@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.10

package/dist/chunk-YGR6OCHQ.js

@@ -0,0 +1,345 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  denyHashesAt
+} from "./chunk-GXJVY6WT.js";
+import {
+  estateRepos,
+  outsideProfileSystems
+} from "./chunk-AY2IUF4K.js";
+import "./chunk-6JLPXDWN.js";
+import "./chunk-4GZXS6S2.js";
+import {
+  denyListHits
+} from "./chunk-R4TBNKKC.js";
+import "./chunk-NIXVDQVO.js";
+import "./chunk-UR7RMZ3R.js";
+import "./chunk-PGKHJYOB.js";
+import "./chunk-MKRBG5EF.js";
+import "./chunk-5XDNUJ4P.js";
+import {
+  RepoManifest,
+  SHARED_MAP_SCHEMA_VERSION,
+  SharedMapFile,
+  factsDirOf,
+  factsFileOf,
+  isAdopted,
+  isSecretPath,
+  loadOrgPack,
+  orgPackDirOf,
+  parseFactsLines,
+  readSharedMaps,
+  redactSecrets,
+  require_dist,
+  serializeFacts,
+  sharedDirOf,
+  sharedRelOf
+} from "./chunk-577AJVRS.js";
+import {
+  writeFileAtomic
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/shared-commands.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readdir, readFile, rm, mkdir, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+var SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+var SHA = /^[0-9a-f]{7,64}$/;
+var SECRET_WORD = /(password|passwd|secret|token|api[-_]?key|access[-_]?key|private[-_]?key|credential)/i;
+var posix = (p) => p.split("\\").join("/");
+async function headCommitOf(dir) {
+  let git = join(dir, ".git");
+  const s = await stat(git).catch(() => void 0);
+  if (!s)
+    return void 0;
+  if (s.isFile()) {
+    const m = /^gitdir:\s*(.+)$/m.exec(await readFile(git, "utf8"));
+    if (!m)
+      return void 0;
+    git = resolve(dir, m[1].trim());
+  }
+  const head = (await readFile(join(git, "HEAD"), "utf8").catch(() => "")).trim();
+  if (SHA.test(head))
+    return head;
+  const ref = /^ref:\s*(.+)$/.exec(head)?.[1]?.trim();
+  if (!ref)
+    return void 0;
+  const common = (await readFile(join(git, "commondir"), "utf8").catch(() => "")).trim();
+  for (const g of [git, ...common ? [resolve(git, common)] : []]) {
+    const loose = (await readFile(join(g, ...ref.split("/")), "utf8").catch(() => "")).trim();
+    if (SHA.test(loose))
+      return loose;
+    const packed = await readFile(join(g, "packed-refs"), "utf8").catch(() => "");
+    for (const line of packed.split(/\r?\n/)) {
+      const [sha, name] = line.trim().split(/\s+/);
+      if (name === ref && sha && SHA.test(sha))
+        return sha;
+    }
+  }
+  return void 0;
+}
+async function theirManifest(dir) {
+  const out = /* @__PURE__ */ new Map();
+  const profiles = join(orgPackDirOf(dir), "profiles");
+  for (const p of (await readdir(profiles).catch(() => [])).sort()) {
+    const text = await readFile(join(profiles, p, "repos.manifest.yaml"), "utf8").catch(() => void 0);
+    if (text === void 0)
+      continue;
+    let raw;
+    try {
+      raw = (0, import_yaml.parse)(text);
+    } catch {
+      continue;
+    }
+    const m = RepoManifest.safeParse(raw);
+    if (m.success) {
+      for (const r of m.data.repos)
+        if (!out.has(r.id))
+          out.set(r.id, r);
+    }
+  }
+  return out;
+}
+function kept(f) {
+  const q = f.cite.quote;
+  if (q === void 0)
+    return { fact: f, redacted: false };
+  const red = isSecretPath(f.cite.file) ? void 0 : redactSecrets(q);
+  const quote = red !== void 0 && red === q && SECRET_WORD.test(q) ? void 0 : red;
+  if (quote === q)
+    return { fact: f, redacted: false };
+  const { quote: _q, ...cite } = f.cite;
+  return { fact: { ...f, cite: quote ? { ...cite, quote } : cite }, redacted: true };
+}
+async function readTheirMap(root, dir, o) {
+  if (!SLUG.test(o.team))
+    return {
+      ok: false,
+      message: `${o.team} isn't a team id: use a lowercase slug, e.g. forge-risk-team.`
+    };
+  const op = await loadOrgPack(orgPackDirOf(root));
+  const systems = outsideProfileSystems(op);
+  const system = systems.find((s) => s.id === o.system);
+  if (!system)
+    return {
+      ok: false,
