2();
-  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
@@ -2145,18 +2148,18 @@ function spliceManifestValue(text2, options) {
     const r = rangeOf(node);
     return r ? lc.linePos(r[0]).line : void 0;
   };
-  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const root = doc.contents;
   let spelled = entry;
   let edit;
-  if (root === null || isScalar2(root) && root.value === null && emptySource(text2, root)) {
-    edit = startManifest(text2, entry, key, value, eol);
+  if (root === null || isScalar2(root) && root.value === null && emptySource(text, root)) {
+    edit = startManifest(text, entry, key, value, eol);
   } else if (!isMap3(root)) {
     throw new DocmetaError(
-      `${at2()}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
+      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
     );
   } else {
-    const style = detectStyle(text2, root, eol);
+    const style = detectStyle(text, root, eol);
     const matches = root.items.filter((p) => same(keyString(p.key), entry));
     const [first, second] = matches;
     if (first && second) {
@@ -2170,7 +2173,7 @@ function spliceManifestValue(text2, options) {
           `${at2()}: the manifest is a flow mapping ({ \u2026 }), which this writer does not add entries to. Rewrite it in block style.`
         );
       }
-      edit = appendEntry(text2, root, entry, key, value, style);
+      edit = appendEntry(text, root, entry, key, value, style);
     } else {
       spelled = keyString(first.key);
       const where = at2(keyLine(first.key));
@@ -2193,18 +2196,18 @@ function spliceManifestValue(text2, options) {
       );
       let made;
       if (v.flow === true) {
-        if (hit) made = replaceFlowValue(text2, hit, value);
-        else if (v.items.length === 0) made = fillEmptyEntry(text2, first, key, value, style);
+        if (hit) made = replaceFlowValue(text, hit, value);
+        else if (v.items.length === 0) made = fillEmptyEntry(text, first, key, value, style);
         else throw flowRefusal();
         if (!made) throw hit ? flowRefusal() : formRefusal();
       } else {
-        made = hit ? replaceBlockValue(text2, hit, value, style) : insertKey(text2, v, key, value, style);
+        made = hit ? replaceBlockValue(text, hit, value, style) : insertKey(text, v, key, value, style);
         if (!made) throw formRefusal();
       }
       edit = made;
     }
   }
-  const out = text2.slice(0, edit.start) + edit.insert + text2.slice(edit.end);
+  const out = text.slice(0, edit.start) + edit.insert + text.slice(edit.end);
   const line = readBack(
     doc,
     out,
@@ -2217,13 +2220,13 @@ function spliceManifestValue(text2, options) {
   );
   return { text: out, line };
 }
-function readManifestValue(text2, options) {
-  const join5 = options.join ?? PATH_JOIN;
-  const doc = parseDocument3(text2, { uniqueKeys: false });
+function readManifestValue(text, options) {
+  const join4 = options.join ?? PATH_JOIN;
+  const doc = parseDocument3(text, { uniqueKeys: false });
   if (doc.errors.length > 0) return void 0;
   const root = doc.contents;
   if (!isMap3(root)) return void 0;
-  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const pair = root.items.find((p) => same(keyString(p.key), options.entry));
   const held = pair?.value;
   if (!isMap3(held)) return void 0;
@@ -2231,17 +2234,17 @@ function readManifestValue(text2, options) {
   const node = kv?.value;
   return isNode2(node) ? node.toJSON() : void 0;
 }
-function removeManifestKey(text2, options) {
+function removeManifestKey(text, options) {
   const { entry, key, file } = options;
-  const join5 = options.join ?? PATH_JOIN;
+  const join4 = options.join ?? PATH_JOIN;
   const at2 = (line) => {
     const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
     if (line === void 0) return name;
     return file === void 0 ? `${name} line ${String(line)}` : `${name}:${String(line)}`;
   };
-  const eol = detectEol(text2);
+  const eol = detectEol(text);
   const lc = new LineCounter2();
-  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
@@ -2251,13 +2254,13 @@ function removeManifestKey(text2, options) {
     return r ? lc.linePos(r[0]).line : void 0;
   };
   const root = doc.contents;
-  if (root === null || isScalar2(root) && root.value === null) return { text: text2 };
+  if (root === null || isScalar2(root) && root.value === null) return { text };
   if (!isMap3(root)) {
     throw new DocmetaError(
-      `${at2()}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
+      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
     );
   }
-  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const matches = root.items.filter((p) => same(keyString(p.key), entry));
   const [first, second] = matches;
   if (first && second) {
@@ -2265,7 +2268,7 @@ function removeManifestKey(text2, options) {
       `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
     );
   }
-  if (first === void 0) return { text: text2 };
+  if (first === void 0) return { text };
   const spelled = keyString(first.key);
   const where = at2(keyLine(first.key));
   const v = first.value;
@@ -2279,7 +2282,7 @@ function removeManifestKey(text2, options) {
       `${at2(keyLine(again.key))}: "${spelled}" sets "${key}" twice (first at line ${String(keyLine(hit.key) ?? "?")}). Remove one.`
     );
   }
-  if (hit === void 0) return { text: text2 };
+  if (hit === void 0) return { text };
   const whole = v.items.length === 1;
   if (!whole && v.flow === true) {
     throw new DocmetaError(
@@ -2287,18 +2290,18 @@ function removeManifestKey(text2, options) {
     );
   }
   const from = rangeOf(whole ? first.key : hit.key);
-  const to = whole ? contentEnd(text2, v) : contentEnd(text2, hit.value) ?? contentEnd(text2, hit.key);
+  const to = whole ? contentEnd(text, v) : contentEnd(text, hit.value) ?? contentEnd(text, hit.key);
   if (!from || to === void 0) {
     throw new DocmetaError(
       `${where}: "${spelled}" writes a key in a form this writer does not edit. Write it as "${key}: \u2026".`
     );
   }
-  let { start, end } = keyLines(text2, from[0], to, eol);
+  let { start, end } = keyLines(text, from[0], to, eol);
   if (whole) {
-    if (text2.slice(start - 2 * eol.length, start) === eol + eol) start -= eol.length;
-    else if (start === 0 && text2.startsWith(eol, end)) end += eol.length;
+    if (text.slice(start - 2 * eol.length, start) === eol + eol) start -= eol.length;
+    else if (start === 0 && text.startsWith(eol, end)) end += eol.length;
   }
-  const out = text2.slice(0, start) + text2.slice(end);
+  const out = text.slice(0, start) + text.slice(end);
   const after = parseDocument3(out, { uniqueKeys: false });
   const fail = (why) => new DocmetaError(
     `${at2()}: removing "${key}" for "${entry}" did not read back as removed, so nothing was written. ${why}`
@@ -2317,16 +2320,16 @@ function removeManifestKey(text2, options) {
   if (!deepEqual(now ?? null, expected)) throw fail("Another value in the manifest would have changed.");
   return { text: out };
 }
-function renameManifestEntry(text2, options) {
+function renameManifestEntry(text, options) {
   const { entry, to, file } = options;
-  const join5 = options.join ?? PATH_JOIN;
+  const join4 = options.join ?? PATH_JOIN;
   const at2 = (line) => {
     const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
     if (line === void 0) return name;
     return file === void 0 ? `${name} line ${String(line)}` : `${name}:${String(line)}`;
   };
   const lc = new LineCounter2();
-  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
@@ -2336,20 +2339,20 @@ function renameManifestEntry(text2, options) {
     return r2 ? lc.linePos(r2[0]).line : void 0;
   };
   const root = doc.contents;
-  if (root === null || isScalar2(root) && root.value === null) return { text: text2 };
+  if (root === null || isScalar2(root) && root.value === null) return { text };
   if (!isMap3(root)) {
     throw new DocmetaError(
-      `${at2()}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
+      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
     );
   }
-  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const [first, second] = root.items.filter((p) => same(keyString(p.key), entry));
   if (first && second) {
     throw new DocmetaError(
       `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
     );
   }
-  if (first === void 0) return { text: text2 };
+  if (first === void 0) return { text };
   const taken = root.items.find((p) => same(keyString(p.key), to));
   if (taken !== void 0) {
     throw new DocmetaError(
@@ -2358,8 +2361,8 @@ function renameManifestEntry(text2, options) {
   }
   const spelled = keyString(first.key);
   const r = rangeOf(first.key);
-  const end = contentEnd(text2, first.key);
-  if (!r || end === void 0 || colonEnd(text2, first) === void 0) {
+  const end = contentEnd(text, first.key);
+  if (!r || end === void 0 || colonEnd(text, first) === void 0) {
     throw new DocmetaError(
       `${at2(keyLine(first.key))}: "${spelled}" is written in a form this writer does not edit. Write it as "${spelled}: \u2026".`
     );
@@ -2367,7 +2370,7 @@ function renameManifestEntry(text2, options) {
   const quoted = isScalar2(first.key) && (first.key.type === "QUOTE_DOUBLE" || first.key.type === "QUOTE_SINGLE");
   const plain = stringify2(to, { lineWidth: 0 }).replace(/\n$/, "");
   const insert = quoted || plain.includes("\n") ? JSON.stringify(to) : plain;
-  const out = text2.slice(0, r[0]) + insert + text2.slice(end);
+  const out = text.slice(0, r[0]) + insert + text.slice(end);
   const after = parseDocument3(out, { uniqueKeys: false });
   const fail = (why) => new DocmetaError(
     `${at2()}: renaming "${spelled}" to "${to}" did not read back as renamed, so nothing was written. ${why}`
@@ -2382,25 +2385,25 @@ function renameManifestEntry(text2, options) {
   if (!deepEqual(now, expected)) throw fail("Another value in the manifest would have changed.");
   return { text: out };
 }
-function startManifest(text2, entry, key, value, eol) {
+function startManifest(text, entry, key, value, eol) {
   const style = { step: 2, indentSeq: true, eol };
   const block = blockLines({ [entry]: { [key]: value } }, 0, style);
   let insert;
-  if (text2 === "" || text2.endsWith("\n")) insert = block + eol;
+  if (text === "" || text.endsWith("\n")) insert = block + eol;
   else insert = eol + block;
-  return { start: text2.length, end: text2.length, insert };
+  return { start: text.length, end: text.length, insert };
 }
-function appendEntry(text2, root, entry, key, value, style) {
+function appendEntry(text, root, entry, key, value, style) {
   const body = { [entry]: { [key]: value } };
   if (root.flow === true) {
     const r = rangeOf(root);
-    const start = r ? r[0] : text2.length;
-    const end = contentEnd(text2, root) ?? start;
-    return { start, end, insert: blockLines(body, colOf(text2, start), style) };
+    const start = r ? r[0] : text.length;
+    const end = contentEnd(text, root) ?? start;
+    return { start, end, insert: blockLines(body, colOf(text, start), style) };
   }
   const firstKey = rangeOf(root.items[0]?.key);
-  const col = firstKey ? colOf(text2, firstKey[0]) : 0;
-  const pos = lineEnd(text2, contentEnd(text2, root) ?? text2.length);
+  const col = firstKey ? colOf(text, firstKey[0]) : 0;
+  const pos = lineEnd(text, contentEnd(text, root) ?? text.length);
   const last = root.items.at(-1);
   const spaced = root.items.length > 1 && isNode2(last?.key) && last.key.spaceBefore === true;
   return {
@@ -2409,12 +2412,12 @@ function appendEntry(text2, root, entry, key, value, style) {
     insert: style.eol + (spaced ? style.eol : "") + blockLines(body, col, style)
   };
 }
-function fillEmptyEntry(text2, entryPair, key, value, style) {
-  const start = colonEnd(text2, entryPair);
+function fillEmptyEntry(text, entryPair, key, value, style) {
+  const start = colonEnd(text, entryPair);
   const keyRange = rangeOf(entryPair.key);
-  const end = contentEnd(text2, entryPair.value);
+  const end = contentEnd(text, entryPair.value);
   if (start === void 0 || !keyRange || end === void 0) return void 0;
-  const col = colOf(text2, keyRange[0]) + style.step;
+  const col = colOf(text, keyRange[0]) + style.step;
   return { start, end, insert: style.eol + blockLines({ [key]: value }, col, style) };
 }
 function readBack(before, out, spelled, key, value, fail) {
@@ -2455,17 +2458,17 @@ function isRecord3(x) {
 function relocateFailed(result) {
   return result.summary.stayed > 0;
 }
-function relocationContext(run2, extras) {
+function relocationContext(run, extras) {
   return {
     cwd: extras.cwd,
-    base: run2.base,
+    base: run.base,
     noConfig: extras.noConfig ?? false,
-    config: run2.config,
-    ...run2.configDir !== void 0 ? { configDir: run2.configDir } : {},
-    ...run2.configPath !== void 0 ? { configPath: run2.configPath } : {},
-    ...run2.configFile !== void 0 ? { configFile: run2.configFile } : {},
-    collections: run2.collections,
-    declaredCollections: run2.declaredCollections,
+    config: run.config,
+    ...run.configDir !== void 0 ? { configDir: run.configDir } : {},
+    ...run.configPath !== void 0 ? { configPath: run.configPath } : {},
+    ...run.configFile !== void 0 ? { configFile: run.configFile } : {},
+    collections: run.collections,
+    declaredCollections: run.declaredCollections,
     targets: extras.targets.filter((t) => t !== STDIN_TOKEN),
     ...extras.cliSchemas !== void 0 ? { cliSchemas: extras.cliSchemas } : {},
     validator: extras.validator,
@@ -2477,11 +2480,11 @@ function relocationContext(run2, extras) {
 }
 var toPosix = (p) => p.split(sep3).join("/");
 function reported2(abs, base) {
-  const rel = relative4(base, abs);
+  const rel = relative5(base, abs);
   return rel === "" ? "." : toPosix(rel);
 }
 function configSource(path, cwd) {
-  return toPosix(relative4(cwd, path)) || basename3(path);
+  return toPosix(relative5(cwd, path)) || basename4(path);
 }
 function cloneCollection(c) {
   return {
@@ -2692,7 +2695,7 @@ var Model = class {
   /** A label relative to the config directory, posix; undefined outside it. */
   relative(label) {
     if (label === "<stdin>") return void 0;
-    const rel = toPosix(relative4(this.configDir, resolve3(this.ctx.base, label)));
+    const rel = toPosix(relative5(this.configDir, resolve3(this.ctx.base, label)));
     return isAbsolute3(rel) || rel.startsWith("../") ? void 0 : rel;
   }
 };
@@ -2704,17 +2707,17 @@ function bare(path) {
 }
 async function collectionPath(target, cwd, configDir) {
   if (target === STDIN_TOKEN) return void 0;
-  const posix5 = target.replace(/\\/g, "/");
-  const scanned = picomatch.scan(posix5);
+  const posix4 = target.replace(/\\/g, "/");
+  const scanned = picomatch.scan(posix4);
   if (scanned.isGlob) {
-    const rel2 = toPosix(relative4(configDir, resolve3(cwd, scanned.base === "" ? "." : scanned.base)));
+    const rel2 = toPosix(relative5(configDir, resolve3(cwd, scanned.base === "" ? "." : scanned.base)));
     if (isAbsolute3(rel2) || rel2 === ".." || rel2.startsWith("../")) return void 0;
     return rel2 === "" ? scanned.glob : `${rel2}/${scanned.glob}`;
   }
-  const abs = resolve3(cwd, posix5);
-  const rel = toPosix(relative4(configDir, abs));
+  const abs = resolve3(cwd, posix4);
+  const rel = toPosix(relative5(configDir, abs));
   if (isAbsolute3(rel) || rel.startsWith("..")) return void 0;
-  let directory = posix5.endsWith("/");
+  let directory = posix4.endsWith("/");
   if (!directory) {
     try {
       directory = (await stat2(abs)).isDirectory();
@@ -2773,7 +2776,7 @@ function marksOf(ctx) {
   });
 }
 function entryFor(m, label, data, configDir, base, key) {
-  if (m.join === PATH_JOIN) return toPosix(relative4(configDir, resolve3(base, label)));
+  if (m.join === PATH_JOIN) return toPosix(relative5(configDir, resolve3(base, label)));
   let raw = data[m.join];
   if (isEncryptedValue(raw)) {
     const k = key();
@@ -3089,9 +3092,9 @@ async function planRelocation(ctx, request) {
   }
   const orderedPages = () => {
     const all = [...pages.values()];
-    const run2 = all.filter((p) => !p.beyond).sort((a, b) => compare(a.label, b.label));
+    const run = all.filter((p) => !p.beyond).sort((a, b) => compare(a.label, b.label));
     const beyond = all.filter((p) => p.beyond).sort((a, b) => compare(a.label, b.label));
-    return [...run2, ...beyond];
+    return [...run, ...beyond];
   };
   let dirty = new Set(pages.values());
   while (dirty.size > 0) {
@@ -3153,20 +3156,20 @@ async function planRelocation(ctx, request) {
     for (const [path, { file, outs, ins }] of files) {
       if (!m.created && outs.length === 0 && ins.length === 0) continue;
       const disk = m.created ? null : await readManifestText(path, file, m.perPage);
-      let text2 = disk ?? "";
-      const before = text2;
+      let text = disk ?? "";
+      const before = text;
       const where = { join: m.join, file };
       for (const o of outs) {
-        if (!o.drop) text2 = spliceManifestValue(text2, { ...where, entry: o.entry, key: o.key, value: o.value }).text;
