@hawkeyexl/manni 4.5.0 → 4.6.0

package/dist/chunk-FQGLRJGX.js

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+
+// src/tracevals/graders/glob.ts
+var literal = (ch) => ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+var compiled = /* @__PURE__ */ new Map();
+function globToRegExp(glob) {
+  const cached = compiled.get(glob);
+  if (cached !== void 0) return cached;
+  const built = compile(glob);
+  compiled.set(glob, built);
+  return built;
+}
+function compile(glob) {
+  const spec = glob.replace(/\\/g, "/").toLowerCase().replace(/(?:\*\*\/)+/g, "**/");
+  let out = "";
+  for (let i = 0; i < spec.length; i += 1) {
+    const ch = spec[i];
+    if (ch === "?") {
+      out += "[^/]";
+      continue;
+    }
+    if (ch !== "*") {
+      out += literal(ch);
+      continue;
+    }
+    if (spec[i + 1] !== "*") {
+      out += "[^/]*";
+      continue;
+    }
+    i += 1;
+    if (spec[i + 1] === "/") {
+      i += 1;
+      if (out !== "") out += "(?:.*/)?";
+    } else if (out.endsWith("/")) {
+      out = `${out.slice(0, -1)}(?:/.*)?`;
+    } else {
+      out += ".*";
+    }
+  }
+  return new RegExp(`^(?:.*/)?${out}$`);
+}
+function normalizePath(path) {
+  return path.replace(/\\/g, "/").toLowerCase();
+}
+function matchesGlob(path, glob) {
+  return globToRegExp(glob).test(normalizePath(path));
+}
+
+// src/tracevals/graders/when.ts
+var stringValue = (kind) => (value) => typeof value === "string" && value.length > 0 ? void 0 : `options.when.${kind} must be a string`;
+var compiled2 = /* @__PURE__ */ new Map();
+function compiledRe(pattern) {
+  const cached = compiled2.get(pattern);
+  if (cached !== void 0) return cached;
+  const built = new RegExp(pattern);
+  compiled2.set(pattern, built);
+  return built;
+}
+var CONDITIONS = {
+  "file-access": {
+    validate: stringValue("file-access"),
+    test: (value, window) => window.fileAccesses.some((a) => matchesGlob(a.path, value)),
+    reason: (value) => `no file matching "${value}" was accessed`
+  },
+  "tool-used": {
+    validate: stringValue("tool-used"),
+    test: (value, window) => window.toolCalls.some((c) => c.name === value),
+    reason: (value) => `the ${value} tool was never used`
+  },
+  "prompt-matches": {
+    validate: (value) => {
+      const shape = stringValue("prompt-matches")(value);
+      if (shape !== void 0) return shape;
+      try {
+        new RegExp(value);
+      } catch (err) {
+        return `options.when.prompt-matches is not a valid regular expression: ${err.message}`;
+      }
+      return void 0;
+    },
+    test: (value, window) => {
+      const re = compiledRe(value);
+      return window.userMessages.some((text) => re.test(text));
+    },
+    reason: (value) => `no prompt matched /${value}/`
+  },
+  "command-matches": {
+    validate: (value) => {
+      const shape = stringValue("command-matches")(value);
+      if (shape !== void 0) return shape;
+      try {
+        new RegExp(value);
+      } catch (err) {
+        return `options.when.command-matches is not a valid regular expression: ${err.message}`;
+      }
+      return void 0;
+    },
+    test: (value, window) => {
+      const re = compiledRe(value);
+      return window.toolCalls.some(
+        (c) => c.name === "Bash" && typeof c.input.command === "string" && re.test(c.input.command)
+      );
+    },
+    reason: (value) => `no Bash command matched /${value}/`
+  },
+  "turn-count-above": {
+    validate: (value) => {
+      if (typeof value !== "number" || !Number.isInteger(value)) {
+        return "options.when.turn-count-above must be a whole number";
+      }
+      if (value < 0) return "options.when.turn-count-above must be at least 0";
+      return void 0;
+    },
+    test: (value, window) => window.turnCount > value,
+    reason: (value, window) => `${window.turnCount} turn(s) is not more than ${value}`
+  }
+};
+var WHEN_CONDITIONS = Object.keys(
+  CONDITIONS
+);
+function validateWhen(options) {
+  const when = options.when;
+  if (when === void 0) return void 0;
+  if (typeof when !== "object" || when === null || Array.isArray(when)) {
+    return "options.when must be an object of conditions";
+  }
+  const conditions = when;
+  const keys = Object.keys(conditions);
+  if (keys.length === 0) {
+    return `options.when needs at least one of: ${WHEN_CONDITIONS.join(", ")}`;
+  }
+  for (const key of keys) {
+    const condition = CONDITIONS[key];
+    if (condition === void 0) {
+      return `options.when.${key} is not a known condition; expected one of: ${WHEN_CONDITIONS.join(", ")}`;
+    }
+    const invalid = condition.validate(conditions[key]);
+    if (invalid !== void 0) return invalid;
+  }
+  return void 0;
+}
+function evaluateWhen(options, window) {
+  const when = options.when;
+  if (when === void 0) return { armed: true };
+  for (const name of WHEN_CONDITIONS) {
+    const value = when[name];
+    if (value === void 0) continue;
+    const condition = CONDITIONS[name];