+      message: `${o.system} isn't a system of your profiles that no estate repo belongs to (${systems.map((s) => s.id).join(", ") || "none"}). Add their system to a profile, boundary internal, with its host as an alias, then import again.`
+    };
+  const others = (await readSharedMaps(root)).maps.filter((m) => m.system === o.system && m.team !== o.team);
+  if (others.length)
+    return {
+      ok: false,
+      message: `${o.system} already has ${others[0].name}'s map (shared/${others[0].team}/): one map per system.`
+    };
+  const from = resolve(dir);
+  const st = await stat(from).catch(() => void 0);
+  if (!st?.isDirectory())
+    return { ok: false, message: `${dir} isn't a folder.` };
+  const commit = o.commit ?? await headCommitOf(from);
+  if (!commit || !SHA.test(commit))
+    return {
+      ok: false,
+      message: o.commit ? `${o.commit} isn't a commit sha.` : `${dir} isn't a git clone Atticus can read the commit of: say which commit of their metarepo these files are at with --commit <sha>.`
+    };
+  const theirFacts = isAdopted(from) || await stat(factsDirOf(from)).catch(() => void 0) ? factsDirOf(from) : from;
+  const names = (await readdir(theirFacts).catch(() => [])).sort();
+  const files = names.flatMap((n) => {
+    const f = factsFileOf(n);
+    return f?.facts ? [f.repo] : [];
+  });
+  if (!files.length)
+    return {
+      ok: false,
+      message: `No facts files (<repo>.jsonl) in ${dir}: give their metarepo, or the folder their facts are in.`
+    };
+  const ours = new Set(estateRepos(op).map((r) => r.id));
+  const clash = files.filter((r) => ours.has(r));
+  if (clash.length)
+    return {
+      ok: false,
+      message: `${clash.join(", ")} ${clash.length === 1 ? "is a repo" : "are repos"} of your estate: a shared map holds only another team's repos.`
+    };
+  const manifest = await theirManifest(from);
+  const leftOut = { other: 0, unverified: 0, bad: 0, redacted: 0 };
+  const facts = {};
+  const repos = [];
+  for (const repo of files) {
+    const { facts: read, bad } = parseFactsLines(await readFile(join(theirFacts, `${repo}.jsonl`), "utf8"));
+    leftOut.bad += bad.length;
+    const list = [];
+    for (const f of read) {
+      if (f.kind !== "entry" || f.repo !== repo)
+        leftOut.other++;
+      else if (f.verified === "none")
+        leftOut.unverified++;
+      else {
+        const k = kept(f);
+        if (k.redacted)
+          leftOut.redacted++;
+        list.push(k.fact);
+      }
+    }
+    const m = manifest.get(repo);
+    const hosts = [
+      .../* @__PURE__ */ new Set([...m?.hosts ?? [], ...(m?.modules ?? []).flatMap((x) => x.hosts)])
+    ].sort();
+    const codeCommit = list.map((f) => f.commit).sort()[0];
+    facts[repo] = list;
+    repos.push({
+      repo,
+      ...m?.component ? { component: m.component } : {},
+      ...codeCommit ? { commit: codeCommit } : {},
+      hosts,
+      ...m?.basePath ? { basePath: m.basePath } : {},
+      entries: list.length
+    });
+  }
+  const rel = posix(relative(root, from));
+  const inside = !!rel && rel !== ".." && !rel.startsWith("../") && !isAbsolute(rel);
+  const file = SharedMapFile.parse({
+    schemaVersion: SHARED_MAP_SCHEMA_VERSION,
+    team: o.team,
+    name: o.name ?? o.team,
+    system: o.system,
+    ...inside ? { source: rel } : {},
+    commit,
+    importedAt: (o.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    repos
+  });
+  const deny = await denyHashesAt(root);
+  if (deny.size) {
+    for (const [repo, list] of Object.entries(facts)) {
+      const hits = denyListHits(list.length ? serializeFacts(list) : "", deny);
+      if (hits.length)
+        return {
+          ok: false,
+          message: `Refused: the deny-list names a word in ${repo}'s entries (line${hits.length === 1 ? "" : "s"} ${hits.join(", ")} as they would be kept). Nothing was written.`
+        };
+    }
+    if (denyListHits((0, import_yaml.stringify)(file), deny).length)
+      return {
+        ok: false,
+        message: "Refused: the deny-list names a word in the map's own file. Nothing was written."
