@hawkeyexl/manni 4.3.1 → 4.4.1

package/dist/chunk-TK3FC4RF.js

@@ -0,0 +1,3090 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_MACHINES,
+  EXTERNAL_DUPLICATE_SCHEMA,
+  EXTERNAL_KEYWORD,
+  EXTERNAL_OWNED_SCHEMA,
+  LOCATION_EXTERNAL_SCHEMA,
+  LOCATION_FINDING_KEYWORD,
+  LOCATION_PAGE_SCHEMA,
+  PATH_JOIN,
+  RESERVED,
+  Validator,
+  ZERO_SHA,
+  assertSingleStatement,
+  attributeRange,
+  bindValue,
+  collectCollections,
+  collectNamedParameters,
+  compareProvenance,
+  corpusDataColumns,
+  createCollectionViews,
+  createDocsTable,
+  deriveProvenance,
+  encryptionFindings,
+  encryptionView,
+  externalMetadataJoin,
+  externalMetadataPointer,
+  isAtOrUnder,
+  keyHome,
+  lazyKey,
+  loadExternalMetadata,
+  loadSqlite,
+  machineIdentity,
+  memberOf,
+  mergeWithMarks,
+  orphanEntries,
+  orphanError,
+  orphanJoins,
+  outsideRefusal,
+  pageMarks,
+  parseLinePorcelain,
+  parseLines,
+  pointerOf,
+  provenanceEntries,
+  provenanceFindings,
+  quoteIdent,
+  readProvenancePage,
+  redactedDerived,
+  registerLineFor,
+  relocationContext,
+  reportedPath,
+  retainMembers,
+  settleFindings,
+  splitLines,
+  stripLeadingTrivia,
+  toFileLines,
+  unverifiedWarning
+} from "./chunk-M3W7J6MU.js";
+import {
+  CHECK_NAME,
+  DEFAULT_BASELINE_PATH,
+  DERIVE_SOURCES,
+  DocmetaError,
+  FILE_SCHEMA_KEY,
+  LEGACY_BASELINE_PATH,
+  PROVENANCE_FIELD,
+  STAMPED_DATE_FIELDS,
+  STDIN_LABEL,
+  STDIN_TOKEN,
+  assertNonEmpty,
+  canonicalSchemaRef,
+  classifyRef,
+  collectSchemaPins,
+  compareDerived,
+  derivableFields,
+  deriveCovers,
+  escapePointerSegment,
+  extractorByName,
+  extractorForExtension,
+  gitignoreOptions,
+  isBuiltinField,
+  isErrorSeverity,
+  locateFrontmatter,
+  managedFields,
+  resolveBaselineRequest,
+  resolveElements,
+  resolveRunConfig,
+  resolveSchemaSetWithSource,
+  resolveTargetSet,
+  schemaLoadOptions,
+  schemaTrustRoot,
+  settleBaseline,
+  staleFindings,
+  supportedExtensions,
+  toJsonText
+} from "./chunk-57NEQRVO.js";
+import {
+  findGitRoot,
+  hasPagePlaceholder,
+  ownsKey,
+  pageManifestPath
+} from "./chunk-Q35YIDBV.js";
+import {
+  errorMessage
+} from "./chunk-G3T47CFV.js";
+
+// src/meta/commands/validate.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { resolve as resolve4, extname as extname2 } from "node:path";
+
+// src/meta/core/derive/config.ts
+var DEFAULT_COMMAND_TIMEOUT_MS = 6e4;
+function commandsOf(config) {
+  if (config?.commands === void 0) return void 0;
+  const out = {};
+  for (const [field, c] of Object.entries(config.commands)) {
+    out[field] = {
+      run: c.run,
+      timeoutMs: c.timeout === void 0 ? DEFAULT_COMMAND_TIMEOUT_MS : Math.round(c.timeout * 1e3)
+    };
+  }
+  return out;
+}
+function machinesOf(config) {
+  return config?.machines ?? DEFAULT_MACHINES;
+}
+
+// src/meta/core/derive/index.ts
+import { dirname as dirname3, resolve as resolve2 } from "node:path";
+
+// src/meta/core/derive/cache.ts
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+var REVIEW_CACHE_DIR = ".manni/meta/review-cache";
+var REVIEW_CACHE_VERSION = 1;
+var ReviewCache = class {
+  constructor(dir, enabled) {
+    this.dir = dir;
+    this.enabled = enabled;
+  }
+  dir;
+  enabled;
+  entryPath(key) {
+    const digest = createHash("sha256").update(key).digest("hex");
+    return join(this.dir, `${digest}.json`);
+  }
+  /** The cached change, or `undefined` for a miss. Never `null`: nulls are not stored. */
+  get(key) {
+    if (!this.enabled) return void 0;
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(this.entryPath(key), "utf8"));
+    } catch {
+      return void 0;
+    }
+    if (!isRecord(raw)) return void 0;
+    if (raw.version !== REVIEW_CACHE_VERSION || raw.key !== key) return void 0;
+    const change = readChange(raw.change);
+    return change ?? void 0;
+  }
+  set(key, value) {
+    if (!this.enabled) return;
+    const entry = { version: REVIEW_CACHE_VERSION, key, change: value };
+    const path = this.entryPath(key);
+    const tmp = `${path}.${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`;
+    try {
+      mkdirSync(this.dir, { recursive: true });
+      writeFileSync(tmp, `${JSON.stringify(entry, null, 2)}
+`, "utf8");
+      renameSync(tmp, path);
+    } catch {
+      try {
+        rmSync(tmp, { force: true });
+      } catch {
+      }
+    }
+  }
+};
+function cachedClient(client, cache, identity) {
+  return {
+    detect: () => client.detect(),
+    status: () => client.status(),
+    async mergedChangeFor(sha) {
+      if (identity === null) return client.mergedChangeFor(sha);
+      const key = `${identity.host}/${identity.project}/${sha}`;
+      const hit = cache.get(key);
+      if (hit !== void 0) return hit;
+      const change = await client.mergedChangeFor(sha);
+      if (change !== null) cache.set(key, change);
+      return change;
+    }
+  };
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function readChange(v) {
+  if (!isRecord(v)) return null;
+  const { id, mergedAt, approvals } = v;
+  if (typeof id !== "number" || typeof mergedAt !== "string") return null;
+  if (!Array.isArray(approvals)) return null;
+  const read = [];
+  for (const a of approvals) {
+    if (!isRecord(a)) return null;
+    if (typeof a.login !== "string" || typeof a.submittedAt !== "string") return null;
+    read.push({ login: a.login, submittedAt: a.submittedAt });
+  }
+  return { id, mergedAt, approvals: read };
+}
+
+// src/meta/core/derive/codeowners.ts
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, relative, resolve, sep } from "node:path";
+import picomatch from "picomatch";
+var CODEOWNERS_LOCATIONS = [
+  ".github/CODEOWNERS",
+  "CODEOWNERS",
+  "docs/CODEOWNERS",
+  ".gitlab/CODEOWNERS"
+];
+function findCodeowners(root, explicit) {
+  if (explicit !== void 0) {
+    const path = resolve(root, explicit);
+    return existsSync(path) ? path : null;
+  }
+  for (const loc of CODEOWNERS_LOCATIONS) {
+    const path = resolve(root, ...loc.split("/"));
+    if (existsSync(path)) return path;
+  }
+  return null;
+}
+var SECTION_HEADER = /^(\^?)\[([^\]]+)\](?:\[(\d+)\])?(.*)$/;
+var TOKEN = /(?:\\.|[^\s\\])+/g;
+function parseCodeowners(text2, path, label) {
+  const rules = [];
+  const sections = [];
+  let current;
+  const lines = text2.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const raw = lines[i] ?? "";
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[") || line.startsWith("^[")) {
+      const m = SECTION_HEADER.exec(line);
+      if (!m) continue;
+      const [, caret, rawName, approvals, rest] = m;
+      const name = (rawName ?? "").trim();
+      if (name === "") continue;
+      const owners2 = tokens(rest ?? "");
+      const existing = sections.find(
+        (s) => s.name.toLowerCase() === name.toLowerCase()
+      );
+      if (existing) {
+        if (owners2.length > 0) existing.defaultOwners = owners2;
+        current = existing;
+        continue;
+      }
+      const section = {
+        name,
+        optional: caret === "^",
+        ...approvals !== void 0 ? { approvals: Number(approvals) } : {},
+        defaultOwners: owners2
+      };
+      sections.push(section);
+      current = section;
+      continue;
+    }
+    const [first, ...owners] = tokens(line);
+    if (first === void 0) continue;
+    const pattern = unescapePattern(first);
+    if (pattern === "" || pattern === "/") continue;
+    rules.push({
+      pattern,
+      owners,
+      line: i + 1,
+      ...current ? { section: current.name } : {}
+    });
+  }
+  return { path, label, rules, sections };
+}
+function tokens(s) {
+  return s.match(TOKEN) ?? [];
+}
+function unescapePattern(token) {
+  return token.replace(/\\ /g, " ").replace(/^\\#/, "#");
+}
+function ownersFor(file, relPath) {
+  const matchers = matchersFor(file);
+  const defaults = new Map(file.sections.map((s) => [s.name, s.defaultOwners]));
+  const order = [void 0, ...file.sections.map((s) => s.name)];
+  const winners = /* @__PURE__ */ new Map();
+  file.rules.forEach((rule, i) => {
+    if (matchers[i]?.(relPath)) winners.set(rule.section, rule);
+  });
+  if (winners.size === 0) return null;
+  const owners = [];
+  let line = 0;
+  let lineFromOwner = false;
+  for (const section of order) {
+    const rule = winners.get(section);
+    if (!rule) continue;
+    const chosen = rule.owners.length > 0 ? rule.owners : (section === void 0 ? void 0 : defaults.get(section)) ?? [];
+    if (chosen.length > 0) {
+      line = rule.line;
+      lineFromOwner = true;
+    } else if (!lineFromOwner) {
+      line = rule.line;
+    }
+    for (const o of chosen) if (!owners.includes(o)) owners.push(o);
+  }
+  return { owners, line };
+}
+var matcherCache = /* @__PURE__ */ new WeakMap();
+function matchersFor(file) {
+  let matchers = matcherCache.get(file);
+  if (!matchers) {
+    matchers = file.rules.map((r) => picomatch(toGlobs(r.pattern), PICOMATCH));
+    matcherCache.set(file, matchers);
+  }
+  return matchers;
+}
+var PICOMATCH = { dot: true, windows: false };
+function toGlobs(pattern) {
+  let p = pattern;
+  const dirOnly = p.endsWith("/");
+  if (dirOnly) p = p.slice(0, -1);
+  let anchored = false;
+  if (p.startsWith("/")) {
+    anchored = true;
+    p = p.slice(1);
+  } else if (p.includes("/") && !p.startsWith("**/")) {
+    anchored = true;
+  }
+  const base = anchored || p.startsWith("**/") ? p : `**/${p}`;
+  if (dirOnly) return [`${base}/**`];
+  const last = p.slice(p.lastIndexOf("/") + 1);
+  return /[*?[]/.test(last) ? [base] : [base, `${base}/**`];
+}
+var NOT_FOUND_REASON = `no CODEOWNERS file found (looked for ${CODEOWNERS_LOCATIONS.join(", ")})`;
+async function deriveFromCodeowners(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const explicitPath = opts.explicit === void 0 ? void 0 : resolve(opts.configDir ?? process.cwd(), opts.explicit);
+  if (explicitPath !== void 0 && !existsSync(explicitPath)) {
+    return {
+      status: { available: false, reason: `CODEOWNERS not found at ${explicitPath}` },
+      records
+    };
+  }
+  const byRoot = /* @__PURE__ */ new Map();
+  const rootCache = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const dir = dirname(input.absPath);
+    let root = rootCache.get(dir);
+    if (root === void 0) {
+      root = opts.rootOf(input.absPath);
+      rootCache.set(dir, root);
+    }
+    if (root === null) continue;
+    const bucket = byRoot.get(root);
+    if (bucket) bucket.push(input);
+    else byRoot.set(root, [input]);
+  }
+  let found = 0;
+  const parsed = /* @__PURE__ */ new Map();
+  for (const [root, bucket] of byRoot) {
+    const path = explicitPath ?? findCodeowners(root);
+    if (path === null) {
+      for (const input of bucket) records.set(input.label, null);
+      continue;
+    }
+    found += 1;
+    const label = toPosix(relative(opts.configDir ?? root, path));
+    const key = `${path}\0${label}`;
+    let file = parsed.get(key);
+    if (!file) {
+      file = readFile(path, "utf8").then(
+        (text2) => parseCodeowners(text2, path, label)
+      );
+      parsed.set(key, file);
+    }
+    let owners;
+    try {
+      owners = await file;
+    } catch (err) {
+      return {
+        status: {
+          available: false,
+          reason: `CODEOWNERS at ${label} could not be read: ${errorMessage(err)}`
+        },
+        records
+      };
+    }
+    for (const input of bucket) {
+      const rel = toPosix(relative(root, input.absPath));
+      const hit = ownersFor(owners, rel);
+      records.set(
+        input.label,
+        hit === null ? null : {
+          value: hit.owners,
+          source: "codeowners",
+          evidence: `${label}:${hit.line}`
+        }
+      );
+    }
+  }
+  if (byRoot.size === 0) {
+    return {
+      status: { available: false, reason: "no git repository contains the documents" },
+      records
+    };
+  }
+  if (found === 0 && explicitPath === void 0) {
+    return { status: { available: true, reason: NOT_FOUND_REASON }, records };
+  }
+  return { status: { available: true }, records };
+}
+function toPosix(p) {
+  return p.split(sep).join("/");
+}
+
+// src/meta/core/derive/spawn.ts
+import { spawn } from "node:child_process";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+var BinMissing = class extends Error {
+};
+function run(bin, args, opts) {
+  return new Promise((settle, reject) => {
+    let done = false;
+    const finish = (r) => {
+      if (done) return;
+      done = true;
+      settle(r);
+    };
+    const fail = (err) => {
+      if (done) return;
+      done = true;
+      reject(err);
+    };
+    let child;
+    try {
+      child = spawn(bin, [...opts.prefixArgs ?? [], ...args], {
+        cwd: opts.cwd,
+        windowsHide: true
+      });
+    } catch (err) {
+      fail(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let tooLarge = false;
+    const stop = (r) => {
+      clearTimeout(timer);
+      child.kill();
+      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
+      finish({ code: null, ...r });
+    };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+      if (stdout.length > MAX_OUTPUT_BYTES) {
+        tooLarge = true;
+        stop({ stdout, stderr, timedOut, tooLarge });
+      }
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+      if (stderr.length > MAX_OUTPUT_BYTES) {
+        tooLarge = true;
+        stop({ stdout, stderr, timedOut, tooLarge });
+      }
+    });
+    child.stdin.end();
+    const timer = setTimeout(() => {
+      timedOut = true;
+      stop({ stdout, stderr, timedOut, tooLarge });
+    }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      fail(err.code === "ENOENT" ? new BinMissing(err.message) : err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({ code, stdout, stderr, timedOut, tooLarge });
+    });
+  });
+}
+function commandLine(bin, args) {
+  return [bin, ...args].join(" ");
+}
+function lastLine(text2) {
+  const lines = text2.split(/\r?\n/).filter((l) => l.trim() !== "");
+  return lines.at(-1) ?? "";
+}
+
+// src/meta/core/derive/command.ts
+var PATH_PLACEHOLDER = "{path}";
+function isPerFile(command) {
+  return command.run.some((arg) => arg.includes(PATH_PLACEHOLDER));
+}
+function argvFor(command, label) {