+    if (condition.test(value, window)) continue;
+    return {
+      armed: false,
+      reason: `trigger not met (${window.label}): ${condition.reason(value, window)}`
+    };
+  }
+  return { armed: true };
+}
+function rejectWhen(kind, options) {
+  if (options.when === void 0) return void 0;
+  return `options.when is not supported by the ${kind} grader, which grades the whole session rather than a window`;
+}
+function skippedTrigger(trigger) {
+  return { findings: [], skipped: trigger.reason ?? "trigger not met" };
+}
+
+export {
+  globToRegExp,
+  matchesGlob,
+  WHEN_CONDITIONS,
+  validateWhen,
+  evaluateWhen,
+  rejectWhen,
+  skippedTrigger
+};
+//# sourceMappingURL=chunk-FQGLRJGX.js.map

package/dist/chunk-FQGLRJGX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tracevals/graders/glob.ts","../src/tracevals/graders/when.ts"],"sourcesContent":["/**\n * A small path glob, for grader options that name a set of files rather than\n * one (ADR 01016).\n *\n * Deliberately not a dependency: the syntax needed here is `**`, `*`, and `?`\n * over already-normalized paths, and a matcher that small is easier to pin than\n * to pick. Matching follows the same rule as the `file-access` grader's\n * suffix compare — separators normalized, case folded, anchored at a path\n * segment boundary — so `docs/**` reads the same whatever the checkout root is.\n * `file-access` reaches that rule by compiling its literal path through here,\n * so the two cannot drift.\n *\n * **The pattern is untrusted input.** It comes from the *evaluated* project's\n * front matter and is tested against every file access in a window, so a\n * pattern that compiles to nested optional-greedy groups is a denial of service\n * on the runner rather than a slow match. Two things keep that impossible: a\n * run of double-star segments collapses to one, so the optional greedy group\n * never nests, and compilation is memoised per pattern string.\n */\n\n/** Escapes every regex metacharacter; `*` and `?` are handled by the caller. */\nconst literal = (ch: string): string => ch.replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\n/**\n * Compiled patterns, keyed by the pattern string. Bounded because the key\n * space is: a run grades a fixed set of evals, each carrying a fixed set of\n * globs, and the compiled form depends on nothing else.\n */\nconst compiled = new Map<string, RegExp>();\n\nexport function globToRegExp(glob: string): RegExp {\n  const cached = compiled.get(glob);\n  if (cached !== undefined) return cached;\n  const built = compile(glob);\n  compiled.set(glob, built);\n  return built;\n}\n\nfunction compile(glob: string): RegExp {\n  // A run of `**/` means exactly what one does — \"any number of segments\" —\n  // so collapsing it here is a normalization, not an approximation. Left\n  // uncollapsed, each repeat added another optional greedy group over the same\n  // input and the cost of a failed match grew multiplicatively.\n  const spec = glob\n    .replace(/\\\\/g, \"/\")\n    .toLowerCase()\n    .replace(/(?:\\*\\*\\/)+/g, \"**/\");\n  let out = \"\";\n  for (let i = 0; i < spec.length; i += 1) {\n    const ch = spec[i] as string;\n    if (ch === \"?\") {\n      out += \"[^/]\";\n      continue;\n    }\n    if (ch !== \"*\") {\n      out += literal(ch);\n      continue;\n    }\n    if (spec[i + 1] !== \"*\") {\n      out += \"[^/]*\";\n      continue;\n    }\n    // `**` spans separators, and must allow *zero* segments: `docs/**` has to\n    // match `docs` itself, and `docs/**/x` has to match `docs/x`. Both cases\n    // absorb one adjacent separator rather than requiring it.\n    i += 1;\n    if (spec[i + 1] === \"/\") {\n      i += 1;\n      // A leading `**/` is already covered by the unconditional ancestor\n      // prefix below, so emitting a second optional group here would give the\n      // engine two interchangeable ways to consume the same segments — the\n      // shape that turns a failed match exponential.\n      if (out !== \"\") out += \"(?:.*/)?\";\n    } else if (out.endsWith(\"/\")) {\n      out = `${out.slice(0, -1)}(?:/.*)?`;\n    } else {\n      out += \".*\";\n    }\n  }\n  // Trace paths are absolute and machine-specific, so a spec matches any\n  // ancestor prefix — but only whole segments, so `docs/**` does not match\n  // `docsite/`.\n  return new RegExp(`^(?:.*/)?${out}$`);\n}\n\n/** Separators normalized and case folded, the one way both matchers see paths. */\nexport function normalizePath(path: string): string {\n  return path.replace(/\\\\/g, \"/\").toLowerCase();\n}\n\n/** True when `path` matches `glob`, both normalized the same way. */\nexport function matchesGlob(path: string, glob: string): boolean {\n  return globToRegExp(glob).test(normalizePath(path));\n}\n","/**\n * Conditional triggers (ADR 01016): `options.when` arms an eval only for the\n * sessions it is about.\n *\n * The point is to make the *absence* of an artifact checkable. You cannot hang\n * an eval on a skill that never loaded — nothing resolves it, so nothing plans\n * it — but you can hang it on `CLAUDE.md`, which resolves for every session.