+        if (!o.drop) text = spliceManifestValue(text, { ...where, entry: o.entry, key: o.key, value: o.value }).text;
       }
-      for (const i of ins) text2 = removeManifestKey(text2, { ...where, entry: i.entry, key: i.key }).text;
-      const found = keyLines2(text2, m.join);
+      for (const i of ins) text = removeManifestKey(text, { ...where, entry: i.entry, key: i.key }).text;
+      const found = keyLines2(text, m.join);
       for (const o of outs) {
         const line = found.get(entryId(o.entry, m.join))?.get(o.key);
         if (line !== void 0) lines.set(lineId(o.page, file, o.key), line);
       }
-      if (m.created || text2 !== before) {
-        writes.push({ path, text: text2, kind: "manifest", before: disk });
+      if (m.created || text !== before) {
+        writes.push({ path, text, kind: "manifest", before: disk });
       }
     }
   }
@@ -3180,9 +3183,9 @@ async function planRelocation(ctx, request) {
         `${ctx.configFile.source} is a single-tool config file, which cannot hold collections:. Move its keys under meta: in ${FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"}.`
       );
     }
-    const text2 = editConfig(target.text, model, configSource(target.path, ctx.cwd));
-    verifyConfig(target.text, text2, finalCollections, configSource(target.path, ctx.cwd));
-    writes.push({ path: target.path, text: text2, kind: "config", before: target.disk });
+    const text = editConfig(target.text, model, configSource(target.path, ctx.cwd));
+    verifyConfig(target.text, text, finalCollections, configSource(target.path, ctx.cwd));
+    writes.push({ path: target.path, text, kind: "config", before: target.disk });
     configCreated = target.text === null;
   }
   for (const page of orderedPages()) {
@@ -3277,7 +3280,7 @@ function assertNoStrandedEntries(m, index, pages, configDir, fileOf) {
     const stranded = m.join === PATH_JOIN ? [...index.byPath].filter(([abs, values]) => {
       const sv = values.get(key);
       return sv !== void 0 && sv.collection === m.collection && sv.file === fileOf(abs);
-    }).map(([abs]) => toPosix(relative4(configDir, abs))) : [...index.byField.get(m.join) ?? /* @__PURE__ */ new Map()].filter(([, values]) => {
+    }).map(([abs]) => toPosix(relative5(configDir, abs))) : [...index.byField.get(m.join) ?? /* @__PURE__ */ new Map()].filter(([, values]) => {
       const sv = values.get(key);
       return sv !== void 0 && sv.file === m.file && sv.collection === m.collection;
     }).map(([value]) => value);
@@ -3297,12 +3300,12 @@ async function readManifestText(path, file, perPage) {
     throw new DocmetaError(`Manifest ${file} could not be read: ${errorMessage(err)}`);
   }
 }
-var entryId = (entry, join5) => join5 === PATH_JOIN ? toPosix(entry).replace(/^\.\//, "").replace(/\/+/g, "/") : entry;
+var entryId = (entry, join4) => join4 === PATH_JOIN ? toPosix(entry).replace(/^\.\//, "").replace(/\/+/g, "/") : entry;
 var lineId = (page, manifest, key) => `${page}\0${manifest}\0${key}`;
-function keyLines2(text2, join5) {
+function keyLines2(text, join4) {
   const out = /* @__PURE__ */ new Map();
   const lc = new LineCounter3();
-  const doc = parseDocument4(text2, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument4(text, { lineCounter: lc, uniqueKeys: false });
   const root = doc.contents;
   if (!isMap4(root)) return out;
   for (const pair of root.items) {
@@ -3314,15 +3317,15 @@ function keyLines2(text2, join5) {
       const range = isNode3(kv.key) ? kv.key.range : void 0;
       if (range) keys.set(name, lc.linePos(range[0]).line);
     }
-    out.set(entryId(spelled, join5), keys);
+    out.set(entryId(spelled, join4), keys);
   }
   return out;
 }
 async function configTarget(ctx, configDir) {
   if (ctx.configPath !== void 0) {
     try {
-      const text2 = await readFile4(ctx.configPath, "utf8");
-      return { path: ctx.configPath, text: text2, disk: text2 };
+      const text = await readFile4(ctx.configPath, "utf8");
+      return { path: ctx.configPath, text, disk: text };
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw new DocmetaError(
@@ -3335,15 +3338,15 @@ async function configTarget(ctx, configDir) {
   for (const name of FAMILY_CONFIG_NAMES) {
     const path = join3(configDir, name);
     try {
-      const text2 = await readFile4(path, "utf8");
-      return { path, text: text2, disk: text2 };
+      const text = await readFile4(path, "utf8");
+      return { path, text, disk: text };
     } catch {
     }
   }
   return { path: join3(configDir, FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"), text: null, disk: null };
 }
-function editConfig(text2, model, source) {
-  const doc = parseDocument4(text2 ?? "");
+function editConfig(text, model, source) {
+  const doc = parseDocument4(text ?? "");
   const [problem] = doc.errors;
   if (problem !== void 0) throw new DocmetaError(`${source}: invalid YAML: ${problem.message}`);
   if (doc.contents !== null && !isMap4(doc.contents)) {
@@ -3515,7 +3518,7 @@ function buildResult(input) {
   };
 }
 async function applyRelocation(ctx, plan, io = {}) {
-  const write = io.write ?? ((path, text2) => writeFileAtomic(path, text2, { createParents: true }));
+  const write = io.write ?? ((path, text) => writeFileAtomic(path, text, { createParents: true }));
   const remove = io.remove ?? ((path) => unlink(path));
   const label = (w) => w.kind === "config" ? configSource(w.path, ctx.cwd) : reported2(w.path, ctx.base);
   for (const w of plan.writes) {
@@ -3687,12 +3690,6 @@ function relocationOffers(plan) {
   return plan.offers;
 }
 
-// src/meta/commands/validate.ts
-import { resolve as resolve7, extname as extname3 } from "node:path";
-
-// src/meta/core/derive/provenance.ts
-import picomatch2 from "picomatch";
-
 // src/shared/pin.ts
 var LineRangeError = class extends ToolError {
   constructor(message) {
@@ -3700,12 +3697,12 @@ var LineRangeError = class extends ToolError {
     this.name = "LineRangeError";
   }
 };
-function normalizeText(text2) {
-  const body = text2.charCodeAt(0) === 65279 ? text2.slice(1) : text2;
+function normalizeText(text) {
+  const body = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
   return body.replace(/\r\n/g, "\n");
 }
-function splitLines(text2) {
-  const parts = normalizeText(text2).split("\n");
+function splitLines(text) {
+  const parts = normalizeText(text).split("\n");
   if (parts.length > 0 && parts[parts.length - 1] === "") parts.pop();
   return parts;
 }
@@ -3722,8 +3719,8 @@ function sliceLines(lines, range, label) {
   }
   return lines.slice(start - 1, end).join("\n");
 }
-function hashRange(text2, range, key) {
-  return hashLines(sliceLines(splitLines(text2), range), key);
+function hashRange(text, range, key) {
+  return hashLines(sliceLines(splitLines(text), range), key);
 }
 function hashLines(joined, key) {
   return key === void 0 ? integrityOf(Buffer.from(joined, "utf8")) : keyedPin(joined, key);
@@ -3770,14 +3767,14 @@ function findWindows(lines, length, pin, key, opts) {
   for (let start = bandEnd + 1; start <= lastStart; start++) order.push(start);
   let spent = 0;
   for (const start of order) {
-    const text2 = joined(start);
-    const bytes = Buffer.byteLength(text2, "utf8");
+    const text = joined(start);
+    const bytes = Buffer.byteLength(text, "utf8");
     if (spent + bytes > budget) {
       if (counter !== void 0) counter.left = budget - spent;
       return { starts, truncated: true };
     }
     spent += bytes;
-    if (hashLines(text2, key) === pin) starts.push(start);
+    if (hashLines(text, key) === pin) starts.push(start);
   }
   if (counter !== void 0) counter.left = budget - spent;
   return { starts, truncated: false };
@@ -3808,9 +3805,9 @@ function toBodyLines(lines, bodyLine) {
   return { start: lines.start - bodyLine + 1, end: lines.end - bodyLine + 1 };
 }
 function splitPageArgument(arg) {
-  const text2 = arg.startsWith(STDIN_LINES_MARKER) ? `-${arg.slice(STDIN_LINES_MARKER.length)}` : arg;
-  const m = /:([1-9][0-9]*)(?:-([1-9][0-9]*))?$/.exec(text2);
-  const head = m === null ? text2 : text2.slice(0, m.index);
+  const text = arg.startsWith(STDIN_LINES_MARKER) ? `-${arg.slice(STDIN_LINES_MARKER.length)}` : arg;
+  const m = /:([1-9][0-9]*)(?:-([1-9][0-9]*))?$/.exec(text);
+  const head = m === null ? text : text.slice(0, m.index);
   if (m === null || head === "") return { page: arg };
   const start = Number(m[1]);
   const end = m[2] === void 0 ? start : Number(m[2]);
@@ -3821,6 +3818,7 @@ function splitPageArgument(arg) {
 }
 
 // src/meta/core/derive/provenance.ts
+import picomatch2 from "picomatch";
 var ZERO_SHA = "0000000000000000000000000000000000000000";
 var DEFAULT_MACHINES = ["*[bot]"];
 var PROVENANCE_POINTER = "/provenance";
@@ -3875,8 +3873,8 @@ function readProvenancePage(content, opts) {
 }
 var HEADER = /^([0-9a-f]{40}(?:[0-9a-f]{24})?) ([1-9][0-9]*) ([1-9][0-9]*)(?: ([1-9][0-9]*))?$/;
 var ALL_ZERO = /^0+$/;
-function parseLinePorcelain(text2) {
-  const rows = text2.split("\n");
+function parseLinePorcelain(text) {
+  const rows = text.split("\n");
   if (rows.length > 0 && rows[rows.length - 1] === "") rows.pop();
   const out = [];
   let i = 0;
@@ -4299,2959 +4297,6 @@ function attributeRange(input) {
   return { "generated-by": input.generatedBy, lines: lineSpec(span), integrity: pinOf(page.body, span) };
 }
 
-// src/meta/core/derive/config.ts
-var DEFAULT_COMMAND_TIMEOUT_MS = 6e4;
-function commandsOf(config) {
-  if (config?.commands === void 0) return void 0;
-  const out = {};
-  for (const [field, c] of Object.entries(config.commands)) {
-    out[field] = {
-      run: c.run,
-      timeoutMs: c.timeout === void 0 ? DEFAULT_COMMAND_TIMEOUT_MS : Math.round(c.timeout * 1e3)
-    };
-  }
-  return out;
-}
-function machinesOf(config) {
-  return config?.machines ?? DEFAULT_MACHINES;
-}
-
-// src/meta/core/derive/index.ts
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
-
-// src/meta/core/derive/cache.ts
-import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join as join4 } from "node:path";
-var REVIEW_CACHE_DIR = ".manni/meta/review-cache";
-var REVIEW_CACHE_VERSION = 1;
-var ReviewCache = class {
-  constructor(dir, enabled) {
-    this.dir = dir;
-    this.enabled = enabled;
-  }
-  dir;
-  enabled;
-  entryPath(key) {
-    const digest = createHash("sha256").update(key).digest("hex");
-    return join4(this.dir, `${digest}.json`);
-  }
-  /** The cached change, or `undefined` for a miss. Never `null`: nulls are not stored. */
-  get(key) {
-    if (!this.enabled) return void 0;
-    let raw;
-    try {
-      raw = JSON.parse(readFileSync(this.entryPath(key), "utf8"));
-    } catch {
-      return void 0;
-    }
-    if (!isRecord4(raw)) return void 0;
-    if (raw.version !== REVIEW_CACHE_VERSION || raw.key !== key) return void 0;
-    const change = readChange(raw.change);
-    return change ?? void 0;
-  }
-  set(key, value) {
-    if (!this.enabled) return;
-    const entry = { version: REVIEW_CACHE_VERSION, key, change: value };
-    const path = this.entryPath(key);
-    const tmp = `${path}.${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`;
-    try {
-      mkdirSync(this.dir, { recursive: true });
-      writeFileSync(tmp, `${JSON.stringify(entry, null, 2)}
-`, "utf8");
-      renameSync(tmp, path);
-    } catch {
-      try {
-        rmSync(tmp, { force: true });
-      } catch {
-      }
-    }
-  }
-};
-function cachedClient(client, cache, identity) {
-  return {
-    detect: () => client.detect(),
-    status: () => client.status(),
-    async mergedChangeFor(sha) {
-      if (identity === null) return client.mergedChangeFor(sha);
-      const key = `${identity.host}/${identity.project}/${sha}`;
-      const hit = cache.get(key);
-      if (hit !== void 0) return hit;
-      const change = await client.mergedChangeFor(sha);
-      if (change !== null) cache.set(key, change);
-      return change;
-    }
-  };
-}
-function isRecord4(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function readChange(v) {
-  if (!isRecord4(v)) return null;
-  const { id, mergedAt, approvals } = v;
-  if (typeof id !== "number" || typeof mergedAt !== "string") return null;
-  if (!Array.isArray(approvals)) return null;
-  const read = [];
-  for (const a of approvals) {
-    if (!isRecord4(a)) return null;
-    if (typeof a.login !== "string" || typeof a.submittedAt !== "string") return null;
-    read.push({ login: a.login, submittedAt: a.submittedAt });
-  }
-  return { id, mergedAt, approvals: read };
-}
-
-// src/meta/core/derive/codeowners.ts
-import { existsSync } from "node:fs";
-import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname3, relative as relative5, resolve as resolve4, sep as sep4 } from "node:path";
-import picomatch3 from "picomatch";
-var CODEOWNERS_LOCATIONS = [
-  ".github/CODEOWNERS",
-  "CODEOWNERS",
-  "docs/CODEOWNERS",
-  ".gitlab/CODEOWNERS"
-];
-function findCodeowners(root, explicit) {
-  if (explicit !== void 0) {
-    const path = resolve4(root, explicit);
-    return existsSync(path) ? path : null;
-  }
-  for (const loc of CODEOWNERS_LOCATIONS) {
-    const path = resolve4(root, ...loc.split("/"));
-    if (existsSync(path)) return path;
-  }
-  return null;
-}
-var SECTION_HEADER = /^(\^?)\[([^\]]+)\](?:\[(\d+)\])?(.*)$/;
-var TOKEN = /(?:\\.|[^\s\\])+/g;
-function parseCodeowners(text2, path, label) {
-  const rules = [];
-  const sections = [];
-  let current;
-  const lines = text2.split(/\r?\n/);
-  for (let i = 0; i < lines.length; i += 1) {
-    const raw = lines[i] ?? "";
-    const line = raw.trim();
-    if (line === "" || line.startsWith("#")) continue;
-    if (line.startsWith("[") || line.startsWith("^[")) {
-      const m = SECTION_HEADER.exec(line);
-      if (!m) continue;
-      const [, caret, rawName, approvals, rest] = m;
-      const name = (rawName ?? "").trim();
-      if (name === "") continue;
-      const owners2 = tokens(rest ?? "");
-      const existing = sections.find(
-        (s) => s.name.toLowerCase() === name.toLowerCase()
-      );
-      if (existing) {
-        if (owners2.length > 0) existing.defaultOwners = owners2;
-        current = existing;
-        continue;
-      }
-      const section = {
-        name,
-        optional: caret === "^",
-        ...approvals !== void 0 ? { approvals: Number(approvals) } : {},
-        defaultOwners: owners2
-      };
-      sections.push(section);
-      current = section;
-      continue;
-    }
-    const [first, ...owners] = tokens(line);
-    if (first === void 0) continue;
-    const pattern = unescapePattern(first);
-    if (pattern === "" || pattern === "/") continue;
-    rules.push({
-      pattern,
-      owners,
-      line: i + 1,
-      ...current ? { section: current.name } : {}
-    });
-  }
-  return { path, label, rules, sections };
-}
-function tokens(s) {
-  return s.match(TOKEN) ?? [];
-}
-function unescapePattern(token) {
-  return token.replace(/\\ /g, " ").replace(/^\\#/, "#");
-}
-function ownersFor(file, relPath) {
-  const matchers = matchersFor(file);
-  const defaults = new Map(file.sections.map((s) => [s.name, s.defaultOwners]));
-  const order = [void 0, ...file.sections.map((s) => s.name)];
-  const winners = /* @__PURE__ */ new Map();
-  file.rules.forEach((rule, i) => {
-    if (matchers[i]?.(relPath)) winners.set(rule.section, rule);
-  });
-  if (winners.size === 0) return null;
-  const owners = [];
-  let line = 0;
-  let lineFromOwner = false;
-  for (const section of order) {
-    const rule = winners.get(section);
-    if (!rule) continue;
-    const chosen = rule.owners.length > 0 ? rule.owners : (section === void 0 ? void 0 : defaults.get(section)) ?? [];
-    if (chosen.length > 0) {
-      line = rule.line;
-      lineFromOwner = true;
-    } else if (!lineFromOwner) {
-      line = rule.line;
-    }
-    for (const o of chosen) if (!owners.includes(o)) owners.push(o);
-  }
-  return { owners, line };
-}
-var matcherCache = /* @__PURE__ */ new WeakMap();
-function matchersFor(file) {
-  let matchers = matcherCache.get(file);
-  if (!matchers) {
-    matchers = file.rules.map((r) => picomatch3(toGlobs(r.pattern), PICOMATCH));
-    matcherCache.set(file, matchers);
-  }
-  return matchers;
-}
-var PICOMATCH = { dot: true, windows: false };
-function toGlobs(pattern) {
-  let p = pattern;
-  const dirOnly = p.endsWith("/");
-  if (dirOnly) p = p.slice(0, -1);
-  let anchored = false;
-  if (p.startsWith("/")) {
-    anchored = true;
-    p = p.slice(1);
-  } else if (p.includes("/") && !p.startsWith("**/")) {
-    anchored = true;
-  }
-  const base = anchored || p.startsWith("**/") ? p : `**/${p}`;
-  if (dirOnly) return [`${base}/**`];
-  const last = p.slice(p.lastIndexOf("/") + 1);
-  return /[*?[]/.test(last) ? [base] : [base, `${base}/**`];
-}
-var NOT_FOUND_REASON = `no CODEOWNERS file found (looked for ${CODEOWNERS_LOCATIONS.join(", ")})`;
-async function deriveFromCodeowners(inputs, opts) {
-  const records = /* @__PURE__ */ new Map();
