@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.2

package/dist/chunk-XY3P7JW7.js

@@ -0,0 +1,3479 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  STORE_MARKER,
+  addStoreReference,
+  readStoreMarker,
+  readStoreVia
+} from "./chunk-4AK7IBVP.js";
+import {
+  AdapterError,
+  mergeBlockers,
+  requireApproval
+} from "./chunk-7JUKDRSZ.js";
+import {
+  readCatalog
+} from "./chunk-27NKUS3X.js";
+import {
+  createGit,
+  readChangeRepos
+} from "./chunk-EFHQ3TWP.js";
+import {
+  ChangeArtifact,
+  ChangeLifecycle,
+  ChangeTouches,
+  Finding,
+  PHASES,
+  Phase,
+  RecordId,
+  TestType,
+  changesDirOf,
+  changesRelOf,
+  external_exports,
+  fastGateOf,
+  fastPathOf,
+  handoffBranch,
+  isAssistantResolution,
+  loadOpenSpecSettings,
+  loadOrgPack,
+  openspecDirOf,
+  orgPackDirOf,
+  readFlow,
+  require_dist,
+  specFlowFiles,
+  toCanonicalYaml
+} from "./chunk-S2A7YC3Q.js";
+import {
+  writeFileAtomic
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/changes/dist/errors.js
+var ChangeError = class extends Error {
+  code;
+  reasons;
+  constructor(code, message, reasons = []) {
+    super(message);
+    this.code = code;
+    this.reasons = reasons;
+    this.name = "ChangeError";
+  }
+};
+
+// packages/changes/dist/markdown.js
+var SEPARATOR = /^\s*\|?\s*:?-{3,}:?\s*(\|\s*:?-{3,}:?\s*)*\|?\s*$/;
+function cells(line) {
+  let s = line.trim();
+  if (s.startsWith("|"))
+    s = s.slice(1);
+  if (s.endsWith("|"))
+    s = s.slice(0, -1);
+  return s.split("|").map((c) => c.trim());
+}
+var stripComments = (text) => text.replace(/<!--[\s\S]*?-->/g, "");
+function readTables(text) {
+  const lines2 = stripComments(text).replace(/\r\n/g, "\n").split("\n");
+  const tables = [];
+  for (let i = 0; i + 1 < lines2.length; i++) {
+    if (!lines2[i].includes("|") || !SEPARATOR.test(lines2[i + 1]))
+      continue;
+    const header = cells(lines2[i]).map((h) => h.toLowerCase());
+    const rows = [];
+    let j = i + 2;
+    for (; j < lines2.length && lines2[j].includes("|"); j++) {
+      const v = cells(lines2[j]);
+      rows.push(Object.fromEntries(header.map((h, k) => [h, v[k] ?? ""])));
+    }
+    tables.push(rows);
+    i = j - 1;
+  }
+  return tables;
+}
+function tableWith(text, headers) {
+  return readTables(text).find((t) => t.length > 0 && headers.every((h) => h in t[0])) ?? [];
+}
+function isFilled(text) {
+  const lines2 = stripComments(text).replace(/\r\n/g, "\n").split("\n");
+  for (let i = 0; i < lines2.length; i++) {
+    const line = lines2[i].trim();
+    if (line === "" || line.startsWith("#"))
+      continue;
+    if (SEPARATOR.test(line))
+      continue;
+    if (line.includes("|") && i + 1 < lines2.length && SEPARATOR.test(lines2[i + 1]))
+      continue;
+    if (line.includes("|") && cells(line).every((c) => c === ""))
+      continue;
+    if (/^([-*+]|\d+\.)(\s+\[[ xX]?\])?\s*$/.test(line))
+      continue;
+    return true;
+  }
+  return false;
+}
+
+// packages/changes/dist/policy.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+var CHANGE_POLICY_FILE = "process/change-policy.yaml";
+var Ids = external_exports.array(RecordId);
+var DEFAULT_ARTIFACT_PHASES = {
+  brief: "define",
+  proposal: "define",
+  specs: "define",
+  interfaces: "design",
+  mappings: "design",
+  data: "design",
+  design: "design",
+  ux: "design",
+  stories: "plan",
+  tasks: "plan",
+  snow: "plan"
+};
+var StageStep = external_exports.strictObject({
+  stage: RecordId,
+  phase: Phase,
+  /** The stage's loop state, relative to the change folder (ADR 0087, `stage/<stage>.yaml`). */
+  loop: external_exports.string().min(1),
+  /** The command that runs it; `<change>` stands for the change's id. */
+  command: external_exports.string().min(1),
+  /** Files it writes, relative to the change folder; a folder ends in "/". They ride with the hand-off. */
+  writes: external_exports.array(external_exports.string().min(1)).default([]),
+  /** The change type's artifacts of the phase that this stage writes: on the stage path, only these are due. */
+  artifacts: external_exports.array(ChangeArtifact).default([])
+});
+var DEFAULT_STAGES = [
+  {
+    stage: "feature",
+    phase: "define",
+    loop: "stage/feature.yaml",
+    command: "atticus change feature <change>",
+    writes: ["feature.yaml", "feature.md", "design/"],
+    artifacts: []
+  },
+  {
+    stage: "architecture",
+    phase: "design",
+    loop: "stage/architecture.yaml",
+    command: "atticus change architecture <change>",
+    writes: ["target-flows/"],
+    artifacts: ["design", "data"]
+  },
+  {
+    stage: "stories",
+    phase: "plan",
+    loop: "stage/stories.yaml",
+    command: "atticus plan stories <change>",
+    writes: ["requests.md", "stage/stories-answer.yaml"],
+    artifacts: ["stories", "tasks"]
+  }
+];
+var Privacy = external_exports.strictObject({
+  role: RecordId.default("privacy-officer"),
+  classifications: external_exports.array(external_exports.string().min(1)).default(["personal", "pii", "sensitive-personal", "special-category"]),
+  /** The first of these phases the change type has; a type with none uses its last phase. */
+  phases: external_exports.array(Phase).min(1).default(["design"])
+});
+var SIGNAL_FACTORS = [
+  "outside-call",
+  "auth",
+  "personal-data",
+  "schema",
+  "breaking",
+  "spread"
+];
+var DEFAULT_WEIGHTS = {
+  extraSystem: 1,
+  dataStore: 2,
+  vendor: 3,
+  interfaceModify: 1,
+  interfaceRetire: 2,
+  outsideCall: 3,
+  auth: 3,
+  personalData: 2,
+  schema: 2,
+  breaking: 3,
+  extraRepo: 1
+};
+var AUTH_WORDS = [
+  "401",
+  "403",
+  "auth",
+  "authn",
+  "authz",
+  "authenticate",
+  "authentication",
+  "authorise",
+  "authorize",
+  "authorisation",
+  "authorization",
+  "unauthorised",
+  "unauthorized",
+  "forbidden",
+  "permission",
+  "permissions",
+  "role",
+  "roles",
+  "scope",
+  "scopes",
+  "entitlement",
+  "entitlements",
+  "acl",
+  "rbac"
+];
+var PERSONAL_WORDS = [
+  "consent",
+  "consents",
+  "pii",
+  "personal",
+  "ssn",
+  "passport",
+  "dob",
+  "birth",
+  "birthdate",
+  "email",
+  "phone",
+  "nationality",
+  "gender",
+  "health",
+  "biometric",
+  "salary"
+];
+var DEFAULT_FACTOR_TESTS = {
+  "outside-call": ["contract", "integration"],
+  auth: ["security"],
+  "personal-data": ["security"],
+  schema: ["data-migration", "integration"],
+  breaking: ["contract", "regression"],
+  spread: ["integration"]
+};
+var Risk = external_exports.strictObject({
+  typeWeights: external_exports.record(RecordId, external_exports.number().int().min(0)).default({ "emergency-fix": 3, feature: 2, integration: 2 }),
+  defaultTypeWeight: external_exports.number().int().min(0).default(1),
+  weights: external_exports.strictObject({
+    /** Per system touched beyond the first. */
+    extraSystem: external_exports.number().int().min(0).default(1),
+    dataStore: external_exports.number().int().min(0).default(2),
+    /** Once, when any touched system is a vendor. */
+    vendor: external_exports.number().int().min(0).default(3),
+    interfaceModify: external_exports.number().int().min(0).default(1),
+    interfaceRetire: external_exports.number().int().min(0).default(2),
+    // What the stages' deltas do (ADR 0124 addendum B-change): each factor counts once however
+    // many steps raise it, and cites every step. Optional and additive (still version 1).
+    /** A step calls a system outside the estate: a vendor, a model provider. */
+    outsideCall: external_exports.number().int().min(0).default(3),
+    /** A step changes who may do what: an authorisation or authentication rule. */
+    auth: external_exports.number().int().min(0).default(3),
+    /** A step reads or writes personal, consent or classified data. */
+    personalData: external_exports.number().int().min(0).default(2),
+    /** A step adds a table, columns or a migration. */
+    schema: external_exports.number().int().min(0).default(2),
+    /** A step breaks who calls or reads it today. */
+    breaking: external_exports.number().int().min(0).default(3),
+    /** Per repo the change spans beyond the first: the deploy order matters. */
+    extraRepo: external_exports.number().int().min(0).default(1)
+  }).default({ ...DEFAULT_WEIGHTS }),
+  /**
+   * The words that mark a delta step as an authorisation change or as personal data (B-change).
+   * A step's words, field names, table and column names and file paths are split into words and
+   * compared whole. Optional and additive; a list a team writes replaces the built-in one.
+   */
+  signals: external_exports.strictObject({
+    auth: external_exports.array(external_exports.string().min(1)).default([...AUTH_WORDS]),
+    personal: external_exports.array(external_exports.string().min(1)).default([...PERSONAL_WORDS])
+  }).default({ auth: [...AUTH_WORDS], personal: [...PERSONAL_WORDS] }),
+  /**
+   * The test kinds each factor asks on top of the test strategy's row (B-change). Optional and
+   * additive; a factor a team lists replaces the built-in kinds for it.
+   */
+  tests: external_exports.partialRecord(external_exports.enum(SIGNAL_FACTORS), external_exports.array(TestType).min(1)).default({}).transform((t) => ({ ...DEFAULT_FACTOR_TESTS, ...t })),
+  /** Lowest score of each level; below medium is low. */
+  levels: external_exports.strictObject({
+    medium: external_exports.number().int().min(1).default(4),
+    high: external_exports.number().int().min(1).default(7)
+  }).refine((l) => l.high > l.medium, "high must be above medium").default({ medium: 4, high: 7 }),
+  /** Extra approver roles by risk level and phase. */
+  approvals: external_exports.partialRecord(external_exports.enum(["low", "medium", "high"]), external_exports.partialRecord(Phase, Ids.min(1))).default({ high: { release: ["architect"] } })
+});
+var SelfApproval = external_exports.strictObject({
+  /** Change types this applies to; empty means all. */
+  types: Ids.default([]),
+  phases: external_exports.array(Phase).min(1),
+  roles: Ids.min(1)
+}).superRefine((s, ctx) => {
+  if (s.phases.includes("release"))
+    ctx.addIssue({
+      code: "custom",
+      path: ["phases"],
+      message: "nobody may approve their own change at release"
+    });
+});
+var ChangePolicy = external_exports.strictObject({
+  schemaVersion: external_exports.literal(1),
+  artifactPhases: external_exports.partialRecord(ChangeArtifact, Phase).default({}).transform((p) => ({ ...DEFAULT_ARTIFACT_PHASES, ...p })),
+  privacy: Privacy.default({
+    role: "privacy-officer",
+    classifications: ["personal", "pii", "sensitive-personal", "special-category"],
+    phases: ["design"]
+  }),
+  risk: Risk.default(() => Risk.parse({})),
+  /** The stage path (ADR 0087); a team's list replaces the built-in one. */
+  stages: external_exports.array(StageStep).default(() => DEFAULT_STAGES.map((x) => ({ ...x }))).refine((xs) => new Set(xs.map((x) => x.phase)).size === xs.length, "one stage per phase"),
+  /**
+   * At most this many questions go to a person when a stage stops (ADR 0117 addendum, U3); the
+   * rest wait and are asked once those are answered. Optional and additive (still version 1).
+   */
+  questionsPerStop: external_exports.number().int().min(1).default(5),
+  /**
+   * How many times a stage's drafter may check its own draft with the stage's checks before it
+   * is handed in as it is (ADR 0087 addendum, W3a). Optional and additive (still version 1).
+   */
+  draftSelfChecks: external_exports.number().int().min(1).default(3),
+  /** By default the product owner may approve the Define hand-off of their own brief. */
+  selfApproval: external_exports.array(SelfApproval).default([{ types: [], phases: ["define"], roles: ["product-owner"] }])
+});
+var DEFAULT_CHANGE_POLICY = ChangePolicy.parse({ schemaVersion: 1 });
+async function loadChangePolicy(orgPackDir) {
+  let text;
+  try {
+    text = await readFile(join(orgPackDir, CHANGE_POLICY_FILE), "utf8");
+  } catch {
+    return { policy: DEFAULT_CHANGE_POLICY, problems: [] };
+  }
+  let data;
+  try {
+    data = (0, import_yaml.parse)(text);
+  } catch (e) {
+    return {
+      policy: DEFAULT_CHANGE_POLICY,
+      problems: [{ file: CHANGE_POLICY_FILE, message: `can't read YAML: ${e.message}` }]
+    };
+  }
+  const r = ChangePolicy.safeParse(data);
+  if (r.success)
+    return { policy: r.data, problems: [] };
+  return {
+    policy: DEFAULT_CHANGE_POLICY,
+    problems: r.error.issues.map((i) => ({
+      file: CHANGE_POLICY_FILE,
+      message: `${i.path.map(String).join(".") || "(file)"}: ${i.message}`
+    }))
+  };
+}
+function stagePathOf(policy) {
+  return policy.stages;
+}
+
+// packages/changes/dist/templates.js
+var import_yaml2 = __toESM(require_dist(), 1);
+import { readdir, readFile as readFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var TemplateMeta = external_exports.strictObject({
+  id: RecordId,
+  name: external_exports.string().min(1),
+  /** The change type this template is normally used with. */
+  changeType: RecordId,
+  description: external_exports.string().min(1).optional()
+});
+var TEMPLATE_VARIABLES = ["title", "id", "type", "by", "date"];
+var intro = "<!-- Brief for {{id}} ({{type}}), started by {{by}} on {{date}}. Replace every comment with your own words; the proposal is drafted from this file. -->";
+function skeleton(sections) {
+  return ["# {{title}}", "", intro, ""].concat(...sections.map(([h, c]) => [`## ${h}`, "", `<!-- ${c} -->`, ""])).join("\n").replace(/\n+$/, "") + "\n";
+}
+var builtIn = (id, name, changeType, description, sections) => ({
+  id,
+  name,
+  changeType,
+  description,
+  body: skeleton(sections),
+  source: "built-in"
+});
+var BUILT_IN_TEMPLATES = [
+  builtIn("feature", "New feature", "feature", "Something new for customers or users.", [
+    ["Problem", "Who has the problem, what it costs them today, and why now."],
+    ["Outcome", "What is true when this is done, in the customer's or user's words."],
+    ["Scope", "In scope, and what is out of scope."],
+    ["Systems", "Systems you expect to be involved, by name or catalog id. Leave it if unsure."],
+    ["Success measures", "How we will know it worked."],
+    ["Open questions", "Anything you don't know yet, and who might."]
+  ]),
+  builtIn("defect-fix", "Defect fix", "bug-fix", "Something that should work and doesn't.", [
+    ["Defect", "What goes wrong, for whom, and since when."],
+    ["Steps to reproduce", "Numbered steps, with the environment."],
+    ["Expected and actual", "What should happen, and what happens instead."],
+    ["Impact", "How many people or transactions, and any workaround."],
+    ["Ticket", "The work-tracker or service-desk ticket."]
+  ]),
+  builtIn("emergency-fix", "Emergency fix", "emergency-fix", "A fix that ships before the usual reviews; the skipped lenses run after release.", [
+    ["Incident", "The incident or alert, when it started, and its ticket."],
+    ["Impact", "Who is affected right now, and how badly."],
+    ["Fix", "The smallest change that stops the harm."],
+    ["Rollback", "How to undo the fix if it makes things worse."],
+    ["Follow-up", "What the post-release review should look at."]
+  ]),
+  builtIn("small-change", "Small change", "small-change", "A small change: one step from brief to tasks, checked and criticised at one gate (ADR 0113).", [
+    ["Change", "What changes, for whom, in two or three sentences."],
+    ["Where", "The flow, screen, endpoint or table it is in, if you know. Leave it if unsure."],
+    ["Done when", "What a test can check when it is done."]
+  ]),
+  builtIn("tech-debt", "Technical debt", "tech-debt", "Work that makes later change cheaper.", [
+    ["Debt", "What is wrong with the code, design or platform today."],
+    ["Cost of leaving it", "What it slows down or puts at risk, with examples."],
+    ["Proposed change", "What you would change, and what stays the same for users."],
+    ["Risk", "What could break, and how you will know."]
+  ]),
+  builtIn("vulnerability-fix", "Vulnerability fix", "bug-fix", "A security weakness to close. Keep exploit details out of the brief.", [
+    ["Vulnerability", "The advisory or scan id and a one-line description. No exploit details."],
+    ["Affected components", "Components, versions and environments affected."],
+    ["Severity", "The severity and the deadline that comes with it."],
+    ["Fix", "Upgrade, patch or configuration change."],
+    ["Verification", "How we prove it is closed, such as a rescan."]