\n * `when` is what lets that always-planned eval stay quiet on the sessions it\n * has nothing to say about.\n *\n * **A trigger that does not fire is `skipped`, never `pass`.** A check that\n * never armed has not been satisfied, and reporting it as a pass would make a\n * green report out of an eval that never ran — the same reasoning that makes an\n * empty window a skip (ADR 01015).\n *\n * **`when` is a general trigger, not one grader's feature.** Every windowed\n * grader routes its options through `validateWhen` and its window through\n * `evaluateWhen`, because `options` is an open bag: a grader that merely\n * ignored an unrecognised `when` would leave the eval armed on every session,\n * which is the exact failure this module exists to prevent. `cost` and\n * `json-output` are the abstainers, and they say so: both grade the whole\n * session rather than a window (ADR 01015), so there is nothing to evaluate a\n * predicate over, and `rejectWhen` turns the option into a loud error.\n *\n * Predicates are pure trace facts, evaluated over the artifact's window, and\n * every listed one must hold.\n *\n * `options` is an open object by schema decree — \"validated by the grader at\n * run time — a grader's options evolve on the grader's schedule\" — so this\n * costs no schema change and no upstream docmeta proposal (ADR 01010).\n */\nimport { matchesGlob } from \"./glob.js\";\nimport type { TraceWindow } from \"./util.js\";\nimport type { Options } from \"./util.js\";\n\n/**\n * One condition, defined once.\n *\n * The three facets used to live in three unlinked places — the name list, the\n * validator's type grouping, and the evaluator's if-chain — so adding a\n * condition meant three coordinated edits, and an incomplete one failed\n * *silently in the arming direction*: an unvalidated key would be rejected as\n * unknown, but an unevaluated one would simply never constrain anything.\n * Keeping them together makes an incomplete condition a type error.\n */\ninterface Condition {\n  /** Rejects a malformed value without a trace, for `fill` (ADR 01004). */\n  validate(value: unknown): string | undefined;\n  /** True when the condition holds over the window. */\n  test(value: unknown, window: TraceWindow): boolean;\n  /** The half of the reason that names what was missing. */\n  reason(value: unknown, window: TraceWindow): string;\n}\n\nconst stringValue =\n  (kind: string) =>\n  (value: unknown): string | undefined =>\n    typeof value === \"string\" && value.length > 0\n      ? undefined\n      : `options.when.${kind} must be a string`;\n\n/**\n * Compiled once per pattern, as `globToRegExp` does. The pattern is fixed by\n * the artifact, so rebuilding it for every eval on every trace of a batch is\n * work with no new answer. No `g` flag here, so a shared instance carries no\n * `lastIndex` between calls.\n */\nconst compiled = new Map<string, RegExp>();\n\nfunction compiledRe(pattern: string): RegExp {\n  const cached = compiled.get(pattern);\n  if (cached !== undefined) return cached;\n  const built = new RegExp(pattern);\n  compiled.set(pattern, built);\n  return built;\n}\n\nconst CONDITIONS = {\n  \"file-access\": {\n    validate: stringValue(\"file-access\"),\n    test: (value, window) =>\n      window.fileAccesses.some((a) => matchesGlob(a.path, value as string)),\n    reason: (value) => `no file matching \"${value as string}\" was accessed`,\n  },\n  \"tool-used\": {\n    validate: stringValue(\"tool-used\"),\n    test: (value, window) => window.toolCalls.some((c) => c.name === value),\n    reason: (value) => `the ${value as string} tool was never used`,\n  },\n  \"prompt-matches\": {\n    validate: (value) => {\n      const shape = stringValue(\"prompt-matches\")(value);\n      if (shape !== undefined) return shape;\n      try {\n        new RegExp(value as string);\n      } catch (err) {\n        return `options.when.prompt-matches is not a valid regular expression: ${(err as Error).message}`;\n      }\n      return undefined;\n    },\n    test: (value, window) => {\n      const re = compiledRe(value as string);\n      return window.userMessages.some((text) => re.test(text));\n    },\n    reason: (value) => `no prompt matched /${value as string}/`,\n  },\n  \"command-matches\": {\n    validate: (value) => {\n      const shape = stringValue(\"command-matches\")(value);\n      if (shape !== undefined) return shape;\n      try {\n        new RegExp(value as string);\n      } catch (err) {\n        return `options.when.command-matches is not a valid regular expression: ${(err as Error).message}`;\n      }\n      return undefined;\n    },\n    test: (value, window) => {\n      const re = compiledRe(value as string);\n      return window.toolCalls.some(\n        (c) =>\n          c.name === \"Bash\" &&\n          typeof c.input.command === \"string\" &&\n          re.test(c.input.command),\n      );\n    },\n    reason: (value) => `no Bash command matched /${value as string}/`,\n  },\n  \"turn-count-above\": {\n    validate: (value) => {\n      if (typeof value !