+      };
+  }
+  const was = (await readSharedMaps(root)).maps.find((m) => m.team === o.team);
+  return { ok: true, file, facts, leftOut, ...was ? { replaced: was.commit } : {} };
+}
+async function writeTheirMap(root, r) {
+  const dir = join(sharedDirOf(root), r.file.team);
+  await rm(join(dir, "facts"), { recursive: true, force: true });
+  await mkdir(join(dir, "facts"), { recursive: true });
+  for (const [repo, list] of Object.entries(r.facts))
+    await writeFileAtomic(join(dir, "facts", `${repo}.jsonl`), list.length ? serializeFacts(list) : "");
+  await writeFileAtomic(join(dir, "map.yaml"), `# ${r.file.name}'s Atticus map, read-only (ADR 0160): their entries at their commit. Theirs to
+# change: import it again (atticus join shared refresh ${r.file.team}); never edit it here.
+${(0, import_yaml.stringify)(r.file)}`);
+  return `${sharedRelOf(root)}/${r.file.team}`;
+}
+function sayImported(r, where, io) {
+  const f = r.file;
+  const entries = f.repos.reduce((n, x) => n + x.entries, 0);
+  io.out(`${r.replaced && r.replaced !== f.commit ? `Replaced ${f.name}'s map at ${r.replaced.slice(0, 7)} with` : r.replaced ? `Imported ${f.name}'s map again,` : `Imported ${f.name}'s map,`} their commit ${f.commit.slice(0, 7)}: ${entries} entr${entries === 1 ? "y" : "ies"} from ${f.repos.length} repo${f.repos.length === 1 ? "" : "s"} (${f.repos.map((x) => `${x.repo} ${x.entries}`).join(", ")}), standing for ${f.system}. Written to ${where}/.`);
+  const lo = r.leftOut;
+  const parts = [
+    lo.other ? `${lo.other} fact${lo.other === 1 ? "" : "s"} that aren't entries` : "",
+    lo.unverified ? `${lo.unverified} entr${lo.unverified === 1 ? "y" : "ies"} their verify didn't confirm` : "",
+    lo.bad ? `${lo.bad} line${lo.bad === 1 ? "" : "s"} that don't read as facts` : ""
+  ].filter(Boolean);
+  if (parts.length)
+    io.out(`  Left out: ${parts.join(", ")}.`);
+  if (lo.redacted)
+    io.out(`  ${lo.redacted} quote${lo.redacted === 1 ? "" : "s"} naming a secret-looking key redacted or dropped.`);
+  if (!f.source)
+    io.out(`  Their folder is outside this metarepo, so where it is isn't recorded: refresh with atticus join shared refresh ${f.team} <folder>.`);
+  io.out(`  Their entries stay theirs: never verified, corrected or reported on here. Review ${where}/ in a pull request, then atticus verify --all --write joins the calls to ${f.system} to them.`);
+}
+async function sharedImport(root, dir, o, io) {
+  if (!dir || !o.team || !o.system) {
+    io.err("Usage: atticus join shared import <their metarepo or facts folder> --team <id> --system <our profile's system id> [--name <team name>] [--commit <sha>] [--json]");
+    return 2;
+  }
+  const r = await readTheirMap(root, dir, o);
+  if (!r.ok) {
+    io.err(r.message);
+    return 1;
+  }
+  const where = await writeTheirMap(root, r);
+  if (o.json)
+    io.out(JSON.stringify({ written: where, map: r.file, leftOut: r.leftOut }, null, 2));
+  else
+    sayImported(r, where, io);
+  return 0;
+}
+async function sharedRefresh(root, team, o, io) {
+  const { maps, problems } = await readSharedMaps(root);
+  for (const p of problems)
+    io.err(p.message);
+  const which = team ? maps.filter((m) => m.team === team) : maps;
+  if (team && !which.length) {
+    io.err(`No shared map for ${team} in ${sharedRelOf(root)}/: import it first (atticus join shared import).`);
+    return 1;
+  }
+  if (o.dir && which.length !== 1) {
+    io.err("Give the team with a new folder: atticus join shared refresh <team> <folder>.");
+    return 2;
+  }
+  let failed = 0;
+  let noFolder = 0;
+  for (const m of which) {
+    const source = m.file.source;
+    if (!o.dir && !source) {
+      io.err(`${m.team}'s map doesn't record where it came from (its folder was outside this metarepo): give the folder, atticus join shared refresh ${m.team} <folder>.`);
+      noFolder++;
+      continue;
+    }
+    const src = o.dir ?? (isAbsolute(source) ? source : join(root, ...source.split("/")));
+    const r = await readTheirMap(root, src, {
+      team: m.team,
+      name: m.name,
+      system: m.system,