+  ]),
+  builtIn("config-flag", "Configuration or feature flag", "config-change", "A setting or flag changes; no code changes.", [
+    ["Setting or flag", "Its name and where it lives."],
+    ["Values", "Current and new value in each environment."],
+    ["Why", "What the change achieves."],
+    ["Rollback", "How to put the old value back, and how fast."]
+  ]),
+  builtIn("data-fix", "Data fix", "bug-fix", "Stored data is wrong and must be corrected.", [
+    ["Data problem", "What is wrong in which data store, and how it happened."],
+    ["Records affected", "How many records, and how they are found."],
+    ["Correction", "What the corrected data looks like, and the script or tool."],
+    ["Verification", "How we check the correction, before and after."],
+    ["Data owner", "Who owns the data and must approve the fix."]
+  ]),
+  builtIn("decommission", "Decommission", "integration", "A system, interface or data store retires.", [
+    ["What retires", "Systems, interfaces or data stores, by catalog id."],
+    ["Consumers", "Who uses it today, from the catalog, and what they move to."],
+    ["Replacement", "What replaces it, if anything."],
+    ["Data", "What happens to the data: migrate, archive or delete, with retention."],
+    ["Timeline", "Notice to consumers, switch-off and clean-up dates."]
+  ])
+];
+async function loadTemplates(orgPackDir) {
+  const byId = new Map(BUILT_IN_TEMPLATES.map((t) => [t.id, t]));
+  const problems = [];
+  const dir = join2(orgPackDir, "process", "change-templates");
+  let names = [];
+  try {
+    names = (await readdir(dir)).filter((n) => n.endsWith(".md")).sort();
+  } catch {
+  }
+  for (const name of names) {
+    const file = `process/change-templates/${name}`;
+    const text = (await readFile2(join2(dir, name), "utf8")).replace(/\r\n/g, "\n");
+    const m = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(text);
+    if (!m) {
+      problems.push({ file, message: "a change template starts with YAML front matter" });
+      continue;
+    }
+    let meta;
+    try {
+      meta = (0, import_yaml2.parse)(m[1]);
+    } catch (e) {
+      problems.push({ file, message: `can't read the front matter: ${e.message}` });
+      continue;
+    }
+    const r = TemplateMeta.safeParse(meta);
+    if (!r.success) {
+      for (const i of r.error.issues)
+        problems.push({ file, message: `${i.path.join(".") || "(front matter)"}: ${i.message}` });
+      continue;
+    }
+    if (`${r.data.id}.md` !== name) {
+      problems.push({ file, message: `says id ${r.data.id}; name the file ${r.data.id}.md` });
+      continue;
+    }
+    const unknown = [...m[2].matchAll(/\{\{\s*([^}]*?)\s*\}\}/g)].map((x) => x[1]).filter((v) => !TEMPLATE_VARIABLES.includes(v));
+    if (unknown.length > 0) {
+      problems.push({
+        file,
+        message: `unknown placeholder ${unknown.map((u) => `{{${u}}}`).join(", ")}; use ${TEMPLATE_VARIABLES.map((v) => `{{${v}}}`).join(", ")}`
+      });
+      continue;
+    }
+    byId.set(r.data.id, { ...r.data, body: m[2].replace(/^\n+/, ""), source: file });
+  }
+  return {
+    templates: [...byId.values()].sort((a, b) => a.id.localeCompare(b.id)),
+    problems
+  };
+}
+function renderTemplate(t, vars) {
+  return t.body.replace(/\{\{\s*(title|id|type|by|date)\s*\}\}/g, (_, k) => vars[k]);
+}
+function pickTemplate(templates, type, wanted) {
+  if (wanted)
+    return templates.find((t) => t.id === wanted);
+  return templates.find((t) => t.id === type) ?? templates.find((t) => t.changeType === type) ?? templates.find((t) => t.id === "feature");
+}
+
+// packages/changes/dist/store.js
+var import_yaml3 = __toESM(require_dist(), 1);
+import { readdir as readdir2, readFile as readFile3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+var CHANGES_DIR = "openspec/changes";
+var CHANGE_FILE = "change.yaml";
+var LEADING = [
+  "schemaVersion",
+  "id",
+  "title",
+  "type",
+  "template",
+  "phase",
+  "state",
+  "from",
+  "to"
+];
+function changeFolder(root, id) {
+  return join3(changesDirOf(root), id);
+}
+function changeFilePath(root, id) {
+  return join3(changeFolder(root, id), CHANGE_FILE);
+}
+var ChangeFileError = class extends Error {
+  path;
+  constructor(message, path) {
+    super(message);
+    this.path = path;
+    this.name = "ChangeFileError";
+  }
+};
+var describe = (issues) => issues.map((i) => `${i.path.map(String).join(".") || "(file)"}: ${i.message}`).join("; ");
+function serializeChange(value) {
+  const r = ChangeLifecycle.safeParse(value);
+  if (!r.success)
+    throw new Error(`change ${value.id}: ${describe(r.error.issues)}`);
+  return toCanonicalYaml(r.data, LEADING);
+}
+function changeStore(root) {
+  async function tryRead(id) {
+    const path = changeFilePath(root, id);
+    let text;
+    try {
+      text = await readFile3(path, "utf8");
+    } catch {
+      return void 0;
+    }
+    let data;
+    try {
+      data = (0, import_yaml3.parse)(text);
+    } catch (e) {
+      throw new ChangeFileError(`${path}: invalid YAML: ${e.message}`, path);
+    }
+    const r = ChangeLifecycle.safeParse(data);
+    if (!r.success)
+      throw new ChangeFileError(`${path}: ${describe(r.error.issues)}`, path);
+    if (r.data.id !== id)
+      throw new ChangeFileError(`${path}: says change ${r.data.id}, expected ${id}`, path);
+    return r.data;
+  }
+  return {
+    root,
+    tryRead,
+    async read(id) {
+      const c = await tryRead(id);
+      if (!c) {
+        const path = changeFilePath(root, id);
+        throw new ChangeFileError(`No change ${id}: ${path} doesn't exist.`, path);
+      }
+      return c;
+    },
+    async write(value) {
+      const path = changeFilePath(root, value.id);
+      await writeFileAtomic(path, serializeChange(value));
+      return path;
+    },
+    async list() {
+      let names;
+      try {
+        names = (await readdir2(changesDirOf(root), { withFileTypes: true })).filter((d) => d.isDirectory() && d.name !== "archive").map((d) => d.name).sort();
+      } catch {
+        return [];
+      }
+      const out = [];
+      for (const n of names) {
+        const c = await tryRead(n);
+        if (c)
+          out.push(c);
+      }
+      return out;
+    }
+  };
+}
+
+// packages/changes/dist/codeowners.js
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+var CODEOWNERS_PATHS = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"];
+function toRegex(pattern) {
+  let p = pattern;
+  const dirOnly = p.endsWith("/");
+  if (dirOnly)
+    p = p.slice(0, -1);
+  let anchored = p.includes("/");
+  if (p.startsWith("/")) {
+    anchored = true;
+    p = p.slice(1);
+  }
+  let body = "";
+  for (let i = 0; i < p.length; i++) {
+    const ch = p[i];
+    if (p.startsWith("**/", i)) {
+      body += "(?:.*/)?";
+      i += 2;
+    } else if (p.startsWith("/**", i) && i + 3 === p.length) {
+      body += "(?:/.*)?";
+      i += 2;
+    } else if (p.startsWith("**", i)) {
+      body += ".*";
+      i += 1;
+    } else if (ch === "*")
+      body += "[^/]*";
+    else if (ch === "?")
+      body += "[^/]";
+    else
+      body += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`${anchored ? "^" : "^(?:.*/)?"}${body}${dirOnly ? "/.*$" : "(?:/.*)?$"}`);
+}
+function parseCodeowners(text) {
+  const rules = [];
+  for (const raw of text.replace(/\r\n/g, "\n").split("\n")) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    if (!line)
+      continue;
+    const [pattern, ...owners] = line.split(/\s+/);
+    rules.push({
+      pattern,
+      regex: toRegex(pattern),
+      owners: owners.map((o) => o.startsWith("@") ? o.slice(1) : o)
+    });
+  }
+  return rules;
+}
+function ownersFor(rules, path) {
+  for (let i = rules.length - 1; i >= 0; i--) {
+    if (rules[i].regex.test(path))
+      return [...rules[i].owners];
+  }
+  return [];
+}
+async function readCodeowners(root) {
+  for (const p of CODEOWNERS_PATHS) {
+    try {
+      return parseCodeowners(await readFile4(join4(root, p), "utf8"));
+    } catch {
+    }
+  }
+  return [];
+}
+
+// packages/changes/dist/context.js
+import { join as join5 } from "node:path";
+async function loadChangeContext(root) {
+  const orgPackDir = join5(orgPackDirOf(root));
+  const orgPack = await loadOrgPack(orgPackDir);
+  const policy = await loadChangePolicy(orgPackDir);
+  const templates = await loadTemplates(orgPackDir);
+  const catalog = await readCatalog(join5(root, orgPack.sources.layout.catalog, "generated"), {
+    cacheRoot: root
+  });
+  return {
+    root,
+    orgPack,
+    policy: policy.policy,
+    templates: templates.templates,
+    records: catalog.records,
+    codeowners: await readCodeowners(root),
+    problems: [
+      ...orgPack.problems.map((p) => `org-pack/${p.file}: ${p.path ? `${p.path}: ` : ""}${p.message}`),
+      ...policy.problems.map((p) => `org-pack/${p.file}: ${p.message}`),
+      ...templates.problems.map((p) => `org-pack/${p.file}: ${p.message}`),
+      ...catalog.problems.map((p) => `catalog ${p.file}: ${p.message}`)
+    ]
+  };
+}
+function changeTypeOf(ctx, type) {
+  const t = ctx.orgPack.changeTypes.types.find((x) => x.id === type);
+  if (!t) {
+    const known = ctx.orgPack.changeTypes.types.map((x) => x.id).join(", ");
+    throw new ChangeError("invalid", `Unknown change type ${type}. Use one of: ${known}.`);
+  }
+  return t;
+}
+
+// packages/changes/dist/footprint.js
+var import_yaml4 = __toESM(require_dist(), 1);
+import { readdir as readdir3, readFile as readFile5 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+function personalLevels(ctx) {
+  const pack = ctx.orgPack.pack?.classification ?? [
+    "public",
+    "internal",
+    "confidential",
+    "restricted"
+  ];
+  const policy = ctx.policy.privacy.classifications;
+  if (policy.some((c) => pack.includes(c.toLowerCase())))
+    return { levels: policy, from: "change-policy" };
+  const i = pack.indexOf("internal");
+  return {
+    levels: [.../* @__PURE__ */ new Set([...policy, ...i >= 0 ? pack.slice(i + 1) : []])],
+    from: "pack-levels"
+  };
+}
+var STATUSES = /* @__PURE__ */ new Set(["planned-new", "planned-modify", "planned-retire"]);
+async function read(path) {
+  try {
+    return await readFile5(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+var cellId = (s) => s.replace(/[`*]/g, "").trim().split(/\s+/)[0].toLowerCase();
+var slug = (s) => s.toLowerCase().replace(/[^a-z0-9.]+/g, "-");
+var sorted = (s) => [...new Set(s)].sort();
+var wordsOf = (s) => s.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+function entryParts(entry) {
+  const m = /^\s*([A-Za-z]+)\s+(\S+)/.exec(entry);
+  const norm2 = (p) => p.replace(/\{[^}]*\}/g, "{}").replace(/:[A-Za-z_]\w*/g, "{}");
+  return m ? { method: m[1].toUpperCase(), path: norm2(m[2]) } : { path: norm2(entry.trim()) };
+}
+var str = (x) => typeof x === "string" && x ? x : void 0;
+var strs = (x) => Array.isArray(x) ? x.filter((v) => typeof v === "string") : [];
+var obj = (x) => x && typeof x === "object" && !Array.isArray(x) ? x : void 0;
+var FIELD_LISTS = ["sends", "returns", "reads", "checks", "from", "to", "required"];
+var quote = (s) => s.length > 90 ? `${s.slice(0, 87).trimEnd()}...` : s;
+var specCache = /* @__PURE__ */ new WeakMap();
+function specIndex(ctx) {
+  let p = specCache.get(ctx);
+  if (!p) {
+    p = (async () => {
+      const files = await specFlowFiles(ctx.root).catch(() => /* @__PURE__ */ new Map());
+      const read2 = /* @__PURE__ */ new Map();
+      const get = async (id) => {
+        if (read2.has(id))
+          return read2.get(id);
+        const f = files.get(id);
+        const flow = f ? await readFlow(ctx.root, f.repo, id).catch(() => void 0) : void 0;
+        const today = flow && f ? { repo: f.repo, flow } : void 0;
+        read2.set(id, today);
+        return today;
+      };
+      const ids = [...files.keys()];
+      return {
+        get,
+        hasComponent: async (id) => {
+          for (const flowId of ids) {
+            if (!flowId.startsWith(`${id}.`))
+              continue;
+            if ((await get(flowId))?.flow.component === id)
+              return true;
+          }
+          return false;
+        },
+        hasRepo: async (id) => {
+          for (const flowId of ids)
+            if (files.get(flowId).repo === id && await get(flowId))
+              return true;
+          return false;
+        }
+      };
+    })();
+    specCache.set(ctx, p);
+  }
+  return p;
+}
+async function changeFootprint(ctx, change) {
+  const dir = changeFolder(ctx.root, change.id);
+  const byId = new Map(ctx.records.map((r) => [r.id, r]));
+  const get = (kind, id) => {
+    const r = byId.get(id);
+    return r?.kind === kind ? r : void 0;
+  };
+  const profileSystems = new Map(ctx.orgPack.profiles.flatMap((p) => p.profile?.systems ?? []).map((s) => [s.id, s]));
+  const isSystem = (id) => get("System", id) !== void 0 || profileSystems.has(id);
+  const systems = new Set(change.systems);
+  const components = /* @__PURE__ */ new Set();
+  const interfaces = /* @__PURE__ */ new Map();
+  const dataStores = new Set(change.touches.dataStores);
+  const tables = new Set(change.touches.tables);
+  const repos = new Set(change.touches.repos);
+  const from = /* @__PURE__ */ new Set();
+  const ref = (id) => {
+    const c = get("Component", id);
+    if (c) {
+      components.add(c.id);
+      systems.add(c.system);
+    } else if (isSystem(id))
+      systems.add(id);
+  };
+  const proposal = await read(join6(dir, "proposal.md"));
+  const proposed = findSystemsTable(proposal);
+  if (proposed.length)
+    from.add("proposal.md");
+  for (const id of proposed)
+    if (isSystem(id))
+      systems.add(id);
+  for (const i of change.touches.interfaces)
+    interfaces.set(i.id, i.status);
+  const hops = tableWith(await read(join6(dir, "interfaces.md")), ["interface id"]);
+  if (hops.length)
+    from.add("interfaces.md");
+  for (const row of hops) {
+    const id = cellId(row["interface id"] ?? "");
+    const status = cellId(row.status ?? "");
+    for (const end of [row.caller, row.callee])
+      if (end)
+        ref(cellId(end));
+    if (get("Interface", id))
+      interfaces.set(id, STATUSES.has(status) ? status : "planned-modify");
+  }
+  const rows = tableWith(await read(join6(dir, "data.md")), ["data store", "table"]);
+  if (rows.length)
+    from.add("data.md");
+  for (const row of rows) {
+    const store = cellId(row["data store"] ?? "");
+    const table = cellId(row.table ?? "");
+    if (store)
+      dataStores.add(store);
+    if (table)
+      tables.add(table.includes(".") ? slug(table) : `${store}.${slug(table)}`);
+  }
+  const staged = await stageFootprint(ctx, dir, { get, isSystem, profileSystems, ref });
+  for (const f of staged.from)
+    from.add(f);
+  for (const r of staged.repos)
+    repos.add(r);
+  for (const t of staged.tables)
+    tables.add(t);
+  for (const [id, status] of staged.interfaces)
+    if (!interfaces.has(id))
+      interfaces.set(id, status);
+  const flows = [...staged.flows];
+  if (change.touches.records.length) {
+    const specs = await specIndex(ctx);
+    for (const id of change.touches.records) {
+      if (flows.some((f) => f.id === id))
+        continue;
+      const today = await specs.get(id);
+      if (!today)
+        continue;
+      flows.push({ id, repo: today.repo, change: "modify" });
+      repos.add(today.repo);
+    }
+    flows.sort((a, b) => a.id.localeCompare(b.id));
+  }
+  for (const id of interfaces.keys()) {
+    const i = get("Interface", id);
+    if (i) {
+      ref(i.from);
+      ref(i.to);
+    }
+  }
+  for (const id of tables) {
+    const t = get("Table", id);
+    if (t) {
+      dataStores.add(t.dataStore);
+      if (t.ownerComponent)
+        ref(t.ownerComponent);
+    } else {
+      const store = id.split(".")[0];
+      if (get("DataStore", store))
+        dataStores.add(store);
+    }
+  }
+  for (const id of dataStores) {
+    const s = get("DataStore", id);
+    if (s?.ownerComponent)
+      ref(s.ownerComponent);
+  }
+  for (const id of components) {
+    const c = get("Component", id);
+    if (c?.repo)
+      repos.add(c.repo);
+  }
+  try {
+    const cr = await readChangeRepos(ctx.root, change.id);
+    for (const r of cr?.repos ?? [])
+      repos.add(r.id);
+  } catch {
+  }
+  const vendors = [...systems].filter((s) => (get("System", s)?.boundary ?? profileSystems.get(s)?.boundary) === "vendor");
+  const personalSet = new Set(personalLevels(ctx).levels.map((c) => c.toLowerCase()));
+  const personal = [];
+  for (const s of staged.stores) {
+    for (const [col, level] of Object.entries(s.classification))
