@hawkeyexl/manni 4.5.0 → 4.7.0

package/dist/{chunk-HVFR66GQ.js → chunk-5UB47BEV.js}

@@ -1,19 +1,30 @@
 #!/usr/bin/env node
 import {
+  CHECK_NAME,
+  DEFAULT_BASELINE_PATH,
   DERIVED_KEYWORD,
   DERIVED_STALE_SCHEMA,
+  DERIVE_SOURCES,
   DocmetaError,
   FILE_SCHEMA_KEY,
+  LEGACY_BASELINE_PATH,
   ManifestCache,
+  PROVENANCE_FIELD,
+  STAMPED_DATE_FIELDS,
   STDIN_LABEL,
   STDIN_TOKEN,
+  assertNonEmpty,
   blockLines,
+  canonicalSchemaRef,
   classifyRef,
   colOf,
   collectSchemaPins,
   colonEnd,
+  compareDerived,
   contentEnd,
   deepEqual,
+  derivableFields,
+  deriveCovers,
   detectEol,
   detectStyle,
   emptySource,
@@ -24,25 +35,34 @@ import {
   gitignoreOptions,
   insertKey,
   integrityOf,
+  isBuiltinField,
+  isErrorSeverity,
   keyLines,
   keyString,
   lineEnd,
   loadConfig,
   loadSchema,
   locateFrontmatter,
+  managedFields,
   positionForFactory,
   publishedBuiltins,
   rangeOf,
   rebaseConfigSchemaRefs,
   replaceBlockValue,
   replaceFlowValue,
+  resolveBaselineRequest,
   resolveElements,
+  resolveRunConfig,
   resolveSchemaSetWithSource,
   resolveTargetSet,
   schemaLoadOptions,
   schemaTrustRoot,
+  settleBaseline,
+  staleFindings,
+  supportedExtensions,
+  toJsonText,
   writeFileAtomic
-} from "./chunk-527HHQPS.js";
+} from "./chunk-MSMB6XOS.js";
 import {
   STDIN_LINES_MARKER
 } from "./chunk-YEUYKR62.js";
@@ -67,12 +87,106 @@ import {
   pageManifestPath,
   parseCollections,
   sameFile
-} from "./chunk-Q35YIDBV.js";
+} from "./chunk-XKBEHKWO.js";
 import {
   ToolError,
   errorMessage
 } from "./chunk-G3T47CFV.js";
 
+// src/meta/commands/validate.ts
+import { readFile as readFile6 } from "node:fs/promises";
+
+// src/meta/core/external-metadata.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { isAbsolute, relative as relative2, resolve as resolve2, sep } from "node:path";
+import {
+  LineCounter,
+  isMap as isMap2,
+  isNode,
+  isScalar,
+  isSeq,
+  parseDocument as parseDocument2
+} from "yaml";
+
+// src/shared/manifest-cas.ts
+import { readFile } from "node:fs/promises";
+import { posix } from "node:path";
+var COMMIT_ATTEMPTS = 5;
+function conflictRefusal(file) {
+  return `${file} changed under the command while it was being written. Nothing was written to it. Re-run the command.`;
+}
+function heldManifest(path, file, before, absent = false) {
+  return { path, file, before, text: before, ops: [], bases: /* @__PURE__ */ new Map(), absent };
+}
+function encodeValue(value) {
+  return value === void 0 ? "absent" : JSON.stringify(value);
+}
+function baseKey(at2) {
+  const entry = at2.join === "path" ? posix.normalize(at2.entry) : at2.entry;
+  return `${entry}\0${at2.key}`;
+}
+function rebaseable(held, op, codec) {
+  const at2 = baseKey(op);
+  if (held.bases.has(at2)) return;
+  held.bases.set(at2, {
+    entry: op.entry,
+    key: op.key,
+    join: op.join,
+    value: encodeValue(codec.read(held.before, op))
+  });
+}
+function rebase(held, current, codec) {
+  for (const base of held.bases.values()) {
+    if (encodeValue(codec.read(current, base)) !== base.value) return void 0;
+  }
+  let text2 = current;
+  for (const op of held.ops) text2 = codec.apply(text2, op);
+  return text2;
+}
+function rebaseline(held) {
+  held.before = held.text;
+  held.ops = [];
+  held.bases.clear();
+  held.absent = false;
+}
+async function settle(held, io) {
+  for (let attempt = 1; attempt <= COMMIT_ATTEMPTS; attempt++) {
+    let current;
+    try {
+      current = await io.read(held.path);
+    } catch (error) {
+      if (held.absent && isMissing(error)) {
+        await io.write(held.path, held.text);
+        held.absent = false;
+        return;
+      }
+      const reason = error instanceof Error ? error.message : String(error);
+      throw io.toError(`Manifest ${held.file} could not be read: ${reason}`);
+    }
+    if (!held.absent && current === held.before) {
+      await io.write(held.path, held.text);
+      return;
+    }
+    const replayed = rebase(held, current, io.codec);
+    if (replayed === void 0) throw io.toError(conflictRefusal(held.file));
+    held.before = current;
+    held.text = replayed;
+    held.absent = false;
+  }
+  throw io.toError(conflictRefusal(held.file));
+}
+function isMissing(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function readManifestOrEmpty(absPath, perPage) {
+  try {
+    return await readFile(absPath, "utf8");
+  } catch (e) {
+    if (perPage && isMissing(e)) return "";
+    throw e;
+  }
+}
+
 // src/meta/core/external-metadata-fetch.ts
 var EXTERNAL_METADATA_FETCH_TIMEOUT_MS = 1e4;
 var EXTERNAL_METADATA_FETCH_MAX_BYTES = 5 * 1024 * 1024;
@@ -166,7 +280,7 @@ async function readCapped(url, res, maxBytes) {
 
 // src/shared/encryption-key.ts
 import { spawnSync } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 import { basename as basename2, dirname as dirname2, join as join2, relative, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { isMap, parseDocument, parse as parseYaml, stringify } from "yaml";
@@ -179,16 +293,16 @@ var RENAME_ATTEMPTS = 3;
 function errorCode(err) {
   return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
 }
-var wait = (ms) => new Promise((resolve4) => {
-  setTimeout(resolve4, ms);
+var wait = (ms) => new Promise((resolve8) => {
+  setTimeout(resolve8, ms);
 });
-async function writeTextAtomic(path, text) {
+async function writeTextAtomic(path, text2) {
   const tmp = join(
     dirname(path),
     `.${basename(path)}.manni-${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`
   );
   try {
-    await writeFile(tmp, text, "utf8");
+    await writeFile(tmp, text2, "utf8");
     try {
       const { mode } = await stat(path);
       await chmod(tmp, mode);
@@ -236,7 +350,7 @@ function errorCode2(err) {
 }
 async function readIfPresent(path) {
   try {
-    return await readFile(path, "utf8");
+    return await readFile2(path, "utf8");
   } catch (err) {
     if (errorCode2(err) === "ENOENT") return null;
     throw err;
@@ -248,21 +362,21 @@ async function fileTarget(file, toError) {
       `${file.source} is a single-tool config file, which cannot hold the family ${ENCRYPTION_KEY_FIELD}. Move its keys under the tool's section in ${FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"}, or set ${ENCRYPTION_KEY_ENV}.`
     );
   }
-  const text = await readIfPresent(file.path);
-  return { path: file.path, source: file.source, text: text ?? file.text };
+  const text2 = await readIfPresent(file.path);
+  return { path: file.path, source: file.source, text: text2 ?? file.text };
 }
 async function defaultTarget(cwd) {
   const root = findGitRoot(cwd) ?? resolve(cwd);
   for (const name of FAMILY_CONFIG_NAMES) {
     const path2 = join2(root, name);
-    const text = await readIfPresent(path2);
-    if (text !== null) return { path: path2, source: relativeSource(cwd, path2), text };
+    const text2 = await readIfPresent(path2);
+    if (text2 !== null) return { path: path2, source: relativeSource(cwd, path2), text: text2 };
   }
   const path = join2(root, FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml");
   return { path, source: relativeSource(cwd, path), text: null };
 }
-function withKey(text, key, previous, source, toError) {
-  const doc = parseDocument(text);
+function withKey(text2, key, previous, source, toError) {
+  const doc = parseDocument(text2);
   const [first] = doc.errors;
   if (first !== void 0) {
     throw toError(`${source}: invalid YAML: ${first.message}`);
@@ -307,12 +421,12 @@ async function writeEncryptionKey(opts) {
     );
   }
   const target = file === null ? await defaultTarget(opts.cwd) : await fileTarget(file, toError);
-  const text = target.text === null ? stringify({
+  const text2 = target.text === null ? stringify({
     [ENCRYPTION_KEY_FIELD]: key,
     ...typeof previous === "string" ? { [ENCRYPTION_KEY_PREVIOUS_FIELD]: previous } : {}
   }) : withKey(target.text, key, previous, target.source, toError);
-  verify(target.text, text, key, previous, target.source, toError);
-  if (opts.dryRun !== true) await writeTextAtomic(target.path, text);
+  verify(target.text, text2, key, previous, target.source, toError);
+  if (opts.dryRun !== true) await writeTextAtomic(target.path, text2);
   return { path: target.path, source: target.source, created: target.text === null };
 }
 function isIgnoredByGit(path) {
@@ -377,8 +491,8 @@ function valueAt(data, pointer) {
   let node = data;
   for (const seg of segments(pointer)) {
     if (Array.isArray(node)) {
-      const items = node;
-      node = /^\d+$/.test(seg) ? items[Number(seg)] : void 0;
+      const items2 = node;
+      node = /^\d+$/.test(seg) ? items2[Number(seg)] : void 0;
     } else if (isRecord(node)) {
       node = Object.hasOwn(node, seg) ? node[seg] : void 0;
     } else {
@@ -393,10 +507,10 @@ function withValueAt(root, pointer, value) {
     const seg = parts[i];
     if (seg === void 0) return value;
     if (Array.isArray(node)) {
-      const items = [...node];
-      if (!/^\d+$/.test(seg) || Number(seg) >= items.length) return node;
-      items[Number(seg)] = set(items[Number(seg)], i + 1);
-      return items;
+      const items2 = [...node];
+      if (!/^\d+$/.test(seg) || Number(seg) >= items2.length) return node;
+      items2[Number(seg)] = set(items2[Number(seg)], i + 1);
+      return items2;
     }
     if (isRecord(node) && Object.hasOwn(node, seg)) {
       return { ...node, [seg]: set(node[seg], i + 1) };
@@ -533,97 +647,6 @@ function redactedDerived(f) {
   };
 }
 
-// src/meta/core/external-metadata.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { isAbsolute, relative as relative2, resolve as resolve2, sep } from "node:path";
-import {
-  LineCounter,
-  isMap as isMap2,
-  isNode,
-  isScalar,
-  isSeq,
-  parseDocument as parseDocument2
-} from "yaml";
-
-// src/shared/manifest-cas.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { posix } from "node:path";
-var COMMIT_ATTEMPTS = 5;
-function conflictRefusal(file) {
-  return `${file} changed under the command while it was being written. Nothing was written to it. Re-run the command.`;
-}
-function heldManifest(path, file, before, absent = false) {
-  return { path, file, before, text: before, ops: [], bases: /* @__PURE__ */ new Map(), absent };
-}
-function encodeValue(value) {
-  return value === void 0 ? "absent" : JSON.stringify(value);
-}
-function baseKey(at2) {
-  const entry = at2.join === "path" ? posix.normalize(at2.entry) : at2.entry;
-  return `${entry}\0${at2.key}`;
-}
-function rebaseable(held, op, codec) {
-  const at2 = baseKey(op);
-  if (held.bases.has(at2)) return;
-  held.bases.set(at2, {
-    entry: op.entry,
-    key: op.key,
-    join: op.join,
-    value: encodeValue(codec.read(held.before, op))
-  });
-}
-function rebase(held, current, codec) {
-  for (const base of held.bases.values()) {
-    if (encodeValue(codec.read(current, base)) !== base.value) return void 0;
-  }
-  let text = current;
-  for (const op of held.ops) text = codec.apply(text, op);
-  return text;
-}
-function rebaseline(held) {
-  held.before = held.text;
-  held.ops = [];
-  held.bases.clear();
-  held.absent = false;
-}
-async function settle(held, io) {
-  for (let attempt = 1; attempt <= COMMIT_ATTEMPTS; attempt++) {
-    let current;
-    try {
-      current = await io.read(held.path);
-    } catch (error) {
-      if (held.absent && isMissing(error)) {
-        await io.write(held.path, held.text);
-        held.absent = false;
-        return;
-      }
-      const reason = error instanceof Error ? error.message : String(error);
-      throw io.toError(`Manifest ${held.file} could not be read: ${reason}`);
-    }
-    if (!held.absent && current === held.before) {
-      await io.write(held.path, held.text);
-      return;
-    }
-    const replayed = rebase(held, current, io.codec);
-    if (replayed === void 0) throw io.toError(conflictRefusal(held.file));
-    held.before = current;
-    held.text = replayed;
-    held.absent = false;
-  }
-  throw io.toError(conflictRefusal(held.file));
-}
-function isMissing(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-async function readManifestOrEmpty(absPath, perPage) {
-  try {
-    return await readFile2(absPath, "utf8");
-  } catch (e) {
-    if (perPage && isMissing(e)) return "";
-    throw e;
-  }
-}
-
 // src/meta/core/external-metadata.ts
 var EXTERNAL_OWNED_SCHEMA = "external:owned";
 var EXTERNAL_DUPLICATE_SCHEMA = "external:duplicate";
@@ -666,18 +689,18 @@ async function loadExternalMetadata(collections, opts) {
       rules.push({ collection: declared, manifest, configDir: opts.configDir });
       continue;
     }
-    const join4 = externalMetadataJoin(manifest);
+    const join5 = externalMetadataJoin(manifest);
     let parsed;
     let file;
     if (classifyRef(manifest.file).kind === "url") {
       file = manifest.file;
-      const text = await fetchExternalMetadata(manifest.file, {
+      const text2 = await fetchExternalMetadata(manifest.file, {
         ...manifest.tokenEnv !== void 0 ? { tokenEnv: manifest.tokenEnv } : {},
         ...opts.offline !== void 0 ? { offline: opts.offline } : {},
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {},
         ...opts.env !== void 0 ? { env: opts.env } : {}
       });
-      parsed = parseManifest(manifest, collection, text, file, opts.configDir, join4, ownership(declared, manifest));
+      parsed = parseManifest(manifest, collection, text2, file, opts.configDir, join5, ownership(declared, manifest));
     } else {
       const abs = isAbsolute(manifest.file) ? manifest.file : resolve2(opts.configDir, manifest.file);
       const label = reportedPath(abs, opts.base);
@@ -693,7 +716,7 @@ async function loadExternalMetadata(collections, opts) {
         // this run's spelling onto every value and entry instead.
