@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.10

package/dist/chunk-CRE4BJHM.js

@@ -0,0 +1,408 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  matchedRepoType
+} from "./chunk-XIWYUQZQ.js";
+import {
+  loadCatalog
+} from "./chunk-P3TKKBAH.js";
+import {
+  repoFor
+} from "./chunk-XKS6THI5.js";
+import {
+  draftSpec
+} from "./chunk-Y5PZHS4K.js";
+import {
+  stepJudges
+} from "./chunk-KC5DROFC.js";
+import "./chunk-RK6MKKKP.js";
+import "./chunk-47QE246J.js";
+import "./chunk-XQ3YIV5R.js";
+import "./chunk-MGVYVW7Q.js";
+import "./chunk-NGPU2ARF.js";
+import {
+  checkSpec,
+  citedFileHashes,
+  staleFlows
+} from "./chunk-AY2IUF4K.js";
+import "./chunk-6JLPXDWN.js";
+import "./chunk-4GZXS6S2.js";
+import "./chunk-R4TBNKKC.js";
+import "./chunk-NIXVDQVO.js";
+import "./chunk-UR7RMZ3R.js";
+import "./chunk-JF2NSTFO.js";
+import "./chunk-N4QZJJVB.js";
+import "./chunk-PGKHJYOB.js";
+import {
+  fsRepo
+} from "./chunk-MKRBG5EF.js";
+import "./chunk-5XDNUJ4P.js";
+import {
+  askedByStep,
+  listQuestions,
+  loadOrgPack,
+  orgPackDirOf,
+  questionsRelOf,
+  raiseQuestions,
+  readRepoSpec,
+  readSpecFindings,
+  reusedLine,
+  serializeRecord,
+  specFindingFingerprint,
+  specRelOf,
+  specTemplateFor,
+  templateRef,
+  writeFlow,
+  writeSpecFindings,
+  writeSpecHeader
+} from "./chunk-577AJVRS.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/spec-commands.js
+import { execFile } from "node:child_process";
+import { resolve } from "node:path";
+var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+var quiet = { out: () => {
+}, err: () => {
+} };
+function headOf(dir) {
+  const same = (a, b) => resolve(a).replace(/\\/g, "/").toLowerCase() === resolve(b).replace(/\\/g, "/").toLowerCase();
+  return new Promise((done) => execFile("git", ["-C", dir, "rev-parse", "--show-toplevel", "HEAD"], { timeout: 1e4 }, (e, out) => {
+    const [top, head] = out.trim().split(/\r?\n/);
+    done(!e && top && head && same(top, dir) && /^[0-9a-f]{40}$/.test(head) ? head : void 0);
+  }));
+}
+var noRepo = (target) => `${target} isn't a cloned repo of the manifest or a folder; clone it with atticus workspace sync, or give its folder.`;
+async function context(root, target, io) {
+  const repo = await repoFor(root, target);
+  if (!repo)
+    return void 0;
+  const op = await loadOrgPack(orgPackDirOf(root));
+  const commit = await headOf(repo.dir);
+  const handle = fsRepo(repo.id, repo.dir, commit ?? "0".repeat(40));
+  const repoType = await matchedRepoType(handle, repo.id, op, io);
+  const template = specTemplateFor(op.specTemplates, repoType?.type.id);
+  return { repo, op, handle, commit, repoType, template };
+}
+async function specDraft(root, target, o, deps, io) {
+  const c = await context(root, target, io);
+  if (!c) {
+    io.err(noRepo(target));
+    return 2;
+  }
+  const { repo, op, handle, commit, repoType, template } = c;
+  const { records } = await loadCatalog(root, { out: () => {
+  }, err: (l) => io.err(l) });
+  const before = await readRepoSpec(root, repo.id, { cacheRoot: root });
+  for (const p of before.problems)
+    io.err(`${p.file}: ${p.message}`);
+  const stale = o.force ? [] : await staleFlows(handle, before.flows, before.header?.files ?? {});
+  const staleIds = new Set(stale.map((s) => s.flow));
+  for (const s of stale)
+    io.out(`${s.flow} cites ${s.files.join(", ")}, which changed since it was drafted; it is drafted again.`);
+  const last = await readSpecFindings(root, repo.id);