+      if (personalSet.has(level.toLowerCase()) && !personal.some((p) => p.id === s.table && p.field === col))
+        personal.push({ id: s.table, classification: level, field: col });
+  }
+  for (const r of ctx.records) {
+    if (r.kind !== "Column" || !r.classification)
+      continue;
+    if (!tables.has(r.table) && !change.touches.records.includes(r.id))
+      continue;
+    if (personalSet.has(r.classification.toLowerCase()))
+      personal.push({ id: r.id, classification: r.classification });
+  }
+  for (const id of interfaces.keys()) {
+    const ep = get("Interface", id)?.endpoint;
+    for (const s of ep && get("Endpoint", ep)?.schemaRefs || []) {
+      for (const f of get("Schema", s)?.fields ?? []) {
+        if (f.classification && personalSet.has(f.classification.toLowerCase()))
+          personal.push({ id: s, classification: f.classification, field: f.name });
+      }
+    }
+  }
+  personal.sort((a, b) => `${a.id}#${a.field ?? ""}`.localeCompare(`${b.id}#${b.field ?? ""}`));
+  const signals = [...staged.signals];
+  for (const s of staged.stores) {
+    if (signals.some((x) => x.factor === "personal-data" && x.cite === s.cite))
+      continue;
+    const classified = s.columns.filter((c) => {
+      const level = s.classification[c] ?? get("Column", `${s.table}.${c}`)?.classification ?? void 0;
+      return level !== void 0 && personalSet.has(level.toLowerCase());
+    });
+    if (classified.length)
+      signals.push({
+        factor: "personal-data",
+        detail: `${s.kind} of ${s.table} (${classified.join(", ")} classified personal)`,
+        cite: s.cite
+      });
+  }
+  const spread = sorted(staged.repos);
+  if (spread.length > 1)
+    signals.push({
+      factor: "spread",
+      detail: `${spread.length} repos (${spread.join(", ")})`,
+      cite: staged.deployFile ?? staged.from.find((f) => f.startsWith("target-flows/")) ?? ""
+    });
+  return {
+    systems: sorted(systems),
+    components: sorted(components),
+    interfaces: [...interfaces].map(([id, status]) => ({ id, status })).sort((a, b) => a.id.localeCompare(b.id)),
+    dataStores: sorted(dataStores),
+    tables: sorted(tables),
+    records: sorted(change.touches.records),
+    repos: sorted(repos),
+    vendors: vendors.sort(),
+    personal,
+    flows,
+    entries: sorted(staged.entries),
+    newEntries: sorted(staged.newEntries),
+    calls: sorted([...staged.calls].filter((id) => !interfaces.has(id))),
+    columns: sorted(staged.columns),
+    fields: sorted(staged.fields),
+    outside: staged.outside,
+    signals,
+    from: sorted(from)
+  };
+}
+async function stageFootprint(ctx, dir, h) {
+  const out = {
+    from: [],
+    flows: [],
+    repos: /* @__PURE__ */ new Set(),
+    tables: /* @__PURE__ */ new Set(),
+    columns: /* @__PURE__ */ new Set(),
+    fields: /* @__PURE__ */ new Set(),
+    entries: /* @__PURE__ */ new Set(),
+    newEntries: /* @__PURE__ */ new Set(),
+    calls: /* @__PURE__ */ new Set(),
+    interfaces: /* @__PURE__ */ new Map(),
+    outside: [],
+    stores: [],
+    signals: []
+  };
+  const files = (await readdir3(join6(dir, "target-flows")).catch(() => [])).filter((f) => f.endsWith(".yaml")).sort();
+  const featureText = await read(join6(dir, "feature.yaml"));
+  const tasksText = await read(join6(dir, "tasks.md"));
+  if (!files.length && !featureText && !tasksText)
+    return out;
+  const { get, isSystem, profileSystems, ref } = h;
+  const specs = await specIndex(ctx);
+  const catalogRepos = /* @__PURE__ */ new Set();
+  for (const r of ctx.records)
+    if (r.kind === "Component" && r.repo)
+      catalogRepos.add(r.repo);
+  const authWords = new Set(ctx.policy.risk.signals.auth.map((w) => w.toLowerCase()));
+  const personalWords = new Set(ctx.policy.risk.signals.personal.map((w) => w.toLowerCase()));
+  const endpoints = ctx.records.filter((r) => r.kind === "Endpoint");
+  const ifaces = ctx.records.filter((r) => r.kind === "Interface");
+  const flows = /* @__PURE__ */ new Map();
+  const outsideOf = async (id) => {
+    const c = get("Component", id);
+    if (c)
+      return get("System", c.system)?.boundary === "vendor";
+    if (isSystem(id))
+      return (get("System", id)?.boundary ?? profileSystems.get(id)?.boundary) === "vendor";
+    if (catalogRepos.has(id))
+      return false;
+    return !await specs.hasComponent(id) && !await specs.hasRepo(id);
+  };
+  const endpointOf = (component, entry) => {
+    const e = entryParts(entry);
+    return endpoints.find((x) => x.component === component && (!e.method || !x.method || x.method.toUpperCase() === e.method) && (x.normalizedPath === e.path || entryParts(x.pathOrTopic ?? "").path === e.path));
+  };
+  const interfaceOf = (fromC, to, entry) => {
+    const e = entryParts(entry);
+    return ifaces.find((x) => x.from === fromC && x.to === to && (!e.method || !x.method || x.method.toUpperCase() === e.method) && x.normalizedPath === e.path);
+  };
+  const outside = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    const rel = `target-flows/${f}`;
+    const text = await read(join6(dir, "target-flows", f));
+    const lines2 = new import_yaml4.LineCounter();
+    let doc;
+    try {
+      doc = (0, import_yaml4.parseDocument)(text, { lineCounter: lines2 });
+    } catch {
+      continue;
+    }
+    if (doc.errors.length)
+      continue;
+    const d = obj(doc.toJS());
+    const flowId = str(d?.flow);
+    if (!d || !flowId)
+      continue;
+    out.from.push(rel);
+    const lineOf = (node) => {
+      const r = node?.range;
+      return r ? lines2.linePos(r[0]).line : void 0;
+    };
+    const stepNodes = (() => {
+      const top = doc.contents;
+      const s = (0, import_yaml4.isMap)(top) ? top.get("steps", true) : void 0;
+      return (0, import_yaml4.isSeq)(s) ? s.items : [];
+    })();
+    const keyLine = (key) => {
+      const top = doc.contents;
+      if (!(0, import_yaml4.isMap)(top))
+        return void 0;
+      const pair = top.items.find((p) => p.key?.value === key);
+      return lineOf(pair?.key);
+    };
+    const today = await specs.get(flowId);
+    const change = str(d.change) ?? "modify";
+    const repo = str(d.repo) ?? today?.repo;
+    const prefix = flowId.split(".")[0];
+    const component = today?.flow.component ?? (get("Component", prefix) || await specs.hasComponent(prefix) ? prefix : void 0);
+    flows.set(flowId, { id: flowId, ...repo ? { repo } : {}, change });
+    if (repo)
+      out.repos.add(repo);
+    if (component)
+      ref(component);
+    const trigger = today?.flow.trigger.ref;
+    if (trigger && get("Endpoint", trigger))
+      out.entries.add(trigger);
+    else {
+      const entry = str(obj(d.trigger)?.entry);
+      if (entry && component) {
+        const ep = endpointOf(component, entry);
+        if (ep)
+          out.entries.add(ep.id);
+        else
+          out.newEntries.add(`${component} ${entry}`);
+      }
+    }
+    if (strs(d.consumers).length || change === "remove")
+      out.signals.push({
+        factor: "breaking",
+        detail: change === "remove" ? `flow ${flowId} is removed` : `flow ${flowId} breaks ${strs(d.consumers).join(", ")}`,
+        cite: `${rel}:${keyLine(strs(d.consumers).length ? "consumers" : "change") ?? 1}`
+      });
+    const steps = Array.isArray(d.steps) ? d.steps : [];
+    for (const [i, raw] of steps.entries()) {
+      const s = obj(raw);
+      if (!s)
+        continue;
+      const cite = `${rel}:${lineOf(stepNodes[i]) ?? 1}`;
+      const op = str(s.op) ?? "add";
+      const n = typeof s.step === "number" ? s.step : void 0;
+      const was = op !== "add" && n ? today?.flow.steps[n - 1] : void 0;
+      const kind = str(s.kind) ?? was?.kind ?? "step";
+      const what = str(s.what) ?? was?.what ?? "";
+      const live = op === "add" || op === "change";
+      const store = obj(s.store);
+      const table = str(store?.table) ?? was?.store?.table;
+      if (table) {
+        out.tables.add(table);
+        const cols = store ? strs(store.columns) : was?.store?.columns ?? [];
+        for (const c of cols)
+          out.columns.add(`${table}.${c}`);
+        const classification = {};
+        for (const [c, v] of Object.entries(obj(store?.classification) ?? {}))
+          if (typeof v === "string")
+            classification[c] = v;
+        out.stores.push({ table, columns: cols, classification, kind, cite });
+        if (live) {
+          const hit = [...wordsOf(table), ...cols.flatMap(wordsOf)].filter((w) => personalWords.has(w));
+          if (hit.length)
+            out.signals.push({
+              factor: "personal-data",
+              detail: `${kind} of ${table} (${[...new Set(hit)].join(", ")})`,
+              cite
+            });
+          const added = Object.keys(obj(store?.types) ?? {});
+          if (store?.new === true || str(store?.migration) || added.length)
+            out.signals.push({
+              factor: "schema",
+              detail: store?.new === true ? `new table ${table}` : added.length ? `${table} gains ${added.join(", ")}` : `migration ${str(store?.migration)} on ${table}`,
+              cite
+            });
+        }
+      }
+      const to = obj(s.to) ?? was?.to;
+      const target = str(to?.component);
+      const entry = str(to?.entry) ?? "";
+      if (target) {
+        if (await outsideOf(target)) {
+          if (isSystem(target))
+            ref(target);
+          const o = outside.get(target) ?? { entries: /* @__PURE__ */ new Set(), cite };
+          if (entry)
+            o.entries.add(entry);
+          outside.set(target, o);
+          if (live)
+            out.signals.push({
+              factor: "outside-call",
+              detail: `${target}${entry ? ` (${entry}${to?.new === true ? ", new" : ""})` : ""}`,
+              cite
+            });
+        } else {
+          ref(target);
+          const ep = entry ? endpointOf(target, entry) : void 0;
+          if (ep)
+            out.entries.add(ep.id);
+          else if (entry && to?.new === true)
+            out.newEntries.add(`${target} ${entry}`);
+        }
+        const iface = component && entry ? interfaceOf(component, target, entry) : void 0;
+        if (iface) {
+          if (op === "remove")
+            out.interfaces.set(iface.id, "planned-retire");
+          else if (op === "change")
+            out.interfaces.set(iface.id, "planned-modify");
+          else
+            out.calls.add(iface.id);
+        }
+      }
+      if (!live)
+        continue;
+      const fields = obj(s.fields) ?? {};
+      const names = FIELD_LISTS.flatMap((k) => strs(fields[k]));
+      for (const name of names)
+        out.fields.add(name);
+      const paths = [str(s.at), str(s.new), ...strs(Array.isArray(s.uses) ? s.uses : [s.uses])].filter((p) => !!p).map((p) => p.replace(/:\d+$/, ""));
+      const plain = (t) => t.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+      const authHit = [...plain(what), ...names.flatMap(wordsOf), ...paths.flatMap(plain)].filter((w) => authWords.has(w) && (kind === "validate" || !/^\d+$/.test(w)));
+      if (authHit.length)
+        out.signals.push({
+          factor: "auth",
+          detail: `${kind} step "${quote(what)}" (${[...new Set(authHit)].join(", ")})`,
+          cite
+        });
+      const fieldHit = names.flatMap(wordsOf).filter((w) => personalWords.has(w));
+      if (fieldHit.length && !out.signals.some((x) => x.factor === "personal-data" && x.cite === cite))
+        out.signals.push({
+          factor: "personal-data",
+          detail: `${kind} step carries ${[...new Set(fieldHit)].join(", ")}`,
+          cite
+        });
+      if (s.breaking === true || strs(fields.required).length)
+        out.signals.push({
+          factor: "breaking",
+          detail: strs(fields.required).length ? `${kind} step now requires ${strs(fields.required).join(", ")}` : `${kind} step "${quote(what)}" is marked breaking`,
+          cite
+        });
+    }
+  }
+  if (featureText) {
+    let placed;
+    try {
+      placed = obj((0, import_yaml4.parse)(featureText));
+    } catch {
+      placed = void 0;
+    }
+    if (placed) {
+      out.from.push("feature.yaml");
+      for (const raw of Array.isArray(placed.flows) ? placed.flows : []) {
+        const fl = obj(raw);
+        const id = str(fl?.id);
+        if (!id || flows.has(id))
+          continue;
+        const today = await specs.get(id);
+        const read2 = str(fl?.how) === "read";
+        flows.set(id, {
+          id,
+          ...today ? { repo: today.repo } : {},
+          change: read2 ? "read" : "modify"
+        });
+        if (read2 || !today)
+          continue;
+        out.repos.add(today.repo);
+        ref(today.flow.component);
+        const trigger = today.flow.trigger.ref;
+        if (trigger && get("Endpoint", trigger))
+          out.entries.add(trigger);
+      }
+      for (const raw of Array.isArray(placed.newFlows) ? placed.newFlows : []) {
+        const repo = str(obj(raw)?.repo);
+        if (repo)
+          out.repos.add(repo);
+      }
+    }
+  }
+  const taskRepos = [];
+  for (const m of tasksText.matchAll(/^##\s+(\S+)\s*$/gm))
+    if (catalogRepos.has(m[1]) || await specs.hasRepo(m[1]))
+      taskRepos.push(m[1]);
+  if (taskRepos.length) {
+    out.from.push("tasks.md");
+    for (const r of taskRepos)
+      out.repos.add(r);
+  }
+  if (await readFile5(join6(dir, "stage", "architecture-deploy.yaml")).then(() => true, () => false))
+    out.deployFile = "stage/architecture-deploy.yaml";
+  out.flows = [...flows.values()].sort((a, b) => a.id.localeCompare(b.id));
+  out.outside = [...outside].map(([id, o]) => ({ id, entries: sorted(o.entries), cite: o.cite })).sort((a, b) => a.id.localeCompare(b.id));
+  return out;
+}
+function findSystemsTable(text) {
+  for (const headerSet of [["system (catalog id)"], ["system"]]) {
+    const rows = tableWith(text, headerSet);
+    if (rows.length)
+      return rows.map((r) => cellId(r[headerSet[0]] ?? "")).filter(Boolean);
+  }
+  return [];
+}
+
+// packages/changes/dist/risk.js
+var SIGNAL_WORDS = {
+  "outside-call": { one: "calls an outside system", many: "calls outside systems" },
+  auth: { one: "changes who may do what", many: "changes who may do what" },
+  "personal-data": {
+    one: "reads or writes personal or consent data",
+    many: "reads or writes personal or consent data"
+  },
+  schema: { one: "changes the schema", many: "changes the schema" },
+  breaking: { one: "breaks who uses it today", many: "breaks who uses it today" },
+  spread: { one: "spans several repos", many: "spans several repos" }
+};
+var WEIGHT = {
+  "outside-call": "outsideCall",
+  auth: "auth",
+  "personal-data": "personalData",
+  schema: "schema",
+  breaking: "breaking",
+  spread: "extraRepo"
+};
+function detailsOf(signals) {
+  const ds = [...new Set(signals.map((s) => s.detail))];
+  return ds.length > 3 ? `${ds.slice(0, 3).join("; ")}; and ${ds.length - 3} more` : ds.join("; ");
+}
+function scoreRisk(input, policy) {
+  const { risk } = policy;
+  const w = risk.weights;
+  const f = input.footprint;
+  const factors = [];
+  const add = (factor, detail, points, cites) => {
+    if (points > 0)
+      factors.push({ factor, detail, points, ...cites ? { cites } : {} });
+  };
+  add("type", `change type ${input.type}`, risk.typeWeights[input.type] ?? risk.defaultTypeWeight);
+  if (f.systems.length > 1)
+    add("systems", `${f.systems.length} systems touched (${f.systems.join(", ")})`, (f.systems.length - 1) * w.extraSystem);
+  for (const s of f.dataStores)
+    add("data-store", `data store ${s}`, w.dataStore);
+  const crossed = f.vendors.filter((v) => !(f.outside ?? []).some((o) => o.id === v));
+  if (crossed.length > 0)
+    add("vendor", `crosses the vendor boundary (${crossed.join(", ")})`, w.vendor);
+  for (const i of f.interfaces) {
+    if (i.status === "planned-modify")
+      add("interface", `interface ${i.id} planned-modify`, w.interfaceModify);
+    if (i.status === "planned-retire")
+      add("interface", `interface ${i.id} planned-retire`, w.interfaceRetire);
+  }
+  for (const factor of SIGNAL_FACTORS) {
+    const signals = (f.signals ?? []).filter((s) => s.factor === factor);
+    if (!signals.length)
+      continue;
+    const words = SIGNAL_WORDS[factor];
+    const points = factor === "spread" ? (f.repos.length - 1) * w[WEIGHT[factor]] : w[WEIGHT[factor]];
+    add(factor, `${signals.length > 1 ? words.many : words.one}: ${detailsOf(signals)}`, points, [
+      ...new Set(signals.map((s) => s.cite))
+    ]);
+  }
+  const score = factors.reduce((n, x) => n + x.points, 0);