+  return command.run.map((arg) => arg.split(PATH_PLACEHOLDER).join(label));
+}
+function valueOf(stdout) {
+  const text2 = stdout.trim();
+  if (text2 === "") return null;
+  if (!/^[{["]/.test(text2)) return text2;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+}
+async function deriveFromCommands(inputs, commands, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const fields = Object.keys(commands);
+  if (fields.length === 0 || inputs.length === 0) {
+    return { status: { available: true }, records };
+  }
+  for (const input of inputs) records.set(input.label, {});
+  for (const field of fields) {
+    const command = commands[field];
+    if (command === void 0) continue;
+    if (isPerFile(command)) {
+      for (const [label, record] of records) {
+        const outcome = await runOne(field, argvFor(command, label), command.timeoutMs, opts);
+        if ("reason" in outcome) return unavailable(outcome.reason);
+        record[field] = outcome.value;
+      }
+    } else {
+      const outcome = await runOne(field, command.run, command.timeoutMs, opts);
+      if ("reason" in outcome) return unavailable(outcome.reason);
+      for (const record of records.values()) record[field] = outcome.value;
+    }
+  }
+  return { status: { available: true }, records };
+}
+function unavailable(reason) {
+  return { status: { available: false, reason }, records: /* @__PURE__ */ new Map() };
+}
+async function runOne(field, argv, timeoutMs, opts) {
+  const [program, ...args] = argv;
+  const where = `(derive.commands.${field})`;
+  if (program === void 0) {
+    return { reason: `no program to run ${where}` };
+  }
+  const line = argv.join(" ");
+  let result;
+  try {
+    result = await run(opts.spawn?.bin ?? program, args, {
+      ...opts.spawn,
+      cwd: opts.spawn?.cwd ?? opts.cwd,
+      timeoutMs
+    });
+  } catch (err) {
+    if (err instanceof BinMissing) {
+      return { reason: `\`${program}\` is not on PATH ${where}` };
+    }
+    return { reason: `\`${line}\` could not be run: ${errorMessage(err)} ${where}` };
+  }
+  if (result.timedOut) {
+    return { reason: `\`${line}\` timed out after ${String(timeoutMs / 1e3)}s ${where}` };
+  }
+  if (result.tooLarge) {
+    return {
+      reason: `\`${line}\` wrote more than ${String(MAX_OUTPUT_BYTES / (1024 * 1024))} MiB; a command reports one field's value ${where}`
+    };
+  }
+  if (result.code !== 0) {
+    const last = lastLine(result.stderr);
+    const detail = last === "" ? "no output on stderr" : last;
+    const exit = result.code === null ? "killed by a signal" : `exit ${String(result.code)}`;
+    return { reason: `\`${line}\` failed (${exit}): ${detail} ${where}` };
+  }
+  const value = valueOf(result.stdout);
+  return { value: value === null ? null : { value, source: "command", evidence: line } };
+}
+
+// src/meta/core/derive/reviews.ts
+import { resolve as resolvePath } from "node:path";
+function parseOriginUrl(url) {
+  const trimmed = url.trim();
+  if (trimmed === "") return null;
+  if (isLocalPath(trimmed)) return null;
+  const scp = /^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(trimmed);
+  if (scp) {
+    const host = scp[1];
+    const path = scp[2];
+    if (host === void 0 || path === void 0) return null;
+    if (/^[A-Za-z]$/.test(host)) return null;
+    return project(host, path);
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (!/^(https?|ssh|git):$/.test(parsed.protocol)) return null;
+  if (parsed.hostname === "") return null;
+  return project(parsed.hostname, parsed.pathname);
+}
+function isLocalPath(s) {
+  return s.startsWith("/") || s.startsWith("./") || s.startsWith("../") || s.startsWith("\\\\");
+}
+function project(host, path) {
+  const segments = path.replace(/\.git$/, "").split("/").filter((s) => s !== "");
+  if (segments.length < 2) return null;
+  return { host, project: segments.join("/") };
+}
+function identityFromOrigin(host, project2, requested) {
+  const name = host.toLowerCase();
+  if (name.includes("github")) return { kind: "github", host, project: project2 };
+  if (name.includes("gitlab")) return { kind: "gitlab", host, project: project2 };
+  const only = requested !== void 0 && requested.length === 1 ? requested[0] : void 0;
+  return only === void 0 ? null : { kind: only, host, project: project2 };
+}
+var UnknownHostClient = class {
+  constructor(host) {
+    this.host = host;
+  }
+  host;
+  detect() {
+    return Promise.resolve(null);
+  }
+  status() {
+    return Promise.resolve({
+      available: false,
+      reason: `the origin remote is ${this.host}, which names neither GitHub nor GitLab; list exactly one of github, gitlab in derive.sources to say which it is`
+    });
+  }
+  mergedChangeFor() {
+    return Promise.resolve(null);
+  }
+};
+function httpStatus(stderr) {
+  const m = /\b(?:HTTP\s+(\d{3})|(\d{3})\s+Not\s+Found)\b/i.exec(stderr);
+  const code = m?.[1] ?? m?.[2];
+  return code === void 0 ? null : Number(code);
+}
+function isNotFound(r) {
+  const status = httpStatus(r.stderr);
+  return status === 404 || status === 422;
+}
+var CliClient = class {
+  constructor(identity, spawnOpts) {
+    this.identity = identity;
+    this.spawnOpts = spawnOpts;
+  }
+  identity;
+  spawnOpts;
+  detect() {
+    return Promise.resolve(this.identity);
+  }
+  async status() {
+    if (this.identity === null) {
+      return { available: false, reason: "no origin remote to tell GitHub from GitLab" };
+    }
+    const { host } = this.identity;
+    let r;
+    try {
+      r = await this.run(["auth", "status", "--hostname", host]);
+    } catch (err) {
+      if (err instanceof BinMissing) {
+        return {
+          available: false,
+          reason: `${this.tool} is not on PATH (origin is ${host}); install ${this.tool} and run ${this.tool} auth login`
+        };
+      }
+      throw err;
+    }
+    if (r.timedOut) throw this.timeout(["auth", "status", "--hostname", host]);
+    if (r.code !== 0) {
+      return {
+        available: false,
+        reason: `${this.tool} is not authenticated for ${host}; run ${this.tool} auth login`
+      };
+    }
+    return { available: true };
+  }
+  async mergedChangeFor(sha) {
+    if (this.identity === null) return null;
+    return this.lookup(this.identity, sha);
+  }
+  get bin() {
+    return this.spawnOpts.bin ?? this.tool;
+  }
+  run(args) {
+    return run(this.bin, args, this.spawnOpts);
+  }
+  timeout(args) {
+    const ms = this.spawnOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return new DocmetaError(
+      `${commandLine(this.tool, args)} timed out after ${ms}ms`
+    );
+  }
+  /**
+   * Run a call whose stdout is JSON. A not-found answer is `null`; any other
+   * failure throws, naming the command the user can re-run by hand. The
+   * message quotes the tool's own name rather than `bin`, which under test
+   * is `node`.
+   */
+  async json(args) {
+    let r;
+    try {
+      r = await this.run(args);
+    } catch (err) {
+      if (err instanceof BinMissing) {
+        throw new DocmetaError(
+          `${commandLine(this.tool, args)} failed: ${this.tool} is not on PATH`
+        );
+      }
+      throw err;
+    }
+    const cmd = commandLine(this.tool, args);
+    if (r.timedOut) throw this.timeout(args);
+    if (r.tooLarge) {
+      throw new DocmetaError(`${cmd} wrote more output than manni will read`);
+    }
+    if (r.code !== 0) {
+      if (isNotFound(r)) return null;
+      const detail = lastLine(r.stderr) || lastLine(r.stdout);
+      const exit = r.code === null ? "signal" : `exit ${r.code}`;
+      throw new DocmetaError(
+        `${cmd} failed (${exit})${detail === "" ? "" : `: ${detail}`}`
+      );
+    }
+    try {
+      return JSON.parse(r.stdout);
+    } catch {
+      throw new DocmetaError(`${cmd} did not return JSON`);
+    }
+  }
+};
+function isRecord2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function items(v) {
+  return Array.isArray(v) ? v.filter(isRecord2) : [];
+}
+function numberOf(v) {
+  return typeof v === "number" && Number.isInteger(v) ? v : null;
+}
+function stringOf(v) {
+  return typeof v === "string" && v !== "" ? v : null;
+}
+function timestampOf(v) {
+  if (v === void 0) return void 0;
+  return stringOf(v);
+}
+function normalizeLogin(login) {
+  return login.replace(/\[bot\]$/, "");
+}
+function latestApprovals(reviews) {
+  const latest = /* @__PURE__ */ new Map();
+  for (const r of reviews) {
+    if (r.state !== "APPROVED") continue;
+    const key = normalizeLogin(r.login);
+    const seen = latest.get(key);
+    if (seen === void 0 || r.submittedAt > seen.submittedAt) {
+      latest.set(key, { login: r.login, submittedAt: r.submittedAt });
+    }
+  }
+  return byTime([...latest.values()]);
+}
+function byTime(approvals) {
+  return [...approvals].sort(
+    (a, b) => a.submittedAt < b.submittedAt ? -1 : a.submittedAt > b.submittedAt ? 1 : 0
+  );
+}
+var GitHubClient = class extends CliClient {
+  tool = "gh";
+  async lookup(identity, sha) {
+    const { host, project: project2 } = identity;
+    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
+    let candidates = items(await api(`repos/${project2}/commits/${sha}/pulls`)).map(
+      (p) => ({ number: numberOf(p.number), mergedAt: timestampOf(p.merged_at) })
+    );
+    if (candidates.length === 0) {
+      const found = await this.json([
+        "pr",
+        "list",
+        "--search",
+        sha,
+        "--state",
+        "merged",
+        "--json",
+        "number,mergedAt",
+        "-R",
+        `${host}/${project2}`
+      ]);
+      candidates = items(found).map((p) => ({
+        number: numberOf(p.number),
+        mergedAt: timestampOf(p.mergedAt)
+      }));
+    }
+    for (const c of candidates) {
+      if (c.number === null) continue;
+      let mergedAt = c.mergedAt;
+      if (mergedAt === void 0) {
+        const pr = await api(`repos/${project2}/pulls/${c.number}`);
+        mergedAt = isRecord2(pr) ? stringOf(pr.merged_at) ?? null : null;
+      }
+      if (mergedAt === null) continue;
+      const raw = [];
+      for (let page = 1; ; page += 1) {
+        const batch = items(
+          await api(`repos/${project2}/pulls/${c.number}/reviews?per_page=100&page=${page}`)
+        );
+        raw.push(...batch);
+        if (batch.length < 100) break;
+      }
+      const reviews = raw.map((r) => ({
+        login: isRecord2(r.user) ? stringOf(r.user.login) : null,
+        state: stringOf(r.state),
+        submittedAt: stringOf(r.submitted_at)
+      })).filter(
+        (r) => r.login !== null && r.state !== null && r.submittedAt !== null
+      );
+      return { id: c.number, mergedAt, approvals: latestApprovals(reviews) };
+    }
+    return null;
+  }
+};
+var GitLabClient = class extends CliClient {
+  tool = "glab";
+  async lookup(identity, sha) {
+    const { host } = identity;
+    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
+    const merged = items(
+      await api(`projects/:fullpath/repository/commits/${sha}/merge_requests`)
+    ).map((mr) => ({ iid: numberOf(mr.iid), mergedAt: stringOf(mr.merged_at) })).find(
+      (mr) => mr.iid !== null && mr.mergedAt !== null
+    );
+    if (merged === void 0) return null;
+    const answer = await api(`projects/:fullpath/merge_requests/${merged.iid}/approvals`);
+    const approvedBy = isRecord2(answer) ? items(answer.approved_by) : [];
+    const approvals = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of approvedBy) {
+      const login = isRecord2(entry.user) ? stringOf(entry.user.username) : null;
+      if (login === null) continue;
+      const key = normalizeLogin(login);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      approvals.push({ login, submittedAt: merged.mergedAt });
+    }
+    return { id: merged.iid, mergedAt: merged.mergedAt, approvals };
+  }
+};
+async function createReviewClient(root, opts) {
+  const spawnOpts = { ...opts.spawn, cwd: opts.spawn?.cwd ?? root };
+  const origin = await originUrl(root);
+  const parsed = origin === null ? null : parseOriginUrl(origin);
+  const identity = parsed === null ? null : identityFromOrigin(parsed.host, parsed.project, opts.requested);
+  if (parsed !== null && identity === null) return new UnknownHostClient(parsed.host);
+  const client = identity?.kind === "gitlab" ? new GitLabClient(identity, spawnOpts) : new GitHubClient(identity, spawnOpts);
+  const cache = new ReviewCache(resolvePath(root, opts.cacheDir), opts.cache);
+  return cachedClient(client, cache, identity);
+}
+async function originUrl(root) {
+  try {
+    const r = await run("git", ["remote", "get-url", "origin"], { cwd: root });
+    if (r.code !== 0 || r.timedOut || r.tooLarge) return null;
+    return stringOf(r.stdout.trim());
+  } catch {
+    return null;
+  }
+}
+var NOTHING = { "reviewed-by": null, "last-reviewed": null };
+async function deriveFromReviews(inputs, client) {
+  const records = /* @__PURE__ */ new Map();
+  const status = await client.status();
+  if (!status.available) return { status, records };
+  const identity = await client.detect();
+  const kind = identity?.kind ?? "github";
+  const bySha = /* @__PURE__ */ new Map();
+  const changeFor = (sha) => {
+    let pending = bySha.get(sha);
+    if (pending === void 0) {
+      pending = client.mergedChangeFor(sha);
+      bySha.set(sha, pending);
+    }
+    return pending;
+  };
+  for (const input of inputs) {
+    if (input.sha === null) {
+      records.set(input.label, NOTHING);
+      continue;
+    }
+    const change = await changeFor(input.sha);
+    records.set(input.label, factsFrom(change, kind));
+  }
+  return { status, records };
+}
+function factsFrom(change, kind) {
+  if (change === null || change.approvals.length === 0) return NOTHING;
+  const ordered = byTime(change.approvals);
+  const latest = ordered.at(-1);
+  if (latest === void 0) return NOTHING;
+  const evidence = kind === "gitlab" ? `gitlab MR !${change.id}` : `github PR #${change.id}`;
+  const dateEvidence = kind === "gitlab" ? `${evidence} (merge date; GitLab records no approval time)` : evidence;
+  return {
+    "reviewed-by": {
+      value: ordered.map((a) => a.login),
+      source: kind,
+      evidence
+    },
+    "last-reviewed": {
+      value: utcDate(latest.submittedAt),
+      source: kind,