         JSON.stringify([
           collection,
-          join4,
+          join5,
           opts.configDir,
           variantOf(declared, manifest)
         ]),
@@ -703,7 +726,7 @@ async function loadExternalMetadata(collections, opts) {
           await readManifest(abs, label),
           label,
           opts.configDir,
-          join4,
+          join5,
           ownership(declared, manifest)
         )
       );
@@ -717,14 +740,14 @@ async function loadExternalMetadata(collections, opts) {
       else owners.set(key, [{ collection, file }]);
     }
     let target;
-    if (join4 === PATH_JOIN) {
+    if (join5 === PATH_JOIN) {
       target = byPath;
     } else {
-      const existing = byField.get(join4);
+      const existing = byField.get(join5);
       if (existing) target = existing;
       else {
         target = /* @__PURE__ */ new Map();
-        byField.set(join4, target);
+        byField.set(join5, target);
       }
     }
     for (const [indexKey, values] of parsed.values) {
@@ -759,14 +782,14 @@ function variantOf(declared, manifest) {
 }
 async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
   const collection = declared.name;
-  const join4 = externalMetadataJoin(manifest);
+  const join5 = externalMetadataJoin(manifest);
   const implied = manifest.keys === void 0 ? { collection: declared, manifest, file: manifest.file, files: /* @__PURE__ */ new Set() } : void 0;
   for (const key of manifest.keys ?? []) {
     const list2 = into.owners.get(key);
     if (list2) list2.push({ collection, file: manifest.file });
     else into.owners.set(key, [{ collection, file: manifest.file }]);
   }
-  const target = indexFor(join4, into);
+  const target = indexFor(join5, into);
   for (const pageAbs of opts.pages ?? []) {
     const resolved = pageManifestPath(manifest.file, opts.configDir, pageAbs);
     if ("outside" in resolved) {
@@ -788,14 +811,14 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
     const label = reportedPath(resolved.abs, opts.base);
     const parsed = await parsedManifests.parse(
       resolved.abs,
-      JSON.stringify([collection, join4, opts.configDir, variantOf(declared, manifest)]),
+      JSON.stringify([collection, join5, opts.configDir, variantOf(declared, manifest)]),
       async () => parseManifest(
         manifest,
         collection,
         await readPageManifest(resolved.abs, label),
         label,
         opts.configDir,
-        join4,
+        join5,
         ownership(declared, manifest)
       )
     );
@@ -809,7 +832,7 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
       );
     }
     for (const [indexKey, values] of parsed.values) {
-      const key = join4 === PATH_JOIN ? pageAbs : indexKey;
+      const key = join5 === PATH_JOIN ? pageAbs : indexKey;
       const merged = target.get(key) ?? /* @__PURE__ */ new Map();
       for (const [owned, value] of values) merged.set(owned, reported(value, label));
       target.set(key, merged);
@@ -823,12 +846,12 @@ async function loadPerPage(declared, manifest, opts, resolvedBy, into) {
   }
   return implied;
 }
-function indexFor(join4, into) {
-  if (join4 === PATH_JOIN) return into.byPath;
-  const existing = into.byField.get(join4);
+function indexFor(join5, into) {
+  if (join5 === PATH_JOIN) return into.byPath;
+  const existing = into.byField.get(join5);
   if (existing) return existing;
   const created = /* @__PURE__ */ new Map();
-  into.byField.set(join4, created);
+  into.byField.set(join5, created);
   return created;
 }
 function outsideRefusal(manifest, collection, pageRel) {
@@ -858,11 +881,11 @@ function unreadable(file, err) {
   const reason = err instanceof Error ? err.message : String(err);
   return new DocmetaError(`Manifest ${file} could not be read: ${reason}`);
 }
-function parseManifest(manifest, collection, text, file, configDir, join4, owns) {
+function parseManifest(manifest, collection, text2, file, configDir, join5, owns) {
   const target = /* @__PURE__ */ new Map();
   const entries = [];
   const lc = new LineCounter();
-  const doc = parseDocument2(text, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument2(text2, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(
@@ -874,7 +897,7 @@ function parseManifest(manifest, collection, text, file, configDir, join4, owns)
     return { values: target, entries };
   if (!isMap2(root)) {
     throw new DocmetaError(
-      `Manifest ${file}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
+      `Manifest ${file}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
     );
   }
   const lineAt = (node) => {
@@ -898,7 +921,7 @@ function parseManifest(manifest, collection, text, file, configDir, join4, owns)
         `Manifest ${where}: "${spelled}" must be a mapping of owned keys to values.`
       );
     }
-    const indexKey = join4 === PATH_JOIN ? resolve2(configDir, spelled) : spelled;
+    const indexKey = join5 === PATH_JOIN ? resolve2(configDir, spelled) : spelled;
     const values = target.get(indexKey) ?? /* @__PURE__ */ new Map();
     for (const kv of pair.value.items) {
       const key = isScalar(kv.key) ? String(kv.key.value) : String(kv.key);
@@ -924,8 +947,8 @@ function parseManifest(manifest, collection, text, file, configDir, join4, owns)
     target.set(indexKey, values);
     entries.push({
       collection,
-      join: join4,
-      ...join4 === PATH_JOIN ? { abs: indexKey } : {},
+      join: join5,
+      ...join5 === PATH_JOIN ? { abs: indexKey } : {},
       spelled,
       file,
       ...entryLine === void 0 ? {} : { line: entryLine }
@@ -1186,9 +1209,6 @@ function isFieldLocation(value) {
   return value === "page" || value === "external";
 }
 
-// src/meta/core/graph-output.ts
-var GRAPH_OUTPUT_KEYWORD = "x-manni-graph-output";
-
 // src/meta/core/validator.ts
 import * as AjvDraft07Ns from "ajv";
 import * as Ajv2019Ns from "ajv/dist/2019.js";
@@ -1196,6 +1216,11 @@ import * as Ajv2020Ns from "ajv/dist/2020.js";
 import * as AjvDraft04Ns from "ajv-draft-04";
 import * as addFormatsNs from "ajv-formats";
 import { createRequire } from "node:module";
+
+// src/meta/core/graph-output.ts
+var GRAPH_OUTPUT_KEYWORD = "x-manni-graph-output";
+
+// src/meta/core/validator.ts
 var draft06MetaSchema = createRequire(import.meta.url)(
   "ajv/dist/refs/json-schema-draft-06.json"
 );
@@ -1810,6 +1835,23 @@ function familyMarks(opts) {
   })();
 }
 
+// src/meta/core/relocation.ts
+import { access, readFile as readFile4, stat as stat2, unlink } from "node:fs/promises";
+import { basename as basename3, extname, isAbsolute as isAbsolute3, join as join3, relative as relative4, resolve as resolve3, sep as sep3 } from "node:path";
+import picomatch from "picomatch";
+import {
+  LineCounter as LineCounter3,
+  isMap as isMap4,
+  isNode as isNode3,
+  isScalar as isScalar3,
+  isSeq as isSeq2,
+  parse as parseYaml2,
+  parseDocument as parseDocument4
+} from "yaml";
+
+// src/meta/core/collections.ts
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolvePath, sep as sep2 } from "node:path";
+
 // src/meta/core/projection.ts
 var SYSTEM_COLUMNS = ["_path", "_format", "_present", "_data"];
 var RESERVED = new Set(SYSTEM_COLUMNS);
@@ -1940,7 +1982,7 @@ function isParamName(name) {
   return PARAM_NAME_HEAD.exec(name)?.[0] === name;
 }
 function collectNamedParameters(sql) {
-  const tokens = [];
+  const tokens2 = [];
   const seen = /* @__PURE__ */ new Set();
   const prefixOf = /* @__PURE__ */ new Map();
   let i = 0;
@@ -1970,14 +2012,14 @@ function collectNamedParameters(sql) {
       prefixOf.set(m[0], ch);
       if (!seen.has(token)) {
         seen.add(token);
-        tokens.push(token);
+        tokens2.push(token);
       }
       i += 1 + m[0].length;
     } else {
       i++;
     }
   }
-  return tokens;
+  return tokens2;
 }
 function stripLeadingTrivia(sql) {
   let i = 0;
@@ -1990,16 +2032,16 @@ function stripLeadingTrivia(sql) {
     return sql.slice(i);
   }
 }
-function isTrivia(text) {
+function isTrivia(text2) {
   let i = 0;
-  while (i < text.length) {
-    const ch = text[i];
+  while (i < text2.length) {
+    const ch = text2[i];
     if (ch === void 0 || /\s/.test(ch) || ch === ";") {
       i++;
       continue;
     }
-    if (startsComment(text, i)) {
-      i = skipComment(text, i);
+    if (startsComment(text2, i)) {
+      i = skipComment(text2, i);
       continue;
     }
     return false;
@@ -2011,8 +2053,8 @@ function loadSqlite() {
   sqliteModule ??= (async () => {
     const original = process.emitWarning.bind(process);
     const filtered = (warning, ...rest) => {
-      const text = typeof warning === "string" ? warning : warning.message;
-      if (text.includes("SQLite is an experimental feature")) return;
+      const text2 = typeof warning === "string" ? warning : warning.message;
+      if (text2.includes("SQLite is an experimental feature")) return;
       Reflect.apply(original, process, [warning, ...rest]);
     };
     process.emitWarning = filtered;
@@ -2026,7 +2068,6 @@ function loadSqlite() {
 }
 
 // src/meta/core/collections.ts
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolvePath, sep as sep2 } from "node:path";
 function memberOf(collections, configDir, base, label) {
   if (collections.length === 0) return [];
   if (label === STDIN_LABEL) return [];
@@ -2067,20 +2108,6 @@ function createCollectionViews(db, collections) {
   }
 }
 
-// src/meta/core/relocation.ts
-import { access, readFile as readFile4, stat as stat2, unlink } from "node:fs/promises";
-import { basename as basename3, extname, isAbsolute as isAbsolute3, join as join3, relative as relative4, resolve as resolve3, sep as sep3 } from "node:path";
-import picomatch from "picomatch";
-import {
-  LineCounter as LineCounter3,
-  isMap as isMap4,
-  isNode as isNode3,
-  isScalar as isScalar3,
-  isSeq as isSeq2,
-  parse as parseYaml2,
-  parseDocument as parseDocument4
-} from "yaml";
-
 // src/meta/core/external-metadata-write.ts
 import { posix as posix3 } from "node:path";
 import {
@@ -2091,9 +2118,9 @@ import {
   parseDocument as parseDocument3,
   stringify as stringify2
 } from "yaml";
-function spliceManifestValue(text, options) {
+function spliceManifestValue(text2, options) {
   const { entry, key, value, file } = options;
-  const join4 = options.join ?? PATH_JOIN;
+  const join5 = options.join ?? PATH_JOIN;
   const at2 = (line2) => {
     const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
     if (line2 === void 0) return name;
@@ -2107,9 +2134,9 @@ function spliceManifestValue(text, options) {
   if (value === void 0) {
     throw new DocmetaError(`${at2()}: refusing to write "${key}" for "${entry}" with no value.`);
   }
-  const eol = detectEol(text);
+  const eol = detectEol(text2);
   const lc = new LineCounter2();
-  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
@@ -2118,18 +2145,18 @@ function spliceManifestValue(text, options) {
     const r = rangeOf(node);
     return r ? lc.linePos(r[0]).line : void 0;
   };
-  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const root = doc.contents;
   let spelled = entry;
   let edit;
-  if (root === null || isScalar2(root) && root.value === null && emptySource(text, root)) {
-    edit = startManifest(text, entry, key, value, eol);
+  if (root === null || isScalar2(root) && root.value === null && emptySource(text2, root)) {
+    edit = startManifest(text2, entry, key, value, eol);
   } else if (!isMap3(root)) {
     throw new DocmetaError(
-      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
+      `${at2()}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
     );
   } else {
-    const style = detectStyle(text, root, eol);
+    const style = detectStyle(text2, root, eol);
     const matches = root.items.filter((p) => same(keyString(p.key), entry));
     const [first, second] = matches;
     if (first && second) {
@@ -2143,7 +2170,7 @@ function spliceManifestValue(text, options) {
           `${at2()}: the manifest is a flow mapping ({ \u2026 }), which this writer does not add entries to. Rewrite it in block style.`
         );
       }
-      edit = appendEntry(text, root, entry, key, value, style);
+      edit = appendEntry(text2, root, entry, key, value, style);
     } else {
       spelled = keyString(first.key);
       const where = at2(keyLine(first.key));
@@ -2166,18 +2193,18 @@ function spliceManifestValue(text, options) {
       );
       let made;
       if (v.flow === true) {
-        if (hit) made = replaceFlowValue(text, hit, value);
-        else if (v.items.length === 0) made = fillEmptyEntry(text, first, key, value, style);
+        if (hit) made = replaceFlowValue(text2, hit, value);
+        else if (v.items.length === 0) made = fillEmptyEntry(text2, first, key, value, style);
         else throw flowRefusal();
         if (!made) throw hit ? flowRefusal() : formRefusal();
       } else {
-        made = hit ? replaceBlockValue(text, hit, value, style) : insertKey(text, v, key, value, style);
+        made = hit ? replaceBlockValue(text2, hit, value, style) : insertKey(text2, v, key, value, style);
         if (!made) throw formRefusal();
       }
       edit = made;
     }
   }
-  const out = text.slice(0, edit.start) + edit.insert + text.slice(edit.end);
+  const out = text2.slice(0, edit.start) + edit.insert + text2.slice(edit.end);
   const line = readBack(
     doc,
     out,
@@ -2190,13 +2217,13 @@ function spliceManifestValue(text, options) {
   );
   return { text: out, line };
 }
-function readManifestValue(text, options) {
-  const join4 = options.join ?? PATH_JOIN;
-  const doc = parseDocument3(text, { uniqueKeys: false });
+function readManifestValue(text2, options) {
+  const join5 = options.join ?? PATH_JOIN;
+  const doc = parseDocument3(text2, { uniqueKeys: false });
   if (doc.errors.length > 0) return void 0;
   const root = doc.contents;
   if (!isMap3(root)) return void 0;
-  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const pair = root.items.find((p) => same(keyString(p.key), options.entry));
   const held = pair?.value;
   if (!isMap3(held)) return void 0;
@@ -2204,17 +2231,17 @@ function readManifestValue(text, options) {
   const node = kv?.value;
   return isNode2(node) ? node.toJSON() : void 0;
 }
-function removeManifestKey(text, options) {
+function removeManifestKey(text2, options) {
   const { entry, key, file } = options;
-  const join4 = options.join ?? PATH_JOIN;
+  const join5 = options.join ?? PATH_JOIN;
   const at2 = (line) => {
     const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
     if (line === void 0) return name;
     return file === void 0 ? `${name} line ${String(line)}` : `${name}:${String(line)}`;
   };
-  const eol = detectEol(text);
+  const eol = detectEol(text2);
   const lc = new LineCounter2();
-  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
@@ -2224,13 +2251,13 @@ function removeManifestKey(text, options) {
     return r ? lc.linePos(r[0]).line : void 0;
   };
   const root = doc.contents;
-  if (root === null || isScalar2(root) && root.value === null) return { text };
+  if (root === null || isScalar2(root) && root.value === null) return { text: text2 };
   if (!isMap3(root)) {
     throw new DocmetaError(
-      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
+      `${at2()}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
     );
   }
-  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const matches = root.items.filter((p) => same(keyString(p.key), entry));
   const [first, second] = matches;
   if (first && second) {
@@ -2238,7 +2265,7 @@ function removeManifestKey(text, options) {
       `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
     );
   }
-  if (first === void 0) return { text };
+  if (first === void 0) return { text: text2 };
   const spelled = keyString(first.key);
   const where = at2(keyLine(first.key));
   const v = first.value;
@@ -2252,7 +2279,7 @@ function removeManifestKey(text, options) {
       `${at2(keyLine(again.key))}: "${spelled}" sets "${key}" twice (first at line ${String(keyLine(hit.key) ?? "?")}). Remove one.`
     );
   }
-  if (hit === void 0) return { text };
+  if (hit === void 0) return { text: text2 };
   const whole = v.items.length === 1;
   if (!whole && v.flow === true) {
     throw new DocmetaError(
@@ -2260,18 +2287,18 @@ function removeManifestKey(text, options) {
     );
   }
   const from = rangeOf(whole ? first.key : hit.key);
-  const to = whole ? contentEnd(text, v) : contentEnd(text, hit.value) ?? contentEnd(text, hit.key);
+  const to = whole ? contentEnd(text2, v) : contentEnd(text2, hit.value) ?? contentEnd(text2, hit.key);
   if (!from || to === void 0) {
     throw new DocmetaError(
       `${where}: "${spelled}" writes a key in a form this writer does not edit. Write it as "${key}: \u2026".`
     );
   }
-  let { start, end } = keyLines(text, from[0], to, eol);
+  let { start, end } = keyLines(text2, from[0], to, eol);
   if (whole) {
-    if (text.slice(start - 2 * eol.length, start) === eol + eol) start -= eol.length;
-    else if (start === 0 && text.startsWith(eol, end)) end += eol.length;
+    if (text2.slice(start - 2 * eol.length, start) === eol + eol) start -= eol.length;
+    else if (start === 0 && text2.startsWith(eol, end)) end += eol.length;
   }
-  const out = text.slice(0, start) + text.slice(end);
+  const out = text2.slice(0, start) + text2.slice(end);
   const after = parseDocument3(out, { uniqueKeys: false });
   const fail = (why) => new DocmetaError(
     `${at2()}: removing "${key}" for "${entry}" did not read back as removed, so nothing was written. ${why}`
@@ -2290,16 +2317,16 @@ function removeManifestKey(text, options) {
   if (!deepEqual(now ?? null, expected)) throw fail("Another value in the manifest would have changed.");
   return { text: out };
 }
-function renameManifestEntry(text, options) {
+function renameManifestEntry(text2, options) {
   const { entry, to, file } = options;
-  const join4 = options.join ?? PATH_JOIN;
+  const join5 = options.join ?? PATH_JOIN;
   const at2 = (line) => {
     const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
     if (line === void 0) return name;
     return file === void 0 ? `${name} line ${String(line)}` : `${name}:${String(line)}`;
   };
   const lc = new LineCounter2();
-  const doc = parseDocument3(text, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument3(text2, { lineCounter: lc, uniqueKeys: false });
   const problem = doc.errors[0];
   if (problem) {
     throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
@@ -2309,20 +2336,20 @@ function renameManifestEntry(text, options) {
     return r2 ? lc.linePos(r2[0]).line : void 0;
   };
   const root = doc.contents;
-  if (root === null || isScalar2(root) && root.value === null) return { text };
+  if (root === null || isScalar2(root) && root.value === null) return { text: text2 };
   if (!isMap3(root)) {
     throw new DocmetaError(
-      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
+      `${at2()}: the manifest must be a mapping from document ${join5 === PATH_JOIN ? "path" : `"${join5}"`} to owned keys.`
     );
   }
-  const same = join4 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
+  const same = join5 === PATH_JOIN ? (a, b) => posix3.normalize(a) === posix3.normalize(b) : (a, b) => a === b;
   const [first, second] = root.items.filter((p) => same(keyString(p.key), entry));
   if (first && second) {
     throw new DocmetaError(
       `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
     );
   }
-  if (first === void 0) return { text };
+  if (first === void 0) return { text: text2 };
   const taken = root.items.find((p) => same(keyString(p.key), to));
   if (taken !== void 0) {
     throw new DocmetaError(
@@ -2331,8 +2358,8 @@ function renameManifestEntry(text, options) {
   }
   const spelled = keyString(first.key);
   const r = rangeOf(first.key);
-  const end = contentEnd(text, first.key);
-  if (!r || end === void 0 || colonEnd(text, first) === void 0) {
+  const end = contentEnd(text2, first.key);
+  if (!r || end === void 0 || colonEnd(text2, first) === void 0) {
     throw new DocmetaError(
       `${at2(keyLine(first.key))}: "${spelled}" is written in a form this writer does not edit. Write it as "${spelled}: \u2026".`
     );
@@ -2340,7 +2367,7 @@ function renameManifestEntry(text, options) {
   const quoted = isScalar2(first.key) && (first.key.type === "QUOTE_DOUBLE" || first.key.type === "QUOTE_SINGLE");
   const plain = stringify2(to, { lineWidth: 0 }).replace(/\n$/, "");
   const insert = quoted || plain.includes("\n") ? JSON.stringify(to) : plain;
-  const out = text.slice(0, r[0]) + insert + text.slice(end);
+  const out = text2.slice(0, r[0]) + insert + text2.slice(end);
   const after = parseDocument3(out, { uniqueKeys: false });
   const fail = (why) => new DocmetaError(
     `${at2()}: renaming "${spelled}" to "${to}" did not read back as renamed, so nothing was written. ${why}`
@@ -2355,25 +2382,25 @@ function renameManifestEntry(text, options) {
   if (!deepEqual(now, expected)) throw fail("Another value in the manifest would have changed.");
   return { text: out };
 }
-function startManifest(text, entry, key, value, eol) {
+function startManifest(text2, entry, key, value, eol) {
   const style = { step: 2, indentSeq: true, eol };
   const block = blockLines({ [entry]: { [key]: value } }, 0, style);
   let insert;
-  if (text === "" || text.endsWith("\n")) insert = block + eol;
+  if (text2 === "" || text2.endsWith("\n")) insert = block + eol;
   else insert = eol + block;
-  return { start: text.length, end: text.length, insert };
+  return { start: text2.length, end: text2.length, insert };
 }
-function appendEntry(text, root, entry, key, value, style) {
+function appendEntry(text2, root, entry, key, value, style) {
   const body = { [entry]: { [key]: value } };
   if (root.flow === true) {
     const r = rangeOf(root);
-    const start = r ? r[0] : text.length;
-    const end = contentEnd(text, root) ?? start;