+  const level = score >= risk.levels.high ? "high" : score >= risk.levels.medium ? "medium" : "low";
+  return { score, level, factors };
+}
+var LEVELS = ["low", "medium", "high"];
+function testsFor(strategy, type, level) {
+  const rows = strategy.matrix.filter((m) => m.changeType === type);
+  if (rows.length === 0)
+    return { required: [], note: `test-strategy.yaml has no row for ${type}.` };
+  const at = LEVELS.indexOf(level);
+  const order = [
+    at,
+    ...LEVELS.slice(0, at).map((_, i) => at - 1 - i).filter((i) => i >= 0),
+    ...LEVELS.slice(at + 1).map((_, i) => at + 1 + i)
+  ];
+  for (const i of order) {
+    const row = rows.find((r) => r.risk === LEVELS[i]);
+    if (!row)
+      continue;
+    const plan = {
+      required: [...row.required],
+      row: { changeType: type, risk: row.risk }
+    };
+    if (row.risk !== level)
+      plan.note = `test-strategy.yaml has no ${type}/${level} row; using ${type}/${row.risk}.`;
+    return plan;
+  }
+  return { required: [], note: `test-strategy.yaml has no row for ${type}.` };
+}
+function whyOf(factor, f) {
+  const what = f.detail.replace(/^[^:]*: /, "");
+  switch (factor) {
+    case "outside-call":
+      return `against a stub of ${what}, with its failure paths (an error, a timeout, an answer it can't use)`;
+    case "auth":
+      return "of who may and who may not: each caller the rule lets in and each it refuses";
+    case "personal-data":
+      return "that the personal or consent data is read only where it may be, and never logged or sent on";
+    case "schema":
+      return "that the migration runs on today's data and the code reads what it writes";
+    case "breaking":
+      return "that today's callers and readers still work, or are changed with it";
+    case "spread":
+      return `across the repos in their deploy order (${what})`;
+  }
+}
+function testPlanFor(ctx, type, risk) {
+  const plan = testsFor(ctx.orgPack.testStrategy, type, risk.level);
+  const added = [];
+  for (const f of risk.factors) {
+    const factor = SIGNAL_FACTORS.includes(f.factor) ? f.factor : void 0;
+    const kinds = factor ? ctx.policy.risk.tests[factor] : void 0;
+    if (!factor || !kinds?.length)
+      continue;
+    added.push({ factor, kinds: [...kinds], why: whyOf(factor, f), cites: f.cites ?? [] });
+  }
+  if (!added.length)
+    return plan;
+  const matrix = [...plan.required];
+  const required = [...matrix];
+  for (const a of added)
+    for (const k of a.kinds)
+      if (!required.includes(k))
+        required.push(k);
+  return { ...plan, required, matrix, added };
+}
+
+// packages/changes/dist/lifecycle.js
+var import_yaml5 = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { readdir as readdir4, readFile as readFile6 } from "node:fs/promises";
+import { join as join7 } from "node:path";
+function phaseState(phase) {
+  return phase === "release" ? "release-ready" : phase;
+}
+function statePhase(state) {
+  if (state === "release-ready")
+    return "release";
+  return PHASES.includes(state) ? state : void 0;
+}
+function nextState(type, phase) {
+  const i = type.phases.indexOf(phase);
+  const next = type.phases[i + 1];
+  return next ? phaseState(next) : "released";
+}
+var ARRIVE = {
+  define: "definition",
+  design: "architecture",
+  plan: "planning",
+  build: "build",
+  qa: "QA",
+  release: "release"
+};
+function handoffName(type, phase) {
+  switch (phase) {
+    case "define": {
+      const next = type.phases[type.phases.indexOf(phase) + 1];
+      return next ? `Send to ${ARRIVE[next]}` : "Go/no-go";
+    }
+    case "design":
+      return "Approve design";
+    case "plan":
+      return "Plan ready";
+    case "build":
+      return "Raise PR";
+    case "qa":
+      return "QA sign-off";
+    case "release":
+      return "Go/no-go";
+  }
+}
+function artifactPhase(ctx, type, artifact) {
+  const want = PHASES.indexOf(ctx.policy.artifactPhases[artifact]);
+  return type.phases.find((p) => PHASES.indexOf(p) >= want) ?? type.phases.at(-1);
+}
+function phaseArtifacts(ctx, type, phase) {
+  const out = type.artifacts.filter((a) => artifactPhase(ctx, type, a) === phase);
+  if (phase === type.phases[0] && !out.includes("brief"))
+    out.unshift("brief");
+  return out;
+}
+function requiredArtifacts(ctx, type, phase, footprint) {
+  return phaseArtifacts(ctx, type, phase).filter((a) => {
+    if (!type.artifacts.includes(a))
+      return false;
+    if (a === "data")
+      return footprint.from.some((f) => f.startsWith("target-flows/")) ? footprint.signals.some((s) => s.factor === "schema") : footprint.dataStores.length + footprint.tables.length > 0;
+    return true;
+  });
+}
+async function phaseStage(ctx, change, phase) {
+  const step = ctx.policy.stages.find((x) => x.phase === phase);
+  if (!step)
+    return void 0;
+  const dir = changeFolder(ctx.root, change.id);
+  for (const x of ctx.policy.stages)
+    if (await readFile6(join7(dir, ...x.loop.split("/"))).then(() => true, () => false))
+      return step;
+  return void 0;
+}
+var stageCommand = (step, change) => step.command.replaceAll("<change>", change);
+async function checkStage(root, change, step) {
+  const dir = changeFolder(root, change.id);
+  const run = stageCommand(step, change.id);
+  const reason = (message) => [{ code: "stage-not-done", message }];
+  const text = await readFile6(join7(dir, ...step.loop.split("/")), "utf8").catch(() => void 0);
+  if (text === void 0)
+    return reason(`The ${step.stage} stage hasn't run yet: run ${run}.`);
+  let loop;
+  try {
+    loop = (0, import_yaml5.parse)(text);
+  } catch {
+    loop = null;
+  }
+  const state = typeof loop?.state === "string" ? loop.state : void 0;
+  switch (state) {
+    case "done":
+      break;
+    case "stopped":
+      return reason(`The ${step.stage} stage stopped and isn't done: see what stopped it, then run ${run} again.`);
+    case "questions":
+      return reason(`The ${step.stage} stage waits for a person to answer its questions: answer them (atticus questions), then run ${run} again.`);
+    case "waiting":
+      return reason(`The ${step.stage} stage is with your assistant${typeof loop?.run === "string" ? ` (run ${loop.run})` : ""}: finish the hand-off, then run ${run} again.`);
+    case "drafting":
+      return reason(`The ${step.stage} stage is still drafting and isn't done: run ${run}.`);
+    default:
+      return reason(`${step.loop} doesn't read as a stage's loop state: run ${run} again.`);
+  }
+  const out = [];
+  for (const w of step.writes.filter((x) => !x.endsWith("/") && !x.startsWith("stage/")))
+    if (!await readFile6(join7(dir, ...w.split("/"))).then(() => true, () => false))
+      out.push(...reason(`${w} is missing, though the ${step.stage} stage is done: run ${run} again.`));
+  return out;
+}
+async function stageFiles(dir, step) {
+  const out = [];
+  for (const w of [...step.writes, step.loop]) {
+    if (w.endsWith("/"))
+      out.push(...await walk(dir, w.slice(0, -1)));
+    else if (await readFile6(join7(dir, ...w.split("/"))).then(() => true, () => false))
+      out.push(w);
+  }
+  return [...new Set(out)].sort();
+}
+async function walk(dir, rel = "") {
+  let entries;
+  try {
+    entries = await readdir4(join7(dir, rel), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    const p = rel ? `${rel}/${e.name}` : e.name;
+    if (e.isDirectory())
+      out.push(...await walk(dir, p));
+    else
+      out.push(p);
+  }
+  return out.sort();
+}
+async function artifactFiles(dir, artifact) {
+  if (artifact === "specs")
+    return (await walk(dir, "specs")).filter((f2) => f2.endsWith(".md"));
+  if (artifact === "stories") {
+    const index = (await walk(dir)).includes("stories.md") ? ["stories.md"] : [];
+    return [...index, ...(await walk(dir, "stories")).filter((f2) => f2.endsWith(".md"))];
+  }
+  const f = `${artifact}.md`;
+  try {
+    await readFile6(join7(dir, f));
+    return [f];
+  } catch {
+    return [];
+  }
+}
+var FILE = {
+  brief: "brief.md",
+  proposal: "proposal.md",
+  specs: "specs/<capability>/spec.md",
+  interfaces: "interfaces.md",
+  mappings: "mappings.md",
+  data: "data.md",
+  design: "design.md",
+  ux: "ux.md",
+  stories: "stories.md",
+  tasks: "tasks.md",
+  snow: "snow.md"
+};
+async function checkArtifacts(root, change, artifacts) {
+  const dir = changeFolder(root, change.id);
+  const reasons = [];
+  for (const a of artifacts) {
+    let files = await artifactFiles(dir, a);
+    if (a === "stories")
+      files = files.filter((f) => f === "stories.md");
+    if (files.length === 0) {
+      reasons.push({ code: "missing-artifact", artifact: a, message: `${FILE[a]} is missing.` });
+      continue;
+    }
+    const texts = await Promise.all(files.map((f) => readFile6(join7(dir, f), "utf8")));
+    if (!texts.some(isFilled)) {
+      reasons.push({
+        code: "unfilled-artifact",
+        artifact: a,
+        message: `${files.length === 1 ? files[0] : FILE[a]} still holds only the template.`
+      });
+    }
+  }
+  return reasons;
+}
+async function checkFindings(root, change, gates) {
+  const reasons = [];
+  for (const gate of gates) {
+    const base = join7(changeFolder(root, change.id), "review", gate);
+    let rounds;
+    try {
+      rounds = (await readdir4(base, { withFileTypes: true })).filter((d) => d.isDirectory() && /^\d+$/.test(d.name)).map((d) => Number(d.name));
+    } catch {
+      continue;
+    }
+    if (rounds.length === 0)
+      continue;
+    const round2 = Math.max(...rounds);
+    const dir = join7(base, String(round2));
+    try {
+      const meta = (0, import_yaml5.parse)(await readFile6(join7(dir, "meta", "round.yaml"), "utf8"));
+      for (const l of meta?.lenses ?? [])
+        if (l.state === "waiting")
+          reasons.push({
+            code: "lens-waiting",
+            message: `The ${l.lens ?? "AI"} lens on the ${gate} gate (round ${round2}) is waiting for its hand-off answer${l.runId ? ` (atticus handoff done ${l.runId})` : ""}.`
+          });
+        else if (l.state === "failed")
+          reasons.push({
+            code: "lens-failed",
+            message: `The ${l.lens ?? "AI"} lens on the ${gate} gate (round ${round2}) didn't review${l.reason ? ` (${l.reason})` : ""}: run atticus critic ${change.id} --gate ${gate} again.`
+          });
+    } catch {
+    }
+    const files = (await readdir4(dir)).filter((f) => /\.ya?ml$/.test(f)).sort();
+    for (const f of files) {
+      const rel = `review/${gate}/${round2}/${f}`;
+      let data;
+      try {
+        data = (0, import_yaml5.parse)(await readFile6(join7(dir, f), "utf8"));
+      } catch {
+        data = void 0;
+      }
+      const r = Finding.safeParse(data);
+      if (!r.success) {
+        reasons.push({
+          code: "bad-finding",
+          message: `${rel} is not a valid finding (${r.error.issues[0]?.message ?? "unreadable"}), so the ${gate} gate can't be checked.`
+        });
+        continue;
+      }
+      const x = r.data;
+      const byAssistant = x.severity === "blocking" && isAssistantResolution(x.resolution);
+      if (x.state !== "open" && !byAssistant)
+        continue;
+      if (x.severity === "blocking")
+        reasons.push({
+          code: "blocking-finding",
+          finding: x.id,
+          message: `Blocking finding ${x.id} on the ${gate} gate (round ${round2}): ${x.summary}`
+        });
+      else if (x.severity === "gap")
+        reasons.push({
+          code: "open-gap",
+          finding: x.id,
+          message: `Knowledge gap ${x.id} on the ${gate} gate (round ${round2}) needs an answer or a fix: ${x.summary}`
+        });
+    }
+  }
+  return reasons;
+}
+function mandatoryGates(ctx) {
+  return [...new Set(ctx.orgPack.profiles.flatMap((p) => p.profile?.gates ?? []))].sort();
+}
+async function checkMandatoryRounds(root, change, gates) {
+  const reasons = [];
+  for (const gate of gates) {
+    const rounds = await readdir4(join7(changeFolder(root, change.id), "review", gate), {
+      withFileTypes: true
+    }).then((ds) => ds.filter((d) => d.isDirectory() && /^\d+$/.test(d.name)), () => []);
+    if (rounds.length === 0)
+      reasons.push({
+        code: "critic-round-missing",
+        message: `The ${gate} gate is mandatory on this platform and the critic hasn't reviewed it yet: run atticus critic ${change.id} --gate ${gate}.`
+      });
+  }
+  return reasons;
+}
+function phaseGates(ctx, phase) {
+  return ctx.orgPack.gates.gates.filter((g) => g.phase === phase).map((g) => g.id);
+}
+var BUILT_IN_GATES = ["drift", "hand-up", "trace", "conform"];
+var BUILT_IN_GATE_PHASES = ["build", "qa", "release"];
+function phaseFindingGates(ctx, phase) {
+  const own = phaseGates(ctx, phase);
+  if (!BUILT_IN_GATE_PHASES.includes(phase))
+    return own;
+  return [...own, ...BUILT_IN_GATES.filter((g) => !own.includes(g))];
+}
+function sha256(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+
+// packages/changes/dist/progress.js
+var import_yaml6 = __toESM(require_dist(), 1);
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+async function stageCompletion(ctx, change) {
+  const dir = changeFolder(ctx.root, change.id);
+  const out = [];
+  for (const s of ctx.policy.stages) {
+    const text = await readFile7(join8(dir, ...s.loop.split("/")), "utf8").catch(() => void 0);
+    let state = "not-started";
+    if (text !== void 0) {
+      try {
+        const y = (0, import_yaml6.parse)(text);
+        state = typeof y?.state === "string" ? y.state : "unknown";
+      } catch {
+        state = "unknown";
+      }
+    }
+    out.push({ stage: s.stage, phase: s.phase, state });
+  }
+  return out;
+}
+var cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+var and = (xs) => xs.length <= 1 ? xs[0] ?? "" : `${xs.slice(0, -1).join(", ")} and ${xs.at(-1)}`;
+function workProgress(type, state, stages, raised = false) {
+  if (stages.every((s) => s.state === "not-started"))
+    return void 0;
+  const phase = state === "returned" ? type.phases[0] : statePhase(state);
+  if (!phase)
+    return void 0;
+  const at = type.phases.indexOf(phase);
+  const own = stages.filter((s) => type.phases.includes(s.phase));
+  if (own.length && own.every((s) => type.phases.indexOf(s.phase) < at))
+    return void 0;
+  const done = own.filter((s) => s.state === "done").map((s) => s.stage);
+  const ahead = own.filter((s) => s.state === "done" && type.phases.indexOf(s.phase) > at).map((s) => s.phase);
+  const current = own.find((s) => s.phase === phase);
+  const under = own.find((s) => s.state !== "done" && s.state !== "not-started");
+  const last = own.filter((s) => s.state === "done").at(-1);
+  const name = handoffName(type, phase);
+  let summary;
+  if (under)
+    summary = `The ${under.stage} stage is ${under.state === "questions" ? "waiting on answers" : under.state}${done.length ? ` (${and(done)} done)` : ""}; the change is in ${state}.`;
+  else if (!current || current.state !== "done")
+    summary = `${done.length ? `${cap(and(done))} done; ` : ""}the ${current?.stage ?? phase} stage hasn't run yet; the change is in ${state}.`;
+  else if (ahead.length)
+    summary = `${cap(last.stage)} done; the change is still in ${state}: ${raised ? "merge" : "raise"} "${name}" (the ${phase} hand-off), then the ${and(ahead)} hand-offs.`;
+  else
+    summary = `${cap(current.stage)} done; waiting on "${name}" (the ${phase} hand-off${raised ? " PR to merge" : ", not raised yet"}).`;
+  return { done, ahead, summary };
+}
+
+// packages/changes/dist/approvals.js
+var strip = (h) => h.startsWith("@") ? h.slice(1) : h;
+function privacyImpact(ctx, type, footprint) {
+  const { phases } = ctx.policy.privacy;
+  return {
+    touched: footprint.personal.length > 0,
+    records: footprint.personal,
+    phase: phases.find((p) => type.phases.includes(p)) ?? type.phases.at(-1),
+    counted: personalLevels(ctx)
+  };
+}
+function prApprovers(handoff2, approvers) {
+  const raiser = strip(handoff2.by);
+  return [...new Set(approvers.map(strip))].filter((p) => p !== raiser).sort();
+}
+
+// packages/changes/dist/assess.js
+var liveHandoff = (c) => c.handoffs.find((h) => h.state === "open" || h.state === "changes-requested");
+async function assess(ctx, change) {
+  const type = changeTypeOf(ctx, change.type);
+  const footprint = await changeFootprint(ctx, change);
+  const risk = scoreRisk({ type: type.id, footprint }, ctx.policy);
+  const tests = testPlanFor(ctx, type.id, risk);
+  const privacy = privacyImpact(ctx, type, footprint);
+  const progress = workProgress(type, change.state, await stageCompletion(ctx, change), change.state !== "returned" && liveHandoff(change) !== void 0);
+  const base = {
+    change,
