@inerrata-corporation/errata 2.0.17-dev.3369 → 2.0.17-dev.3416

package/pass-worker.mjs

@@ -15430,6 +15430,308 @@ var init_project_symbol = __esm({
 });
 
 // ../../packages/shared/src/lockfile.ts
+function rankDirect(raw, ecosystem = "npm") {
+  const byName = /* @__PURE__ */ new Map();
+  for (const { name: name2, version: version2 } of raw) {
+    const prev = byName.get(name2);
+    if (prev) {
+      prev.importers++;
+      continue;
+    }
+    byName.set(name2, {
+      purl: `pkg:${ecosystem}/${name2}@${version2}`,
+      name: name2,
+      version: version2,
+      ecosystem,
+      importers: 1
+    });
+  }
+  return [...byName.values()].sort(
+    (a, b) => b.importers - a.importers || a.name.localeCompare(b.name)
+  );
+}
+function npmPurl(name2, version2) {
+  return `pkg:npm/${name2}@${version2}`;
+}
+function component(name2, version2) {
+  return { purl: npmPurl(name2, version2), name: name2, version: version2, ecosystem: "npm" };
+}
+function isNpmImporterPath(path) {
+  return path === "" || !path.includes("node_modules/");
+}
+function parsePackageLockJson(jsonText) {
+  let doc;
+  try {
+    doc = JSON.parse(jsonText);
+  } catch {
+    return { components: [], dependencies: [] };
+  }
+  const packages = doc.packages ?? {};
+  const components = [];
+  const hoisted = /* @__PURE__ */ new Map();
+  const byPath = /* @__PURE__ */ new Map();
+  for (const [path, meta3] of Object.entries(packages)) {
+    if (path === "" || meta3.link === true) continue;
+    const ix = path.lastIndexOf("node_modules/");
+    if (ix === -1) continue;
+    const name2 = path.slice(ix + "node_modules/".length);
+    const version2 = typeof meta3.version === "string" ? meta3.version : "";
+    if (!name2 || !version2) continue;
+    components.push(component(name2, version2));
+    byPath.set(path, { name: name2, version: version2 });
+    const depth = path.split("node_modules/").length;
+    const prev = hoisted.get(name2);
+    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version2, depth });
+  }
+  const dependencies = [];
+  for (const [path, meta3] of Object.entries(packages)) {
+    const self = byPath.get(path);
+    if (!self) continue;
+    const deps = meta3.dependencies;
+    if (!deps || typeof deps !== "object") continue;
+    const dependsOn = [];
+    for (const depName of Object.keys(deps)) {
+      const target = hoisted.get(depName);
+      if (target) dependsOn.push(npmPurl(depName, target.version));
+    }
+    if (dependsOn.length > 0)
+      dependencies.push({ ref: npmPurl(self.name, self.version), dependsOn });
+  }
+  const directRaw = [];
+  for (const [path, meta3] of Object.entries(packages)) {
+    if (!isNpmImporterPath(path)) continue;
+    for (const section of [meta3.dependencies, meta3.devDependencies, meta3.optionalDependencies]) {
+      if (!section || typeof section !== "object") continue;
+      for (const name2 of Object.keys(section)) {
+        const target = hoisted.get(name2);
+        if (target) directRaw.push({ name: name2, version: target.version });
+      }
+    }
+  }
+  const direct = rankDirect(directRaw);
+  return {
+    components,
+    dependencies: dedupeRefs(dependencies),
+    ...direct.length > 0 ? { direct } : {}
+  };
+}
+function splitPnpmKey(raw) {
+  let k = raw.trim().replace(/^['"]|['"]$/g, "");
+  if (k.startsWith("/")) k = k.slice(1);
+  const paren = k.indexOf("(");
+  if (paren !== -1) k = k.slice(0, paren);
+  if (k.startsWith("link:") || k.startsWith("file:") || k.includes("://")) return null;
+  const at = k.lastIndexOf("@");
+  if (at <= 0) return null;
+  const name2 = k.slice(0, at);
+  const version2 = k.slice(at + 1);
+  if (!name2 || !version2) return null;
+  return { name: name2, version: version2 };
+}
+function parsePnpmImporters(lines) {
+  const DEP_SECTIONS = /* @__PURE__ */ new Set(["dependencies:", "devDependencies:", "optionalDependencies:"]);
+  const raw = [];
+  let inImporters = false;
+  let inDepSection = false;
+  let depName = null;
+  for (const line of lines) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    if (indent === 0) {
+      inImporters = line.trimEnd() === "importers:";
+      inDepSection = false;
+      depName = null;
+      continue;
+    }
+    if (!inImporters) continue;
+    if (indent === 2) {
+      inDepSection = false;
+      depName = null;
+      continue;
+    }
+    if (indent === 4) {
+      inDepSection = DEP_SECTIONS.has(line.trim());
+      depName = null;
+      continue;
+    }
+    if (!inDepSection) continue;
+    if (indent === 6 && line.trimEnd().endsWith(":")) {
+      depName = line.trim().slice(0, -1).replace(/^['"]|['"]$/g, "") || null;
+      continue;
+    }
+    if (indent === 8 && depName) {
+      const t = line.trim();
+      if (!t.startsWith("version:")) continue;
+      let version2 = t.slice("version:".length).trim().replace(/^['"]|['"]$/g, "");
+      const paren = version2.indexOf("(");
+      if (paren !== -1) version2 = version2.slice(0, paren);
+      if (!version2 || version2.startsWith("link:") || version2.startsWith("file:") || version2.includes("://")) {
+        depName = null;
+        continue;
+      }
+      raw.push({ name: depName, version: version2 });
+      depName = null;
+    }
+  }
+  return rankDirect(raw);
+}
+function parsePnpmLock(text) {
+  const lines = text.split(/\r?\n/);
+  const components = [];
+  const seen = /* @__PURE__ */ new Set();
+  const dependencies = [];
+  let section = null;
+  let currentPkg = null;
+  let inDepsBlock = false;
+  let currentDeps = [];
+  const flushDeps = () => {
+    if (currentPkg && currentDeps.length > 0) {
+      dependencies.push({
+        ref: npmPurl(currentPkg.name, currentPkg.version),
+        dependsOn: currentDeps.slice()
+      });
+    }
+    currentDeps = [];
+  };
+  for (const line of lines) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const indent = line.length - line.trimStart().length;
+    if (indent === 0) {
+      flushDeps();
+      currentPkg = null;
+      inDepsBlock = false;
+      section = line === "packages:" ? "packages" : line === "snapshots:" ? "snapshots" : null;
+      continue;
+    }
+    if (!section) continue;
+    if (indent === 2 && line.trimEnd().endsWith(":")) {
+      flushDeps();
+      inDepsBlock = false;
+      const key = line.trim().slice(0, -1);
+      currentPkg = splitPnpmKey(key);
+      if (currentPkg && section === "packages") {
+        const purl = npmPurl(currentPkg.name, currentPkg.version);
+        if (!seen.has(purl)) {
+          seen.add(purl);
+          components.push(component(currentPkg.name, currentPkg.version));
+        }
+      }
+      continue;
+    }
+    if (!currentPkg) continue;
+    if (indent === 4) {
+      inDepsBlock = line.trim() === "dependencies:";
+      continue;
+    }
+    if (inDepsBlock && indent === 6) {
+      const t = line.trim();
+      const at = t.indexOf(": ");
+      if (at === -1) continue;
+      const depName = t.slice(0, at).replace(/^['"]|['"]$/g, "");
+      let depVersion = t.slice(at + 2).trim().replace(/^['"]|['"]$/g, "");
+      const paren = depVersion.indexOf("(");
+      if (paren !== -1) depVersion = depVersion.slice(0, paren);
+      if (depName && depVersion && !depVersion.startsWith("link:"))
+        currentDeps.push(npmPurl(depName, depVersion));
+    }
+  }
+  flushDeps();
+  const direct = parsePnpmImporters(lines);
+  return {
+    components,
+    dependencies: dedupeRefs(dependencies),
+    ...direct.length > 0 ? { direct } : {}
+  };
+}
+function parseGemfileLock(text) {
+  const lines = text.split(/\r?\n/);
+  const components = [];
+  const dependencies = [];
+  const seen = /* @__PURE__ */ new Set();
+  const registryVersions = /* @__PURE__ */ new Map();
+  const nonRegistry = /* @__PURE__ */ new Set();
+  const declared = [];
+  let section = null;
+  let inSpecs = false;
+  let currentGem = null;
+  const specLine = /^\s{4}([A-Za-z0-9_.-]+)\s*\(([^)]*)\)\s*$/;
+  const nestedDep = /^\s{6}([A-Za-z0-9_.-]+)/;
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    if (!/^\s/.test(line)) {
+      const header = line.trim();
+      section = header === "GEM" ? "gem" : header === "PATH" || header === "GIT" || header === "PLUGIN SOURCE" ? "path-or-git" : header === "DEPENDENCIES" ? "dependencies" : null;
+      inSpecs = false;
+      currentGem = null;
+      continue;
+    }