-    return { start, end, insert: blockLines(body, colOf(text, start), style) };
+    const start = r ? r[0] : text2.length;
+    const end = contentEnd(text2, root) ?? start;
+    return { start, end, insert: blockLines(body, colOf(text2, start), style) };
   }
   const firstKey = rangeOf(root.items[0]?.key);
-  const col = firstKey ? colOf(text, firstKey[0]) : 0;
-  const pos = lineEnd(text, contentEnd(text, root) ?? text.length);
+  const col = firstKey ? colOf(text2, firstKey[0]) : 0;
+  const pos = lineEnd(text2, contentEnd(text2, root) ?? text2.length);
   const last = root.items.at(-1);
   const spaced = root.items.length > 1 && isNode2(last?.key) && last.key.spaceBefore === true;
   return {
@@ -2382,12 +2409,12 @@ function appendEntry(text, root, entry, key, value, style) {
     insert: style.eol + (spaced ? style.eol : "") + blockLines(body, col, style)
   };
 }
-function fillEmptyEntry(text, entryPair, key, value, style) {
-  const start = colonEnd(text, entryPair);
+function fillEmptyEntry(text2, entryPair, key, value, style) {
+  const start = colonEnd(text2, entryPair);
   const keyRange = rangeOf(entryPair.key);
-  const end = contentEnd(text, entryPair.value);
+  const end = contentEnd(text2, entryPair.value);
   if (start === void 0 || !keyRange || end === void 0) return void 0;
-  const col = colOf(text, keyRange[0]) + style.step;
+  const col = colOf(text2, keyRange[0]) + style.step;
   return { start, end, insert: style.eol + blockLines({ [key]: value }, col, style) };
 }
 function readBack(before, out, spelled, key, value, fail) {
@@ -2428,17 +2455,17 @@ function isRecord3(x) {
 function relocateFailed(result) {
   return result.summary.stayed > 0;
 }
-function relocationContext(run, extras) {
+function relocationContext(run2, extras) {
   return {
     cwd: extras.cwd,
-    base: run.base,
+    base: run2.base,
     noConfig: extras.noConfig ?? false,
-    config: run.config,
-    ...run.configDir !== void 0 ? { configDir: run.configDir } : {},
-    ...run.configPath !== void 0 ? { configPath: run.configPath } : {},
-    ...run.configFile !== void 0 ? { configFile: run.configFile } : {},
-    collections: run.collections,
-    declaredCollections: run.declaredCollections,
+    config: run2.config,
+    ...run2.configDir !== void 0 ? { configDir: run2.configDir } : {},
+    ...run2.configPath !== void 0 ? { configPath: run2.configPath } : {},
+    ...run2.configFile !== void 0 ? { configFile: run2.configFile } : {},
+    collections: run2.collections,
+    declaredCollections: run2.declaredCollections,
     targets: extras.targets.filter((t) => t !== STDIN_TOKEN),
     ...extras.cliSchemas !== void 0 ? { cliSchemas: extras.cliSchemas } : {},
     validator: extras.validator,
@@ -2677,17 +2704,17 @@ function bare(path) {
 }
 async function collectionPath(target, cwd, configDir) {
   if (target === STDIN_TOKEN) return void 0;
-  const posix4 = target.replace(/\\/g, "/");
-  const scanned = picomatch.scan(posix4);
+  const posix5 = target.replace(/\\/g, "/");
+  const scanned = picomatch.scan(posix5);
   if (scanned.isGlob) {
     const rel2 = toPosix(relative4(configDir, resolve3(cwd, scanned.base === "" ? "." : scanned.base)));
     if (isAbsolute3(rel2) || rel2 === ".." || rel2.startsWith("../")) return void 0;
     return rel2 === "" ? scanned.glob : `${rel2}/${scanned.glob}`;
   }
-  const abs = resolve3(cwd, posix4);
+  const abs = resolve3(cwd, posix5);
   const rel = toPosix(relative4(configDir, abs));
   if (isAbsolute3(rel) || rel.startsWith("..")) return void 0;
-  let directory = posix4.endsWith("/");
+  let directory = posix5.endsWith("/");
   if (!directory) {
     try {
       directory = (await stat2(abs)).isDirectory();
@@ -3062,9 +3089,9 @@ async function planRelocation(ctx, request) {
   }
   const orderedPages = () => {
     const all = [...pages.values()];
-    const run = all.filter((p) => !p.beyond).sort((a, b) => compare(a.label, b.label));
+    const run2 = all.filter((p) => !p.beyond).sort((a, b) => compare(a.label, b.label));
     const beyond = all.filter((p) => p.beyond).sort((a, b) => compare(a.label, b.label));
-    return [...run, ...beyond];
+    return [...run2, ...beyond];
   };
   let dirty = new Set(pages.values());
   while (dirty.size > 0) {
@@ -3126,20 +3153,20 @@ async function planRelocation(ctx, request) {
     for (const [path, { file, outs, ins }] of files) {
       if (!m.created && outs.length === 0 && ins.length === 0) continue;
       const disk = m.created ? null : await readManifestText(path, file, m.perPage);
-      let text = disk ?? "";
-      const before = text;
+      let text2 = disk ?? "";
+      const before = text2;
       const where = { join: m.join, file };
       for (const o of outs) {
-        if (!o.drop) text = spliceManifestValue(text, { ...where, entry: o.entry, key: o.key, value: o.value }).text;
+        if (!o.drop) text2 = spliceManifestValue(text2, { ...where, entry: o.entry, key: o.key, value: o.value }).text;
       }
-      for (const i of ins) text = removeManifestKey(text, { ...where, entry: i.entry, key: i.key }).text;
-      const found = keyLines2(text, m.join);
+      for (const i of ins) text2 = removeManifestKey(text2, { ...where, entry: i.entry, key: i.key }).text;
+      const found = keyLines2(text2, m.join);
       for (const o of outs) {
         const line = found.get(entryId(o.entry, m.join))?.get(o.key);
         if (line !== void 0) lines.set(lineId(o.page, file, o.key), line);
       }
-      if (m.created || text !== before) {
-        writes.push({ path, text, kind: "manifest", before: disk });
+      if (m.created || text2 !== before) {
+        writes.push({ path, text: text2, kind: "manifest", before: disk });
       }
     }
   }
@@ -3153,9 +3180,9 @@ async function planRelocation(ctx, request) {
         `${ctx.configFile.source} is a single-tool config file, which cannot hold collections:. Move its keys under meta: in ${FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"}.`
       );
     }
-    const text = editConfig(target.text, model, configSource(target.path, ctx.cwd));
-    verifyConfig(target.text, text, finalCollections, configSource(target.path, ctx.cwd));
-    writes.push({ path: target.path, text, kind: "config", before: target.disk });
+    const text2 = editConfig(target.text, model, configSource(target.path, ctx.cwd));
+    verifyConfig(target.text, text2, finalCollections, configSource(target.path, ctx.cwd));
+    writes.push({ path: target.path, text: text2, kind: "config", before: target.disk });
     configCreated = target.text === null;
   }
   for (const page of orderedPages()) {
@@ -3270,12 +3297,12 @@ async function readManifestText(path, file, perPage) {
     throw new DocmetaError(`Manifest ${file} could not be read: ${errorMessage(err)}`);
   }
 }
-var entryId = (entry, join4) => join4 === PATH_JOIN ? toPosix(entry).replace(/^\.\//, "").replace(/\/+/g, "/") : entry;
+var entryId = (entry, join5) => join5 === PATH_JOIN ? toPosix(entry).replace(/^\.\//, "").replace(/\/+/g, "/") : entry;
 var lineId = (page, manifest, key) => `${page}\0${manifest}\0${key}`;
-function keyLines2(text, join4) {
+function keyLines2(text2, join5) {
   const out = /* @__PURE__ */ new Map();
   const lc = new LineCounter3();
-  const doc = parseDocument4(text, { lineCounter: lc, uniqueKeys: false });
+  const doc = parseDocument4(text2, { lineCounter: lc, uniqueKeys: false });
   const root = doc.contents;
   if (!isMap4(root)) return out;
   for (const pair of root.items) {
@@ -3287,15 +3314,15 @@ function keyLines2(text, join4) {
       const range = isNode3(kv.key) ? kv.key.range : void 0;
       if (range) keys.set(name, lc.linePos(range[0]).line);
     }
-    out.set(entryId(spelled, join4), keys);
+    out.set(entryId(spelled, join5), keys);
   }
   return out;
 }
 async function configTarget(ctx, configDir) {
   if (ctx.configPath !== void 0) {
     try {
-      const text = await readFile4(ctx.configPath, "utf8");
-      return { path: ctx.configPath, text, disk: text };
+      const text2 = await readFile4(ctx.configPath, "utf8");
+      return { path: ctx.configPath, text: text2, disk: text2 };
     } catch (err) {
       if (err.code !== "ENOENT") {
         throw new DocmetaError(
@@ -3308,15 +3335,15 @@ async function configTarget(ctx, configDir) {
   for (const name of FAMILY_CONFIG_NAMES) {
     const path = join3(configDir, name);
     try {
-      const text = await readFile4(path, "utf8");
-      return { path, text, disk: text };
+      const text2 = await readFile4(path, "utf8");
+      return { path, text: text2, disk: text2 };
     } catch {
     }
   }
   return { path: join3(configDir, FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"), text: null, disk: null };
 }
-function editConfig(text, model, source) {
-  const doc = parseDocument4(text ?? "");
+function editConfig(text2, model, source) {
+  const doc = parseDocument4(text2 ?? "");
   const [problem] = doc.errors;
   if (problem !== void 0) throw new DocmetaError(`${source}: invalid YAML: ${problem.message}`);
   if (doc.contents !== null && !isMap4(doc.contents)) {
@@ -3488,7 +3515,7 @@ function buildResult(input) {
   };
 }
 async function applyRelocation(ctx, plan, io = {}) {
-  const write = io.write ?? ((path, text) => writeFileAtomic(path, text, { createParents: true }));
+  const write = io.write ?? ((path, text2) => writeFileAtomic(path, text2, { createParents: true }));
   const remove = io.remove ?? ((path) => unlink(path));
   const label = (w) => w.kind === "config" ? configSource(w.path, ctx.cwd) : reported2(w.path, ctx.base);
   for (const w of plan.writes) {
@@ -3660,6 +3687,12 @@ function relocationOffers(plan) {
   return plan.offers;
 }
 
+// src/meta/commands/validate.ts
+import { resolve as resolve7, extname as extname3 } from "node:path";
+
+// src/meta/core/derive/provenance.ts
+import picomatch2 from "picomatch";
+
 // src/shared/pin.ts
 var LineRangeError = class extends ToolError {
   constructor(message) {
@@ -3667,12 +3700,12 @@ var LineRangeError = class extends ToolError {
     this.name = "LineRangeError";
   }
 };
-function normalizeText(text) {
-  const body = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+function normalizeText(text2) {
+  const body = text2.charCodeAt(0) === 65279 ? text2.slice(1) : text2;
   return body.replace(/\r\n/g, "\n");
 }
-function splitLines(text) {
-  const parts = normalizeText(text).split("\n");
+function splitLines(text2) {
+  const parts = normalizeText(text2).split("\n");
   if (parts.length > 0 && parts[parts.length - 1] === "") parts.pop();
   return parts;
 }
@@ -3689,8 +3722,8 @@ function sliceLines(lines, range, label) {
   }
   return lines.slice(start - 1, end).join("\n");
 }
-function hashRange(text, range, key) {
-  return hashLines(sliceLines(splitLines(text), range), key);
+function hashRange(text2, range, key) {
+  return hashLines(sliceLines(splitLines(text2), range), key);
 }
 function hashLines(joined, key) {
   return key === void 0 ? integrityOf(Buffer.from(joined, "utf8")) : keyedPin(joined, key);
@@ -3737,14 +3770,14 @@ function findWindows(lines, length, pin, key, opts) {
   for (let start = bandEnd + 1; start <= lastStart; start++) order.push(start);
   let spent = 0;
   for (const start of order) {
-    const text = joined(start);
-    const bytes = Buffer.byteLength(text, "utf8");
+    const text2 = joined(start);
+    const bytes = Buffer.byteLength(text2, "utf8");
     if (spent + bytes > budget) {
       if (counter !== void 0) counter.left = budget - spent;
       return { starts, truncated: true };
     }
     spent += bytes;
-    if (hashLines(text, key) === pin) starts.push(start);
+    if (hashLines(text2, key) === pin) starts.push(start);
   }
   if (counter !== void 0) counter.left = budget - spent;
   return { starts, truncated: false };
@@ -3775,9 +3808,9 @@ function toBodyLines(lines, bodyLine) {
   return { start: lines.start - bodyLine + 1, end: lines.end - bodyLine + 1 };
 }
 function splitPageArgument(arg) {
-  const text = arg.startsWith(STDIN_LINES_MARKER) ? `-${arg.slice(STDIN_LINES_MARKER.length)}` : arg;
-  const m = /:([1-9][0-9]*)(?:-([1-9][0-9]*))?$/.exec(text);
-  const head = m === null ? text : text.slice(0, m.index);
+  const text2 = arg.startsWith(STDIN_LINES_MARKER) ? `-${arg.slice(STDIN_LINES_MARKER.length)}` : arg;
+  const m = /:([1-9][0-9]*)(?:-([1-9][0-9]*))?$/.exec(text2);
+  const head = m === null ? text2 : text2.slice(0, m.index);
   if (m === null || head === "") return { page: arg };
   const start = Number(m[1]);
   const end = m[2] === void 0 ? start : Number(m[2]);
@@ -3788,7 +3821,6 @@ function splitPageArgument(arg) {
 }
 
 // src/meta/core/derive/provenance.ts
-import picomatch2 from "picomatch";
 var ZERO_SHA = "0000000000000000000000000000000000000000";
 var DEFAULT_MACHINES = ["*[bot]"];
 var PROVENANCE_POINTER = "/provenance";
@@ -3843,8 +3875,8 @@ function readProvenancePage(content, opts) {
 }
 var HEADER = /^([0-9a-f]{40}(?:[0-9a-f]{24})?) ([1-9][0-9]*) ([1-9][0-9]*)(?: ([1-9][0-9]*))?$/;
 var ALL_ZERO = /^0+$/;
-function parseLinePorcelain(text) {
-  const rows = text.split("\n");
+function parseLinePorcelain(text2) {
+  const rows = text2.split("\n");
   if (rows.length > 0 && rows[rows.length - 1] === "") rows.pop();
   const out = [];
   let i = 0;
@@ -4267,7 +4299,2940 @@ function attributeRange(input) {
   return { "generated-by": input.generatedBy, lines: lineSpec(span), integrity: pinOf(page.body, span) };
 }
 
+// src/meta/core/derive/config.ts
+var DEFAULT_COMMAND_TIMEOUT_MS = 6e4;
+function commandsOf(config) {
+  if (config?.commands === void 0) return void 0;
+  const out = {};
+  for (const [field, c] of Object.entries(config.commands)) {
+    out[field] = {
+      run: c.run,
+      timeoutMs: c.timeout === void 0 ? DEFAULT_COMMAND_TIMEOUT_MS : Math.round(c.timeout * 1e3)
+    };
+  }
+  return out;
+}
+function machinesOf(config) {
+  return config?.machines ?? DEFAULT_MACHINES;
+}
+
+// src/meta/core/derive/index.ts
+import { dirname as dirname5, resolve as resolve5 } from "node:path";
+
+// src/meta/core/derive/cache.ts
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join as join4 } from "node:path";
+var REVIEW_CACHE_DIR = ".manni/meta/review-cache";
+var REVIEW_CACHE_VERSION = 1;
+var ReviewCache = class {
+  constructor(dir, enabled) {
+    this.dir = dir;
+    this.enabled = enabled;
+  }
+  dir;
+  enabled;
+  entryPath(key) {
+    const digest = createHash("sha256").update(key).digest("hex");
+    return join4(this.dir, `${digest}.json`);
+  }
+  /** The cached change, or `undefined` for a miss. Never `null`: nulls are not stored. */
+  get(key) {
+    if (!this.enabled) return void 0;
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(this.entryPath(key), "utf8"));
+    } catch {
+      return void 0;
+    }
+    if (!isRecord4(raw)) return void 0;
+    if (raw.version !== REVIEW_CACHE_VERSION || raw.key !== key) return void 0;
+    const change = readChange(raw.change);
+    return change ?? void 0;
+  }
+  set(key, value) {
+    if (!this.enabled) return;
+    const entry = { version: REVIEW_CACHE_VERSION, key, change: value };
+    const path = this.entryPath(key);
+    const tmp = `${path}.${process.pid}-${Math.random().toString(36).slice(2, 8)}.tmp`;
+    try {
+      mkdirSync(this.dir, { recursive: true });
+      writeFileSync(tmp, `${JSON.stringify(entry, null, 2)}
+`, "utf8");
+      renameSync(tmp, path);
+    } catch {
+      try {
+        rmSync(tmp, { force: true });
+      } catch {
+      }
+    }
+  }
+};
+function cachedClient(client, cache, identity) {
+  return {
+    detect: () => client.detect(),
+    status: () => client.status(),
+    async mergedChangeFor(sha) {
+      if (identity === null) return client.mergedChangeFor(sha);
+      const key = `${identity.host}/${identity.project}/${sha}`;
+      const hit = cache.get(key);
+      if (hit !== void 0) return hit;
+      const change = await client.mergedChangeFor(sha);
+      if (change !== null) cache.set(key, change);
+      return change;
+    }
+  };
+}
+function isRecord4(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function readChange(v) {
+  if (!isRecord4(v)) return null;
+  const { id, mergedAt, approvals } = v;
+  if (typeof id !== "number" || typeof mergedAt !== "string") return null;
+  if (!Array.isArray(approvals)) return null;
+  const read = [];
+  for (const a of approvals) {
+    if (!isRecord4(a)) return null;
+    if (typeof a.login !== "string" || typeof a.submittedAt !== "string") return null;
+    read.push({ login: a.login, submittedAt: a.submittedAt });
+  }
+  return { id, mergedAt, approvals: read };
+}
+
+// src/meta/core/derive/codeowners.ts
+import { existsSync } from "node:fs";
+import { readFile as readFile5 } from "node:fs/promises";
+import { dirname as dirname3, relative as relative5, resolve as resolve4, sep as sep4 } from "node:path";
+import picomatch3 from "picomatch";
+var CODEOWNERS_LOCATIONS = [
+  ".github/CODEOWNERS",
+  "CODEOWNERS",
+  "docs/CODEOWNERS",
+  ".gitlab/CODEOWNERS"
+];
+function findCodeowners(root, explicit) {
+  if (explicit !== void 0) {
+    const path = resolve4(root, explicit);
+    return existsSync(path) ? path : null;
+  }
+  for (const loc of CODEOWNERS_LOCATIONS) {
+    const path = resolve4(root, ...loc.split("/"));
+    if (existsSync(path)) return path;
+  }
+  return null;
+}
+var SECTION_HEADER = /^(\^?)\[([^\]]+)\](?:\[(\d+)\])?(.*)$/;
+var TOKEN = /(?:\\.|[^\s\\])+/g;
+function parseCodeowners(text2, path, label) {
+  const rules = [];
+  const sections = [];
+  let current;
+  const lines = text2.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const raw = lines[i] ?? "";
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[") || line.startsWith("^[")) {
+      const m = SECTION_HEADER.exec(line);
+      if (!m) continue;
+      const [, caret, rawName, approvals, rest] = m;
+      const name = (rawName ?? "").trim();
+      if (name === "") continue;
+      const owners2 = tokens(rest ?? "");
+      const existing = sections.find(
+        (s) => s.name.toLowerCase() === name.toLowerCase()
+      );
+      if (existing) {
+        if (owners2.length > 0) existing.defaultOwners = owners2;
+        current = existing;
+        continue;
+      }
+      const section = {
+        name,
+        optional: caret === "^",
+        ...approvals !== void 0 ? { approvals: Number(approvals) } : {},
+        defaultOwners: owners2
+      };
+      sections.push(section);
+      current = section;
+      continue;
+    }
+    const [first, ...owners] = tokens(line);
+    if (first === void 0) continue;
+    const pattern = unescapePattern(first);
+    if (pattern === "" || pattern === "/") continue;
+    rules.push({
+      pattern,
+      owners,
+      line: i + 1,
+      ...current ? { section: current.name } : {}
+    });
+  }
+  return { path, label, rules, sections };
+}
+function tokens(s) {
+  return s.match(TOKEN) ?? [];
+}
+function unescapePattern(token) {
+  return token.replace(/\\ /g, " ").replace(/^\\#/, "#");
+}
+function ownersFor(file, relPath) {
+  const matchers = matchersFor(file);
+  const defaults = new Map(file.sections.map((s) => [s.name, s.defaultOwners]));
+  const order = [void 0, ...file.sections.map((s) => s.name)];
+  const winners = /* @__PURE__ */ new Map();
+  file.rules.forEach((rule, i) => {
+    if (matchers[i]?.(relPath)) winners.set(rule.section, rule);
+  });
+  if (winners.size === 0) return null;
+  const owners = [];
+  let line = 0;
+  let lineFromOwner = false;
+  for (const section of order) {
+    const rule = winners.get(section);
+    if (!rule) continue;
+    const chosen = rule.owners.length > 0 ? rule.owners : (section === void 0 ? void 0 : defaults.get(section)) ?? [];
+    if (chosen.length > 0) {
+      line = rule.line;
+      lineFromOwner = true;
+    } else if (!lineFromOwner) {
+      line = rule.line;
+    }
+    for (const o of chosen) if (!owners.includes(o)) owners.push(o);
+  }
+  return { owners, line };
+}
+var matcherCache = /* @__PURE__ */ new WeakMap();
+function matchersFor(file) {
+  let matchers = matcherCache.get(file);
+  if (!matchers) {
+    matchers = file.rules.map((r) => picomatch3(toGlobs(r.pattern), PICOMATCH));
+    matcherCache.set(file, matchers);
+  }
+  return matchers;
+}
+var PICOMATCH = { dot: true, windows: false };
+function toGlobs(pattern) {
+  let p = pattern;
+  const dirOnly = p.endsWith("/");
+  if (dirOnly) p = p.slice(0, -1);
+  let anchored = false;
+  if (p.startsWith("/")) {
+    anchored = true;
+    p = p.slice(1);
+  } else if (p.includes("/") && !p.startsWith("**/")) {
+    anchored = true;
+  }
+  const base = anchored || p.startsWith("**/") ? p : `**/${p}`;
+  if (dirOnly) return [`${base}/**`];
+  const last = p.slice(p.lastIndexOf("/") + 1);
+  return /[*?[]/.test(last) ? [base] : [base, `${base}/**`];
+}
+var NOT_FOUND_REASON = `no CODEOWNERS file found (looked for ${CODEOWNERS_LOCATIONS.join(", ")})`;
+async function deriveFromCodeowners(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const explicitPath = opts.explicit === void 0 ? void 0 : resolve4(opts.configDir ?? process.cwd(), opts.explicit);
+  if (explicitPath !== void 0 && !existsSync(explicitPath)) {
+    return {
+      status: { available: false, reason: `CODEOWNERS not found at ${explicitPath}` },
+      records
+    };
+  }
+  const byRoot = /* @__PURE__ */ new Map();
+  const rootCache = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const dir = dirname3(input.absPath);
+    let root = rootCache.get(dir);
+    if (root === void 0) {
+      root = opts.rootOf(input.absPath);
+      rootCache.set(dir, root);
+    }
+    if (root === null) continue;
+    const bucket = byRoot.get(root);
+    if (bucket) bucket.push(input);
+    else byRoot.set(root, [input]);
+  }
+  let found = 0;
+  const parsed = /* @__PURE__ */ new Map();
+  for (const [root, bucket] of byRoot) {
+    const path = explicitPath ?? findCodeowners(root);
+    if (path === null) {
+      for (const input of bucket) records.set(input.label, null);