+    type,
+    state: change.state,
+    footprint,
+    risk,
+    tests,
+    privacy,
+    ...progress ? { progress } : {}
+  };
+  const phase = change.state === "returned" ? type.phases[0] : statePhase(change.state);
+  if (!phase) {
+    if (change.state === "released")
+      return { ...base, next: "archived", blockers: [], reasons: [] };
+    if (change.state === "post-release-review") {
+      const blockers2 = await checkFindings(ctx.root, change, ["post-release-review"]);
+      return { ...base, next: "archived", blockers: blockers2, reasons: blockers2 };
+    }
+    const reasons2 = [
+      {
+        code: "wrong-state",
+        message: change.state === "archived" ? `${change.id} is archived.` : `${change.id} is a draft; create it with atticus change new.`
+      }
+    ];
+    return { ...base, blockers: reasons2, reasons: reasons2 };
+  }
+  const stage = await phaseStage(ctx, change, phase);
+  const due = requiredArtifacts(ctx, type, phase, footprint).filter((a) => !stage || stage.artifacts.includes(a));
+  const stageReasons = stage ? await checkStage(ctx.root, change, stage) : [];
+  const blockers = [
+    ...stageReasons,
+    ...await checkArtifacts(ctx.root, change, due),
+    ...await checkFindings(ctx.root, change, phaseFindingGates(ctx, phase)),
+    ...stageReasons.length ? [] : await checkMandatoryRounds(ctx.root, change, phaseGates(ctx, phase).filter((g) => mandatoryGates(ctx).includes(g)))
+  ];
+  const next = change.state === "returned" ? phaseState(phase) : nextState(type, phase);
+  const live = change.state === "returned" ? void 0 : liveHandoff(change);
+  const reasons = [...blockers];
+  if (!live) {
+    reasons.push({
+      code: "no-handoff",
+      message: `No hand-off PR yet: raise "${handoffName(type, phase)}" when the ${phase} work is done.`
+    });
+  } else if (live.state === "changes-requested") {
+    reasons.push({
+      code: "changes-requested",
+      message: `Changes were requested on PR #${live.pr.number}; update the artifacts and hand off again.`
+    });
+  } else {
+    const approved = prApprovers(live, live.approvals.map((a) => a.by));
+    reasons.push({
+      code: "pr-not-merged",
+      message: approved.length ? `PR #${live.pr.number} is approved (${approved.join(", ")}) but not merged yet: ${live.pr.url}` : `Waiting for PR #${live.pr.number} to be approved and merged on the Git host: ${live.pr.url}`
+    });
+  }
+  return { ...base, phase, next, ...live ? { handoff: live } : {}, blockers, reasons };
+}
+async function canAdvance(change, root) {
+  const ctx = await loadChangeContext(root);
+  const c = typeof change === "string" ? await changeStore(root).read(change) : change;
+  const a = await assess(ctx, c);
+  return {
+    ok: a.reasons.length === 0,
+    state: a.state,
+    ...a.phase ? { phase: a.phase } : {},
+    ...a.next ? { next: a.next } : {},
+    reasons: a.reasons
+  };
+}
+async function changeReport(root, id) {
+  const ctx = await loadChangeContext(root);
+  const a = await assess(ctx, await changeStore(root).read(id));
+  return { ...a, nextStep: nextStep(a), problems: ctx.problems };
+}
+function nextStep(a) {
+  switch (a.state) {
+    case "draft":
+      return "Create the change with atticus change new.";
+    case "archived":
+      return "Nothing: the change is archived.";
+    case "released":
+      return "Archive the change.";
+    case "post-release-review":
+      return a.reasons.length ? "Resolve the post-release review findings, then archive the change." : "Review the skipped lenses, then archive the change.";
+    case "returned":
+      return `Revise the work, then hand off ${a.phase} again.`;
+  }
+  const name = handoffName(a.type, a.phase);
+  if (!a.handoff)
+    return a.blockers.length ? `Finish the ${a.phase} work, then raise "${name}".` : `Ready to raise "${name}".`;
+  if (a.handoff.state === "changes-requested")
+    return `Update the artifacts and hand off again on PR #${a.handoff.pr.number}.`;
+  return `Merge PR #${a.handoff.pr.number} once it is approved (${a.handoff.pr.url}); syncing then moves the change on.`;
+}
+
+// packages/changes/dist/new-change.js
+var import_yaml7 = __toESM(require_dist(), 1);
+import { mkdir, readFile as readFile8, writeFile } from "node:fs/promises";
+import { join as join9 } from "node:path";
+var nowIso = () => (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+var strip2 = (h) => h.startsWith("@") ? h.slice(1) : h;
+function slugify(title) {
+  return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80).replace(/-+$/, "");
+}
+async function exists(path) {
+  try {
+    await readFile8(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function defaultSchema(root) {
+  try {
+    const cfg = (0, import_yaml7.parse)(await readFile8(join9(openspecDirOf(root), "config.yaml"), "utf8"));
+    if (cfg && typeof cfg.schema === "string")
+      return cfg.schema;
+  } catch {
+  }
+  return "spec-driven";
+}
+async function newChange(root, opts) {
+  const ctx = await loadChangeContext(root);
+  const type = changeTypeOf(ctx, opts.type);
+  const id = opts.id ?? slugify(opts.title);
+  if (!RecordId.safeParse(id).success)
+    throw new ChangeError("invalid", `"${id}" can't be a change id; use a lowercase slug such as add-transfer-limit.`);
+  const template = pickTemplate(ctx.templates, type.id, opts.template);
+  if (!template)
+    throw new ChangeError("invalid", `Unknown change template ${opts.template}. Use one of: ${ctx.templates.map((t) => t.id).join(", ")}.`);
+  const store = changeStore(root);
+  if (await store.tryRead(id).catch(() => true))
+    throw new ChangeError("conflict", `Change ${id} already exists.`);
+  const now = opts.now ?? nowIso();
+  const by = strip2(opts.by);
+  const dir = changeFolder(root, id);
+  if (opts.openspec && !await exists(join9(dir, ".openspec.yaml"))) {
+    await opts.openspec.newChange(id, { description: opts.title });
+  } else {
+    await mkdir(dir, { recursive: true });
+    if (!await exists(join9(dir, ".openspec.yaml")))
+      await writeFile(join9(dir, ".openspec.yaml"), `schema: ${await defaultSchema(root)}
+created: ${now.slice(0, 10)}
+`, "utf8");
+  }
+  if (!await exists(join9(dir, "brief.md")))
+    await writeFileAtomic(join9(dir, "brief.md"), renderTemplate(template, {
+      title: opts.title,
+      id,
+      type: type.id,
+      by,
+      date: now.slice(0, 10)
+    }));
+  const owners = {};
+  for (const [role, people] of Object.entries(opts.owners ?? {}))
+    if (people.length)
+      owners[role] = [...new Set(people.map(strip2))];
+  if (!owners["product-owner"] && type.phases.includes("define"))
+    owners["product-owner"] = [by];
+  const first = phaseState(type.phases[0]);
+  const touches = ChangeTouches.parse(opts.touches ?? {});
+  const change = {
+    schemaVersion: 1,
+    id,
+    title: opts.title,
+    type: type.id,
+    template: template.id,
+    state: first,
+    owners,
+    systems: [...new Set(opts.systems ?? [])].sort(),
+    touches,
+    authors: {},
+    createdAt: now,
+    createdBy: by,
+    history: [
+      { from: "draft", to: first, at: now, by, reason: `Created from the ${template.id} template` }
+    ],
+    handoffs: []
+  };
+  await store.write(change);
+  return change;
+}
+
+// packages/changes/dist/publish.js
+import { rm } from "node:fs/promises";
+import { join as join10 } from "node:path";
+function gitHandoffPublisher(opts = {}) {
+  const remote = opts.remote ?? "origin";
+  const env = opts.env ?? process.env;
+  return {
+    async publish({ root, branch, base, files, message, approval }) {
+      requireApproval("git", approval);
+      const git = createGit({ env });
+      const out = async (args) => (await git(args, root)).stdout.trim();
+      const tryOut = (args) => out(args).catch(() => void 0);
+      const gitDir = await out(["rev-parse", "--absolute-git-dir"]);
+      await tryOut(["fetch", "--quiet", remote, base]);
+      await tryOut(["fetch", "--quiet", remote, branch]);
+      const start = await tryOut([
+        "rev-parse",
+        "--verify",
+        "--quiet",
+        `refs/remotes/${remote}/${branch}^{commit}`
+      ]) ?? await tryOut([
+        "rev-parse",
+        "--verify",
+        "--quiet",
+        `refs/remotes/${remote}/${base}^{commit}`
+      ]) ?? await out(["rev-parse", "--verify", `refs/heads/${base}^{commit}`]);
+      const index = join10(gitDir, "atticus-handoff-index");
+      const staged = createGit({ env: { ...env, GIT_INDEX_FILE: index } });
+      try {
+        await staged(["read-tree", start], root);
+        if (files.length > 0)
+          await staged(["add", "-f", "--", ...files], root);
+        const tree = (await staged(["write-tree"], root)).stdout.trim();
+        const startTree = await out(["rev-parse", `${start}^{tree}`]);
+        const commit = tree === startTree ? start : await out(["commit-tree", tree, "-p", start, "-m", message]);
+        await out(["update-ref", `refs/heads/${branch}`, commit]);
+        await out(["push", "--quiet", remote, `${commit}:refs/heads/${branch}`]);
+        return { commit };
+      } finally {
+        await rm(index, { force: true });
+      }
+    }
+  };
+}
+
+// packages/changes/dist/handoff.js
+import { readdir as readdir6, readFile as readFile10 } from "node:fs/promises";
+import { join as join12 } from "node:path";
+
+// packages/changes/dist/drafted.js
+var import_yaml8 = __toESM(require_dist(), 1);
+import { mkdir as mkdir2, readdir as readdir5, readFile as readFile9, rm as rm2 } from "node:fs/promises";
+import { dirname, join as join11, relative, sep } from "node:path";
+var CAPTURE_SCHEMA_VERSION = 1;
+var DraftCapture = external_exports.object({
+  schemaVersion: external_exports.literal(CAPTURE_SCHEMA_VERSION),
+  change: external_exports.string().min(1),
+  stage: external_exports.string().min(1),
+  phase: external_exports.string().min(1),
+  pr: external_exports.object({ number: external_exports.number().int().positive(), url: external_exports.string().min(1) }),
+  branch: external_exports.string().min(1),
+  base: external_exports.string().min(1),
+  /** captured: both sides kept. waiting-for-merge: the merge isn't in the clone yet. no-draft: the drafted files are gone. */
+  state: external_exports.enum(["captured", "waiting-for-merge", "no-draft"]),
+  /** When Atticus saw the PR merged (the sync's time). */
+  mergedAt: external_exports.string().min(1),
+  capturedAt: external_exports.string().min(1),
+  drafted: external_exports.object({
+    from: external_exports.enum(["git", "working-tree", "missing"]),
+    commit: external_exports.string().optional()
+  }),
+  merged: external_exports.object({
+    commit: external_exports.string().min(1),
+    /** The merge commit's committer date. */
+    at: external_exports.string().min(1),
+    how: external_exports.enum(["message", "ancestry"])
+  }).optional(),
+  files: external_exports.array(external_exports.object({
+    path: external_exports.string().min(1),
+    status: external_exports.enum(["same", "edited", "added", "removed"]),
+    drafted: external_exports.string().optional(),
+    merged: external_exports.string().optional()
+  })).default([]),
+  note: external_exports.string().optional()
+});
+var capturePaths = (stage) => ({
+  capture: `stage/${stage}.capture.yaml`,
+  drafted: `stage/${stage}.drafted`,
+  merged: `stage/${stage}.merged`
+});
+var HEADER = "# What Atticus drafted beside what was merged (H1, ADR 0087 addendum). Atticus writes this file.\n";
+function machinery(path) {
+  return path === "change.yaml" || path === "brief.md" || path.startsWith("stage/") || path.startsWith("review/") || path.startsWith("questions/") || path.startsWith("design/") || path.startsWith("inputs/");
+}
+function artifactMatch(path, a) {
+  if (a === "specs")
+    return path.startsWith("specs/") && path.endsWith(".md");
+  if (a === "stories")
+    return path === "stories.md" || path.startsWith("stories/") && path.endsWith(".md");
+  return path === `${a}.md`;
+}
+function draftedPath(path, step, artifacts) {
+  if (machinery(path))
+    return false;
+  if (step) {
+    for (const w of step.writes)
+      if (w.endsWith("/") ? path.startsWith(w) : path === w)
+        return !machinery(path);
+    return step.artifacts.some((a) => artifactMatch(path, a));
+  }
+  return artifacts.some((a) => a !== "brief" && artifactMatch(path, a));
+}
+async function openGit(root, runner) {
+  const top = await runner(["rev-parse", "--show-toplevel"], root).then((r) => r.stdout.trim(), () => void 0);
+  if (!top)
+    return void 0;
+  const prefix = (await runner(["rev-parse", "--show-prefix"], root)).stdout.trim();
+  const run = async (args) => (await runner(args, top)).stdout;
+  return {
+    git: { run, tryRun: (args) => run(args).catch(() => void 0) },
+    prefix
+  };
+}
+var sameText = (text, recorded) => sha256(text) === recorded || sha256(text.replace(/\r?\n/g, "\r\n")) === recorded || sha256(text.replace(/\r\n/g, "\n")) === recorded;
+async function walk2(dir, rel = "") {
+  let entries;
+  try {
+    entries = await readdir5(join11(dir, rel), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries) {
+    const p = rel ? `${rel}/${e.name}` : e.name;
+    if (e.isDirectory())
+      out.push(...await walk2(dir, p));
+    else
+      out.push(p);
+  }
+  return out.sort();
+}
+async function firstParentLog(git, ref) {
+  const out = await git.tryRun([
+    "log",
+    "--first-parent",
+    "-n",
+    "500",
+    "--format=%H%x1f%cI%x1f%B%x1e",
+    ref
+  ]);
+  if (!out)
+    return [];
+  return out.split("").map((x) => x.replace(/^\s+/, "")).filter(Boolean).map((x) => {
+    const [sha, at, message] = x.split("");
+    return { sha: sha.trim(), at: (at ?? "").trim(), message: message ?? "" };
+  });
+}
+var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+async function findMerge(git, refs, branch, pr, draft) {
+  const names = new RegExp(`(^|[^\\w.-])${escape(branch)}($|[^\\w/.-])`);
+  const number = new RegExp(`(#|!|\\bPR\\s*)${pr}(?!\\d)`);
+  for (const ref of refs) {
+    const log = await firstParentLog(git, ref);
+    if (!log.length)
+      continue;
+    const oldest = [...log].reverse();
+    const byBranch = oldest.find((e) => names.test(e.message));
+    const byNumber = byBranch ?? oldest.find((e) => number.test(e.message));
+    if (byNumber)
+      return { commit: byNumber.sha, at: byNumber.at, how: "message" };
+    if (draft) {
+      const after = await git.tryRun(["rev-list", "--ancestry-path", `${draft}..${ref}`]);
+      const descendants = new Set((after ?? "").split("\n").map((s) => s.trim()).filter(Boolean));
+      const merge = oldest.find((e) => descendants.has(e.sha));
+      if (merge)
+        return { commit: merge.sha, at: merge.at, how: "ancestry" };
+      const ff = oldest.find((e) => e.sha === draft);
+      if (ff)
+        return { commit: ff.sha, at: ff.at, how: "ancestry" };
+    }
+  }
+  return void 0;
+}
+async function existing(git, refs) {
+  const out = [];
+  for (const r of refs)
+    if (await git.tryRun(["rev-parse", "--verify", "--quiet", `${r}^{commit}`]))
+      out.push(r);
+  return out;
+}
+async function blob(git, commit, path) {
+  return git.tryRun(["cat-file", "blob", `${commit}:${path}`]);
+}
+async function findDraft(git, ref, dirInTree, recorded) {
+  const commits = await git.tryRun(["rev-list", "-n", "100", ref, "--", dirInTree]);
+  for (const c of (commits ?? "").split("\n").map((s) => s.trim()).filter(Boolean)) {
+    let all = true;
+    for (const r of recorded) {
+      const text = await blob(git, c, `${dirInTree}/${r.path}`);
+      if (text === void 0 || !sameText(text, r.sha256)) {
+        all = false;
+        break;
+      }
+    }
+    if (all)
+      return c;
+  }
+  return void 0;
+}
+async function captureStageOf(ctx, change, phase) {
+  const step = await phaseStage(ctx, change, phase);
+  return step ? { name: step.stage, step } : { name: phase };
+}
+async function captureHandoff(input) {
+  const { ctx, change, handoff: handoff2 } = input;
+  const root = ctx.root;
+  const opened = await openGit(root, input.git ?? createGit());
+  if (!opened)
+    return void 0;
+  const { git, prefix } = opened;
+  const remote = input.remote ?? "origin";
+  const phase = handoff2.phase;
+  const { name, step } = await captureStageOf(ctx, change, phase);
+  const artifacts = phaseArtifacts(ctx, input.type, phase);
+  const isDraft = (p2) => draftedPath(p2, step, artifacts);
+  const recorded = handoff2.artifacts.filter((a) => isDraft(a.path));
+  if (!recorded.length)
+    return void 0;
+  const dirInTree = `${prefix}${changesRelOf(root)}/${change.id}`;