+      ...o.commit ? { commit: o.commit } : {},
+      ...o.now ? { now: o.now } : {}
+    });
+    if (!r.ok) {
+      io.err(`${m.team}: ${r.message}`);
+      failed++;
+      continue;
+    }
+    sayImported(r, await writeTheirMap(root, r), io);
+  }
+  if (!which.length)
+    io.out(`No shared maps in ${sharedRelOf(root)}/.`);
+  return failed ? 1 : noFolder ? 2 : 0;
+}
+async function sharedList(root, o, io) {
+  const { maps, problems } = await readSharedMaps(root);
+  if (o.json) {
+    io.out(JSON.stringify({ maps: maps.map((m) => m.file), problems }, null, 2));
+    return problems.length ? 1 : 0;
+  }
+  for (const p of problems)
+    io.err(p.message);
+  if (!maps.length) {
+    io.out(`No shared maps in ${sharedRelOf(root)}/. Import another team's: atticus join shared import <their metarepo> --team <id> --system <id>.`);
+    return problems.length ? 1 : 0;
+  }
+  for (const m of maps) {
+    const n = m.file.repos.reduce((k, r) => k + r.entries, 0);
+    io.out(`${m.team}: ${m.name}'s map for ${m.system}, their commit ${m.commit.slice(0, 7)}, imported ${m.file.importedAt.slice(0, 10)} from ${m.file.source ?? "a folder outside the metarepo"}: ${n} entr${n === 1 ? "y" : "ies"} in ${m.file.repos.map((r) => r.repo).join(", ")}.`);
+  }
+  return problems.length ? 1 : 0;
+}
+export {
+  headCommitOf,
+  readTheirMap,
+  sharedImport,
+  sharedList,
+  sharedRefresh
+};

package/dist/chunk-YIEOFHOL.js

@@ -0,0 +1,30 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  SHOWN,
+  factsRepos,
+  verifyAllCommand,
+  verifyCommand,
+  verifyInputsOf
+} from "./chunk-3GTZ2OON.js";
+import "./chunk-HE4ZQXZM.js";
+import "./chunk-B3O52AUQ.js";
+import "./chunk-XKS6THI5.js";
+import "./chunk-4GZXS6S2.js";
+import "./chunk-UR7RMZ3R.js";
+import "./chunk-7F2RUWPU.js";
+import "./chunk-PGKHJYOB.js";
+import "./chunk-MKRBG5EF.js";
+import "./chunk-577AJVRS.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+export {
+  SHOWN,
+  factsRepos,
+  verifyAllCommand,
+  verifyCommand,
+  verifyInputsOf
+};

package/dist/chunk-YLAJAI2W.js

@@ -0,0 +1,180 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  diffCatalogs,
+  readCatalog
+} from "./chunk-AY2IUF4K.js";
+import "./chunk-6JLPXDWN.js";
+import "./chunk-4GZXS6S2.js";
+import "./chunk-R4TBNKKC.js";
+import "./chunk-NIXVDQVO.js";
+import "./chunk-UR7RMZ3R.js";
+import {
+  baseClonePath,
+  branchSlug,
+  checkoutState,
+  gitUser,
+  loadRepos,
+  remoteDefaultBranch
+} from "./chunk-PGKHJYOB.js";
+import "./chunk-MKRBG5EF.js";
+import "./chunk-5XDNUJ4P.js";
+import {
+  ManifestEditError,
+  REPO_DESCRIPTION_MAX,
+  RepoDescription,
+  RepoManifest,
+  catalogDirOf,
+  orgPackDirOf,
+  require_dist,
+  setManifestDescription
+} from "./chunk-577AJVRS.js";
+import {
+  writeFileAtomic
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/repo-branches.js
+var import_yaml = __toESM(require_dist(), 1);
+var import_yaml2 = __toESM(require_dist(), 1);
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+async function branchScans(root) {
+  const dir = join(catalogDirOf(root), "branches");
+  const out = [];
+  for (const d of (await readdir(dir).catch(() => [])).sort()) {
+    const text = await readFile(join(dir, d, "branch.yaml"), "utf8").catch(() => void 0);
+    if (!text)
+      continue;
+    const m = (0, import_yaml2.parse)(text);
+    if (typeof m.branch === "string" && typeof m.scannedAt === "string" && Array.isArray(m.repos))
+      out.push({ branch: m.branch, scannedAt: m.scannedAt, repos: m.repos });
+  }
+  return out;
+}
+async function repoBranches(root) {
+  const scans = await branchScans(root);
+  const repos = [];
+  for (const r of await loadRepos(root)) {
+    if (r.archived)
+      continue;
+    const base = baseClonePath(root, r.id);
+    const remoteDefault = await remoteDefaultBranch(base);
+    const commit = await checkoutState(base).then((s) => s.commit, () => void 0);
+    repos.push({
+      id: r.id,
+      platform: r.platform,
+      url: r.url,
+      type: r.type,
+      owner: r.owner,
+      // What it is, in a person's words, or a draft nobody has confirmed (ADR 0128).