+      evidence: dateEvidence
+    }
+  };
+}
+function utcDate(iso) {
+  const ms = Date.parse(iso);
+  if (Number.isNaN(ms)) return iso;
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+// src/meta/core/derive/git.ts
+import { constants as bufferConstants } from "node:buffer";
+import { spawn as spawn2 } from "node:child_process";
+import { availableParallelism } from "node:os";
+import { dirname as dirname2, extname, isAbsolute, posix, relative as relative2, sep as sep2 } from "node:path";
+import { parse as parseYaml } from "yaml";
+
+// src/shared/concurrency.ts
+async function mapConcurrent(items2, limit, fn) {
+  const out = new Array(items2.length);
+  let next = 0;
+  const workers = Array.from(
+    { length: Math.max(1, Math.min(limit, items2.length)) },
+    async () => {
+      for (; ; ) {
+        const i = next++;
+        const item = items2[i];
+        if (i >= items2.length || item === void 0) return;
+        out[i] = await fn(item);
+      }
+    }
+  );
+  await Promise.all(workers);
+  return out;
+}
+
+// src/meta/core/derive/git.ts
+var DEFAULT_BULK_THRESHOLD = 32;
+var NULL_SHA = "0".repeat(40);
+var MAX_GIT_OUTPUT_BYTES = Math.min(
+  512 * 1024 * 1024,
+  bufferConstants.MAX_STRING_LENGTH
+);
+var HistoryTooLarge = class extends Error {
+};
+var BlobsUnreadable = class extends Error {
+  constructor(detail) {
+    super(detail);
+    this.detail = detail;
+  }
+  detail;
+};
+var BlameUnreadable = class extends Error {
+  constructor(rel, detail) {
+    super(rel);
+    this.rel = rel;
+    this.detail = detail;
+  }
+  rel;
+  detail;
+};
+function bodyOf(content, fenced) {
+  if (fenced !== true) return content;
+  const loc = locateFrontmatter(content);
+  if (!loc) return content;
+  return content.slice(0, loc.openStart) + content.slice(loc.closeEnd);
+}
+async function deriveFromGit(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const byRoot = groupByRoot(inputs);
+  if (byRoot.size === 0) {
+    return {
+      status: {
+        available: false,
+        reason: "no git repository contains the documents"
+      },
+      records
+    };
+  }
+  const threshold = opts.bulkThreshold ?? DEFAULT_BULK_THRESHOLD;
+  const machines = opts.machines ?? DEFAULT_MACHINES;
+  const wantsProvenance = opts.fields?.includes(PROVENANCE_FIELD) ?? false;
+  const maxBytes = opts.maxOutputBytes ?? MAX_GIT_OUTPUT_BYTES;
+  const parse = yamlOnce();
+  const reasons = [];
+  for (const [root, bucket] of byRoot) {
+    const run2 = (args, stdin) => runGit(args, root, stdin, maxBytes);
+    const shallow = await run2(["rev-parse", "--is-shallow-repository"]);
+    if (shallow.missing) {
+      return {
+        status: { available: false, reason: "git is not on PATH" },
+        records: /* @__PURE__ */ new Map()
+      };
+    }
+    if (shallow.code !== 0) {
+      reasons.push(`git could not read the repository at ${root}`);
+      continue;
+    }
+    if (text(shallow).trim() === "true") {
+      reasons.push(
+        `this checkout is shallow; use actions/checkout with fetch-depth: 0 (${root})`
+      );
+      continue;
+    }
+    try {
+      const found = await histories(
+        run2,
+        bucket.map((e) => e.rel),
+        threshold
+      );
+      if (found === null) {
+        reasons.push(`git could not read the history at ${root}`);
+        continue;
+      }
+      await readOtherParentBlobs(run2, found);
+      const blobs = await fetchBlobs(run2, neededBlobs(found));
+      if (!await followTakenBodies(run2, bucket, found, blobs, threshold)) {
+        reasons.push(`git could not read the history at ${root}`);
+        continue;
+      }
+      const manifestStamps = await stampsInManifests(run2, root, bucket, found, blobs, parse);
+      const facts = bucket.map(
+        (entry) => judge(
+          entry.input,
+          root,
+          found.get(entry.rel) ?? [],
+          blobs,
+          opts.now,
+          machines,
+          manifestStamps.get(entry.input.label)
+        )
+      );
+      if (wantsProvenance) {
+        const pages = await mapConcurrent(bucket, GIT_CONCURRENCY, async (entry) => ({
+          entry,
+          blame: await blameOf(run2, entry.rel, entry.input.content),
+          history: found.get(entry.rel) ?? []
+        }));
+        const evidence = await commitEvidence(run2, root, pages, blobs, parse);
+        const provenanceRun = {
+          machines,
+          ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
+        };
+        pages.forEach((page, i) => {
+          const judged = facts[i];
+          const commits = evidence[i];
+          if (judged === void 0 || commits === void 0) return;
+          const derived = provenanceFor(page.entry, page.blame, commits, provenanceRun);
+          judged.provenance = derived.value;
+          judged.provenanceDerivation = derived.derivation;
+        });
+      }
+      bucket.forEach((entry, i) => {
+        const judged = facts[i];
+        if (judged !== void 0) records.set(entry.input.label, judged);
+      });
+    } catch (err) {
+      if (err instanceof BlobsUnreadable) {
+        reasons.push(`git cat-file could not read the history (${root}): ${err.detail}`);
+        continue;
+      }
+      if (err instanceof BlameUnreadable) {
+        const why = err.detail === "" ? "" : `: ${err.detail}`;
+        reasons.push(`git blame could not read ${err.rel} (${root})${why}`);
+        continue;
+      }
+      if (!(err instanceof HistoryTooLarge)) throw err;
+      reasons.push(`git history is too large to read in one pass (${root})`);
+      continue;
+    }
+  }
+  if (reasons.length > 0) {
+    return {
+      status: { available: false, reason: reasons.join("; ") },
+      records: /* @__PURE__ */ new Map()
+    };
+  }
+  return { status: { available: true }, records };
+}
+function groupByRoot(inputs) {
+  const rootOf = /* @__PURE__ */ new Map();
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const dir = dirname2(input.absPath);
+    let root = rootOf.get(dir);
+    if (root === void 0) {
+      root = findGitRoot(dir);
+      rootOf.set(dir, root);
+    }
+    if (root === null) continue;
+    const rel = relative2(root, input.absPath).split(sep2).join("/");
+    const bucket = byRoot.get(root);
+    if (bucket) bucket.push({ input, rel });
+    else byRoot.set(root, [{ input, rel }]);
+  }
+  return byRoot;
+}
+var RECORD_FORMAT = "--format=%x1e%H%x00%aI%x00%an%x00%ae%x00%(trailers:key=Co-authored-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Reviewed-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Generated-by,valueonly,unfold,separator=%x1f)%x00%P";
+var LOG_ARGS = [
+  "-c",
+  "core.quotePath=false",
+  "log",
+  "--raw",
+  "--diff-merges=first-parent",
+  "-M",
+  "--no-abbrev",
+  RECORD_FORMAT
+];
+function histories(run2, rels, threshold, rev = "HEAD") {
+  return rels.length <= threshold ? perFileHistories(run2, rels, rev) : bulkHistories(run2, rels, rev);
+}
+async function perFileHistories(run2, rels, rev) {
+  const found = /* @__PURE__ */ new Map();
+  for (const rel of rels) {
+    const out = await run2([...LOG_ARGS, rev, "--follow", "--", pathspec(rel)]);
+    if (out.tooLarge) throw new HistoryTooLarge();
+    if (out.code !== 0) {
+      if (await isUnbornHead(run2)) return found;
+      return null;
+    }
+    const attributed = attribute(parseLog(text(out)), [rel]);
+    found.set(rel, attributed.get(rel) ?? []);
+  }
+  return found;
+}
+async function bulkHistories(run2, rels, rev) {
+  const out = await run2([...LOG_ARGS, rev]);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) {
+    if (await isUnbornHead(run2)) return /* @__PURE__ */ new Map();
+    return null;
+  }
+  return attribute(parseLog(text(out)), [...rels]);
+}
+async function followTakenBodies(run2, bucket, found, blobs, threshold) {
+  for (; ; ) {
+    const byParent = /* @__PURE__ */ new Map();
+    for (const entry of bucket) {
+      const history = found.get(entry.rel) ?? [];
+      const taken = takenMerge(entry.input.extracted.fenced, history, blobs);
+      if (taken === void 0) continue;
+      const group = byParent.get(taken.parent) ?? [];
+      group.push({ rel: entry.rel, keep: history.slice(0, taken.index), path: taken.path });
+      byParent.set(taken.parent, group);
+    }
+    if (byParent.size === 0) return true;
+    const walked = /* @__PURE__ */ new Map();
+    for (const [parent, group] of byParent) {
+      const paths = [...new Set(group.map((g) => g.path))];
+      const side = await histories(run2, paths, threshold, parent);
+      if (side === null) return false;
+      for (const g of group) {
+        const tail = side.get(g.path) ?? [];
+        walked.set(g.rel, tail);
+        found.set(g.rel, [...g.keep, ...tail]);
+      }
+    }
+    await readOtherParentBlobs(run2, walked);
+    const missing = new Set([...neededBlobs(walked)].filter((sha) => !blobs.has(sha)));
+    for (const [sha, content] of await fetchBlobs(run2, missing)) blobs.set(sha, content);
+  }
+}
+function takenMerge(fenced, history, blobs) {
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const index = history.findIndex((h) => !sameBody(blobBody(h.newBlob), blobBody(h.oldBlob)));
+  const newest = history[index];
+  if (newest === void 0) return void 0;
+  const body = blobBody(newest.newBlob);
+  const k = newest.otherParentBlobs.findIndex((b) => b !== null && sameBody(body, blobBody(b)));
+  const parent = newest.otherParents[k];
+  if (k === -1 || parent === void 0) return void 0;
+  return { index, parent, path: newest.pathAtCommit };
+}
+function pathspec(rel) {
+  return /[*?[\]]/.test(rel) ? `:(literal)${rel}` : rel;
+}
+async function isUnbornHead(run2) {
+  const out = await run2(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
+  return !out.missing && out.code !== 0;
+}
+function parseLog(text2) {
+  const records = [];
+  for (const chunk of text2.split("")) {
+    if (chunk === "") continue;
+    const nl = chunk.indexOf("\n");
+    const header = nl === -1 ? chunk : chunk.slice(0, nl);
+    const fields = header.split("\0");
+    const sha = fields[0];
+    if (sha === void 0 || sha === "") continue;
+    const raw = [];
+    if (nl !== -1) {
+      for (const line of chunk.slice(nl + 1).split("\n")) {
+        const entry = parseRawLine(line);
+        if (entry) raw.push(entry);
+      }
+    }
+    records.push({
+      sha,
+      authorDate: fields[1] ?? "",
+      authorName: fields[2] ?? "",
+      authorEmail: fields[3] ?? "",
+      coAuthors: splitTrailers(fields[4]),
+      reviewedBy: splitTrailers(fields[5]),
+      generatedBy: splitTrailers(fields[6]),
+      parents: (fields[7] ?? "").trim().split(" ").filter((p) => p !== ""),
+      raw
+    });
+  }
+  return records;
+}
+function splitTrailers(field) {
+  if (field === void 0 || field === "") return [];
+  return field.split("").map((s) => s.trim()).filter((s) => s !== "");
+}
+function parseRawLine(line) {
+  if (!line.startsWith(":")) return null;
+  const tab = line.indexOf("	");
+  if (tab === -1) return null;
+  const meta = line.slice(1, tab).split(" ");
+  const oldBlob = meta[2];
+  const newBlob = meta[3];
+  const status = meta[4];
+  if (oldBlob === void 0 || newBlob === void 0 || status === void 0) {
+    return null;
+  }
+  const paths = line.slice(tab + 1).split("	").map(unquotePath);
+  const first = paths[0];
+  if (first === void 0) return null;
+  const second = paths[1];
+  const renamed = status.startsWith("R") || status.startsWith("C");
+  return {
+    status,
+    oldBlob,
+    newBlob,
+    oldPath: first,
+    newPath: renamed && second !== void 0 ? second : first
+  };
+}
+function unquotePath(p) {
+  if (p.length < 2 || !p.startsWith('"') || !p.endsWith('"')) return p;
+  const inner = p.slice(1, -1);
+  const bytes = [];
+  for (let i = 0; i < inner.length; i += 1) {
+    const ch = inner[i];
+    if (ch !== "\\") {
+      bytes.push(...Buffer.from(ch ?? "", "utf8"));
+      continue;
+    }
+    const next = inner[i + 1];
+    if (next === void 0) break;
+    const octal = /^[0-7]{3}/.exec(inner.slice(i + 1));
+    if (octal) {
+      bytes.push(parseInt(octal[0], 8));
+      i += 3;
+      continue;
+    }
+    const simple = {
+      a: 7,
+      b: 8,
+      t: 9,
+      n: 10,
+      v: 11,
+      f: 12,
+      r: 13,
+      '"': 34,
+      "\\": 92
+    };
+    const code = simple[next];
+    if (code === void 0) bytes.push(...Buffer.from(next, "utf8"));
+    else bytes.push(code);
+    i += 1;
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function attribute(records, wanted) {
+  const histories2 = /* @__PURE__ */ new Map();
+  const tracked = /* @__PURE__ */ new Map();
+  for (const rel of wanted) {
+    histories2.set(rel, []);
+    tracked.set(rel, rel);
+  }
+  for (const record of records) {
+    if (record.raw.length === 0) continue;
+    const byNewPath = /* @__PURE__ */ new Map();
+    for (const entry of record.raw) byNewPath.set(entry.newPath, entry);
+    for (const [rel, current] of tracked) {
+      const entry = byNewPath.get(current);
+      if (!entry) continue;
+      histories2.get(rel)?.push({
+        sha: record.sha,
+        authorDate: record.authorDate,
+        authorName: record.authorName,
+        authorEmail: record.authorEmail,
+        coAuthors: record.coAuthors,
+        reviewedBy: record.reviewedBy,
+        generatedBy: record.generatedBy,
+        oldBlob: entry.oldBlob === NULL_SHA ? null : entry.oldBlob,
+        newBlob: entry.newBlob === NULL_SHA ? null : entry.newBlob,
+        pathAtCommit: entry.newPath,
+        otherParents: record.parents.slice(1),
+        otherParentBlobs: []
+      });
+      if (entry.oldPath !== entry.newPath) tracked.set(rel, entry.oldPath);
+    }
+  }
+  return histories2;
+}
+function neededBlobs(histories2) {
+  const shas = /* @__PURE__ */ new Set();
+  for (const history of histories2.values()) {
+    for (const h of history) {
+      if (h.oldBlob !== null) shas.add(h.oldBlob);
+      if (h.newBlob !== null) shas.add(h.newBlob);
+      for (const b of h.otherParentBlobs) if (b !== null) shas.add(b);
+    }
+  }
+  return shas;
+}
+async function readOtherParentBlobs(run2, histories2) {
+  const merges = [];
+  const specs = [];
+  for (const history of histories2.values()) {