+    if (section === "dependencies") {
+      const d = /^\s{2}([A-Za-z0-9_.-]+)(!?)/.exec(line);
+      if (d?.[1] && d[2] !== "!") declared.push(d[1]);
+      continue;
+    }
+    if (!section) continue;
+    if (/^\s{2}specs:\s*$/.test(line)) {
+      inSpecs = true;
+      currentGem = null;
+      continue;
+    }
+    if (/^\s{2}\S/.test(line)) {
+      inSpecs = false;
+      currentGem = null;
+      continue;
+    }
+    if (!inSpecs) continue;
+    const spec = specLine.exec(line);
+    if (spec) {
+      const name2 = spec[1];
+      const version2 = (spec[2] ?? "").trim();
+      if (section === "path-or-git") {
+        nonRegistry.add(name2);
+        currentGem = null;
+        continue;
+      }
+      if (!version2) continue;
+      currentGem = { name: name2, version: version2 };
+      registryVersions.set(name2, version2);
+      const purl = `pkg:gem/${name2}@${version2}`;
+      if (!seen.has(purl)) {
+        seen.add(purl);
+        components.push({ purl, name: name2, version: version2, ecosystem: "gem" });
+      }
+      continue;
+    }
+    const nested = nestedDep.exec(line);
+    if (nested?.[1] && currentGem) {
+      dependencies.push({
+        ref: `pkg:gem/${currentGem.name}@${currentGem.version}`,
+        dependsOn: [nested[1]]
+      });
+    }
+  }
+  const resolved = dependencies.map((d) => ({
+    ref: d.ref,
+    dependsOn: d.dependsOn.filter((n) => !nonRegistry.has(n) && registryVersions.has(n)).map((n) => `pkg:gem/${n}@${registryVersions.get(n)}`)
+  })).filter((d) => d.dependsOn.length > 0);
+  const direct = rankDirect(
+    declared.filter((n) => !nonRegistry.has(n) && registryVersions.has(n)).map((n) => ({ name: n, version: registryVersions.get(n) })),
+    "gem"
+  );
+  return {
+    components,
+    dependencies: dedupeRefs(resolved),
+    ...direct.length > 0 ? { direct } : {}
+  };
+}
+function dedupeRefs(deps) {
+  const byRef = /* @__PURE__ */ new Map();
+  for (const d of deps) {
+    const set2 = byRef.get(d.ref) ?? /* @__PURE__ */ new Set();
+    for (const t of d.dependsOn) set2.add(t);
+    byRef.set(d.ref, set2);
+  }
+  return [...byRef.entries()].map(([ref, set2]) => ({ ref, dependsOn: [...set2] }));
+}
 var init_lockfile = __esm({
   "../../packages/shared/src/lockfile.ts"() {
     "use strict";
@@ -15437,10 +15739,307 @@ var init_lockfile = __esm({
 });
 
 // ../../packages/shared/src/manifests.ts
+function isManifestPath(p) {
+  return MANIFEST_PATH_RE.test(p);
+}
+function basename(p) {
+  const ix = p.lastIndexOf("/");
+  return ix === -1 ? p : p.slice(ix + 1);
+}
+function parseCsproj(path, text) {
+  const deps = [];
+  for (const m of text.matchAll(/<PackageReference\s+Include="([^"]+)"(?:\s+Version="([^"]+)")?/g)) {
+    deps.push({ ecosystem: "nuget", name: m[1] ?? "", version: m[2] ?? null, kind: "package", manifest: path });
+  }
+  for (const m of text.matchAll(/<Project\s+Sdk="([^"/]+)(?:\/([^"]+))?"/g)) {
+    const sdk = m[1] ?? "";
+    if (sdk.toLowerCase() !== "microsoft.net.sdk") {
+      deps.push({ ecosystem: "nuget", name: sdk, version: m[2] ?? null, kind: "sdk", manifest: path });
+    }
+  }
+  for (const m of text.matchAll(/<TargetFramework>([^<]+)<\/TargetFramework>/g)) {
+    const mm = /^net(\d+\.\d+)/.exec((m[1] ?? "").trim());
+    if (mm) deps.push({ ecosystem: "dotnet", name: "dotnet", version: mm[1] ?? null, kind: "runtime", manifest: path });
+  }
+  return deps;
+}
+function parseGodot(path, text) {
+  const m = /config\/features=PackedStringArray\(([^)]*)\)/.exec(text);
+  if (!m) return [];
+  const feats = (m[1] ?? "").split(",").map((f) => f.trim().replace(/^"|"$/g, "")).filter((f) => f.length > 0);
+  const version2 = feats.find((f) => /^\d+\.\d+/.test(f)) ?? null;
+  return [{ ecosystem: "godot", name: "godot", version: version2, kind: "engine", manifest: path }];
+}
+function parsePackageJson(path, text) {
+  let obj;
+  try {
+    obj = JSON.parse(text);
+  } catch {
+    return [];
+  }
+  if (!obj || typeof obj !== "object") return [];
+  const deps = [];
+  for (const key of PACKAGE_JSON_SECTIONS) {
+    const section = obj[key];
+    if (!section || typeof section !== "object") continue;
+    for (const [name2, ver] of Object.entries(section)) {
+      const version2 = ver ? String(ver) : null;
+      deps.push({ ecosystem: "npm", name: name2, version: version2, kind: "package", manifest: path });
+    }
+  }
+  return deps;
+}
+function isPep508DirectRef(spec) {
+  return /^[A-Za-z0-9][A-Za-z0-9._-]*(?:\[[^\]]*\])?\s*@\s*\S/.test(spec.trim());
+}
+function parseRequirements(path, text) {
+  const deps = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const line = (raw.split("#", 1)[0] ?? "").trim();
+    if (!line || line.startsWith("-") || line.startsWith("git+") || line.startsWith("http")) continue;
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*(?:([=<>!~]+)\s*([^\s;]+))?/.exec(line);
+    if (m) {
+      deps.push({
+        ecosystem: "pypi",
+        name: m[1] ?? "",
+        version: m[2] ? m[3] ?? null : null,
+        kind: "package",
+        manifest: path,
+        ...isPep508DirectRef(line) ? { directRef: true } : {}
+      });
+    }
+  }
+  return deps;
+}
+function parsePyproject(path, text) {
+  const deps = [];
+  const m = /^\s*dependencies\s*=\s*\[([\s\S]*?)\]/m.exec(text);
+  if (!m) return deps;
+  for (const s of (m[1] ?? "").matchAll(/"([^"]+)"|'([^']+)'/g)) {
+    const spec = s[1] || s[2] || "";
+    const mm = /^([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(spec);
+    if (mm) {
+      deps.push({
+        ecosystem: "pypi",
+        name: mm[1] ?? "",
+        version: null,
+        kind: "package",
+        manifest: path,
+        ...isPep508DirectRef(spec) ? { directRef: true } : {}
+      });
+    }
+  }
+  return deps;
+}
+function parseDocker(path, text) {
+  const deps = [];
+  for (const m of text.matchAll(/^\s*(?:image:\s*|FROM\s+(?:--platform=\S+\s+)?)["']?([^\s"']+)/gm)) {
+    const ref = m[1] ?? "";
+    if (ref.toLowerCase() === "scratch" || ref.includes("$") || LOCAL_IMAGE_RE.test(ref)) continue;
+    const at = ref.indexOf("@");
+    const undigested = at === -1 ? ref : ref.slice(0, at);
+    const colon = undigested.indexOf(":");
+    const name2 = colon === -1 ? undigested : undigested.slice(0, colon);
+    const tag = colon === -1 ? "" : undigested.slice(colon + 1);
+    deps.push({ ecosystem: "docker", name: name2, version: tag || null, kind: "image", manifest: path });
+  }
+  return deps;
+}
+function parseGoMod(path, text) {
+  const deps = [];
+  for (const m of text.matchAll(/^\s*(?:require\s+)?([a-z0-9.\-]+\.[a-z]+\/[^\s]+)\s+(v[^\s]+)/gm)) {
+    const end = (m.index ?? 0) + m[0].length;
+    if (text.slice(end, end + 20).includes("// indirect")) continue;
+    deps.push({ ecosystem: "golang", name: m[1] ?? "", version: m[2] ?? null, kind: "package", manifest: path });
+  }
+  return deps;
+}
+function parseCargo(path, text) {
+  const deps = [];
+  const sec = /^\[dependencies\]([\s\S]*?)(?=^\[|(?![\s\S]))/m.exec(text);
+  if (!sec) return deps;
+  for (const m of (sec[1] ?? "").matchAll(/^\s*([A-Za-z0-9_-]+)\s*=\s*(?:"([^"]+)"|\{[^}]*version\s*=\s*"([^"]+)")/gm)) {
+    deps.push({ ecosystem: "cargo", name: m[1] ?? "", version: m[2] ?? m[3] ?? null, kind: "package", manifest: path });
+  }
+  return deps;
+}
+function mavenName(groupId, artifactId) {
+  return `${groupId.trim()}:${artifactId.trim()}`;
+}
+function parsePom(path, text) {
+  const deps = [];
+  const coord = (block) => {
+    const g = /<groupId>([^<]+)<\/groupId>/.exec(block)?.[1];
+    const a = /<artifactId>([^<]+)<\/artifactId>/.exec(block)?.[1];
+    if (!g || !a) return null;
+    return { g, a, v: /<version>([^<]+)<\/version>/.exec(block)?.[1]?.trim() ?? null };
+  };
+  for (const m of text.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const c = coord(m[1] ?? "");
+    if (c) deps.push({ ecosystem: "maven", name: mavenName(c.g, c.a), version: c.v, kind: "package", manifest: path });
+  }
+  for (const m of text.matchAll(/<parent>([\s\S]*?)<\/parent>/g)) {
+    const c = coord(m[1] ?? "");
+    if (c) deps.push({ ecosystem: "maven", name: mavenName(c.g, c.a), version: c.v, kind: "sdk", manifest: path });
+  }
+  return deps;
+}
+function parseGradle(path, text) {
+  const deps = [];
+  const re = new RegExp(`\\b(?:${GRADLE_CONFIGS})\\s*(?:\\(\\s*)?["']([^"']+)["']`, "g");