== \"number\" || !Number.isInteger(value)) {\n        return \"options.when.turn-count-above must be a whole number\";\n      }\n      if (value < 0) return \"options.when.turn-count-above must be at least 0\";\n      return undefined;\n    },\n    test: (value, window) => window.turnCount > (value as number),\n    reason: (value, window) =>\n      `${window.turnCount} turn(s) is not more than ${value as number}`,\n  },\n} satisfies Record<string, Condition>;\n\n/** Every recognised condition. Unknown keys are an error, never ignored. */\nexport const WHEN_CONDITIONS = Object.keys(\n  CONDITIONS,\n) as readonly WhenCondition[];\n\nexport type WhenCondition = keyof typeof CONDITIONS;\n\n/** What a trigger decided, and — when it did not fire — why. */\nexport interface TriggerResult {\n  armed: boolean;\n  /** Reason phrase for the skip; set only when `armed` is false. */\n  reason?: string;\n}\n\n/**\n * Validate `options.when` without a trace, so `fill` can ground-check a\n * proposal before writing it (ADR 01004).\n *\n * An unrecognised condition is rejected rather than dropped. A silently\n * ignored `file-acess` would leave the eval armed on every session — the loud\n * failure is the safe one, and it mirrors how `metadata.eval*` reserves its\n * own prefix in `src/evals/extract.ts`.\n */\nexport function validateWhen(options: Options): string | undefined {\n  const when = options.when;\n  if (when === undefined) return undefined;\n  if (typeof when !== \"object\" || when === null || Array.isArray(when)) {\n    return \"options.when must be an object of conditions\";\n  }\n  const conditions = when as Record<string, unknown>;\n  const keys = Object.keys(conditions);\n  if (keys.length === 0) {\n    // A trigger with no conditions arms on every session, which is the same as\n    // having no trigger — but reads like a scoped check.\n    return `options.when needs at least one of: ${WHEN_CONDITIONS.join(\", \")}`;\n  }\n  for (const key of keys) {\n    const condition = (CONDITIONS as Record<string, Condition>)[key];\n    if (condition === undefined) {\n      return `options.when.${key} is not a known condition; expected one of: ${WHEN_CONDITIONS.join(\", \")}`;\n    }\n    const invalid = condition.validate(conditions[key]);\n    if (invalid !== undefined) return invalid;\n  }\n  return undefined;\n}\n\n/**\n * Decide whether the trigger fires over a window. Conjunctive: the first\n * condition that fails names itself in the reason, so a skipped eval says\n * which half of its trigger was missing rather than only that it was.\n *\n * Evaluation walks `WHEN_CONDITIONS`, not the caller's key order, so the\n * reason a skip carries is stable across two spellings of the same trigger.\n */\nexport function evaluateWhen(options: Options, window: TraceWindow): TriggerResult {\n  const when = options.when as Record<string, unknown> | undefined;\n  if (when === undefined) return { armed: true };\n\n  for (const name of WHEN_CONDITIONS) {\n    const value = when[name];\n    if (value === undefined) continue;\n    const condition = CONDITIONS[name] as Condition;\n    if (condition.test(value, window)) continue;\n    return {\n      armed: false,\n      reason: `trigger not met (${window.label}): ${condition.reason(value, window)}`,\n    };\n  }\n\n  return { armed: true };\n}\n\n/**\n * Reject `when` outright, for a grader that has no window to evaluate it over.\n *\n * Silence is the one answer not available. `options` is an open bag, so a\n * `when` a grader neither evaluates nor rejects validates clean and is\n * ignored — and an ignored trigger is an eval left armed on every session,\n * which is precisely the outcome its author wrote `when` to avoid. `cost` is\n * unwindowed by design (ADR 01015) and `json-output` reads the session's final\n * text; for both, the honest answer is that the option does not apply.\n */\nexport function rejectWhen(kind: string, options: Options): string | undefined {\n  if (options.when === undefined) return undefined;\n  return (\n    `options.when is not supported by the ${kind} grader, ` +\n    \"which grades the whole session rather than a window\"\n  );\n}\n\n/**\n * The skip a grader returns for an unfired trigger. One helper rather than one\n * per grader, so every grader's wording — and the fact that it is a skip and\n * not a pass — comes from a single place.