+  const critic = (last?.findings ?? []).filter((f) => !f.question).map((f) => f.message);
+  const flagged = new Set((last?.findings ?? []).filter((f) => !f.question).map((f) => before.flows.find((x) => f.target.startsWith(`${x.id} `) || f.target === x.id)?.id).filter((x) => !!x));
+  if (flagged.size)
+    io.out(`The last spec check found problems in ${[...flagged].join(", ")}; they are drafted again.`);
+  const redo = /* @__PURE__ */ new Set([...staleIds, ...flagged]);
+  const keep = o.force ? [] : before.flows.filter((f) => !redo.has(f.id));
+  if (!o.force && !o.resume && before.header && redo.size === 0 && critic.length === 0) {
+    if (!await draftSpecNeeded(handle, repo.id, records, template, keep)) {
+      io.out(`Every trigger of ${repo.id} has a flow, no cited file changed and the last check found nothing to fix. Re-run with --force to draft the spec again.`);
+      return 0;
+    }
+  }
+  const questions = (await listQuestions(root, { repo: repo.id })).questions.filter((q) => askedByStep(q, "spec-draft") || askedByStep(q, "spec-check"));
+  const r = await draftSpec(handle, {
+    repoId: repo.id,
+    runtime: deps.runtime,
+    records,
+    template,
+    orgPack: op,
+    ...repoType ? { repoType } : {},
+    questions,
+    keep,
+    onFile: before.flows,
+    critic,
+    maxAttempts: o.attempts ?? 3,
+    ...deps.now ? { now: deps.now } : {},
+    ...o.resume ? { resume: o.resume } : {}
+  });
+  if (r.status === "waiting") {
+    io.out(`Handed the spec to your assistant (run ${r.runId}). When it is done: atticus handoff done ${r.runId}, then atticus spec draft ${repo.id} --resume ${r.runId}`);
+    return 0;
+  }
+  for (const a of r.attempts.filter((x) => x.problems.length > 0)) {
+    io.out(`Attempt ${a.attempt}: ${plural(a.problems.length, "problem")}, handed back:`);
+    for (const p of a.problems)
+      io.out(`  - ${p}`);
+  }
+  const at = (deps.now ?? /* @__PURE__ */ new Date()).toISOString();
+  const rel = specRelOf(root, repo.id);
+  for (const f of r.flows)
+    await writeFlow(root, repo.id, f);
+  const fresh = new Set(r.flows.map((f) => f.id));
+  const left = [];
+  for (const f of before.flows.filter((x) => redo.has(x.id) && !fresh.has(x.id))) {
+    if (!staleIds.has(f.id)) {
+      left.push(f);
+      continue;
+    }
+    const marked = { ...f, flags: [.../* @__PURE__ */ new Set([...f.flags ?? [], "stale"])] };
+    await writeFlow(root, repo.id, marked);
+    left.push(marked);
+  }
+  const byId = new Map([...keep, ...left].map((f) => [f.id, f]));
+  for (const f of r.flows)
+    byId.set(f.id, f);
+  const all = [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
+  const hashes = {
+    ...before.header?.files ?? {},
+    ...await citedFileHashes(handle, [...keep.filter((f) => !fresh.has(f.id)), ...r.flows])
+  };
+  const rerun = `atticus spec draft ${repo.id}`;
+  const judges = stepJudges(root, deps.runtime, repo.id, new Date(at));
+  const { raised, known, reused } = await raiseQuestions(root, r.questions, {
+    step: "spec-draft",
+    repo: repo.id,
+    command: rerun,
+    rerun,
+    ...r.runId ? { run: r.runId } : {},
+    at
+  }, judges);
+  const open = [...raised, ...known.filter((q) => q.state === "open")].map((q) => q.id);
+  const header = {
+    schemaVersion: 1,
+    repo: repo.id,
+    ...commit ? { commit } : {},
+    template: templateRef(template),
+    // The default template ships with Atticus; a repo type's is reviewed in its PR, and a
+    // person sets this once it has merged.