-  const explicitPath = opts.explicit === void 0 ? void 0 : resolve4(opts.configDir ?? process.cwd(), opts.explicit);
-  if (explicitPath !== void 0 && !existsSync(explicitPath)) {
-    return {
-      status: { available: false, reason: `CODEOWNERS not found at ${explicitPath}` },
-      records
-    };
-  }
-  const byRoot = /* @__PURE__ */ new Map();
-  const rootCache = /* @__PURE__ */ new Map();
-  for (const input of inputs) {
-    const dir = dirname3(input.absPath);
-    let root = rootCache.get(dir);
-    if (root === void 0) {
-      root = opts.rootOf(input.absPath);
-      rootCache.set(dir, root);
-    }
-    if (root === null) continue;
-    const bucket = byRoot.get(root);
-    if (bucket) bucket.push(input);
-    else byRoot.set(root, [input]);
-  }
-  let found = 0;
-  const parsed = /* @__PURE__ */ new Map();
-  for (const [root, bucket] of byRoot) {
-    const path = explicitPath ?? findCodeowners(root);
-    if (path === null) {
-      for (const input of bucket) records.set(input.label, null);
-      continue;
-    }
-    found += 1;
-    const label = toPosix2(relative5(opts.configDir ?? root, path));
-    const key = `${path}\0${label}`;
-    let file = parsed.get(key);
-    if (!file) {
-      file = readFile5(path, "utf8").then(
-        (text2) => parseCodeowners(text2, path, label)
-      );
-      parsed.set(key, file);
-    }
-    let owners;
-    try {
-      owners = await file;
-    } catch (err) {
-      return {
-        status: {
-          available: false,
-          reason: `CODEOWNERS at ${label} could not be read: ${errorMessage(err)}`
-        },
-        records
-      };
-    }
-    for (const input of bucket) {
-      const rel = toPosix2(relative5(root, input.absPath));
-      const hit = ownersFor(owners, rel);
-      records.set(
-        input.label,
-        hit === null ? null : {
-          value: hit.owners,
-          source: "codeowners",
-          evidence: `${label}:${hit.line}`
-        }
-      );
-    }
-  }
-  if (byRoot.size === 0) {
-    return {
-      status: { available: false, reason: "no git repository contains the documents" },
-      records
-    };
-  }
-  if (found === 0 && explicitPath === void 0) {
-    return { status: { available: true, reason: NOT_FOUND_REASON }, records };
-  }
-  return { status: { available: true }, records };
-}
-function toPosix2(p) {
-  return p.split(sep4).join("/");
-}
-
-// src/meta/core/derive/spawn.ts
-import { spawn } from "node:child_process";
-var DEFAULT_TIMEOUT_MS = 3e4;
-var MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
-var BinMissing = class extends Error {
-};
-function run(bin, args, opts) {
-  return new Promise((settle2, reject) => {
-    let done = false;
-    const finish = (r) => {
-      if (done) return;
-      done = true;
-      settle2(r);
-    };
-    const fail = (err) => {
-      if (done) return;
-      done = true;
-      reject(err);
-    };
-    let child;
-    try {
-      child = spawn(bin, [...opts.prefixArgs ?? [], ...args], {
-        cwd: opts.cwd,
-        windowsHide: true
-      });
-    } catch (err) {
-      fail(err instanceof Error ? err : new Error(String(err)));
-      return;
-    }
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    let tooLarge = false;
-    const stop = (r) => {
-      clearTimeout(timer);
-      child.kill();
-      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
-      finish({ code: null, ...r });
-    };
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-      if (stdout.length > MAX_OUTPUT_BYTES) {
-        tooLarge = true;
-        stop({ stdout, stderr, timedOut, tooLarge });
-      }
-    });
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-      if (stderr.length > MAX_OUTPUT_BYTES) {
-        tooLarge = true;
-        stop({ stdout, stderr, timedOut, tooLarge });
-      }
-    });
-    child.stdin.end();
-    const timer = setTimeout(() => {
-      timedOut = true;
-      stop({ stdout, stderr, timedOut, tooLarge });
-    }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      fail(err.code === "ENOENT" ? new BinMissing(err.message) : err);
-    });
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      finish({ code, stdout, stderr, timedOut, tooLarge });
-    });
-  });
-}
-function commandLine(bin, args) {
-  return [bin, ...args].join(" ");
-}
-function lastLine(text2) {
-  const lines = text2.split(/\r?\n/).filter((l) => l.trim() !== "");
-  return lines.at(-1) ?? "";
-}
-
-// src/meta/core/derive/command.ts
-var PATH_PLACEHOLDER = "{path}";
-function isPerFile(command) {
-  return command.run.some((arg) => arg.includes(PATH_PLACEHOLDER));
-}
-function argvFor(command, label) {
-  return command.run.map((arg) => arg.split(PATH_PLACEHOLDER).join(label));
-}
-function valueOf(stdout) {
-  const text2 = stdout.trim();
-  if (text2 === "") return null;
-  if (!/^[{["]/.test(text2)) return text2;
-  try {
-    return JSON.parse(text2);
-  } catch {
-    return text2;
-  }
-}
-async function deriveFromCommands(inputs, commands, opts) {
-  const records = /* @__PURE__ */ new Map();
-  const fields = Object.keys(commands);
-  if (fields.length === 0 || inputs.length === 0) {
-    return { status: { available: true }, records };
-  }
-  for (const input of inputs) records.set(input.label, {});
-  for (const field of fields) {
-    const command = commands[field];
-    if (command === void 0) continue;
-    if (isPerFile(command)) {
-      for (const [label, record] of records) {
-        const outcome = await runOne(field, argvFor(command, label), command.timeoutMs, opts);
-        if ("reason" in outcome) return unavailable(outcome.reason);
-        record[field] = outcome.value;
-      }
-    } else {
-      const outcome = await runOne(field, command.run, command.timeoutMs, opts);
-      if ("reason" in outcome) return unavailable(outcome.reason);
-      for (const record of records.values()) record[field] = outcome.value;
-    }
-  }
-  return { status: { available: true }, records };
-}
-function unavailable(reason) {
-  return { status: { available: false, reason }, records: /* @__PURE__ */ new Map() };
-}
-async function runOne(field, argv, timeoutMs, opts) {
-  const [program, ...args] = argv;
-  const where = `(derive.commands.${field})`;
-  if (program === void 0) {
-    return { reason: `no program to run ${where}` };
-  }
-  const line = argv.join(" ");
-  let result;
-  try {
-    result = await run(opts.spawn?.bin ?? program, args, {
-      ...opts.spawn,
-      cwd: opts.spawn?.cwd ?? opts.cwd,
-      timeoutMs
-    });
-  } catch (err) {
-    if (err instanceof BinMissing) {
-      return { reason: `\`${program}\` is not on PATH ${where}` };
-    }
-    return { reason: `\`${line}\` could not be run: ${errorMessage(err)} ${where}` };
-  }
-  if (result.timedOut) {
-    return { reason: `\`${line}\` timed out after ${String(timeoutMs / 1e3)}s ${where}` };
-  }
-  if (result.tooLarge) {
-    return {
-      reason: `\`${line}\` wrote more than ${String(MAX_OUTPUT_BYTES / (1024 * 1024))} MiB; a command reports one field's value ${where}`
-    };
-  }
-  if (result.code !== 0) {
-    const last = lastLine(result.stderr);
-    const detail = last === "" ? "no output on stderr" : last;
-    const exit = result.code === null ? "killed by a signal" : `exit ${String(result.code)}`;
-    return { reason: `\`${line}\` failed (${exit}): ${detail} ${where}` };
-  }
-  const value = valueOf(result.stdout);
-  return { value: value === null ? null : { value, source: "command", evidence: line } };
-}
-
-// src/meta/core/derive/reviews.ts
-import { resolve as resolvePath2 } from "node:path";
-function parseOriginUrl(url) {
-  const trimmed = url.trim();
-  if (trimmed === "") return null;
-  if (isLocalPath(trimmed)) return null;
-  const scp = /^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(trimmed);
-  if (scp) {
-    const host = scp[1];
-    const path = scp[2];
-    if (host === void 0 || path === void 0) return null;
-    if (/^[A-Za-z]$/.test(host)) return null;
-    return project(host, path);
-  }
-  let parsed;
-  try {
-    parsed = new URL(trimmed);
-  } catch {
-    return null;
-  }
-  if (!/^(https?|ssh|git):$/.test(parsed.protocol)) return null;
-  if (parsed.hostname === "") return null;
-  return project(parsed.hostname, parsed.pathname);
-}
-function isLocalPath(s) {
-  return s.startsWith("/") || s.startsWith("./") || s.startsWith("../") || s.startsWith("\\\\");
-}
-function project(host, path) {
-  const segments2 = path.replace(/\.git$/, "").split("/").filter((s) => s !== "");
-  if (segments2.length < 2) return null;
-  return { host, project: segments2.join("/") };
-}
-function identityFromOrigin(host, project2, requested) {
-  const name = host.toLowerCase();
-  if (name.includes("github")) return { kind: "github", host, project: project2 };
-  if (name.includes("gitlab")) return { kind: "gitlab", host, project: project2 };
-  const only = requested !== void 0 && requested.length === 1 ? requested[0] : void 0;
-  return only === void 0 ? null : { kind: only, host, project: project2 };
-}
-var UnknownHostClient = class {
-  constructor(host) {
-    this.host = host;
-  }
-  host;
-  detect() {
-    return Promise.resolve(null);
-  }
-  status() {
-    return Promise.resolve({
-      available: false,
-      reason: `the origin remote is ${this.host}, which names neither GitHub nor GitLab; list exactly one of github, gitlab in derive.sources to say which it is`
-    });
-  }
-  mergedChangeFor() {
-    return Promise.resolve(null);
-  }
-};
-function httpStatus(stderr) {
-  const m = /\b(?:HTTP\s+(\d{3})|(\d{3})\s+Not\s+Found)\b/i.exec(stderr);
-  const code = m?.[1] ?? m?.[2];
-  return code === void 0 ? null : Number(code);
-}
-function isNotFound(r) {
-  const status = httpStatus(r.stderr);
-  return status === 404 || status === 422;
-}
-var CliClient = class {
-  constructor(identity, spawnOpts) {
-    this.identity = identity;
-    this.spawnOpts = spawnOpts;
-  }
-  identity;
-  spawnOpts;
-  detect() {
-    return Promise.resolve(this.identity);
-  }
-  async status() {
-    if (this.identity === null) {
-      return { available: false, reason: "no origin remote to tell GitHub from GitLab" };
-    }
-    const { host } = this.identity;
-    let r;
-    try {
-      r = await this.run(["auth", "status", "--hostname", host]);
-    } catch (err) {
-      if (err instanceof BinMissing) {
-        return {
-          available: false,
-          reason: `${this.tool} is not on PATH (origin is ${host}); install ${this.tool} and run ${this.tool} auth login`
-        };
-      }
-      throw err;
-    }
-    if (r.timedOut) throw this.timeout(["auth", "status", "--hostname", host]);
-    if (r.code !== 0) {
-      return {
-        available: false,
-        reason: `${this.tool} is not authenticated for ${host}; run ${this.tool} auth login`
-      };
-    }
-    return { available: true };
-  }
-  async mergedChangeFor(sha) {
-    if (this.identity === null) return null;
-    return this.lookup(this.identity, sha);
-  }
-  get bin() {
-    return this.spawnOpts.bin ?? this.tool;
-  }
-  run(args) {
-    return run(this.bin, args, this.spawnOpts);
-  }
-  timeout(args) {
-    const ms = this.spawnOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    return new DocmetaError(
-      `${commandLine(this.tool, args)} timed out after ${ms}ms`
-    );
-  }
-  /**
-   * Run a call whose stdout is JSON. A not-found answer is `null`; any other
-   * failure throws, naming the command the user can re-run by hand. The
-   * message quotes the tool's own name rather than `bin`, which under test
-   * is `node`.
-   */
-  async json(args) {
-    let r;
-    try {
-      r = await this.run(args);
-    } catch (err) {
-      if (err instanceof BinMissing) {
-        throw new DocmetaError(
-          `${commandLine(this.tool, args)} failed: ${this.tool} is not on PATH`
-        );
-      }
-      throw err;
-    }
-    const cmd = commandLine(this.tool, args);
-    if (r.timedOut) throw this.timeout(args);
-    if (r.tooLarge) {
-      throw new DocmetaError(`${cmd} wrote more output than manni will read`);
-    }
-    if (r.code !== 0) {
-      if (isNotFound(r)) return null;
-      const detail = lastLine(r.stderr) || lastLine(r.stdout);
-      const exit = r.code === null ? "signal" : `exit ${r.code}`;
-      throw new DocmetaError(
-        `${cmd} failed (${exit})${detail === "" ? "" : `: ${detail}`}`
-      );
-    }
-    try {
-      return JSON.parse(r.stdout);
-    } catch {
-      throw new DocmetaError(`${cmd} did not return JSON`);
-    }
-  }
-};
-function isRecord5(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function items(v) {
-  return Array.isArray(v) ? v.filter(isRecord5) : [];
-}
-function numberOf(v) {
-  return typeof v === "number" && Number.isInteger(v) ? v : null;
-}
-function stringOf(v) {
-  return typeof v === "string" && v !== "" ? v : null;
-}
-function timestampOf(v) {
-  if (v === void 0) return void 0;
-  return stringOf(v);
-}
-function normalizeLogin(login) {
-  return login.replace(/\[bot\]$/, "");
-}
-function latestApprovals(reviews) {
-  const latest = /* @__PURE__ */ new Map();
-  for (const r of reviews) {
-    if (r.state !== "APPROVED") continue;
-    const key = normalizeLogin(r.login);
-    const seen = latest.get(key);
-    if (seen === void 0 || r.submittedAt > seen.submittedAt) {
-      latest.set(key, { login: r.login, submittedAt: r.submittedAt });
-    }
-  }
-  return byTime([...latest.values()]);
-}
-function byTime(approvals) {
-  return [...approvals].sort(
-    (a, b) => a.submittedAt < b.submittedAt ? -1 : a.submittedAt > b.submittedAt ? 1 : 0
-  );
-}
-var GitHubClient = class extends CliClient {
-  tool = "gh";
-  async lookup(identity, sha) {
-    const { host, project: project2 } = identity;
-    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
-    let candidates = items(await api(`repos/${project2}/commits/${sha}/pulls`)).map(
-      (p) => ({ number: numberOf(p.number), mergedAt: timestampOf(p.merged_at) })
-    );
-    if (candidates.length === 0) {
-      const found = await this.json([
-        "pr",
-        "list",
-        "--search",
-        sha,
-        "--state",
-        "merged",
-        "--json",
-        "number,mergedAt",
-        "-R",
-        `${host}/${project2}`
-      ]);
-      candidates = items(found).map((p) => ({
-        number: numberOf(p.number),
-        mergedAt: timestampOf(p.mergedAt)
-      }));
-    }
-    for (const c of candidates) {
-      if (c.number === null) continue;
-      let mergedAt = c.mergedAt;
-      if (mergedAt === void 0) {
-        const pr = await api(`repos/${project2}/pulls/${c.number}`);
-        mergedAt = isRecord5(pr) ? stringOf(pr.merged_at) ?? null : null;
-      }
-      if (mergedAt === null) continue;
-      const raw = [];
-      for (let page = 1; ; page += 1) {
-        const batch = items(
-          await api(`repos/${project2}/pulls/${c.number}/reviews?per_page=100&page=${page}`)
-        );
-        raw.push(...batch);
-        if (batch.length < 100) break;
-      }
-      const reviews = raw.map((r) => ({
-        login: isRecord5(r.user) ? stringOf(r.user.login) : null,
-        state: stringOf(r.state),
-        submittedAt: stringOf(r.submitted_at)
-      })).filter(
-        (r) => r.login !== null && r.state !== null && r.submittedAt !== null
-      );
-      return { id: c.number, mergedAt, approvals: latestApprovals(reviews) };
-    }
-    return null;
-  }
-};
-var GitLabClient = class extends CliClient {
-  tool = "glab";
-  async lookup(identity, sha) {
-    const { host } = identity;
-    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
-    const merged = items(
-      await api(`projects/:fullpath/repository/commits/${sha}/merge_requests`)
-    ).map((mr) => ({ iid: numberOf(mr.iid), mergedAt: stringOf(mr.merged_at) })).find(
-      (mr) => mr.iid !== null && mr.mergedAt !== null
-    );
-    if (merged === void 0) return null;
-    const answer = await api(`projects/:fullpath/merge_requests/${merged.iid}/approvals`);
-    const approvedBy = isRecord5(answer) ? items(answer.approved_by) : [];
-    const approvals = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const entry of approvedBy) {
-      const login = isRecord5(entry.user) ? stringOf(entry.user.username) : null;
-      if (login === null) continue;
-      const key = normalizeLogin(login);
-      if (seen.has(key)) continue;
-      seen.add(key);
-      approvals.push({ login, submittedAt: merged.mergedAt });
-    }
-    return { id: merged.iid, mergedAt: merged.mergedAt, approvals };
-  }
-};
-async function createReviewClient(root, opts) {
-  const spawnOpts = { ...opts.spawn, cwd: opts.spawn?.cwd ?? root };
-  const origin = await originUrl(root);
-  const parsed = origin === null ? null : parseOriginUrl(origin);
-  const identity = parsed === null ? null : identityFromOrigin(parsed.host, parsed.project, opts.requested);
-  if (parsed !== null && identity === null) return new UnknownHostClient(parsed.host);
-  const client = identity?.kind === "gitlab" ? new GitLabClient(identity, spawnOpts) : new GitHubClient(identity, spawnOpts);
