@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.11

package/dist/chunk-EBWIOODZ.js

@@ -0,0 +1,339 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  denyHashesAt
+} from "./chunk-BA5DTXHQ.js";
+import {
+  estateRepos,
+  outsideProfileSystems
+} from "./chunk-IILZ7J3L.js";
+import {
+  denyListHits
+} from "./chunk-WIMOJMAK.js";
+import {
+  RepoManifest,
+  SHARED_MAP_SCHEMA_VERSION,
+  SharedMapFile,
+  factsDirOf,
+  factsFileOf,
+  isAdopted,
+  isSecretPath,
+  loadOrgPack,
+  orgPackDirOf,
+  parseFactsLines,
+  readSharedMaps,
+  redactSecrets,
+  require_dist,
+  serializeFacts,
+  sharedDirOf,
+  sharedRelOf
+} from "./chunk-JMOLB347.js";
+import {
+  writeFileAtomic
+} from "./chunk-MMB2OHUY.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/shared-commands.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readdir, readFile, rm, mkdir, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+var SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+var SHA = /^[0-9a-f]{7,64}$/;
+var SECRET_WORD = /(password|passwd|secret|token|api[-_]?key|access[-_]?key|private[-_]?key|credential)/i;
+var posix = (p) => p.split("\\").join("/");
+async function headCommitOf(dir) {
+  let git = join(dir, ".git");
+  const s = await stat(git).catch(() => void 0);
+  if (!s)
+    return void 0;
+  if (s.isFile()) {
+    const m = /^gitdir:\s*(.+)$/m.exec(await readFile(git, "utf8"));
+    if (!m)
+      return void 0;
+    git = resolve(dir, m[1].trim());
+  }
+  const head = (await readFile(join(git, "HEAD"), "utf8").catch(() => "")).trim();
+  if (SHA.test(head))
+    return head;
+  const ref = /^ref:\s*(.+)$/.exec(head)?.[1]?.trim();
+  if (!ref)
+    return void 0;
+  const common = (await readFile(join(git, "commondir"), "utf8").catch(() => "")).trim();
+  for (const g of [git, ...common ? [resolve(git, common)] : []]) {
+    const loose = (await readFile(join(g, ...ref.split("/")), "utf8").catch(() => "")).trim();
+    if (SHA.test(loose))
+      return loose;
+    const packed = await readFile(join(g, "packed-refs"), "utf8").catch(() => "");
+    for (const line of packed.split(/\r?\n/)) {
+      const [sha, name] = line.trim().split(/\s+/);
+      if (name === ref && sha && SHA.test(sha))
+        return sha;
+    }
+  }
+  return void 0;
+}
+async function theirManifest(dir) {
+  const out = /* @__PURE__ */ new Map();
+  const profiles = join(orgPackDirOf(dir), "profiles");
+  for (const p of (await readdir(profiles).catch(() => [])).sort()) {
+    const text = await readFile(join(profiles, p, "repos.manifest.yaml"), "utf8").catch(() => void 0);
+    if (text === void 0)
+      continue;
+    let raw;
+    try {
+      raw = (0, import_yaml.parse)(text);
+    } catch {
+      continue;
+    }
+    const m = RepoManifest.safeParse(raw);
+    if (m.success) {
+      for (const r of m.data.repos)
+        if (!out.has(r.id))
+          out.set(r.id, r);
+    }
+  }
+  return out;
+}
+function kept(f) {
+  const q = f.cite.quote;
+  if (q === void 0)
+    return { fact: f, redacted: false };
+  const red = isSecretPath(f.cite.file) ? void 0 : redactSecrets(q);
+  const quote = red !== void 0 && red === q && SECRET_WORD.test(q) ? void 0 : red;
+  if (quote === q)
+    return { fact: f, redacted: false };
+  const { quote: _q, ...cite } = f.cite;
+  return { fact: { ...f, cite: quote ? { ...cite, quote } : cite }, redacted: true };
+}
+async function readTheirMap(root, dir, o) {
+  if (!SLUG.test(o.team))
+    return {
+      ok: false,
+      message: `${o.team} isn't a team id: use a lowercase slug, e.g. forge-risk-team.`
+    };
+  const op = await loadOrgPack(orgPackDirOf(root));
+  const systems = outsideProfileSystems(op);
+  const system = systems.find((s) => s.id === o.system);
+  if (!system)
+    return {
+      ok: false,
+      message: `${o.system} isn't a system of your profiles that no estate repo belongs to (${systems.map((s) => s.id).join(", ") || "none"}). Add their system to a profile, boundary internal, with its host as an alias, then import again.`