+      continue;
+    }
+    found += 1;
+    const label = toPosix2(relative5(opts.configDir ?? root, path));
+    const key = `${path}\0${label}`;
+    let file = parsed.get(key);
+    if (!file) {
+      file = readFile5(path, "utf8").then(
+        (text2) => parseCodeowners(text2, path, label)
+      );
+      parsed.set(key, file);
+    }
+    let owners;
+    try {
+      owners = await file;
+    } catch (err) {
+      return {
+        status: {
+          available: false,
+          reason: `CODEOWNERS at ${label} could not be read: ${errorMessage(err)}`
+        },
+        records
+      };
+    }
+    for (const input of bucket) {
+      const rel = toPosix2(relative5(root, input.absPath));
+      const hit = ownersFor(owners, rel);
+      records.set(
+        input.label,
+        hit === null ? null : {
+          value: hit.owners,
+          source: "codeowners",
+          evidence: `${label}:${hit.line}`
+        }
+      );
+    }
+  }
+  if (byRoot.size === 0) {
+    return {
+      status: { available: false, reason: "no git repository contains the documents" },
+      records
+    };
+  }
+  if (found === 0 && explicitPath === void 0) {
+    return { status: { available: true, reason: NOT_FOUND_REASON }, records };
+  }
+  return { status: { available: true }, records };
+}
+function toPosix2(p) {
+  return p.split(sep4).join("/");
+}
+
+// src/meta/core/derive/spawn.ts
+import { spawn } from "node:child_process";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+var BinMissing = class extends Error {
+};
+function run(bin, args, opts) {
+  return new Promise((settle2, reject) => {
+    let done = false;
+    const finish = (r) => {
+      if (done) return;
+      done = true;
+      settle2(r);
+    };
+    const fail = (err) => {
+      if (done) return;
+      done = true;
+      reject(err);
+    };
+    let child;
+    try {
+      child = spawn(bin, [...opts.prefixArgs ?? [], ...args], {
+        cwd: opts.cwd,
+        windowsHide: true
+      });
+    } catch (err) {
+      fail(err instanceof Error ? err : new Error(String(err)));
+      return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let tooLarge = false;
+    const stop = (r) => {
+      clearTimeout(timer);
+      child.kill();
+      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
+      finish({ code: null, ...r });
+    };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+      if (stdout.length > MAX_OUTPUT_BYTES) {
+        tooLarge = true;
+        stop({ stdout, stderr, timedOut, tooLarge });
+      }
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+      if (stderr.length > MAX_OUTPUT_BYTES) {
+        tooLarge = true;
+        stop({ stdout, stderr, timedOut, tooLarge });
+      }
+    });
+    child.stdin.end();
+    const timer = setTimeout(() => {
+      timedOut = true;
+      stop({ stdout, stderr, timedOut, tooLarge });
+    }, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      fail(err.code === "ENOENT" ? new BinMissing(err.message) : err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({ code, stdout, stderr, timedOut, tooLarge });
+    });
+  });
+}
+function commandLine(bin, args) {
+  return [bin, ...args].join(" ");
+}
+function lastLine(text2) {
+  const lines = text2.split(/\r?\n/).filter((l) => l.trim() !== "");
+  return lines.at(-1) ?? "";
+}
+
+// src/meta/core/derive/command.ts
+var PATH_PLACEHOLDER = "{path}";
+function isPerFile(command) {
+  return command.run.some((arg) => arg.includes(PATH_PLACEHOLDER));
+}
+function argvFor(command, label) {
+  return command.run.map((arg) => arg.split(PATH_PLACEHOLDER).join(label));
+}
+function valueOf(stdout) {
+  const text2 = stdout.trim();
+  if (text2 === "") return null;
+  if (!/^[{["]/.test(text2)) return text2;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+}
+async function deriveFromCommands(inputs, commands, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const fields = Object.keys(commands);
+  if (fields.length === 0 || inputs.length === 0) {
+    return { status: { available: true }, records };
+  }
+  for (const input of inputs) records.set(input.label, {});
+  for (const field of fields) {
+    const command = commands[field];
+    if (command === void 0) continue;
+    if (isPerFile(command)) {
+      for (const [label, record] of records) {
+        const outcome = await runOne(field, argvFor(command, label), command.timeoutMs, opts);
+        if ("reason" in outcome) return unavailable(outcome.reason);
+        record[field] = outcome.value;
+      }
+    } else {
+      const outcome = await runOne(field, command.run, command.timeoutMs, opts);
+      if ("reason" in outcome) return unavailable(outcome.reason);
+      for (const record of records.values()) record[field] = outcome.value;
+    }
+  }
+  return { status: { available: true }, records };
+}
+function unavailable(reason) {
+  return { status: { available: false, reason }, records: /* @__PURE__ */ new Map() };
+}
+async function runOne(field, argv, timeoutMs, opts) {
+  const [program, ...args] = argv;
+  const where = `(derive.commands.${field})`;
+  if (program === void 0) {
+    return { reason: `no program to run ${where}` };
+  }
+  const line = argv.join(" ");
+  let result;
+  try {
+    result = await run(opts.spawn?.bin ?? program, args, {
+      ...opts.spawn,
+      cwd: opts.spawn?.cwd ?? opts.cwd,
+      timeoutMs
+    });
+  } catch (err) {
+    if (err instanceof BinMissing) {
+      return { reason: `\`${program}\` is not on PATH ${where}` };
+    }
+    return { reason: `\`${line}\` could not be run: ${errorMessage(err)} ${where}` };
+  }
+  if (result.timedOut) {
+    return { reason: `\`${line}\` timed out after ${String(timeoutMs / 1e3)}s ${where}` };
+  }
+  if (result.tooLarge) {
+    return {
+      reason: `\`${line}\` wrote more than ${String(MAX_OUTPUT_BYTES / (1024 * 1024))} MiB; a command reports one field's value ${where}`
+    };
+  }
+  if (result.code !== 0) {
+    const last = lastLine(result.stderr);
+    const detail = last === "" ? "no output on stderr" : last;
+    const exit = result.code === null ? "killed by a signal" : `exit ${String(result.code)}`;
+    return { reason: `\`${line}\` failed (${exit}): ${detail} ${where}` };
+  }
+  const value = valueOf(result.stdout);
+  return { value: value === null ? null : { value, source: "command", evidence: line } };
+}
+
+// src/meta/core/derive/reviews.ts
+import { resolve as resolvePath2 } from "node:path";
+function parseOriginUrl(url) {
+  const trimmed = url.trim();
+  if (trimmed === "") return null;
+  if (isLocalPath(trimmed)) return null;
+  const scp = /^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(trimmed);
+  if (scp) {
+    const host = scp[1];
+    const path = scp[2];
+    if (host === void 0 || path === void 0) return null;
+    if (/^[A-Za-z]$/.test(host)) return null;
+    return project(host, path);
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (!/^(https?|ssh|git):$/.test(parsed.protocol)) return null;
+  if (parsed.hostname === "") return null;
+  return project(parsed.hostname, parsed.pathname);
+}
+function isLocalPath(s) {
+  return s.startsWith("/") || s.startsWith("./") || s.startsWith("../") || s.startsWith("\\\\");
+}
+function project(host, path) {
+  const segments2 = path.replace(/\.git$/, "").split("/").filter((s) => s !== "");
+  if (segments2.length < 2) return null;
+  return { host, project: segments2.join("/") };
+}
+function identityFromOrigin(host, project2, requested) {
+  const name = host.toLowerCase();
+  if (name.includes("github")) return { kind: "github", host, project: project2 };
+  if (name.includes("gitlab")) return { kind: "gitlab", host, project: project2 };
+  const only = requested !== void 0 && requested.length === 1 ? requested[0] : void 0;
+  return only === void 0 ? null : { kind: only, host, project: project2 };
+}
+var UnknownHostClient = class {
+  constructor(host) {
+    this.host = host;
+  }
+  host;
+  detect() {
+    return Promise.resolve(null);
+  }
+  status() {
+    return Promise.resolve({
+      available: false,
+      reason: `the origin remote is ${this.host}, which names neither GitHub nor GitLab; list exactly one of github, gitlab in derive.sources to say which it is`
+    });
+  }
+  mergedChangeFor() {
+    return Promise.resolve(null);
+  }
+};
+function httpStatus(stderr) {
+  const m = /\b(?:HTTP\s+(\d{3})|(\d{3})\s+Not\s+Found)\b/i.exec(stderr);
+  const code = m?.[1] ?? m?.[2];
+  return code === void 0 ? null : Number(code);
+}
+function isNotFound(r) {
+  const status = httpStatus(r.stderr);
+  return status === 404 || status === 422;
+}
+var CliClient = class {
+  constructor(identity, spawnOpts) {
+    this.identity = identity;
+    this.spawnOpts = spawnOpts;
+  }
+  identity;
+  spawnOpts;
+  detect() {
+    return Promise.resolve(this.identity);
+  }
+  async status() {
+    if (this.identity === null) {
+      return { available: false, reason: "no origin remote to tell GitHub from GitLab" };
+    }
+    const { host } = this.identity;
+    let r;
+    try {
+      r = await this.run(["auth", "status", "--hostname", host]);
+    } catch (err) {
+      if (err instanceof BinMissing) {
+        return {
+          available: false,
+          reason: `${this.tool} is not on PATH (origin is ${host}); install ${this.tool} and run ${this.tool} auth login`
+        };
+      }
+      throw err;
+    }
+    if (r.timedOut) throw this.timeout(["auth", "status", "--hostname", host]);
+    if (r.code !== 0) {
+      return {
+        available: false,
+        reason: `${this.tool} is not authenticated for ${host}; run ${this.tool} auth login`
+      };
+    }
+    return { available: true };
+  }
+  async mergedChangeFor(sha) {
+    if (this.identity === null) return null;
+    return this.lookup(this.identity, sha);
+  }
+  get bin() {
+    return this.spawnOpts.bin ?? this.tool;
+  }
+  run(args) {
+    return run(this.bin, args, this.spawnOpts);
+  }
+  timeout(args) {
+    const ms = this.spawnOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return new DocmetaError(
+      `${commandLine(this.tool, args)} timed out after ${ms}ms`
+    );
+  }
+  /**
+   * Run a call whose stdout is JSON. A not-found answer is `null`; any other
+   * failure throws, naming the command the user can re-run by hand. The
+   * message quotes the tool's own name rather than `bin`, which under test
+   * is `node`.
+   */
+  async json(args) {
+    let r;
+    try {
+      r = await this.run(args);
+    } catch (err) {
+      if (err instanceof BinMissing) {
+        throw new DocmetaError(
+          `${commandLine(this.tool, args)} failed: ${this.tool} is not on PATH`
+        );
+      }
+      throw err;
+    }
+    const cmd = commandLine(this.tool, args);
+    if (r.timedOut) throw this.timeout(args);
+    if (r.tooLarge) {
+      throw new DocmetaError(`${cmd} wrote more output than manni will read`);
+    }
+    if (r.code !== 0) {
+      if (isNotFound(r)) return null;
+      const detail = lastLine(r.stderr) || lastLine(r.stdout);
+      const exit = r.code === null ? "signal" : `exit ${r.code}`;
+      throw new DocmetaError(
+        `${cmd} failed (${exit})${detail === "" ? "" : `: ${detail}`}`
+      );
+    }
+    try {
+      return JSON.parse(r.stdout);
+    } catch {
+      throw new DocmetaError(`${cmd} did not return JSON`);
+    }
+  }
+};
+function isRecord5(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function items(v) {
+  return Array.isArray(v) ? v.filter(isRecord5) : [];
+}
+function numberOf(v) {
+  return typeof v === "number" && Number.isInteger(v) ? v : null;
+}
+function stringOf(v) {
+  return typeof v === "string" && v !== "" ? v : null;
+}
+function timestampOf(v) {
+  if (v === void 0) return void 0;
+  return stringOf(v);
+}
+function normalizeLogin(login) {
+  return login.replace(/\[bot\]$/, "");
+}
+function latestApprovals(reviews) {
+  const latest = /* @__PURE__ */ new Map();
+  for (const r of reviews) {
+    if (r.state !== "APPROVED") continue;
+    const key = normalizeLogin(r.login);
+    const seen = latest.get(key);
+    if (seen === void 0 || r.submittedAt > seen.submittedAt) {
+      latest.set(key, { login: r.login, submittedAt: r.submittedAt });
+    }
+  }
+  return byTime([...latest.values()]);
+}
+function byTime(approvals) {
+  return [...approvals].sort(
+    (a, b) => a.submittedAt < b.submittedAt ? -1 : a.submittedAt > b.submittedAt ? 1 : 0
+  );
+}
+var GitHubClient = class extends CliClient {
+  tool = "gh";
+  async lookup(identity, sha) {
+    const { host, project: project2 } = identity;
+    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
+    let candidates = items(await api(`repos/${project2}/commits/${sha}/pulls`)).map(
+      (p) => ({ number: numberOf(p.number), mergedAt: timestampOf(p.merged_at) })
+    );
+    if (candidates.length === 0) {
+      const found = await this.json([
+        "pr",
+        "list",
+        "--search",
+        sha,
+        "--state",
+        "merged",
+        "--json",
+        "number,mergedAt",
+        "-R",
+        `${host}/${project2}`
+      ]);
+      candidates = items(found).map((p) => ({
+        number: numberOf(p.number),
+        mergedAt: timestampOf(p.mergedAt)
+      }));
+    }
+    for (const c of candidates) {
+      if (c.number === null) continue;
+      let mergedAt = c.mergedAt;
+      if (mergedAt === void 0) {
+        const pr = await api(`repos/${project2}/pulls/${c.number}`);
+        mergedAt = isRecord5(pr) ? stringOf(pr.merged_at) ?? null : null;
+      }
+      if (mergedAt === null) continue;
+      const raw = [];
+      for (let page = 1; ; page += 1) {
+        const batch = items(
+          await api(`repos/${project2}/pulls/${c.number}/reviews?per_page=100&page=${page}`)
+        );
+        raw.push(...batch);
+        if (batch.length < 100) break;
+      }
+      const reviews = raw.map((r) => ({
+        login: isRecord5(r.user) ? stringOf(r.user.login) : null,
+        state: stringOf(r.state),
+        submittedAt: stringOf(r.submitted_at)
+      })).filter(
+        (r) => r.login !== null && r.state !== null && r.submittedAt !== null
+      );
+      return { id: c.number, mergedAt, approvals: latestApprovals(reviews) };
+    }
+    return null;
+  }
+};
+var GitLabClient = class extends CliClient {
+  tool = "glab";
+  async lookup(identity, sha) {
+    const { host } = identity;
+    const api = (endpoint) => this.json(["api", "--hostname", host, endpoint]);
+    const merged = items(
+      await api(`projects/:fullpath/repository/commits/${sha}/merge_requests`)
+    ).map((mr) => ({ iid: numberOf(mr.iid), mergedAt: stringOf(mr.merged_at) })).find(
+      (mr) => mr.iid !== null && mr.mergedAt !== null
+    );
+    if (merged === void 0) return null;
+    const answer = await api(`projects/:fullpath/merge_requests/${merged.iid}/approvals`);
+    const approvedBy = isRecord5(answer) ? items(answer.approved_by) : [];
+    const approvals = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of approvedBy) {
+      const login = isRecord5(entry.user) ? stringOf(entry.user.username) : null;
+      if (login === null) continue;
+      const key = normalizeLogin(login);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      approvals.push({ login, submittedAt: merged.mergedAt });
+    }
+    return { id: merged.iid, mergedAt: merged.mergedAt, approvals };
+  }
+};
+async function createReviewClient(root, opts) {
+  const spawnOpts = { ...opts.spawn, cwd: opts.spawn?.cwd ?? root };
+  const origin = await originUrl(root);
+  const parsed = origin === null ? null : parseOriginUrl(origin);
+  const identity = parsed === null ? null : identityFromOrigin(parsed.host, parsed.project, opts.requested);
+  if (parsed !== null && identity === null) return new UnknownHostClient(parsed.host);
+  const client = identity?.kind === "gitlab" ? new GitLabClient(identity, spawnOpts) : new GitHubClient(identity, spawnOpts);
+  const cache = new ReviewCache(resolvePath2(root, opts.cacheDir), opts.cache);
+  return cachedClient(client, cache, identity);
+}
+async function originUrl(root) {
+  try {
+    const r = await run("git", ["remote", "get-url", "origin"], { cwd: root });
+    if (r.code !== 0 || r.timedOut || r.tooLarge) return null;
+    return stringOf(r.stdout.trim());
+  } catch {
+    return null;
+  }
+}
+var NOTHING = { "reviewed-by": null, "last-reviewed": null };
+async function deriveFromReviews(inputs, client) {
+  const records = /* @__PURE__ */ new Map();
+  const status = await client.status();
+  if (!status.available) return { status, records };
+  const identity = await client.detect();
+  const kind = identity?.kind ?? "github";
+  const bySha = /* @__PURE__ */ new Map();
+  const changeFor = (sha) => {
+    let pending = bySha.get(sha);
+    if (pending === void 0) {
+      pending = client.mergedChangeFor(sha);
+      bySha.set(sha, pending);
+    }
+    return pending;
+  };
+  for (const input of inputs) {
+    if (input.sha === null) {
+      records.set(input.label, NOTHING);
+      continue;
+    }
+    const change = await changeFor(input.sha);
+    records.set(input.label, factsFrom(change, kind));
+  }
+  return { status, records };
+}
+function factsFrom(change, kind) {
+  if (change === null || change.approvals.length === 0) return NOTHING;
+  const ordered = byTime(change.approvals);
+  const latest = ordered.at(-1);
+  if (latest === void 0) return NOTHING;
+  const evidence = kind === "gitlab" ? `gitlab MR !${change.id}` : `github PR #${change.id}`;
+  const dateEvidence = kind === "gitlab" ? `${evidence} (merge date; GitLab records no approval time)` : evidence;
+  return {
+    "reviewed-by": {
+      value: ordered.map((a) => a.login),
+      source: kind,
+      evidence
+    },
+    "last-reviewed": {
+      value: utcDate(latest.submittedAt),
+      source: kind,
+      evidence: dateEvidence
+    }
+  };
+}
+function utcDate(iso) {
+  const ms = Date.parse(iso);
+  if (Number.isNaN(ms)) return iso;
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+// src/meta/core/derive/git.ts
+import { constants as bufferConstants } from "node:buffer";
+import { spawn as spawn2 } from "node:child_process";
+import { availableParallelism } from "node:os";
+import { dirname as dirname4, extname as extname2, isAbsolute as isAbsolute4, posix as posix4, relative as relative6, sep as sep5 } from "node:path";
+import { parse as parseYaml3 } from "yaml";
+
+// src/shared/concurrency.ts
+async function mapConcurrent(items2, limit, fn) {
+  const out = new Array(items2.length);
+  let next = 0;
+  const workers = Array.from(
+    { length: Math.max(1, Math.min(limit, items2.length)) },
+    async () => {
+      for (; ; ) {
+        const i = next++;
+        const item = items2[i];
+        if (i >= items2.length || item === void 0) return;
+        out[i] = await fn(item);
+      }
+    }
+  );
+  await Promise.all(workers);
+  return out;
+}
+
+// src/meta/core/derive/git.ts
+var DEFAULT_BULK_THRESHOLD = 32;
+var NULL_SHA = "0".repeat(40);
+var MAX_GIT_OUTPUT_BYTES = Math.min(
+  512 * 1024 * 1024,
+  bufferConstants.MAX_STRING_LENGTH
+);
+var HistoryTooLarge = class extends Error {
+};
+var BlobsUnreadable = class extends Error {
+  constructor(detail) {
+    super(detail);
+    this.detail = detail;
+  }
+  detail;
+};
+var BlameUnreadable = class extends Error {
+  constructor(rel, detail) {
+    super(rel);
+    this.rel = rel;
+    this.detail = detail;
+  }
+  rel;
+  detail;
+};
+function bodyOf(content, fenced) {
+  if (fenced !== true) return content;
+  const loc = locateFrontmatter(content);
+  if (!loc) return content;
+  return content.slice(0, loc.openStart) + content.slice(loc.closeEnd);
+}
+async function deriveFromGit(inputs, opts) {
+  const records = /* @__PURE__ */ new Map();
+  const byRoot = groupByRoot(inputs);
+  if (byRoot.size === 0) {
+    return {
+      status: {
+        available: false,
+        reason: "no git repository contains the documents"
+      },
+      records
+    };
+  }
+  const threshold = opts.bulkThreshold ?? DEFAULT_BULK_THRESHOLD;
+  const machines = opts.machines ?? DEFAULT_MACHINES;
+  const wantsProvenance = opts.fields?.includes(PROVENANCE_FIELD) ?? false;
+  const maxBytes = opts.maxOutputBytes ?? MAX_GIT_OUTPUT_BYTES;
+  const parse = yamlOnce();
+  const reasons = [];
+  for (const [root, bucket] of byRoot) {
+    const run2 = (args, stdin) => runGit(args, root, stdin, maxBytes);
+    const shallow = await run2(["rev-parse", "--is-shallow-repository"]);
+    if (shallow.missing) {
+      return {
+        status: { available: false, reason: "git is not on PATH" },
+        records: /* @__PURE__ */ new Map()
+      };
+    }
+    if (shallow.code !== 0) {
+      reasons.push(`git could not read the repository at ${root}`);
+      continue;
+    }
+    if (text(shallow).trim() === "true") {
+      reasons.push(
+        `this checkout is shallow; use actions/checkout with fetch-depth: 0 (${root})`
+      );
+      continue;
+    }
+    try {
+      const found = await histories(
+        run2,
+        bucket.map((e) => e.rel),
+        threshold
+      );
+      if (found === null) {
+        reasons.push(`git could not read the history at ${root}`);
+        continue;
+      }
+      await readOtherParentBlobs(run2, found);
+      const blobs = await fetchBlobs(run2, neededBlobs(found));
+      if (!await followTakenBodies(run2, bucket, found, blobs, threshold)) {
+        reasons.push(`git could not read the history at ${root}`);
+        continue;
+      }
+      const manifestStamps = await stampsInManifests(run2, root, bucket, found, blobs, parse);
+      const facts = bucket.map(
+        (entry) => judge(
+          entry.input,
+          root,
+          found.get(entry.rel) ?? [],
+          blobs,
+          opts.now,
+          machines,
+          manifestStamps.get(entry.input.label)
+        )
+      );
+      if (wantsProvenance) {