-  const cache = new ReviewCache(resolvePath2(root, opts.cacheDir), opts.cache);
-  return cachedClient(client, cache, identity);
-}
-async function originUrl(root) {
-  try {
-    const r = await run("git", ["remote", "get-url", "origin"], { cwd: root });
-    if (r.code !== 0 || r.timedOut || r.tooLarge) return null;
-    return stringOf(r.stdout.trim());
-  } catch {
-    return null;
-  }
-}
-var NOTHING = { "reviewed-by": null, "last-reviewed": null };
-async function deriveFromReviews(inputs, client) {
-  const records = /* @__PURE__ */ new Map();
-  const status = await client.status();
-  if (!status.available) return { status, records };
-  const identity = await client.detect();
-  const kind = identity?.kind ?? "github";
-  const bySha = /* @__PURE__ */ new Map();
-  const changeFor = (sha) => {
-    let pending = bySha.get(sha);
-    if (pending === void 0) {
-      pending = client.mergedChangeFor(sha);
-      bySha.set(sha, pending);
-    }
-    return pending;
-  };
-  for (const input of inputs) {
-    if (input.sha === null) {
-      records.set(input.label, NOTHING);
-      continue;
-    }
-    const change = await changeFor(input.sha);
-    records.set(input.label, factsFrom(change, kind));
-  }
-  return { status, records };
-}
-function factsFrom(change, kind) {
-  if (change === null || change.approvals.length === 0) return NOTHING;
-  const ordered = byTime(change.approvals);
-  const latest = ordered.at(-1);
-  if (latest === void 0) return NOTHING;
-  const evidence = kind === "gitlab" ? `gitlab MR !${change.id}` : `github PR #${change.id}`;
-  const dateEvidence = kind === "gitlab" ? `${evidence} (merge date; GitLab records no approval time)` : evidence;
-  return {
-    "reviewed-by": {
-      value: ordered.map((a) => a.login),
-      source: kind,
-      evidence
-    },
-    "last-reviewed": {
-      value: utcDate(latest.submittedAt),
-      source: kind,
-      evidence: dateEvidence
-    }
-  };
-}
-function utcDate(iso) {
-  const ms = Date.parse(iso);
-  if (Number.isNaN(ms)) return iso;
-  return new Date(ms).toISOString().slice(0, 10);
-}
-
-// src/meta/core/derive/git.ts
-import { constants as bufferConstants } from "node:buffer";
-import { spawn as spawn2 } from "node:child_process";
-import { availableParallelism } from "node:os";
-import { dirname as dirname4, extname as extname2, isAbsolute as isAbsolute4, posix as posix4, relative as relative6, sep as sep5 } from "node:path";
-import { parse as parseYaml3 } from "yaml";
-
-// src/shared/concurrency.ts
-async function mapConcurrent(items2, limit, fn) {
-  const out = new Array(items2.length);
-  let next = 0;
-  const workers = Array.from(
-    { length: Math.max(1, Math.min(limit, items2.length)) },
-    async () => {
-      for (; ; ) {
-        const i = next++;
-        const item = items2[i];
-        if (i >= items2.length || item === void 0) return;
-        out[i] = await fn(item);
-      }
-    }
-  );
-  await Promise.all(workers);
-  return out;
-}
-
-// src/meta/core/derive/git.ts
-var DEFAULT_BULK_THRESHOLD = 32;
-var NULL_SHA = "0".repeat(40);
-var MAX_GIT_OUTPUT_BYTES = Math.min(
-  512 * 1024 * 1024,
-  bufferConstants.MAX_STRING_LENGTH
-);
-var HistoryTooLarge = class extends Error {
-};
-var BlobsUnreadable = class extends Error {
-  constructor(detail) {
-    super(detail);
-    this.detail = detail;
-  }
-  detail;
-};
-var BlameUnreadable = class extends Error {
-  constructor(rel, detail) {
-    super(rel);
-    this.rel = rel;
-    this.detail = detail;
-  }
-  rel;
-  detail;
-};
-function bodyOf(content, fenced) {
-  if (fenced !== true) return content;
-  const loc = locateFrontmatter(content);
-  if (!loc) return content;
-  return content.slice(0, loc.openStart) + content.slice(loc.closeEnd);
-}
-async function deriveFromGit(inputs, opts) {
-  const records = /* @__PURE__ */ new Map();
-  const byRoot = groupByRoot(inputs);
-  if (byRoot.size === 0) {
-    return {
-      status: {
-        available: false,
-        reason: "no git repository contains the documents"
-      },
-      records
-    };
-  }
-  const threshold = opts.bulkThreshold ?? DEFAULT_BULK_THRESHOLD;
-  const machines = opts.machines ?? DEFAULT_MACHINES;
-  const wantsProvenance = opts.fields?.includes(PROVENANCE_FIELD) ?? false;
-  const maxBytes = opts.maxOutputBytes ?? MAX_GIT_OUTPUT_BYTES;
-  const parse = yamlOnce();
-  const reasons = [];
-  for (const [root, bucket] of byRoot) {
-    const run2 = (args, stdin) => runGit(args, root, stdin, maxBytes);
-    const shallow = await run2(["rev-parse", "--is-shallow-repository"]);
-    if (shallow.missing) {
-      return {
-        status: { available: false, reason: "git is not on PATH" },
-        records: /* @__PURE__ */ new Map()
-      };
-    }
-    if (shallow.code !== 0) {
-      reasons.push(`git could not read the repository at ${root}`);
-      continue;
-    }
-    if (text(shallow).trim() === "true") {
-      reasons.push(
-        `this checkout is shallow; use actions/checkout with fetch-depth: 0 (${root})`
-      );
-      continue;
-    }
-    try {
-      const found = await histories(
-        run2,
-        bucket.map((e) => e.rel),
-        threshold
-      );
-      if (found === null) {
-        reasons.push(`git could not read the history at ${root}`);
-        continue;
-      }
-      await readOtherParentBlobs(run2, found);
-      const blobs = await fetchBlobs(run2, neededBlobs(found));
-      if (!await followTakenBodies(run2, bucket, found, blobs, threshold)) {
-        reasons.push(`git could not read the history at ${root}`);
-        continue;
-      }
-      const manifestStamps = await stampsInManifests(run2, root, bucket, found, blobs, parse);
-      const facts = bucket.map(
-        (entry) => judge(
-          entry.input,
-          root,
-          found.get(entry.rel) ?? [],
-          blobs,
-          opts.now,
-          machines,
-          manifestStamps.get(entry.input.label)
-        )
-      );
-      if (wantsProvenance) {
-        const pages = await mapConcurrent(bucket, GIT_CONCURRENCY, async (entry) => ({
-          entry,
-          blame: await blameOf(run2, entry.rel, entry.input.content),
-          history: found.get(entry.rel) ?? []
-        }));
-        const evidence = await commitEvidence(run2, root, pages, blobs, parse);
-        const provenanceRun = {
-          machines,
-          ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
-        };
-        pages.forEach((page, i) => {
-          const judged = facts[i];
-          const commits = evidence[i];
-          if (judged === void 0 || commits === void 0) return;
-          const derived = provenanceFor(page.entry, page.blame, commits, provenanceRun);
-          judged.provenance = derived.value;
-          judged.provenanceDerivation = derived.derivation;
-        });
-      }
-      bucket.forEach((entry, i) => {
-        const judged = facts[i];
-        if (judged !== void 0) records.set(entry.input.label, judged);
-      });
-    } catch (err) {
-      if (err instanceof BlobsUnreadable) {
-        reasons.push(`git cat-file could not read the history (${root}): ${err.detail}`);
-        continue;
-      }
-      if (err instanceof BlameUnreadable) {
-        const why = err.detail === "" ? "" : `: ${err.detail}`;
-        reasons.push(`git blame could not read ${err.rel} (${root})${why}`);
-        continue;
-      }
-      if (!(err instanceof HistoryTooLarge)) throw err;
-      reasons.push(`git history is too large to read in one pass (${root})`);
-      continue;
-    }
-  }
-  if (reasons.length > 0) {
-    return {
-      status: { available: false, reason: reasons.join("; ") },
-      records: /* @__PURE__ */ new Map()
-    };
-  }
-  return { status: { available: true }, records };
-}
-function groupByRoot(inputs) {
-  const rootOf = /* @__PURE__ */ new Map();
-  const byRoot = /* @__PURE__ */ new Map();
-  for (const input of inputs) {
-    const dir = dirname4(input.absPath);
-    let root = rootOf.get(dir);
-    if (root === void 0) {
-      root = findGitRoot(dir);
-      rootOf.set(dir, root);
-    }
-    if (root === null) continue;
-    const rel = relative6(root, input.absPath).split(sep5).join("/");
-    const bucket = byRoot.get(root);
-    if (bucket) bucket.push({ input, rel });
-    else byRoot.set(root, [{ input, rel }]);
-  }
-  return byRoot;
-}
-var RECORD_FORMAT = "--format=%x1e%H%x00%aI%x00%an%x00%ae%x00%(trailers:key=Co-authored-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Reviewed-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Generated-by,valueonly,unfold,separator=%x1f)%x00%P";
-var LOG_ARGS = [
-  "-c",
-  "core.quotePath=false",
-  "log",
-  "--raw",
-  "--diff-merges=first-parent",
-  "-M",
-  "--no-abbrev",
-  RECORD_FORMAT
-];
-function histories(run2, rels, threshold, rev = "HEAD") {
-  return rels.length <= threshold ? perFileHistories(run2, rels, rev) : bulkHistories(run2, rels, rev);
-}
-async function perFileHistories(run2, rels, rev) {
-  const found = /* @__PURE__ */ new Map();
-  for (const rel of rels) {
-    const records = await lineage(run2, rel, rev);
-    if (records === null) {
-      if (await isUnbornHead(run2)) return found;
-      return null;
-    }
-    found.set(rel, attribute(records, [rel]).get(rel) ?? []);
-  }
-  return found;
-}
-async function lineage(run2, rel, rev) {
-  const records = [];
-  let at2 = rel;
-  let from = rev;
-  for (; ; ) {
-    const out = await run2([...LOG_ARGS, from, "--", pathspec(at2)]);
-    if (out.tooLarge) throw new HistoryTooLarge();
-    if (out.code !== 0) return null;
-    let renamedFrom;
-    for (const record of parseLog(text(out))) {
-      const status = record.raw.find((e) => e.newPath === at2)?.status;
-      if (status === "A" || status === "D") {
-        const whole = await run2([...LOG_ARGS, "-1", record.sha]);
-        if (whole.tooLarge) throw new HistoryTooLarge();
-        if (whole.code !== 0) return null;
-        record.raw = parseLog(text(whole))[0]?.raw ?? [];
-        const entry = record.raw.find((e) => e.newPath === at2);
-        if (entry !== void 0 && entry.oldPath !== at2) renamedFrom = entry.oldPath;
-      }
-      records.push(record);
-      if (renamedFrom !== void 0) {
-        from = `${record.sha}^`;
-        break;
-      }
-    }
-    if (renamedFrom === void 0) return records;
-    at2 = renamedFrom;
-  }
-}
-async function bulkHistories(run2, rels, rev) {
-  const out = await run2([...LOG_ARGS, rev]);
-  if (out.tooLarge) throw new HistoryTooLarge();
-  if (out.code !== 0) {
-    if (await isUnbornHead(run2)) return /* @__PURE__ */ new Map();
-    return null;
-  }
-  return attribute(parseLog(text(out)), [...rels]);
-}
-async function followTakenBodies(run2, bucket, found, blobs, threshold) {
-  for (; ; ) {
-    const byParent = /* @__PURE__ */ new Map();
-    for (const entry of bucket) {
-      const history = found.get(entry.rel) ?? [];
-      const taken = takenMerge(entry.input.extracted.fenced, history, blobs);
-      if (taken === void 0) continue;
-      const group = byParent.get(taken.parent) ?? [];
-      group.push({ rel: entry.rel, keep: history.slice(0, taken.index), path: taken.path });
-      byParent.set(taken.parent, group);
-    }
-    if (byParent.size === 0) return true;
-    const walked = /* @__PURE__ */ new Map();
-    for (const [parent, group] of byParent) {
-      const paths = [...new Set(group.map((g) => g.path))];
-      const side = await histories(run2, paths, threshold, parent);
-      if (side === null) return false;
-      for (const g of group) {
-        const tail = side.get(g.path) ?? [];
-        walked.set(g.rel, tail);
-        found.set(g.rel, [...g.keep, ...tail]);
-      }
-    }
-    await readOtherParentBlobs(run2, walked);
-    const missing = new Set([...neededBlobs(walked)].filter((sha) => !blobs.has(sha)));
-    for (const [sha, content] of await fetchBlobs(run2, missing)) blobs.set(sha, content);
-  }
-}
-function takenMerge(fenced, history, blobs) {
-  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
-  const index = history.findIndex((h) => !sameBody(blobBody(h.newBlob), blobBody(h.oldBlob)));
-  const newest = history[index];
-  if (newest === void 0) return void 0;
-  const body = blobBody(newest.newBlob);
-  const k = newest.otherParentBlobs.findIndex((b) => b !== null && sameBody(body, blobBody(b)));
-  const parent = newest.otherParents[k];
-  if (k === -1 || parent === void 0) return void 0;
-  return { index, parent, path: newest.pathAtCommit };
-}
-function pathspec(rel) {
-  return /[*?[\]]/.test(rel) ? `:(literal)${rel}` : rel;
-}
-async function isUnbornHead(run2) {
-  const out = await run2(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
-  return !out.missing && out.code !== 0;
-}
-function parseLog(text2) {
-  const records = [];
-  for (const chunk of text2.split("")) {
-    if (chunk === "") continue;
-    const nl = chunk.indexOf("\n");
-    const header = nl === -1 ? chunk : chunk.slice(0, nl);
-    const fields = header.split("\0");
-    const sha = fields[0];
-    if (sha === void 0 || sha === "") continue;
-    const raw = [];
-    if (nl !== -1) {
-      for (const line of chunk.slice(nl + 1).split("\n")) {
-        const entry = parseRawLine(line);
-        if (entry) raw.push(entry);
-      }
-    }
-    records.push({
-      sha,
-      authorDate: fields[1] ?? "",
-      authorName: fields[2] ?? "",
-      authorEmail: fields[3] ?? "",
-      coAuthors: splitTrailers(fields[4]),
-      reviewedBy: splitTrailers(fields[5]),
-      generatedBy: splitTrailers(fields[6]),
-      parents: (fields[7] ?? "").trim().split(" ").filter((p) => p !== ""),
-      raw
-    });
-  }
-  return records;
-}
-function splitTrailers(field) {
-  if (field === void 0 || field === "") return [];
-  return field.split("").map((s) => s.trim()).filter((s) => s !== "");
-}
-function parseRawLine(line) {
-  if (!line.startsWith(":")) return null;
-  const tab = line.indexOf("	");
-  if (tab === -1) return null;
-  const meta = line.slice(1, tab).split(" ");
-  const oldBlob = meta[2];
-  const newBlob = meta[3];
-  const status = meta[4];
-  if (oldBlob === void 0 || newBlob === void 0 || status === void 0) {
-    return null;
-  }
-  const paths = line.slice(tab + 1).split("	").map(unquotePath);
-  const first = paths[0];
-  if (first === void 0) return null;
-  const second = paths[1];
-  const renamed = status.startsWith("R") || status.startsWith("C");
-  return {
-    status,
-    oldBlob,
-    newBlob,
-    oldPath: first,
-    newPath: renamed && second !== void 0 ? second : first
-  };
-}
-function unquotePath(p) {
-  if (p.length < 2 || !p.startsWith('"') || !p.endsWith('"')) return p;
-  const inner = p.slice(1, -1);
-  const bytes = [];
-  for (let i = 0; i < inner.length; i += 1) {
-    const ch = inner[i];
-    if (ch !== "\\") {
-      bytes.push(...Buffer.from(ch ?? "", "utf8"));
-      continue;
-    }
-    const next = inner[i + 1];
-    if (next === void 0) break;
-    const octal = /^[0-7]{3}/.exec(inner.slice(i + 1));
-    if (octal) {
-      bytes.push(parseInt(octal[0], 8));
-      i += 3;
-      continue;
-    }
-    const simple = {
-      a: 7,
-      b: 8,
-      t: 9,
-      n: 10,
-      v: 11,
-      f: 12,
-      r: 13,
-      '"': 34,
-      "\\": 92
-    };
-    const code = simple[next];
-    if (code === void 0) bytes.push(...Buffer.from(next, "utf8"));
-    else bytes.push(code);
-    i += 1;
-  }
-  return Buffer.from(bytes).toString("utf8");
-}
-function attribute(records, wanted) {
-  const histories2 = /* @__PURE__ */ new Map();
-  const tracked = /* @__PURE__ */ new Map();
-  for (const rel of wanted) {
-    histories2.set(rel, []);
-    tracked.set(rel, rel);
-  }
-  for (const record of records) {
-    if (record.raw.length === 0) continue;
-    const byNewPath = /* @__PURE__ */ new Map();
-    for (const entry of record.raw) byNewPath.set(entry.newPath, entry);
-    for (const [rel, current] of tracked) {
-      const entry = byNewPath.get(current);
-      if (!entry) continue;
-      histories2.get(rel)?.push({
-        sha: record.sha,
-        authorDate: record.authorDate,
-        authorName: record.authorName,
-        authorEmail: record.authorEmail,
-        coAuthors: record.coAuthors,
-        reviewedBy: record.reviewedBy,
-        generatedBy: record.generatedBy,
-        oldBlob: entry.oldBlob === NULL_SHA ? null : entry.oldBlob,
-        newBlob: entry.newBlob === NULL_SHA ? null : entry.newBlob,
-        pathAtCommit: entry.newPath,
-        otherParents: record.parents.slice(1),
-        otherParentBlobs: []
-      });
-      if (entry.oldPath !== entry.newPath) tracked.set(rel, entry.oldPath);
-    }
-  }
-  return histories2;
-}
-function neededBlobs(histories2) {
-  const shas = /* @__PURE__ */ new Set();
-  for (const history of histories2.values()) {
-    for (const h of history) {
-      if (h.oldBlob !== null) shas.add(h.oldBlob);
-      if (h.newBlob !== null) shas.add(h.newBlob);
-      for (const b of h.otherParentBlobs) if (b !== null) shas.add(b);