+  for (const m of text.matchAll(re)) {
+    const parts2 = (m[1] ?? "").split(":");
+    const [group, artifact, version2] = parts2;
+    if (!group || !artifact || parts2.length < 2) continue;
+    deps.push({
+      ecosystem: "maven",
+      name: mavenName(group, artifact),
+      version: version2?.trim() || null,
+      kind: "package",
+      manifest: path
+    });
+  }
+  return deps;
+}
+function parseVersionCatalog(path, text) {
+  const section = /^\s*\[libraries\]([\s\S]*?)(?=^\s*\[|(?![\s\S]))/m.exec(text);
+  if (!section) return [];
+  const deps = [];
+  for (const line of (section[1] ?? "").split(/\r?\n/)) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    const module2 = /module\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
+    const version2 = /version(?:\.ref)?\s*=\s*["']([^"']+)["']/.exec(line)?.[1] ?? null;
+    if (module2) {
+      const [group2, artifact2] = module2.split(":");
+      if (group2 && artifact2) {
+        deps.push({ ecosystem: "maven", name: mavenName(group2, artifact2), version: version2, kind: "package", manifest: path });
+      }
+      continue;
+    }
+    const group = /\bgroup\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
+    const artifact = /\bname\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
+    if (group && artifact) {
+      deps.push({ ecosystem: "maven", name: mavenName(group, artifact), version: version2, kind: "package", manifest: path });
+    }
+  }
+  return deps;
+}
+function parseGemfile(path, text) {
+  const deps = [];
+  for (const raw of text.split(/\r?\n/)) {
+    const line = (raw.split("#", 1)[0] ?? "").trim();
+    const m = /^gem\s+["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/.exec(line);
+    if (!m?.[1]) continue;
+    deps.push({ ecosystem: "gem", name: m[1], version: m[2] ?? null, kind: "package", manifest: path });
+  }
+  return deps;
+}
+function parseGemspec(path, text) {
+  const deps = [];
+  for (const m of text.matchAll(
+    /\.add_(?:runtime_|development_)?dependency\s*\(?\s*["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/g
+  )) {
+    if (m[1]) deps.push({ ecosystem: "gem", name: m[1], version: m[2] ?? null, kind: "package", manifest: path });
+  }
+  return deps;
+}
+function tomlTable(text, header) {
+  const escaped = header.replace(/[.[\]]/g, "\\$&");
+  return new RegExp(`^\\s*\\[${escaped}\\]([\\s\\S]*?)(?=^\\s*\\[|(?![\\s\\S]))`, "m").exec(text)?.[1] ?? null;
+}
+function tomlName(table) {
+  return table && /^\s*name\s*=\s*["']([^"']+)["']/m.exec(table)?.[1]?.trim() || null;
+}
+function pomSelf(text) {
+  const parentGroup = /<groupId>([^<]+)<\/groupId>/.exec(/<parent>([\s\S]*?)<\/parent>/.exec(text)?.[1] ?? "")?.[1];
+  const own = text.replace(POM_FOREIGN_BLOCKS, "");
+  const group = (/<groupId>([^<]+)<\/groupId>/.exec(own)?.[1] ?? parentGroup)?.trim();
+  const artifact = /<artifactId>([^<]+)<\/artifactId>/.exec(own)?.[1]?.trim();
+  if (!group) return [];
+  const self = [{ ecosystem: "maven", kind: "namespace", value: group }];
+  if (artifact) self.push({ ecosystem: "maven", kind: "name", value: mavenName(group, artifact) });
+  return self;
+}
+function parseManifestSelf(path, text) {
+  const file2 = basename(path);
+  if (file2 === "package.json") {
+    let obj;
+    try {
+      obj = JSON.parse(text);
+    } catch {
+      return [];
+    }
+    const name2 = obj && typeof obj === "object" ? obj["name"] : null;
+    if (typeof name2 !== "string" || !name2.trim()) return [];
+    const self = [{ ecosystem: "npm", kind: "name", value: name2.trim() }];
+    const scope = /^(@[^/]+)\//.exec(name2.trim())?.[1];
+    if (scope) self.push({ ecosystem: "npm", kind: "namespace", value: scope });
+    return self;
+  }
+  if (file2 === "pom.xml") return pomSelf(text);
+  if (file2 === "build.gradle" || file2 === "build.gradle.kts") {
+    const group = /^\s*group\s*(?:=\s*)?["']([^"']+)["']/m.exec(text)?.[1]?.trim();
+    return group ? [{ ecosystem: "maven", kind: "namespace", value: group }] : [];
+  }
+  if (file2 === "Cargo.toml") {
+    const name2 = tomlName(tomlTable(text, "package"));
+    return name2 ? [{ ecosystem: "cargo", kind: "name", value: name2 }] : [];
+  }
+  if (file2 === "pyproject.toml") {
+    const name2 = tomlName(tomlTable(text, "project")) ?? tomlName(tomlTable(text, "tool.poetry"));
+    return name2 ? [{ ecosystem: "pypi", kind: "name", value: name2 }] : [];
+  }
+  if (file2 === "go.mod") {
+    const module2 = /^\s*module\s+(\S+)/m.exec(text)?.[1];
+    return module2 ? [{ ecosystem: "golang", kind: "namespace", value: module2 }] : [];
+  }
+  if (file2.endsWith(".gemspec")) {
+    const name2 = /\.name\s*=\s*["']([^"']+)["']/.exec(text)?.[1]?.trim();
+    return name2 ? [{ ecosystem: "gem", kind: "name", value: name2 }] : [];
+  }
+  if (file2.endsWith(".csproj") || file2.endsWith(".fsproj")) {
+    const id = /<PackageId>([^<]+)<\/PackageId>/.exec(text)?.[1]?.trim() ?? file2.replace(/\.(cs|fs)proj$/, "");
+    return id ? [{ ecosystem: "nuget", kind: "name", value: id }] : [];
+  }
+  return [];
+}
+function parseManifest(path, text) {
+  const name2 = basename(path);
+  if (name2.endsWith(".csproj") || name2.endsWith(".fsproj")) return parseCsproj(path, text);
+  if (name2 === "project.godot") return parseGodot(path, text);
+  if (name2 === "package.json") return parsePackageJson(path, text);
+  if (name2.startsWith("requirements") && name2.endsWith(".txt")) return parseRequirements(path, text);
+  if (name2 === "pyproject.toml") return parsePyproject(path, text);
+  if (name2.startsWith("docker-compose") || name2.startsWith("compose") || name2.startsWith("Dockerfile")) {
+    return parseDocker(path, text);
+  }
+  if (name2 === "go.mod") return parseGoMod(path, text);
+  if (name2 === "libs.versions.toml") return parseVersionCatalog(path, text);
+  if (name2 === "Cargo.toml") return parseCargo(path, text);
+  if (name2 === "pom.xml") return parsePom(path, text);
+  if (name2 === "build.gradle" || name2 === "build.gradle.kts") return parseGradle(path, text);
+  if (name2 === "Gemfile") return parseGemfile(path, text);
+  if (name2.endsWith(".gemspec")) return parseGemspec(path, text);
+  return [];
+}
+function buildSpine(sha2, manifestPaths2, readText) {
+  const manifests = {};
+  for (const p of manifestPaths2) {
+    const deps = parseManifest(p, readText(p));
+    if (deps.length > 0) manifests[p] = deps;
+  }
+  return { sha: sha2, manifests };
+}
+var MANIFEST_PATH_RE, LOCAL_IMAGE_RE, PACKAGE_JSON_SECTIONS, GRADLE_CONFIGS, POM_FOREIGN_BLOCKS;
 var init_manifests = __esm({
   "../../packages/shared/src/manifests.ts"() {
     "use strict";
     init_identity();
+    MANIFEST_PATH_RE = /(^|\/)(?:[^/]+\.csproj|[^/]+\.fsproj|project\.godot|package\.json|requirements[^/]*\.txt|pyproject\.toml|docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|Dockerfile(?:\.[^/]+)?|go\.mod|Cargo\.toml|pom\.xml|build\.gradle(?:\.kts)?|libs\.versions\.toml|Gemfile|[^/]+\.gemspec)$/;
+    LOCAL_IMAGE_RE = /^(openbane|local)[/-]|:local$/;
+    PACKAGE_JSON_SECTIONS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+    GRADLE_CONFIGS = "implementation|api|compileOnly|compileOnlyApi|runtimeOnly|testImplementation|testCompileOnly|testRuntimeOnly|annotationProcessor|kapt|ksp|classpath|developmentOnly";
+    POM_FOREIGN_BLOCKS = /<(parent|dependencies|dependencyManagement|build|profiles|reporting|distributionManagement|modules)>[\s\S]*?<\/\1>/g;
   }
 });
 
@@ -15620,6 +16219,10 @@ var init_review = __esm({
 });
 
 // ../../packages/local-shared/src/anchorable.ts
+function isAnchorableCodePath(relPath) {
+  const p = relPath.toLowerCase();
+  return BY_LENGTH.some((ext) => p.endsWith(ext));
+}
 function anchorableExtensionAlternation() {
   return BY_LENGTH.map((e) => e.slice(1).replace(/[+.]/g, (c) => `\\${c}`)).join("|");
 }
@@ -18835,7 +19438,7 @@ async function Module2(moduleArg = {}) {
   _fd_close.sig = "ii";
   var INT53_MAX = 9007199254740992;
   var INT53_MIN = -9007199254740992;
-  var bigintToI53Checked = /* @__PURE__ */ __name((num) => num < INT53_MIN || num > INT53_MAX ? NaN : Number(num), "bigintToI53Checked");
+  var bigintToI53Checked = /* @__PURE__ */ __name((num2) => num2 < INT53_MIN || num2 > INT53_MAX ? NaN : Number(num2), "bigintToI53Checked");
   function _fd_seek(fd, offset, whence, newOffset) {
     offset = bigintToI53Checked(offset);