+        const pages = await mapConcurrent(bucket, GIT_CONCURRENCY, async (entry) => ({
+          entry,
+          blame: await blameOf(run2, entry.rel, entry.input.content),
+          history: found.get(entry.rel) ?? []
+        }));
+        const evidence = await commitEvidence(run2, root, pages, blobs, parse);
+        const provenanceRun = {
+          machines,
+          ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
+        };
+        pages.forEach((page, i) => {
+          const judged = facts[i];
+          const commits = evidence[i];
+          if (judged === void 0 || commits === void 0) return;
+          const derived = provenanceFor(page.entry, page.blame, commits, provenanceRun);
+          judged.provenance = derived.value;
+          judged.provenanceDerivation = derived.derivation;
+        });
+      }
+      bucket.forEach((entry, i) => {
+        const judged = facts[i];
+        if (judged !== void 0) records.set(entry.input.label, judged);
+      });
+    } catch (err) {
+      if (err instanceof BlobsUnreadable) {
+        reasons.push(`git cat-file could not read the history (${root}): ${err.detail}`);
+        continue;
+      }
+      if (err instanceof BlameUnreadable) {
+        const why = err.detail === "" ? "" : `: ${err.detail}`;
+        reasons.push(`git blame could not read ${err.rel} (${root})${why}`);
+        continue;
+      }
+      if (!(err instanceof HistoryTooLarge)) throw err;
+      reasons.push(`git history is too large to read in one pass (${root})`);
+      continue;
+    }
+  }
+  if (reasons.length > 0) {
+    return {
+      status: { available: false, reason: reasons.join("; ") },
+      records: /* @__PURE__ */ new Map()
+    };
+  }
+  return { status: { available: true }, records };
+}
+function groupByRoot(inputs) {
+  const rootOf = /* @__PURE__ */ new Map();
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const dir = dirname4(input.absPath);
+    let root = rootOf.get(dir);
+    if (root === void 0) {
+      root = findGitRoot(dir);
+      rootOf.set(dir, root);
+    }
+    if (root === null) continue;
+    const rel = relative6(root, input.absPath).split(sep5).join("/");
+    const bucket = byRoot.get(root);
+    if (bucket) bucket.push({ input, rel });
+    else byRoot.set(root, [{ input, rel }]);
+  }
+  return byRoot;
+}
+var RECORD_FORMAT = "--format=%x1e%H%x00%aI%x00%an%x00%ae%x00%(trailers:key=Co-authored-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Reviewed-by,valueonly,unfold,separator=%x1f)%x00%(trailers:key=Generated-by,valueonly,unfold,separator=%x1f)%x00%P";
+var LOG_ARGS = [
+  "-c",
+  "core.quotePath=false",
+  "log",
+  "--raw",
+  "--diff-merges=first-parent",
+  "-M",
+  "--no-abbrev",
+  RECORD_FORMAT
+];
+function histories(run2, rels, threshold, rev = "HEAD") {
+  return rels.length <= threshold ? perFileHistories(run2, rels, rev) : bulkHistories(run2, rels, rev);
+}
+async function perFileHistories(run2, rels, rev) {
+  const found = /* @__PURE__ */ new Map();
+  for (const rel of rels) {
+    const out = await run2([...LOG_ARGS, rev, "--follow", "--", pathspec(rel)]);
+    if (out.tooLarge) throw new HistoryTooLarge();
+    if (out.code !== 0) {
+      if (await isUnbornHead(run2)) return found;
+      return null;
+    }
+    const attributed = attribute(parseLog(text(out)), [rel]);
+    found.set(rel, attributed.get(rel) ?? []);
+  }
+  return found;
+}
+async function bulkHistories(run2, rels, rev) {
+  const out = await run2([...LOG_ARGS, rev]);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) {
+    if (await isUnbornHead(run2)) return /* @__PURE__ */ new Map();
+    return null;
+  }
+  return attribute(parseLog(text(out)), [...rels]);
+}
+async function followTakenBodies(run2, bucket, found, blobs, threshold) {
+  for (; ; ) {
+    const byParent = /* @__PURE__ */ new Map();
+    for (const entry of bucket) {
+      const history = found.get(entry.rel) ?? [];
+      const taken = takenMerge(entry.input.extracted.fenced, history, blobs);
+      if (taken === void 0) continue;
+      const group = byParent.get(taken.parent) ?? [];
+      group.push({ rel: entry.rel, keep: history.slice(0, taken.index), path: taken.path });
+      byParent.set(taken.parent, group);
+    }
+    if (byParent.size === 0) return true;
+    const walked = /* @__PURE__ */ new Map();
+    for (const [parent, group] of byParent) {
+      const paths = [...new Set(group.map((g) => g.path))];
+      const side = await histories(run2, paths, threshold, parent);
+      if (side === null) return false;
+      for (const g of group) {
+        const tail = side.get(g.path) ?? [];
+        walked.set(g.rel, tail);
+        found.set(g.rel, [...g.keep, ...tail]);
+      }
+    }
+    await readOtherParentBlobs(run2, walked);
+    const missing = new Set([...neededBlobs(walked)].filter((sha) => !blobs.has(sha)));
+    for (const [sha, content] of await fetchBlobs(run2, missing)) blobs.set(sha, content);
+  }
+}
+function takenMerge(fenced, history, blobs) {
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const index = history.findIndex((h) => !sameBody(blobBody(h.newBlob), blobBody(h.oldBlob)));
+  const newest = history[index];
+  if (newest === void 0) return void 0;
+  const body = blobBody(newest.newBlob);
+  const k = newest.otherParentBlobs.findIndex((b) => b !== null && sameBody(body, blobBody(b)));
+  const parent = newest.otherParents[k];
+  if (k === -1 || parent === void 0) return void 0;
+  return { index, parent, path: newest.pathAtCommit };
+}
+function pathspec(rel) {
+  return /[*?[\]]/.test(rel) ? `:(literal)${rel}` : rel;
+}
+async function isUnbornHead(run2) {
+  const out = await run2(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
+  return !out.missing && out.code !== 0;
+}
+function parseLog(text2) {
+  const records = [];
+  for (const chunk of text2.split("")) {
+    if (chunk === "") continue;
+    const nl = chunk.indexOf("\n");
+    const header = nl === -1 ? chunk : chunk.slice(0, nl);
+    const fields = header.split("\0");
+    const sha = fields[0];
+    if (sha === void 0 || sha === "") continue;
+    const raw = [];
+    if (nl !== -1) {
+      for (const line of chunk.slice(nl + 1).split("\n")) {
+        const entry = parseRawLine(line);
+        if (entry) raw.push(entry);
+      }
+    }
+    records.push({
+      sha,
+      authorDate: fields[1] ?? "",
+      authorName: fields[2] ?? "",
+      authorEmail: fields[3] ?? "",
+      coAuthors: splitTrailers(fields[4]),
+      reviewedBy: splitTrailers(fields[5]),
+      generatedBy: splitTrailers(fields[6]),
+      parents: (fields[7] ?? "").trim().split(" ").filter((p) => p !== ""),
+      raw
+    });
+  }
+  return records;
+}
+function splitTrailers(field) {
+  if (field === void 0 || field === "") return [];
+  return field.split("").map((s) => s.trim()).filter((s) => s !== "");
+}
+function parseRawLine(line) {
+  if (!line.startsWith(":")) return null;
+  const tab = line.indexOf("	");
+  if (tab === -1) return null;
+  const meta = line.slice(1, tab).split(" ");
+  const oldBlob = meta[2];
+  const newBlob = meta[3];
+  const status = meta[4];
+  if (oldBlob === void 0 || newBlob === void 0 || status === void 0) {
+    return null;
+  }
+  const paths = line.slice(tab + 1).split("	").map(unquotePath);
+  const first = paths[0];
+  if (first === void 0) return null;
+  const second = paths[1];
+  const renamed = status.startsWith("R") || status.startsWith("C");
+  return {
+    status,
+    oldBlob,
+    newBlob,
+    oldPath: first,
+    newPath: renamed && second !== void 0 ? second : first
+  };
+}
+function unquotePath(p) {
+  if (p.length < 2 || !p.startsWith('"') || !p.endsWith('"')) return p;
+  const inner = p.slice(1, -1);
+  const bytes = [];
+  for (let i = 0; i < inner.length; i += 1) {
+    const ch = inner[i];
+    if (ch !== "\\") {
+      bytes.push(...Buffer.from(ch ?? "", "utf8"));
+      continue;
+    }
+    const next = inner[i + 1];
+    if (next === void 0) break;
+    const octal = /^[0-7]{3}/.exec(inner.slice(i + 1));
+    if (octal) {
+      bytes.push(parseInt(octal[0], 8));
+      i += 3;
+      continue;
+    }
+    const simple = {
+      a: 7,
+      b: 8,
+      t: 9,
+      n: 10,
+      v: 11,
+      f: 12,
+      r: 13,
+      '"': 34,
+      "\\": 92
+    };
+    const code = simple[next];
+    if (code === void 0) bytes.push(...Buffer.from(next, "utf8"));
+    else bytes.push(code);
+    i += 1;
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function attribute(records, wanted) {
+  const histories2 = /* @__PURE__ */ new Map();
+  const tracked = /* @__PURE__ */ new Map();
+  for (const rel of wanted) {
+    histories2.set(rel, []);
+    tracked.set(rel, rel);
+  }
+  for (const record of records) {
+    if (record.raw.length === 0) continue;
+    const byNewPath = /* @__PURE__ */ new Map();
+    for (const entry of record.raw) byNewPath.set(entry.newPath, entry);
+    for (const [rel, current] of tracked) {
+      const entry = byNewPath.get(current);
+      if (!entry) continue;
+      histories2.get(rel)?.push({
+        sha: record.sha,
+        authorDate: record.authorDate,
+        authorName: record.authorName,
+        authorEmail: record.authorEmail,
+        coAuthors: record.coAuthors,
+        reviewedBy: record.reviewedBy,
+        generatedBy: record.generatedBy,
+        oldBlob: entry.oldBlob === NULL_SHA ? null : entry.oldBlob,
+        newBlob: entry.newBlob === NULL_SHA ? null : entry.newBlob,
+        pathAtCommit: entry.newPath,
+        otherParents: record.parents.slice(1),
+        otherParentBlobs: []
+      });
+      if (entry.oldPath !== entry.newPath) tracked.set(rel, entry.oldPath);
+    }
+  }
+  return histories2;
+}
+function neededBlobs(histories2) {
+  const shas = /* @__PURE__ */ new Set();
+  for (const history of histories2.values()) {
+    for (const h of history) {
+      if (h.oldBlob !== null) shas.add(h.oldBlob);
+      if (h.newBlob !== null) shas.add(h.newBlob);
+      for (const b of h.otherParentBlobs) if (b !== null) shas.add(b);
+    }
+  }
+  return shas;
+}
+async function readOtherParentBlobs(run2, histories2) {
+  const merges = [];
+  const specs = [];
+  for (const history of histories2.values()) {
+    for (const h of history) {
+      if (h.otherParents.length === 0) continue;
+      merges.push(h);
+      for (const parent of h.otherParents) specs.push(`${parent}:${h.pathAtCommit}`);
+    }
+  }
+  if (specs.length === 0) return;
+  const out = await run2(["cat-file", "--batch-check"], `${specs.join("\n")}
+`);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  const lines = text(out).split("\n");
+  let i = 0;
+  for (const h of merges) {
+    h.otherParentBlobs = h.otherParents.map(() => blobOfCheckLine(lines[i++]));
+  }
+}
+function blobOfCheckLine(line) {
+  const [sha, kind] = (line ?? "").split(" ");
+  if (sha === void 0 || kind !== "blob" || !/^[0-9a-f]{40,64}$/.test(sha)) return null;
+  return sha;
+}
+async function fetchBlobs(run2, shas) {
+  const blobs = /* @__PURE__ */ new Map();
+  if (shas.size === 0) return blobs;
+  const out = await run2(["cat-file", "--batch"], `${[...shas].join("\n")}
+`);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  const buf = out.raw;
+  let cursor = 0;
+  while (cursor < buf.length) {
+    const nl = buf.indexOf(10, cursor);
+    if (nl === -1) break;
+    const header = buf.toString("utf8", cursor, nl).split(" ");
+    cursor = nl + 1;
+    const sha = header[0];
+    const kind = header[1];
+    const size = Number(header[2]);
+    if (sha === void 0 || kind !== "blob" || !Number.isFinite(size)) {
+      continue;
+    }
+    blobs.set(sha, buf.toString("utf8", cursor, cursor + size));
+    cursor += size + 1;
+  }
+  return blobs;
+}
+var git = (value, evidence) => ({
+  value,
+  source: "git",
+  evidence
+});
+function factCommits(input, history, blobs) {
+  const fenced = input.extracted.fenced;
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const bodyChanging = [...history].reverse().filter((h) => {
+    const body = blobBody(h.newBlob);
+    if (sameBody(body, blobBody(h.oldBlob))) return false;
+    return !h.otherParentBlobs.some((b) => b !== null && sameBody(body, blobBody(b)));
+  });
+  return {
+    bodyChanging,
+    oldest: history[history.length - 1],
+    newestBody: bodyChanging[bodyChanging.length - 1]
+  };
+}
+async function stampsInManifests(run2, root, bucket, histories2, blobs, parse) {
+  const reads = [];
+  for (const entry of bucket) {
+    const refs = entry.input.stampManifests;
+    if (refs === void 0) continue;
+    const { oldest, newestBody } = factCommits(entry.input, histories2.get(entry.rel) ?? [], blobs);
+    for (const field of STAMPED_DATE_FIELDS) {
+      const ref = refs[field];
+      const at2 = field === "created" ? oldest : newestBody;
+      if (ref === void 0 || at2 === void 0) continue;
+      const rel = insideRoot(root, ref.absPath);
+      if (rel === void 0) continue;
+      const key = ref.join === "path" ? entryAt(ref.entry, entry.rel, at2.pathAtCommit) : ref.entry;
+      const revs = field === "created" ? [at2.sha] : [at2.sha, `${at2.sha}^`];
+      for (const rev of revs) {
+        reads.push({ label: entry.input.label, field, rev, spec: `${rev}:${rel}`, key, join: ref.join });
+      }
+    }
+  }
+  const out = /* @__PURE__ */ new Map();
+  if (reads.length === 0) return out;
+  const fetched = await fetchSpecs(run2, [...new Set(reads.map((r) => r.spec))]);
+  const values = /* @__PURE__ */ new Map();
+  const keyOf = (label, field, rev) => `${label}\0${field}\0${rev}`;
+  for (const r of reads) {
+    values.set(keyOf(r.label, r.field, r.rev), manifestValue(fetched.get(r.spec), r.key, r.join, r.field, parse));
+  }
+  for (const label of new Set(reads.map((r) => r.label))) {
+    out.set(label, (field, rev) => values.get(keyOf(label, field, rev)));
+  }
+  return out;
+}
+function judge(input, root, history, blobs, now, machines, manifestStamp2) {
+  const fenced = input.extracted.fenced;
+  const extractor = extractorFor(input);
+  const blobBody = (sha) => sha === null ? null : bodyOf(blobs.get(sha) ?? "", fenced);
+  const stampsOf = (sha) => {
+    if (sha === null) return {};
+    const content = blobs.get(sha);
+    return content === void 0 ? {} : extractStamps(extractor, content, input.absPath);
+  };
+  const stampAt = (field, h, parent) => {
+    const kept = manifestStamp2?.(field, parent ? `${h.sha}^` : h.sha);
+    if (kept !== void 0 && kept !== null) return kept;
+    return stampsOf(parent ? h.oldBlob : h.newBlob)[field];
+  };
+  const { bodyChanging, oldest, newestBody } = factCommits(input, history, blobs);
+  const head = history[0];
+  const headBlob = head === void 0 ? null : head.newBlob;
+  const created = oldest === void 0 ? null : createdOf(oldest, stampAt("created", oldest, false));
+  const workingChanged = !sameBody(
+    bodyOf(input.content, fenced),
+    headBlob === null ? null : blobBody(headBlob)
+  );
+  let lastUpdated;
+  let lastBodyCommit;
+  if (workingChanged) {
+    lastBodyCommit = null;
+    const working = input.extracted.data["last-updated"];
+    const committed = stampsOf(headBlob)["last-updated"];
+    lastUpdated = working !== void 0 && working !== null && !sameValue(working, committed) ? git(working, "stamped in working tree") : git(utcDate2(now()), "uncommitted body change");
+  } else if (newestBody === void 0) {
+    lastBodyCommit = null;
+    lastUpdated = null;
+  } else {
+    lastBodyCommit = newestBody.sha;
+    lastUpdated = lastUpdatedOf(
+      newestBody,
+      stampAt("last-updated", newestBody, false),
+      stampAt("last-updated", newestBody, true)
+    );
+  }
+  const authors = bodyChanging.length === 0 ? null : authorsOf(bodyChanging, machines);
+  let reviewedBy = null;
+  let lastReviewed = null;
+  if (!workingChanged && newestBody !== void 0 && newestBody.reviewedBy.length > 0) {
+    const evidence = `Reviewed-by trailer in ${short2(newestBody.sha)}`;
+    reviewedBy = git(newestBody.reviewedBy.map(nameOf), evidence);
+    lastReviewed = git(datePart(newestBody.authorDate), evidence);
+  }
+  return {
+    created,
+    "last-updated": lastUpdated,
+    authors,
+    "reviewed-by": reviewedBy,
+    "last-reviewed": lastReviewed,
+    provenance: null,
+    lastBodyCommit,
+    root
+  };
+}
+function createdOf(oldest, stamp) {
+  if (stamp !== void 0 && stamp !== null) {
+    return git(stamp, `stamped in ${short2(oldest.sha)}`);
+  }
+  const date = datePart(oldest.authorDate);
+  return git(date, `added in ${short2(oldest.sha)} (${date})`);
+}
+function lastUpdatedOf(commit, stamp, before) {
+  if (stamp !== void 0 && stamp !== null && !sameValue(stamp, before)) {
+    return git(stamp, `stamped in ${short2(commit.sha)}`);
+  }
+  const date = datePart(commit.authorDate);
+  return git(date, `body changed in ${short2(commit.sha)} (${date})`);
+}
+function authorsOf(bodyChanging, machines) {
+  const seen = /* @__PURE__ */ new Set();
+  const names = [];
+  const add = (name, email) => {
+    if (name === "") return;
+    const identity = email === null || email === "" ? name : `${name} <${email}>`;
+    if (machineIdentity(identity, machines) !== void 0) return;
+    const key = email === null || email === "" ? `name:${name.toLowerCase()}` : email.toLowerCase();
+    if (seen.has(key)) return;
+    seen.add(key);
+    names.push(name);
+  };
+  for (const h of bodyChanging) {
+    add(h.authorName, h.authorEmail);
+    for (const co of h.coAuthors) add(nameOf(co), emailOf(co));
+  }
+  const n = bodyChanging.length;
+  return git(names, `${n} body-changing ${n === 1 ? "commit" : "commits"}`);
+}
+function provenanceFenced(extracted) {
+  return extracted.fenced === true || extracted.format === "markdown" || extracted.format === "mdx";
+}
+var OUTSIDE_RANGE = "outside-the-attributed-range";
+var ATTRIBUTED = ":attributed";
+function provenanceFor(entry, blame, commits, opts) {
+  const { input } = entry;
+  const fenced = provenanceFenced(input.extracted);
+  const base = { content: input.content, commits, machines: opts.machines, fenced };
+  let derivation;
+  const attribution = input.attribution;
+  if (attribution !== void 0) {
+    const page = readProvenancePage(input.content, { fenced });
+    const { bodyLine } = page;
+    const ranges = attribution.targets.flatMap((target) => {
+      const entry2 = attributeRange({ ...base, blame, target, generatedBy: attribution.generatedBy, page });
+      const span = entry2 === void 0 ? void 0 : parseLines(entry2.lines);
+      return span === void 0 ? [] : [toFileLines(span, bodyLine)];
+    });
+    const inRange = (line) => ranges.some((range) => line.finalLine >= range.start && line.finalLine <= range.end);
+    const attributed = new Map(commits);
+    const trailers = { generatedBy: [attribution.generatedBy], coAuthoredBy: [] };
+    attributed.set(OUTSIDE_RANGE, { sha: OUTSIDE_RANGE, trailers: { generatedBy: [], coAuthoredBy: [] } });
+    const rekeyed = blame.map((line) => {
+      if (inRange(line)) {
+        if (line.uncommitted) return line;
+        const sha = `${line.sha}${ATTRIBUTED}`;
+        attributed.set(sha, { sha, trailers });
+        return { ...line, sha };
+      }
+      return line.uncommitted ? { ...line, sha: OUTSIDE_RANGE, uncommitted: false } : line;
+    });
+    derivation = deriveProvenance({
+      ...base,
+      commits: attributed,
+      generatedBy: attribution.generatedBy,
+      blame: rekeyed
+    });
+  } else {
+    derivation = deriveProvenance({
+      ...base,
+      blame,
+      ...opts.generatedBy !== void 0 ? { generatedBy: opts.generatedBy } : {}
+    });
+  }
+  const entries = derivation.derived.map((d) => d.entry);
+  return {
+    value: entries.length === 0 ? null : git(entries, provenanceEvidence(derivation)),
+    derivation
+  };
+}
+function provenanceEvidence(derivation) {
+  const shas = [];
+  let uncommitted = false;
+  for (const range of derivation.derived) {
+    for (let n = range.span.start; n <= range.span.end; n++) {
+      const evidence = derivation.evidenceByLine.get(n);
+      if (evidence?.machine === void 0) continue;
+      if (evidence.rule === 1) uncommitted = true;
+      else if (!shas.includes(evidence.sha)) shas.push(evidence.sha);
+    }
+  }
+  const first = shas[0];
+  if (first === void 0) return "uncommitted";
+  const parts = [`blame ${short2(first)}`];
+  if (shas.length > 1) parts.push(`${String(shas.length)} commits`);
+  if (uncommitted) parts.push("uncommitted");
+  return parts.join(", ");
+}
+async function blameOf(run2, rel, content) {
+  const out = await run2([
+    "-c",
+    "core.quotePath=false",
+    "blame",
+    "--no-ignore-revs-file",
+    "--line-porcelain",
+    "--",
+    rel
+  ]);
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) {
+    const inHead = await run2(["cat-file", "-e", `HEAD:${rel}`]);
+    if (inHead.code !== 0) {
+      return splitLines(content).map((line, i) => ({
+        sha: ZERO_SHA,
+        origLine: i + 1,
+        finalLine: i + 1,
+        author: "Not Committed Yet",
+        authorMail: "not.committed.yet",
+        filename: rel,
+        boundary: false,
+        uncommitted: true,
+        content: line
+      }));
+    }
+    throw new BlameUnreadable(rel, out.stderr.trim());
+  }
+  return parseLinePorcelain(text(out));
+}
+async function commitEvidence(run2, root, pages, blobs, parse) {
+  const plans = pages.map(({ entry, blame, history }) => {
+    const pathAt = /* @__PURE__ */ new Map();
+    for (const line of blame) {
+      if (!line.uncommitted && !pathAt.has(line.sha)) pathAt.set(line.sha, unquotePath(line.filename));
+    }
+    const trailers = /* @__PURE__ */ new Map();
+    const pageBlob = /* @__PURE__ */ new Map();
+    for (const h of history) {
+      trailers.set(h.sha, { generatedBy: h.generatedBy, coAuthoredBy: h.coAuthors });
+      const blob = h.newBlob === null ? void 0 : blobs.get(h.newBlob);
+      if (blob !== void 0) pageBlob.set(h.sha, blob);
+    }
+    const manifest = entry.input.provenanceManifest;