-    }
-  }
-  return shas;
-}
-async function readOtherParentBlobs(run2, histories2) {
-  const merges = [];
-  const specs = [];
-  for (const history of histories2.values()) {
-    for (const h of history) {
-      if (h.otherParents.length === 0) continue;
-      merges.push(h);
-      for (const parent of h.otherParents) specs.push(`${parent}:${h.pathAtCommit}`);
-    }
-  }
-  if (specs.length === 0) return;
-  const out = await run2(["cat-file", "--batch-check"], `${specs.join("\n")}
-`);
-  if (out.tooLarge) throw new HistoryTooLarge();
-  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
-  const lines = text(out).split("\n");
-  let i = 0;
-  for (const h of merges) {
-    h.otherParentBlobs = h.otherParents.map(() => blobOfCheckLine(lines[i++]));
-  }
-}
-function blobOfCheckLine(line) {
-  const [sha, kind] = (line ?? "").split(" ");
-  if (sha === void 0 || kind !== "blob" || !/^[0-9a-f]{40,64}$/.test(sha)) return null;
-  return sha;
-}
-async function fetchBlobs(run2, shas) {
-  const blobs = /* @__PURE__ */ new Map();
-  if (shas.size === 0) return blobs;
-  const out = await run2(["cat-file", "--batch"], `${[...shas].join("\n")}
-`);
-  if (out.tooLarge) throw new HistoryTooLarge();
-  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
-  const buf = out.raw;
-  let cursor = 0;
-  while (cursor < buf.length) {
-    const nl = buf.indexOf(10, cursor);
-    if (nl === -1) break;
-    const header = buf.toString("utf8", cursor, nl).split(" ");
-    cursor = nl + 1;
-    const sha = header[0];
-    const kind = header[1];
-    const size = Number(header[2]);
-    if (sha === void 0 || kind !== "blob" || !Number.isFinite(size)) {
-      continue;
-    }
-    blobs.set(sha, buf.toString("utf8", cursor, cursor + size));
-    cursor += size + 1;
-  }
-  return blobs;
-}
-var git = (value, evidence) => ({
-  value,
-  source: "git",
-  evidence
-});
-function factCommits(input, history, blobs) {
-  const fenced = input.extracted.fenced;
-  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
-  const bodyChanging = [...history].reverse().filter((h) => {
-    const body = blobBody(h.newBlob);
-    if (sameBody(body, blobBody(h.oldBlob))) return false;
-    return !h.otherParentBlobs.some((b) => b !== null && sameBody(body, blobBody(b)));
-  });
-  return {
-    bodyChanging,
-    oldest: history[history.length - 1],
-    newestBody: bodyChanging[bodyChanging.length - 1]
-  };
-}
-async function stampsInManifests(run2, root, bucket, histories2, blobs, parse) {
-  const reads = [];
-  for (const entry of bucket) {
-    const refs = entry.input.stampManifests;
-    if (refs === void 0) continue;
-    const { oldest, newestBody } = factCommits(entry.input, histories2.get(entry.rel) ?? [], blobs);
-    for (const field of STAMPED_DATE_FIELDS) {
-      const ref = refs[field];
-      const at2 = field === "created" ? oldest : newestBody;
-      if (ref === void 0 || at2 === void 0) continue;
-      const rel = insideRoot(root, ref.absPath);
-      if (rel === void 0) continue;
-      const key = ref.join === "path" ? entryAt(ref.entry, entry.rel, at2.pathAtCommit) : ref.entry;
-      const revs = field === "created" ? [at2.sha] : [at2.sha, `${at2.sha}^`];
-      for (const rev of revs) {
-        reads.push({ label: entry.input.label, field, rev, spec: `${rev}:${rel}`, key, join: ref.join });
-      }
-    }
-  }
-  const out = /* @__PURE__ */ new Map();
-  if (reads.length === 0) return out;
-  const fetched = await fetchSpecs(run2, [...new Set(reads.map((r) => r.spec))]);
-  const values = /* @__PURE__ */ new Map();
-  const keyOf = (label, field, rev) => `${label}\0${field}\0${rev}`;
-  for (const r of reads) {
-    values.set(keyOf(r.label, r.field, r.rev), manifestValue(fetched.get(r.spec), r.key, r.join, r.field, parse));
-  }
-  for (const label of new Set(reads.map((r) => r.label))) {
-    out.set(label, (field, rev) => values.get(keyOf(label, field, rev)));
-  }
-  return out;
-}
-function judge(input, root, history, blobs, now, machines, manifestStamp2) {
-  const fenced = input.extracted.fenced;
-  const extractor = extractorFor(input);
-  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
-  const stampsOf = (sha) => {
-    if (sha === null) return {};
-    const content = blobs.get(sha);
-    return content === void 0 ? {} : extractStamps(extractor, content, input.absPath);
-  };
-  const stampAt = (field, h, parent) => {
-    const kept = manifestStamp2?.(field, parent ? `${h.sha}^` : h.sha);
-    if (kept !== void 0 && kept !== null) return kept;
-    return stampsOf(parent ? h.oldBlob : h.newBlob)[field];
-  };
-  const { bodyChanging, oldest, newestBody } = factCommits(input, history, blobs);
-  const head = history[0];
-  const headBlob = head === void 0 ? null : head.newBlob;
-  const created = oldest === void 0 ? null : createdOf(oldest, stampAt("created", oldest, false));
-  const workingChanged = !sameBody(
-    bodyOf(input.content, fenced),
-    headBlob === null ? null : blobBody(headBlob)
-  );
-  let lastUpdated;
-  let lastBodyCommit;
-  if (workingChanged) {
-    lastBodyCommit = null;
-    const working = input.extracted.data["last-updated"];
-    const committed = stampsOf(headBlob)["last-updated"];
-    lastUpdated = working !== void 0 && working !== null && !sameValue(working, committed) ? git(working, "stamped in working tree") : git(utcDate2(now()), "uncommitted body change");
-  } else if (newestBody === void 0) {
-    lastBodyCommit = null;
-    lastUpdated = null;
-  } else {
-    lastBodyCommit = newestBody.sha;
-    lastUpdated = lastUpdatedOf(
-      newestBody,
-      stampAt("last-updated", newestBody, false),
-      stampAt("last-updated", newestBody, true)
-    );
-  }
-  const authors = bodyChanging.length === 0 ? null : authorsOf(bodyChanging, machines);
-  let reviewedBy = null;
-  let lastReviewed = null;
-  if (!workingChanged && newestBody !== void 0 && newestBody.reviewedBy.length > 0) {
-    const evidence = `Reviewed-by trailer in ${short2(newestBody.sha)}`;
-    reviewedBy = git(newestBody.reviewedBy.map(nameOf), evidence);
-    lastReviewed = git(datePart(newestBody.authorDate), evidence);
-  }
-  return {
-    created,
-    "last-updated": lastUpdated,
-    authors,
-    "reviewed-by": reviewedBy,
-    "last-reviewed": lastReviewed,
-    provenance: null,
-    lastBodyCommit,
-    root
-  };
-}
-function createdOf(oldest, stamp) {
-  if (stamp !== void 0 && stamp !== null) {
-    return git(stamp, `stamped in ${short2(oldest.sha)}`);
-  }
-  const date = datePart(oldest.authorDate);
-  return git(date, `added in ${short2(oldest.sha)} (${date})`);
-}
-function lastUpdatedOf(commit, stamp, before) {
-  if (stamp !== void 0 && stamp !== null && !sameValue(stamp, before)) {
-    return git(stamp, `stamped in ${short2(commit.sha)}`);
-  }
-  const date = datePart(commit.authorDate);
-  return git(date, `body changed in ${short2(commit.sha)} (${date})`);
-}
-function authorsOf(bodyChanging, machines) {
-  const seen = /* @__PURE__ */ new Set();
-  const names = [];
-  const add = (name, email) => {
-    if (name === "") return;
-    const identity = email === null || email === "" ? name : `${name} <${email}>`;
-    if (machineIdentity(identity, machines) !== void 0) return;
-    const key = email === null || email === "" ? `name:${name.toLowerCase()}` : email.toLowerCase();
-    if (seen.has(key)) return;
-    seen.add(key);
-    names.push(name);
-  };
-  for (const h of bodyChanging) {
-    add(h.authorName, h.authorEmail);
-    for (const co of h.coAuthors) add(nameOf(co), emailOf(co));
-  }
-  const n = bodyChanging.length;
-  return git(names, `${n} body-changing ${n === 1 ? "commit" : "commits"}`);
-}
-function provenanceFenced(extracted) {
-  return extracted.fenced === true || extracted.format === "markdown" || extracted.format === "mdx";
-}
-var OUTSIDE_RANGE = "outside-the-attributed-range";
-var ATTRIBUTED = ":attributed";
-function provenanceFor(entry, blame, commits, opts) {
-  const { input } = entry;
-  const fenced = provenanceFenced(input.extracted);
-  const base = { content: input.content, commits, machines: opts.machines, fenced };
-  let derivation;
-  const attribution = input.attribution;
-  if (attribution !== void 0) {
-    const page = readProvenancePage(input.content, { fenced });
-    const { bodyLine } = page;
-    const ranges = attribution.targets.flatMap((target) => {
-      const entry2 = attributeRange({ ...base, blame, target, generatedBy: attribution.generatedBy, page });
-      const span = entry2 === void 0 ? void 0 : parseLines(entry2.lines);
-      return span === void 0 ? [] : [toFileLines(span, bodyLine)];
-    });
-    const inRange = (line) => ranges.some((range) => line.finalLine >= range.start && line.finalLine <= range.end);
-    const attributed = new Map(commits);
-    const trailers = { generatedBy: [attribution.generatedBy], coAuthoredBy: [] };
-    attributed.set(OUTSIDE_RANGE, { sha: OUTSIDE_RANGE, trailers: { generatedBy: [], coAuthoredBy: [] } });
-    const rekeyed = blame.map((line) => {
-      if (inRange(line)) {
-        if (line.uncommitted) return line;
-        const sha = `${line.sha}${ATTRIBUTED}`;
-        attributed.set(sha, { sha, trailers });
-        return { ...line, sha };
-      }
-      return line.uncommitted ? { ...line, sha: OUTSIDE_RANGE, uncommitted: false } : line;
-    });
-    derivation = deriveProvenance({
-      ...base,
-      commits: attributed,
-      generatedBy: attribution.generatedBy,
-      blame: rekeyed
-    });
-  } else {
-    derivation = deriveProvenance({
-      ...base,
-      blame,
-      ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
-    });
-  }
-  const entries = derivation.derived.map((d) => d.entry);
-  return {
-    value: entries.length === 0 ? null : git(entries, provenanceEvidence(derivation)),
-    derivation
-  };
-}
-function provenanceEvidence(derivation) {
-  const shas = [];
-  let uncommitted = false;
-  for (const range of derivation.derived) {
-    for (let n = range.span.start; n <= range.span.end; n++) {
-      const evidence = derivation.evidenceByLine.get(n);
-      if (evidence?.machine === void 0) continue;
-      if (evidence.rule === 1) uncommitted = true;
-      else if (!shas.includes(evidence.sha)) shas.push(evidence.sha);
-    }
-  }
-  const first = shas[0];
-  if (first === void 0) return "uncommitted";
-  const parts = [`blame ${short2(first)}`];
-  if (shas.length > 1) parts.push(`${String(shas.length)} commits`);
-  if (uncommitted) parts.push("uncommitted");
-  return parts.join(", ");
-}
-async function blameOf(run2, rel, content) {
-  const out = await run2([
-    "-c",
-    "core.quotePath=false",
-    "blame",
-    "--no-ignore-revs-file",
-    "--line-porcelain",
-    "--",
-    rel
-  ]);
-  if (out.tooLarge) throw new HistoryTooLarge();
-  if (out.code !== 0) {
-    const inHead = await run2(["cat-file", "-e", `HEAD:${rel}`]);
-    if (inHead.code !== 0) {
-      return splitLines(content).map((line, i) => ({
-        sha: ZERO_SHA,
-        origLine: i + 1,
-        finalLine: i + 1,
-        author: "Not Committed Yet",
-        authorMail: "not.committed.yet",
-        filename: rel,
-        boundary: false,
-        uncommitted: true,
-        content: line
-      }));
-    }
-    throw new BlameUnreadable(rel, out.stderr.trim());
-  }
-  return parseLinePorcelain(text(out));
-}
-async function commitEvidence(run2, root, pages, blobs, parse) {
-  const plans = pages.map(({ entry, blame, history }) => {
-    const pathAt = /* @__PURE__ */ new Map();
-    for (const line of blame) {
-      if (!line.uncommitted && !pathAt.has(line.sha)) pathAt.set(line.sha, unquotePath(line.filename));
-    }
-    const trailers = /* @__PURE__ */ new Map();
-    const pageBlob = /* @__PURE__ */ new Map();
-    for (const h of history) {
-      trailers.set(h.sha, { generatedBy: h.generatedBy, coAuthoredBy: h.coAuthors });
-      const blob = h.newBlob === null ? void 0 : blobs.get(h.newBlob);
-      if (blob !== void 0) pageBlob.set(h.sha, blob);
-    }
-    const manifest = entry.input.provenanceManifest;
-    const manifestRel = manifest === void 0 ? void 0 : insideRoot(root, manifest.absPath);
-    return { entry, pathAt, trailers, pageBlob, manifest, manifestRel };
-  });
-  const unlogged = /* @__PURE__ */ new Set();
-  const specs = /* @__PURE__ */ new Set();
-  for (const { pathAt, trailers, pageBlob, manifestRel } of plans) {
-    for (const [sha, path] of pathAt) {
-      if (!trailers.has(sha)) unlogged.add(sha);
-      if (!pageBlob.has(sha)) specs.add(`${sha}:${path}`);
-      if (manifestRel !== void 0) specs.add(`${sha}:${manifestRel}`);
-    }
-  }
-  const logged = /* @__PURE__ */ new Map();
-  if (unlogged.size > 0) {
-    const out = await run2(["log", "--no-walk=unsorted", "--stdin", RECORD_FORMAT], `${[...unlogged].join("\n")}
-`);
-    if (out.tooLarge) throw new HistoryTooLarge();
-    if (out.code !== 0) throw new BlobsUnreadable(`git log exit ${String(out.code)}`);
-    for (const record of parseLog(text(out))) {
-      logged.set(record.sha, { generatedBy: record.generatedBy, coAuthoredBy: record.coAuthors });
-    }
-  }
-  const fetched = await fetchSpecs(run2, [...specs]);
-  return plans.map(({ entry, pathAt, trailers, pageBlob, manifest, manifestRel }) => {
-    const commits = /* @__PURE__ */ new Map();
-    for (const [sha, path] of pathAt) {
-      const blob = pageBlob.get(sha) ?? fetched.get(`${sha}:${path}`);
-      commits.set(sha, {
-        sha,
-        trailers: trailers.get(sha) ?? logged.get(sha) ?? { generatedBy: [], coAuthoredBy: [] },
-        ...blob !== void 0 ? { blob } : {},
-        ...manifest !== void 0 ? {
-          stamp: manifestRel === void 0 ? [] : manifestStamp(
-            fetched.get(`${sha}:${manifestRel}`),
-            manifest.join === "path" ? entryAt(manifest.entry, entry.rel, path) : manifest.entry,
-            manifest.join,
-            parse
-          )
-        } : {}
-      });
-    }
-    return commits;
-  });
-}
-function insideRoot(root, abs) {
-  const rel = relative6(root, abs);
-  if (rel === "" || rel.startsWith("..") || isAbsolute4(rel)) return void 0;
-  return rel.split(sep5).join("/");
-}
-function entryAt(entry, rel, relAtCommit) {
-  if (relAtCommit === rel) return entry;
-  const fromHere = posix4.relative(posix4.dirname(rel), relAtCommit);
-  return posix4.join(posix4.dirname(entry), fromHere);
-}
-function manifestStamp(text2, key, join5, parse) {
-  return provenanceEntries(manifestValue(text2, key, join5, PROVENANCE_FIELD, parse));
-}
-function yamlOnce() {
-  const parsed = /* @__PURE__ */ new Map();
-  return (text2) => {
-    if (parsed.has(text2)) return parsed.get(text2);
-    let data;
-    try {
-      data = parseYaml3(text2);
-    } catch {
-      data = void 0;
-    }
-    parsed.set(text2, data);
-    return data;
-  };
-}
-function manifestValue(text2, key, join5, field, parse) {
-  if (text2 === void 0) return void 0;
-  const data = parse(text2);
-  if (!isRecord6(data)) return void 0;
-  for (const [candidate, value] of Object.entries(data)) {
-    const same = join5 === "path" ? posix4.normalize(candidate) === posix4.normalize(key) : candidate === key;
-    if (same && isRecord6(value)) return value[field];
-  }
-  return void 0;
-}
-function isRecord6(x) {
-  return typeof x === "object" && x !== null && !Array.isArray(x);
-}
-async function fetchSpecs(run2, specs) {
-  const found = /* @__PURE__ */ new Map();
-  if (specs.length === 0) return found;
-  const out = await run2(["cat-file", "--batch"], `${specs.join("\n")}
-`);
-  if (out.tooLarge && specs.length > 1) {
-    const half = Math.ceil(specs.length / 2);
-    const first = await fetchSpecs(run2, specs.slice(0, half));
-    const rest = await fetchSpecs(run2, specs.slice(half));
-    return new Map([...first, ...rest]);
-  }
-  if (out.tooLarge) throw new HistoryTooLarge();
-  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
-  for (const [spec, content] of parseSpecBatch(out.raw, specs)) found.set(spec, content);
-  return found;
-}
-function parseSpecBatch(buf, specs) {
-  const found = /* @__PURE__ */ new Map();
-  let cursor = 0;
-  for (const spec of specs) {
-    const nl = buf.indexOf(10, cursor);
-    if (nl === -1) throw new BlobsUnreadable(`the answer ends before ${spec}`);
-    const header = buf.toString("utf8", cursor, nl);
-    cursor = nl + 1;
-    if (header.endsWith(" missing") || header.endsWith(" ambiguous")) continue;
-    const parts = header.split(" ");
-    const size = Number(parts[2]);
-    if (parts.length !== 3 || !Number.isInteger(size) || size < 0) {
-      throw new BlobsUnreadable(`unreadable header for ${spec}: ${header}`);
-    }
-    if (parts[1] === "blob") found.set(spec, buf.toString("utf8", cursor, cursor + size));
-    cursor += size + 1;
-  }
-  return found;
-}
-function extractorFor(input) {
-  return extractorByName(input.extracted.format) ?? extractorForExtension(extname2(input.absPath));
-}
-function extractStamps(extractor, content, filePath) {
-  if (!extractor) return {};
-  try {