+    templateReviewed: template.repoType === "default" || before.header?.template === templateRef(template) && before.header.templateReviewed,
+    drafted: { at, ...r.runId ? { run: r.runId } : {} },
+    flows: all.map((f) => f.id),
+    files: hashes,
+    questions: [.../* @__PURE__ */ new Set([...before.header?.questions ?? [], ...open])].sort()
+  };
+  if (r.flows.length || !before.header)
+    await writeSpecHeader(root, header);
+  else
+    await writeSpecHeader(root, { ...header, drafted: before.header.drafted ?? header.drafted });
+  if (r.flows.length)
+    io.out(`Wrote ${plural(r.flows.length, "flow")} in ${rel}/ (template ${header.template}${header.templateReviewed ? "" : ", not yet reviewed"}):`);
+  for (const f of r.flows) {
+    const checked = f.steps.filter((s) => s.confirmedBy === "check").length;
+    io.out(`  ${f.id}: ${f.name} (${plural(f.steps.length, "step")}, ${checked} confirmed by the check${f.family.length ? `, stands for ${f.family.length} more` : ""})`);
+  }
+  for (const f of r.failed)
+    io.out(`  not written: ${f.flow}, still failing: ${f.problems.join("; ")}`);
+  for (const t of r.uncovered)
+    io.out(`  no flow yet: ${t.kind} ${t.label} (${t.id})`);
+  if (raised.length) {
+    io.out(`${plural(raised.length, "question")} for a person, in ${questionsRelOf(root)}/:`);
+    for (const q of raised)
+      io.out(`  ${q.id} ${q.question}`);
+  }
+  for (const q of reused)
+    io.out(reusedLine(q));
+  if (r.status === "failed") {
+    io.out(`No flow passed its checks in ${plural(r.attempts.length, "attempt")}; nothing new was written.`);
+    return 1;
+  }
+  io.out(`Next: atticus spec check ${repo.id}, then review ${rel}/ in a pull request.`);
+  return 0;
+}
+async function draftSpecNeeded(handle, repoId, records, template, flows) {
+  const r = await checkSpec({ repo: handle, repoId, flows, records, template });
+  return r.triggers.some((t) => !t.flow);
+}
+function findingQuestion(f, evidence) {
+  return {
+    question: `The spec check found this again after the flows were drafted again: ${f.message}. What should the flow say?`,
+    options: [],
+    evidence: [evidence],
+    scope: "repo"
+  };
+}
+async function specCheck(root, target, o, io) {
+  const c = await context(root, target, o.json ? quiet : io);
+  if (!c) {
+    io.err(noRepo(target));
+    return 2;
+  }
+  const { repo, handle, template } = c;
+  const spec = await readRepoSpec(root, repo.id, { cacheRoot: root });
+  if (!spec.header && spec.flows.length === 0) {
+    io.err(`${repo.id} has no spec yet. Draft it: atticus spec draft ${repo.id}`);
+    return 2;
+  }
+  const { records } = await loadCatalog(root, { out: () => {
+  }, err: (l) => io.err(l) });
+  const onFile = (await listQuestions(root, { repo: repo.id })).questions.filter((q) => q.state !== "retired");
+  const r = await checkSpec({
+    repo: handle,
+    repoId: repo.id,
+    flows: spec.flows,
+    records,
+    template,
+    questions: onFile
+  });
+  const findings = [...r.findings];
+  for (const p of spec.problems)
+    findings.push({
+      rule: "line-missing",
+      target: p.file,
+      message: `${p.file}: ${p.message}`,
+      fingerprint: specFindingFingerprint("unreadable", p.file)
+    });
+  for (const s of await staleFlows(handle, spec.flows, spec.header?.files ?? {}))
+    findings.push({
+      rule: "stale",
+      target: s.flow,
+      message: `${s.flow} cites ${s.files.join(", ")}, which changed since it was drafted; run atticus spec draft ${repo.id}`,