+    for (const h of history) {
+      if (h.otherParents.length === 0) continue;
+      merges.push(h);
+      for (const parent of h.otherParents) specs.push(`${parent}:${h.pathAtCommit}`);
+    }
+  }
+  if (specs.length === 0) return;
+  const out = await run2(["cat-file", "--batch-check"], `${specs.join("\n")}
+`);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  const lines = text(out).split("\n");
+  let i = 0;
+  for (const h of merges) {
+    h.otherParentBlobs = h.otherParents.map(() => blobOfCheckLine(lines[i++]));
+  }
+}
+function blobOfCheckLine(line) {
+  const [sha, kind] = (line ?? "").split(" ");
+  if (sha === void 0 || kind !== "blob" || !/^[0-9a-f]{40,64}$/.test(sha)) return null;
+  return sha;
+}
+async function fetchBlobs(run2, shas) {
+  const blobs = /* @__PURE__ */ new Map();
+  if (shas.size === 0) return blobs;
+  const out = await run2(["cat-file", "--batch"], `${[...shas].join("\n")}
+`);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  const buf = out.raw;
+  let cursor = 0;
+  while (cursor < buf.length) {
+    const nl = buf.indexOf(10, cursor);
+    if (nl === -1) break;
+    const header = buf.toString("utf8", cursor, nl).split(" ");
+    cursor = nl + 1;
+    const sha = header[0];
+    const kind = header[1];
+    const size = Number(header[2]);
+    if (sha === void 0 || kind !== "blob" || !Number.isFinite(size)) {
+      continue;
+    }
+    blobs.set(sha, buf.toString("utf8", cursor, cursor + size));
+    cursor += size + 1;
+  }
+  return blobs;
+}
+var git = (value, evidence) => ({
+  value,
+  source: "git",
+  evidence
+});
+function factCommits(input, history, blobs) {
+  const fenced = input.extracted.fenced;
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const bodyChanging = [...history].reverse().filter((h) => {
+    const body = blobBody(h.newBlob);
+    if (sameBody(body, blobBody(h.oldBlob))) return false;
+    return !h.otherParentBlobs.some((b) => b !== null && sameBody(body, blobBody(b)));
+  });
+  return {
+    bodyChanging,
+    oldest: history[history.length - 1],
+    newestBody: bodyChanging[bodyChanging.length - 1]
+  };
+}
+async function stampsInManifests(run2, root, bucket, histories2, blobs, parse) {
+  const reads = [];
+  for (const entry of bucket) {
+    const refs = entry.input.stampManifests;
+    if (refs === void 0) continue;
+    const { oldest, newestBody } = factCommits(entry.input, histories2.get(entry.rel) ?? [], blobs);
+    for (const field of STAMPED_DATE_FIELDS) {
+      const ref = refs[field];
+      const at = field === "created" ? oldest : newestBody;
+      if (ref === void 0 || at === void 0) continue;
+      const rel = insideRoot(root, ref.absPath);
+      if (rel === void 0) continue;
+      const key = ref.join === "path" ? entryAt(ref.entry, entry.rel, at.pathAtCommit) : ref.entry;
+      const revs = field === "created" ? [at.sha] : [at.sha, `${at.sha}^`];
+      for (const rev of revs) {
+        reads.push({ label: entry.input.label, field, rev, spec: `${rev}:${rel}`, key, join: ref.join });
+      }
+    }
+  }
+  const out = /* @__PURE__ */ new Map();
+  if (reads.length === 0) return out;
+  const fetched = await fetchSpecs(run2, [...new Set(reads.map((r) => r.spec))]);
+  const values = /* @__PURE__ */ new Map();
+  const keyOf = (label, field, rev) => `${label}\0${field}\0${rev}`;
+  for (const r of reads) {
+    values.set(keyOf(r.label, r.field, r.rev), manifestValue(fetched.get(r.spec), r.key, r.join, r.field, parse));
+  }
+  for (const label of new Set(reads.map((r) => r.label))) {
+    out.set(label, (field, rev) => values.get(keyOf(label, field, rev)));
+  }
+  return out;
+}
+function judge(input, root, history, blobs, now, machines, manifestStamp2) {
+  const fenced = input.extracted.fenced;
+  const extractor = extractorFor(input);
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const stampsOf = (sha) => {
+    if (sha === null) return {};
+    const content = blobs.get(sha);
+    return content === void 0 ? {} : extractStamps(extractor, content, input.absPath);
+  };
+  const stampAt = (field, h, parent) => {
+    const kept = manifestStamp2?.(field, parent ? `${h.sha}^` : h.sha);
+    if (kept !== void 0 && kept !== null) return kept;
+    return stampsOf(parent ? h.oldBlob : h.newBlob)[field];
+  };
+  const { bodyChanging, oldest, newestBody } = factCommits(input, history, blobs);
+  const head = history[0];
+  const headBlob = head === void 0 ? null : head.newBlob;
+  const created = oldest === void 0 ? null : createdOf(oldest, stampAt("created", oldest, false));
+  const workingChanged = !sameBody(
+    bodyOf(input.content, fenced),
+    headBlob === null ? null : blobBody(headBlob)
+  );
+  let lastUpdated;
+  let lastBodyCommit;
+  if (workingChanged) {
+    lastBodyCommit = null;
+    const working = input.extracted.data["last-updated"];
+    const committed = stampsOf(headBlob)["last-updated"];
+    lastUpdated = working !== void 0 && working !== null && !sameValue(working, committed) ? git(working, "stamped in working tree") : git(utcDate2(now()), "uncommitted body change");
+  } else if (newestBody === void 0) {
+    lastBodyCommit = null;
+    lastUpdated = null;
+  } else {
+    lastBodyCommit = newestBody.sha;
+    lastUpdated = lastUpdatedOf(
+      newestBody,
+      stampAt("last-updated", newestBody, false),
+      stampAt("last-updated", newestBody, true)
+    );
+  }
+  const authors = bodyChanging.length === 0 ? null : authorsOf(bodyChanging, machines);
+  let reviewedBy = null;
+  let lastReviewed = null;
+  if (!workingChanged && newestBody !== void 0 && newestBody.reviewedBy.length > 0) {
+    const evidence = `Reviewed-by trailer in ${short(newestBody.sha)}`;
+    reviewedBy = git(newestBody.reviewedBy.map(nameOf), evidence);
+    lastReviewed = git(datePart(newestBody.authorDate), evidence);
+  }
+  return {
+    created,
+    "last-updated": lastUpdated,
+    authors,
+    "reviewed-by": reviewedBy,
+    "last-reviewed": lastReviewed,
+    provenance: null,
+    lastBodyCommit,
+    root
+  };
+}
+function createdOf(oldest, stamp) {
+  if (stamp !== void 0 && stamp !== null) {
+    return git(stamp, `stamped in ${short(oldest.sha)}`);
+  }
+  const date = datePart(oldest.authorDate);
+  return git(date, `added in ${short(oldest.sha)} (${date})`);
+}
+function lastUpdatedOf(commit, stamp, before) {
+  if (stamp !== void 0 && stamp !== null && !sameValue(stamp, before)) {
+    return git(stamp, `stamped in ${short(commit.sha)}`);
+  }
+  const date = datePart(commit.authorDate);
+  return git(date, `body changed in ${short(commit.sha)} (${date})`);
+}
+function authorsOf(bodyChanging, machines) {
+  const seen = /* @__PURE__ */ new Set();
+  const names = [];
+  const add = (name, email) => {
+    if (name === "") return;
+    const identity = email === null || email === "" ? name : `${name} <${email}>`;
+    if (machineIdentity(identity, machines) !== void 0) return;
+    const key = email === null || email === "" ? `name:${name.toLowerCase()}` : email.toLowerCase();
+    if (seen.has(key)) return;
+    seen.add(key);
+    names.push(name);
+  };
+  for (const h of bodyChanging) {
+    add(h.authorName, h.authorEmail);
+    for (const co of h.coAuthors) add(nameOf(co), emailOf(co));
+  }
+  const n = bodyChanging.length;
+  return git(names, `${n} body-changing ${n === 1 ? "commit" : "commits"}`);
+}
+function provenanceFenced(extracted) {
+  return extracted.fenced === true || extracted.format === "markdown" || extracted.format === "mdx";
+}
+var OUTSIDE_RANGE = "outside-the-attributed-range";
+var ATTRIBUTED = ":attributed";
+function provenanceFor(entry, blame, commits, opts) {
+  const { input } = entry;
+  const fenced = provenanceFenced(input.extracted);
+  const base = { content: input.content, commits, machines: opts.machines, fenced };
+  let derivation;
+  const attribution = input.attribution;
+  if (attribution !== void 0) {
+    const page = readProvenancePage(input.content, { fenced });
+    const { bodyLine } = page;
+    const ranges = attribution.targets.flatMap((target) => {
+      const entry2 = attributeRange({ ...base, blame, target, generatedBy: attribution.generatedBy, page });
+      const span = entry2 === void 0 ? void 0 : parseLines(entry2.lines);
+      return span === void 0 ? [] : [toFileLines(span, bodyLine)];
+    });
+    const inRange = (line) => ranges.some((range) => line.finalLine >= range.start && line.finalLine <= range.end);
+    const attributed = new Map(commits);
+    const trailers = { generatedBy: [attribution.generatedBy], coAuthoredBy: [] };
+    attributed.set(OUTSIDE_RANGE, { sha: OUTSIDE_RANGE, trailers: { generatedBy: [], coAuthoredBy: [] } });
+    const rekeyed = blame.map((line) => {
+      if (inRange(line)) {
+        if (line.uncommitted) return line;
+        const sha = `${line.sha}${ATTRIBUTED}`;
+        attributed.set(sha, { sha, trailers });
+        return { ...line, sha };
+      }
+      return line.uncommitted ? { ...line, sha: OUTSIDE_RANGE, uncommitted: false } : line;
+    });
+    derivation = deriveProvenance({
+      ...base,
+      commits: attributed,
+      generatedBy: attribution.generatedBy,
+      blame: rekeyed
+    });
+  } else {
+    derivation = deriveProvenance({
+      ...base,
+      blame,
+      ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
+    });
+  }
+  const entries = derivation.derived.map((d) => d.entry);
+  return {
+    value: entries.length === 0 ? null : git(entries, provenanceEvidence(derivation)),
+    derivation
+  };
+}
+function provenanceEvidence(derivation) {
+  const shas = [];
+  let uncommitted = false;
+  for (const range of derivation.derived) {
+    for (let n = range.span.start; n <= range.span.end; n++) {
+      const evidence = derivation.evidenceByLine.get(n);
+      if (evidence?.machine === void 0) continue;
+      if (evidence.rule === 1) uncommitted = true;
+      else if (!shas.includes(evidence.sha)) shas.push(evidence.sha);
+    }
+  }
+  const first = shas[0];
+  if (first === void 0) return "uncommitted";
+  const parts = [`blame ${short(first)}`];
+  if (shas.length > 1) parts.push(`${String(shas.length)} commits`);
+  if (uncommitted) parts.push("uncommitted");
+  return parts.join(", ");
+}
+async function blameOf(run2, rel, content) {
+  const out = await run2([
+    "-c",
+    "core.quotePath=false",
+    "blame",
+    "--no-ignore-revs-file",
+    "--line-porcelain",
+    "--",
+    rel
+  ]);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) {
+    const inHead = await run2(["cat-file", "-e", `HEAD:${rel}`]);
+    if (inHead.code !== 0) {
+      return splitLines(content).map((line, i) => ({
+        sha: ZERO_SHA,
+        origLine: i + 1,
+        finalLine: i + 1,
+        author: "Not Committed Yet",
+        authorMail: "not.committed.yet",
+        filename: rel,
+        boundary: false,
+        uncommitted: true,
+        content: line
+      }));
+    }
+    throw new BlameUnreadable(rel, out.stderr.trim());
+  }
+  return parseLinePorcelain(text(out));
+}
+async function commitEvidence(run2, root, pages, blobs, parse) {
+  const plans = pages.map(({ entry, blame, history }) => {
+    const pathAt = /* @__PURE__ */ new Map();
+    for (const line of blame) {
+      if (!line.uncommitted && !pathAt.has(line.sha)) pathAt.set(line.sha, unquotePath(line.filename));
+    }
+    const trailers = /* @__PURE__ */ new Map();
+    const pageBlob = /* @__PURE__ */ new Map();
+    for (const h of history) {
+      trailers.set(h.sha, { generatedBy: h.generatedBy, coAuthoredBy: h.coAuthors });
+      const blob = h.newBlob === null ? void 0 : blobs.get(h.newBlob);
+      if (blob !== void 0) pageBlob.set(h.sha, blob);
+    }
+    const manifest = entry.input.provenanceManifest;
+    const manifestRel = manifest === void 0 ? void 0 : insideRoot(root, manifest.absPath);
+    return { entry, pathAt, trailers, pageBlob, manifest, manifestRel };
+  });
+  const unlogged = /* @__PURE__ */ new Set();
+  const specs = /* @__PURE__ */ new Set();
+  for (const { pathAt, trailers, pageBlob, manifestRel } of plans) {
+    for (const [sha, path] of pathAt) {
+      if (!trailers.has(sha)) unlogged.add(sha);
+      if (!pageBlob.has(sha)) specs.add(`${sha}:${path}`);
+      if (manifestRel !== void 0) specs.add(`${sha}:${manifestRel}`);
+    }
+  }
+  const logged = /* @__PURE__ */ new Map();
+  if (unlogged.size > 0) {
+    const out = await run2(["log", "--no-walk=unsorted", "--stdin", RECORD_FORMAT], `${[...unlogged].join("\n")}
+`);
+    if (out.tooLarge) throw new HistoryTooLarge();
+    if (out.code !== 0) throw new BlobsUnreadable(`git log exit ${String(out.code)}`);
+    for (const record of parseLog(text(out))) {
+      logged.set(record.sha, { generatedBy: record.generatedBy, coAuthoredBy: record.coAuthors });
+    }
+  }
+  const fetched = await fetchSpecs(run2, [...specs]);
+  return plans.map(({ entry, pathAt, trailers, pageBlob, manifest, manifestRel }) => {
+    const commits = /* @__PURE__ */ new Map();
+    for (const [sha, path] of pathAt) {
+      const blob = pageBlob.get(sha) ?? fetched.get(`${sha}:${path}`);
+      commits.set(sha, {
+        sha,
+        trailers: trailers.get(sha) ?? logged.get(sha) ?? { generatedBy: [], coAuthoredBy: [] },
+        ...blob !== void 0 ? { blob } : {},
+        ...manifest !== void 0 ? {
+          stamp: manifestRel === void 0 ? [] : manifestStamp(
+            fetched.get(`${sha}:${manifestRel}`),
+            manifest.join === "path" ? entryAt(manifest.entry, entry.rel, path) : manifest.entry,
+            manifest.join,
+            parse
+          )
+        } : {}
+      });
+    }
+    return commits;
+  });
+}
+function insideRoot(root, abs) {
+  const rel = relative2(root, abs);
+  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return void 0;
+  return rel.split(sep2).join("/");
+}
+function entryAt(entry, rel, relAtCommit) {
+  if (relAtCommit === rel) return entry;
+  const fromHere = posix.relative(posix.dirname(rel), relAtCommit);
+  return posix.join(posix.dirname(entry), fromHere);
+}
+function manifestStamp(text2, key, join2, parse) {
+  return provenanceEntries(manifestValue(text2, key, join2, PROVENANCE_FIELD, parse));
+}
+function yamlOnce() {
+  const parsed = /* @__PURE__ */ new Map();