     return 70;
@@ -18853,7 +19456,7 @@ async function Module2(moduleArg = {}) {
     }
   }, "printChar");
   var _fd_write = /* @__PURE__ */ __name((fd, iov, iovcnt, pnum) => {
-    var num = 0;
+    var num2 = 0;
     for (var i2 = 0; i2 < iovcnt; i2++) {
       var ptr = LE_HEAP_LOAD_U32((iov >> 2) * 4);
       var len = LE_HEAP_LOAD_U32((iov + 4 >> 2) * 4);
@@ -18861,9 +19464,9 @@ async function Module2(moduleArg = {}) {
       for (var j = 0; j < len; j++) {
         printChar(fd, HEAPU8[ptr + j]);
       }
-      num += len;
+      num2 += len;
     }
-    LE_HEAP_STORE_U32((pnum >> 2) * 4, num);
+    LE_HEAP_STORE_U32((pnum >> 2) * 4, num2);
     return 0;
   }, "_fd_write");
   _fd_write.sig = "iippp";
@@ -24627,12 +25230,13 @@ function installHistoryCacheFloor(db) {
 }
 
 // ../../packages/local-graph/src/session-evidence.ts
+var arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
+var scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
+var SESSION_EVIDENCE_FIELDS = [...arrays, ...scalars, "citeAnchorHints"];
 function repairSessionEvidence(input, aliases = /* @__PURE__ */ new Map()) {
   const mapping = new Map(aliases);
   const uuid3 = "[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}";
   const codex = new RegExp(`^codex:(?:rollout-.*?)?(${uuid3})$`, "i");
-  const arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
-  const scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
   const discover = (value, key = "") => {
     if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
       const match = value.match(codex);
@@ -24730,6 +25334,7 @@ function localEdgeViolation(fromLabel, type, toLabel) {
   return verdict.ok ? null : verdict.reason ?? "edge rule violation";
 }
 var SCHEMA_VERSION = 6;
+var SESSION_EVIDENCE_PREDICATE = SESSION_EVIDENCE_FIELDS.map((field) => `instr(attrs_json, '${JSON.stringify(field)}') > 0`).join(" OR ");
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS schema_version (
   version INTEGER PRIMARY KEY
@@ -24822,6 +25427,10 @@ CREATE UNIQUE INDEX IF NOT EXISTS edges_triple ON edges(from_id, type, to_id);
 `;
 var TEMPORAL_INDEX_SQL = `
 CREATE INDEX IF NOT EXISTS nodes_live ON nodes(label, valid_to);
+CREATE INDEX IF NOT EXISTS nodes_live_count ON nodes(valid_to);
+CREATE INDEX IF NOT EXISTS nodes_live_recent ON nodes(label, last_updated_at DESC) WHERE valid_to IS NULL;
+CREATE INDEX IF NOT EXISTS nodes_session_evidence ON nodes(id) WHERE ${SESSION_EVIDENCE_PREDICATE};
+CREATE INDEX IF NOT EXISTS edges_session_evidence ON edges(id) WHERE ${SESSION_EVIDENCE_PREDICATE};
 -- Covering + partial index for labelFingerprint over the instance labels: the
 -- live-push probe runs it per workspace on a timer, and each hit used to read
 -- its table row. Partial, so it maintains a few thousand rows instead of adding
@@ -25191,12 +25800,13 @@ var SqliteGraphStore = class {
     });
   }
   repairSessionAliases(canonical, aliases = []) {
+    if (canonical && aliases.length === 0) return 0;
     const mapping = new Map(aliases.map((alias) => [alias, canonical]));
     let changed = 0;
     for (const table of ["nodes", "edges"]) {
       const predicates = canonical ? aliases.map(() => "instr(attrs_json, ?) > 0") : ["instr(attrs_json, 'codex:') > 0", "instr(attrs_json, 'discriminatorSource') > 0"];
       if (!predicates.length) continue;
-      const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE ${predicates.join(" OR ")}`).all(...canonical ? aliases : []);
+      const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE (${SESSION_EVIDENCE_PREDICATE}) AND (${predicates.join(" OR ")})`).all(...canonical ? aliases.map((alias) => JSON.stringify(alias)) : []);
       const update = this.db.prepare(`UPDATE ${table} SET attrs_json = ?${table === "edges" ? ", type = CASE WHEN type = 'CONFIRMS' AND json_extract(?, '$.provisional') = 1 THEN 'INDICATES' ELSE type END" : ""} WHERE id = ?`);
       for (const row of rows) {
         const attrs = JSON.stringify(repairSessionEvidence(JSON.parse(row.attrs_json), mapping));
@@ -25422,6 +26032,25 @@ var SqliteGraphStore = class {
     const rows = this.db.prepare("SELECT id FROM nodes WHERE label = ? AND valid_to IS NULL ORDER BY last_updated_at DESC LIMIT ?").all(label, Math.max(0, limit));
     return rows.map((r) => r.id);
   }
+  recentOpenProblemCandidates(opts) {
+    if (!Number.isSafeInteger(opts.limit) || opts.limit < 0) {
+      throw new RangeError("candidate limit must be a non-negative safe integer");
+    }
+    return this.db.prepare(`SELECT id, description FROM nodes
+      WHERE label = 'Problem' AND valid_to IS NULL
+        AND json_extract(attrs_json, '$.resolvedAt') IS NULL
+        AND json_type(attrs_json, '$.mergedInto') IS NULL
+        AND (? IS NULL OR id != ?)
+        AND (json_type(attrs_json, '$.workspaceId') IS NULL OR json_extract(attrs_json, '$.workspaceId') = ?)
+        AND COALESCE(json_extract(attrs_json, '$.kind') = 'constraint', 0) = ?
+      ORDER BY last_updated_at DESC, rowid ASC LIMIT ?`).all(
+      opts.excludeId ?? null,
+      opts.excludeId ?? null,
+      opts.workspaceId,
+      opts.constraint ? 1 : 0,
+      opts.limit
+    );
+  }
   hasLiveNodes() {
     const r = this.db.prepare("SELECT EXISTS(SELECT 1 FROM nodes WHERE valid_to IS NULL) AS e").get();
     return r.e === 1;
@@ -26359,6 +26988,14 @@ function isConstraintProblem(node) {
   return node.attrs["kind"] === "constraint";
 }
 var RECURRENCE_DEBOUNCE_MS = 60 * 60 * 1e3;
+function resolveFileNode(store2, path, workspaceId) {
+  const want = path.trim().replace(/^\.?\//, "");
+  for (const n of store2.findNodesByLabel("File")) {
+    if (n.attrs["workspaceId"] && n.attrs["workspaceId"] !== workspaceId) continue;
+    if (n.attrs["relPath"] === want || n.description === want) return n;
+  }
+  return null;
+}
 var CITABLE_PRIOR_LABELS = /* @__PURE__ */ new Set([
   "Solution",
   "RootCause",
@@ -26428,6 +27065,127 @@ function priorsForFile(store2, relPath) {
     solutionsByProblem
   };
 }
+function anchorProblemToWorkingFile(store2, problemId, relPath, workspaceId, ts, provenance = "edited", opts = {}) {
+  const p = store2.getNode(problemId);
+  if (!p || p.label !== "Problem" && p.label !== "Vulnerability") return false;
+  if (p.label === "Vulnerability" && provenance !== "witnessed") return false;
+  if (!isAnchorableCodePath(relPath)) return false;
+  const file2 = resolveFileNode(store2, relPath, workspaceId);
+  if (!file2) return false;
+  const already = new Set(store2.outEdges(problemId, ["ANCHORED_AT"]).map((e) => e.to));
+  const confidence = provenance === "witnessed" ? 0.4 : 0.3;
+  if (!already.has(file2.id)) {
+    store2.mergeEdge({
+      id: `edge_${digest({ from: problemId, type: "ANCHORED_AT", to: file2.id })}`.slice(0, 24),
+      from: problemId,
+      to: file2.id,
+      type: "ANCHORED_AT",
+      confidence,
+      extractionSource: "agent-observed",
+      createdAt: ts,
+      lastSeenAt: ts,
+      navSuccesses: 0,
+      navFailures: 0,
+      attrs: { provisional: true, captureTime: true, anchorProvenance: provenance }
+    });
+  }
+  if (opts.line !== void 0 && opts.fileText !== void 0) {
+    const sym = resolveEnclosingSymbol(store2, file2.id, opts.line, opts.fileText);
+    if (sym && !already.has(sym.id)) {
+      store2.mergeEdge({
+        id: `edge_${digest({ from: problemId, type: "ANCHORED_AT", to: sym.id })}`.slice(0, 24),
+        from: problemId,
+        to: sym.id,
+        type: "ANCHORED_AT",
+        confidence,
+        extractionSource: "agent-observed",
+        createdAt: ts,
+        lastSeenAt: ts,
+        navSuccesses: 0,
+        navFailures: 0,
+        attrs: {
+          provisional: true,
+          captureTime: true,
+          anchorProvenance: provenance,
+          anchorLine: opts.line,
+          enclosingSymbol: true,
+          // PJ-anchor-version: WHICH version of the symbol this was witnessed
+          // against. `bodyHash` is the indexer's 16-hex sha256 of the body;
+          // `headSha` is the checkout's HEAD at capture. Both opaque, both
+          // cross the membrane on the anchor edge, and a teammate's reanchor
+          // compares the hash with their own symbol to tell "current" from
+          // "pre-change" — the branch hazard where a fix witnessed on feat/x
+          // would otherwise read as a fact about the unchanged symbol on dev.