+      fingerprint: specFindingFingerprint("stale", s.flow, s.files.join(",")),
+      flow: s.flow
+    });
+  let confirmedNow = 0;
+  for (const f of r.flows) {
+    const was = spec.flows.find((x) => x.id === f.id);
+    if (serializeRecord(was) === serializeRecord(f))
+      continue;
+    await writeFlow(root, repo.id, f);
+    confirmedNow++;
+  }
+  const prev = await readSpecFindings(root, repo.id);
+  const draftedAt = spec.header?.drafted?.at;
+  const redrafted = !!prev && prev.draftedAt !== draftedAt;
+  const now = (o.now ?? /* @__PURE__ */ new Date()).toISOString();
+  const lines = /* @__PURE__ */ new Map();
+  const exists = async (a) => {
+    const cut = a.lastIndexOf(":");
+    const path = a.slice(0, cut);
+    if (!lines.has(path)) {
+      const t = await handle.readText(path).catch(() => void 0);
+      lines.set(path, t === void 0 ? 0 : t.replace(/\n$/, "").split(/\r?\n/).length);
+    }
+    const n = Number(a.slice(cut + 1));
+    return n >= 1 && n <= lines.get(path);
+  };
+  const stored = [];
+  const toAsk = [];
+  const callers = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const p = prev?.findings.find((x) => x.fingerprint === f.fingerprint);
+    const seen = p ? redrafted ? p.seen + 1 : p.seen : 1;
+    let evidence = f.evidence && await exists(f.evidence) ? f.evidence : void 0;
+    if (!evidence && f.flow) {
+      const t = spec.flows.find((x) => x.id === f.flow)?.trigger.evidence[0];
+      const a = t?.path && t.line ? `${t.path}:${t.line}` : void 0;
+      if (a && await exists(a))
+        evidence = a;
+    }
+    const flow = f.flow ? spec.flows.find((x) => x.id === f.flow) : void 0;
+    if (f.rule === "caller-unknown" && !f.callers?.length && !p?.question && evidence && flow) {
+      const c2 = callers.get(flow.component) ?? { fs: [], labels: [], at: [] };
+      const t = r.triggers.find((x) => x.id === flow.trigger.ref);
+      c2.fs.push(f);
+      c2.labels.push(t?.label ?? flow.trigger.what);
+      if (!c2.at.includes(evidence))
+        c2.at.push(evidence);
+      callers.set(flow.component, c2);
+    } else if (!p?.question && seen >= 2 && evidence)
+      toAsk.push({ fs: [f], q: findingQuestion(f, evidence) });
+    stored.push({
+      fingerprint: f.fingerprint,
+      rule: f.rule,
+      target: f.target,
+      ...f.evidence ? { evidence: f.evidence } : {},
+      message: f.message,
+      seen,
+      ...p?.question ? { question: p.question } : {}
+    });
+  }
+  for (const [component, c2] of callers)
+    toAsk.push({
+      fs: c2.fs,
+      q: {
+        question: `Who calls ${c2.labels.length === 1 ? "this entry point" : "these entry points"} of ${component}, and how does each call arrive (through which gateway, or direct)? ${c2.labels.join("; ")}`,
+        options: [],
+        evidence: c2.at,
+        scope: "repo"
+      }
+    });
+  const rerun = `atticus spec draft ${repo.id}`;
+  const asked = await raiseQuestions(root, toAsk.map((x) => x.q), { step: "spec-check", repo: repo.id, command: `atticus spec check ${repo.id}`, rerun, at: now });
+  const questionIds = [];
+  const callerIds = /* @__PURE__ */ new Set();
+  for (const [i, x] of toAsk.entries()) {
+    const q = asked.of[i];
+    if (!q)
+      continue;
+    questionIds.push(q.id);
+    if (x.fs[0]?.rule === "caller-unknown")
+      callerIds.add(q.id);
+    for (const f of x.fs) {
+      const s = stored.find((y) => y.fingerprint === f.fingerprint);