+    const manifestRel = manifest === void 0 ? void 0 : insideRoot(root, manifest.absPath);
+    return { entry, pathAt, trailers, pageBlob, manifest, manifestRel };
+  });
+  const unlogged = /* @__PURE__ */ new Set();
+  const specs = /* @__PURE__ */ new Set();
+  for (const { pathAt, trailers, pageBlob, manifestRel } of plans) {
+    for (const [sha, path] of pathAt) {
+      if (!trailers.has(sha)) unlogged.add(sha);
+      if (!pageBlob.has(sha)) specs.add(`${sha}:${path}`);
+      if (manifestRel !== void 0) specs.add(`${sha}:${manifestRel}`);
+    }
+  }
+  const logged = /* @__PURE__ */ new Map();
+  if (unlogged.size > 0) {
+    const out = await run2(["log", "--no-walk=unsorted", "--stdin", RECORD_FORMAT], `${[...unlogged].join("\n")}
+`);
+    if (out.tooLarge) throw new HistoryTooLarge();
+    if (out.code !== 0) throw new BlobsUnreadable(`git log exit ${String(out.code)}`);
+    for (const record of parseLog(text(out))) {
+      logged.set(record.sha, { generatedBy: record.generatedBy, coAuthoredBy: record.coAuthors });
+    }
+  }
+  const fetched = await fetchSpecs(run2, [...specs]);
+  return plans.map(({ entry, pathAt, trailers, pageBlob, manifest, manifestRel }) => {
+    const commits = /* @__PURE__ */ new Map();
+    for (const [sha, path] of pathAt) {
+      const blob = pageBlob.get(sha) ?? fetched.get(`${sha}:${path}`);
+      commits.set(sha, {
+        sha,
+        trailers: trailers.get(sha) ?? logged.get(sha) ?? { generatedBy: [], coAuthoredBy: [] },
+        ...blob !== void 0 ? { blob } : {},
+        ...manifest !== void 0 ? {
+          stamp: manifestRel === void 0 ? [] : manifestStamp(
+            fetched.get(`${sha}:${manifestRel}`),
+            manifest.join === "path" ? entryAt(manifest.entry, entry.rel, path) : manifest.entry,
+            manifest.join,
+            parse
+          )
+        } : {}
+      });
+    }
+    return commits;
+  });
+}
+function insideRoot(root, abs) {
+  const rel = relative6(root, abs);
+  if (rel === "" || rel.startsWith("..") || isAbsolute4(rel)) return void 0;
+  return rel.split(sep5).join("/");
+}
+function entryAt(entry, rel, relAtCommit) {
+  if (relAtCommit === rel) return entry;
+  const fromHere = posix4.relative(posix4.dirname(rel), relAtCommit);
+  return posix4.join(posix4.dirname(entry), fromHere);
+}
+function manifestStamp(text2, key, join5, parse) {
+  return provenanceEntries(manifestValue(text2, key, join5, PROVENANCE_FIELD, parse));
+}
+function yamlOnce() {
+  const parsed = /* @__PURE__ */ new Map();
+  return (text2) => {
+    if (parsed.has(text2)) return parsed.get(text2);
+    let data;
+    try {
+      data = parseYaml3(text2);
+    } catch {
+      data = void 0;
+    }
+    parsed.set(text2, data);
+    return data;
+  };
+}
+function manifestValue(text2, key, join5, field, parse) {
+  if (text2 === void 0) return void 0;
+  const data = parse(text2);
+  if (!isRecord6(data)) return void 0;
+  for (const [candidate, value] of Object.entries(data)) {
+    const same = join5 === "path" ? posix4.normalize(candidate) === posix4.normalize(key) : candidate === key;
+    if (same && isRecord6(value)) return value[field];
+  }
+  return void 0;
+}
+function isRecord6(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+async function fetchSpecs(run2, specs) {
+  const found = /* @__PURE__ */ new Map();
+  if (specs.length === 0) return found;
+  const out = await run2(["cat-file", "--batch"], `${specs.join("\n")}
+`);
+  if (out.tooLarge && specs.length > 1) {
+    const half = Math.ceil(specs.length / 2);
+    const first = await fetchSpecs(run2, specs.slice(0, half));
+    const rest = await fetchSpecs(run2, specs.slice(half));
+    return new Map([...first, ...rest]);
+  }
+  if (out.tooLarge) throw new HistoryTooLarge();
+  if (out.code !== 0) throw new BlobsUnreadable(`exit ${String(out.code)}`);
+  for (const [spec, content] of parseSpecBatch(out.raw, specs)) found.set(spec, content);
+  return found;
+}
+function parseSpecBatch(buf, specs) {
+  const found = /* @__PURE__ */ new Map();
+  let cursor = 0;
+  for (const spec of specs) {
+    const nl = buf.indexOf(10, cursor);
+    if (nl === -1) throw new BlobsUnreadable(`the answer ends before ${spec}`);
+    const header = buf.toString("utf8", cursor, nl);
+    cursor = nl + 1;
+    if (header.endsWith(" missing") || header.endsWith(" ambiguous")) continue;
+    const parts = header.split(" ");
+    const size = Number(parts[2]);
+    if (parts.length !== 3 || !Number.isInteger(size) || size < 0) {
+      throw new BlobsUnreadable(`unreadable header for ${spec}: ${header}`);
+    }
+    if (parts[1] === "blob") found.set(spec, buf.toString("utf8", cursor, cursor + size));
+    cursor += size + 1;
+  }
+  return found;
+}
+function extractorFor(input) {
+  return extractorByName(input.extracted.format) ?? extractorForExtension(extname2(input.absPath));
+}
+function extractStamps(extractor, content, filePath) {
+  if (!extractor) return {};
+  try {
+    return extractor.extract(content, filePath).data;
+  } catch {
+    return {};
+  }
+}
+function sameBody(a, b) {
+  if (a === null || b === null) return a === b;
+  return a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
+}
+function sameValue(a, b) {
+  return toJsonText(a) === toJsonText(b);
+}
+var short2 = (sha) => sha.slice(0, 7);
+var datePart = (iso) => {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? "" : utcDate2(d);
+};
+function utcDate2(d) {
+  return d.toISOString().slice(0, 10);
+}
+function nameOf(trailer) {
+  const lt = trailer.lastIndexOf("<");
+  return (lt === -1 ? trailer : trailer.slice(0, lt)).trim();
+}
+function emailOf(trailer) {
+  const m = /<([^>]*)>\s*$/.exec(trailer);
+  return m?.[1]?.trim() ?? null;
+}
+var MAX_STDERR_BYTES = 16 * 1024;
+var GIT_CONCURRENCY = Math.min(8, availableParallelism());
+function text(out) {
+  try {
+    return out.raw.toString("utf8");
+  } catch {
+    throw new HistoryTooLarge();
+  }
+}
+function runGit(args, cwd, stdin, maxBytes) {
+  return new Promise((settle2, reject) => {
+    let done = false;
+    const finish = (out) => {
+      if (done) return;
+      done = true;
+      settle2(out);
+    };
+    const fail = (err) => {
+      if (done) return;
+      done = true;
+      reject(err instanceof Error ? err : new Error(String(err)));
+    };
+    const failed = (missing) => ({
+      code: null,
+      raw: Buffer.alloc(0),
+      missing,
+      tooLarge: false,
+      stderr: ""
+    });
+    let child;
+    try {
+      child = spawn2("git", args, { cwd, windowsHide: true });
+    } catch {
+      finish(failed(true));
+      return;
+    }
+    let chunks = [];
+    let total = 0;
+    let tooLarge = false;
+    child.stdout.on("data", (chunk) => {
+      if (tooLarge) return;
+      total += chunk.length;
+      if (total > maxBytes) {
+        tooLarge = true;
+        chunks = [];
+        child.kill();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    const errChunks = [];
+    let errTotal = 0;
+    child.stderr.on("data", (chunk) => {
+      if (errTotal >= MAX_STDERR_BYTES) return;
+      const kept = chunk.subarray(0, MAX_STDERR_BYTES - errTotal);
+      errTotal += kept.length;
+      errChunks.push(kept);
+    });
+    child.on("error", (err) => {
+      finish(failed(err.code === "ENOENT"));
+    });
+    child.stdin.on("error", () => {
+    });
+    child.on("close", (code) => {
+      try {
+        const raw = tooLarge ? Buffer.alloc(0) : Buffer.concat(chunks);
+        const stderr = Buffer.concat(errChunks).toString("utf8");
+        finish({ code, raw, missing: false, tooLarge, stderr });
+      } catch (err) {
+        fail(err);
+      }
+    });
+    if (stdin === void 0) child.stdin.end();
+    else child.stdin.end(stdin);
+  });
+}
+
+// src/meta/core/derive/index.ts
+var FIELD_SOURCES = {
+  created: ["git"],
+  "last-updated": ["git"],
+  authors: ["git"],
+  owner: ["codeowners"],
+  "reviewed-by": ["github", "gitlab", "git"],
+  "last-reviewed": ["github", "gitlab", "git"],
+  provenance: ["git"]
+};
+var REVIEW_SOURCES = ["github", "gitlab"];
+var HOST_NAME = {
+  github: "GitHub",
+  gitlab: "GitLab"
+};
+function sourcesFor(field, commands) {
+  if (isBuiltinField(field)) return FIELD_SOURCES[field];
+  if (commands !== void 0 && Object.hasOwn(commands, field)) return ["command"];
+  return [];
+}
+function consultedSources(fields, sources, commands) {
+  const needed = /* @__PURE__ */ new Set();
+  for (const field of fields) {
+    for (const s of sourcesFor(field, commands)) needed.add(s);
+  }
+  return sources.filter((s) => needed.has(s));
+}
+function assertSourcesAvailable(sources, hint) {
+  for (const name of Object.keys(sources)) {
+    const status = sources[name];
+    if (status === void 0 || status.available) continue;
+    const reason = status.reason ?? "it could not answer";
+    throw new DocmetaError(
+      `${name} source unavailable: ${reason}${hint === void 0 ? "" : `; ${hint}`}`
+    );
+  }
+}
+async function deriveMetadata(inputs, ctx) {
+  const consulted = new Set(consultedSources(ctx.fields, ctx.sources, ctx.commands));
+  const sources = {};
+  let git2 = /* @__PURE__ */ new Map();
+  if (consulted.has("git")) {
+    const result = await deriveFromGit(inputs, {
+      cwd: ctx.cwd,
+      now: ctx.now,
+      fields: ctx.fields,
+      ...ctx.generatedBy !== void 0 ? { generatedBy: ctx.generatedBy } : {},
+      ...ctx.machines !== void 0 ? { machines: ctx.machines } : {}
+    });
+    sources.git = result.status;
+    git2 = result.records;
+  }
+  const provenance = /* @__PURE__ */ new Map();
+  for (const [label, facts] of git2) {
+    if (facts.provenanceDerivation !== void 0) provenance.set(label, facts.provenanceDerivation);
+  }
+  const rootCache = /* @__PURE__ */ new Map();
+  const rootOf = (absPath) => {
+    const dir = dirname5(absPath);
+    let root = rootCache.get(dir);
+    if (root === void 0) {
+      root = findGitRoot(dir);
+      rootCache.set(dir, root);
+    }
+    return root;
+  };
+  const rootFor = (input) => git2.get(input.label)?.root ?? rootOf(input.absPath);
+  let owners = /* @__PURE__ */ new Map();
+  if (consulted.has("codeowners")) {
+    const result = await deriveFromCodeowners(inputs, {
+      explicit: ctx.codeowners,
+      configDir: ctx.configDir,
+      rootOf
+    });
+    sources.codeowners = result.status;
+    owners = result.records;
+  }
+  const requested = REVIEW_SOURCES.filter((s) => consulted.has(s));
+  let reviews = /* @__PURE__ */ new Map();
+  if (requested.length > 0) {
+    if (!consulted.has("git")) {
+      for (const s of requested) {
+        sources[s] = {
+          available: false,
+          reason: `the ${s} source needs the git source to find each document's commits; add git to sources`
+        };
+      }
+    } else if (sources.git?.available === false) {
+      for (const s of requested) {
+        sources[s] = {
+          available: false,
+          reason: `the git source could not answer, so the ${s} source cannot locate any commit`
+        };
+      }
+    } else {
+      const result = await deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested);
+      Object.assign(sources, result.status);
+      reviews = result.records;
+    }
+  }
+  let commanded = /* @__PURE__ */ new Map();
+  const doomed = Object.values(sources).some((s) => !s.available);
+  if (consulted.has("command") && ctx.commands !== void 0 && !doomed) {
+    const wanted = new Set(ctx.fields);
+    const commands = Object.fromEntries(
+      Object.entries(ctx.commands).filter(([field]) => wanted.has(field))
+    );
+    if (Object.keys(commands).length > 0) {
+      const result = await deriveFromCommands(inputs, commands, { cwd: ctx.configDir ?? ctx.cwd });
+      sources.command = result.status;
+      commanded = result.records;
+    }
+  }
+  const records = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const fields = {};
+    const g = git2.get(input.label);
+    const r = reviews.get(input.label);
+    const c = commanded.get(input.label);
+    for (const field of ctx.fields) {
+      let value = null;
+      for (const source of sourcesFor(field, ctx.commands)) {
+        if (!consulted.has(source)) continue;
+        const candidate = valueFrom(source, field, g, r, owners.get(input.label), c);
+        if (candidate !== null) {
+          value = candidate;
+          break;
+        }
+      }
+      fields[field] = value;
+    }
+    records.set(input.label, { file: input.label, fields });
+  }
+  return { records, sources, ...provenance.size > 0 ? { provenance } : {} };
+}
+function valueFrom(source, field, git2, reviews, owner, commanded) {
+  switch (source) {
+    case "git":
+      if (git2 === void 0 || !isBuiltinField(field) || field === "owner") return null;
+      return git2[field];
+    case "command":
+      return commanded?.[field] ?? null;
+    case "codeowners":
+      return field === "owner" ? owner ?? null : null;
+    case "github":
+    case "gitlab": {
+      if (reviews === void 0) return null;
+      if (field !== "reviewed-by" && field !== "last-reviewed") return null;
+      const fact = reviews[field];
+      return fact !== null && fact.source === source ? fact : null;
+    }
+  }
+}
+async function deriveReviewsByRoot(inputs, git2, rootFor, ctx, requested) {
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const input of inputs) {
+    const root = rootFor(input);
+    if (root === null) continue;
+    const bucket = byRoot.get(root) ?? [];
+    bucket.push(input);
+    byRoot.set(root, bucket);
+  }
+  const status = {};
+  const records = /* @__PURE__ */ new Map();
+  const unavailable2 = (which, reason) => {
+    for (const s of which) status[s] = { available: false, reason };
+    return { status, records: /* @__PURE__ */ new Map() };
+  };
+  if (byRoot.size === 0) {
+    return unavailable2(requested, "no git repository contains the documents");
+  }
+  const cacheDir = resolve5(ctx.configDir ?? ctx.cwd, REVIEW_CACHE_DIR);
+  for (const [root, bucket] of byRoot) {
+    const client = ctx.reviews ?? await createReviewClient(root, { cwd: ctx.cwd, cache: ctx.cache, cacheDir, requested });
+    const identity = await client.detect();
+    if (identity === null) {
+      const s = await client.status();
+      return unavailable2(requested, s.reason ?? "no origin remote to tell GitHub from GitLab");
+    }
+    const source = identity.kind;
+    if (!requested.includes(source)) {
+      return unavailable2(
+        requested,
+        `the origin remote is ${identity.host}, which is ${HOST_NAME[source]}; add ${source} to sources, or drop reviewed-by and last-reviewed from the managed fields`
+      );
+    }
+    const result = await deriveFromReviews(
+      bucket.map((input) => ({
+        label: input.label,
+        sha: git2.get(input.label)?.lastBodyCommit ?? null
+      })),
+      client
+    );
+    if (!result.status.available) {
+      status[source] = result.status;
+      return { status, records: /* @__PURE__ */ new Map() };
+    }
+    status[source] = result.status;
+    for (const [label, facts] of result.records) records.set(label, facts);
+  }
+  return { status, records };
+}
+
+// src/meta/core/derive/table.ts
+var DERIVED_VIEW = "derived";
+var DERIVED_ROWS = "_derived_rows";
+var RESOLVED_VIEW = "resolved";
+var ORIGIN_COLUMN = "_origin";
+var SOURCES_COLUMN = "_sources";
+function derivedColumns(commands) {
+  return ["_path", ...derivableFields(commands), SOURCES_COLUMN];
+}
+function mentionsDerived(sql) {
+  return /\b(?:from|join|update|into|table|view)\s+(?:"derived"|derived\b)/i.test(sql);
+}
+function fieldsForSql(sql, fields) {
+  const named = (field) => new RegExp(`(?<![\\w-])${escapeRegExp(field)}(?![\\w-])`, "i").test(sql);
+  if (sql.includes("*") || /\b_(?:sources|origin)\b/i.test(sql)) {
+    return fields.filter((field) => field !== PROVENANCE_FIELD || named(field));
+  }
+  return fields.filter(named);
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function createDerivedView(db, records, columns) {
+  const quoted = columns.map(quoteIdent);
+  db.exec(
+    `CREATE TABLE ${DERIVED_ROWS} (${quoted.map((c, i) => i === 0 ? `${c} TEXT PRIMARY KEY` : `${c} TEXT`).join(", ")})`
+  );
+  const insert = db.prepare(
+    `INSERT INTO ${DERIVED_ROWS} VALUES (${quoted.map(() => "?").join(", ")})`
+  );
+  const fields = columns.slice(1, -1);
+  db.exec("BEGIN");
+  let committed = false;
+  try {
+    for (const [label, record] of records) {
+      const sources = {};
+      const values = fields.map((field) => {
+        const derived = record.fields[field];
+        if (derived == null) return null;
+        sources[field] = { source: derived.source, evidence: derived.evidence };
+        return bindValue(derived.value);
+      });
+      insert.run(label, ...values, JSON.stringify(sources));
+    }
+    db.exec("COMMIT");
+    committed = true;
+  } finally {
+    if (!committed) db.exec("ROLLBACK");
+  }
+  db.exec(`CREATE VIEW ${DERIVED_VIEW} AS SELECT * FROM ${DERIVED_ROWS}`);
+}
+function resolvedColumns(docsColumns, commands) {
+  const columns = ["_path"];
+  const seen = /* @__PURE__ */ new Set(["_path", ORIGIN_COLUMN, SOURCES_COLUMN]);
+  for (const column of docsColumns) {
+    if (seen.has(column) || RESERVED.has(column)) continue;
+    seen.add(column);
+    columns.push(column);
+  }
+  for (const field of derivableFields(commands)) {
+    if (seen.has(field)) continue;
+    seen.add(field);
+    columns.push(field);
+  }
+  columns.push(ORIGIN_COLUMN, SOURCES_COLUMN);
+  return columns;
+}
+function mentionsResolved(sql) {
+  return /\b(?:from|join|update|into|table|view)\s+(?:"resolved"|resolved\b)/i.test(sql);
+}
+function jsonPath(field) {
+  return `$.${JSON.stringify(field)}`;
+}
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function createResolvedView(db, docsColumns, commands) {
+  const columns = resolvedColumns(docsColumns, commands);
+  const fields = columns.slice(1, -2);
+  const inDocs = new Set(docsColumns);
+  const inDerived = new Set(derivableFields(commands));
+  const selects = [`d.${quoteIdent("_path")} AS ${quoteIdent("_path")}`];
+  const origin = [];
+  for (const field of fields) {
+    const path = sqlString(jsonPath(field));
+    const asserted = `json_type(d.${quoteIdent("_data")}, ${path}) IS NOT NULL`;
+    const assertedValue = inDocs.has(field) ? `d.${quoteIdent(field)}` : `d.${quoteIdent("_data")} ->> ${path}`;
+    if (inDerived.has(field)) {
+      const derivedValue = `r.${quoteIdent(field)}`;
+      selects.push(
+        `CASE WHEN ${asserted} THEN ${assertedValue} ELSE ${derivedValue} END AS ${quoteIdent(field)}`
+      );
+      origin.push(
+        `${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' WHEN ${derivedValue} IS NOT NULL THEN 'derived' END`
+      );
+    } else {
+      selects.push(`${assertedValue} AS ${quoteIdent(field)}`);
+      origin.push(`${sqlString(field)}, CASE WHEN ${asserted} THEN 'asserted' END`);
+    }
+  }
+  selects.push(
+    `json_patch('{}', json_object(${origin.join(", ")})) AS ${quoteIdent(ORIGIN_COLUMN)}`
+  );
+  selects.push(`r.${quoteIdent(SOURCES_COLUMN)} AS ${quoteIdent(SOURCES_COLUMN)}`);
+  db.exec(
+    `CREATE VIEW ${RESOLVED_VIEW} AS SELECT ${selects.join(", ")} FROM docs d LEFT JOIN ${DERIVED_ROWS} r USING (${quoteIdent("_path")})`
+  );
+}
+async function deriveForTable(inputs, ctx, hint, fields) {
+  const derive = ctx.config?.derive;
+  const commands = commandsOf(derive);
+  const managesProvenance = derive?.fields?.includes(PROVENANCE_FIELD) === true && !fields.includes(PROVENANCE_FIELD);
+  const result = await deriveMetadata(inputs, {
+    cwd: ctx.cwd,
+    base: ctx.base,
+    ...ctx.configDir !== void 0 ? { configDir: ctx.configDir } : {},
+    sources: derive?.sources ?? [...DERIVE_SOURCES],
+    fields: managesProvenance ? [...fields, PROVENANCE_FIELD] : fields,
+    ...derive?.codeowners !== void 0 ? { codeowners: derive.codeowners } : {},
+    ...commands !== void 0 ? { commands } : {},
+    cache: ctx.cache,
+    now: ctx.now ?? (() => /* @__PURE__ */ new Date()),
+    machines: machinesOf(derive)
+  });
+  assertSourcesAvailable(result.sources, hint);
+  return result.records;
+}
+
+// src/meta/core/checks.ts
+var CHECK_KEYWORD = "check";
+function checkSchemaRef(name) {
+  if (!CHECK_NAME.test(name) || name.toLowerCase().endsWith(".json")) {
+    throw new DocmetaError(
+      `check name "${name}" must match [a-z0-9][a-z0-9._-]* and not end in ".json" \u2014 the name is part of each finding's identity (check:<name>).`
+    );
+  }
+  return `check:${name}`;
+}
+var CONVENTION_COLUMNS = /* @__PURE__ */ new Set(["path", "line", "key", "message"]);
+function rowsToFindings(name, columns, rows, loaded) {
+  if (!columns.includes("path")) {
+    throw new DocmetaError(
+      `check "${name}": the result has no \`path\` column. A check's SELECT names its findings through the column convention: \`path\` (required), and optionally \`line\`, \`key\`, and \`message\`; any other column is folded into the message.`
+    );
+  }
+  const findings = /* @__PURE__ */ new Map();
+  const extras = columns.filter((c) => !CONVENTION_COLUMNS.has(c));
+  for (const row of rows) {
+    const path = row.path;
+    if (typeof path !== "string" || loaded !== void 0 && !loaded.has(path)) {
+      throw new DocmetaError(
+        `check "${name}": a result row names ${JSON.stringify(path)}, which this run did not load \u2014 a finding must attach to a file of the corpus. Fix the check's \`path\` column.`
+      );
+    }
+    const key = typeof row.key === "string" && row.key !== "" ? row.key : void 0;
+    const line = asLine(row.line);
+    const message = typeof row.message === "string" && row.message !== "" ? row.message : synthesizeMessage(extras, row);
+    const err = {
+      schema: checkSchemaRef(name),
+      keyword: CHECK_KEYWORD,
+      // RFC 6901 escaping, or a key containing `/` or `~` would build a
+      // pointer that parses as a different (nested) location.