+  const branchRefs = await existing(git, [
+    `refs/heads/${handoff2.branch}`,
+    `refs/remotes/${remote}/${handoff2.branch}`
+  ]);
+  let draft;
+  for (const ref of branchRefs) {
+    draft = await findDraft(git, ref, dirInTree, recorded);
+    if (draft)
+      break;
+  }
+  const baseRefs = await existing(git, [
+    `refs/remotes/${remote}/${input.base}`,
+    `refs/heads/${input.base}`
+  ]);
+  const merged = await findMerge(git, baseRefs, handoff2.branch, handoff2.pr.number, draft);
+  if (!draft && merged && await git.tryRun(["rev-parse", "--verify", "--quiet", `${merged.commit}^2`]))
+    draft = await findDraft(git, `${merged.commit}^2`, dirInTree, recorded);
+  const folder = changeFolder(root, change.id);
+  const draftedFiles = /* @__PURE__ */ new Map();
+  let from = "missing";
+  if (draft) {
+    from = "git";
+    const listed = await git.tryRun([
+      "ls-tree",
+      "-r",
+      "--name-only",
+      "--full-tree",
+      draft,
+      "--",
+      dirInTree
+    ]);
+    const paths2 = new Set(recorded.map((r) => r.path));
+    for (const full of (listed ?? "").split("\n").map((s) => s.trim()).filter(Boolean)) {
+      const p2 = full.slice(dirInTree.length + 1);
+      if (isDraft(p2) && paths2.has(p2)) {
+        const t = await blob(git, draft, full);
+        if (t !== void 0)
+          draftedFiles.set(p2, t);
+      }
+    }
+  } else {
+    const texts = await Promise.all(recorded.map(async (r) => [
+      r,
+      await readFile9(join11(folder, ...r.path.split("/")), "utf8").catch(() => void 0)
+    ]));
+    if (texts.every(([r, t]) => t !== void 0 && sameText(t, r.sha256))) {
+      from = "working-tree";
+      for (const [r, t] of texts)
+        draftedFiles.set(r.path, t);
+    }
+  }
+  const mergedFiles = /* @__PURE__ */ new Map();
+  if (merged) {
+    const listed = await git.tryRun([
+      "ls-tree",
+      "-r",
+      "--name-only",
+      "--full-tree",
+      merged.commit,
+      "--",
+      dirInTree
+    ]);
+    for (const full of (listed ?? "").split("\n").map((s) => s.trim()).filter(Boolean)) {
+      const p2 = full.slice(dirInTree.length + 1);
+      if (!isDraft(p2))
+        continue;
+      const t = await blob(git, merged.commit, full);
+      if (t !== void 0)
+        mergedFiles.set(p2, t);
+    }
+  }
+  const state = from === "missing" ? "no-draft" : merged ? "captured" : "waiting-for-merge";
+  const paths = [
+    .../* @__PURE__ */ new Set([...draftedFiles.keys(), ...merged ? mergedFiles.keys() : []])
+  ].sort();
+  const files = paths.map((path) => {
+    const d = draftedFiles.get(path);
+    const m = merged ? mergedFiles.get(path) : void 0;
+    const status = !merged || d === m ? "same" : d === void 0 ? "added" : m === void 0 ? "removed" : "edited";
+    return {
+      path,
+      status,
+      ...d !== void 0 ? { drafted: sha256(d) } : {},
+      ...m !== void 0 ? { merged: sha256(m) } : {}
+    };
+  });
+  const capture = {
+    schemaVersion: CAPTURE_SCHEMA_VERSION,
+    change: change.id,
+    stage: name,
+    phase,
+    pr: handoff2.pr,
+    branch: handoff2.branch,
+    base: input.base,
+    state,
+    mergedAt: handoff2.updatedAt ?? input.now,
+    capturedAt: input.now,
+    drafted: { from, ...draft ? { commit: draft } : {} },
+    ...merged ? { merged } : {},
+    files: state === "captured" ? files : [],
+    ...state === "waiting-for-merge" ? {
+      note: `The merge of PR #${handoff2.pr.number} isn't in this clone yet: pull ${input.base}, then run atticus change learn.`
+    } : state === "no-draft" ? {
+      note: `No commit on ${handoff2.branch} and no file on disk has the drafted files' hashes any more, so the draft can't be compared.`
+    } : {}
+  };
+  const p = capturePaths(name);
+  await rm2(join11(folder, ...p.drafted.split("/")), { recursive: true, force: true });
+  await rm2(join11(folder, ...p.merged.split("/")), { recursive: true, force: true });
+  const put = async (base, rel, text) => {
+    const f = join11(folder, ...base.split("/"), ...rel.split("/"));
+    await mkdir2(dirname(f), { recursive: true });
+    await writeFileAtomic(f, text);
+  };
+  for (const [rel, t] of draftedFiles)
+    await put(p.drafted, rel, t);
+  if (state === "captured")
+    for (const [rel, t] of mergedFiles)
+      await put(p.merged, rel, t);
+  await mkdir2(join11(folder, "stage"), { recursive: true });
+  await writeFileAtomic(join11(folder, ...p.capture.split("/")), HEADER + (0, import_yaml8.stringify)(capture, { lineWidth: 0 }));
+  return { capture, file: p.capture };
+}
+async function readFolderFiles(dir) {
+  const out = /* @__PURE__ */ new Map();
+  for (const f of await walk2(dir))
+    out.set(f, (await readFile9(join11(dir, ...f.split("/")), "utf8")).replace(/\r\n/g, "\n"));
+  return out;
+}
+async function changeFolders(root) {
+  const base = join11(root, ...changesRelOf(root).split("/"));
+  const out = [];
+  const list = async (dir) => (await readdir5(dir, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  for (const name of await list(base)) {
+    if (name === "archive")
+      for (const a of await list(join11(base, "archive")))
+        out.push(join11(base, "archive", a));
+    else
+      out.push(join11(base, name));
+  }
+  return out;
+}
+async function readDraftPairs(root) {
+  const out = [];
+  for (const folder of await changeFolders(root)) {
+    const names = (await readdir5(join11(folder, "stage")).catch(() => [])).filter((f) => f.endsWith(".capture.yaml")).sort();
+    for (const f of names) {
+      let capture;
+      try {
+        capture = DraftCapture.parse((0, import_yaml8.parse)(await readFile9(join11(folder, "stage", f), "utf8")));
+      } catch {
+        continue;
+      }
+      const p = capturePaths(capture.stage);
+      out.push({
+        capture,
+        folder: relative(root, folder).split(sep).join("/"),
+        drafted: await readFolderFiles(join11(folder, ...p.drafted.split("/"))),
+        merged: await readFolderFiles(join11(folder, ...p.merged.split("/")))
+      });
+    }
+  }
+  return out;
+}
+async function completeCaptures(root, ctx, o) {
+  const out = [];
+  let changes;
+  try {
+    changes = await changeStore(root).list();
+  } catch {
+    return out;
+  }
+  for (const change of changes) {
+    const type = ctx.orgPack.changeTypes.types.find((t) => t.id === change.type);
+    if (!type)
+      continue;
+    for (const h of change.handoffs.filter((x) => x.state === "merged")) {
+      const { name } = await captureStageOf(ctx, change, h.phase);
+      const file = join11(changeFolder(root, change.id), ...capturePaths(name).capture.split("/"));
+      const prior = await readFile9(file, "utf8").then((t) => DraftCapture.safeParse((0, import_yaml8.parse)(t)), () => void 0);
+      if (prior?.success && prior.data.pr.number === h.pr.number && prior.data.state !== "waiting-for-merge")
+        continue;
+      const base = prior?.success ? prior.data.base : o.defaultBase ?? "main";
+      const r = await captureHandoff({
+        ctx,
+        change,
+        type,
+        handoff: h,
+        base,
+        now: o.now,
+        ...o.git ? { git: o.git } : {},
+        ...o.remote ? { remote: o.remote } : {}
+      });
+      if (r)
+        out.push(r);
+    }
+  }
+  return out;
+}
+
+// packages/changes/dist/handoff.js
+var nowIso2 = () => (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+var strip3 = (h) => h.startsWith("@") ? h.slice(1) : h;
+function metarepo(ctx, repo) {
+  const fromRuntime = ctx.orgPack.runtime.adapters.gitHost?.settings.metarepo;
+  const r = repo ?? (typeof fromRuntime === "string" ? fromRuntime : void 0);
+  if (!r)
+    throw new ChangeError("invalid", "Say which repo on the Git host is the metarepo: pass --repo, or set metarepo under adapters.gitHost.settings in runtime.yaml.");
+  return r;
+}
+async function load(root, id) {
+  const ctx = await loadChangeContext(root);
+  const change = await changeStore(root).read(id).catch((e) => {
+    throw new ChangeError("not-found", e.message);
+  });
+  return { ctx, change };
+}
+async function walkReview(dir, gate) {
+  const out = [];
+  const base = join12(dir, "review", gate);
+  let rounds;
+  try {
+    rounds = (await readdir6(base)).filter((r) => /^\d+$/.test(r)).sort((a, b) => Number(a) - Number(b));
+  } catch {
+    return [];
+  }
+  for (const r of rounds) {
+    try {
+      for (const f of (await readdir6(join12(base, r))).filter((x) => /\.ya?ml$/.test(x)).sort())
+        out.push(`review/${gate}/${r}/${f}`);
+    } catch {
+    }
+  }
+  return out;
+}
+async function keptPairFiles(dir) {
+  const out = [];
+  let entries;
+  try {
+    entries = await readdir6(join12(dir, "stage"), { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  const walk3 = async (rel) => {
+    for (const e of await readdir6(join12(dir, ...rel.split("/")), { withFileTypes: true }).catch(() => [])) {
+      const p = `${rel}/${e.name}`;
+      if (e.isDirectory())
+        await walk3(p);
+      else
+        out.push(p);
+    }
+  };
+  for (const e of entries) {
+    if (e.isFile() && e.name.endsWith(".capture.yaml"))
+      out.push(`stage/${e.name}`);
+    else if (e.isDirectory() && /\.(drafted|merged)$/.test(e.name))
+      await walk3(`stage/${e.name}`);
+  }
+  return out.sort();
+}
+async function handoffFiles(ctx, a, phase) {
+  const dir = changeFolder(ctx.root, a.change.id);
+  const artifacts = [];
+  const files = /* @__PURE__ */ new Set();
+  for (const art of phaseArtifacts(ctx, a.type, phase)) {
+    const f = await artifactFiles(dir, art);
+    if (f.length === 0)
+      continue;
+    artifacts.push(art);
+    for (const x of f)
+      files.add(x);
+  }
+  const stage = await phaseStage(ctx, a.change, phase);
+  if (stage)
+    for (const f of await stageFiles(dir, stage))
+      files.add(f);
+  if (phase === "build") {
+    for (const extra of ["tasks.md", "repos.yaml"]) {
+      try {
+        await readFile10(join12(dir, extra));
+        files.add(extra);
+      } catch {
+      }
+    }
+  }
+  for (const gate of phaseGates(ctx, phase))
+    for (const f of await walkReview(dir, gate))
+      files.add(f);
+  for (const f of await keptPairFiles(dir))
+    files.add(f);
+  return { files: [...files].sort(), artifacts };
+}
+function prBody(a, phase, next, paths, reviewers, review) {
+  const c = a.change;
+  const lines2 = [
+    `## Hand-off: ${handoffName(a.type, phase)}`,
+    "",
+    `Change ${c.id} (${c.title}), type ${c.type}, moves from ${phase} to ${next} when this pull request merges.`,
+    "",
+    "Merging this pull request approves the hand-off. The Git host's own rules (branch protection, CODEOWNERS) decide who may approve it.",
+    "",
+    "### Files",
+    "",
+    ...paths.length ? paths.map((f) => `- ${f}`) : ["- None"],
+    "",
+    "### Reviewers",
+    "",
+    ...reviewers.length ? reviewers.map((r) => `- @${r}`) : ["- None"],
+    "",
+    "### Risk",
+    "",
+    `${a.risk.level} (${a.risk.score})`,
+    "",
+    ...a.risk.factors.map((f) => `- ${f.detail}: +${f.points}`),
+    "",
+    "### Privacy",
+    "",
+    a.privacy.touched ? `Touches personal data (${a.privacy.records.map((r) => r.id).join(", ")}); review it with the ${a.privacy.phase} hand-off.` : "No personal data touched.",
+    ...review?.trim() ? ["", review.trim()] : []
+  ];
+  return lines2.join("\n") + "\n";
+}
+async function handoff(root, id, opts) {
+  requireApproval("changes", opts.approval);
+  const { ctx, change } = await load(root, id);
+  const repo = metarepo(ctx, opts.repo);
+  const now = opts.now ?? nowIso2();
+  const by = strip3(opts.by);
+  const a = await assess(ctx, change);
+  const phase = a.phase;
+  if (!phase)
+    throw new ChangeError("refused", `${id} is ${change.state}; there is nothing to hand off.`, a.reasons);
+  if (a.blockers.length > 0)
+    throw new ChangeError("refused", `${id} isn't ready for "${handoffName(a.type, phase)}".`, a.blockers);
+  if (opts.openspec && phase === "plan")
+    await requireValid(opts.openspec, id);
+  const { files, artifacts } = await handoffFiles(ctx, a, phase);
+  const dir = changeFolder(root, id);
+  const hashed = await Promise.all(files.map(async (path) => ({ path, sha256: sha256(await readFile10(join12(dir, path))) })));
+  const authors = { ...change.authors };
+  for (const art of artifacts) {
+    const people = (opts.authors?.[art] ?? [by]).map(strip3);
+    authors[art] = [.../* @__PURE__ */ new Set([...authors[art] ?? [], ...people])];
+  }
+  const branch = handoffBranch(id, phase);
+  const rel = changesRelOf(root);
+  const metaFiles = [...files.map((f) => `${rel}/${id}/${f}`), `${rel}/${id}/change.yaml`];
+  const reviewers = [
+    ...new Set(files.flatMap((f) => ownersFor(ctx.codeowners, `${rel}/${id}/${f}`)))
+  ].filter((p) => p !== by).sort();
+  const live = change.state === "returned" ? void 0 : liveHandoff(change);
+  if (live && live.phase === phase) {
+    const pr2 = await opts.gitHost.getPullRequest(repo, live.pr.number);
+    if (pr2.state === "open" || pr2.state === "draft") {
+      await opts.publisher?.publish({
+        root,
+        branch,
+        base: pr2.base,
+        files: metaFiles,
+        message: `${handoffName(a.type, phase)}: update`,
+        approval: opts.approval
+      });
+      await opts.gitHost.comment(repo, live.pr.number, `${by} updated the hand-off for another review.`, opts.approval);
+      const updated = {
+        ...live,
+        state: "open",
+        updatedAt: now,
+        reviewers,
+        artifacts: hashed,
+        approvals: []
+      };
+      await changeStore(root).write({
+        ...change,
+        authors,
+        handoffs: change.handoffs.map((h2) => h2 === live ? updated : h2)
+      });
+      return updated;
+    }
+    if (pr2.state === "merged")
+      throw new ChangeError("refused", `PR #${pr2.number} is already merged on the Git host; sync the change instead.`);
+    live.state = "closed";
+    live.updatedAt = now;
+  }
+  const base = opts.base ?? (await opts.gitHost.getRepo(repo)).defaultBranch;
+  const next = a.next;
+  await opts.publisher?.publish({
+    root,
+    branch,
+    base,
+    files: metaFiles,
+    message: `${handoffName(a.type, phase)}: ${change.title}`,
+    approval: opts.approval
+  });
+  const pr = await opts.gitHost.createPullRequest({
+    repo,
+    head: branch,
+    base,
+    title: `${change.title}: ${handoffName(a.type, phase)}`,
+    body: prBody(a, phase, change.state === "returned" ? nextAfterResubmit(a, phase) : next, files.map((f) => `${rel}/${id}/${f}`), reviewers, opts.review)
+  }, opts.approval);
+  const h = {
+    phase,
+    branch,
+    pr: { number: pr.number, url: pr.url },
+    state: "open",
+    by,
+    openedAt: now,
+    reviewers,
+    approvals: [],
+    artifacts: hashed
+  };
+  const history = [...change.history];
+  let state = change.state;
+  if (change.state === "returned") {
+    history.push({ from: "returned", to: phaseState(phase), at: now, by, reason: "Resubmitted" });
+    state = phaseState(phase);
+  }
+  await changeStore(root).write({
+    ...change,
+    state,
+    authors,
+    history,
+    handoffs: [...change.handoffs, h]
+  });
+  return h;
+}
+function nextAfterResubmit(a, phase) {
+  const next = a.type.phases[a.type.phases.indexOf(phase) + 1];
+  return next ? phaseState(next) : "released";
+}
+async function syncHandoff(root, id, opts) {
+  const { ctx, change } = await load(root, id);
+  const repo = metarepo(ctx, opts.repo);
+  const now = opts.now ?? nowIso2();
+  const live = liveHandoff(change);
+  if (!live)
+    throw new ChangeError("refused", `${id} has no open hand-off PR to sync.`, [
+      { code: "no-handoff", message: `${id} has no open hand-off PR.` }
+    ]);
+  const a = await assess(ctx, change);
+  const pr = await opts.gitHost.getPullRequest(repo, live.pr.number);
+  const current = pr.url !== live.pr.url || pr.number !== live.pr.number ? { ...live, pr: { number: pr.number, url: pr.url } } : live;
+  const store = changeStore(root);
+  const save = async (h2, extra = {}) => {
+    const updated = {
+      ...change,
+      ...extra,
+      handoffs: change.handoffs.map((x) => x === live ? h2 : x)
+    };
+    await store.write(updated);
+    return updated;
+  };
+  if (pr.state === "closed") {
+    const h2 = { ...current, state: "closed", updatedAt: now };
+    await save(h2);
+    return {
+      merged: false,
+      ready: false,
+      state: change.state,
+      handoff: h2,
+      reasons: [{ code: "pr-closed", message: `PR #${pr.number} was closed on the Git host.` }]
+    };
+  }
+  const latest = /* @__PURE__ */ new Map();
+  for (const r of pr.reviews)