+          ...typeof sym.attrs["bodyHash"] === "string" ? { symbolContentHash: sym.attrs["bodyHash"] } : {},
+          ...opts.headSha ? { observedAtCommit: opts.headSha } : {}
+        }
+      });
+    }
+  }
+  return true;
+}
+var ENCLOSING_SYMBOL_KINDS = /* @__PURE__ */ new Set([
+  "Function",
+  "Class",
+  "Method",
+  "Module",
+  "Interface",
+  "Const",
+  "Enum",
+  "TypeAlias",
+  "Namespace",
+  "Property"
+]);
+var ENCLOSING_WALK_DEPTH = 8;
+function resolveEnclosingSymbol(store2, fileId, line, fileText) {
+  if (!Number.isFinite(line) || line < 1) return null;
+  const row = Math.floor(line) - 1;
+  const lineStarts = [0];
+  for (let i2 = 0; i2 < fileText.length; i2++) if (fileText.charCodeAt(i2) === 10) lineStarts.push(i2 + 1);
+  const rowOf = (index) => {
+    let lo = 0;
+    let hi = lineStarts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (lineStarts[mid] <= index) lo = mid;
+      else hi = mid - 1;
+    }
+    return lo;
+  };
+  let best = null;
+  let bestStart = -1;
+  let bestSpan = Number.POSITIVE_INFINITY;
+  const seen = /* @__PURE__ */ new Set([fileId]);
+  let frontier = [fileId];
+  for (let depth = 0; depth < ENCLOSING_WALK_DEPTH && frontier.length > 0; depth++) {
+    const next = [];
+    for (const id of frontier) {
+      for (const e of store2.outEdges(id, ["DEFINES"])) {
+        if (seen.has(e.to)) continue;
+        seen.add(e.to);
+        const n = store2.getNode(e.to);
+        if (!n) continue;
+        next.push(n.id);
+        if (!ENCLOSING_SYMBOL_KINDS.has(n.label)) continue;
+        const startRow = n.attrs["startRow"];
+        const startByte = n.attrs["startByte"];
+        const endByte = n.attrs["endByte"];
+        if (typeof startRow !== "number" || typeof startByte !== "number" || typeof endByte !== "number") continue;
+        if (startRow < 0 || endByte < startByte) continue;
+        const endRow = rowOf(Math.max(startByte, Math.min(endByte, fileText.length) - 1));
+        if (row < startRow || row > endRow) continue;
+        const span = endByte - startByte;
+        if (startRow > bestStart || startRow === bestStart && span < bestSpan) {
+          best = n;
+          bestStart = startRow;
+          bestSpan = span;
+        }
+      }
+    }
+    frontier = next;
+  }
+  return best;
+}
 function recordAnchorHint(store2, problemId, relPath, provenance, ts) {
   const p = store2.getNode(problemId);
   if (!p || p.label !== "Problem") return false;
@@ -26437,6 +27195,49 @@ function recordAnchorHint(store2, problemId, relPath, provenance, ts) {
   });
   return true;
 }
+function openAnchorHint(p) {
+  const h = p.attrs["anchorHint"];
+  if (!h || typeof h.path !== "string" || h.upgradedAt) return null;
+  return { path: h.path, ts: typeof h.ts === "number" ? h.ts : 0 };
+}
+function consumeAnchorHint(store2, p, ts) {
+  const hint = p.attrs["anchorHint"];
+  store2.updateNode(p.id, { attrs: { ...p.attrs, anchorHint: { ...hint, upgradedAt: ts } } });
+  deriveContextFromAnchors(store2, p.id, ts);
+}
+function upgradeAnchorHints(store2, workspaceId, ts) {
+  let upgraded = 0;
+  let standing = 0;
+  let unresolvable = 0;
+  let blocked = 0;
+  const filesByPath = /* @__PURE__ */ new Map();
+  for (const f of store2.findNodesByLabel("File")) {
+    if (f.attrs["workspaceId"] && f.attrs["workspaceId"] !== workspaceId) continue;
+    const rel = typeof f.attrs["relPath"] === "string" ? f.attrs["relPath"] : f.description;
+    if (rel && !filesByPath.has(rel)) filesByPath.set(rel, f);
+  }
+  for (const p of store2.findNodesByLabel("Problem")) {
+    if (p.validTo != null || p.attrs["resolvedAt"]) continue;
+    const hint = openAnchorHint(p);
+    if (!hint) continue;
+    const file2 = filesByPath.get(hint.path.trim().replace(/^\.?\//, ""));
+    if (!file2 || !isAnchorableCodePath(hint.path)) {
+      unresolvable++;
+      continue;
+    }
+    standing++;
+    const changedAt = Number(file2.attrs["contentChangedAt"] ?? 0);
+    if (changedAt <= hint.ts) continue;
+    if (anchorProblemToWorkingFile(store2, p.id, hint.path, workspaceId, ts, "hint-confirmed")) {
+      consumeAnchorHint(store2, p, ts);
+      upgraded++;
+      standing--;
+    } else {
+      blocked++;
+    }
+  }
+  return { upgraded, standing, unresolvable, blocked };
+}
 function reopenAutoClosedProblems(store2, t) {
   const report = { reopened: 0, alreadySuspect: 0, agentDescribed: 0 };
   for (const p of store2.findNodesByLabel("Problem")) {
@@ -27174,7 +27975,380 @@ function rankToolsForHandles(store2, limit = 5) {
 init_src2();
 
 // ../../packages/local-graph/src/mechanism-liveness.ts
+var STALL_MIN_RUNS = 3;
 var STALL_MIN_SPAN_MS = 60 * 60 * 1e3;
+var MECHANISMS = [
+  {
+    id: "refute-local-stamp",
+    what: "stamps a harvested refute witness onto the LOCAL node (refutedAt/refutations/reason)",
+    // Stamped at harvest, so the capture pass carries the effect counter.
+    pass: "capture",
+    // Refutes are rare by design (a verdict, not a lean-on) — the bar is "the
+    // field is written at all", the revisitAnsweredWhen precedent. RG-mark
+    // ships the producer; RG-recall is the ranking consumer — until it lands,
+    // THIS descriptor is the consumer, which is exactly the condition the
+    // probe exists to keep visible rather than let rot silently.
+    fed: {
+      labels: ["Problem", "Solution", "RootCause", "Pattern"],
+      attr: "refutedAt",
+      minFraction: 0
+    },
+    effectCounter: "refutesStamped",
+    note: "RG-mark; reason text is local-only (wire ships nodeId+witnessKey)"
+  },
+  {
+    id: "regression-recognize",
+    what: "marks a resolved problem as resolutionSuspect when it recurs at the door",
+    pass: "capture",
+    // Regressions are rare and precious — written-at-all bar, like refutedAt.
+    fed: {
+      labels: ["Problem"],
+      attr: "recurredAt",
+      minFraction: 0
+    },
+    effectCounter: "recurrencesMarked",
+    note: "RG-recognize tier A (exact-id door); tiers B/C add REGRESSION_OF edges; reopen is RG-reopen's"
+  },
+  {
+    id: "regression-reopen",
+    what: "flips a marked close back open once two DISTINCT sessions witnessed the recurrence",
+    pass: "capture",
+    // Reopens should be rarer than recurrences by construction — written-at-all.
+    fed: {
+      labels: ["Problem"],
+      attr: "reopenedFrom",
+      minFraction: 0
+    },
+    effectCounter: "reopenedFromRegression",
+    note: "RG-reopen; the machine sweep never counts as a witness \u2014 only sessions do"
+  },
+  {
+    id: "fix-candidate-ask",
+    what: "asks an agent whether an edit to a problem's anchor fixed it",
+    pass: "semantic-maintenance",
+    // markFixCandidates fails CLOSED on a File anchor with no contentChangedAt —
+    // correct (the alternative manufactured 92 asks out of no-op reindexes) and
+    // exactly why coverage must be watched rather than assumed. Measured over
+    // the recently-TOUCHED files, because the stamp is forward-only: whole-corpus
+    // coverage on this store is ~0.5% and says nothing about whether the
+    // producer works.
+    fed: { labels: ["File"], attr: "contentChangedAt", minFraction: 0.02, recent: 200 },
+    effectCounter: "fixCandidatesSettled",
+    // Standing asks ARE the queue: 94 of them sat forever while the sweep
+    // reported zero every run, and nothing could tell that from a clean backlog.
+    backlogCounter: "fixCandidatesStanding",
+    note: "stamped forward-only; measured over the 200 newest File nodes"
+  },
+  {
+    id: "revisit-sweep",
+    what: "retires a revisit ask once its recorded condition is met",
+    pass: "semantic-maintenance",
+    fed: {
+      labels: ["Solution", "Problem", "RootCause", "Pattern"],
+      attr: "revisitAnsweredWhen",
+      // Only FLAGGED nodes carry it, and flags are rare by design, so the bar is
+      // "the field is written at all" — it was written zero times before this.
+      minFraction: 0
+    },
+    effectCounter: "revisitsCleared",
+    backlogCounter: "revisitsStanding"
+  },
+  {
+    id: "ingest-sequence",
+    what: "orders knowledge arrivals so decay is driven by superseding info, not the clock",
+    // CAPTURE, not semantic-maintenance. The sequence advances where knowledge
+    // ENTERS the graph, and the maintenance pass never mints — so pointing this
+    // at maintenance named a counter that is structurally always zero and the
+    // mechanism read IDLE forever while stamping every new node. A descriptor
+    // that cannot report an effect is the same defect it exists to detect.
+    pass: "capture",
+    fed: {
+      labels: ["Problem", "Solution", "RootCause", "Pattern"],
+      attr: "__createdAtSeq",
+      // UNIVERSAL stamp: every semantic node minted after the producer went live
+      // carries a sequence position, so the honest metric is "of the nodes born
+      // since the first stamp, how many are stamped" — an invariant that should
+      // read ~1.0 always. The 173k pre-fix nodes are deliberately never
+      // backfilled (inventing a sequence position would feed the decay math
+      // fabricated evidence it would read as real), and a recent-N window would
+      // have to turn over 50 nodes before it could go green: it read 6% while
+      // the producer was verifiably stamping every new node.
+      minFraction: 0.9,
+      recent: 200,
+      sinceFirstStamp: true
+    },
+    effectCounter: "seqAdvanced",
+    note: "column, not attr; measured over nodes born since the first stamp in the recent window"
+  },
+  {
+    id: "render-ledger",
+    what: "records which priors actually reached the agent, so an answer rate has a denominator",
+    // RENDER, not semantic-maintenance — `shown` only moves during a render, so
+    // attributing it elsewhere named an always-zero counter (same defect as
+    // ingest-sequence's, found alongside it).