+      instancePath: key === void 0 ? "" : `/${escapePointerSegment(key)}`,
+      message,
+      ...line === void 0 ? {} : { line }
+    };
+    const bucket = findings.get(path);
+    if (bucket) bucket.push(err);
+    else findings.set(path, [err]);
+  }
+  return findings;
+}
+function asLine(value) {
+  const n = typeof value === "bigint" ? Number(value) : typeof value === "number" ? value : void 0;
+  return n !== void 0 && Number.isInteger(n) && n > 0 ? n : void 0;
+}
+function synthesizeMessage(extras, row) {
+  const pairs = extras.flatMap((c) => {
+    const value = row[c];
+    if (value === null || value === void 0) return [];
+    const text2 = typeof value === "string" ? value : typeof value === "number" || typeof value === "bigint" ? String(value) : JSON.stringify(value);
+    return [`${c}=${text2}`];
+  });
+  return pairs.length > 0 ? pairs.join(", ") : "check matched";
+}
+async function runChecks(checks, entries, ctx = {}) {
+  const merged = /* @__PURE__ */ new Map();
+  if (checks.length === 0) return merged;
+  const { DatabaseSync } = await loadSqlite();
+  const db = new DatabaseSync(":memory:");
+  try {
+    const dataColumns = corpusDataColumns(entries);
+    createDocsTable(db, entries, dataColumns);
+    registerLineFor(db, entries);
+    createCollectionViews(db, collectCollections(entries, ctx));
+    const wantsDerived = checks.filter(
+      (c) => mentionsDerived(c.query) || mentionsResolved(c.query)
+    );
+    if (wantsDerived.length > 0) {
+      if (ctx.derive === void 0) {
+        throw new DocmetaError(
+          `check "${wantsDerived[0]?.name ?? ""}": the SQL names the derived or resolved table, but this run cannot derive. Run it through \`manni meta validate\`, or drop the reference.`
+        );
+      }
+      const commands = ctx.commands;
+      const readable = derivableFields(commands);
+      const fields = /* @__PURE__ */ new Set();
+      for (const c of wantsDerived) for (const f of fieldsForSql(c.query, readable)) fields.add(f);
+      createDerivedView(db, await ctx.derive([...fields]), derivedColumns(commands));
+      createResolvedView(db, dataColumns, commands);
+    }
+    db.exec("PRAGMA query_only = 1");
+    const loaded = new Set(entries.map((e) => e.label));
+    for (const check of checks) {
+      const head = stripLeadingTrivia(check.query);
+      if (/^(attach|vacuum)\b/i.test(head)) {
+        throw new DocmetaError(
+          `check "${check.name}": ${head.split(/\s/, 1)[0]?.toUpperCase() ?? "that statement"} is refused: it can write outside the docs table.`
+        );
+      }
+      let tokens2;
+      try {
+        tokens2 = collectNamedParameters(check.query);
+      } catch (err) {
+        throw new DocmetaError(
+          `check "${check.name}": ${errorMessage(err)}`
+        );
+      }
+      if (tokens2.length > 0) {
+        throw new DocmetaError(
+          `check "${check.name}": the SQL references ${tokens2.join(", ")}, but checks bind no parameters \u2014 an unbound name binds NULL and matches nothing, so the gate would pass on a typo. Inline the value in the SQL.`
+        );
+      }
+      let columns;
+      let rows;
+      try {
+        assertSingleStatement(check.query);
+        const stmt = db.prepare(check.query);
+        columns = stmt.columns().map((c) => c.name);
+        rows = stmt.all();
+      } catch (err) {
+        const message = errorMessage(err);
+        throw new DocmetaError(
+          message.includes("attempt to write a readonly database") ? `check "${check.name}": ${message} \u2014 checks are read-only by design; a check is a SELECT over the projection. Edit the corpus with \`manni meta query\` instead.` : `check "${check.name}": ${message}`
+        );
+      }
+      for (const [path, errs] of rowsToFindings(
+        check.name,
+        columns,
+        rows,
+        loaded
+      )) {
+        const bucket = merged.get(path);
+        if (bucket) bucket.push(...errs);
+        else merged.set(path, errs);
+      }
+    }
+  } finally {
+    db.close();
+  }
+  return merged;
+}
+
+// src/meta/core/derive/provenance-place.ts
+import { isAbsolute as isAbsolute5, relative as relative7, resolve as resolve6, sep as sep6 } from "node:path";
+var toPosix3 = (p) => p.split(sep6).join("/");
+function provenanceManifests(collections, configDir, base, field = PROVENANCE_FIELD) {
+  const out = [];
+  for (const collection of collections) {
+    for (const manifest of collection.externalMetadata) {
+      const implied = manifest.keys === void 0;
+      if (!implied && manifest.keys?.includes(field) !== true) continue;
+      const url = classifyRef(manifest.file).kind === "url";
+      if (url && !implied) throw new DocmetaError(urlRefusal(collection.name, field));
+      if (url) {
+        out.push({
+          collection: collection.name,
+          absPath: manifest.file,
+          file: manifest.file,
+          join: externalMetadataJoin(manifest),
+          perPage: false,
+          written: manifest.file,
+          implied: { collection, manifest, url }
+        });
+        continue;
+      }
+      const absPath = isAbsolute5(manifest.file) ? manifest.file : resolve6(configDir, manifest.file);
+      const perPage = hasPagePlaceholder(manifest.file);
+      out.push({
+        collection: collection.name,
+        absPath,
+        file: perPage ? manifest.file : reportedPath(absPath, base),
+        join: externalMetadataJoin(manifest),
+        perPage,
+        written: manifest.file,
+        ...implied ? { implied: { collection, manifest, url } } : {}
+      });
+    }
+  }
+  return out;
+}
+function urlRefusal(collection, field) {
+  return `collection ${collection}: ${field} cannot come from a URL manifest, because manni meta derive writes it.`;
+}
+function provenancePlace(label, data, manifests, collections, configDir, base, marked, field = PROVENANCE_FIELD) {
+  if (manifests.length === 0) return void 0;
+  const members = new Set(memberOf(collections, configDir, base, label));
+  const owning = manifests.filter(
+    (m) => members.has(m.collection) && (m.implied === void 0 || ownsKey(m.implied.collection, m.implied.manifest, field, marked))
+  );
+  const [declared, second] = owning;
+  if (declared === void 0) return void 0;
+  if (second !== void 0) {
+    throw new DocmetaError(
+      `${label} is in collections ${declared.collection} and ${second.collection}, and both keep ${field} in a manifest.`
+    );
+  }
+  if (declared.implied?.url === true) throw new DocmetaError(urlRefusal(declared.collection, field));
+  const manifest = declared.perPage ? ownManifest(declared, label, collections, configDir, base) : declared;
+  if (manifest.join === PATH_JOIN) {
+    const entry = toPosix3(relative7(configDir, resolve6(base, label)));
+    return { manifest, absPath: manifest.absPath, entry, join: manifest.join };
+  }
+  const value = data[manifest.join];
+  if (typeof value !== "string" && typeof value !== "number") {
+    throw new DocmetaError(
+      `${label} carries no ${manifest.join}, which ${manifest.file} joins on, so its ${field} has no entry there.`
+    );
+  }
+  return { manifest, absPath: manifest.absPath, entry: String(value), join: manifest.join };
+}
+function ownManifest(manifest, label, collections, configDir, base) {
+  const resolved = pageManifestPath(manifest.written, configDir, resolve6(base, label));
+  if ("outside" in resolved) {
+    const declared = collections.find((c) => c.name === manifest.collection)?.externalMetadata.find((m) => m.file === manifest.written);
+    throw new DocmetaError(
+      outsideRefusal(declared ?? { file: manifest.written }, manifest.collection, resolved.pageRel)
+    );
+  }
+  return { ...manifest, absPath: resolved.abs, file: reportedPath(resolved.abs, base) };
+}
+function readerManifests(collections, configDir, base, field = PROVENANCE_FIELD) {
+  const local = collections.map((c) => ({
+    ...c,
+    externalMetadata: c.externalMetadata.filter((m) => classifyRef(m.file).kind !== "url")
+  }));
+  return provenanceManifests(local, configDir, base, field);
+}
+function readerPlace(label, data, manifests, collections, configDir, base, marked, field = PROVENANCE_FIELD) {
+  try {
+    const place = provenancePlace(label, data, manifests, collections, configDir, base, marked, field);
+    return place === void 0 ? void 0 : { absPath: place.absPath, entry: place.entry, join: place.join };
+  } catch (err) {
+    if (err instanceof DocmetaError) return void 0;
+    throw err;
+  }
+}
+function stampManifests(label, data, collections, configDir, base, marked, fields) {
+  const out = {};
+  for (const field of STAMPED_DATE_FIELDS) {
+    if (!fields.includes(field)) continue;
+    const manifests = readerManifests(collections, configDir, base, field);
+    const place = readerPlace(label, data, manifests, collections, configDir, base, marked, field);
+    if (place !== void 0) out[field] = place;
+  }
+  return out;
+}
+
+// src/shared/cli-options.ts
+import { basename as basename4, relative as relative8 } from "node:path";
+function collect(value, prev) {
+  return prev.concat([value]);
+}
+function splitList(value) {
+  return value.split(",").map((s) => s.trim()).filter(Boolean);
+}
+var STDIN_REQUIRES_AS = "Reading from stdin (`-`) requires --as <format> to choose an extractor.";
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function configOption(value) {
+  if (value === false) return { noConfig: true };
+  return typeof value === "string" ? { configPath: value } : {};
+}
+function explicitFalse(value) {
+  return value === false ? false : void 0;
+}
+function reportConfig(toStdout, cwd) {
+  return (info) => {
+    const where = (relative8(cwd, info.dir) || ".").replace(/\\/g, "/");
+    const line = `Using ${basename4(info.path)} (${where})
+`;
+    (toStdout ? process.stdout : process.stderr).write(line);
+  };
+}
+
+// src/meta/commands/validate.ts
+function parseErrorResult(file, format, message, keyword) {
+  const err = {
+    schema: "(parse)",
+    instancePath: "",
+    message,
+    keyword
+  };
+  return { file, format, ok: false, schemas: [], errors: [err] };
+}
+function once(fn) {
+  let pending;
+  return () => {
+    pending ??= fn();
+    return pending;
+  };
+}
+async function runValidate(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const run2 = await resolveRunConfig({
+    cwd,
+    configPath: opts.configPath,
+    noConfig: opts.noConfig,
+    inputs: opts.inputs,
+    ...opts.collections !== void 0 ? { collections: opts.collections } : {},
+    onConfigLoaded: opts.onConfigLoaded
+  });
+  const {
+    config,
+    inputs,
+    base,
+    configDir,
+    collections,
+    declaredCollections,
+    fromCollections,
+    configFile
+  } = run2;
+  const membersFor = (label) => memberOf(collections, configDir ?? cwd, base, label);
+  const usingStdin = inputs.includes(STDIN_TOKEN);
+  if (inputs.length === 0) {
+    throw new DocmetaError(
+      "No files to validate. Pass paths/globs, or declare a collection under `collections:` in manni.config.yaml."
+    );
+  }
+  const forcedExtractor = opts.as ? extractorByName(opts.as) : void 0;
+  if (opts.as && !forcedExtractor) {
+    throw new DocmetaError(
+      `Unknown format "${opts.as}". Supported extensions: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  const exts = opts.exts ?? (forcedExtractor ? forcedExtractor.extensions : void 0);
+  const fileInputs = inputs.filter((i) => i !== STDIN_TOKEN);
+  const allowEmpty = opts.allowEmpty ?? config?.allowEmpty;
+  const exclude = opts.exclude ?? [];
+  const { files: walked, gitignoreSkipped } = await resolveTargetSet({
+    inputs: fileInputs,
+    exts,
+    exclude,
+    cwd: base,
+    allowEmpty,
+    ...gitignoreOptions({
+      flag: opts.respectGitignore,
+      configured: config?.respectGitignore,
+      onNotice: opts.onNotice
+    })
+  });
+  const files = fromCollections ? retainMembers(walked, membersFor) : walked;
+  assertNonEmpty({
+    files,
+    inputs: fileInputs,
+    usingStdin,
+    allowEmpty,
+    exclude,
+    exts,
+    gitignoreSkipped,
+    action: "validated"
+  });
+  const trustRoot = schemaTrustRoot(cwd, configDir);
+  const externalMetadata = await loadExternalMetadata(collections, {
+    configDir: configDir ?? cwd,
+    base,
+    offline: opts.offline ?? config?.offline ?? false,
+    // A `{page}` manifest (0058) is read for exactly the pages this run reads.
+    pages: files.map((file) => resolve7(base, file))
+  });
+  const validator = new Validator(
+    schemaLoadOptions({
+      // The config's directory when a config governs the run, so one project
+      // keeps one cache no matter which directory the command was run from.
+      root: configDir ?? cwd,
+      // A relative file ref belongs to the run's directory, not the cache root.
+      fileBase: cwd,
+      ttlHours: config?.schemaCache?.ttlHours,
+      offline: opts.offline ?? config?.offline,
+      // Built from the rebased config, so a pinned local ref is keyed by the
+      // same absolute spelling `resolveSchemaSet` will hand to `loadSchema`.
+      pins: collectSchemaPins(config),
+      registered: config?.registered
+    })
+  );
+  const marks = pageMarks({
+    validator,
+    config,
+    cwd,
+    trustRoot,
+    ...opts.cliSchemas !== void 0 ? { cliSchemas: opts.cliSchemas } : {}
+  });
+  let relocation;
+  const relocationCtx = () => relocation ??= relocationContext(run2, {
+    cwd,
+    targets: fromCollections ? [] : opts.inputs,
+    validator,
+    ...opts.noConfig !== void 0 ? { noConfig: opts.noConfig } : {},
+    ...opts.env !== void 0 ? { env: opts.env } : {}
+  });
+  const refFrame = { cwd, base: configDir ?? cwd, runBase: base };
+  const locationFindings = async (label, own, data, refs, members, merged, lineFor) => {
+    const preferences = await validator.locationPreferences(data, refs);
+    if (preferences.size === 0) return [];
+    const owned = new Set(merged.collisions.map((c) => c.key));
+    const declaredMembers = declaredCollections === collections ? members : memberOf(declaredCollections, configDir ?? cwd, base, label);
+    const joins = new Set(
+      declaredCollections.filter((c) => declaredMembers.includes(c.name)).flatMap((c) => c.externalMetadata.map(externalMetadataJoin)).filter((join5) => join5 !== PATH_JOIN)
+    );
+    const findings = [];
+    for (const key of Object.keys(data)) {
+      const preference = preferences.get(key);
+      if (preference === void 0) continue;
+      const ref = canonicalSchemaRef(preference.schema, refFrame);
+      const pointer = externalMetadataPointer(key);
+      const common = {
+        keyword: LOCATION_FINDING_KEYWORD,
+        subject: key,
+        instancePath: pointer,
+        severity: "warning"
+      };
+      if (Object.hasOwn(own, key)) {
+        if (preference.location !== "external" || owned.has(key) || joins.has(key)) continue;
+        const line = lineFor(key);
+        const none = await homeless(label, own, key);
+        findings.push({
+          schema: LOCATION_EXTERNAL_SCHEMA,
+          ...common,
+          // relocate refuses --no-config (U2), so it is no answer there.
+          // Nor is it one for stdin, which relocate refuses: no advice there.
+          message: opts.noConfig ? `"${key}" is stored in the page; ${ref} prefers external metadata, and --no-config leaves it no manifest.` : label === STDIN_LABEL ? `"${key}" is stored in the page; ${ref} prefers external metadata.` : none > 0 ? `"${key}" is stored in the page; ${ref} prefers external metadata, and this document is in none of the ${String(none)} collections.` : `"${key}" is stored in the page; ${ref} prefers external metadata. Run manni meta relocate.`,
+          ...line != null ? { line } : {}
+        });
+        continue;
+      }
+      if (preference.location !== "page") continue;
+      const at2 = merged.locate(pointer);
+      if (at2 === void 0) continue;
+      findings.push({
+        schema: LOCATION_PAGE_SCHEMA,
+        ...common,
+        // A fetched manifest cannot give a value up, so relocate is no
+        // answer; the value moves in the repository that serves it.