+    };
+  const others = (await readSharedMaps(root)).maps.filter((m) => m.system === o.system && m.team !== o.team);
+  if (others.length)
+    return {
+      ok: false,
+      message: `${o.system} already has ${others[0].name}'s map (shared/${others[0].team}/): one map per system.`
+    };
+  const from = resolve(dir);
+  const st = await stat(from).catch(() => void 0);
+  if (!st?.isDirectory())
+    return { ok: false, message: `${dir} isn't a folder.` };
+  const commit = o.commit ?? await headCommitOf(from);
+  if (!commit || !SHA.test(commit))
+    return {
+      ok: false,
+      message: o.commit ? `${o.commit} isn't a commit sha.` : `${dir} isn't a git clone Atticus can read the commit of: say which commit of their metarepo these files are at with --commit <sha>.`
+    };
+  const theirFacts = isAdopted(from) || await stat(factsDirOf(from)).catch(() => void 0) ? factsDirOf(from) : from;
+  const names = (await readdir(theirFacts).catch(() => [])).sort();
+  const files = names.flatMap((n) => {
+    const f = factsFileOf(n);
+    return f?.facts ? [f.repo] : [];
+  });
+  if (!files.length)
+    return {
+      ok: false,
+      message: `No facts files (<repo>.jsonl) in ${dir}: give their metarepo, or the folder their facts are in.`
+    };
+  const ours = new Set(estateRepos(op).map((r) => r.id));
+  const clash = files.filter((r) => ours.has(r));
+  if (clash.length)
+    return {
+      ok: false,
+      message: `${clash.join(", ")} ${clash.length === 1 ? "is a repo" : "are repos"} of your estate: a shared map holds only another team's repos.`
+    };
+  const manifest = await theirManifest(from);
+  const leftOut = { other: 0, unverified: 0, bad: 0, redacted: 0 };
+  const facts = {};
+  const repos = [];
+  for (const repo of files) {
+    const { facts: read, bad } = parseFactsLines(await readFile(join(theirFacts, `${repo}.jsonl`), "utf8"));
+    leftOut.bad += bad.length;
+    const list = [];
+    for (const f of read) {
+      if (f.kind !== "entry" || f.repo !== repo)
+        leftOut.other++;
+      else if (f.verified === "none")
+        leftOut.unverified++;
+      else {
+        const k = kept(f);
+        if (k.redacted)
+          leftOut.redacted++;
+        list.push(k.fact);
+      }
+    }
+    const m = manifest.get(repo);
+    const hosts = [
+      .../* @__PURE__ */ new Set([...m?.hosts ?? [], ...(m?.modules ?? []).flatMap((x) => x.hosts)])
+    ].sort();
+    const codeCommit = list.map((f) => f.commit).sort()[0];
+    facts[repo] = list;
+    repos.push({
+      repo,
+      ...m?.component ? { component: m.component } : {},
+      ...codeCommit ? { commit: codeCommit } : {},
+      hosts,
+      ...m?.basePath ? { basePath: m.basePath } : {},
+      entries: list.length
+    });
+  }
+  const rel = posix(relative(root, from));
+  const inside = !!rel && rel !== ".." && !rel.startsWith("../") && !isAbsolute(rel);
+  const file = SharedMapFile.parse({
+    schemaVersion: SHARED_MAP_SCHEMA_VERSION,
+    team: o.team,
+    name: o.name ?? o.team,
+    system: o.system,
+    ...inside ? { source: rel } : {},
+    commit,
+    importedAt: (o.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    repos
+  });
+  const deny = await denyHashesAt(root);
+  if (deny.size) {
+    for (const [repo, list] of Object.entries(facts)) {
+      const hits = denyListHits(list.length ? serializeFacts(list) : "", deny);
+      if (hits.length)
+        return {
+          ok: false,
+          message: `Refused: the deny-list names a word in ${repo}'s entries (line${hits.length === 1 ? "" : "s"} ${hits.join(", ")} as they would be kept). Nothing was written.`
+        };
+    }
+    if (denyListHits((0, import_yaml.stringify)(file), deny).length)
+      return {
+        ok: false,
+        message: "Refused: the deny-list names a word in the map's own file. Nothing was written."