+    pass: "render",
+    fed: {
+      labels: ["Problem", "Solution", "RootCause", "Pattern"],
+      attr: "shownCount",
+      minFraction: 5e-3
+    },
+    effectCounter: "shown"
+  },
+  {
+    id: "contribution-ship",
+    what: "carries local knowledge across the membrane to the cloud, and records the door's verdict",
+    pass: "ship",
+    // FED = nodes that have actually crossed. `contributedAtSeq` is stamped
+    // only after the door accepts, so a fed reading is proof the whole chain
+    // (build → generalize → drain → accept) ran, not merely that a timer fired.
+    // The instance lane sat DEAD for 13 days behind a 422 nobody surfaced —
+    // this row is the instrument that would have caught it on day one.
+    fed: {
+      labels: ["Problem", "Solution", "RootCause"],
+      attr: "contributedAtSeq",
+      minFraction: 0.01
+    },
+    effectCounter: "accepted",
+    // Rising = knowledge piling up locally that never crossed. A backlog that
+    // climbs while `accepted` stays flat is the shape of a silently-closed door.
+    backlogCounter: "candidates"
+  },
+  {
+    id: "orphan-reap",
+    what: "closes File nodes whose path the indexer no longer covers",
+    pass: "orphan-reap",
+    // Stranded lineage is the CONDITION this clears, so a rising reading is bad;
+    // it is declared fed-by-liveness so the row exists and the pass is watched.
+    fed: { labels: ["File"], attr: "relPath", minFraction: 0.9 },
+    effectCounter: "reaped"
+  },
+  {
+    id: "prior-corroboration",
+    what: "grounds a cited prior by overlap with what the session actually touched",
+    // CAPTURE mints the edges and stamps the verdict; the fed metric is the
+    // corroborated fraction of the newest priorTag edges. Measured 2026-08-08:
+    // 1 of 139 recent despite 84 having a live grounding path — reading STARVED
+    // is the honest state until the touched-set plumbing is fixed
+    // (VS-corroboration-rate); an alarm on a genuinely broken channel is what
+    // alarms are for.
+    pass: "capture",
+    fedEdges: { marker: '"priorTag":true', attr: "corroborated", minFraction: 0.02, recent: 100 },
+    effectCounter: "corroboratedEdges",
+    note: "expected STARVED until VS-corroboration-rate lands \u2014 the channel is genuinely starved"
+  },
+  {
+    id: "anchor-hint-upgrade",
+    what: "promotes a read-grade anchor hint once its file is edited while the problem stays open",
+    // The maintenance sweep is the reliable invoker (the harvest seam also
+    // counts into capture's anchorHintsUpgraded, but only on edited turns).
+    pass: "semantic-maintenance",
+    // Conditional stamp: only flagged-during-read Problems carry a hint. 302
+    // held one at mechanism birth (census 2026-08-09) — the fed floor is
+    // "the field exists at all", the revisit-sweep precedent.
+    fed: { labels: ["Problem"], attr: "anchorHint", minFraction: 0 },
+    effectCounter: "anchorHintsUpgraded",
+    // The gauge is the work the mechanism CAN act on and didn't: hints whose file
+    // changed after the hint yet never upgraded. `anchorHintsStanding` also
+    // counts hints still waiting for their file to be edited — a queue that
+    // drains on the user's schedule, which read STUCK over any quiet stretch
+    // (2026-09-23: 71 standing, none edited, toasted daily). Standing stays in
+    // the ledger as information; it just cannot declare a stall.
+    backlogCounter: "anchorHintsBlocked",
+    note: "a hint upgrades when its file is next edited; stuck means an edited file's hint failed to anchor"
+  },
+  {
+    id: "fold-candidate-resolve",
+    what: "resolves parked paraphrase-fold nominations (embedding-certain bands auto, ambiguous band via the equivalence judge)",
+    // The settle boundary's fold-judge pass is the sole consumer of
+    // attrs.foldCandidate; producers are the file/workspace scouts (capture)
+    // and the settle near-miss band (mergeProblemsByEmbedding).
+    pass: "fold-judge",
+    // Conditional mark, rare by design (a nomination is a near-miss event) —
+    // the bar is "the field is written at all", the revisit-sweep precedent.
+    fed: { labels: ["Problem"], attr: "foldCandidate", minFraction: 0 },
+    effectCounter: "folded",
+    // Standing nominations ARE the judge-less backlog — without the gauge a
+    // deployment with no judge configured reads as "nothing to fold".
+    backlogCounter: "standing",
+    configCounter: "judgeConfigured",
+    note: "the ambiguous band needs the opt-in judge: set ERRATA_FOLD_JUDGE=1 + a configured chat provider (azure env), or leave it off and the nominations stand"
+  },
+  {
+    id: "cite-anchor-accrual",
+    what: "accrues cite-context anchor evidence on anchorless cited priors; two distinct sessions promote a cite-confirmed ANCHORED_AT",
+    pass: "capture",
+    // Conditional attr: only anchorless semantic priors cited from a known
+    // working file carry hints — "written at all" is the honest floor.
+    fed: { labels: ["Problem"], attr: "citeAnchorHints", minFraction: 0 },
+    effectCounter: "citeAnchorsPromoted",
+    note: "the supply-side fix for corroboration 0-for-8: promoted anchors are what the overlap gate intersects on the NEXT citation"
+  },
+  {
+    id: "wm-reinforce-exposure",
+    what: "labels each paraphrase re-derivation with the prior's exposure (shown/evicted/unshown)",
+    // The producer runs inside capture's fold path (reinforceSameAnchorProblem),
+    // but capture cannot count it without threading the fold verdict up through
+    // ingestDesignProblem — so the WM-JOIN reading is the observable: the
+    // wm-calibration pass reads the stamped counters as levels every tick.
+    pass: "wm-calibration",
+    // Conditional stamp, rare by design (a paraphrase fold is a few-per-day
+    // event) — the bar is "the field is written at all", the revisit-sweep
+    // precedent. Zero everywhere = the outcome site never fired, which was
+    // this store's measured state on 2026-08-09, day one of WM-labels.
+    fed: { labels: ["Problem"], attr: "lastReinforceExposure", minFraction: 0 },
+    // A LEVEL, not an increment: nonzero once any node ever carried an outcome.
+    // Which is precisely why it must be read as movement — measured across the
+    // 103 retained rows it never left 1, and the summed reading called that
+    // "effect 103, ok".
+    effectCounter: "reinforcedNodes",
+    effectIsLevel: true,
+    note: "levels ride the wm-calibration row; expect no-effect until outcome data accrues"
+  },
+  {
+    id: "wm-leaned-exposure",
+    what: "classifies a leaned-cite's exposure at outcome time (the display-confounded cell)",
+    // CAPTURE parses the cite and classifies against the render stamps — the
+    // gate's input is `lastShownAtSeq`, the render ledger's seq stamp.
+    pass: "capture",
+    fed: {
+      labels: ["Problem", "Solution", "RootCause", "Pattern"],
+      attr: "lastShownAtSeq",
+      minFraction: 5e-3
+    },
+    effectCounter: "exposureOutcomes",
+    note: "0 with live render stamps = no lean-cites parsed, not a broken classifier"
+  },
+  {
+    id: "liveness-watch",
+    what: "the daemon-side schedule of this very verdict \u2014 alarms when a mechanism stops working",
+    // The watcher is itself a row: a probe that only runs when a human remembers
+    // is how the original six defects shipped, and a scheduled watch that
+    // silently stops running is the same failure one level up. Its `invoked …
+    // ago` column is the reading that matters.
+    pass: "liveness-watch",
+    // It reads the pass LEDGER, not a node attribute; minFraction 0 makes the
+    // fed gate structurally unfailable (the same "field written at all" bar as
+    // revisit-sweep) so this row can only ever alarm on invocation.
+    fed: { labels: ["Problem"], attr: "revisitReason", minFraction: 0 },
+    // Alarms ARE its state transitions; zero on a healthy store, so the steady
+    // reading is IDLE — correct, and it declares no backlog on purpose.