+  return (text2) => {
+    if (parsed.has(text2)) return parsed.get(text2);
+    let data;
+    try {
+      data = parseYaml(text2);
+    } catch {
+      data = void 0;
+    }
+    parsed.set(text2, data);
+    return data;
+  };
+}
+function manifestValue(text2, key, join2, field, parse) {
+  if (text2 === void 0) return void 0;
+  const data = parse(text2);
+  if (!isRecord3(data)) return void 0;
+  for (const [candidate, value] of Object.entries(data)) {
+    const same = join2 === "path" ? posix.normalize(candidate) === posix.normalize(key) : candidate === key;
+    if (same && isRecord3(value)) return value[field];
+  }
+  return void 0;
+}
+function isRecord3(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+async function fetchSpecs(run2, specs) {
+  const found = /* @__PURE__ */ new Map();
+  if (specs.length === 0) return found;
+  const out = await run2(["cat-file", "--batch"], `${specs.join("\n")}
+`);
+  if (out.tooLarge && specs.length > 1) {
+    const half = Math.ceil(specs.length / 2);
+    const first = await fetchSpecs(run2, specs.slice(0, half));
+    const rest = await fetchSpecs(run2, specs.slice(half));
+    return new Map([...first, ...rest]);
+  }
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  for (const [spec, content] of parseSpecBatch(out.raw, specs)) found.set(spec, content);
+  return found;
+}
+function parseSpecBatch(buf, specs) {
+  const found = /* @__PURE__ */ new Map();
+  let cursor = 0;
+  for (const spec of specs) {
+    const nl = buf.indexOf(10, cursor);
+    if (nl === -1) throw new BlobsUnreadable(`the answer ends before ${spec}`);
+    const header = buf.toString("utf8", cursor, nl);
+    cursor = nl + 1;
+    if (header.endsWith(" missing") || header.endsWith(" ambiguous")) continue;
+    const parts = header.split(" ");
+    const size = Number(parts[2]);
+    if (parts.length !== 3 || !Number.isInteger(size) || size < 0) {
+      throw new BlobsUnreadable(`unreadable header for ${spec}: ${header}`);
+    }
+    if (parts[1] === "blob") found.set(spec, buf.toString("utf8", cursor, cursor + size));
+    cursor += size + 1;
+  }
+  return found;
+}
+function extractorFor(input) {
+  return extractorByName(input.extracted.format) ?? extractorForExtension(extname(input.absPath));
+}
+function extractStamps(extractor, content, filePath) {
+  if (!extractor) return {};
+  try {
+    return extractor.extract(content, filePath).data;
+  } catch {
+    return {};
+  }
+}
+function sameBody(a, b) {
+  if (a === null || b === null) return a === b;
+  return a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
+}
+function sameValue(a, b) {
+  return toJsonText(a) === toJsonText(b);
+}
+var short = (sha) => sha.slice(0, 7);
+var datePart = (iso) => {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? "" : utcDate2(d);
+};
+function utcDate2(d) {
+  return d.toISOString().slice(0, 10);
+}
+function nameOf(trailer) {
+  const lt = trailer.lastIndexOf("<");
+  return (lt === -1 ? trailer : trailer.slice(0, lt)).trim();
+}
+function emailOf(trailer) {
+  const m = /<([^>]*)>\s*$/.exec(trailer);
+  return m?.[1]?.trim() ?? null;
+}
+var MAX_STDERR_BYTES = 16 * 1024;
+var GIT_CONCURRENCY = Math.min(8, availableParallelism());
+function text(out) {
+  try {
+    return out.raw.toString("utf8");
+  } catch {
+    throw new HistoryTooLarge();
+  }
+}
+function runGit(args, cwd, stdin, maxBytes) {
+  return new Promise((settle, reject) => {
+    let done = false;
+    const finish = (out) => {
+      if (done) return;
+      done = true;
+      settle(out);
+    };
+    const fail = (err) => {
+      if (done) return;
+      done = true;
+      reject(err instanceof Error ? err : new Error(String(err)));
+    };
+    const failed = (missing) => ({
+      code: null,
+      raw: Buffer.alloc(0),
+      missing,
+      tooLarge: false,
+      stderr: ""
+    });
+    let child;
+    try {
+      child = spawn2("git", args, { cwd, windowsHide: true });
+    } catch {
+      finish(failed(true));
+      return;
+    }
+    let chunks = [];
+    let total = 0;
+    let tooLarge = false;
+    child.stdout.on("data", (chunk) => {
+      if (tooLarge) return;
+      total += chunk.length;
+      if (total > maxBytes) {
+        tooLarge = true;
+        chunks = [];
+        child.kill();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    const errChunks = [];
+    let errTotal = 0;
+    child.stderr.on("data", (chunk) => {
+      if (errTotal >= MAX_STDERR_BYTES) return;
+      const kept = chunk.subarray(0, MAX_STDERR_BYTES - errTotal);
+      errTotal += kept.length;
+      errChunks.push(kept);
+    });
+    child.on("error", (err) => {
+      finish(failed(err.code === "ENOENT"));
+    });
+    child.stdin.on("error", () => {
+    });
+    child.on("close", (code) => {
+      try {
+        const raw = tooLarge ? Buffer.alloc(0) : Buffer.concat(chunks);
+        const stderr = Buffer.concat(errChunks).toString("utf8");
+        finish({ code, raw, missing: false, tooLarge, stderr });
+      } catch (err) {
+        fail(err);
+      }
+    });
+    if (stdin === void 0) child.stdin.end();
+    else child.stdin.end(stdin);
+  });
+}
+
+// src/meta/core/derive/index.ts
+var FIELD_SOURCES = {
+  created: ["git"],
+  "last-updated": ["git"],
+  authors: ["git"],
+  owner: ["codeowners"],
+  "reviewed-by": ["github", "gitlab", "git"],
+  "last-reviewed": ["github", "gitlab", "git"],
+  provenance: ["git"]
+};
+var REVIEW_SOURCES = ["github", "gitlab"];
+var HOST_NAME = {
+  github: "GitHub",
+  gitlab: "GitLab"
+};
+function sourcesFor(field, commands) {
+  if (isBuiltinField(field)) return FIELD_SOURCES[field];
+  if (commands !== void 0 && Object.hasOwn(commands, field)) return ["command"];
+  return [];
+}
+function consultedSources(fields, sources, commands) {
+  const needed = /* @__PURE__ */ new Set();
+  for (const field of fields) {
+    for (const s of sourcesFor(field, commands)) needed.add(s);
+  }
+  return sources.filter((s) => needed.has(s));
+}
+function assertSourcesAvailable(sources, hint) {
+  for (const name of Object.keys(sources)) {
+    const status = sources[name];
+    if (status === void 0 || status.available) continue;
+    const reason = status.reason ?? "it could not answer";
+    throw new DocmetaError(
+      `${name} source unavailable: ${reason}${hint === void 0 ? "" : `; ${hint}`}`
+    );
+  }
+}
+async function deriveMetadata(inputs, ctx) {
+  const consulted = new Set(consultedSources(ctx.fields, ctx.sources, ctx.commands));
+  const sources = {};
+  let git2 = /* @__PURE__ */ new Map();
+  if (consulted.has("git")) {
+    const result = await deriveFromGit(inputs, {
+      cwd: ctx.cwd,
+      now: ctx.now,
+      fields: ctx.fields,
+      ...ctx.generatedBy !== void 0 ? { generatedBy: ctx.generatedBy } : {},
+      ...ctx.machines !== void 0 ? { machines: ctx.machines } : {}
+    });
+    sources.git = result.status;
+    git2 = result.records;
+  }
+  const provenance = /* @__PURE__ */ new Map();
+  for (const [label, facts] of git2) {
+    if (facts.provenanceDerivation !== void 0) provenance.set(label, facts.provenanceDerivation);
+  }
+  const rootCache = /* @__PURE__ */ new Map();
+  const rootOf = (absPath) => {
+    const dir = dirname3(absPath);
+    let root = rootCache.get(dir);
+    if (root === void 0) {
+      root = findGitRoot(dir);
+      rootCache.set(dir, root);
+    }
+    return root;
+  };
+  const rootFor = (input) => git2.get(input.label)?.root ?? rootOf(input.absPath);
+  let owners = /* @__PURE__ */ new Map();
+  if (consulted.has("codeowners")) {
+    const result = await deriveFromCodeowners(inputs, {
+      explicit: ctx.codeowners,
+      configDir: ctx.configDir,
+      rootOf
+    });
+    sources.codeowners = result.status;
+    owners = result.records;
+  }
+  const requested = REVIEW_SOURCES.filter((s) => consulted.has(s));
+  let reviews = /* @__PURE__ */ new Map();
+  if (requested.length > 0) {
+    if (!consulted.has("git")) {
+      for (const s of requested) {
+        sources[s] = {
+          available: false,
+          reason: `the ${s} source needs the git source to find each document's commits; add git to sources`
+        };
+      }
+    } else if (sources.git?.available === false) {
+      for (const s of requested) {
+        sources[s] = {
+          available: false,
+          reason: `the git source could not answer, so the ${s} source cannot locate any commit`
+        };
+      }
+    } else {
+      const result = await deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested);
+      Object.assign(sources, result.status);
+      reviews = result.records;
+    }
+  }
+  let commanded = /* @__PURE__ */ new Map();
+  const doomed = Object.values(sources).some((s) => !s.available);
+  if (consulted.has("command") && ctx.commands !== void 0 && !doomed) {
+    const wanted = new Set(ctx.fields);
+    const commands = Object.fromEntries(
+      Object.entries(ctx.commands).filter(([field]) => wanted.has(field))
+    );
+    if (Object.keys(commands).length > 0) {
+      const result = await deriveFromCommands(inputs, commands, { cwd: ctx.configDir ?? ctx.cwd });
+      sources.command = result.status;
+      commanded = result.records;
+    }
+  }
+  const records = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const fields = {};
+    const g = git2.get(input.label);
+    const r = reviews.get(input.label);
+    const c = commanded.get(input.label);
+    for (const field of ctx.fields) {
+      let value = null;
+      for (const source of sourcesFor(field, ctx.commands)) {
+        if (!consulted.has(source)) continue;
+        const candidate = valueFrom(source, field, g, r, owners.get(input.label), c);
+        if (candidate !== null) {
+          value = candidate;
+          break;
+        }
+      }
+      fields[field] = value;
+    }
+    records.set(input.label, { file: input.label, fields });
+  }
+  return { records, sources, ...provenance.size > 0 ? { provenance } : {} };
+}
+function valueFrom(source, field, git2, reviews, owner, commanded) {
+  switch (source) {
+    case "git":
+      if (git2 === void 0 || !isBuiltinField(field) || field === "owner") return null;
+      return git2[field];
+    case "command":
+      return commanded?.[field] ?? null;
+    case "codeowners":
+      return field === "owner" ? owner ?? null : null;
+    case "github":
+    case "gitlab": {
+      if (reviews === void 0) return null;
+      if (field !== "reviewed-by" && field !== "last-reviewed") return null;
+      const fact = reviews[field];
+      return fact !== null && fact.source === source ? fact : null;
+    }
+  }
+}
+async function deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested) {
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const root = rootFor(input);
+    if (root === null) continue;
+    const bucket = byRoot.get(root) ?? [];
+    bucket.push(input);
+    byRoot.set(root, bucket);
+  }
+  const status = {};
+  const records = /* @__PURE__ */ new Map();
+  const unavailable2 = (which, reason) => {
+    for (const s of which) status[s] = { available: false, reason };
+    return { status, records: /* @__PURE__ */ new Map() };
+  };
+  if (byRoot.size === 0) {
+    return unavailable2(requested, "no git repository contains the documents");
+  }
+  const cacheDir = resolve2(ctx.configDir ?? ctx.cwd, REVIEW_CACHE_DIR);
+  for (const [root, bucket] of byRoot) {
+    const client = ctx.reviews ?? await createReviewClient(root, { cwd: ctx.cwd, cache: ctx.cache, cacheDir, requested });
+    const identity = await client.detect();
+    if (identity === null) {
+      const s = await client.status();
+      return unavailable2(requested, s.reason ?? "no origin remote to tell GitHub from GitLab");
+    }
+    const source = identity.kind;
+    if (!requested.includes(source)) {
+      return unavailable2(
+        requested,
+        `the origin remote is ${identity.host}, which is ${HOST_NAME[source]}; add ${source} to sources, or drop reviewed-by and last-reviewed from the managed fields`
+      );
+    }
+    const result = await deriveFromReviews(
+      bucket.map((input) => ({
+        label: input.label,
+        sha: git2.get(input.label)?.lastBodyCommit ?? null
+      })),
+      client
+    );
+    if (!result.status.available) {
+      status[source] = result.status;
+      return { status, records: /* @__PURE__ */ new Map() };
+    }
+    status[source] = result.status;
+    for (const [label, facts] of result.records) records.set(label, facts);
+  }
+  return { status, records };
+}
+
+// src/meta/core/derive/table.ts
+var DERIVED_VIEW = "derived";
+var DERIVED_ROWS = "_derived_rows";
+var RESOLVED_VIEW = "resolved";
+var ORIGIN_COLUMN = "_origin";
+var SOURCES_COLUMN = "_sources";
+function derivedColumns(commands) {
+  return ["_path", ...derivableFields(commands), SOURCES_COLUMN];
+}
+function mentionsDerived(sql) {
+  return /\b(?:from|join|update|into|table|view)\s+(?:"derived"|derived\b)/i.test(sql);
+}
+function fieldsForSql(sql, fields) {
+  const named = (field) => new RegExp(`(?<![\\w-])${escapeRegExp(field)}(?![\\w-])`, "i").test(sql);
+  if (sql.includes("*") || /\b_(?:sources|origin)\b/i.test(sql)) {
+    return fields.filter((field) => field !== PROVENANCE_FIELD || named(field));
+  }
+  return fields.filter(named);
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function createDerivedView(db, records, columns) {
+  const quoted = columns.map(quoteIdent);
+  db.exec(
+    `CREATE TABLE ${DERIVED_ROWS} (${quoted.map((c, i) => i === 0 ? `${c} TEXT PRIMARY KEY` : `${c} TEXT`).join(", ")})`
+  );
+  const insert = db.prepare(
+    `INSERT INTO ${DERIVED_ROWS} VALUES (${quoted.map(() => "?").join(", ")})`
+  );
+  const fields = columns.slice(1, -1);
+  db.exec("BEGIN");
+  let committed = false;
+  try {
+    for (const [label, record] of records) {
+      const sources = {};
+      const values = fields.map((field) => {
+        const derived = record.fields[field];
+        if (derived == null) return null;
+        sources[field] = { source: derived.source, evidence: derived.evidence };
+        return bindValue(derived.value);
+      });
+      insert.run(label, ...values, JSON.stringify(sources));
+    }
+    db.exec("COMMIT");
+    committed = true;