\n */\nexport function skippedTrigger(trigger: TriggerResult): {\n  findings: never[];\n  skipped: string;\n} {\n  return { findings: [], skipped: trigger.reason ?? \"trigger not met\" };\n}\n"],"mappings":";;;AAqBA,IAAM,UAAU,CAAC,OAAuB,GAAG,QAAQ,qBAAqB,MAAM;AAO9E,IAAM,WAAW,oBAAI,IAAoB;AAElC,SAAS,aAAa,MAAsB;AACjD,QAAM,SAAS,SAAS,IAAI,IAAI;AAChC,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,QAAQ,QAAQ,IAAI;AAC1B,WAAS,IAAI,MAAM,KAAK;AACxB,SAAO;AACT;AAEA,SAAS,QAAQ,MAAsB;AAKrC,QAAM,OAAO,KACV,QAAQ,OAAO,GAAG,EAClB,YAAY,EACZ,QAAQ,gBAAgB,KAAK;AAChC,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,OAAO,KAAK;AACd,aAAO;AACP;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,aAAO,QAAQ,EAAE;AACjB;AAAA,IACF;AACA,QAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AACvB,aAAO;AACP;AAAA,IACF;AAIA,SAAK;AACL,QAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AACvB,WAAK;AAKL,UAAI,QAAQ,GAAI,QAAO;AAAA,IACzB,WAAW,IAAI,SAAS,GAAG,GAAG;AAC5B,YAAM,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3B,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAIA,SAAO,IAAI,OAAO,YAAY,GAAG,GAAG;AACtC;AAGO,SAAS,cAAc,MAAsB;AAClD,SAAO,KAAK,QAAQ,OAAO,GAAG,EAAE,YAAY;AAC9C;AAGO,SAAS,YAAY,MAAc,MAAuB;AAC/D,SAAO,aAAa,IAAI,EAAE,KAAK,cAAc,IAAI,CAAC;AACpD;;;ACvCA,IAAM,cACJ,CAAC,SACD,CAAC,UACC,OAAO,UAAU,YAAY,MAAM,SAAS,IACxC,SACA,gBAAgB,IAAI;AAQ5B,IAAMA,YAAW,oBAAI,IAAoB;AAEzC,SAAS,WAAW,SAAyB;AAC3C,QAAM,SAASA,UAAS,IAAI,OAAO;AACnC,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,QAAQ,IAAI,OAAO,OAAO;AAChC,EAAAA,UAAS,IAAI,SAAS,KAAK;AAC3B,SAAO;AACT;AAEA,IAAM,aAAa;AAAA,EACjB,eAAe;AAAA,IACb,UAAU,YAAY,aAAa;AAAA,IACnC,MAAM,CAAC,OAAO,WACZ,OAAO,aAAa,KAAK,CAAC,MAAM,YAAY,EAAE,MAAM,KAAe,CAAC;AAAA,IACtE,QAAQ,CAAC,UAAU,qBAAqB,KAAe;AAAA,EACzD;AAAA,EACA,aAAa;AAAA,IACX,UAAU,YAAY,WAAW;AAAA,IACjC,MAAM,CAAC,OAAO,WAAW,OAAO,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK;AAAA,IACtE,QAAQ,CAAC,UAAU,OAAO,KAAe;AAAA,EAC3C;AAAA,EACA,kBAAkB;AAAA,IAChB,UAAU,CAAC,UAAU;AACnB,YAAM,QAAQ,YAAY,gBAAgB,EAAE,KAAK;AACjD,UAAI,UAAU,OAAW,QAAO;AAChC,UAAI;AACF,YAAI,OAAO,KAAe;AAAA,MAC5B,SAAS,KAAK;AACZ,eAAO,kEAAmE,IAAc,OAAO;AAAA,MACjG;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,CAAC,OAAO,WAAW;AACvB,YAAM,KAAK,WAAW,KAAe;AACrC,aAAO,OAAO,aAAa,KAAK,CAAC,SAAS,GAAG,KAAK,IAAI,CAAC;AAAA,IACzD;AAAA,IACA,QAAQ,CAAC,UAAU,sBAAsB,KAAe;AAAA,EAC1D;AAAA,EACA,mBAAmB;AAAA,IACjB,UAAU,CAAC,UAAU;AACnB,YAAM,QAAQ,YAAY,iBAAiB,EAAE,KAAK;AAClD,UAAI,UAAU,OAAW,QAAO;AAChC,UAAI;AACF,YAAI,OAAO,KAAe;AAAA,MAC5B,SAAS,KAAK;AACZ,eAAO,mEAAoE,IAAc,OAAO;AAAA,MAClG;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,CAAC,OAAO,WAAW;AACvB,YAAM,KAAK,WAAW,KAAe;AACrC,aAAO,OAAO,UAAU;AAAA,QACtB,CAAC,MACC,EAAE,SAAS,UACX,OAAO,EAAE,MAAM,YAAY,YAC3B,GAAG,KAAK,EAAE,MAAM,OAAO;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,QAAQ,CAAC,UAAU,4BAA4B,KAAe;AAAA,EAChE;AAAA,EACA,oBAAoB;AAAA,IAClB,UAAU,CAAC,UAAU;AACnB,UAAI,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,GAAG;AACzD,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,EAAG,QAAO;AACtB,aAAO;AAAA,IACT;AAAA,IACA,MAAM,CAAC,OAAO,WAAW,OAAO,YAAa;AAAA,IAC7C,QAAQ,CAAC,OAAO,WACd,GAAG,OAAO,SAAS,6BAA6B,KAAe;AAAA,EACnE;AACF;AAGO,IAAM,kBAAkB,OAAO;AAAA,EACpC;AACF;AAoBO,SAAS,aAAa,SAAsC;AACjE,QAAM,OAAO,QAAQ;AACrB,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG;AACpE,WAAO;AAAA,EACT;AACA,QAAM,aAAa;AACnB,QAAM,OAAO,OAAO,KAAK,UAAU;AACnC,MAAI,KAAK,WAAW,GAAG;AAGrB,WAAO,uCAAuC,gBAAgB,KAAK,IAAI,CAAC;AAAA,EAC1E;AACA,aAAW,OAAO,MAAM;AACtB,UAAM,YAAa,WAAyC,GAAG;AAC/D,QAAI,cAAc,QAAW;AAC3B,aAAO,gBAAgB,GAAG,+CAA+C,gBAAgB,KAAK,IAAI,CAAC;AAAA,IACrG;AACA,UAAM,UAAU,UAAU,SAAS,WAAW,GAAG,CAAC;AAClD,QAAI,YAAY,OAAW,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAUO,SAAS,aAAa,SAAkB,QAAoC;AACjF,QAAM,OAAO,QAAQ;AACrB,MAAI,SAAS,OAAW,QAAO,EAAE,OAAO,KAAK;AAE7C,aAAW,QAAQ,iBAAiB;AAClC,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI,UAAU,OAAW;AACzB,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,UAAU,KAAK,OAAO,MAAM,EAAG;AACnC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ,oBAAoB,OAAO,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,CAAC;AAAA,IAC/E;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,KAAK;AACvB;AAYO,SAAS,WAAW,MAAc,SAAsC;AAC7E,MAAI,QAAQ,SAAS,OAAW,QAAO;AACvC,SACE,wCAAwC,IAAI;AAGhD;AAOO,SAAS,eAAe,SAG7B;AACA,SAAO,EAAE,UAAU,CAAC,GAAG,SAAS,QAAQ,UAAU,kBAAkB;AACtE;","names":["compiled"]}

package/dist/{chunk-XWFNO5PO.js → chunk-GAJIJKET.js}

@@ -2,10 +2,10 @@
 import {
   resultFor,
   splitBaselined
-} from "./chunk-NGK3N6F2.js";
+} from "./chunk-T6SYGLWR.js";
 import {
   errorSite
-} from "./chunk-TA42STP7.js";
+} from "./chunk-UAKNZVCD.js";
 import {
   escapeWorkflowCommandMessage,
   escapeWorkflowCommandProperty
@@ -51,4 +51,4 @@ export {
   findingMessage,
   renderCheckGithub
 };
-//# sourceMappingURL=chunk-XWFNO5PO.js.map
+//# sourceMappingURL=chunk-GAJIJKET.js.map

package/dist/{chunk-QCBICNKC.js → chunk-GREQKO6M.js}

@@ -1,58 +1,39 @@
 #!/usr/bin/env node
-import {
-  externalWriteWarning,
-  externalWriteWarnings,
-  manifestKeyLine,
-  mergeMetaProvenance,
-  offerExternalHomes
-} from "./chunk-3YHAYXBC.js";
 import {
   DERIVED_ROWS,
   DERIVED_VIEW,
-  RESOLVED_VIEW,
-  STDIN_REQUIRES_AS,
-  assertSourcesAvailable,
-  commandsOf,
-  createDerivedView,
-  createResolvedView,
-  deriveForTable,
-  deriveMetadata,
-  derivedColumns,
-  fieldsForSql,
-  machinesOf,
-  mapConcurrent,
-  mentionsDerived,
-  mentionsResolved,
-  provenanceFenced,
-  provenanceManifests,
-  provenancePlace,