+    effectCounter: "alarms",
+    note: "steady-state IDLE is healthy; the row exists for its invocation age"
+  }
+];
+var COLUMN_INPUTS = {
+  __createdAtSeq: (n) => n.createdAtSeq !== void 0 && n.createdAtSeq !== null
+};
+function evaluateFed(store2, d) {
+  if (d.fedEdges) {
+    const { count: count2, total } = store2.recentEdgeAttrCoverage(
+      d.fedEdges.marker,
+      d.fedEdges.attr,
+      d.fedEdges.recent
+    );
+    return { count: count2, total, fraction: total === 0 ? 0 : count2 / total };
+  }
+  if (!d.fed) return { count: 0, total: 0, fraction: 0 };
+  const column = COLUMN_INPUTS[d.fed.attr];
+  const fed = d.fed;
+  const has = (n) => column ? column(n) : n.attrs[fed.attr] !== void 0;
+  const nodes = fed.labels.flatMap((label) => store2.findNodeAttrsByLabel(label));
+  let window2 = nodes;
+  if (fed.recent !== void 0) {
+    window2 = [...nodes].sort((a, b) => b.createdAt - a.createdAt).slice(0, fed.recent);
+  }
+  if (fed.sinceFirstStamp) {
+    let anchor = Infinity;
+    for (const n of window2) if (has(n) && n.createdAt < anchor) anchor = n.createdAt;
+    window2 = anchor === Infinity ? [] : window2.filter((n) => n.createdAt >= anchor);
+  }
+  let count = 0;
+  for (const n of window2) if (has(n)) count++;
+  return { count, total: window2.length, fraction: window2.length === 0 ? 0 : count / window2.length };
+}
+function evaluateMechanisms(store2, invocations = /* @__PURE__ */ new Map(), mechanisms = MECHANISMS) {
+  return mechanisms.map((d) => {
+    const fed = evaluateFed(store2, d);
+    const inv = invocations.get(d.pass);
+    const effectCount = d.effectIsLevel ? Math.max(
+      0,
+      (inv?.lastTotals?.[d.effectCounter] ?? 0) - (inv?.firstTotals?.[d.effectCounter] ?? 0)
+    ) : inv?.totals[d.effectCounter] ?? 0;
+    const backlog = d.backlogCounter ? inv?.lastTotals?.[d.backlogCounter] : void 0;
+    const backlogWas = d.backlogCounter ? inv?.firstTotals?.[d.backlogCounter] : void 0;
+    const span = inv?.firstTs === void 0 ? 0 : inv.lastTs - inv.firstTs;
+    const stalled = backlog !== void 0 && backlog > 0 && effectCount === 0 && (inv?.runs ?? 0) >= STALL_MIN_RUNS && span >= STALL_MIN_SPAN_MS && (backlogWas === void 0 || backlog >= backlogWas);
+    let verdict;
+    if (!inv || inv.runs === 0) verdict = "never-invoked";
+    else if (d.configCounter && inv.lastTotals?.[d.configCounter] === 0) verdict = "unconfigured";
+    else if (fed.fraction < (d.fedEdges?.minFraction ?? d.fed?.minFraction ?? 0)) verdict = "starved";
+    else if (stalled) verdict = "stalled";
+    else if (effectCount === 0) verdict = "no-effect";
+    else verdict = "ok";
+    return {
+      id: d.id,
+      what: d.what,
+      pass: d.pass,
+      fedCount: fed.count,
+      fedTotal: fed.total,
+      fedFraction: fed.fraction,
+      minFraction: d.fedEdges?.minFraction ?? d.fed?.minFraction ?? 0,
+      ...inv ? { lastInvokedMs: inv.lastTs } : {},
+      runs: inv?.runs ?? 0,
+      effectCount,
+      ...backlog !== void 0 ? { backlog } : {},
+      ...backlogWas !== void 0 ? { backlogWas } : {},
+      ...inv?.firstTs !== void 0 ? { spanMs: span } : {},
+      verdict,
+      ...d.note ? { note: d.note } : {}
+    };
+  });
+}
+
+// ../../packages/local-graph/src/wm-calibration.ts
+var WM_CALIBRATION_LABELS = [
+  "Problem",
+  "Solution",
+  "RootCause",
+  "Pattern",
+  "Technique",
+  "AntiPattern"
+];
+var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+function wmCalibrationCells(store2) {
+  const cells = {
+    shownNodes: 0,
+    shownImpressions: 0,
+    evictedNodes: 0,
+    evictedImpressions: 0,
+    reinforceShown: 0,
+    reinforceEvicted: 0,
+    reinforceUnshown: 0,
+    reinforcedNodes: 0
+  };
+  for (const label of WM_CALIBRATION_LABELS) {
+    for (const n of store2.findNodesByLabel(label)) {
+      const shown = num(n.attrs["shownCount"]);
+      const evicted = num(n.attrs["evictedCount"]);
+      if (shown > 0) {
+        cells.shownNodes++;
+        cells.shownImpressions += shown;
+      }
+      if (evicted > 0) {
+        cells.evictedNodes++;
+        cells.evictedImpressions += evicted;
+      }
+      const rs = num(n.attrs["reinforceShownCount"]);
+      const re = num(n.attrs["reinforceEvictedCount"]);
+      const ru = num(n.attrs["reinforceUnshownCount"]);
+      cells.reinforceShown += rs;
+      cells.reinforceEvicted += re;
+      cells.reinforceUnshown += ru;
+      if (rs + re + ru > 0) cells.reinforcedNodes++;
+    }
+  }
+  return cells;
+}
 
 // ../../packages/generalizer/src/generalizer.ts
 init_src2();
@@ -28004,6 +29178,381 @@ async function reconcileStaleFiles(store2, rootPath, workspaceId) {
   return total;
 }
 
+// src/workspace-maintenance.ts
+function runWorkspaceMaintenance(store2, workspaceId) {
+  const seqBefore = store2.currentIngestSeq();
+  const report = runSemanticMaintenance(store2);
+  let hintUpgrade = { upgraded: 0, standing: 0, unresolvable: 0, blocked: 0 };
+  try {
+    hintUpgrade = upgradeAnchorHints(store2, workspaceId, Date.now());
+  } catch {
+  }
+  let calibration = null;
+  const calibrationStarted = Date.now();
+  try {
+    calibration = wmCalibrationCells(store2);
+  } catch {
+  }
+  return {
+    report,
+    hintUpgrade,
+    seqAdvanced: store2.currentIngestSeq() - seqBefore,
+    calibration,
+    calibrationMs: Date.now() - calibrationStarted
+  };
+}
+
+// src/retrieval-stack.ts
+init_src();
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
+var MANIFEST_SCAN_CAP = 400;
+var PUBLIC_NPM_HOSTS = /* @__PURE__ */ new Set(["registry.npmjs.org", "registry.yarnpkg.com"]);
+var PUBLIC_PYPI_HOSTS = /* @__PURE__ */ new Set(["pypi.org", "files.pythonhosted.org", "pypi.python.org"]);
+var PUBLIC_NUGET_HOSTS = /* @__PURE__ */ new Set(["api.nuget.org", "www.nuget.org", "nuget.org"]);
+var PUBLIC_GEM_HOSTS = /* @__PURE__ */ new Set(["rubygems.org", "index.rubygems.org"]);
+var PUBLIC_MAVEN_HOSTS = /* @__PURE__ */ new Set([
+  "repo.maven.apache.org",
+  "repo1.maven.org",
+  "central.sonatype.com",
+  "oss.sonatype.org",
+  "dl.google.com",
+  "maven.google.com",
+  "plugins.gradle.org"
+]);
+function ecoKey(ecosystem, name2) {
+  return `${ecosystem.toLowerCase()}\0${name2.toLowerCase()}`;
+}
+function selfIdentityFrom(selves) {
+  const selfNames = /* @__PURE__ */ new Set();
+  const selfNamespaces = /* @__PURE__ */ new Set();
+  for (const s of selves) {
+    (s.kind === "name" ? selfNames : selfNamespaces).add(ecoKey(s.ecosystem, s.value));
+  }
+  return { selfNames, selfNamespaces };
+}
+function hostOf(value) {
+  try {
+    return new URL(value.trim()).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function urlIsPublic(value, publicHosts) {
+  const host = hostOf(value);
+  return host !== null && publicHosts.has(host);
+}
+var unquote = (s) => s.trim().replace(/^['"]|['"]$/g, "");
+function parseNpmrcPolicy(texts) {
+  let defaultPublic = null;
+  const privateScopes = /* @__PURE__ */ new Set();
+  const decidedScopes = /* @__PURE__ */ new Set();
+  for (const text of texts) {
+    for (const rawLine of text.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+      const eq = line.indexOf("=");
+      if (eq === -1) continue;
+      const key = line.slice(0, eq).trim().toLowerCase();
+      const value = line.slice(eq + 1).trim();
+      if (key === "registry") {
+        if (defaultPublic === null) defaultPublic = urlIsPublic(value, PUBLIC_NPM_HOSTS);
+        continue;
+      }
+      const scoped = /^(@[^:]+):registry$/.exec(key);
+      if (!scoped) continue;
+      const scope = (scoped[1] ?? "").toLowerCase();
+      if (decidedScopes.has(scope)) continue;
+      decidedScopes.add(scope);
+      if (!urlIsPublic(value, PUBLIC_NPM_HOSTS)) privateScopes.add(scope);
+    }
+  }
+  return { defaultPublic: defaultPublic ?? true, privateScopes };
+}
+function pypiIndexIsPrivate(texts) {
+  for (const text of texts) {
+    if (/^\s*\[\[?\s*tool\.(poetry\.source|uv\.index)\s*\]\]?/m.test(text)) {
+      const urls = [...text.matchAll(/^\s*url\s*=\s*(.+)$/gm)].map((m) => unquote(m[1] ?? ""));
+      if (urls.length === 0 || urls.some((u) => !urlIsPublic(u, PUBLIC_PYPI_HOSTS))) return true;
+    }
+    for (const m of text.matchAll(/^\s*(?:-i\b|--?(?:extra-)?index-url)\s*[=:]?\s*(\S+)/gm)) {
+      if (!urlIsPublic(unquote(m[1] ?? ""), PUBLIC_PYPI_HOSTS)) return true;
+    }
+    for (const m of text.matchAll(/^\s*(?:extra-)?index-url\s*=\s*(\S+)/gm)) {
+      if (!urlIsPublic(unquote(m[1] ?? ""), PUBLIC_PYPI_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function cargoRegistryIsPrivate(texts) {
+  return texts.some(
+    (t) => /^\s*\[registries(\.|\])/m.test(t) || /^\s*replace-with\s*=/m.test(t)
+  );
+}
+function nugetSourcesArePrivate(texts) {
+  for (const text of texts) {
+    const block = /<packageSources>([\s\S]*?)<\/packageSources>/i.exec(text);
+    if (!block) continue;