+  } finally {
+    if (!committed) db.exec("ROLLBACK");
+  }
+  db.exec(`CREATE VIEW ${DERIVED_VIEW} AS SELECT * FROM ${DERIVED_ROWS}`);
+}
+function resolvedColumns(docsColumns, commands) {
+  const columns = ["_path"];
+  const seen = /* @__PURE__ */ new Set(["_path", ORIGIN_COLUMN, SOURCES_COLUMN]);
+  for (const column of docsColumns) {
+    if (seen.has(column) || RESERVED.has(column)) continue;
+    seen.add(column);
+    columns.push(column);
+  }
+  for (const field of derivableFields(commands)) {
+    if (seen.has(field)) continue;
+    seen.add(field);
+    columns.push(field);
+  }
+  columns.push(ORIGIN_COLUMN, SOURCES_COLUMN);
+  return columns;
+}
+function mentionsResolved(sql) {
+  return /\b(?:from|join|update|into|table|view)\s+(?:"resolved"|resolved\b)/i.test(sql);
+}
+function jsonPath(field) {
+  return `$.${JSON.stringify(field)}`;
+}
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function createResolvedView(db, docsColumns, commands) {
+  const columns = resolvedColumns(docsColumns, commands);
+  const fields = columns.slice(1, -2);
+  const inDocs = new Set(docsColumns);
+  const inDerived = new Set(derivableFields(commands));
+  const selects = [`d.${quoteIdent("_path")} AS ${quoteIdent("_path")}`];
+  const origin = [];
+  for (const field of fields) {
+    const path = sqlString(jsonPath(field));
+    const asserted = `json_type(d.${quoteIdent("_data")}, ${path}) IS NOT NULL`;
+    const assertedValue = inDocs.has(field) ? `d.${quoteIdent(field)}` : `d.${quoteIdent("_data")} ->> ${path}`;
+    if (inDerived.has(field)) {
+      const derivedValue = `r.${quoteIdent(field)}`;
+      selects.push(
+        `CASE WHEN ${asserted} THEN ${assertedValue} ELSE ${derivedValue} END AS ${quoteIdent(field)}`
+      );
+      origin.push(
+        `${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' WHEN ${derivedValue} IS NOT NULL THEN 'derived' END`
+      );
+    } else {
+      selects.push(`${assertedValue} AS ${quoteIdent(field)}`);
+      origin.push(`${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' END`);
+    }
+  }
+  selects.push(
+    `json_patch('{}', json_object(${origin.join(", ")})) AS ${quoteIdent(ORIGIN_COLUMN)}`
+  );
+  selects.push(`r.${quoteIdent(SOURCES_COLUMN)} AS ${quoteIdent(SOURCES_COLUMN)}`);
+  db.exec(
+    `CREATE VIEW ${RESOLVED_VIEW} AS SELECT ${selects.join(", ")} FROM docs d LEFT JOIN ${DERIVED_ROWS} r USING (${quoteIdent("_path")})`
+  );
+}
+async function deriveForTable(inputs, ctx, hint, fields) {
+  const derive = ctx.config?.derive;
+  const commands = commandsOf(derive);
+  const managesProvenance = derive?.fields?.includes(PROVENANCE_FIELD) === true && !fields.includes(PROVENANCE_FIELD);
+  const result = await deriveMetadata(inputs, {
+    cwd: ctx.cwd,
+    base: ctx.base,
+    ...ctx.configDir !== void 0 ? { configDir: ctx.configDir } : {},
+    sources: derive?.sources ?? [...DERIVE_SOURCES],
+    fields: managesProvenance ? [...fields, PROVENANCE_FIELD] : fields,
+    ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
+    ...commands !== void 0 ? { commands } : {},
+    cache: ctx.cache,
+    now: ctx.now ?? (() => /* @__PURE__ */ new Date()),
+    machines: machinesOf(derive)
+  });
+  assertSourcesAvailable(result.sources, hint);
+  return result.records;
+}
+
+// src/meta/core/checks.ts
+var CHECK_KEYWORD = "check";
+function checkSchemaRef(name) {
+  if (!CHECK_NAME.test(name) || name.toLowerCase().endsWith(".json")) {
+    throw new DocmetaError(
+      `check name "${name}" must match [a-z0-9][a-z0-9._-]* and not end in ".json" \u2014 the name is part of each finding's identity (check:<name>).`
+    );
+  }
+  return `check:${name}`;
+}
+var CONVENTION_COLUMNS = /* @__PURE__ */ new Set(["path", "line", "key", "message"]);
+function rowsToFindings(name, columns, rows, loaded) {
+  if (!columns.includes("path")) {
+    throw new DocmetaError(
+      `check "${name}": the result has no \`path\` column. A check's SELECT names its findings through the column convention: \`path\` (required), and optionally \`line\`, \`key\`, and \`message\`; any other column is folded into the message.`
+    );
+  }
+  const findings = /* @__PURE__ */ new Map();
+  const extras = columns.filter((c) => !CONVENTION_COLUMNS.has(c));
+  for (const row of rows) {
+    const path = row.path;
+    if (typeof path !== "string" || loaded !== void 0 && !loaded.has(path)) {
+      throw new DocmetaError(
+        `check "${name}": a result row names ${JSON.stringify(path)}, which this run did not load \u2014 a finding must attach to a file of the corpus. Fix the check's \`path\` column.`
+      );
+    }
+    const key = typeof row.key === "string" && row.key !== "" ? row.key : void 0;
+    const line = asLine(row.line);
+    const message = typeof row.message === "string" && row.message !== "" ? row.message : synthesizeMessage(extras, row);
+    const err = {
+      schema: checkSchemaRef(name),
+      keyword: CHECK_KEYWORD,
+      // RFC 6901 escaping, or a key containing `/` or `~` would build a
+      // pointer that parses as a different (nested) location.
+      instancePath: key === void 0 ? "" : `/${escapePointerSegment(key)}`,
+      message,
+      ...line === void 0 ? {} : { line }
+    };
+    const bucket = findings.get(path);
+    if (bucket) bucket.push(err);
+    else findings.set(path, [err]);
+  }
+  return findings;
+}
+function asLine(value) {
+  const n = typeof value === "bigint" ? Number(value) : typeof value === "number" ? value : void 0;
+  return n !== void 0 && Number.isInteger(n) && n > 0 ? n : void 0;
+}
+function synthesizeMessage(extras, row) {
+  const pairs = extras.flatMap((c) => {
+    const value = row[c];
+    if (value === null || value === void 0) return [];
+    const text2 = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : JSON.stringify(value);
+    return [`${c}=${text2}`];
+  });
+  return pairs.length > 0 ? pairs.join(", ") : "check matched";
+}
+async function runChecks(checks, entries, ctx = {}) {
+  const merged = /* @__PURE__ */ new Map();
+  if (checks.length === 0) return merged;
+  const { DatabaseSync } = await loadSqlite();
+  const db = new DatabaseSync(":memory:");
+  try {
+    const dataColumns = corpusDataColumns(entries);
+    createDocsTable(db, entries, dataColumns);
+    registerLineFor(db, entries);
+    createCollectionViews(db, collectCollections(entries, ctx));
+    const wantsDerived = checks.filter(
+      (c) => mentionsDerived(c.query) || mentionsResolved(c.query)
+    );
+    if (wantsDerived.length > 0) {
+      if (ctx.derive === void 0) {
+        throw new DocmetaError(
+          `check "${wantsDerived[0]?.name ?? ""}": the SQL names the derived or resolved table, but this run cannot derive. Run it through \`manni meta validate\`, or drop the reference.`
+        );
+      }
+      const commands = ctx.commands;
+      const readable = derivableFields(commands);
+      const fields = /* @__PURE__ */ new Set();
+      for (const c of wantsDerived) for (const f of fieldsForSql(c.query, readable)) fields.add(f);
+      createDerivedView(db, await ctx.derive([...fields]), derivedColumns(commands));
+      createResolvedView(db, dataColumns, commands);
+    }
+    db.exec("PRAGMA query_only = 1");
+    const loaded = new Set(entries.map((e) => e.label));
+    for (const check of checks) {
+      const head = stripLeadingTrivia(check.query);
+      if (/^(attach|vacuum)\b/i.test(head)) {
+        throw new DocmetaError(
+          `check "${check.name}": ${head.split(/\s/, 1)[0]?.toUpperCase() ?? "that statement"} is refused: it can write outside the docs table.`
+        );
+      }
+      let tokens2;
+      try {
+        tokens2 = collectNamedParameters(check.query);
+      } catch (err) {
+        throw new DocmetaError(
+          `check "${check.name}": ${errorMessage(err)}`
+        );
+      }
+      if (tokens2.length > 0) {
+        throw new DocmetaError(
+          `check "${check.name}": the SQL references ${tokens2.join(", ")}, but checks bind no parameters \u2014 an unbound name binds NULL and matches nothing, so the gate would pass on a typo. Inline the value in the SQL.`
+        );
+      }
+      let columns;
+      let rows;
+      try {
+        assertSingleStatement(check.query);
+        const stmt = db.prepare(check.query);
+        columns = stmt.columns().map((c) => c.name);
+        rows = stmt.all();
+      } catch (err) {
+        const message = errorMessage(err);
+        throw new DocmetaError(
+          message.includes("attempt to write a readonly database") ? `check "${check.name}": ${message} \u2014 checks are read-only by design; a check is a SELECT over the projection. Edit the corpus with \`manni meta query\` instead.` : `check "${check.name}": ${message}`
+        );
+      }
+      for (const [path, errs] of rowsToFindings(
+        check.name,
+        columns,
+        rows,
+        loaded
+      )) {
+        const bucket = merged.get(path);
+        if (bucket) bucket.push(...errs);
+        else merged.set(path, errs);
+      }
+    }
+  } finally {
+    db.close();
+  }
+  return merged;
+}
+
+// src/meta/core/derive/provenance-place.ts
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve3, sep as sep3 } from "node:path";
+var toPosix2 = (p) => p.split(sep3).join("/");
+function provenanceManifests(collections, configDir, base, field = PROVENANCE_FIELD) {
+  const out = [];
+  for (const collection of collections) {
+    for (const manifest of collection.externalMetadata) {
+      const implied = manifest.keys === void 0;
+      if (!implied && manifest.keys?.includes(field) !== true) continue;
+      const url = classifyRef(manifest.file).kind === "url";
+      if (url && !implied) throw new DocmetaError(urlRefusal(collection.name, field));
+      if (url) {
+        out.push({
+          collection: collection.name,
+          absPath: manifest.file,
+          file: manifest.file,
+          join: externalMetadataJoin(manifest),
+          perPage: false,
+          written: manifest.file,
+          implied: { collection, manifest, url }
+        });
+        continue;
+      }
+      const absPath = isAbsolute2(manifest.file) ? manifest.file : resolve3(configDir, manifest.file);
+      const perPage = hasPagePlaceholder(manifest.file);
+      out.push({
+        collection: collection.name,
+        absPath,
+        file: perPage ? manifest.file : reportedPath(absPath, base),
+        join: externalMetadataJoin(manifest),
+        perPage,
+        written: manifest.file,
+        ...implied ? { implied: { collection, manifest, url } } : {}
+      });
+    }
+  }
+  return out;
+}
+function urlRefusal(collection, field) {
+  return `collection ${collection}: ${field} cannot come from a URL manifest, because manni meta derive writes it.`;
+}
+function provenancePlace(label, data, manifests, collections, configDir, base, marked, field = PROVENANCE_FIELD) {
+  if (manifests.length === 0) return void 0;
+  const members = new Set(memberOf(collections, configDir, base, label));
+  const owning = manifests.filter(
+    (m) => members.has(m.collection) && (m.implied === void 0 || ownsKey(m.implied.collection, m.implied.manifest, field, marked))
+  );
+  const [declared, second] = owning;
+  if (declared === void 0) return void 0;
+  if (second !== void 0) {
+    throw new DocmetaError(
+      `${label} is in collections ${declared.collection} and ${second.collection}, and both keep ${field} in a manifest.`
+    );
+  }
+  if (declared.implied?.url === true) throw new DocmetaError(urlRefusal(declared.collection, field));
+  const manifest = declared.perPage ? ownManifest(declared, label, collections, configDir, base) : declared;
+  if (manifest.join === PATH_JOIN) {
+    const entry = toPosix2(relative3(configDir, resolve3(base, label)));
+    return { manifest, absPath: manifest.absPath, entry, join: manifest.join };
+  }
+  const value = data[manifest.join];
+  if (typeof value !== "string" && typeof value !== "number") {
+    throw new DocmetaError(
+      `${label} carries no ${manifest.join}, which ${manifest.file} joins on, so its ${field} has no entry there.`
+    );
+  }
+  return { manifest, absPath: manifest.absPath, entry: String(value), join: manifest.join };
+}
+function ownManifest(manifest, label, collections, configDir, base) {
+  const resolved = pageManifestPath(manifest.written, configDir, resolve3(base, label));
+  if ("outside" in resolved) {
+    const declared = collections.find((c) => c.name === manifest.collection)?.externalMetadata.find((m) => m.file === manifest.written);
+    throw new DocmetaError(
+      outsideRefusal(declared ?? { file: manifest.written }, manifest.collection, resolved.pageRel)
+    );
+  }
+  return { ...manifest, absPath: resolved.abs, file: reportedPath(resolved.abs, base) };
+}
+function readerManifests(collections, configDir, base, field = PROVENANCE_FIELD) {
+  const local = collections.map((c) => ({
+    ...c,
+    externalMetadata: c.externalMetadata.filter((m) => classifyRef(m.file).kind !== "url")
+  }));
+  return provenanceManifests(local, configDir, base, field);
+}
+function readerPlace(label, data, manifests, collections, configDir, base, marked, field = PROVENANCE_FIELD) {
+  try {
+    const place = provenancePlace(label, data, manifests, collections, configDir, base, marked, field);
+    return place === void 0 ? void 0 : { absPath: place.absPath, entry: place.entry, join: place.join };
+  } catch (err) {
+    if (err instanceof DocmetaError) return void 0;
+    throw err;
+  }
+}
+function stampManifests(label, data, collections, configDir, base, marked, fields) {
+  const out = {};
+  for (const field of STAMPED_DATE_FIELDS) {
+    if (!fields.includes(field)) continue;
+    const manifests = readerManifests(collections, configDir, base, field);
+    const place = readerPlace(label, data, manifests, collections, configDir, base, marked, field);
+    if (place !== void 0) out[field] = place;
+  }
+  return out;
+}
+
+// src/shared/cli-options.ts
+import { basename, relative as relative4 } from "node:path";
+function collect(value, prev) {
+  return prev.concat([value]);
+}
+function splitList(value) {
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+var STDIN_REQUIRES_AS = "Reading from stdin (`-`) requires --as <format> to choose an extractor.";