-  readerManifests,
-  readerPlace,
-  stampManifests
-} from "./chunk-NAZRLJAK.js";
-import {
   ENCRYPTED_PLACEHOLDER,
   ENCRYPTION_KEY_ENV,
   EncryptionRefusal,
   META_CONTEXT,
   PATH_JOIN,
   RESERVED,
+  RESOLVED_VIEW,
+  STDIN_REQUIRES_AS,
   SYSTEM_COLUMNS,
   Validator,
   applyRelocation,
   assertSingleStatement,
+  assertSourcesAvailable,
   bindValue,
   collectCollections,
   collectNamedParameters,
   collectionNames,
+  commandsOf,
   committedKeyWarning,
   compareProvenance,
   compileWithFormats,
   corpusDataColumns,
   createCollectionViews,
+  createDerivedView,
   createDocsTable,
+  createResolvedView,
+  deriveForTable,
+  deriveMetadata,
+  derivedColumns,
   encryptionView,
   externalMetadataJoin,
+  fieldsForSql,
   heldManifest,
   isAtOrUnder,
   isIgnoredByGit,
@@ -62,8 +43,12 @@ import {
   lineSpec,
   loadExternalMetadata,
   loadSqlite,
+  machinesOf,
+  mapConcurrent,
   marksValidator,
   memberOf,
+  mentionsDerived,
+  mentionsResolved,
   mergeExternalMetadata,
   mergeWithMarks,
   offerPrompt,
@@ -76,16 +61,22 @@ import {
   planRelocation,
   pointerOf,
   provenanceEntries,
+  provenanceFenced,
   provenanceFindings,
+  provenanceManifests,
+  provenancePlace,
   rangeResults,
   readManifestValue,
   readProvenancePage,
+  readerManifests,
+  readerPlace,
   rebaseable,
   rebaseline,
   redactForModel,
   redactedDerived,
   registerLineFor,
   relocationContext,
+  relocationOffers,
   removeManifestKey,
   renameManifestEntry,
   renderProvenanceValue,
@@ -96,6 +87,7 @@ import {
   skipComment,
   skipStringOrIdent,
   spliceManifestValue,
+  stampManifests,
   startsComment,
   startsStringOrIdent,
   stringFormatNames,
@@ -106,11 +98,11 @@ import {
   valueAt,
   withValueAt,
   writeEncryptionKey
-} from "./chunk-HVFR66GQ.js";
+} from "./chunk-TUAAR3MM.js";
 import {
   formatList,
   render
-} from "./chunk-TCC737IS.js";
+} from "./chunk-5G53XATW.js";
 import {
   DERIVABLE_FIELDS,
   DERIVE_SOURCES,
@@ -164,7 +156,7 @@ import {
   urlManifestMessage,
   urlManifestOwning,
   writeFileAtomic
-} from "./chunk-527HHQPS.js";
+} from "./chunk-KCOFEWV5.js";
 import {
   palette
 } from "./chunk-RNVYGWIC.js";
@@ -173,20 +165,24 @@ import {
   escapeWorkflowCommandProperty
 } from "./chunk-MNH7QO4Z.js";
 import {
-  assertKnownProvider,
-  assertLocalFlag,
-  assertModelHasProvider,
   decryptValue,
   encryptValue,
   generateEncryptionKey,
   isEncryptedValue,
-  isMember,
+  isMember
+} from "./chunk-XKBEHKWO.js";
+import {
+  warn
+} from "./chunk-HX44GB4Z.js";
+import {
+  assertKnownProvider,
+  assertLocalFlag,
+  assertModelHasProvider,
   localNotice,
   providerSpecFor,
   resolveIdentity,
-  selectProvider,
-  warn
-} from "./chunk-Q35YIDBV.js";
+  selectProvider
+} from "./chunk-QCHVR4ZM.js";
 import {
   errorMessage
 } from "./chunk-G3T47CFV.js";
@@ -964,7 +960,110 @@ import { randomBytes } from "node:crypto";
 import { existsSync as existsSync2 } from "node:fs";
 import { mkdir as mkdir2, open, readFile as readFile3, rename, rm } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve3, extname as extname3, sep as sep2 } from "node:path";
-import { parseDocument as parseDocument2, isMap, isSeq, isScalar } from "yaml";
+import { parseDocument as parseDocument3, isMap as isMap2, isSeq, isScalar as isScalar2 } from "yaml";
+
+// src/meta/core/location-writes.ts
+import { LineCounter, isMap, isNode, isScalar, parseDocument as parseDocument2 } from "yaml";
+var dedupe = (xs) => [...new Set(xs)];
+var pages = (n) => `${String(n)} page${n === 1 ? "" : "s"}`;
+async function offerExternalHomes(ctx, writes, hooks) {
+  const applied = /* @__PURE__ */ new Set();
+  const groups = /* @__PURE__ */ new Map();
+  for (const w of writes) {
+    if (w.home.kind !== "collection") continue;
+    const group = groups.get(w.home.collection) ?? [];
+    group.push(w);
+    groups.set(w.home.collection, group);
+  }
+  for (const [collection, group] of groups) {
+    const require2 = /* @__PURE__ */ new Map();
+    for (const w of group) {
+      const keys = require2.get(w.label) ?? [];
+      if (!keys.includes(w.key)) keys.push(w.key);
+      require2.set(w.label, keys);
+    }
+    const plan = await planRelocation(ctx, {
+      files: [...require2.keys()],
+      fields: dedupe(group.map((w) => w.key)),
+      require: require2
+    });
+    const offers = relocationOffers(plan);
+    if (offers.length === 0) continue;
+    let yes = true;
+    for (const offer of offers) {
+      const { notice, question } = offerPrompt(offer, "write");
+      hooks.onNotice?.(notice);
+      if (!await hooks.confirm(question)) {
+        yes = false;
+        break;
+      }
+    }
+    if (!yes) continue;
+    const result = await applyRelocation(ctx, plan);
+    hooks.onRelocated?.(result);
+    applied.add(collection);
+  }
+  return applied;
+}
+function externalWriteWarnings(writes, dryRun) {
+  const verb = dryRun ? "would write" : "wrote";
+  const groups = /* @__PURE__ */ new Map();