+        message: /^https?:\/\//.test(at2.file) ? `"${key}" is stored in manifest ${at2.file}; ${ref} prefers the page, and a fetched manifest cannot be written. Move it in that repository.` : `"${key}" is stored in manifest ${at2.file}; ${ref} prefers the page. Run manni meta relocate.`,
+        file: at2.file,
+        ...at2.line != null ? { line: at2.line } : {}
+      });
+    }
+    return findings;
+  };
+  const homeless = async (label, own, key) => {
+    if (label === STDIN_LABEL) return 0;
+    const home = await keyHome(relocationCtx(), label, own, key);
+    return home.kind === "unowned" && home.home.kind === "none" && home.home.reason === "collections" && home.home.collections > 1 ? home.home.collections : 0;
+  };
+  const results = [];
+  const skippedDefaultOnly = /* @__PURE__ */ new Set();
+  const defaultOnly = (label, members) => {
+    try {
+      return resolveSchemaSetWithSource({
+        filePath: label,
+        fileSchema: void 0,
+        cliSchemas: opts.cliSchemas,
+        config,
+        memberOf: members,
+        fileBase: cwd,
+        trustRoot
+      }).source === "default";
+    } catch {
+      return false;
+    }
+  };
+  const joinHits = /* @__PURE__ */ new Map();
+  const scopedToCollections = (opts.collections?.length ?? 0) > 0;
+  const scopedByFlags = opts.inputs.length > 0 || // redundant with inputs.length (stdin is an input) — kept as belt-and-suspenders
+  usingStdin || opts.as !== void 0 || opts.exts !== void 0 || opts.exclude !== void 0 && opts.exclude.length > 0 || opts.respectGitignore !== void 0 || (opts.cliSchemas?.length ?? 0) > 0;
+  const scoped = scopedByFlags || scopedToCollections;
+  const configuredChecks = config?.checks ?? [];
+  if (!scopedByFlags) {
+    const covered = scopedToCollections ? collections.map((c) => c.name) : void 0;
+    const orphans = orphanEntries(externalMetadata, files, base, covered);
+    if (orphans.length > 0) throw orphanError(orphans);
+  }
+  const checksWillRun = configuredChecks.length > 0 && opts.checks !== false && !scoped;
+  const checkEntries = [];
+  const encryptionKey = lazyKey(configFile, opts.env);
+  let unverified = 0;
+  const deriveConfig = config?.derive;
+  const configuredFields = managedFields(deriveConfig);
+  const defaultedFields = deriveConfig !== void 0 && deriveConfig.fields === void 0;
+  const deriveWillRun = deriveConfig !== void 0 && configuredFields.length > 0 && opts.derive !== false;
+  const pageManaged = /* @__PURE__ */ new Map();
+  const derivedChecks = checksWillRun ? configuredChecks.filter((c) => mentionsDerived(c.query) || mentionsResolved(c.query)) : [];
+  const checksNeedDerived = derivedChecks.length > 0;
+  const deriveInputs = [];
+  const managedViews = /* @__PURE__ */ new Map();
+  const keepDeriveInputs = deriveWillRun || checksNeedDerived;
+  const deriveCommands = commandsOf(deriveConfig);
+  const deriveFields = new Set(deriveWillRun && !defaultedFields ? configuredFields : []);
+  const readable = derivableFields(deriveCommands);
+  for (const c of derivedChecks) for (const f of fieldsForSql(c.query, readable)) deriveFields.add(f);
+  const provenanceManifests2 = keepDeriveInputs && (deriveFields.has(PROVENANCE_FIELD) || deriveWillRun && configuredFields.includes(PROVENANCE_FIELD)) ? readerManifests(declaredCollections, configDir ?? cwd, base) : [];
+  const derivedOnce = once(async () => {
+    const derived = await deriveMetadata(deriveInputs, {
+      cwd,
+      base,
+      ...configDir !== void 0 ? { configDir } : {},
+      sources: deriveConfig?.sources ?? [...DERIVE_SOURCES],
+      fields: [...deriveFields],
+      ...deriveConfig?.codeowners !== void 0 ? { codeowners: deriveConfig.codeowners } : {},
+      ...deriveCommands !== void 0 ? { commands: deriveCommands } : {},
+      cache: opts.cache ?? true,
+      now: opts.now ?? (() => /* @__PURE__ */ new Date()),
+      machines: machinesOf(deriveConfig)
+    });
+    assertSourcesAvailable(
+      derived.sources,
+      deriveWillRun ? "pass --no-derive to skip the comparison, or narrow derive.sources" : "narrow derive.sources in manni.config.yaml"
+    );
+    for (const [name, status] of Object.entries(derived.sources)) {
+      if (status.available && status.reason !== void 0) {
+        opts.onNotice?.(`${name}: ${status.reason}`);
+      }
+    }
+    return derived;
+  });
+  const processOne = async (label, content, extension) => {
+    const extractor = forcedExtractor ?? extractorForExtension(extension);
+    if (!extractor) {
+      throw new DocmetaError(
+        `Unsupported file type "${extension}" for "${label}". Supported: ${supportedExtensions().join(", ")}. Use --as to override.`
+      );
+    }
+    const members = membersFor(label);
+    let extracted;
+    try {
+      extracted = extractor.extract(content, label, {
+        elements: resolveElements(label, config, members)
+      });
+    } catch (err) {
+      if (err instanceof DocmetaError) throw err;
+      if (opts.skipDefaultOnly === true && defaultOnly(label, members)) {
+        skippedDefaultOnly.add(label);
+        return;
+      }
+      results.push(
+        parseErrorResult(label, extractor.name, errorMessage(err), "parse")
+      );
+      return;
+    }
+    const merged = await mergeWithMarks(label, extracted, externalMetadata, members, base, {
+      encryptionKey,
+      marks
+    });
+    if (keepDeriveInputs && label !== STDIN_LABEL && (checksNeedDerived || deriveCovers(deriveConfig, members))) {
+      const place = provenanceManifests2.length === 0 ? void 0 : readerPlace(label, extracted.data, provenanceManifests2, declaredCollections, configDir ?? cwd, base, merged.marked);
+      const owned = declaredCollections.length === 0 ? {} : stampManifests(label, extracted.data, declaredCollections, configDir ?? cwd, base, merged.marked, STAMPED_DATE_FIELDS);
+      deriveInputs.push({
+        label,
+        absPath: resolve7(base, label),
+        content,
+        extracted,
+        ...place !== void 0 ? { provenanceManifest: place } : {},
+        ...Object.keys(owned).length > 0 ? { stampManifests: owned } : {}
+      });
+    }
+    const own = extracted.data;
+    extracted = merged.extracted;
+    if (deriveWillRun && label !== STDIN_LABEL) {
+      managedViews.set(label, {
+        data: extracted.data,
+        marked: [],
+        hidden: [],
+        refs: [],
+        locate: merged.locate
+      });
+    }
+    for (const j of merged.joins) {
+      const byValue = joinHits.get(j.field) ?? /* @__PURE__ */ new Map();
+      const line = extracted.lineFor(j.field);
+      const hits = byValue.get(j.value) ?? [];
+      hits.push({
+        label,
+        file: j.file,
+        shown: j.pageValue ?? j.value,
+        ...line != null ? { line } : {}
+      });
+      byValue.set(j.value, hits);
+      joinHits.set(j.field, byValue);
+    }
+    if (checksWillRun) checkEntries.push({ label, extracted });
+    let resolved;
+    try {
+      resolved = resolveSchemaSetWithSource({
+        filePath: label,
+        fileSchema: extracted.data[FILE_SCHEMA_KEY],
+        cliSchemas: opts.cliSchemas,
+        config,
+        memberOf: members,
+        // A document's own `$schema` is measured from the run's directory, the
+        // same base `loadSchema` will read it from, and contained to the
+        // repository the run is standing in.
+        fileBase: cwd,
+        trustRoot,
+        onNotice: opts.onNotice
+      });
+    } catch (err) {
+      results.push(
+        parseErrorResult(label, extractor.name, errorMessage(err), "schema")
+      );
+      return;
+    }
+    if (opts.skipDefaultOnly === true && resolved.source === "default") {
+      skippedDefaultOnly.add(label);
+      return;
+    }
+    const schemaSet = resolved.schemas;
+    if (deriveWillRun && defaultedFields && label !== STDIN_LABEL && deriveCovers(deriveConfig, members)) {
+      let claimed = /* @__PURE__ */ new Set();
+      try {
+        claimed = await validator.claimedProperties(schemaSet);
+      } catch (err) {
+        if (!(err instanceof DocmetaError)) throw err;
+      }
+      const own2 = configuredFields.filter((f) => claimed.has(f));
+      pageManaged.set(label, own2);
+      for (const f of own2) deriveFields.add(f);
+    }
+    let errors;
+    try {
+      const view = await encryptionView({
+        data: extracted.data,
+        refs: schemaSet,
+        validator,
+        key: encryptionKey,
+        locate: merged.locate
+      });
+      unverified += view.unverified.length;
+      if (deriveWillRun && label !== STDIN_LABEL) {
+        managedViews.set(label, {
+          data: view.data,
+          marked: view.marked,
+          hidden: [...view.unreadable, ...view.unverified],
+          refs: schemaSet,
+          locate: merged.locate
+        });
+      }
+      errors = [
+        ...settleFindings(
+          await validator.validate(
+            view.data,
+            schemaSet,
+            extracted.lineFor,
+            extracted.colFor,
+            merged.locate
+          ),
+          view,
+          extracted,
+          merged.locate
+        ),
+        ...encryptionFindings(view, extracted, merged.locate),
+        // Over the decrypted view, the object validation evaluated: a mark
+        // counts where Ajv takes a branch, and a branch may read a value.
+        ...await locationFindings(label, own, view.data, schemaSet, members, merged, extracted.lineFor)
+      ];
+    } catch (err) {
+      if (!(err instanceof DocmetaError) || resolved.source !== "document") {
+        throw err;
+      }
+      results.push(
+        parseErrorResult(label, extractor.name, err.message, "schema")
+      );
+      return;
+    }
+    for (const { key, file, collection } of merged.collisions) {
+      const line = extracted.lineFor(key);
+      errors.push({
+        schema: EXTERNAL_OWNED_SCHEMA,
+        keyword: EXTERNAL_KEYWORD,
+        subject: key,
+        instancePath: externalMetadataPointer(key),
+        message: `"${key}" is owned by manifest ${file} (collection ${collection}); remove it from the document`,
+        ...line != null ? { line } : {}
+      });
+    }
+    results.push({
+      file: label,
+      format: extractor.name,
+      ok: !errors.some(isErrorSeverity),
+      schemas: schemaSet,
+      errors
+    });
+  };
+  if (usingStdin) {
+    const content = opts.stdinContent ?? "";
+    if (!forcedExtractor) {
+      throw new DocmetaError(
+        STDIN_REQUIRES_AS
+      );
+    }
+    await processOne(STDIN_LABEL, content, forcedExtractor.extensions[0] ?? "");
+  }
+  for (const file of files) {
+    const content = await readFile6(resolve7(base, file), "utf8");
+    await processOne(file, content, extname3(file));
+  }
+  if (unverified > 0) opts.onNotice?.(unverifiedWarning(unverified));
+  if (externalMetadata) {
+    const byLabel = new Map(results.map((r) => [r.file, r]));
+    const matched = /* @__PURE__ */ new Map();
+    for (const [field, byValue] of joinHits) {
+      matched.set(field, new Set(byValue.keys()));
+      for (const hits of byValue.values()) {
+        if (hits.length < 2) continue;
+        for (const hit of hits) {
+          const others = hits.filter((h) => h.label !== hit.label).map((h) => h.label).join(", ");
+          const result = byLabel.get(hit.label);
+          if (!result) continue;
+          result.errors.push({
+            schema: EXTERNAL_DUPLICATE_SCHEMA,
+            keyword: EXTERNAL_KEYWORD,
+            subject: hit.shown,
+            instancePath: externalMetadataPointer(field),
+            message: `${hits.length} documents carry ${field} "${hit.shown}"; ${hit.file} cannot tell them apart (${others})`,
+            ...hit.line != null ? { line: hit.line } : {}
+          });
+          result.ok = false;
+        }
+      }
+    }
+    if (!scopedByFlags) {
+      const covered = scopedToCollections ? collections.map((c) => c.name) : void 0;
+      const orphans = orphanJoins(externalMetadata, matched, covered);
+      if (orphans.length > 0) throw orphanError(orphans);
+    }
+  }
+  if (configuredChecks.length > 0 && opts.checks !== false) {
+    if (scoped) {
+      opts.onNotice?.(
+        scopedToCollections ? `corpus checks skipped: run is scoped to collections ${collections.map((c) => c.name).join(", ")}` : "corpus checks skipped: run is scoped"
+      );
+    } else {
+      const findings = await runChecks(configuredChecks, checkEntries, {
+        // Every declared collection is a view (0041 rule 7), holding the
+        // members this run loaded — decided by the same path arithmetic
+        // `membersFor` uses, so a check and a `manni meta query` over the same
+        // corpus see the same collections.
+        collections: declaredCollections,
+        ...configDir !== void 0 ? { configDir } : {},
+        base,
+        // A check that names the `derived` table (0040) gets the same view
+        // `query` builds, from the run's one derivation — which already
+        // covers every field the checks can read, so the list handed back
+        // here is not needed. Built only when asked for, because building
+        // it spawns git.
+        derive: async () => (await derivedOnce()).records,
+        // Its columns include the configured commands' keys (0042), which a
+        // check's context cannot read from a config since 0041.
+        ...deriveCommands !== void 0 ? { commands: deriveCommands } : {}
+      });
+      const byFile = new Map(results.map((r) => [r.file, r]));
+      for (const [file, errs] of findings) {
+        const result = byFile.get(file);
+        if (!result && skippedDefaultOnly.has(file)) continue;
+        if (!result) {
+          throw new DocmetaError(
+            `check findings for "${file}" have no validation result to attach to.`
+          );
+        }
+        result.errors.push(...errs);
+        result.ok = result.ok && !errs.some(isErrorSeverity);
+      }
+    }
+  }
+  if (deriveWillRun && deriveInputs.length > 0) {
+    const derived = await derivedOnce();
+    const byFile = new Map(results.map((r) => [r.file, r]));
+    for (const input of deriveInputs) {
+      const record = derived.records.get(input.label);
+      const result = byFile.get(input.label);
+      if (!record || !result) continue;
+      const managed = managedViews.get(input.label);
+      const managedHere = !deriveCovers(deriveConfig, membersFor(input.label)) ? [] : defaultedFields ? pageManaged.get(input.label) ?? [] : configuredFields;
+      const fields = managedHere.filter(
+        (field) => !(managed?.hidden.some((p) => isAtOrUnder(p, pointerOf(field))) ?? false)
+      );
+      let marked = [];
+      if (managed !== void 0) {
+        const stamped = { ...managed.data };
+        for (const field of fields) {
+          const d = record.fields[field];
+          if (d != null) stamped[field] = d.value;
+        }
+        marked = [...managed.marked, ...await validator.markedPointers(stamped, managed.refs)];
+      }
+      const asserted = (field) => managed !== void 0 ? managed.data[field] : input.extracted.data[field];
+      const findings = fields.flatMap((field) => {
+        if (field === PROVENANCE_FIELD) {
+          const derivation = derived.provenance?.get(input.label);
+          if (derivation === void 0) return [];
+          return provenanceFindings(
+            compareProvenance(provenanceEntries(asserted(field)), derivation),
+            derivation.page.bodyLine
+          );
+        }
+        const compared = compareDerived(field, asserted(field), record.fields[field]);
+        const at2 = pointerOf(field);
+        return staleFindings(
+          [marked.some((p) => isAtOrUnder(p, at2)) ? redactedDerived(compared) : compared],
+          input.extracted.lineFor,
+          managed?.locate
+        );
+      });
+      if (findings.length === 0) continue;
+      result.errors.push(...findings);
+      result.ok = false;
+    }
+  }
+  const frame = { cwd, base: configDir ?? cwd, runBase: base };
+  const { results: reported3, baseline } = await settleBaseline(
+    results,
+    resolveBaselineRequest(opts, config?.baseline, configDir, cwd, {
+      current: DEFAULT_BASELINE_PATH,
+      legacy: LEGACY_BASELINE_PATH
+    }),
+    frame
+  );
+  const failed = reported3.filter((r) => !r.ok).length;
+  const count2 = (keep) => reported3.reduce((n, r) => n + r.errors.filter(keep).length, 0);
+  const warnings = count2((e) => e.severity === "warning");
+  const notices = count2((e) => e.severity === "notice");
+  const summary = {
+    files: reported3.length,
+    passed: reported3.length - failed,
+    failed,
+    errors: count2(isErrorSeverity),
+    // Omitted at zero, like `gitignoreSkipped` below: only the location
+    // findings (proposal 0047) are warnings, so a run with no
+    // `x-manni-location` marks keeps the summary as it was.
+    ...warnings > 0 ? { warnings } : {},
+    ...notices > 0 ? { notices } : {},
+    // Omitted when nothing was skipped: there is nothing to audit, and the
+    // JSON summary stays as it was for every run in a clean repo.
+    ...gitignoreSkipped > 0 ? { gitignoreSkipped } : {},
+    ...baseline ? { baseline } : {}
+  };
+  return { results: reported3, summary, frame };
+}
+
 export {
+  collect,
+  splitList,
+  STDIN_REQUIRES_AS,
+  readStdin,
+  configOption,
+  explicitFalse,
+  reportConfig,
   writeTextAtomic,
   ENCRYPTION_KEY_ENV,
   resolveEncryptionKey,
@@ -4287,7 +7252,6 @@ export {
   META_CONTEXT,
   EncryptionRefusal,
   unreadableMessage,
-  unverifiedWarning,
   lazyKey,
   pointerOf,
   topLevelKeyOf,
@@ -4296,17 +7260,14 @@ export {
   withValueAt,
   encryptionView,
   settleFindings,
-  encryptionFindings,
   redactForModel,
   redactedDerived,
   EXTERNAL_OWNED_SCHEMA,
   EXTERNAL_DUPLICATE_SCHEMA,
   EXTERNAL_KEYWORD,
   PATH_JOIN,
-  reportedPath,
   externalMetadataJoin,
   loadExternalMetadata,
-  outsideRefusal,
   mergeExternalMetadata,
   mergeWithMarks,
   externalMetadataPointer,
@@ -4317,7 +7278,6 @@ export {
   LOCATION_KEYWORD,
   LOCATION_EXTERNAL_SCHEMA,
   LOCATION_PAGE_SCHEMA,
-  LOCATION_FINDING_KEYWORD,
   GRAPH_OUTPUT_KEYWORD,
   compileWithFormats,
   stringFormatNames,
@@ -4332,7 +7292,6 @@ export {
   familyMarks,
   SYSTEM_COLUMNS,
   RESERVED,
-  quoteIdent,
   bindValue,
   corpusDataColumns,
   createDocsTable,
@@ -4380,19 +7339,57 @@ export {
   toFileLines,
   toBodyLines,
   splitPageArgument,
-  ZERO_SHA,
-  DEFAULT_MACHINES,
   provenanceEntries,
   readProvenancePage,
-  parseLinePorcelain,
-  machineIdentity,
-  deriveProvenance,
   compareProvenance,
   planProvenanceWrite,
   rangeResults,
   provenanceFindings,
   renderProvenanceValue,
   parseProvenanceTarget,
-  attributeRange
+  commandsOf,
+  machinesOf,
+  REVIEW_CACHE_DIR,
+  REVIEW_CACHE_VERSION,
+  ReviewCache,
+  cachedClient,
+  BinMissing,
+  run,
+  PATH_PLACEHOLDER,
+  isPerFile,
+  argvFor,
+  valueOf,
+  deriveFromCommands,
+  parseOriginUrl,
+  identityFromOrigin,
+  GitHubClient,
+  GitLabClient,
+  createReviewClient,
+  deriveFromReviews,
+  mapConcurrent,
+  provenanceFenced,
+  FIELD_SOURCES,
+  sourcesFor,
+  consultedSources,
+  assertSourcesAvailable,
+  deriveMetadata,
+  DERIVED_VIEW,
+  DERIVED_ROWS,
+  RESOLVED_VIEW,
+  derivedColumns,
+  mentionsDerived,
+  fieldsForSql,
+  createDerivedView,
+  resolvedColumns,
+  mentionsResolved,
+  createResolvedView,
+  deriveForTable,
+  rowsToFindings,
+  provenanceManifests,
+  provenancePlace,
+  readerManifests,
+  readerPlace,
+  stampManifests,
+  runValidate
 };
-//# sourceMappingURL=chunk-HVFR66GQ.js.map
+//# sourceMappingURL=chunk-5UB47BEV.js.map