+      ...r.description ? { description: r.description } : {},
+      defaultBranch: r.defaultBranch,
+      ...remoteDefault ? { remoteDefault } : {},
+      branches: r.branches,
+      ...commit ? { commit } : {},
+      scans: scans.flatMap((s) => s.repos.filter((x) => x.id === r.id).map((x) => ({ branch: s.branch, scannedAt: s.scannedAt, commit: x.commit })))
+    });
+  }
+  return { repos };
+}
+var key = (r) => `${r.kind}/${r.id}`;
+async function compareBranch(root, branch) {
+  const scan = (await branchScans(root)).find((s) => s.branch === branch);
+  if (!scan)
+    return void 0;
+  const ids = new Set(scan.repos.map((r) => r.id));
+  const ofRepos = (records) => records.filter((r) => r.evidence.some((e) => e.repo && ids.has(e.repo)));
+  const cat = catalogDirOf(root);
+  const before = await readCatalog(join(cat, "generated"), { cacheRoot: root });
+  const after = await readCatalog(join(cat, "branches", branchSlug(branch), "generated"), {
+    cacheRoot: root
+  });
+  const d = diffCatalogs(ofRepos(before.records), ofRepos(after.records));
+  return {
+    branch,
+    scannedAt: scan.scannedAt,
+    repos: scan.repos,
+    added: d.added.map(key),
+    removed: d.removed.map(key),
+    changed: d.changed.map((c) => ({ record: key(c), fields: c.fields }))
+  };
+}
+var RepoEditError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+async function editRepoBranches(root, repoId, set) {
+  const repo = (await loadRepos(root)).find((r) => r.id === repoId);
+  if (!repo)
+    throw new RepoEditError("not-found", `There is no repo ${repoId} in any manifest.`);
+  const rel = `org-pack/profiles/${repo.platform}/repos.manifest.yaml`;
+  const file = join(orgPackDirOf(root), "profiles", repo.platform, "repos.manifest.yaml");
+  const doc = (0, import_yaml.parseDocument)(await readFile(file, "utf8"));
+  const list = doc.get("repos");
+  const item = (0, import_yaml.isSeq)(list) ? list.items.find((x) => (0, import_yaml.isMap)(x) && x.get("id") === repoId) : void 0;
+  if (!(0, import_yaml.isMap)(item))
+    throw new RepoEditError("not-found", `${rel} doesn't list ${repoId}.`);
+  const branches = set.branches?.map((b) => b.trim()).filter(Boolean);
+  const def = set.defaultBranch?.trim() || repo.defaultBranch;
+  if (branches?.includes(def))
+    throw new RepoEditError("invalid", `${def} is the default branch: its catalog is the baseline, so it isn't one of the branches scanned beside it.`);
+  if (set.defaultBranch?.trim())
+    item.set("defaultBranch", set.defaultBranch.trim());
+  if (branches) {
+    if (branches.length)
+      item.set("branches", doc.createNode([...new Set(branches)]));
+    else
+      item.delete("branches");
+  }
+  const check = RepoManifest.safeParse(doc.toJS());
+  if (!check.success)
+    throw new RepoEditError("invalid", check.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "));
+  await writeFileAtomic(file, doc.toString({ flowCollectionPadding: true }));
+  return rel;
+}
+async function editRepoDescription(root, repoId, set, o = {}) {
+  const repo = (await loadRepos(root)).find((r) => r.id === repoId);
+  if (!repo)
+    throw new RepoEditError("not-found", `There is no repo ${repoId} in any manifest.`);
+  const now = o.now ?? /* @__PURE__ */ new Date();
+  let next;
+  if (!set.reject) {
+    const text = set.text?.trim() || (set.accept ? repo.description?.text : void 0);
+    if (!text)
+      throw new RepoEditError("invalid", set.accept ? `${repoId} has no drafted description to confirm. Write one instead.` : `Say what ${repoId} is, in one line.`);