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function configOption(value) {
+  if (value === false) return { noConfig: true };
+  return typeof value === "string" ? { configPath: value } : {};
+}
+function explicitFalse(value) {
+  return value === false ? false : void 0;
+}
+function reportConfig(toStdout, cwd) {
+  return (info) => {
+    const where = (relative4(cwd, info.dir) || ".").replace(/\\/g, "/");
+    const line = `Using ${basename(info.path)} (${where})
+`;
+    (toStdout ? process.stdout : process.stderr).write(line);
+  };
+}
+
+// src/meta/commands/validate.ts
+function parseErrorResult(file, format, message, keyword) {
+  const err = {
+    schema: "(parse)",
+    instancePath: "",
+    message,
+    keyword
+  };
+  return { file, format, ok: false, schemas: [], errors: [err] };
+}
+function once(fn) {
+  let pending;
+  return () => {
+    pending ??= fn();
+    return pending;
+  };
+}
+async function runValidate(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const run2 = await resolveRunConfig({
+    cwd,
+    configPath: opts.configPath,
+    noConfig: opts.noConfig,
+    inputs: opts.inputs,
+    ...opts.collections !== void 0 ? { collections: opts.collections } : {},
+    onConfigLoaded: opts.onConfigLoaded
+  });
+  const {
+    config,
+    inputs,
+    base,
+    configDir,
+    collections,
+    declaredCollections,
+    fromCollections,
+    configFile
+  } = run2;
+  const membersFor = (label) => memberOf(collections, configDir ?? cwd, base, label);
+  const usingStdin = inputs.includes(STDIN_TOKEN);
+  if (inputs.length === 0) {
+    throw new DocmetaError(
+      "No files to validate. Pass paths/globs, or declare a collection under `collections:` in manni.config.yaml."
+    );
+  }
+  const forcedExtractor = opts.as ? extractorByName(opts.as) : void 0;
+  if (opts.as && !forcedExtractor) {
+    throw new DocmetaError(
+      `Unknown format "${opts.as}". Supported extensions: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  const exts = opts.exts ?? (forcedExtractor ? forcedExtractor.extensions : void 0);
+  const fileInputs = inputs.filter((i) => i !== STDIN_TOKEN);
+  const allowEmpty = opts.allowEmpty ?? config?.allowEmpty;
+  const exclude = opts.exclude ?? [];
+  const { files: walked, gitignoreSkipped } = await resolveTargetSet({
+    inputs: fileInputs,
+    exts,
+    exclude,
+    cwd: base,
+    allowEmpty,
+    ...gitignoreOptions({
+      flag: opts.respectGitignore,
+      configured: config?.respectGitignore,
+      onNotice: opts.onNotice
+    })
+  });
+  const files = fromCollections ? retainMembers(walked, membersFor) : walked;
+  assertNonEmpty({
+    files,
+    inputs: fileInputs,
+    usingStdin,
+    allowEmpty,
+    exclude,
+    exts,
+    gitignoreSkipped,
+    action: "validated"
+  });
+  const trustRoot = schemaTrustRoot(cwd, configDir);
+  const externalMetadata = await loadExternalMetadata(collections, {
+    configDir: configDir ?? cwd,
+    base,
+    offline: opts.offline ?? config?.offline ?? false,
+    // A `{page}` manifest (0058) is read for exactly the pages this run reads.
+    pages: files.map((file) => resolve4(base, file))
+  });
+  const validator = new Validator(
+    schemaLoadOptions({
+      // The config's directory when a config governs the run, so one project
+      // keeps one cache no matter which directory the command was run from.
+      root: configDir ?? cwd,
+      // A relative file ref belongs to the run's directory, not the cache root.
+      fileBase: cwd,
+      ttlHours: config?.schemaCache?.ttlHours,
+      offline: opts.offline ?? config?.offline,
+      // Built from the rebased config, so a pinned local ref is keyed by the
+      // same absolute spelling `resolveSchemaSet` will hand to `loadSchema`.
+      pins: collectSchemaPins(config),
+      registered: config?.registered
+    })
+  );
+  const marks = pageMarks({
+    validator,
+    config,
+    cwd,
+    trustRoot,
+    ...opts.cliSchemas !== void 0 ? { cliSchemas: opts.cliSchemas } : {}
+  });
+  let relocation;
+  const relocationCtx = () => relocation ??= relocationContext(run2, {
+    cwd,
+    targets: fromCollections ? [] : opts.inputs,
+    validator,
+    ...opts.noConfig !== void 0 ? { noConfig: opts.noConfig } : {},
+    ...opts.env !== void 0 ? { env: opts.env } : {}
+  });
+  const refFrame = { cwd, base: configDir ?? cwd, runBase: base };
+  const locationFindings = async (label, own, data, refs, members, merged, lineFor) => {
+    const preferences = await validator.locationPreferences(data, refs);
+    if (preferences.size === 0) return [];
+    const owned = new Set(merged.collisions.map((c) => c.key));
+    const declaredMembers = declaredCollections === collections ? members : memberOf(declaredCollections, configDir ?? cwd, base, label);
+    const joins = new Set(
+      declaredCollections.filter((c) => declaredMembers.includes(c.name)).flatMap((c) => c.externalMetadata.map(externalMetadataJoin)).filter((join2) => join2 !== PATH_JOIN)
+    );
+    const findings = [];
+    for (const key of Object.keys(data)) {
+      const preference = preferences.get(key);
+      if (preference === void 0) continue;
+      const ref = canonicalSchemaRef(preference.schema, refFrame);
+      const pointer = externalMetadataPointer(key);
+      const common = {
+        keyword: LOCATION_FINDING_KEYWORD,
+        subject: key,
+        instancePath: pointer,
+        severity: "warning"
+      };
+      if (Object.hasOwn(own, key)) {
+        if (preference.location !== "external" || owned.has(key) || joins.has(key)) continue;
+        const line = lineFor(key);
+        const none = await homeless(label, own, key);
+        findings.push({
+          schema: LOCATION_EXTERNAL_SCHEMA,
+          ...common,
+          // relocate refuses --no-config (U2), so it is no answer there.
+          // Nor is it one for stdin, which relocate refuses: no advice there.
+          message: opts.noConfig ? `"${key}" is stored in the page; ${ref} prefers external metadata, and --no-config leaves it no manifest.` : label === STDIN_LABEL ? `"${key}" is stored in the page; ${ref} prefers external metadata.` : none > 0 ? `"${key}" is stored in the page; ${ref} prefers external metadata, and this document is in none of the ${String(none)} collections.` : `"${key}" is stored in the page; ${ref} prefers external metadata. Run manni meta relocate.`,
+          ...line != null ? { line } : {}
+        });
+        continue;
+      }
+      if (preference.location !== "page") continue;
+      const at = merged.locate(pointer);
+      if (at === void 0) continue;
+      findings.push({
+        schema: LOCATION_PAGE_SCHEMA,
+        ...common,
+        // A fetched manifest cannot give a value up, so relocate is no
+        // answer; the value moves in the repository that serves it.
+        message: /^https?:\/\//.test(at.file) ? `"${key}" is stored in manifest ${at.file}; ${ref} prefers the page, and a fetched manifest cannot be written. Move it in that repository.` : `"${key}" is stored in manifest ${at.file}; ${ref} prefers the page. Run manni meta relocate.`,
+        file: at.file,
+        ...at.line != null ? { line: at.line } : {}
+      });
+    }
+    return findings;
+  };
+  const homeless = async (label, own, key) => {
+    if (label === STDIN_LABEL) return 0;
+    const home = await keyHome(relocationCtx(), label, own, key);
+    return home.kind === "unowned" && home.home.kind === "none" && home.home.reason === "collections" && home.home.collections > 1 ? home.home.collections : 0;
+  };
+  const results = [];
+  const skippedDefaultOnly = /* @__PURE__ */ new Set();
+  const defaultOnly = (label, members) => {
+    try {
+      return resolveSchemaSetWithSource({
+        filePath: label,
+        fileSchema: void 0,
+        cliSchemas: opts.cliSchemas,
+        config,
+        memberOf: members,
+        fileBase: cwd,
+        trustRoot
+      }).source === "default";
+    } catch {
+      return false;
+    }
+  };
+  const joinHits = /* @__PURE__ */ new Map();
+  const scopedToCollections = (opts.collections?.length ?? 0) > 0;
+  const scopedByFlags = opts.inputs.length > 0 || // redundant with inputs.length (stdin is an input) — kept as belt-and-suspenders
+  usingStdin || opts.as !== void 0 || opts.exts !== void 0 || opts.exclude !== void 0 && opts.exclude.length > 0 || opts.respectGitignore !== void 0 || (opts.cliSchemas?.length ?? 0) > 0;
+  const scoped = scopedByFlags || scopedToCollections;
+  const configuredChecks = config?.checks ?? [];
+  if (!scopedByFlags) {
+    const covered = scopedToCollections ? collections.map((c) => c.name) : void 0;
+    const orphans = orphanEntries(externalMetadata, files, base, covered);
+    if (orphans.length > 0) throw orphanError(orphans);
+  }
+  const checksWillRun = configuredChecks.length > 0 && opts.checks !== false && !scoped;
+  const checkEntries = [];
+  const encryptionKey = lazyKey(configFile, opts.env);
+  let unverified = 0;
+  const deriveConfig = config?.derive;
+  const configuredFields = managedFields(deriveConfig);
+  const defaultedFields = deriveConfig !== void 0 && deriveConfig.fields === void 0;
+  const deriveWillRun = deriveConfig !== void 0 && configuredFields.length > 0 && opts.derive !== false;
+  const pageManaged = /* @__PURE__ */ new Map();
+  const derivedChecks = checksWillRun ? configuredChecks.filter((c) => mentionsDerived(c.query) || mentionsResolved(c.query)) : [];
+  const checksNeedDerived = derivedChecks.length > 0;
+  const deriveInputs = [];
+  const managedViews = /* @__PURE__ */ new Map();
+  const keepDeriveInputs = deriveWillRun || checksNeedDerived;
+  const deriveCommands = commandsOf(deriveConfig);
+  const deriveFields = new Set(deriveWillRun && !defaultedFields ? configuredFields : []);
+  const readable = derivableFields(deriveCommands);
+  for (const c of derivedChecks) for (const f of fieldsForSql(c.query, readable)) deriveFields.add(f);
+  const provenanceManifests2 = keepDeriveInputs && (deriveFields.has(PROVENANCE_FIELD) || deriveWillRun && configuredFields.includes(PROVENANCE_FIELD)) ? readerManifests(declaredCollections, configDir ?? cwd, base) : [];
+  const derivedOnce = once(async () => {
+    const derived = await deriveMetadata(deriveInputs, {
+      cwd,
+      base,
+      ...configDir !== void 0 ? { configDir } : {},
+      sources: deriveConfig?.sources ?? [...DERIVE_SOURCES],
+      fields: [...deriveFields],
+      ...deriveConfig?.codeowners !== void 0 ? { codeowners: deriveConfig.codeowners } : {},
+      ...deriveCommands !== void 0 ? { commands: deriveCommands } : {},
+      cache: opts.cache ?? true,
+      now: opts.now ?? (() => /* @__PURE__ */ new Date()),
+      machines: machinesOf(deriveConfig)
+    });
+    assertSourcesAvailable(
+      derived.sources,
+      deriveWillRun ? "pass --no-derive to skip the comparison, or narrow derive.sources" : "narrow derive.sources in manni.config.yaml"
+    );
+    for (const [name, status] of Object.entries(derived.sources)) {
+      if (status.available && status.reason !== void 0) {
+        opts.onNotice?.(`${name}: ${status.reason}`);
+      }
+    }
+    return derived;
+  });
+  const processOne = async (label, content, extension) => {
+    const extractor = forcedExtractor ?? extractorForExtension(extension);
+    if (!extractor) {
+      throw new DocmetaError(
+        `Unsupported file type "${extension}" for "${label}". Supported: ${supportedExtensions().join(", ")}. Use --as to override.`
+      );
+    }
+    const members = membersFor(label);
+    let extracted;
+    try {
+      extracted = extractor.extract(content, label, {
+        elements: resolveElements(label, config, members)
+      });
+    } catch (err) {
+      if (err instanceof DocmetaError) throw err;
+      if (opts.skipDefaultOnly === true && defaultOnly(label, members)) {
+        skippedDefaultOnly.add(label);
+        return;
+      }
+      results.push(
+        parseErrorResult(label, extractor.name, errorMessage(err), "parse")
+      );
+      return;
+    }
+    const merged = await mergeWithMarks(label, extracted, externalMetadata, members, base, {
+      encryptionKey,
+      marks
+    });
+    if (keepDeriveInputs && label !== STDIN_LABEL && (checksNeedDerived || deriveCovers(deriveConfig, members))) {
+      const place = provenanceManifests2.length === 0 ? void 0 : readerPlace(label, extracted.data, provenanceManifests2, declaredCollections, configDir ?? cwd, base, merged.marked);
+      const owned = declaredCollections.length === 0 ? {} : stampManifests(label, extracted.data, declaredCollections, configDir ?? cwd, base, merged.marked, STAMPED_DATE_FIELDS);
+      deriveInputs.push({
+        label,
+        absPath: resolve4(base, label),
+        content,
+        extracted,
+        ...place !== void 0 ? { provenanceManifest: place } : {},
+        ...Object.keys(owned).length > 0 ? { stampManifests: owned } : {}
+      });
+    }
+    const own = extracted.data;
+    extracted = merged.extracted;
+    if (deriveWillRun && label !== STDIN_LABEL) {
+      managedViews.set(label, {
+        data: extracted.data,
+        marked: [],
+        hidden: [],
+        refs: [],
+        locate: merged.locate
+      });
+    }
+    for (const j of merged.joins) {
+      const byValue = joinHits.get(j.field) ?? /* @__PURE__ */ new Map();
+      const line = extracted.lineFor(j.field);
+      const hits = byValue.get(j.value) ?? [];
+      hits.push({
+        label,
+        file: j.file,
+        shown: j.pageValue ?? j.value,
+        ...line != null ? { line } : {}
+      });
+      byValue.set(j.value, hits);
+      joinHits.set(j.field, byValue);
+    }
+    if (checksWillRun) checkEntries.push({ label, extracted });
+    let resolved;
+    try {
+      resolved = resolveSchemaSetWithSource({
+        filePath: label,
+        fileSchema: extracted.data[FILE_SCHEMA_KEY],
+        cliSchemas: opts.cliSchemas,
+        config,
+        memberOf: members,
+        // A document's own `$schema` is measured from the run's directory, the
+        // same base `loadSchema` will read it from, and contained to the
+        // repository the run is standing in.