-    return extractor.extract(content, filePath).data;
-  } catch {
-    return {};
-  }
-}
-function sameBody(a, b) {
-  if (a === null || b === null) return a === b;
-  return a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
-}
-function sameValue(a, b) {
-  return toJsonText(a) === toJsonText(b);
-}
-var short2 = (sha) => sha.slice(0, 7);
-var datePart = (iso) => {
-  const d = new Date(iso);
-  return Number.isNaN(d.getTime()) ? "" : utcDate2(d);
-};
-function utcDate2(d) {
-  return d.toISOString().slice(0, 10);
-}
-function nameOf(trailer) {
-  const lt = trailer.lastIndexOf("<");
-  return (lt === -1 ? trailer : trailer.slice(0, lt)).trim();
-}
-function emailOf(trailer) {
-  const m = /<([^>]*)>\s*$/.exec(trailer);
-  return m?.[1]?.trim() ?? null;
-}
-var MAX_STDERR_BYTES = 16 * 1024;
-var GIT_CONCURRENCY = Math.min(8, availableParallelism());
-function text(out) {
-  try {
-    return out.raw.toString("utf8");
-  } catch {
-    throw new HistoryTooLarge();
-  }
-}
-function runGit(args, cwd, stdin, maxBytes) {
-  return new Promise((settle2, reject) => {
-    let done = false;
-    const finish = (out) => {
-      if (done) return;
-      done = true;
-      settle2(out);
-    };
-    const fail = (err) => {
-      if (done) return;
-      done = true;
-      reject(err instanceof Error ? err : new Error(String(err)));
-    };
-    const failed = (missing) => ({
-      code: null,
-      raw: Buffer.alloc(0),
-      missing,
-      tooLarge: false,
-      stderr: ""
-    });
-    let child;
-    try {
-      child = spawn2("git", args, { cwd, windowsHide: true });
-    } catch {
-      finish(failed(true));
-      return;
-    }
-    let chunks = [];
-    let total = 0;
-    let tooLarge = false;
-    child.stdout.on("data", (chunk) => {
-      if (tooLarge) return;
-      total += chunk.length;
-      if (total > maxBytes) {
-        tooLarge = true;
-        chunks = [];
-        child.kill();
-        return;
-      }
-      chunks.push(chunk);
-    });
-    const errChunks = [];
-    let errTotal = 0;
-    child.stderr.on("data", (chunk) => {
-      if (errTotal >= MAX_STDERR_BYTES) return;
-      const kept = chunk.subarray(0, MAX_STDERR_BYTES - errTotal);
-      errTotal += kept.length;
-      errChunks.push(kept);
-    });
-    child.on("error", (err) => {
-      finish(failed(err.code === "ENOENT"));
-    });
-    child.stdin.on("error", () => {
-    });
-    child.on("close", (code) => {
-      try {
-        const raw = tooLarge ? Buffer.alloc(0) : Buffer.concat(chunks);
-        const stderr = Buffer.concat(errChunks).toString("utf8");
-        finish({ code, raw, missing: false, tooLarge, stderr });
-      } catch (err) {
-        fail(err);
-      }
-    });
-    if (stdin === void 0) child.stdin.end();
-    else child.stdin.end(stdin);
-  });
-}
-
-// src/meta/core/derive/index.ts
-var FIELD_SOURCES = {
-  created: ["git"],
-  "last-updated": ["git"],
-  authors: ["git"],
-  owner: ["codeowners"],
-  "reviewed-by": ["github", "gitlab", "git"],
-  "last-reviewed": ["github", "gitlab", "git"],
-  provenance: ["git"]
-};
-var REVIEW_SOURCES = ["github", "gitlab"];
-var HOST_NAME = {
-  github: "GitHub",
-  gitlab: "GitLab"
-};
-function sourcesFor(field, commands) {
-  if (isBuiltinField(field)) return FIELD_SOURCES[field];
-  if (commands !== void 0 && Object.hasOwn(commands, field)) return ["command"];
-  return [];
-}
-function consultedSources(fields, sources, commands) {
-  const needed = /* @__PURE__ */ new Set();
-  for (const field of fields) {
-    for (const s of sourcesFor(field, commands)) needed.add(s);
-  }
-  return sources.filter((s) => needed.has(s));
-}
-function assertSourcesAvailable(sources, hint) {
-  for (const name of Object.keys(sources)) {
-    const status = sources[name];
-    if (status === void 0 || status.available) continue;
-    const reason = status.reason ?? "it could not answer";
-    throw new DocmetaError(
-      `${name} source unavailable: ${reason}${hint === void 0 ? "" : `; ${hint}`}`
-    );
-  }
-}
-async function deriveMetadata(inputs, ctx) {
-  const consulted = new Set(consultedSources(ctx.fields, ctx.sources, ctx.commands));
-  const sources = {};
-  let git2 = /* @__PURE__ */ new Map();
-  if (consulted.has("git")) {
-    const result = await deriveFromGit(inputs, {
-      cwd: ctx.cwd,
-      now: ctx.now,
-      fields: ctx.fields,
-      ...ctx.generatedBy !== void 0 ? { generatedBy: ctx.generatedBy } : {},
-      ...ctx.machines !== void 0 ? { machines: ctx.machines } : {}
-    });
-    sources.git = result.status;
-    git2 = result.records;
-  }
-  const provenance = /* @__PURE__ */ new Map();
-  for (const [label, facts] of git2) {
-    if (facts.provenanceDerivation !== void 0) provenance.set(label, facts.provenanceDerivation);
-  }
-  const rootCache = /* @__PURE__ */ new Map();
-  const rootOf = (absPath) => {
-    const dir = dirname5(absPath);
-    let root = rootCache.get(dir);
-    if (root === void 0) {
-      root = findGitRoot(dir);
-      rootCache.set(dir, root);
-    }
-    return root;
-  };
-  const rootFor = (input) => git2.get(input.label)?.root ?? rootOf(input.absPath);
-  let owners = /* @__PURE__ */ new Map();
-  if (consulted.has("codeowners")) {
-    const result = await deriveFromCodeowners(inputs, {
-      explicit: ctx.codeowners,
-      configDir: ctx.configDir,
-      rootOf
-    });
-    sources.codeowners = result.status;
-    owners = result.records;
-  }
-  const requested = REVIEW_SOURCES.filter((s) => consulted.has(s));
-  let reviews = /* @__PURE__ */ new Map();
-  if (requested.length > 0) {
-    if (!consulted.has("git")) {
-      for (const s of requested) {
-        sources[s] = {
-          available: false,
-          reason: `the ${s} source needs the git source to find each document's commits; add git to sources`
-        };
-      }
-    } else if (sources.git?.available === false) {
-      for (const s of requested) {
-        sources[s] = {
-          available: false,
-          reason: `the git source could not answer, so the ${s} source cannot locate any commit`
-        };
-      }
-    } else {
-      const result = await deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested);
-      Object.assign(sources, result.status);
-      reviews = result.records;
-    }
-  }
-  let commanded = /* @__PURE__ */ new Map();
-  const doomed = Object.values(sources).some((s) => !s.available);
-  if (consulted.has("command") && ctx.commands !== void 0 && !doomed) {
-    const wanted = new Set(ctx.fields);
-    const commands = Object.fromEntries(
-      Object.entries(ctx.commands).filter(([field]) => wanted.has(field))
-    );
-    if (Object.keys(commands).length > 0) {
-      const result = await deriveFromCommands(inputs, commands, { cwd: ctx.configDir ?? ctx.cwd });
-      sources.command = result.status;
-      commanded = result.records;
-    }
-  }
-  const records = /* @__PURE__ */ new Map();
-  for (const input of inputs) {
-    const fields = {};
-    const g = git2.get(input.label);
-    const r = reviews.get(input.label);
-    const c = commanded.get(input.label);
-    for (const field of ctx.fields) {
-      let value = null;
-      for (const source of sourcesFor(field, ctx.commands)) {
-        if (!consulted.has(source)) continue;
-        const candidate = valueFrom(source, field, g, r, owners.get(input.label), c);
-        if (candidate !== null) {
-          value = candidate;
-          break;
-        }
-      }
-      fields[field] = value;
-    }
-    records.set(input.label, { file: input.label, fields });
-  }
-  return { records, sources, ...provenance.size > 0 ? { provenance } : {} };
-}
-function valueFrom(source, field, git2, reviews, owner, commanded) {
-  switch (source) {
-    case "git":
-      if (git2 === void 0 || !isBuiltinField(field) || field === "owner") return null;
-      return git2[field];
-    case "command":
-      return commanded?.[field] ?? null;
-    case "codeowners":
-      return field === "owner" ? owner ?? null : null;
-    case "github":
-    case "gitlab": {
-      if (reviews === void 0) return null;
-      if (field !== "reviewed-by" && field !== "last-reviewed") return null;
-      const fact = reviews[field];
-      return fact !== null && fact.source === source ? fact : null;
-    }
-  }
-}
-async function deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested) {
-  const byRoot = /* @__PURE__ */ new Map();
-  for (const input of inputs) {
-    const root = rootFor(input);
-    if (root === null) continue;
-    const bucket = byRoot.get(root) ?? [];
-    bucket.push(input);
-    byRoot.set(root, bucket);
-  }
-  const status = {};
-  const records = /* @__PURE__ */ new Map();
-  const unavailable2 = (which, reason) => {
-    for (const s of which) status[s] = { available: false, reason };
-    return { status, records: /* @__PURE__ */ new Map() };
-  };
-  if (byRoot.size === 0) {
-    return unavailable2(requested, "no git repository contains the documents");
-  }
-  const cacheDir = resolve5(ctx.configDir ?? ctx.cwd, REVIEW_CACHE_DIR);
-  for (const [root, bucket] of byRoot) {
-    const client = ctx.reviews ?? await createReviewClient(root, { cwd: ctx.cwd, cache: ctx.cache, cacheDir, requested });
-    const identity = await client.detect();
-    if (identity === null) {
-      const s = await client.status();
-      return unavailable2(requested, s.reason ?? "no origin remote to tell GitHub from GitLab");
-    }
-    const source = identity.kind;
-    if (!requested.includes(source)) {
-      return unavailable2(
-        requested,
-        `the origin remote is ${identity.host}, which is ${HOST_NAME[source]}; add ${source} to sources, or drop reviewed-by and last-reviewed from the managed fields`
-      );
-    }
-    const result = await deriveFromReviews(
-      bucket.map((input) => ({
-        label: input.label,
-        sha: git2.get(input.label)?.lastBodyCommit ?? null
-      })),
-      client
-    );
-    if (!result.status.available) {
-      status[source] = result.status;
-      return { status, records: /* @__PURE__ */ new Map() };
-    }
-    status[source] = result.status;
-    for (const [label, facts] of result.records) records.set(label, facts);
-  }
-  return { status, records };
-}
-
-// src/meta/core/derive/table.ts
-var DERIVED_VIEW = "derived";
-var DERIVED_ROWS = "_derived_rows";
-var RESOLVED_VIEW = "resolved";
-var ORIGIN_COLUMN = "_origin";
-var SOURCES_COLUMN = "_sources";
-function derivedColumns(commands) {
-  return ["_path", ...derivableFields(commands), SOURCES_COLUMN];
-}
-function mentionsDerived(sql) {
-  return /\b(?:from|join|update|into|table|view)\s+(?:"derived"|derived\b)/i.test(sql);
-}
-function fieldsForSql(sql, fields) {
-  const named = (field) => new RegExp(`(?<![\\w-])${escapeRegExp(field)}(?![\\w-])`, "i").test(sql);
-  if (sql.includes("*") || /\b_(?:sources|origin)\b/i.test(sql)) {
-    return fields.filter((field) => field !== PROVENANCE_FIELD || named(field));
-  }
-  return fields.filter(named);
-}
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function createDerivedView(db, records, columns) {
-  const quoted = columns.map(quoteIdent);
-  db.exec(
-    `CREATE TABLE ${DERIVED_ROWS} (${quoted.map((c, i) => i === 0 ? `${c} TEXT PRIMARY KEY` : `${c} TEXT`).join(", ")})`
-  );
-  const insert = db.prepare(
-    `INSERT INTO ${DERIVED_ROWS} VALUES (${quoted.map(() => "?").join(", ")})`
-  );
-  const fields = columns.slice(1, -1);
-  db.exec("BEGIN");
-  let committed = false;
-  try {
-    for (const [label, record] of records) {
-      const sources = {};
-      const values = fields.map((field) => {
-        const derived = record.fields[field];
-        if (derived == null) return null;
-        sources[field] = { source: derived.source, evidence: derived.evidence };
-        return bindValue(derived.value);
-      });
-      insert.run(label, ...values, JSON.stringify(sources));
-    }
-    db.exec("COMMIT");
-    committed = true;
-  } finally {
-    if (!committed) db.exec("ROLLBACK");
-  }
-  db.exec(`CREATE VIEW ${DERIVED_VIEW} AS SELECT * FROM ${DERIVED_ROWS}`);
-}
-function resolvedColumns(docsColumns, commands) {
-  const columns = ["_path"];
-  const seen = /* @__PURE__ */ new Set(["_path", ORIGIN_COLUMN, SOURCES_COLUMN]);
-  for (const column of docsColumns) {
-    if (seen.has(column) || RESERVED.has(column)) continue;
-    seen.add(column);
-    columns.push(column);
-  }
-  for (const field of derivableFields(commands)) {
-    if (seen.has(field)) continue;
-    seen.add(field);
-    columns.push(field);
-  }
-  columns.push(ORIGIN_COLUMN, SOURCES_COLUMN);
-  return columns;
-}
-function mentionsResolved(sql) {
-  return /\b(?:from|join|update|into|table|view)\s+(?:"resolved"|resolved\b)/i.test(sql);
-}
-function jsonPath(field) {
-  return `$.${JSON.stringify(field)}`;
-}
-function sqlString(value) {
-  return `'${value.replaceAll("'", "''")}'`;
-}
-function createResolvedView(db, docsColumns, commands) {
-  const columns = resolvedColumns(docsColumns, commands);
-  const fields = columns.slice(1, -2);
-  const inDocs = new Set(docsColumns);
-  const inDerived = new Set(derivableFields(commands));
-  const selects = [`d.${quoteIdent("_path")} AS ${quoteIdent("_path")}`];
-  const origin = [];
-  for (const field of fields) {
-    const path = sqlString(jsonPath(field));
-    const asserted = `json_type(d.${quoteIdent("_data")}, ${path}) IS NOT NULL`;
-    const assertedValue = inDocs.has(field) ? `d.${quoteIdent(field)}` : `d.${quoteIdent("_data")} ->> ${path}`;
-    if (inDerived.has(field)) {
-      const derivedValue = `r.${quoteIdent(field)}`;
-      selects.push(
-        `CASE WHEN ${asserted} THEN ${assertedValue} ELSE ${derivedValue} END AS ${quoteIdent(field)}`
-      );
-      origin.push(
-        `${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' WHEN ${derivedValue} IS NOT NULL THEN 'derived' END`
-      );
-    } else {
-      selects.push(`${assertedValue} AS ${quoteIdent(field)}`);
-      origin.push(`${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' END`);
-    }
-  }
-  selects.push(
-    `json_patch('{}', json_object(${origin.join(", ")})) AS ${quoteIdent(ORIGIN_COLUMN)}`
-  );
-  selects.push(`r.${quoteIdent(SOURCES_COLUMN)} AS ${quoteIdent(SOURCES_COLUMN)}`);
-  db.exec(
-    `CREATE VIEW ${RESOLVED_VIEW} AS SELECT ${selects.join(", ")} FROM docs d LEFT JOIN ${DERIVED_ROWS} r USING (${quoteIdent("_path")})`
-  );
-}
-async function deriveForTable(inputs, ctx, hint, fields) {
-  const derive = ctx.config?.derive;
-  const commands = commandsOf(derive);
-  const managesProvenance = derive?.fields?.includes(PROVENANCE_FIELD) === true && !fields.includes(PROVENANCE_FIELD);
-  const result = await deriveMetadata(inputs, {
-    cwd: ctx.cwd,
-    base: ctx.base,
-    ...ctx.configDir !== void 0 ? { configDir: ctx.configDir } : {},
-    sources: derive?.sources ?? [...DERIVE_SOURCES],
-    fields: managesProvenance ? [...fields, PROVENANCE_FIELD] : fields,
-    ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
-    ...commands !== void 0 ? { commands } : {},
-    cache: ctx.cache,
-    now: ctx.now ?? (() => /* @__PURE__ */ new Date()),
-    machines: machinesOf(derive)
-  });
-  assertSourcesAvailable(result.sources, hint);
-  return result.records;
-}
-
-// src/meta/core/checks.ts
-var CHECK_KEYWORD = "check";
-function checkSchemaRef(name) {
-  if (!CHECK_NAME.test(name) || name.toLowerCase().endsWith(".json")) {
-    throw new DocmetaError(
-      `check name "${name}" must match [a-z0-9][a-z0-9._-]* and not end in ".json" \u2014 the name is part of each finding's identity (check:<name>).`
-    );
-  }
-  return `check:${name}`;
-}
-var CONVENTION_COLUMNS = /* @__PURE__ */ new Set(["path", "line", "key", "message"]);
-function rowsToFindings(name, columns, rows, loaded) {
-  if (!columns.includes("path")) {
-    throw new DocmetaError(
-      `check "${name}": the result has no \`path\` column. A check's SELECT names its findings through the column convention: \`path\` (required), and optionally \`line\`, \`key\`, and \`message\`; any other column is folded into the message.`
-    );
-  }
-  const findings = /* @__PURE__ */ new Map();
-  const extras = columns.filter((c) => !CONVENTION_COLUMNS.has(c));
-  for (const row of rows) {
-    const path = row.path;
-    if (typeof path !== "string" || loaded !== void 0 && !loaded.has(path)) {
-      throw new DocmetaError(
-        `check "${name}": a result row names ${JSON.stringify(path)}, which this run did not load \u2014 a finding must attach to a file of the corpus. Fix the check's \`path\` column.`
-      );
-    }
-    const key = typeof row.key === "string" && row.key !== "" ? row.key : void 0;
-    const line = asLine(row.line);
-    const message = typeof row.message === "string" && row.message !== "" ? row.message : synthesizeMessage(extras, row);
-    const err = {
-      schema: checkSchemaRef(name),
-      keyword: CHECK_KEYWORD,
-      // RFC 6901 escaping, or a key containing `/` or `~` would build a
-      // pointer that parses as a different (nested) location.