+    if (text.length > REPO_DESCRIPTION_MAX)
+      throw new RepoEditError("invalid", `That is ${text.length} characters; a description is one line, up to ${REPO_DESCRIPTION_MAX}.`);
+    const by = o.by ?? await gitUser(root).then((u) => u.handle, () => "someone");
+    next = RepoDescription.parse({
+      text,
+      trust: "verified",
+      by,
+      at: now.toISOString().replace(/\.\d{3}Z$/, "Z")
+    });
+  } else if (!repo.description)
+    throw new RepoEditError("invalid", `${repoId} has no description to drop.`);
+  try {
+    const f = await setManifestDescription(root, repoId, next);
+    return { file: f.rel, ...next ? { description: next } : {} };
+  } catch (e) {
+    if (e instanceof ManifestEditError)
+      throw new RepoEditError(e.code === "not-found" ? "not-found" : "invalid", e.message);
+    throw e;
+  }
+}
+export {
+  RepoEditError,
+  compareBranch,
+  editRepoBranches,
+  editRepoDescription,
+  repoBranches
+};

package/dist/chunk-YMOJD5BO.js

@@ -0,0 +1,50 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  runOpenSpecRaw
+} from "./chunk-MGVYVW7Q.js";
+import {
+  changesDirOf
+} from "./chunk-577AJVRS.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/openspec-run-commands.js
+import { readdir } from "node:fs/promises";
+var CHANGE_FLAG = (a) => a === "--change" || a === "-c" || a.startsWith("--change=") || a.startsWith("-c=");
+async function openChanges(root) {
+  return (await readdir(changesDirOf(root), { withFileTypes: true }).catch(() => [])).filter((d) => d.isDirectory() && d.name !== "archive").map((d) => d.name).sort();
+}
+var NEEDS_CHANGE = /* @__PURE__ */ new Set(["status", "instructions", "show"]);
+async function openspecRun(root, args, io) {
+  if (!args.length) {
+    io.err("Usage: atticus openspec <openspec arguments>, for example: atticus openspec status, atticus openspec instructions apply. atticus openspec setup and atticus openspec check are Atticus's own.");
+    return 2;
+  }
+  let full = [...args];
+  let note;
+  if (NEEDS_CHANGE.has(args[0]) && !args.some(CHANGE_FLAG)) {
+    const changes = await openChanges(root);
+    if (changes.length === 1) {
+      full = [...full, "--change", changes[0]];
+      note = `Only one change is open, so: openspec ${full.join(" ")}`;
+    } else if (changes.length > 1)
+      note = `${changes.length} changes are open (${changes.join(", ")}); add --change <id> to name one.`;
+  }
+  if (note)
+    io.out(note);
+  const r = await runOpenSpecRaw(full, { root });
+  for (const l of r.stdout.replace(/\n$/, "").split("\n"))
+    if (l !== "")
+      io.out(l);
+  for (const l of r.stderr.replace(/\n$/, "").split("\n"))
+    if (l !== "")
+      io.err(l);
+  return r.exitCode ?? 1;
+}
+export {
+  openspecRun
+};

package/dist/chunk-YPBQNJHA.js

@@ -0,0 +1,33 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  denyHash,
+  denyHashesAt,
+  intakeTraffic,
+  linkEvidenceAbout,
+  linkEvidenceLines,
+  loadLinkEvidence,
+  repoContractsOf,
+  writeRepoContracts
+} from "./chunk-GXJVY6WT.js";
+import "./chunk-R4TBNKKC.js";
+import "./chunk-NIXVDQVO.js";
+import "./chunk-UR7RMZ3R.js";
+import "./chunk-MKRBG5EF.js";
+import "./chunk-5XDNUJ4P.js";
+import "./chunk-577AJVRS.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+export {
+  denyHash,
+  denyHashesAt,
+  intakeTraffic,
+  linkEvidenceAbout,
+  linkEvidenceLines,
+  loadLinkEvidence,
+  repoContractsOf,
+  writeRepoContracts
+};