+      };
+  }
+  const was = (await readSharedMaps(root)).maps.find((m) => m.team === o.team);
+  return { ok: true, file, facts, leftOut, ...was ? { replaced: was.commit } : {} };
+}
+async function writeTheirMap(root, r) {
+  const dir = join(sharedDirOf(root), r.file.team);
+  await rm(join(dir, "facts"), { recursive: true, force: true });
+  await mkdir(join(dir, "facts"), { recursive: true });
+  for (const [repo, list] of Object.entries(r.facts))
+    await writeFileAtomic(join(dir, "facts", `${repo}.jsonl`), list.length ? serializeFacts(list) : "");
+  await writeFileAtomic(join(dir, "map.yaml"), `# ${r.file.name}'s Atticus map, read-only (ADR 0160): their entries at their commit. Theirs to
+# change: import it again (atticus join shared refresh ${r.file.team}); never edit it here.
+${(0, import_yaml.stringify)(r.file)}`);
+  return `${sharedRelOf(root)}/${r.file.team}`;
+}
+function sayImported(r, where, io) {
+  const f = r.file;
+  const entries = f.repos.reduce((n, x) => n + x.entries, 0);
+  io.out(`${r.replaced && r.replaced !== f.commit ? `Replaced ${f.name}'s map at ${r.replaced.slice(0, 7)} with` : r.replaced ? `Imported ${f.name}'s map again,` : `Imported ${f.name}'s map,`} their commit ${f.commit.slice(0, 7)}: ${entries} entr${entries === 1 ? "y" : "ies"} from ${f.repos.length} repo${f.repos.length === 1 ? "" : "s"} (${f.repos.map((x) => `${x.repo} ${x.entries}`).join(", ")}), standing for ${f.system}. Written to ${where}/.`);
+  const lo = r.leftOut;
+  const parts = [
+    lo.other ? `${lo.other} fact${lo.other === 1 ? "" : "s"} that aren't entries` : "",
+    lo.unverified ? `${lo.unverified} entr${lo.unverified === 1 ? "y" : "ies"} their verify didn't confirm` : "",
+    lo.bad ? `${lo.bad} line${lo.bad === 1 ? "" : "s"} that don't read as facts` : ""
+  ].filter(Boolean);
+  if (parts.length)
+    io.out(`  Left out: ${parts.join(", ")}.`);
+  if (lo.redacted)
+    io.out(`  ${lo.redacted} quote${lo.redacted === 1 ? "" : "s"} naming a secret-looking key redacted or dropped.`);
+  if (!f.source)
+    io.out(`  Their folder is outside this metarepo, so where it is isn't recorded: refresh with atticus join shared refresh ${f.team} <folder>.`);
+  io.out(`  Their entries stay theirs: never verified, corrected or reported on here. Review ${where}/ in a pull request, then atticus verify --all --write joins the calls to ${f.system} to them.`);
+}
+async function sharedImport(root, dir, o, io) {
+  if (!dir || !o.team || !o.system) {
+    io.err("Usage: atticus join shared import <their metarepo or facts folder> --team <id> --system <our profile's system id> [--name <team name>] [--commit <sha>] [--json]");
+    return 2;
+  }
+  const r = await readTheirMap(root, dir, o);
+  if (!r.ok) {
+    io.err(r.message);
+    return 1;
+  }
+  const where = await writeTheirMap(root, r);
+  if (o.json)
+    io.out(JSON.stringify({ written: where, map: r.file, leftOut: r.leftOut }, null, 2));
+  else
+    sayImported(r, where, io);
+  return 0;
+}
+async function sharedRefresh(root, team, o, io) {
+  const { maps, problems } = await readSharedMaps(root);
+  for (const p of problems)
+    io.err(p.message);
+  const which = team ? maps.filter((m) => m.team === team) : maps;
+  if (team && !which.length) {
+    io.err(`No shared map for ${team} in ${sharedRelOf(root)}/: import it first (atticus join shared import).`);