-      instancePath: key === void 0 ? "" : `/${escapePointerSegment(key)}`,
-      message,
-      ...line === void 0 ? {} : { line }
-    };
-    const bucket = findings.get(path);
-    if (bucket) bucket.push(err);
-    else findings.set(path, [err]);
-  }
-  return findings;
-}
-function asLine(value) {
-  const n = typeof value === "bigint" ? Number(value) : typeof value === "number" ? value : void 0;
-  return n !== void 0 && Number.isInteger(n) && n > 0 ? n : void 0;
-}
-function synthesizeMessage(extras, row) {
-  const pairs = extras.flatMap((c) => {
-    const value = row[c];
-    if (value === null || value === void 0) return [];
-    const text2 = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : JSON.stringify(value);
-    return [`${c}=${text2}`];
-  });
-  return pairs.length > 0 ? pairs.join(", ") : "check matched";
-}
-async function runChecks(checks, entries, ctx = {}) {
-  const merged = /* @__PURE__ */ new Map();
-  if (checks.length === 0) return merged;
-  const { DatabaseSync } = await loadSqlite();
-  const db = new DatabaseSync(":memory:");
-  try {
-    const dataColumns = corpusDataColumns(entries);
-    createDocsTable(db, entries, dataColumns);
-    registerLineFor(db, entries);
-    createCollectionViews(db, collectCollections(entries, ctx));
-    const wantsDerived = checks.filter(
-      (c) => mentionsDerived(c.query) || mentionsResolved(c.query)
-    );
-    if (wantsDerived.length > 0) {
-      if (ctx.derive === void 0) {
-        throw new DocmetaError(
-          `check "${wantsDerived[0]?.name ?? ""}": the SQL names the derived or resolved table, but this run cannot derive. Run it through \`manni meta validate\`, or drop the reference.`
-        );
-      }
-      const commands = ctx.commands;
-      const readable = derivableFields(commands);
-      const fields = /* @__PURE__ */ new Set();
-      for (const c of wantsDerived) for (const f of fieldsForSql(c.query, readable)) fields.add(f);
-      createDerivedView(db, await ctx.derive([...fields]), derivedColumns(commands));
-      createResolvedView(db, dataColumns, commands);
-    }
-    db.exec("PRAGMA query_only = 1");
-    const loaded = new Set(entries.map((e) => e.label));
-    for (const check of checks) {
-      const head = stripLeadingTrivia(check.query);
-      if (/^(attach|vacuum)\b/i.test(head)) {
-        throw new DocmetaError(
-          `check "${check.name}": ${head.split(/\s/, 1)[0]?.toUpperCase() ?? "that statement"} is refused: it can write outside the docs table.`
-        );
-      }
-      let tokens2;
-      try {
-        tokens2 = collectNamedParameters(check.query);
-      } catch (err) {
-        throw new DocmetaError(
-          `check "${check.name}": ${errorMessage(err)}`
-        );
-      }
-      if (tokens2.length > 0) {
-        throw new DocmetaError(
-          `check "${check.name}": the SQL references ${tokens2.join(", ")}, but checks bind no parameters \u2014 an unbound name binds NULL and matches nothing, so the gate would pass on a typo. Inline the value in the SQL.`
-        );
-      }
-      let columns;
-      let rows;
-      try {
-        assertSingleStatement(check.query);
-        const stmt = db.prepare(check.query);
-        columns = stmt.columns().map((c) => c.name);
-        rows = stmt.all();
-      } catch (err) {
-        const message = errorMessage(err);
-        throw new DocmetaError(
-          message.includes("attempt to write a readonly database") ? `check "${check.name}": ${message} \u2014 checks are read-only by design; a check is a SELECT over the projection. Edit the corpus with \`manni meta query\` instead.` : `check "${check.name}": ${message}`
-        );
-      }
-      for (const [path, errs] of rowsToFindings(
-        check.name,
-        columns,
-        rows,
-        loaded
-      )) {
-        const bucket = merged.get(path);
-        if (bucket) bucket.push(...errs);
-        else merged.set(path, errs);
-      }
-    }
-  } finally {
-    db.close();
-  }
-  return merged;
-}
-
-// src/meta/core/derive/provenance-place.ts
-import { isAbsolute as isAbsolute5, relative as relative7, resolve as resolve6, sep as sep6 } from "node:path";
-var toPosix3 = (p) => p.split(sep6).join("/");
-function provenanceManifests(collections, configDir, base, field = PROVENANCE_FIELD) {
-  const out = [];
-  for (const collection of collections) {
-    for (const manifest of collection.externalMetadata) {
-      const implied = manifest.keys === void 0;
-      if (!implied && manifest.keys?.includes(field) !== true) continue;
-      const url = classifyRef(manifest.file).kind === "url";
-      if (url && !implied) throw new DocmetaError(urlRefusal(collection.name, field));
-      if (url) {
-        out.push({
-          collection: collection.name,
-          absPath: manifest.file,
-          file: manifest.file,
-          join: externalMetadataJoin(manifest),
-          perPage: false,
-          written: manifest.file,
-          implied: { collection, manifest, url }
-        });
-        continue;
-      }
-      const absPath = isAbsolute5(manifest.file) ? manifest.file : resolve6(configDir, manifest.file);
-      const perPage = hasPagePlaceholder(manifest.file);
-      out.push({
-        collection: collection.name,
-        absPath,
-        file: perPage ? manifest.file : reportedPath(absPath, base),
-        join: externalMetadataJoin(manifest),
-        perPage,
-        written: manifest.file,
-        ...implied ? { implied: { collection, manifest, url } } : {}
-      });
-    }
-  }
-  return out;
-}
-function urlRefusal(collection, field) {
-  return `collection ${collection}: ${field} cannot come from a URL manifest, because manni meta derive writes it.`;
-}
-function provenancePlace(label, data, manifests, collections, configDir, base, marked, field = PROVENANCE_FIELD) {
-  if (manifests.length === 0) return void 0;
-  const members = new Set(memberOf(collections, configDir, base, label));
-  const owning = manifests.filter(
-    (m) => members.has(m.collection) && (m.implied === void 0 || ownsKey(m.implied.collection, m.implied.manifest, field, marked))
-  );
-  const [declared, second] = owning;
-  if (declared === void 0) return void 0;
-  if (second !== void 0) {
-    throw new DocmetaError(
-      `${label} is in collections ${declared.collection} and ${second.collection}, and both keep ${field} in a manifest.`
-    );
-  }
-  if (declared.implied?.url === true) throw new DocmetaError(urlRefusal(declared.collection, field));
-  const manifest = declared.perPage ? ownManifest(declared, label, collections, configDir, base) : declared;
-  if (manifest.join === PATH_JOIN) {
-    const entry = toPosix3(relative7(configDir, resolve6(base, label)));
-    return { manifest, absPath: manifest.absPath, entry, join: manifest.join };
-  }
-  const value = data[manifest.join];
-  if (typeof value !== "string" && typeof value !== "number") {
-    throw new DocmetaError(
-      `${label} carries no ${manifest.join}, which ${manifest.file} joins on, so its ${field} has no entry there.`
-    );
-  }
-  return { manifest, absPath: manifest.absPath, entry: String(value), join: manifest.join };
-}
-function ownManifest(manifest, label, collections, configDir, base) {
-  const resolved = pageManifestPath(manifest.written, configDir, resolve6(base, label));
-  if ("outside" in resolved) {
-    const declared = collections.find((c) => c.name === manifest.collection)?.externalMetadata.find((m) => m.file === manifest.written);
-    throw new DocmetaError(
-      outsideRefusal(declared ?? { file: manifest.written }, manifest.collection, resolved.pageRel)
-    );
-  }
-  return { ...manifest, absPath: resolved.abs, file: reportedPath(resolved.abs, base) };
-}
-function readerManifests(collections, configDir, base, field = PROVENANCE_FIELD) {
-  const local = collections.map((c) => ({
-    ...c,
-    externalMetadata: c.externalMetadata.filter((m) => classifyRef(m.file).kind !== "url")
-  }));
-  return provenanceManifests(local, configDir, base, field);
-}
-function readerPlace(label, data, manifests, collections, configDir, base, marked, field = PROVENANCE_FIELD) {
-  try {
-    const place = provenancePlace(label, data, manifests, collections, configDir, base, marked, field);
-    return place === void 0 ? void 0 : { absPath: place.absPath, entry: place.entry, join: place.join };
-  } catch (err) {
-    if (err instanceof DocmetaError) return void 0;
-    throw err;
-  }
-}
-function stampManifests(label, data, collections, configDir, base, marked, fields) {
-  const out = {};
-  for (const field of STAMPED_DATE_FIELDS) {
-    if (!fields.includes(field)) continue;
-    const manifests = readerManifests(collections, configDir, base, field);
-    const place = readerPlace(label, data, manifests, collections, configDir, base, marked, field);
-    if (place !== void 0) out[field] = place;
-  }
-  return out;
-}
-
-// src/shared/cli-options.ts
-import { basename as basename4, relative as relative8 } from "node:path";
-function collect(value, prev) {
-  return prev.concat([value]);
-}
-function splitList(value) {
-  return value.split(",").map((s) => s.trim()).filter(Boolean);
-}
-var STDIN_REQUIRES_AS = "Reading from stdin (`-`) requires --as <format> to choose an extractor.";
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-function configOption(value) {
-  if (value === false) return { noConfig: true };
-  return typeof value === "string" ? { configPath: value } : {};
-}
-function explicitFalse(value) {
-  return value === false ? false : void 0;
-}
-function reportConfig(toStdout, cwd) {
-  return (info) => {
-    const where = (relative8(cwd, info.dir) || ".").replace(/\\/g, "/");
-    const line = `Using ${basename4(info.path)} (${where})
-`;
-    (toStdout ? process.stdout : process.stderr).write(line);
-  };
-}
-
-// src/meta/commands/validate.ts
-function parseErrorResult(file, format, message, keyword) {
-  const err = {
-    schema: "(parse)",
-    instancePath: "",
-    message,
-    keyword
-  };
-  return { file, format, ok: false, schemas: [], errors: [err] };
-}
-function once(fn) {
-  let pending;
-  return () => {
-    pending ??= fn();
-    return pending;
-  };
-}
-async function runValidate(opts) {
-  const cwd = opts.cwd ?? process.cwd();
-  const run2 = await resolveRunConfig({
-    cwd,
-    configPath: opts.configPath,
-    noConfig: opts.noConfig,
-    inputs: opts.inputs,
-    ...opts.collections !== void 0 ? { collections: opts.collections } : {},
-    onConfigLoaded: opts.onConfigLoaded
-  });
-  const {
-    config,
-    inputs,
-    base,
-    configDir,
-    collections,
-    declaredCollections,
-    fromCollections,
-    configFile
-  } = run2;
-  const membersFor = (label) => memberOf(collections, configDir ?? cwd, base, label);
-  const usingStdin = inputs.includes(STDIN_TOKEN);
-  if (inputs.length === 0) {
-    throw new DocmetaError(
-      "No files to validate. Pass paths/globs, or declare a collection under `collections:` in manni.config.yaml."
-    );
-  }
-  const forcedExtractor = opts.as ? extractorByName(opts.as) : void 0;
-  if (opts.as && !forcedExtractor) {
-    throw new DocmetaError(
-      `Unknown format "${opts.as}". Supported extensions: ${supportedExtensions().join(", ")}.`
-    );
-  }
-  const exts = opts.exts ?? (forcedExtractor ? forcedExtractor.extensions : void 0);
-  const fileInputs = inputs.filter((i) => i !== STDIN_TOKEN);
-  const allowEmpty = opts.allowEmpty ?? config?.allowEmpty;
-  const exclude = opts.exclude ?? [];
-  const { files: walked, gitignoreSkipped } = await resolveTargetSet({
-    inputs: fileInputs,
-    exts,
-    exclude,
-    cwd: base,
-    allowEmpty,
-    ...gitignoreOptions({
-      flag: opts.respectGitignore,
-      configured: config?.respectGitignore,
-      onNotice: opts.onNotice
-    })
-  });
-  const files = fromCollections ? retainMembers(walked, membersFor) : walked;
-  assertNonEmpty({
-    files,
-    inputs: fileInputs,
-    usingStdin,
-    allowEmpty,
-    exclude,
-    exts,
-    gitignoreSkipped,
-    action: "validated"
-  });
-  const trustRoot = schemaTrustRoot(cwd, configDir);
-  const externalMetadata = await loadExternalMetadata(collections, {
-    configDir: configDir ?? cwd,
-    base,
-    offline: opts.offline ?? config?.offline ?? false,
-    // A `{page}` manifest (0058) is read for exactly the pages this run reads.
-    pages: files.map((file) => resolve7(base, file))
-  });
-  const validator = new Validator(
-    schemaLoadOptions({
-      // The config's directory when a config governs the run, so one project
-      // keeps one cache no matter which directory the command was run from.
-      root: configDir ?? cwd,
-      // A relative file ref belongs to the run's directory, not the cache root.
-      fileBase: cwd,
-      ttlHours: config?.schemaCache?.ttlHours,
-      offline: opts.offline ?? config?.offline,
-      // Built from the rebased config, so a pinned local ref is keyed by the
-      // same absolute spelling `resolveSchemaSet` will hand to `loadSchema`.
-      pins: collectSchemaPins(config),
-      registered: config?.registered
-    })
-  );
-  const marks = pageMarks({
-    validator,
-    config,
-    cwd,
-    trustRoot,
-    ...opts.cliSchemas !== void 0 ? { cliSchemas: opts.cliSchemas } : {}
-  });
-  let relocation;
-  const relocationCtx = () => relocation ??= relocationContext(run2, {
-    cwd,
-    targets: fromCollections ? [] : opts.inputs,
-    validator,
-    ...opts.noConfig !== void 0 ? { noConfig: opts.noConfig } : {},
-    ...opts.env !== void 0 ? { env: opts.env } : {}
-  });
-  const refFrame = { cwd, base: configDir ?? cwd, runBase: base };
-  const locationFindings = async (label, own, data, refs, members, merged, lineFor) => {
-    const preferences = await validator.locationPreferences(data, refs);
-    if (preferences.size === 0) return [];
-    const owned = new Set(merged.collisions.map((c) => c.key));
-    const declaredMembers = declaredCollections === collections ? members : memberOf(declaredCollections, configDir ?? cwd, base, label);
-    const joins = new Set(
-      declaredCollections.filter((c) => declaredMembers.includes(c.name)).flatMap((c) => c.externalMetadata.map(externalMetadataJoin)).filter((join5) => join5 !== PATH_JOIN)
-    );
-    const findings = [];
-    for (const key of Object.keys(data)) {
-      const preference = preferences.get(key);
-      if (preference === void 0) continue;
-      const ref = canonicalSchemaRef(preference.schema, refFrame);
-      const pointer = externalMetadataPointer(key);
-      const common = {
-        keyword: LOCATION_FINDING_KEYWORD,
-        subject: key,
-        instancePath: pointer,
-        severity: "warning"
-      };
-      if (Object.hasOwn(own, key)) {
-        if (preference.location !== "external" || owned.has(key) || joins.has(key)) continue;
-        const line = lineFor(key);
-        const none = await homeless(label, own, key);
-        findings.push({
-          schema: LOCATION_EXTERNAL_SCHEMA,
-          ...common,
-          // relocate refuses --no-config (U2), so it is no answer there.
-          // Nor is it one for stdin, which relocate refuses: no advice there.
-          message: opts.noConfig ? `"${key}" is stored in the page; ${ref} prefers external metadata, and --no-config leaves it no manifest.` : label === STDIN_LABEL ? `"${key}" is stored in the page; ${ref} prefers external metadata.` : none > 0 ? `"${key}" is stored in the page; ${ref} prefers external metadata, and this document is in none of the ${String(none)} collections.` : `"${key}" is stored in the page; ${ref} prefers external metadata. Run manni meta relocate.`,
-          ...line != null ? { line } : {}
-        });
-        continue;
-      }
-      if (preference.location !== "page") continue;
-      const at2 = merged.locate(pointer);
-      if (at2 === void 0) continue;
-      findings.push({
-        schema: LOCATION_PAGE_SCHEMA,
-        ...common,
-        // A fetched manifest cannot give a value up, so relocate is no
-        // answer; the value moves in the repository that serves it.