+    if (r.state !== "commented")
+      latest.set(strip3(r.by), r.state);
+  const approvers = [...latest].filter(([, s]) => s === "approved").map(([p]) => p);
+  const requested = [...latest].filter(([, s]) => s === "changes-requested").map(([p]) => p).sort();
+  const counted = prApprovers(live, approvers);
+  const approvals = counted.map((by) => ({ by, at: now }));
+  const advance = async (by) => {
+    const h2 = { ...current, state: "merged", updatedAt: now, approvals };
+    const next = a.next;
+    const history = [
+      ...change.history,
+      {
+        from: change.state,
+        to: next,
+        at: now,
+        by,
+        pr: pr.number,
+        reason: `${handoffName(a.type, live.phase)} merged`
+      }
+    ];
+    let state = next;
+    if (next === "released" && a.type.postReleaseReview) {
+      history.push({
+        from: "released",
+        to: "post-release-review",
+        at: now,
+        by,
+        reason: "Released first; the skipped lenses are reviewed now"
+      });
+      state = "post-release-review";
+    }
+    const saved = await save(h2, { state, history });
+    const kept = await captureHandoff({
+      ctx,
+      change: saved,
+      type: a.type,
+      handoff: h2,
+      base: pr.base,
+      now,
+      ...opts.git ? { git: opts.git } : {},
+      ...opts.remote ? { remote: opts.remote } : {}
+    }).catch(() => void 0);
+    return {
+      merged: true,
+      ready: true,
+      state,
+      handoff: h2,
+      reasons: [],
+      ...kept ? { capture: kept.capture } : {}
+    };
+  };
+  if (pr.state === "merged")
+    return advance(strip3(opts.approval?.by ?? live.by));
+  if (requested.length > 0) {
+    const h2 = { ...current, state: "changes-requested", updatedAt: now, approvals };
+    await save(h2);
+    return {
+      merged: false,
+      ready: false,
+      state: change.state,
+      handoff: h2,
+      reasons: requested.map((p) => ({
+        code: "changes-requested",
+        person: p,
+        message: `${p} requested changes on PR #${pr.number}.`
+      }))
+    };
+  }
+  const h = { ...current, state: "open", updatedAt: now, approvals };
+  const reasons = [];
+  if (counted.length === 0)
+    reasons.push(approvers.length > 0 ? {
+      code: "self-approval",
+      person: strip3(live.by),
+      message: `PR #${pr.number} is approved only by ${strip3(live.by)}, who raised it; it needs someone else's approval.`
+    } : {
+      code: "approval-missing",
+      message: `PR #${pr.number} isn't approved yet: ask a reviewer on the Git host (${pr.url}).`
+    });
+  if (reasons.length === 0) {
+    reasons.push(...a.blockers);
+  }
+  if (reasons.length === 0) {
+    const blockers = mergeBlockers(pr);
+    if (blockers.length > 0)
+      reasons.push({
+        code: "host-refused",
+        message: `The Git host won't merge PR #${pr.number} yet: ${blockers.join("; ")}.`
+      });
+  }
+  if (reasons.length > 0 || !opts.approval) {
+    await save(h);
+    return { merged: false, ready: reasons.length === 0, state: change.state, handoff: h, reasons };
+  }
+  const approval = requireApproval("changes", opts.approval);
+  try {
+    await opts.gitHost.merge(repo, pr.number, opts.approval);
+  } catch (e) {
+    if (!(e instanceof AdapterError))
+      throw e;
+    await save(h);
+    return {
+      merged: false,
+      ready: false,
+      state: change.state,
+      handoff: h,
+      reasons: [{ code: "host-refused", message: `The Git host refused the merge: ${e.message}` }]
+    };
+  }
+  return advance(strip3(approval.by));
+}
+async function returnToPo(root, id, opts) {
+  const { ctx, change } = await load(root, id);
+  const live = liveHandoff(change);
+  if (!live)
+    throw new ChangeError("refused", `${id} has no open hand-off PR to return.`, [
+      { code: "no-handoff", message: `${id} has no open hand-off PR.` }
+    ]);
+  requireApproval("changes", opts.approval);
+  const repo = metarepo(ctx, opts.repo);
+  const now = opts.now ?? nowIso2();
+  const by = strip3(opts.by);
+  const host = opts.gitHost;
+  await host.comment(repo, live.pr.number, `Returned to the product owner by ${by}: ${opts.reason}`, opts.approval);
+  const closedOnHost = host.closePullRequest ? (await host.closePullRequest(repo, live.pr.number, opts.approval)).state === "closed" : false;
+  const h = { ...live, state: "closed", updatedAt: now };
+  await changeStore(root).write({
+    ...change,
+    state: "returned",
+    history: [
+      ...change.history,
+      {
+        from: change.state,
+        to: "returned",
+        at: now,
+        by,
+        pr: live.pr.number,
+        reason: `Returned to the product owner (${opts.reason})`
+      }
+    ],
+    handoffs: change.handoffs.map((x) => x === live ? h : x)
+  });
+  return { state: "returned", closedOnHost, handoff: h };
+}
+async function requireValid(openspec, id) {
+  const r = await openspec.validate({ item: id, type: "change", strict: true });
+  const item = r.items[0];
+  if (!item || item.valid)
+    return;
+  throw new ChangeError("refused", `${id} doesn't pass openspec validate --strict.`, item.issues.filter((i) => i.level !== "INFO").map((i) => ({ code: "openspec-invalid", message: `${i.path}: ${i.message}` })));
+}
+async function archiveChange(root, id, opts) {
+  const { ctx, change } = await load(root, id);
+  const a = await assess(ctx, change);
+  if (change.state !== "released" && change.state !== "post-release-review")
+    throw new ChangeError("refused", `${id} is ${change.state}; only a released change can be archived.`, [{ code: "wrong-state", message: `${id} is ${change.state}.` }]);
+  if (a.reasons.length > 0)
+    throw new ChangeError("refused", `${id} can't be archived yet.`, a.reasons);
+  if (opts.openspec)
+    await requireValid(opts.openspec, id);
+  const now = opts.now ?? nowIso2();
+  const updated = {
+    ...change,
+    state: "archived",
+    history: [
+      ...change.history,
+      { from: change.state, to: "archived", at: now, by: strip3(opts.by), reason: "Archived" }
+    ]
+  };
+  await changeStore(root).write(updated);
+  if (opts.openspec)
+    await opts.openspec.archive(id);
+  return updated;
+}
+
+// packages/changes/dist/learn.js
+var import_yaml9 = __toESM(require_dist(), 1);
+import { readFile as readFile11 } from "node:fs/promises";
+import { join as join13 } from "node:path";
+var LEARN_SCHEMA_VERSION = 1;
+var MAX_CELLS = 4e6;
+var lines = (text) => {
+  if (text === void 0 || text === "")
+    return [];
+  const ls = text.replace(/\r\n/g, "\n").split("\n");
+  if (ls[ls.length - 1] === "")
+    ls.pop();
+  return ls;
+};
+function lineDiff(a, b) {
+  const n = a.length;
+  const m = b.length;
+  if (n * m > MAX_CELLS) {
+    const left = /* @__PURE__ */ new Map();
+    for (const l of b)
+      left.set(l, (left.get(l) ?? 0) + 1);
+    const out2 = [];
+    for (const l of a) {
+      const k = left.get(l) ?? 0;
+      if (k > 0) {
+        left.set(l, k - 1);
+        out2.push({ op: "=", line: l });
+      } else
+        out2.push({ op: "-", line: l });
+    }
+    for (const [l, k] of left)
+      for (let i2 = 0; i2 < k; i2++)
+        out2.push({ op: "+", line: l });
+    return out2;
+  }
+  const w = m + 1;
+  const t = new Uint32Array((n + 1) * w);
+  for (let i2 = n - 1; i2 >= 0; i2--)
+    for (let j2 = m - 1; j2 >= 0; j2--)
+      t[i2 * w + j2] = a[i2] === b[j2] ? t[(i2 + 1) * w + j2 + 1] + 1 : Math.max(t[(i2 + 1) * w + j2], t[i2 * w + j2 + 1]);
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      out.push({ op: "=", line: a[i] });
+      i++;
+      j++;
+    } else if (t[(i + 1) * w + j] >= t[i * w + j + 1])
+      out.push({ op: "-", line: a[i++] });
+    else
+      out.push({ op: "+", line: b[j++] });
+  }
+  while (i < n)
+    out.push({ op: "-", line: a[i++] });
+  while (j < m)
+    out.push({ op: "+", line: b[j++] });
+  return out;
+}
+function hunksOf(drafted, merged) {
+  const out = [];
+  let cur;
+  let line = 1;
+  for (const o of lineDiff(lines(drafted), lines(merged))) {
+    if (o.op === "=") {
+      cur = void 0;
+      line++;
+      continue;
+    }
+    if (!cur)
+      out.push(cur = { at: line, drafted: [], merged: [] });
+    if (o.op === "-") {
+      cur.drafted.push(o.line);
+      line++;
+    } else
+      cur.merged.push(o.line);
+  }
+  return out;
+}
+function countLines(drafted, merged) {
+  let added = 0;
+  let removed = 0;
+  let changed2 = 0;
+  for (const h of hunksOf(drafted, merged)) {
+    const c = Math.min(h.drafted.length, h.merged.length);
+    changed2 += c;
+    removed += h.drafted.length - c;
+    added += h.merged.length - c;
+  }
+  return { drafted: lines(drafted).length, merged: lines(merged).length, added, removed, changed: changed2 };
+}
+var norm = (s) => s.trim().replace(/\s+\((Entry|Validation|Error|Checks?|Outcome)[^)]*\)\s*$/i, "").replace(/[.\s]+$/, "").replace(/\s+/g, " ");
+function readStory(text) {
+  const ls = lines(text);
+  const sections = /* @__PURE__ */ new Map();
+  let title = "";
+  let statement = "";
+  let section = "";
+  let body = [];
+  const close = () => {
+    if (section)
+      sections.set(section, body.join("\n").trim());
+  };
+  for (const l of ls) {
+    if (!title && /^# /.test(l)) {
+      title = l.slice(2).trim();
+      continue;
+    }
+    const h = /^## (.+)$/.exec(l);
+    if (h) {
+      close();
+      section = h[1].trim();
+      body = [];
+      continue;
+    }
+    if (!section && !statement && /^As an? /.test(l))
+      statement = l.trim();
+    if (section)
+      body.push(l);
+  }
+  close();
+  const bullets = (s, indent) => (s ?? "").split("\n").filter((l) => indent.test(l)).map((l) => norm(l.replace(indent, "")));
+  let criteria = bullets(sections.get("Acceptance criteria"), /^- /);
+  if (!criteria.length) {
+    const tasks = sections.get("Tasks") ?? "";
+    let inCriteria = false;
+    for (const l of tasks.split("\n")) {
+      if (/^- Acceptance criteria:/.test(l))
+        inCriteria = true;
+      else if (/^- /.test(l) || /^#/.test(l))
+        inCriteria = false;
+      else if (inCriteria && /^ {2}- /.test(l))
+        criteria.push(norm(l.replace(/^ {2}- /, "")));
+    }
+  }
+  criteria = [...new Set(criteria.filter(Boolean))];
+  const fields = /* @__PURE__ */ new Set();
+  for (const l of (sections.get("Tasks") ?? "").split("\n")) {
+    const f = /^- Fields: (.+)$/.exec(l);
+    if (f) {
+      for (const x of f[1].split(","))
+        if (x.trim() && x.trim() !== "none")
+          fields.add(x.trim());
+    }
+  }
+  for (const name of ["Interface changes", "Data changes"]) {
+    let col = -1;
+    for (const l of (sections.get(name) ?? "").split("\n")) {
+      if (!l.startsWith("|")) {
+        col = -1;
+        continue;
+      }
+      const cells2 = l.split("|").slice(1, -1).map((c) => c.trim());
+      if (cells2.every((c) => /^-+$/.test(c)))
+        continue;
+      const head = cells2.findIndex((c) => c === "Field" || c === "Column");
+      if (head >= 0) {
+        col = head;
+        continue;
+      }
+      if (col >= 0 && cells2[col])
+        fields.add(cells2[col]);
+    }
+  }
+  return { title, statement, criteria, fields: [...fields].sort(), sections };
+}
+function measureStory(file, d, m) {
+  const id = file.replace(/^stories\//, "").replace(/\.md$/, "");
+  const a = d === void 0 ? void 0 : readStory(d);
+  const b = m === void 0 ? void 0 : readStory(m);
+  const status = d === m ? "same" : !a ? "added" : !b ? "removed" : "edited";
+  const minus = (x, y) => x.filter((v) => !y.includes(v));
+  const changed2 = [];
+  if (a && b) {
+    if (a.title !== b.title)
+      changed2.push("title");
+    if (a.statement !== b.statement)
+      changed2.push("statement");
+    for (const s of [.../* @__PURE__ */ new Set([...a.sections.keys(), ...b.sections.keys()])])
+      if ((a.sections.get(s) ?? "") !== (b.sections.get(s) ?? ""))
+        changed2.push(s);
+  }
+  return {
+    id,
+    file,
+    status,
+    criteria: {
+      added: minus(b?.criteria ?? [], a?.criteria ?? []),
+      removed: minus(a?.criteria ?? [], b?.criteria ?? [])
+    },
+    fields: {
+      added: minus(b?.fields ?? [], a?.fields ?? []),
+      removed: minus(a?.fields ?? [], b?.fields ?? [])
+    },
+    changed: changed2
+  };
+}
+var isStoryFile = (p) => p.startsWith("stories/") && p.endsWith(".md");
+var TREND_MIN = 3;
+var TREND_STEP = 0.02;
+var round = (x) => Math.round(x * 1e4) / 1e4;
+function measurePair(p) {
+  const c = p.capture;
+  const paths = [.../* @__PURE__ */ new Set([...p.drafted.keys(), ...p.merged.keys()])].sort();
+  const files = paths.map((path) => {
+    const d = p.drafted.get(path);
+    const m = p.merged.get(path);
+    const status = d === m ? "same" : d === void 0 ? "added" : m === void 0 ? "removed" : "edited";
+    return { path, status, ...countLines(d, m) };
+  });
+  const sum = (k) => files.reduce((n, f) => n + f[k], 0);
+  const t = {
+    drafted: sum("drafted"),
+    merged: sum("merged"),
+    added: sum("added"),
+    removed: sum("removed"),
+    changed: sum("changed")
+  };
+  return {
+    stage: c.stage,
+    phase: c.phase,
+    pr: c.pr.number,
+    mergedAt: c.merged?.at ?? c.mergedAt,
+    drafted: { from: c.drafted.from, ...c.drafted.commit ? { commit: c.drafted.commit } : {} },
+    merged: { commit: c.merged?.commit ?? "" },
+    files,
+    stories: paths.filter(isStoryFile).map((f) => measureStory(f, p.drafted.get(f), p.merged.get(f))),
+    totals: {
+      ...t,
+      editRate: round((t.added + t.removed + t.changed) / Math.max(1, t.drafted, t.merged)),
+      files: files.length,
+      filesEdited: files.filter((f) => f.status !== "same").length
+    }
+  };
+}
+var byTime = (a, b) => a.mergedAt.localeCompare(b.mergedAt) || a.change.localeCompare(b.change) || a.stage.localeCompare(b.stage);
+function trendOf(points) {
+  const ps = [...points].sort(byTime);
+  if (ps.length < TREND_MIN)
+    return { points: ps, direction: "too-few" };
+  const half = Math.floor(ps.length / 2);
+  const mean = (xs) => round(xs.reduce((n, x) => n + x.editRate, 0) / xs.length);
+  const earlier = mean(ps.slice(0, half));
+  const later = mean(ps.slice(ps.length - half));
+  const d = later - earlier;
+  return {
+    points: ps,
+    earlier,
+    later,
+    direction: d <= -TREND_STEP ? "falling" : d >= TREND_STEP ? "rising" : "flat"
+  };
+}
+function learnFromPairs(pairs) {
+  const changes = /* @__PURE__ */ new Map();
+  const pending = [];
+  for (const p of pairs) {
+    const c = p.capture;
+    if (c.state !== "captured") {
+      pending.push({
+        change: c.change,
+        stage: c.stage,
+        pr: c.pr.number,
+        state: c.state,
+        note: c.note ?? ""
+      });
+      continue;
+    }
+    const list = changes.get(c.change) ?? [];
+    list.push(measurePair(p));
+    changes.set(c.change, list);
+  }
+  const out = [...changes].map(([change, stages]) => ({
+    change,
+    stages: stages.sort((a, b) => a.mergedAt.localeCompare(b.mergedAt) || a.stage.localeCompare(b.stage))
+  })).sort((a, b) => a.stages[0].mergedAt.localeCompare(b.stages[0].mergedAt) || a.change.localeCompare(b.change));
+  const points = out.flatMap((c) => c.stages.map((s) => ({
+    change: c.change,
+    stage: s.stage,
+    mergedAt: s.mergedAt,
+    editRate: s.totals.editRate
+  })));
+  const byStage = {};
+  for (const s of [...new Set(points.map((p) => p.stage))].sort())
+    byStage[s] = trendOf(points.filter((p) => p.stage === s));
+  return {
+    schemaVersion: LEARN_SCHEMA_VERSION,
+    changes: out,
+    pending: pending.sort((a, b) => a.change.localeCompare(b.change) || a.stage.localeCompare(b.stage)),
+    trend: { overall: trendOf(points), byStage }
+  };
+}
+async function learnReport(root) {
+  return learnFromPairs(await readDraftPairs(root));
+}
+var pct = (x) => `${Math.round(x * 100)}%`;
+var day = (iso) => iso.slice(0, 10);
+function trendLine(name, t) {
+  if (t.direction === "too-few")
+    return `  ${name}: ${t.points.length} merged so far; a trend needs ${TREND_MIN}.`;
+  const words = { falling: "falling", rising: "rising", flat: "flat" }[t.direction];
+  return `  ${name}: ${pct(t.earlier)} of lines edited in the earlier half, ${pct(t.later)} in the later half, over ${t.points.length} merged: ${words}.`;
+}
+function formatLearn(r) {
+  const out = [];
+  const stages = r.changes.reduce((n, c) => n + c.stages.length, 0);
+  if (!stages && !r.pending.length)
+    return [
+      "No merged hand-off has a kept draft yet. When a stage's hand-off PR merges, atticus change sync keeps what Atticus drafted beside what merged (stage/<stage>.drafted/ and .merged/)."