+    return 1;
+  }
+  if (o.dir && which.length !== 1) {
+    io.err("Give the team with a new folder: atticus join shared refresh <team> <folder>.");
+    return 2;
+  }
+  let failed = 0;
+  let noFolder = 0;
+  for (const m of which) {
+    const source = m.file.source;
+    if (!o.dir && !source) {
+      io.err(`${m.team}'s map doesn't record where it came from (its folder was outside this metarepo): give the folder, atticus join shared refresh ${m.team} <folder>.`);
+      noFolder++;
+      continue;
+    }
+    const src = o.dir ?? (isAbsolute(source) ? source : join(root, ...source.split("/")));
+    const r = await readTheirMap(root, src, {
+      team: m.team,
+      name: m.name,
+      system: m.system,
+      ...o.commit ? { commit: o.commit } : {},
+      ...o.now ? { now: o.now } : {}
+    });
+    if (!r.ok) {
+      io.err(`${m.team}: ${r.message}`);
+      failed++;
+      continue;
+    }
+    sayImported(r, await writeTheirMap(root, r), io);
+  }
+  if (!which.length)
+    io.out(`No shared maps in ${sharedRelOf(root)}/.`);
+  return failed ? 1 : noFolder ? 2 : 0;
+}
+async function sharedList(root, o, io) {
+  const { maps, problems } = await readSharedMaps(root);
+  if (o.json) {
+    io.out(JSON.stringify({ maps: maps.map((m) => m.file), problems }, null, 2));
+    return problems.length ? 1 : 0;
+  }
+  for (const p of problems)
+    io.err(p.message);
+  if (!maps.length) {
+    io.out(`No shared maps in ${sharedRelOf(root)}/. Import another team's: atticus join shared import <their metarepo> --team <id> --system <id>.`);
+    return problems.length ? 1 : 0;
+  }
+  for (const m of maps) {
+    const n = m.file.repos.reduce((k, r) => k + r.entries, 0);
+    io.out(`${m.team}: ${m.name}'s map for ${m.system}, their commit ${m.commit.slice(0, 7)}, imported ${m.file.importedAt.slice(0, 10)} from ${m.file.source ?? "a folder outside the metarepo"}: ${n} entr${n === 1 ? "y" : "ies"} in ${m.file.repos.map((r) => r.repo).join(", ")}.`);
+  }
+  return problems.length ? 1 : 0;
+}
+
+export {
+  headCommitOf,
+  readTheirMap,
+  sharedImport,
+  sharedRefresh,
+  sharedList
+};

package/dist/chunk-EHUYLNLC.js

@@ -0,0 +1,282 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  intakeContext
+} from "./chunk-MYKQVS5W.js";
+import "./chunk-VOGCSYOI.js";
+import {
+  changeFolder,
+  changeStore
+} from "./chunk-3LU6YCSQ.js";
+import "./chunk-L7I5PKGD.js";
+import "./chunk-CAN3EBE5.js";
+import {
+  estateFacts,
+  estateRepos,
+  hostAliases,
+  joinReposOf,
+  outsideProfileSystems,
+  outsideSystems
+} from "./chunk-IILZ7J3L.js";
+import "./chunk-TEBBD4XH.js";
+import "./chunk-XPWSNKF3.js";
+import {
+  attachToChange,
+  readChangeInputs,
+  readVendorSpec
+} from "./chunk-WIMOJMAK.js";
+import "./chunk-5V5BJACL.js";
+import "./chunk-GVFUEGGM.js";
+import "./chunk-XZJE6WIT.js";
+import "./chunk-FMRMTI7W.js";
+import "./chunk-BKFGGJKA.js";
+import {
+  PROTOTYPE_GROUPS,
+  comparePrototype,
+  factsDirOf,
+  inputsDirOf,
+  isPrototypeType,
+  joinConventions,
+  parseFacts,
+  prototypeArchitectureSection
+} from "./chunk-JMOLB347.js";
+import "./chunk-MMB2OHUY.js";
+import "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/prototype-commands.js
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+var PROTOTYPE_CLI_WORDS = {