-        message: /^https?:\/\//.test(at2.file) ? `"${key}" is stored in manifest ${at2.file}; ${ref} prefers the page, and a fetched manifest cannot be written. Move it in that repository.` : `"${key}" is stored in manifest ${at2.file}; ${ref} prefers the page. Run manni meta relocate.`,
-        file: at2.file,
-        ...at2.line != null ? { line: at2.line } : {}
-      });
-    }
-    return findings;
-  };
-  const homeless = async (label, own, key) => {
-    if (label === STDIN_LABEL) return 0;
-    const home = await keyHome(relocationCtx(), label, own, key);
-    return home.kind === "unowned" && home.home.kind === "none" && home.home.reason === "collections" && home.home.collections > 1 ? home.home.collections : 0;
-  };
-  const results = [];
-  const skippedDefaultOnly = /* @__PURE__ */ new Set();
-  const defaultOnly = (label, members) => {
-    try {
-      return resolveSchemaSetWithSource({
-        filePath: label,
-        fileSchema: void 0,
-        cliSchemas: opts.cliSchemas,
-        config,
-        memberOf: members,
-        fileBase: cwd,
-        trustRoot
-      }).source === "default";
-    } catch {
-      return false;
-    }
-  };
-  const joinHits = /* @__PURE__ */ new Map();
-  const scopedToCollections = (opts.collections?.length ?? 0) > 0;
-  const scopedByFlags = opts.inputs.length > 0 || // redundant with inputs.length (stdin is an input) — kept as belt-and-suspenders
-  usingStdin || opts.as !== void 0 || opts.exts !== void 0 || opts.exclude !== void 0 && opts.exclude.length > 0 || opts.respectGitignore !== void 0 || (opts.cliSchemas?.length ?? 0) > 0;
-  const scoped = scopedByFlags || scopedToCollections;
-  const configuredChecks = config?.checks ?? [];
-  if (!scopedByFlags) {
-    const covered = scopedToCollections ? collections.map((c) => c.name) : void 0;
-    const orphans = orphanEntries(externalMetadata, files, base, covered);
-    if (orphans.length > 0) throw orphanError(orphans);
-  }
-  const checksWillRun = configuredChecks.length > 0 && opts.checks !== false && !scoped;
-  const checkEntries = [];
-  const encryptionKey = lazyKey(configFile, opts.env);
-  let unverified = 0;
-  const deriveConfig = config?.derive;
-  const configuredFields = managedFields(deriveConfig);
-  const defaultedFields = deriveConfig !== void 0 && deriveConfig.fields === void 0;
-  const deriveWillRun = deriveConfig !== void 0 && configuredFields.length > 0 && opts.derive !== false;
-  const pageManaged = /* @__PURE__ */ new Map();
-  const derivedChecks = checksWillRun ? configuredChecks.filter((c) => mentionsDerived(c.query) || mentionsResolved(c.query)) : [];
-  const checksNeedDerived = derivedChecks.length > 0;
-  const deriveInputs = [];
-  const managedViews = /* @__PURE__ */ new Map();
-  const keepDeriveInputs = deriveWillRun || checksNeedDerived;
-  const deriveCommands = commandsOf(deriveConfig);
-  const deriveFields = new Set(deriveWillRun && !defaultedFields ? configuredFields : []);
-  const readable = derivableFields(deriveCommands);
-  for (const c of derivedChecks) for (const f of fieldsForSql(c.query, readable)) deriveFields.add(f);
-  const provenanceManifests2 = keepDeriveInputs && (deriveFields.has(PROVENANCE_FIELD) || deriveWillRun && configuredFields.includes(PROVENANCE_FIELD)) ? readerManifests(declaredCollections, configDir ?? cwd, base) : [];
-  const derivedOnce = once(async () => {
-    const derived = await deriveMetadata(deriveInputs, {
-      cwd,
-      base,
-      ...configDir !== void 0 ? { configDir } : {},
-      sources: deriveConfig?.sources ?? [...DERIVE_SOURCES],
-      fields: [...deriveFields],
-      ...deriveConfig?.codeowners !== void 0 ? { codeowners: deriveConfig.codeowners } : {},
-      ...deriveCommands !== void 0 ? { commands: deriveCommands } : {},
-      cache: opts.cache ?? true,
-      now: opts.now ?? (() => /* @__PURE__ */ new Date()),
-      machines: machinesOf(deriveConfig)
-    });
-    assertSourcesAvailable(
-      derived.sources,
-      deriveWillRun ? "pass --no-derive to skip the comparison, or narrow derive.sources" : "narrow derive.sources in manni.config.yaml"
-    );
-    for (const [name, status] of Object.entries(derived.sources)) {
-      if (status.available && status.reason !== void 0) {
-        opts.onNotice?.(`${name}: ${status.reason}`);
-      }
-    }
-    return derived;
-  });
-  const processOne = async (label, content, extension) => {
-    const extractor = forcedExtractor ?? extractorForExtension(extension);
-    if (!extractor) {
-      throw new DocmetaError(
-        `Unsupported file type "${extension}" for "${label}". Supported: ${supportedExtensions().join(", ")}. Use --as to override.`
-      );
-    }
-    const members = membersFor(label);
-    let extracted;
-    try {
-      extracted = extractor.extract(content, label, {
-        elements: resolveElements(label, config, members)
-      });
-    } catch (err) {
-      if (err instanceof DocmetaError) throw err;
-      if (opts.skipDefaultOnly === true && defaultOnly(label, members)) {
-        skippedDefaultOnly.add(label);
-        return;
-      }
-      results.push(
-        parseErrorResult(label, extractor.name, errorMessage(err), "parse")
-      );
-      return;
-    }
-    const merged = await mergeWithMarks(label, extracted, externalMetadata, members, base, {
-      encryptionKey,
-      marks
-    });
-    if (keepDeriveInputs && label !== STDIN_LABEL && (checksNeedDerived || deriveCovers(deriveConfig, members))) {
-      const place = provenanceManifests2.length === 0 ? void 0 : readerPlace(label, extracted.data, provenanceManifests2, declaredCollections, configDir ?? cwd, base, merged.marked);
-      const owned = declaredCollections.length === 0 ? {} : stampManifests(label, extracted.data, declaredCollections, configDir ?? cwd, base, merged.marked, STAMPED_DATE_FIELDS);
-      deriveInputs.push({
-        label,
-        absPath: resolve7(base, label),
-        content,
-        extracted,
-        ...place !== void 0 ? { provenanceManifest: place } : {},
-        ...Object.keys(owned).length > 0 ? { stampManifests: owned } : {}
-      });
-    }
-    const own = extracted.data;
-    extracted = merged.extracted;
-    if (deriveWillRun && label !== STDIN_LABEL) {
-      managedViews.set(label, {
-        data: extracted.data,
-        marked: [],
-        hidden: [],
-        refs: [],
-        locate: merged.locate
-      });
-    }
-    for (const j of merged.joins) {
-      const byValue = joinHits.get(j.field) ?? /* @__PURE__ */ new Map();
-      const line = extracted.lineFor(j.field);
-      const hits = byValue.get(j.value) ?? [];
-      hits.push({
-        label,
-        file: j.file,
-        shown: j.pageValue ?? j.value,
-        ...line != null ? { line } : {}
-      });
-      byValue.set(j.value, hits);
-      joinHits.set(j.field, byValue);
-    }
-    if (checksWillRun) checkEntries.push({ label, extracted });
-    let resolved;
-    try {
-      resolved = resolveSchemaSetWithSource({
-        filePath: label,
-        fileSchema: extracted.data[FILE_SCHEMA_KEY],
-        cliSchemas: opts.cliSchemas,
-        config,
-        memberOf: members,
-        // A document's own `$schema` is measured from the run's directory, the
-        // same base `loadSchema` will read it from, and contained to the
-        // repository the run is standing in.
-        fileBase: cwd,
-        trustRoot,
-        onNotice: opts.onNotice
-      });
-    } catch (err) {
-      results.push(
-        parseErrorResult(label, extractor.name, errorMessage(err), "schema")
-      );
-      return;
-    }
-    if (opts.skipDefaultOnly === true && resolved.source === "default") {
-      skippedDefaultOnly.add(label);
-      return;
-    }
-    const schemaSet = resolved.schemas;
-    if (deriveWillRun && defaultedFields && label !== STDIN_LABEL && deriveCovers(deriveConfig, members)) {
-      let claimed = /* @__PURE__ */ new Set();
-      try {
-        claimed = await validator.claimedProperties(schemaSet);
-      } catch (err) {
-        if (!(err instanceof DocmetaError)) throw err;
-      }
-      const own2 = configuredFields.filter((f) => claimed.has(f));
-      pageManaged.set(label, own2);
-      for (const f of own2) deriveFields.add(f);
-    }
-    let errors;
-    try {
-      const view = await encryptionView({
-        data: extracted.data,
-        refs: schemaSet,
-        validator,
-        key: encryptionKey,
-        locate: merged.locate
-      });
-      unverified += view.unverified.length;
-      if (deriveWillRun && label !== STDIN_LABEL) {
-        managedViews.set(label, {
-          data: view.data,
-          marked: view.marked,
-          hidden: [...view.unreadable, ...view.unverified],
-          refs: schemaSet,
-          locate: merged.locate
-        });
-      }
-      errors = [
-        ...settleFindings(
-          await validator.validate(
-            view.data,
-            schemaSet,
-            extracted.lineFor,
-            extracted.colFor,
-            merged.locate
-          ),
-          view,
-          extracted,
-          merged.locate
-        ),
-        ...encryptionFindings(view, extracted, merged.locate),
-        // Over the decrypted view, the object validation evaluated: a mark
-        // counts where Ajv takes a branch, and a branch may read a value.
-        ...await locationFindings(label, own, view.data, schemaSet, members, merged, extracted.lineFor)
-      ];
-    } catch (err) {
-      if (!(err instanceof DocmetaError) || resolved.source !== "document") {
-        throw err;
-      }
-      results.push(
-        parseErrorResult(label, extractor.name, err.message, "schema")
-      );
-      return;
-    }
-    for (const { key, file, collection } of merged.collisions) {
-      const line = extracted.lineFor(key);
-      errors.push({
-        schema: EXTERNAL_OWNED_SCHEMA,
-        keyword: EXTERNAL_KEYWORD,
-        subject: key,
-        instancePath: externalMetadataPointer(key),
-        message: `"${key}" is owned by manifest ${file} (collection ${collection}); remove it from the document`,
-        ...line != null ? { line } : {}
-      });
-    }
-    results.push({
-      file: label,
-      format: extractor.name,
-      ok: !errors.some(isErrorSeverity),
-      schemas: schemaSet,
-      errors
-    });
-  };
-  if (usingStdin) {
-    const content = opts.stdinContent ?? "";
-    if (!forcedExtractor) {
-      throw new DocmetaError(
-        STDIN_REQUIRES_AS
-      );
-    }
-    await processOne(STDIN_LABEL, content, forcedExtractor.extensions[0] ?? "");
-  }
-  for (const file of files) {
-    const content = await readFile6(resolve7(base, file), "utf8");
-    await processOne(file, content, extname3(file));
-  }
-  if (unverified > 0) opts.onNotice?.(unverifiedWarning(unverified));
-  if (externalMetadata) {
-    const byLabel = new Map(results.map((r) => [r.file, r]));
-    const matched = /* @__PURE__ */ new Map();
-    for (const [field, byValue] of joinHits) {
-      matched.set(field, new Set(byValue.keys()));
-      for (const hits of byValue.values()) {
-        if (hits.length < 2) continue;
-        for (const hit of hits) {
-          const others = hits.filter((h) => h.label !== hit.label).map((h) => h.label).join(", ");
-          const result = byLabel.get(hit.label);
-          if (!result) continue;
-          result.errors.push({
-            schema: EXTERNAL_DUPLICATE_SCHEMA,
-            keyword: EXTERNAL_KEYWORD,
-            subject: hit.shown,
-            instancePath: externalMetadataPointer(field),
-            message: `${hits.length} documents carry ${field} "${hit.shown}"; ${hit.file} cannot tell them apart (${others})`,
-            ...hit.line != null ? { line: hit.line } : {}
-          });
-          result.ok = false;
-        }
-      }
-    }
-    if (!scopedByFlags) {
-      const covered = scopedToCollections ? collections.map((c) => c.name) : void 0;
-      const orphans = orphanJoins(externalMetadata, matched, covered);
-      if (orphans.length > 0) throw orphanError(orphans);
-    }
-  }
-  if (configuredChecks.length > 0 && opts.checks !== false) {
-    if (scoped) {
-      opts.onNotice?.(
-        scopedToCollections ? `corpus checks skipped: run is scoped to collections ${collections.map((c) => c.name).join(", ")}` : "corpus checks skipped: run is scoped"
-      );
-    } else {
-      const findings = await runChecks(configuredChecks, checkEntries, {
-        // Every declared collection is a view (0041 rule 7), holding the
-        // members this run loaded — decided by the same path arithmetic
-        // `membersFor` uses, so a check and a `manni meta query` over the same
-        // corpus see the same collections.
-        collections: declaredCollections,
-        ...configDir !== void 0 ? { configDir } : {},
-        base,
-        // A check that names the `derived` table (0040) gets the same view
-        // `query` builds, from the run's one derivation — which already
-        // covers every field the checks can read, so the list handed back
-        // here is not needed. Built only when asked for, because building
-        // it spawns git.
-        derive: async () => (await derivedOnce()).records,
-        // Its columns include the configured commands' keys (0042), which a
-        // check's context cannot read from a config since 0041.
-        ...deriveCommands !== void 0 ? { commands: deriveCommands } : {}
-      });
-      const byFile = new Map(results.map((r) => [r.file, r]));
-      for (const [file, errs] of findings) {
-        const result = byFile.get(file);
-        if (!result && skippedDefaultOnly.has(file)) continue;
-        if (!result) {
-          throw new DocmetaError(
-            `check findings for "${file}" have no validation result to attach to.`
-          );
-        }
-        result.errors.push(...errs);
-        result.ok = result.ok && !errs.some(isErrorSeverity);
-      }
-    }
-  }
-  if (deriveWillRun && deriveInputs.length > 0) {
-    const derived = await derivedOnce();
-    const byFile = new Map(results.map((r) => [r.file, r]));
-    for (const input of deriveInputs) {
-      const record = derived.records.get(input.label);
-      const result = byFile.get(input.label);
-      if (!record || !result) continue;
-      const managed = managedViews.get(input.label);
-      const managedHere = !deriveCovers(deriveConfig, membersFor(input.label)) ? [] : defaultedFields ? pageManaged.get(input.label) ?? [] : configuredFields;
-      const fields = managedHere.filter(
-        (field) => !(managed?.hidden.some((p) => isAtOrUnder(p, pointerOf(field))) ?? false)
-      );
-      let marked = [];
-      if (managed !== void 0) {
-        const stamped = { ...managed.data };
-        for (const field of fields) {
-          const d = record.fields[field];
-          if (d != null) stamped[field] = d.value;
-        }
-        marked = [...managed.marked, ...await validator.markedPointers(stamped, managed.refs)];
-      }
-      const asserted = (field) => managed !== void 0 ? managed.data[field] : input.extracted.data[field];
-      const findings = fields.flatMap((field) => {
-        if (field === PROVENANCE_FIELD) {
-          const derivation = derived.provenance?.get(input.label);
-          if (derivation === void 0) return [];
-          return provenanceFindings(
-            compareProvenance(provenanceEntries(asserted(field)), derivation),
-            derivation.page.bodyLine
-          );
-        }
-        const compared = compareDerived(field, asserted(field), record.fields[field]);
-        const at2 = pointerOf(field);
-        return staleFindings(
-          [marked.some((p) => isAtOrUnder(p, at2)) ? redactedDerived(compared) : compared],
-          input.extracted.lineFor,
-          managed?.locate
-        );
-      });
-      if (findings.length === 0) continue;
-      result.errors.push(...findings);
-      result.ok = false;
-    }
-  }
-  const frame = { cwd, base: configDir ?? cwd, runBase: base };
-  const { results: reported3, baseline } = await settleBaseline(
-    results,
-    resolveBaselineRequest(opts, config?.baseline, configDir, cwd, {
-      current: DEFAULT_BASELINE_PATH,
-      legacy: LEGACY_BASELINE_PATH
-    }),
-    frame
-  );
-  const failed = reported3.filter((r) => !r.ok).length;
-  const count2 = (keep) => reported3.reduce((n, r) => n + r.errors.filter(keep).length, 0);
-  const warnings = count2((e) => e.severity === "warning");
-  const notices = count2((e) => e.severity === "notice");
-  const summary = {
-    files: reported3.length,
-    passed: reported3.length - failed,
-    failed,
-    errors: count2(isErrorSeverity),
-    // Omitted at zero, like `gitignoreSkipped` below: only the location
-    // findings (proposal 0047) are warnings, so a run with no
-    // `x-manni-location` marks keeps the summary as it was.
-    ...warnings > 0 ? { warnings } : {},
-    ...notices > 0 ? { notices } : {},
-    // Omitted when nothing was skipped: there is nothing to audit, and the
-    // JSON summary stays as it was for every run in a clean repo.
-    ...gitignoreSkipped > 0 ? { gitignoreSkipped } : {},
-    ...baseline ? { baseline } : {}
-  };
-  return { results: reported3, summary, frame };
-}
-
 export {
   collect,
   splitList,
@@ -7279,6 +4324,7 @@ export {
   META_CONTEXT,
   EncryptionRefusal,
   unreadableMessage,
+  unverifiedWarning,
   lazyKey,
   pointerOf,
   topLevelKeyOf,
@@ -7287,14 +4333,17 @@ export {
   withValueAt,
   encryptionView,
   settleFindings,
+  encryptionFindings,
   redactForModel,
   redactedDerived,
   EXTERNAL_OWNED_SCHEMA,
   EXTERNAL_DUPLICATE_SCHEMA,
   EXTERNAL_KEYWORD,
   PATH_JOIN,
+  reportedPath,
   externalMetadataJoin,
   loadExternalMetadata,
+  outsideRefusal,
   mergeExternalMetadata,
   mergeWithMarks,
   externalMetadataPointer,
@@ -7305,6 +4354,7 @@ export {
   LOCATION_KEYWORD,
   LOCATION_EXTERNAL_SCHEMA,
   LOCATION_PAGE_SCHEMA,
+  LOCATION_FINDING_KEYWORD,
   GRAPH_OUTPUT_KEYWORD,
   compileWithFormats,
   stringFormatNames,
@@ -7319,6 +4369,7 @@ export {
   familyMarks,
   SYSTEM_COLUMNS,
   RESERVED,
+  quoteIdent,
   bindValue,
   corpusDataColumns,
   createDocsTable,
@@ -7366,57 +4417,19 @@ export {
   toFileLines,
   toBodyLines,
   splitPageArgument,
+  ZERO_SHA,
+  DEFAULT_MACHINES,
   provenanceEntries,
   readProvenancePage,
+  parseLinePorcelain,
+  machineIdentity,
+  deriveProvenance,
   compareProvenance,
   planProvenanceWrite,
   rangeResults,
   provenanceFindings,
   renderProvenanceValue,
   parseProvenanceTarget,
-  commandsOf,
-  machinesOf,
-  REVIEW_CACHE_DIR,
-  REVIEW_CACHE_VERSION,
-  ReviewCache,
-  cachedClient,
-  BinMissing,
-  run,
-  PATH_PLACEHOLDER,
-  isPerFile,
-  argvFor,
-  valueOf,
-  deriveFromCommands,
-  parseOriginUrl,
-  identityFromOrigin,
-  GitHubClient,
-  GitLabClient,
-  createReviewClient,
-  deriveFromReviews,
-  mapConcurrent,
-  provenanceFenced,
-  FIELD_SOURCES,
-  sourcesFor,
-  consultedSources,
-  assertSourcesAvailable,
-  deriveMetadata,
-  DERIVED_VIEW,
-  DERIVED_ROWS,
-  RESOLVED_VIEW,
-  derivedColumns,
-  mentionsDerived,
-  fieldsForSql,
-  createDerivedView,
-  resolvedColumns,
-  mentionsResolved,
-  createResolvedView,
-  deriveForTable,
-  rowsToFindings,
-  provenanceManifests,
-  provenancePlace,
-  readerManifests,
-  readerPlace,
-  stampManifests,
-  runValidate
+  attributeRange
 };
-//# sourceMappingURL=chunk-KBG463UK.js.map
+//# sourceMappingURL=chunk-GV56WGL2.js.map