+        fileBase: cwd,
+        trustRoot,
+        onNotice: opts.onNotice
+      });
+    } catch (err) {
+      results.push(
+        parseErrorResult(label, extractor.name, errorMessage(err), "schema")
+      );
+      return;
+    }
+    if (opts.skipDefaultOnly === true && resolved.source === "default") {
+      skippedDefaultOnly.add(label);
+      return;
+    }
+    const schemaSet = resolved.schemas;
+    if (deriveWillRun && defaultedFields && label !== STDIN_LABEL && deriveCovers(deriveConfig, members)) {
+      let claimed = /* @__PURE__ */ new Set();
+      try {
+        claimed = await validator.claimedProperties(schemaSet);
+      } catch (err) {
+        if (!(err instanceof DocmetaError)) throw err;
+      }
+      const own2 = configuredFields.filter((f) => claimed.has(f));
+      pageManaged.set(label, own2);
+      for (const f of own2) deriveFields.add(f);
+    }
+    let errors;
+    try {
+      const view = await encryptionView({
+        data: extracted.data,
+        refs: schemaSet,
+        validator,
+        key: encryptionKey,
+        locate: merged.locate
+      });
+      unverified += view.unverified.length;
+      if (deriveWillRun && label !== STDIN_LABEL) {
+        managedViews.set(label, {
+          data: view.data,
+          marked: view.marked,
+          hidden: [...view.unreadable, ...view.unverified],
+          refs: schemaSet,
+          locate: merged.locate
+        });
+      }
+      errors = [
+        ...settleFindings(
+          await validator.validate(
+            view.data,
+            schemaSet,
+            extracted.lineFor,
+            extracted.colFor,
+            merged.locate
+          ),
+          view,
+          extracted,
+          merged.locate
+        ),
+        ...encryptionFindings(view, extracted, merged.locate),
+        // Over the decrypted view, the object validation evaluated: a mark
+        // counts where Ajv takes a branch, and a branch may read a value.
+        ...await locationFindings(label, own, view.data, schemaSet, members, merged, extracted.lineFor)
+      ];
+    } catch (err) {
+      if (!(err instanceof DocmetaError) || resolved.source !== "document") {
+        throw err;
+      }
+      results.push(
+        parseErrorResult(label, extractor.name, err.message, "schema")
+      );
+      return;
+    }
+    for (const { key, file, collection } of merged.collisions) {
+      const line = extracted.lineFor(key);
+      errors.push({
+        schema: EXTERNAL_OWNED_SCHEMA,
+        keyword: EXTERNAL_KEYWORD,
+        subject: key,
+        instancePath: externalMetadataPointer(key),
+        message: `"${key}" is owned by manifest ${file} (collection ${collection}); remove it from the document`,
+        ...line != null ? { line } : {}
+      });
+    }
+    results.push({
+      file: label,
+      format: extractor.name,
+      ok: !errors.some(isErrorSeverity),
+      schemas: schemaSet,
+      errors
+    });
+  };
+  if (usingStdin) {
+    const content = opts.stdinContent ?? "";
+    if (!forcedExtractor) {
+      throw new DocmetaError(
+        STDIN_REQUIRES_AS
+      );
+    }
+    await processOne(STDIN_LABEL, content, forcedExtractor.extensions[0] ?? "");
+  }
+  for (const file of files) {
+    const content = await readFile2(resolve4(base, file), "utf8");
+    await processOne(file, content, extname2(file));
+  }
+  if (unverified > 0) opts.onNotice?.(unverifiedWarning(unverified));
+  if (externalMetadata) {
+    const byLabel = new Map(results.map((r) => [r.file, r]));
+    const matched = /* @__PURE__ */ new Map();
+    for (const [field, byValue] of joinHits) {
+      matched.set(field, new Set(byValue.keys()));
+      for (const hits of byValue.values()) {
+        if (hits.length < 2) continue;
+        for (const hit of hits) {
+          const others = hits.filter((h) => h.label !== hit.label).map((h) => h.label).join(", ");
+          const result = byLabel.get(hit.label);
+          if (!result) continue;
+          result.errors.push({
+            schema: EXTERNAL_DUPLICATE_SCHEMA,
+            keyword: EXTERNAL_KEYWORD,
+            subject: hit.shown,
+            instancePath: externalMetadataPointer(field),
+            message: `${hits.length} documents carry ${field} "${hit.shown}"; ${hit.file} cannot tell them apart (${others})`,
+            ...hit.line != null ? { line: hit.line } : {}
+          });
+          result.ok = false;
+        }
+      }
+    }
+    if (!scopedByFlags) {
+      const covered = scopedToCollections ? collections.map((c) => c.name) : void 0;
+      const orphans = orphanJoins(externalMetadata, matched, covered);
+      if (orphans.length > 0) throw orphanError(orphans);
+    }
+  }
+  if (configuredChecks.length > 0 && opts.checks !== false) {
+    if (scoped) {
+      opts.onNotice?.(
+        scopedToCollections ? `corpus checks skipped: run is scoped to collections ${collections.map((c) => c.name).join(", ")}` : "corpus checks skipped: run is scoped"
+      );
+    } else {
+      const findings = await runChecks(configuredChecks, checkEntries, {
+        // Every declared collection is a view (0041 rule 7), holding the
+        // members this run loaded — decided by the same path arithmetic
+        // `membersFor` uses, so a check and a `manni meta query` over the same
+        // corpus see the same collections.
+        collections: declaredCollections,
+        ...configDir !== void 0 ? { configDir } : {},
+        base,
+        // A check that names the `derived` table (0040) gets the same view
+        // `query` builds, from the run's one derivation — which already
+        // covers every field the checks can read, so the list handed back
+        // here is not needed. Built only when asked for, because building
+        // it spawns git.
+        derive: async () => (await derivedOnce()).records,
+        // Its columns include the configured commands' keys (0042), which a
+        // check's context cannot read from a config since 0041.
+        ...deriveCommands !== void 0 ? { commands: deriveCommands } : {}
+      });
+      const byFile = new Map(results.map((r) => [r.file, r]));
+      for (const [file, errs] of findings) {
+        const result = byFile.get(file);
+        if (!result && skippedDefaultOnly.has(file)) continue;
+        if (!result) {
+          throw new DocmetaError(
+            `check findings for "${file}" have no validation result to attach to.`
+          );
+        }
+        result.errors.push(...errs);
+        result.ok = result.ok && !errs.some(isErrorSeverity);
+      }
+    }
+  }
+  if (deriveWillRun && deriveInputs.length > 0) {
+    const derived = await derivedOnce();
+    const byFile = new Map(results.map((r) => [r.file, r]));
+    for (const input of deriveInputs) {
+      const record = derived.records.get(input.label);
+      const result = byFile.get(input.label);
+      if (!record || !result) continue;
+      const managed = managedViews.get(input.label);
+      const managedHere = !deriveCovers(deriveConfig, membersFor(input.label)) ? [] : defaultedFields ? pageManaged.get(input.label) ?? [] : configuredFields;
+      const fields = managedHere.filter(
+        (field) => !(managed?.hidden.some((p) => isAtOrUnder(p, pointerOf(field))) ?? false)
+      );
+      let marked = [];
+      if (managed !== void 0) {
+        const stamped = { ...managed.data };
+        for (const field of fields) {
+          const d = record.fields[field];
+          if (d != null) stamped[field] = d.value;
+        }
+        marked = [...managed.marked, ...await validator.markedPointers(stamped, managed.refs)];
+      }
+      const asserted = (field) => managed !== void 0 ? managed.data[field] : input.extracted.data[field];
+      const findings = fields.flatMap((field) => {
+        if (field === PROVENANCE_FIELD) {
+          const derivation = derived.provenance?.get(input.label);
+          if (derivation === void 0) return [];
+          return provenanceFindings(
+            compareProvenance(provenanceEntries(asserted(field)), derivation),
+            derivation.page.bodyLine
+          );
+        }
+        const compared = compareDerived(field, asserted(field), record.fields[field]);
+        const at = pointerOf(field);
+        return staleFindings(
+          [marked.some((p) => isAtOrUnder(p, at)) ? redactedDerived(compared) : compared],
+          input.extracted.lineFor,
+          managed?.locate
+        );
+      });
+      if (findings.length === 0) continue;
+      result.errors.push(...findings);
+      result.ok = false;
+    }
+  }
+  const frame = { cwd, base: configDir ?? cwd, runBase: base };
+  const { results: reported, baseline } = await settleBaseline(
+    results,
+    resolveBaselineRequest(opts, config?.baseline, configDir, cwd, {
+      current: DEFAULT_BASELINE_PATH,
+      legacy: LEGACY_BASELINE_PATH
+    }),
+    frame
+  );
+  const failed = reported.filter((r) => !r.ok).length;
+  const count = (keep) => reported.reduce((n, r) => n + r.errors.filter(keep).length, 0);
+  const warnings = count((e) => e.severity === "warning");
+  const notices = count((e) => e.severity === "notice");
+  const summary = {
+    files: reported.length,
+    passed: reported.length - failed,
+    failed,
+    errors: count(isErrorSeverity),
+    // Omitted at zero, like `gitignoreSkipped` below: only the location
+    // findings (proposal 0047) are warnings, so a run with no
+    // `x-manni-location` marks keeps the summary as it was.
+    ...warnings > 0 ? { warnings } : {},
+    ...notices > 0 ? { notices } : {},
+    // Omitted when nothing was skipped: there is nothing to audit, and the
+    // JSON summary stays as it was for every run in a clean repo.
+    ...gitignoreSkipped > 0 ? { gitignoreSkipped } : {},
+    ...baseline ? { baseline } : {}
+  };
+  return { results: reported, summary, frame };
+}
+
+export {
+  collect,
+  splitList,
+  STDIN_REQUIRES_AS,
+  readStdin,
+  configOption,
+  explicitFalse,
+  reportConfig,
+  commandsOf,
+  machinesOf,
+  REVIEW_CACHE_DIR,
+  REVIEW_CACHE_VERSION,
+  ReviewCache,
+  cachedClient,
+  BinMissing,
+  run,
+  PATH_PLACEHOLDER,
+  isPerFile,
+  argvFor,
+  valueOf,
+  deriveFromCommands,
+  parseOriginUrl,
+  identityFromOrigin,
+  GitHubClient,
+  GitLabClient,
+  createReviewClient,
+  deriveFromReviews,
+  mapConcurrent,
+  provenanceFenced,
+  FIELD_SOURCES,
+  sourcesFor,
+  consultedSources,
+  assertSourcesAvailable,
+  deriveMetadata,
+  DERIVED_VIEW,
+  DERIVED_ROWS,
+  RESOLVED_VIEW,
+  derivedColumns,
+  mentionsDerived,
+  fieldsForSql,
+  createDerivedView,
+  resolvedColumns,
+  mentionsResolved,
+  createResolvedView,
+  deriveForTable,
+  rowsToFindings,
+  provenanceManifests,
+  provenancePlace,
+  readerManifests,
+  readerPlace,
+  stampManifests,
+  runValidate
+};
+//# sourceMappingURL=chunk-TK3FC4RF.js.map