+    for (const m of (block[1] ?? "").matchAll(/<add\b[^>]*\bvalue\s*=\s*"([^"]+)"/gi)) {
+      if (!urlIsPublic(m[1] ?? "", PUBLIC_NUGET_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function parseGoPrivate(values) {
+  return values.flatMap((v) => (v ?? "").split(",")).map((s) => s.trim()).filter(Boolean);
+}
+function mavenReposArePrivate(texts) {
+  for (const text of texts) {
+    if (/<servers>[\s\S]*?<server>/i.test(text)) return true;
+    for (const m of text.matchAll(/<(?:repository|pluginRepository|mirror)\b[\s\S]*?<\/(?:repository|pluginRepository|mirror)>/gi)) {
+      const url2 = /<url>([^<]+)<\/url>/i.exec(m[0])?.[1];
+      if (!url2 || !urlIsPublic(url2, PUBLIC_MAVEN_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function gemSourceIsPrivate(texts) {
+  for (const text of texts) {
+    for (const m of text.matchAll(/^\s*source\s+["']([^"']+)["']/gm)) {
+      if (!urlIsPublic(m[1] ?? "", PUBLIC_GEM_HOSTS)) return true;
+    }
+  }
+  return false;
+}
+function privateGemNamesIn(texts) {
+  const names = /* @__PURE__ */ new Set();
+  for (const text of texts) {
+    for (const raw of text.split(/\r?\n/)) {
+      const line = (raw.split("#", 1)[0] ?? "").trim();
+      const m = /^gem\s+["']([^"']+)["']/.exec(line);
+      if (!m?.[1]) continue;
+      if (/(?::(?:git|path|github|gist|bitbucket)\s*=>|\b(?:git|path|github|gist|bitbucket):\s)/.test(line)) {
+        names.add(m[1]);
+      }
+    }
+  }
+  return names;
+}
+function selfTokensFromLocator(repoLocator) {
+  if (!repoLocator) return [];
+  const segments = repoLocator.toLowerCase().split("/").slice(1).filter(Boolean);
+  return [...new Set(segments.filter((s) => s.length >= 3))];
+}
+function loadRegistryPolicy(root, env2 = process.env, repoLocator) {
+  const read = (p) => {
+    try {
+      return readFileSync3(p, "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const texts = (...paths2) => paths2.map(read).filter((t) => t !== null);
+  const home = homedir3();
+  const npm = parseNpmrcPolicy(texts(join6(root, ".npmrc"), join6(home, ".npmrc")));
+  const blocked = /* @__PURE__ */ new Set();
+  if (!npm.defaultPublic) blocked.add("npm");
+  if (pypiIndexIsPrivate(
+    texts(
+      join6(root, "pip.conf"),
+      join6(root, "pip.ini"),
+      join6(root, "pyproject.toml"),
+      join6(root, "requirements.txt"),
+      join6(home, ".pip", "pip.conf"),
+      join6(home, ".config", "pip", "pip.conf"),
+      join6(env2["APPDATA"] ?? home, "pip", "pip.ini")
+    )
+  )) {
+    blocked.add("pypi");
+  }
+  if (cargoRegistryIsPrivate(
+    texts(
+      join6(root, ".cargo", "config.toml"),
+      join6(root, ".cargo", "config"),
+      join6(home, ".cargo", "config.toml"),
+      join6(home, ".cargo", "config")
+    )
+  )) {
+    blocked.add("cargo");
+  }
+  if (nugetSourcesArePrivate(
+    texts(
+      join6(root, "NuGet.config"),
+      join6(root, "nuget.config"),
+      join6(root, "NuGet.Config"),
+      join6(env2["APPDATA"] ?? home, "NuGet", "NuGet.Config"),
+      join6(home, ".nuget", "NuGet", "NuGet.Config")
+    )
+  )) {
+    blocked.add("nuget");
+  }
+  const goEnvFile = env2["GOENV"] ?? join6(env2["APPDATA"] ?? join6(home, ".config"), "go", "env");
+  const goEnvText = read(goEnvFile) ?? "";
+  const fromFile = ["GOPRIVATE", "GONOSUMDB", "GONOSUMCHECK"].map(
+    (k) => new RegExp(`^${k}=(.*)$`, "m").exec(goEnvText)?.[1]
+  );
+  const goPrivatePatterns = parseGoPrivate([
+    env2["GOPRIVATE"],
+    env2["GONOSUMDB"],
+    env2["GONOSUMCHECK"],
+    ...fromFile
+  ]);
+  const gemfiles = texts(join6(root, "Gemfile"));
+  if (gemSourceIsPrivate(gemfiles)) blocked.add("gem");
+  if (mavenReposArePrivate(
+    texts(join6(root, "pom.xml"), join6(home, ".m2", "settings.xml"))
+  )) {
+    blocked.add("maven");
+  }
+  const scan2 = scanManifests(root);
+  return {
+    blockedEcosystems: blocked,
+    npmPrivateScopes: npm.privateScopes,
+    goPrivatePatterns,
+    privateGemNames: privateGemNamesIn(gemfiles),
+    selfTokens: selfTokensFromLocator(repoLocator),
+    ...selfIdentityFrom(scan2.self),
+    selfComplete: scan2.complete
+  };
+}
+var LOCKFILES = [
+  { file: "pnpm-lock.yaml", family: "npm", parse: parsePnpmLock },
+  { file: "package-lock.json", family: "npm", parse: parsePackageLockJson },
+  { file: "Gemfile.lock", family: "gem", parse: parseGemfileLock }
+];
+var directCache = /* @__PURE__ */ new Map();
+function readDirectDependencies(root) {
+  const stamps = [];
+  const found = [];
+  const familiesSeen = /* @__PURE__ */ new Set();
+  for (const c of LOCKFILES) {
+    if (familiesSeen.has(c.family)) continue;
+    const p = join6(root, c.file);
+    if (!existsSync3(p)) continue;
+    try {
+      const s = statSync4(p);
+      stamps.push(`${c.file}:${s.mtimeMs}:${s.size}`);
+    } catch {
+      continue;
+    }
+    familiesSeen.add(c.family);
+    found.push({ c, path: p });
+  }
+  if (found.length === 0) {
+    directCache.delete(root);
+    return [];
+  }
+  const key = stamps.join("|");
+  const hit = directCache.get(root);
+  if (hit && hit.key === key) return hit.direct;
+  const direct = [];
+  for (const { c, path } of found) {
+    try {
+      direct.push(...c.parse(readFileSync3(path, "utf8")).direct ?? []);
+    } catch {
+    }
+  }
+  directCache.set(root, { key, direct });
+  return direct;
+}
+function manifestPaths(root) {
+  try {
+    const out2 = execFileSync3("git", ["-C", root, "ls-files", "-z"], {
+      encoding: "utf8",
+      maxBuffer: 128 * 1024 * 1024,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const paths2 = out2.split("\0").filter((f) => f && isManifestPath(f));
+    if (paths2.length > 0) {
+      return {
+        paths: paths2.slice(0, MANIFEST_SCAN_CAP),
+        tracked: true,
+        truncated: paths2.length > MANIFEST_SCAN_CAP
+      };
+    }
+  } catch {
+  }
+  const ROOT_MANIFESTS = [
+    "package.json",
+    "pyproject.toml",
+    "requirements.txt",
+    "go.mod",
+    "Cargo.toml",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "gradle/libs.versions.toml",
+    "Gemfile",
+    "docker-compose.yml",
+    "docker-compose.yaml",
+    "compose.yaml",
+    "Dockerfile",
+    "project.godot"
+  ];
+  return {
+    paths: ROOT_MANIFESTS.filter((f) => existsSync3(join6(root, f))),
+    tracked: false,
+    truncated: false
+  };
+}
+var WORKSPACE_MARKERS = ["pnpm-workspace.yaml", "lerna.json", "go.work", "settings.gradle", "settings.gradle.kts"];
+function rootDeclaresWorkspace(root, texts) {
+  if (WORKSPACE_MARKERS.some((f) => existsSync3(join6(root, f)))) return true;
+  return /"workspaces"\s*:/.test(texts.get("package.json") ?? "") || /<modules>/.test(texts.get("pom.xml") ?? "") || /^\s*\[workspace\]/m.test(texts.get("Cargo.toml") ?? "");
+}
+var EMPTY_SCAN = { deps: [], self: [], complete: true };
+var manifestCache = /* @__PURE__ */ new Map();
+function scanManifests(root) {
+  const { paths: paths2, tracked, truncated } = manifestPaths(root);
+  if (paths2.length === 0) {
+    manifestCache.delete(root);
+    return EMPTY_SCAN;
+  }
+  const texts = /* @__PURE__ */ new Map();
+  const stamps = [];
+  for (const rel of paths2) {
+    const abs = join6(root, rel);
+    try {
+      const s = statSync4(abs);
+      stamps.push(`${rel}:${s.mtimeMs}:${s.size}`);
+      texts.set(rel, readFileSync3(abs, "utf8"));
+    } catch {
+    }
+  }
+  const key = stamps.join("|");
+  const hit = manifestCache.get(root);
+  if (hit && hit.key === key) return hit.scan;
+  const scan2 = {
+    deps: [],
+    self: [],
+    complete: !truncated && (tracked || !rootDeclaresWorkspace(root, texts))
+  };
+  try {
+    const spine = buildSpine("workspace", [...texts.keys()], (p) => texts.get(p) ?? "");
+    scan2.deps = Object.values(spine.manifests).flat();
+    for (const [path, text] of texts) scan2.self.push(...parseManifestSelf(path, text));
+  } catch {
+    scan2.deps = [];
+    scan2.self = [];
+    scan2.complete = false;
+  }
+  manifestCache.set(root, { key, scan: scan2 });
+  return scan2;
+}
+function readManifestDependencies(root) {
+  return scanManifests(root).deps;
+}
+function readRetrievalInputs(root, repoLocator) {
+  return {
+    direct: readDirectDependencies(root),
+    manifestDeps: readManifestDependencies(root),
+    registry: loadRegistryPolicy(root, process.env, repoLocator)
+  };
+}
+
 // src/pass-worker.ts
 var init2 = workerData;
 var store = openGraphStore({ path: init2.castaliaPath });
@@ -28017,6 +29566,12 @@ port.on("message", (msg) => {
 });
 function runPass(msg) {
   switch (msg.kind) {
+    case "semanticMaintenance":
+      return runWorkspaceMaintenance(store, init2.workspaceId);
+    case "liveness":
+      return evaluateMechanisms(store, new Map(msg.payload));
+    case "retrievalInputs":
+      return readRetrievalInputs(init2.workspaceRoot, msg.payload);
     case "nightly":
       return runNightly();
     case "reconcile":