+  usage: (change, repo) => `--prototype names a prototype repo, attached on its own: atticus change attach ${change} --prototype ${repo}`,
+  noChange: (change) => `There is no change ${change}: atticus change list shows them.`,
+  noRepo: (repo) => `There is no repo ${repo} in the manifests (org-pack/profiles/<platform>/repos.manifest.yaml); atticus repo add adds one.`,
+  notPrototype: (repo, type) => `${repo} isn't a prototype: repos.manifest.yaml types it ${type}. A prototype is typed prototype there; then attach it.`,
+  notRead: (repo) => `${repo} has no verified facts yet: read it with /atticus-map ${repo}, then atticus verify ${repo}.`,
+  about: (repo, about) => `${repo} (a prototype)${about ? `: ${about.text}${about.trust === "suggested" ? " (a draft nobody has confirmed)" : ""}` : ": nothing says what it is yet (atticus repo describe)."}`,
+  counts: (c) => {
+    const all = PROTOTYPE_GROUPS.reduce((n, g) => n + c[g], 0);
+    return `${all} call${all === 1 ? "" : "s"} compared with the estate: ${c.exists} exist${c.exists === 1 ? "s" : ""}, ${c.changes} change${c.changes === 1 ? "s" : ""}, ${c.new} new, ${c.vendor} only a vendor provides.`;
+  },
+  group: {
+    exists: "Exists: the estate serves it as the prototype needs.",
+    changes: "Changes: the estate serves the operation, but not as the prototype needs.",
+    new: "New: nothing in the estate serves it.",
+    vendor: "Vendor: only a vendor provides it, so it needs a route through the external gateway."
+  },
+  /** The vendor group's heading when another team's system provides one of its calls (O2). */
+  outside: "Outside: only a vendor or another team's system provides it; a vendor's needs a route through the external gateway, another team's is called as it publishes it.",
+  left: (n) => `${n} call${n === 1 ? "" : "s"} of the prototype reach${n === 1 ? "es" : ""} nothing in it and ${n === 1 ? "isn't" : "aren't"} compared:`,
+  attached: (path) => `Attached as ${path}: the change's feature and architecture stages read it as data, citing it by line.`,
+  unchanged: (path) => `The comparison is what ${path} already says: nothing to attach again.`,
+  footprint: (c) => {
+    const parts = [
+      c.repos.length ? `repos ${c.repos.join(", ")}` : "",
+      c.endpoints.length ? `Endpoints ${c.endpoints.join(", ")}` : "",
+      c.vendorOperations.length ? `vendor operations ${c.vendorOperations.join(", ")}` : ""
+    ].filter(Boolean);
+    return parts.length ? `Its footprint now has ${parts.join("; ")}.` : "Its footprint is unchanged: every call exists as the prototype needs, or is new.";
+  },
+  docTitle: (repo) => `# What the prototype ${repo} asks of the estate`
+};
+var SPECS = /* @__PURE__ */ new Set(["openapi", "swagger"]);
+async function loadPrototypeComparison(root, repo, io) {
+  const { op, inputs } = await intakeContext(root, io);
+  const manifest = estateRepos(op).find((r) => r.id === repo);
+  if (!manifest)
+    return { error: PROTOTYPE_CLI_WORDS.noRepo(repo) };
+  if (!isPrototypeType(manifest.type))
+    return { error: PROTOTYPE_CLI_WORDS.notPrototype(repo, manifest.type) };
+  const text = await readFile(join(factsDirOf(root), `${repo}.jsonl`), "utf8").catch(() => "");
+  const parsed = text.trim() ? parseFacts(text) : void 0;
+  if (!parsed?.ok || !parsed.facts.length || parsed.facts.some((f) => f.verified === "none"))