+  const groupOf = (w) => w.home.kind === "collection" ? `c:${w.home.collection}` : `n:${w.home.reason}`;
+  for (const w of writes) {
+    const id = groupOf(w);
+    groups.set(id, [...groups.get(id) ?? [], w]);
+  }
+  const out = [];
+  for (const group of groups.values()) {
+    const [first] = group;
+    if (first === void 0) continue;
+    out.push(
+      externalWriteWarning({
+        verb,
+        keys: dedupe(group.map((w) => w.key)),
+        pages: new Set(group.map((w) => w.label)).size,
+        home: first.home,
+        createsHome: group.some(
+          (w) => w.home.kind === "collection" && (w.home.createsCollection || w.home.addsPath !== void 0)
+        )
+      })
+    );
+  }
+  return out;
+}
+function externalWriteWarning(line) {
+  const { verb, keys, home } = line;
+  const one = keys.length === 1;
+  const head = `${verb} ${keys.join(", ")} to ${pages(line.pages)}`;
+  const prefer = one ? "the schema prefers external metadata" : "their schemas prefer external metadata";
+  const them = one ? "it" : "them";
+  if (home.kind === "collection") {
+    if (!line.createsHome) {
+      return `${head} in collection ${home.collection}; ${prefer}, and no manifest owns ${them}. Run manni meta relocate to move ${them}.`;
+    }
+    return home.createsCollection || home.createsManifest ? `${head}; ${prefer}. Run manni meta relocate to give ${them} a manifest.` : `${head}; ${prefer}. Run manni meta relocate to add ${them} to collection ${home.collection}.`;
+  }
+  return home.reason === "no-config" ? `${head}; ${prefer}, and --no-config leaves ${them} no manifest.` : `${head} that ${line.pages === 1 ? "is" : "are"} in none of the ${String(home.collections)} collections; ${prefer}, and only a collection has a manifest.`;
+}
+function manifestKeyLine(text, entry, key, join3) {
+  const norm = (e) => join3 === PATH_JOIN ? e.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/") : e;
+  const lc = new LineCounter();
+  const doc = parseDocument2(text, { lineCounter: lc, uniqueKeys: false });
+  const root = doc.contents;
+  if (!isMap(root)) return void 0;
+  for (const pair of root.items) {
+    const spelled = isScalar(pair.key) ? String(pair.key.value) : String(pair.key);
+    if (norm(spelled) !== norm(entry) || !isMap(pair.value)) continue;
+    for (const kv of pair.value.items) {
+      const name = isScalar(kv.key) ? String(kv.key.value) : String(kv.key);
+      const range = isNode(kv.key) ? kv.key.range : void 0;
+      if (name === key && range) return lc.linePos(range[0]).line;
+    }
+  }
+  return void 0;
+}
+
+// src/meta/commands/query.ts
 async function runQuery(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const sql = opts.sql.trim();
@@ -2178,11 +2277,11 @@ async function planConfigEdit(ctx, edit, runRefs) {
     return { changes: [], repointed: false };
   }
   const text = await readFile3(configPath, "utf8");
-  const doc = parseDocument2(stripBom(text));
+  const doc = parseDocument3(stripBom(text));
   const display = displayPath(ctx, configPath);
   const rawRefOf = (item) => {
-    if (isScalar(item) && typeof item.value === "string") return item.value;
-    if (isMap(item)) {
+    if (isScalar2(item) && typeof item.value === "string") return item.value;
+    if (isMap2(item)) {
       const ref = item.get("ref");
       if (typeof ref === "string") return ref;
     }
@@ -2204,10 +2303,10 @@ async function planConfigEdit(ctx, edit, runRefs) {
     for (const item of node.items) {
       const raw = rawRefOf(item);
       if (raw === void 0 || !wants(raw)) continue;
-      if (isScalar(item)) {
+      if (isScalar2(item)) {
         item.value = spec.newRef;
         n += 1;
-      } else if (isMap(item)) {
+      } else if (isMap2(item)) {
         item.set("ref", spec.newRef);
         n += 1;
       }
@@ -2215,13 +2314,13 @@ async function planConfigEdit(ctx, edit, runRefs) {
     return n;
   };
   const root = ctx.configSection === void 0 ? doc : doc.get(ctx.configSection, true);
-  const keyOf2 = (key) => root === doc ? doc.get(key, true) : isMap(root) ? root.get(key, true) : void 0;
+  const keyOf2 = (key) => root === doc ? doc.get(key, true) : isMap2(root) ? root.get(key, true) : void 0;
   const topSeq = keyOf2("schemas");
   let repointCount = repoint(topSeq);
   const overrides = keyOf2("overrides");
   if (isSeq(overrides)) {
     for (const entry of overrides.items) {
-      if (isMap(entry)) repointCount += repoint(entry.get("schemas", true));
+      if (isMap2(entry)) repointCount += repoint(entry.get("schemas", true));
     }
   }
   const repointed = repointCount > 0;
@@ -2230,7 +2329,7 @@ async function planConfigEdit(ctx, edit, runRefs) {
   if (edit.integrity && isSeq(topSeq)) {
     const wantPath = foldPath(edit.integrity.path);
     for (const item of topSeq.items) {
-      if (!isMap(item)) continue;
+      if (!isMap2(item)) continue;
       const raw = rawRefOf(item);
       if (raw === void 0 || classifyRef(raw).kind !== "file") continue;