+      s.question = q.id;
+    }
+  }
+  await writeSpecFindings(root, {
+    schemaVersion: 1,
+    repo: repo.id,
+    checkedAt: now,
+    ...draftedAt ? { draftedAt } : {},
+    findings: stored
+  });
+  if (spec.header && questionIds.length)
+    await writeSpecHeader(root, {
+      ...spec.header,
+      questions: [.../* @__PURE__ */ new Set([...spec.header.questions, ...questionIds])].sort()
+    });
+  const steps = r.flows.reduce((n, f) => n + f.steps.length, 0);
+  const covered = r.triggers.filter((t) => t.flow).length;
+  if (o.json) {
+    io.out(JSON.stringify({
+      repo: repo.id,
+      template: templateRef(template),
+      flows: r.flows.length,
+      steps,
+      confirmedByCheck: r.confirmed,
+      triggers: { total: r.triggers.length, covered },
+      findings: stored,
+      questions: asked.raised.map((q) => q.id)
+    }, null, 2));
+    return stored.length ? 1 : 0;
+  }
+  io.out(`${repo.id}: ${plural(r.flows.length, "flow")}, ${plural(steps, "step")}; ${covered} of ${plural(r.triggers.length, "trigger")} in the catalog have a flow; the check confirmed ${r.confirmed} ${r.confirmed === 1 ? "step" : "steps"} on its cited lines${confirmedNow ? ` (${plural(confirmedNow, "flow file")} updated)` : ""}.`);
+  if (r.unconfirmable)
+    io.out(`  ${plural(r.unconfirmable, "step")} the check can't confirm (transforms, branches, validations, or nothing named to look for); the AI pass and your review confirm those.`);
+  if (stored.length === 0) {
+    io.out("No findings.");
+    return 0;
+  }
+  io.out(`${plural(stored.length, "finding")}:`);
+  for (const f of stored)
+    io.out(`  [${f.rule}] ${f.message}${f.question ? ` (question ${f.question})` : ""}`);
+  const callerQs = asked.raised.filter((q) => callerIds.has(q.id));
+  const backQs = asked.raised.filter((q) => !callerQs.includes(q));
+  if (callerQs.length)
+    io.out(`Nothing in the code or config says who calls some entry points, so ${callerQs.length === 1 ? "a question asks" : "questions ask"} a person in ${questionsRelOf(root)}/: ${callerQs.map((q) => q.id).join(", ")}`);
+  if (backQs.length)
+    io.out(`${plural(backQs.length, "finding")} came back unchanged after a redraft, so ${backQs.length === 1 ? "it is" : "they are"} now ${backQs.length === 1 ? "a question" : "questions"} for a person in ${questionsRelOf(root)}/: ${backQs.map((q) => q.id).join(", ")}`);
+  for (const q of asked.reused)
+    io.out(reusedLine(q));
+  if (asked.raised.length)
+    io.out(`Answer with atticus questions answer <id> --text "...", then run ${rerun}`);
+  else
+    io.out(`Next: ${rerun} hands the findings back to your assistant.`);
+  return 1;
+}
+export {
+  specCheck,
+  specDraft
+};

package/dist/chunk-D3PO4DOZ.js

@@ -0,0 +1,261 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+
+// packages/core/dist/schema/version.js
+var SCHEMA_VERSION = 3;
+
+// packages/core/dist/fs.js
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+async function writeFileAtomic(path, data) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, data, typeof data === "string" ? "utf8" : void 0);
+    await renameRetrying(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
+}
+var BUSY = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+async function renameRetrying(from, to, tries = 9) {
+  for (let i = 0; ; i++) {
+    try {
+      await rename(from, to);
+      return;
+    } catch (e) {
+      const code = e.code ?? "";
+      if (!BUSY.has(code) || i >= tries - 1)