+    return { error: PROTOTYPE_CLI_WORDS.notRead(repo) };
+  const estate = await estateFacts(root, op, repo);
+  const systems = outsideProfileSystems(op);
+  const vendors = [];
+  for (const d of inputs.documents) {
+    if (!d.id || d.supersededBy || !SPECS.has(d.classification))
+      continue;
+    const system = systems.find((s) => s.id === d.systems[0]);
+    if (!system)
+      continue;
+    const body = await readFile(join(inputsDirOf(root), ...d.path.split("/").slice(1)), "utf8");
+    const spec = readVendorSpec(d.path, body, system.id);
+    if (!spec)
+      continue;
+    const prior = vendors.find((v) => v.system === system.id);
+    const operations = spec.operations.map((o) => ({
+      id: o.id,
+      method: o.method,
+      path: o.path,
+      fullPath: o.fullPath,
+      cite: o.cite,
+      ...o.auth ? { auth: o.auth } : {},
+      scopes: o.scopes,
+      fields: [
+        ...o.request.map((f) => ({ side: "request", f })),
+        ...o.response.map((f) => ({ side: "response", f }))
+      ].map(({ side, f }) => ({
+        side,
+        name: f.name,
+        ...f.type ? { type: f.type } : {},
+        ...f.required !== void 0 ? { required: f.required } : {},
+        ...f.enum ? { enum: f.enum } : {},
+        ...f.in === "header" ? { in: f.in } : {},
+        at: f.cite
+      })),
+      ...o.errors ? { errors: o.errors.map((e) => ({ status: e.status, at: e.cite })) } : {}
+    }));
+    if (prior) {
+      prior.operations.push(...operations);
+      prior.hosts.push(...spec.hosts);
+    } else
+      vendors.push({
+        system: system.id,
+        names: [system.name, ...system.aliases],
+        hosts: [.../* @__PURE__ */ new Set([...spec.hosts, ...hostAliases(system.aliases)])],
+        ...system.boundary === "vendor" ? {} : { boundary: "internal" },
+        operations
+      });
+  }
+  const comparison = comparePrototype({
+    prototype: {
+      repo,
+      facts: parsed.facts,
+      ...manifest.component ? { component: manifest.component } : {}
+    },
+    estate: joinReposOf(op, estate.repos),
+    vendors,
+    outside: outsideSystems(op),
+    ...joinConventions(op)
+  });
+  return {
+    repo,
+    ...manifest.description ? { about: manifest.description } : {},
+    comparison,
+    notes: estate.notes,
+    architecture: prototypeArchitectureSection(comparison, parsed.facts),
+    systemOf: Object.fromEntries(estateRepos(op).flatMap((r) => r.system ? [[r.id, r.system]] : []))
+  };
+}
+var where = (e) => `${e.repo} ${e.at}`;
+function callLines(c) {
+  const other = c.estate ? `; ${where(c.estate.entry)}` : c.vendor?.at ? `; ${c.vendor.name} ${c.vendor.at}` : "";
+  return [
+    `  ${c.sentence}`,
+    `    ${c.call.repo} ${c.call.at} \u2192 ${c.lands.at}${other}`,
+    ...(c.candidates ?? []).map((x) => `    ? ${where(x)}`),
+    ...c.differences.map((d) => `    - ${d.message}`)
+  ];
+}
+function prototypeLines(l) {
+  const c = l.comparison;
+  const out = [PROTOTYPE_CLI_WORDS.about(l.repo, l.about), PROTOTYPE_CLI_WORDS.counts(c.counts)];
+  for (const g of PROTOTYPE_GROUPS) {
+    const calls = c.calls.filter((x) => x.group === g);
+    if (!calls.length)
+      continue;
+    out.push(g === "vendor" && calls.some((x) => x.vendor?.boundary === "internal") ? PROTOTYPE_CLI_WORDS.outside : PROTOTYPE_CLI_WORDS.group[g]);
+    for (const x of calls)