       const abs = isAbsolute2(raw) ? raw : resolve3(configDir, raw);
@@ -4041,6 +4140,51 @@ function buildUserPrompt(params, before = []) {
   ].join("\n");
 }
 
+// src/meta/core/meta-provenance.ts
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeMetaProvenance(held, model, key, proposed) {
+  if (held !== void 0 && !Array.isArray(held)) return void 0;
+  const list = held === void 0 ? [] : [...held];
+  const at = list.findIndex((e) => isPlainRecord(e) && e["generated-by"] === model);
+  const prior = list[at];
+  const kept = isPlainRecord(prior) ? prior : {};
+  const priorNames = kept[key];
+  const names = Array.isArray(priorNames) ? priorNames.filter((p) => typeof p === "string") : [];
+  const confidence = {};
+  if (isPlainRecord(kept.confidence)) {
+    for (const [k, v] of Object.entries(kept.confidence)) {
+      if (typeof v === "number") confidence[k] = v;
+    }
+  }
+  for (const p of proposed) {
+    if (!names.includes(p.name)) names.push(p.name);
+    confidence[p.name] = p.confidence;
+  }
+  const entry = {
+    ...kept,
+    "generated-by": model,
+    [key]: names,
+    confidence
+  };
+  if (at === -1) list.push(entry);
+  else list[at] = entry;
+  return { list, entry, names };
+}
+function metaProvenanceEntries(value) {
+  if (!Array.isArray(value)) return [];
+  const strings = (list) => Array.isArray(list) ? list.filter((s) => typeof s === "string") : [];
+  const out = [];
+  for (const item of value) {
+    if (!isPlainRecord(item)) continue;
+    const machine = item["generated-by"];
+    if (typeof machine !== "string" || machine === "") continue;
+    out.push({ "generated-by": machine, fields: strings(item.fields), evals: strings(item.evals) });
+  }
+  return out;
+}
+
 // src/meta/commands/fill.ts
 var META_PROVENANCE_KEY = "meta-provenance";
 var PROVENANCE_KEYS = /* @__PURE__ */ new Set(["provenance", META_PROVENANCE_KEY]);
@@ -4253,10 +4397,10 @@ async function runFill(opts) {
     const keys = new Set(candidates.map((c) => c.key));
     const wants = (fields) => fields.some(([key]) => key !== void 0 && keys.has(key));
     const termIndex = wants(TERM_FIELDS) ? await (termbase ??= readTermbase()) : void 0;
-    const pages = wants(PAGE_FIELDS) ? await pageIds(resolve5(base, label), mergeMembersFor(label)) : [];
+    const pages2 = wants(PAGE_FIELDS) ? await pageIds(resolve5(base, label), mergeMembersFor(label)) : [];
     const hints = fieldHints(candidates, {
       terms: termIndex === void 0 ? void 0 : offered(termIndex.labels),
-      pages: offered(pages)
+      pages: offered(pages2)
     });
     return { hints, termIndex };
   };
@@ -5550,7 +5694,7 @@ async function runDerive(opts) {
       runFields = union2;
     }
     const provenanceRoot = configDir ?? cwd;
-    const pages = files.map((label) => resolve6(base, label));
+    const pages2 = files.map((label) => resolve6(base, label));
     const manifests = runFields.includes(PROVENANCE_FIELD) ? provenanceManifests(declaredCollections, provenanceRoot, base) : [];
     const provenanceCollections = declaredCollections.map((c) => ({
       ...c,
@@ -5558,7 +5702,7 @@ async function runDerive(opts) {
         (m) => m.keys === void 0 ? classifyRef(m.file).kind !== "url" : m.keys.includes(PROVENANCE_FIELD)
       )
     })).filter((c) => c.externalMetadata.length > 0);
-    const provenanceIndex = manifests.length === 0 ? null : await loadExternalMetadata(provenanceCollections, { configDir: provenanceRoot, base, pages });
+    const provenanceIndex = manifests.length === 0 ? null : await loadExternalMetadata(provenanceCollections, { configDir: provenanceRoot, base, pages: pages2 });
     const places2 = /* @__PURE__ */ new Map();
     for (const doc of loaded2.values()) {
       const dated = fieldsOf(doc.label).filter((f) => f === "created" || f === "last-updated");
@@ -5600,7 +5744,7 @@ async function runDerive(opts) {
         (m.keys === void 0 || m.keys.some((k) => k !== PROVENANCE_FIELD && runFields.includes(k)))
       )
     })).filter((c) => c.externalMetadata.length > 0);
-    const ownedIndex = ownedCollections.length === 0 ? null : await loadExternalMetadata(ownedCollections, { configDir: provenanceRoot, base, pages });
+    const ownedIndex = ownedCollections.length === 0 ? null : await loadExternalMetadata(ownedCollections, { configDir: provenanceRoot, base, pages: pages2 });
     const derived2 = await deriveMetadata([...loaded2.values()], {
       cwd,
       base,
@@ -6710,12 +6854,16 @@ export {
   vendorFileName,
   runVendorSchema,
   runInferSchema,
+  offerExternalHomes,
+  externalWriteWarnings,
   runQuery,
   CONCEPT_FIELDS,
   TERM_RELATION_FIELDS,
   fieldPointer,
   valueAt2 as valueAt,
   registerTermLabelSource,
+  mergeMetaProvenance,
+  metaProvenanceEntries,
   runFill,
   runDerive,
   deriveFailed,
@@ -6734,4 +6882,4 @@ export {
   renderQuery,
   renderQueryCsv
 };
-//# sourceMappingURL=chunk-QCBICNKC.js.map
+//# sourceMappingURL=chunk-GREQKO6M.js.map