+    ];
+  out.push(`How much people changed Atticus's drafts, from ${stages} merged hand-off${stages === 1 ? "" : "s"} in ${r.changes.length} change${r.changes.length === 1 ? "" : "s"}:`);
+  for (const c of r.changes) {
+    out.push("", c.change);
+    for (const s of c.stages) {
+      const t = s.totals;
+      out.push(`  ${s.stage} (PR #${s.pr}, merged ${day(s.mergedAt)}): ${t.added + t.removed + t.changed} of ${Math.max(t.drafted, t.merged)} lines edited (${pct(t.editRate)}); ${t.filesEdited} of ${t.files} files`);
+      for (const f of s.files.filter((x) => x.status !== "same"))
+        out.push(`    ${f.path} (${f.status}): +${f.added} -${f.removed} ~${f.changed}`);
+      for (const st of s.stories.filter((x) => x.status !== "same")) {
+        const c2 = st.criteria;
+        const bits = [
+          c2.added.length || c2.removed.length ? `criteria +${c2.added.length} -${c2.removed.length}` : "",
+          st.fields.added.length ? `fields added: ${st.fields.added.join(", ")}` : "",
+          st.fields.removed.length ? `fields removed: ${st.fields.removed.join(", ")}` : "",
+          st.changed.length ? `changed: ${st.changed.join(", ")}` : ""
+        ].filter(Boolean);
+        out.push(`    story ${st.id} (${st.status}): ${bits.join("; ") || "reworded"}`);
+      }
+    }
+  }
+  out.push("", "Trend (share of lines people edited, by merge date):");
+  out.push(trendLine("all stages", r.trend.overall));
+  for (const [s, t] of Object.entries(r.trend.byStage))
+    out.push(trendLine(s, t));
+  if (r.pending.length) {
+    out.push("", "Not counted yet:");
+    for (const p of r.pending)
+      out.push(`  ${p.change} ${p.stage} (PR #${p.pr}): ${p.note}`);
+  }
+  return out;
+}
+var uniq = (xs) => [...new Set(xs.filter(Boolean))].sort();
+async function pairTouches(root, p) {
+  const files = p.merged.size ? p.merged : p.drafted;
+  const repos = [];
+  const tables = [];
+  const flows = [];
+  const systems = [];
+  let entry;
+  const yaml = (t) => {
+    try {
+      const v = (0, import_yaml9.parse)(t);
+      return v && typeof v === "object" ? v : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  const arr = (v) => Array.isArray(v) ? v.filter((x) => !!x && typeof x === "object") : [];
+  for (const [path, text] of files) {
+    if (path === "feature.yaml") {
+      const d = yaml(text);
+      if (typeof d?.entry === "string")
+        entry = d.entry;
+      for (const f of arr(d?.flows))
+        if (typeof f.id === "string") {
+          flows.push(f.id);
+          if (f.id.includes("."))
+            repos.push(f.id.slice(0, f.id.indexOf(".")));
+        }
+      for (const f of arr(d?.newFlows))
+        if (typeof f.repo === "string")
+          repos.push(f.repo);
+    } else if (path.startsWith("target-flows/") && path.endsWith(".yaml")) {
+      const d = yaml(text);
+      if (typeof d?.repo === "string")
+        repos.push(d.repo);
+      if (typeof d?.flow === "string")
+        flows.push(d.flow);
+      for (const s of arr(d?.steps)) {
+        const st = s.store;
+        if (st && typeof st.table === "string")
+          tables.push(st.table);
+      }
+    } else if (path.startsWith("stories/") && path.endsWith(".md")) {
+      const sys = /^## Systems and repos\n\n(.+)$/m.exec(text);
+      if (sys)
+        repos.push(...sys[1].split(",").map((s) => s.trim()));
+      for (const m of text.matchAll(/^- Store: ([^:\s]+):/gm))
+        tables.push(m[1]);
+      for (const m of text.matchAll(/^target-flows\/([^\s]+)\.yaml/gm))
+        flows.push(m[1]);
+    }
+  }
+  const change = yaml(await readFile11(join13(root, ...p.folder.split("/"), "change.yaml"), "utf8").catch(() => ""));
+  const touches = change?.touches ?? {};
+  for (const r of Array.isArray(touches.repos) ? touches.repos : [])
+    if (typeof r === "string")
+      repos.push(r);
+  for (const t of Array.isArray(touches.tables) ? touches.tables : [])
+    if (typeof t === "string")
+      tables.push(t);
+  for (const s of Array.isArray(change?.systems) ? change.systems : [])
+    if (typeof s === "string")
+      systems.push(s);
+  return {
+    repos: uniq(repos),
+    tables: uniq(tables),
+    flows: uniq(flows),
+    systems: uniq(systems),
+    ...entry ? { entry } : {}
+  };
+}
+async function pastCorrections(root, q) {
+  const pairs = (await readDraftPairs(root)).filter((p) => p.capture.state === "captured" && p.capture.stage === q.stage && p.capture.change !== q.change);
+  const out = [];
+  for (const p of pairs) {
+    const files = [.../* @__PURE__ */ new Set([...p.drafted.keys(), ...p.merged.keys()])].sort().map((path) => {
+      const d = p.drafted.get(path);
+      const m = p.merged.get(path);
+      const status = d === m ? "same" : d === void 0 ? "added" : m === void 0 ? "removed" : "edited";
+      return { path, status, hunks: status === "same" ? [] : hunksOf(d, m) };
+    }).filter((f) => f.hunks.length > 0);
+    if (!files.length)
+      continue;
+    const t = await pairTouches(root, p);
+    const shares = [];
+    const share = (kind, xs, ys) => {
+      for (const x of xs)
+        if (ys.includes(x))
+          shares.push(`${kind} ${x}`);
+    };
+    share("repo", q.touches.repos, t.repos);
+    share("table", q.touches.tables, t.tables);
+    share("flow", q.touches.flows, t.flows);
+    share("system", q.touches.systems, t.systems);
+    const strong = shares.length;
+    if (q.touches.entry && t.entry === q.touches.entry)
+      shares.push(`entry ${t.entry}`);
+    if (!shares.length)
+      continue;
+    out.push({
+      change: p.capture.change,
+      folder: p.folder,
+      stage: p.capture.stage,
+      pr: p.capture.pr.number,
+      mergedAt: p.capture.merged?.at ?? p.capture.mergedAt,
+      shares,
+      // A shared repo, table, flow or system counts for more than the same kind of entry.
+      score: strong * 2 + (shares.length - strong),
+      files
+    });
+  }
+  return out.sort((a, b) => b.score - a.score || b.mergedAt.localeCompare(a.mergedAt) || a.change.localeCompare(b.change)).slice(0, q.max ?? 2);
+}
+
+// packages/changes/dist/conflicts.js
+var both = (a, b) => a.filter((x) => b.includes(x));
+var changed = (f) => f.flows.filter((x) => x.change !== "read").map((x) => x.id);
+async function detectConflicts(root) {
+  const ctx = await loadChangeContext(root);
+  const open = (await changeStore(root).list()).filter((c) => c.state !== "archived");
+  const prints = [];
+  for (const c of open)
+    prints.push([c.id, await changeFootprint(ctx, c)]);
+  const out = [];
+  for (let i = 0; i < prints.length; i++) {
+    for (let j = i + 1; j < prints.length; j++) {
+      const [ia, a] = prints[i];
+      const [ib, b] = prints[j];
+      const overlap = {
+        systems: both(a.systems, b.systems),
+        interfaces: both(a.interfaces.map((x) => x.id), b.interfaces.map((x) => x.id)),
+        dataStores: both(a.dataStores, b.dataStores),
+        tables: both(a.tables, b.tables),
+        records: both(a.records, b.records),
+        repos: both(a.repos, b.repos),
+        flows: both(changed(a), changed(b))
+      };
+      if (Object.values(overlap).some((v) => v.length > 0))
+        out.push({ changes: [ia, ib], overlap });
+    }
+  }
+  return out;
+}
+
+// packages/changes/dist/size.js
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join14 } from "node:path";
+async function changeSize(ctx, change) {
+  const type = ctx.orgPack.changeTypes.types.find((t) => t.id === change.type);
+  if (!type)
+    return {
+      fast: false,
+      why: "standard",
+      words: `${change.type} isn't a change type in change-types.yaml, so ${change.id} takes the full path.`
+    };
+  const brief = await readFile12(join14(changeFolder(ctx.root, change.id), "brief.md"), "utf8").catch(() => "");
+  const f = fastPathOf(type, brief);
+  const gate = f.fast ? fastGateOf(type, ctx.orgPack.gates) : void 0;
+  const words = {
+    type: `${change.id} is a ${type.name.toLowerCase()} (${type.id}), a small type: one step from brief to tasks.`,
+    brief: `${change.id}'s brief says it is small, and ${type.id} lets a brief say so: one step from brief to tasks.`,
+    "brief-standard": `${change.id}'s brief says it is standard, so it takes the full path though ${type.id} is small.`,
+    "brief-not-allowed": `${change.id}'s brief says it is small, but ${type.id} doesn't let a brief choose the fast path (smallWhenBriefSays in change-types.yaml), so it takes the full path.`,
+    standard: `${change.id} is a ${type.id} change: the feature, architecture and stories stages.`
+  };
+  return { fast: f.fast, why: f.why, ...gate ? { gate } : {}, words: words[f.why] };
+}
+
+// packages/changes/dist/openspec-stores.js
+import { existsSync } from "node:fs";
+import { readFile as readFile13, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, isAbsolute, join as join15, relative as relative2, resolve, sep as sep2 } from "node:path";
+function storeDirOf(root, path) {
+  if (path === "~" || path.startsWith("~/") || path.startsWith("~\\"))
+    return join15(homedir(), path.slice(2));
+  return isAbsolute(path) ? resolve(path) : resolve(root, path);
+}
+function packRel(root) {
+  return relative2(root, orgPackDirOf(root)).split(sep2).join("/");
+}
+async function openspecStores(root) {
+  const { settings, problem } = await loadOpenSpecSettings(orgPackDirOf(root));
+  const problems = problem ? [`${packRel(root)}/${problem}`] : [];
+  const stores = [];
+  for (const s of settings.stores) {
+    const dir = storeDirOf(root, s.path);
+    const view = await readStoreVia(dir);
+    stores.push({ ...view, label: s.label ?? view.id ?? basename(dir), path: s.path });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const s of stores) {
+    if (seen.has(s.label))
+      problems.push(`${packRel(root)}/openspec.yaml: two stores are labelled ${s.label}; give one a label`);
+    seen.add(s.label);
+  }
+  return { stores, problems };
+}
+async function storeSpecLookup(root, capability) {
+  const { stores } = await openspecStores(root);
+  return stores.flatMap((s) => s.specs.filter((x) => x.id === capability).map((x) => ({ store: s.label, ...x })));
+}
+var REMOTE = /^[a-z][a-z0-9+.-]*:\/\//i;
+var SCP = /^[^/\\]+@[^:/\\]+:/;
+async function metarepoOrigin(root, git = createGit()) {
+  if (!existsSync(join15(root, ".git")))
+    return void 0;
+  try {
+    const url = (await git(["remote", "get-url", "origin"], root)).stdout.trim();
+    if (!url || url.startsWith("file:"))
+      return void 0;
+    return REMOTE.test(url) || SCP.test(url) ? url : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function referenceMetarepoIn(root, repoDir, o = {}) {
+  const { settings } = await loadOpenSpecSettings(orgPackDirOf(root));
+  if (!settings.referenceInRepos)
+    return { action: "off" };
+  const file = "openspec/config.yaml";
+  const marker = await readStoreMarker(root);
+  if (!marker.marker)
+    return {
+      action: "skipped",
+      file,
+      why: marker.missing ? `this metarepo isn't an OpenSpec store yet (no ${STORE_MARKER}): run atticus upgrade --openspec-store, commit the file, then hand down again` : `this metarepo's ${STORE_MARKER} can't be read (${marker.notes.join("; ")})`
+    };
+  const path = join15(repoDir, "openspec", "config.yaml");
+  const text = await readFile13(path, "utf8").catch(() => void 0);
+  if (text === void 0)
+    return {
+      action: "skipped",
+      file,
+      why: "the repo has no openspec/config.yaml, so there is nowhere to add the metarepo as an OpenSpec reference"
+    };
+  const remote = marker.marker.remote ?? await metarepoOrigin(root, o.git);
+  const r = addStoreReference(text, { id: marker.marker.id, ...remote ? { remote } : {} });
+  if ("problem" in r)
+    return { action: "skipped", file, why: r.problem };
+  if (r.action === "added")
+    await writeFile2(path, r.text, "utf8");
+  return { action: r.action, file };
+}
+
+export {
+  ChangeError,
+  readTables,
+  tableWith,
+  isFilled,
+  CHANGE_POLICY_FILE,
+  StageStep,
+  SIGNAL_FACTORS,
+  ChangePolicy,
+  DEFAULT_CHANGE_POLICY,
+  loadChangePolicy,
+  stagePathOf,
+  TemplateMeta,
+  TEMPLATE_VARIABLES,
+  BUILT_IN_TEMPLATES,
+  loadTemplates,
+  renderTemplate,
+  pickTemplate,
+  CHANGES_DIR,
+  CHANGE_FILE,
+  changeFolder,
+  changeFilePath,
+  ChangeFileError,
+  serializeChange,
+  changeStore,
+  CODEOWNERS_PATHS,
+  parseCodeowners,
+  ownersFor,
+  readCodeowners,
+  loadChangeContext,
+  changeTypeOf,
+  personalLevels,
+  wordsOf,
+  changeFootprint,
+  scoreRisk,
+  testsFor,
+  testPlanFor,
+  phaseState,
+  statePhase,
+  nextState,
+  handoffName,
+  artifactPhase,
+  phaseArtifacts,
+  requiredArtifacts,
+  phaseStage,
+  stageCommand,
+  checkStage,
+  stageFiles,
+  artifactFiles,
+  checkArtifacts,
+  checkFindings,
+  mandatoryGates,
+  checkMandatoryRounds,
+  phaseGates,
+  BUILT_IN_GATES,
+  phaseFindingGates,
+  sha256,
+  stageCompletion,
+  workProgress,
+  privacyImpact,
+  prApprovers,
+  liveHandoff,
+  assess,
+  canAdvance,
+  changeReport,
+  slugify,
+  newChange,
+  gitHandoffPublisher,
+  CAPTURE_SCHEMA_VERSION,
+  DraftCapture,
+  capturePaths,
+  draftedPath,
+  captureStageOf,
+  captureHandoff,
+  readDraftPairs,
+  completeCaptures,
+  handoff,
+  syncHandoff,
+  returnToPo,
+  requireValid,
+  archiveChange,
+  LEARN_SCHEMA_VERSION,
+  lineDiff,
+  hunksOf,
+  countLines,
+  readStory,
+  TREND_MIN,
+  TREND_STEP,
+  measurePair,
+  trendOf,
+  learnFromPairs,
+  learnReport,
+  formatLearn,
+  pairTouches,
+  pastCorrections,
+  detectConflicts,
+  changeSize,
+  storeDirOf,
+  openspecStores,
+  storeSpecLookup,
+  metarepoOrigin,
+  referenceMetarepoIn
+};