+      out.push(...callLines(x));
+  }
+  if (c.left.length) {
+    out.push(PROTOTYPE_CLI_WORDS.left(c.left.length));
+    for (const x of c.left)
+      out.push(`  ${x.why} (${x.call.at})`);
+  }
+  out.push(...l.notes);
+  return out;
+}
+function prototypeDocument(l) {
+  return {
+    name: `prototype-${l.repo}.md`,
+    text: [
+      PROTOTYPE_CLI_WORDS.docTitle(l.repo),
+      "",
+      ...prototypeLines(l),
+      "",
+      ...l.architecture
+    ].join("\n")
+  };
+}
+var sorted = (xs) => [...new Set(xs)].sort();
+var ATTACHED = /^prototype-(.+)\.md$/;
+async function changePrototypes(root, change) {
+  const quiet = { out: () => void 0, err: () => void 0 };
+  const files = (await readChangeInputs(changeFolder(root, change))).files.filter((f) => !f.supersededBy && ATTACHED.test(f.name)).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const prototypes = [];
+  for (const f of files) {
+    const repo = ATTACHED.exec(f.name)[1];
+    const got = await loadPrototypeComparison(root, repo, quiet);
+    prototypes.push("error" in got ? { repo, attached: f.path, problem: got.error } : {
+      repo,
+      attached: f.path,
+      ...got.about ? { about: { text: got.about.text, trust: got.about.trust } } : {},
+      comparison: got.comparison
+    });
+  }
+  return { prototypes };
+}
+async function attachPrototype(root, change, repo, o, io) {
+  const store = changeStore(root);
+  const c = await store.read(change).catch(() => void 0);
+  if (!c) {
+    io.err(PROTOTYPE_CLI_WORDS.noChange(change));
+    return 1;
+  }
+  const got = await loadPrototypeComparison(root, repo, io);
+  if ("error" in got) {
+    io.err(got.error);
+    return 1;
+  }
+  const doc = prototypeDocument(got);
+  const dir = changeFolder(root, c.id);
+  const before = (await readChangeInputs(dir)).files.find((f) => f.name === doc.name && !f.supersededBy);
+  const r = await attachToChange(dir, [{ name: doc.name, bytes: new TextEncoder().encode(doc.text) }], {
+    by: o.by,
+    at: (o.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+    ...before ? { replaces: before.path } : {}
+  });
+  const added = r.added[0]?.path;
+  const path = added ?? before?.path ?? `inputs/${doc.name}`;
+  const cmp = got.comparison;
+  const fresh = await store.read(c.id);
+  const touches = {
+    ...fresh.touches,
+    repos: sorted([...fresh.touches.repos, ...cmp.repos]),
+    records: sorted([...fresh.touches.records, ...cmp.endpoints, ...cmp.vendorOperations])
+  };
+  const systems = sorted([
+    ...fresh.systems,
+    ...cmp.vendors,
+    ...cmp.repos.flatMap((x) => got.systemOf[x] ? [got.systemOf[x]] : [])
+  ]);
+  await store.write({ ...fresh, systems, touches });
+  if (o.json) {
+    io.out(JSON.stringify({
+      prototype: repo,
+      ...got.about ? { about: got.about } : {},
+      comparison: cmp,
+      attached: path,
+      touches: { repos: touches.repos, records: touches.records },
+      systems
+    }, null, 2));
+    return 0;
+  }
+  for (const l of prototypeLines(got))
+    io.out(l);
+  io.out(added ? PROTOTYPE_CLI_WORDS.attached(path) : PROTOTYPE_CLI_WORDS.unchanged(path));
+  io.out(PROTOTYPE_CLI_WORDS.footprint(cmp));
+  return 0;
+}
+export {
+  PROTOTYPE_CLI_WORDS,
+  attachPrototype,
+  changePrototypes,
+  loadPrototypeComparison,
+  prototypeDocument,
+  prototypeLines
+};