+        throw e;
+      await new Promise((r) => setTimeout(r, 20 * 2 ** i));
+    }
+  }
+}
+var LockHeldError = class extends Error {
+  held;
+  constructor(held) {
+    super(`Another ${held.what} is running (process ${held.pid} on ${held.host}, since ${held.startedAt}). Wait for it to finish.`);
+    this.held = held;
+    this.name = "LockHeldError";
+  }
+};
+var lockFileOf = (root, name) => join(root, ".atticus", "locks", `${name}.json`);
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+async function readLock(root, name) {
+  try {
+    const info = JSON.parse(await readFile(lockFileOf(root, name), "utf8"));
+    const stale = info.host === hostname() ? !alive(info.pid) : false;
+    return { ...info, stale };
+  } catch {
+    return void 0;
+  }
+}
+async function acquireLock(root, name, what, now = () => /* @__PURE__ */ new Date()) {
+  const file = lockFileOf(root, name);
+  await ensureLocalIgnore(root);
+  await mkdir(dirname(file), { recursive: true });
+  const info = {
+    pid: process.pid,
+    host: hostname(),
+    startedAt: now().toISOString(),
+    what
+  };
+  let interrupted;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      await writeFile(file, JSON.stringify(info), { encoding: "utf8", flag: "wx" });
+      const release = async () => {
+        const cur = await readLock(root, name);
+        if (cur && cur.pid === info.pid && cur.startedAt === info.startedAt)
+          await rm(file, { force: true });
+      };
+      return interrupted ? { release, interrupted } : { release };
+    } catch (e) {
+      if (e.code !== "EEXIST")
+        throw e;
+      const held = await readLock(root, name);
+      if (held && !held.stale)
+        throw new LockHeldError(held);
+      if (held) {
+        const { stale: _s, ...rest } = held;
+        interrupted = rest;
+      }
+      await rm(file, { force: true });
+    }
+  }
+  throw new Error(`Couldn't take the ${name} lock at ${file}.`);
+}
+var LOCAL_ONLY = [
+  "me.yaml",
+  "logs/",
+  "locks/",
+  "backups/",
+  "history/",
+  "probe/",
+  "cache/"
+];
+async function ensureLocalIgnore(root) {
+  const file = join(root, ".atticus", ".gitignore");
+  const text = await readFile(file, "utf8").catch(() => "");
+  const have = new Set(text.split(/\r?\n/).map((l) => l.trim()));
+  const missing = LOCAL_ONLY.filter((l) => !have.has(l));
+  if (!missing.length)
+    return;
+  await mkdir(dirname(file), { recursive: true });
+  const prefix = text && !text.endsWith("\n") ? `${text}
+` : text;
+  await writeFile(file, `${prefix}${prefix ? "" : "# This machine's own files: never committed.\n"}${missing.join("\n")}
+`, "utf8");
+}
+
+// packages/core/dist/log.js
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { join as join2 } from "node:path";
+var ORDER = { debug: 10, info: 20, warn: 30, error: 40, off: 100 };
+var LOG_MAX_BYTES = 5 * 1024 * 1024;
+var LOG_KEEP = 3;
+var logFileOf = (root) => join2(root, ".atticus", "logs", "atticus.log");
+var SECRET_KEY = /(token|password|passwd|pwd|secret|api[-_]?key|private[-_]?key|credential|authorization|cookie|session)/i;
+function redactText(s, o = {}) {
+  let out = s.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@\s:]+:[^/@\s]+@/gi, "$1***@").replace(/\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 ***").replace(new RegExp(`(${SECRET_KEY.source})(["']?\\s*[:=]\\s*["']?)([^\\s"',;&]+)`, "gi"), "$1$3***").replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g, "***").replace(/\b(?=[A-Za-z0-9+_-]*\d)(?=[A-Za-z0-9+_-]*[A-Z])(?=[A-Za-z0-9+_-]*[a-z])[A-Za-z0-9+_-]{32,}={0,2}/g, "***");
+  const home = o.home ?? safeHome();
+  if (home && home.length > 3)
+    out = out.split(home).join("~");
+  const user = o.user ?? safeUser();
+  if (user && user.length > 2)
+    out = out.replace(new RegExp(`([\\\\/])${escapeRe(user)}(?=[\\\\/])`, "g"), "$1<user>");
+  return out;
+}
+function redact(v, o = {}) {
+  if (typeof v === "string")
+    return redactText(v, o);
+  if (Array.isArray(v))
+    return v.map((x) => redact(x, o));
+  if (v && typeof v === "object") {
+    const out = {};
+    for (const [k, x] of Object.entries(v))
+      out[k] = SECRET_KEY.test(k) ? "***" : redact(x, o);
+    return out;
+  }
+  return v;
+}
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function safeHome() {
+  try {
+    return homedir();
+  } catch {
+    return void 0;
+  }
+}
+function safeUser() {
+  try {
+    return userInfo().username;
+  } catch {
+    return void 0;
+  }
+}
+function rotate(file, max, keep) {
+  try {
+    if (statSync(file).size < max)
+      return;
+  } catch {
+    return;
+  }
+  rmSync(`${file}.${keep}`, { force: true });
+  for (let i = keep - 1; i >= 1; i--) {
+    try {
+      renameSync(`${file}.${i}`, `${file}.${i + 1}`);
+    } catch {
+    }
+  }
+  try {
+    renameSync(file, `${file}.1`);
+  } catch {
+  }
+}
+function logLevelFrom(env = process.env) {
+  const v = (env.ATTICUS_LOG ?? "").toLowerCase();
+  return v in ORDER ? v : "info";
+}
+function createLog(root, o = {}) {
+  const file = logFileOf(root);
+  const level = o.level ?? logLevelFrom();
+  const now = o.now ?? (() => /* @__PURE__ */ new Date());
+  const write = (lvl, event, fields) => {
+    if (ORDER[lvl] < ORDER[level])
+      return;
+    try {
+      mkdirSync(join2(file, ".."), { recursive: true });
+      ignoreLocalSync(root);
+      rotate(file, o.maxBytes ?? LOG_MAX_BYTES, o.keep ?? LOG_KEEP);
+      const entry = redact({ at: now().toISOString(), level: lvl, event, ...fields });
+      appendFileSync(file, `${JSON.stringify(entry)}
+`, "utf8");
+    } catch {
+    }
+  };
+  return {
+    file,
+    debug: (e, f = {}) => write("debug", e, f),
+    info: (e, f = {}) => write("info", e, f),
+    warn: (e, f = {}) => write("warn", e, f),
+    error: (e, err, f = {}) => write("error", e, {
+      ...f,
+      error: err instanceof Error ? { name: err.name, message: err.message, stack: err.stack?.split("\n").slice(0, 25) } : { message: String(err) }
+    })
+  };
+}
+function ignoreLocalSync(root) {
+  const f = join2(root, ".atticus", ".gitignore");
+  const text = existsSync(f) ? readFileSync(f, "utf8") : "";
+  const have = new Set(text.split(/\r?\n/).map((l) => l.trim()));
+  const missing = LOCAL_ONLY.filter((l) => !have.has(l));
+  if (!missing.length)
+    return;
+  const prefix = text && !text.endsWith("\n") ? `${text}
+` : text;
+  const head = prefix ? "" : "# This machine's own files: never committed.\n";
+  writeFileSync(f, `${prefix}${head}${missing.join("\n")}
+`, "utf8");
+}
+var NO_LOG = {
+  file: "",
+  debug: () => void 0,
+  info: () => void 0,
+  warn: () => void 0,
+  error: () => void 0
+};
+
+export {
+  SCHEMA_VERSION,
+  writeFileAtomic,
+  renameRetrying,
+  LockHeldError,
+  lockFileOf,
+  readLock,
+  acquireLock,
+  LOCAL_ONLY,
+  ensureLocalIgnore,
+  LOG_MAX_BYTES,
+  LOG_KEEP,
+  logFileOf,
+  redactText,
+  redact,
+  logLevelFrom,
+  createLog,
+  NO_LOG
+};