@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.2

package/dist/chunk-YY6ZQQBP.js

@@ -0,0 +1,203 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  buildSite,
+  catalogRecords,
+  openChanges
+} from "./chunk-B2WLAWNJ.js";
+import {
+  doctorChecks
+} from "./chunk-AIOQPLA5.js";
+import {
+  readProbes,
+  whatRunsWhere
+} from "./chunk-IPKHE5D6.js";
+import {
+  baseClonePath,
+  loadRepos
+} from "./chunk-EFHQ3TWP.js";
+import {
+  CatalogBaseline,
+  DEFAULT_RUNTIME,
+  WORKSPACE_SCHEMA_VERSION,
+  catalogDirOf,
+  inputsDirOf,
+  loadOrgPack,
+  orgPackDirOf,
+  require_dist
+} from "./chunk-S2A7YC3Q.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/baseline-commands.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+var BASELINE_FILE = "baseline.yaml";
+async function readBaseline(root) {
+  try {
+    const r = CatalogBaseline.safeParse((0, import_yaml.parse)(await readFile(join(catalogDirOf(root), BASELINE_FILE), "utf8")));
+    return r.success ? r.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function countFiles(dir) {
+  try {
+    const all = await readdir(dir, { recursive: true, withFileTypes: true });
+    return all.filter((e) => e.isFile()).length;
+  } catch {
+    return 0;
+  }
+}
+async function setupSteps(root, o = {}) {
+  const clonedOf = async (repos2) => (await Promise.all(repos2.map((r) => stat(join(baseClonePath(root, r.id), ".git")).then(() => true, () => false)))).filter(Boolean).length;
+  const [doctor, op, repos, records, inputs, baseline, probes] = await Promise.all([
+    o.doctor ?? doctorChecks(root),
+    loadOrgPack(orgPackDirOf(root)),
+    loadRepos(root).catch(() => []),
+    catalogRecords(root),
+    countFiles(inputsDirOf(root)),
+    readBaseline(root),
+    readProbes(root).then((p) => p.results)
+  ]);
+  const failing = doctor.filter((c) => c.status === "fail");
+  const cloned = await clonedOf(repos);
+  const generated = records.filter((r) => r.evidence.some((e) => e.source !== "manual")).length;
+  const wikis = op.sources.wikis.length;
+  const steps = [
+    {
+      id: "machine",
+      label: "This machine has what Atticus needs",
+      done: failing.length === 0,
+      detail: failing.length ? `to fix: ${failing.map((c) => c.label).join(", ")}` : `${doctor.filter((c) => c.status === "warn").length} to look at`,
+      fix: failing.length ? `Run atticus doctor: ${failing.map((c) => c.fix ?? c.label).join(" ")}` : "Run atticus doctor for the details."
+    },
+    {
+      id: "org-pack",
+      label: "The org pack's files are valid",
+      done: op.problems.length === 0,
+      detail: op.problems.length ? `${op.problems.length} problem${op.problems.length === 1 ? "" : "s"}` : "no problems in its files",
+      fix: "Run atticus orgpack validate and fix each problem it names (each says the file and field)."
+    },
+    {
+      // A new metarepo's org pack is valid as atticus init wrote it, but nobody owns it yet.
+      id: "org-pack-owner",
+      label: "The org pack has an owner",
+      done: !!op.pack?.owner && op.pack.owner !== "unassigned",
+      detail: op.pack?.owner && op.pack.owner !== "unassigned" ? op.pack.owner : "unassigned",
+      fix: "Set owner in org-pack/pack.yaml to the person who looks after the org pack (normally the platform lead), and commit it through a pull request."
+    },
+    {
+      // ADR 0121 item 6: how AI runs here is a choice, not the default left by accident.
+      id: "ai",
+      label: "Choose how AI runs here",
+      // runtime.yaml's version alone (1 from an older init, ADR 0121 addendum) isn't a choice.
+      done: JSON.stringify({ ...op.runtime, schemaVersion: DEFAULT_RUNTIME.schemaVersion }) !== JSON.stringify(DEFAULT_RUNTIME),
+      detail: whatRunsWhere(op.runtime, { probes }),
+      fix: "Choose the assistants, the modes and the model provider on Set up \u203A AI in the app (or in org-pack/runtime.yaml), and commit it through a pull request. As atticus init wrote it, steps are handed to Copilot, which needs nothing more.",
+      optional: true
+    },
+    {
+      id: "repos",
+      label: "Repos are listed",
+      done: repos.length > 0,
+      detail: `${repos.length} repo${repos.length === 1 ? "" : "s"} in the manifests`,
+      fix: "Run atticus repos discover <folder> (or --org <org>) and add what it proposes to repos.manifest.yaml."
+    },
+    {
+      id: "clones",
+      label: "Repos are cloned here",
+      done: repos.length > 0 && cloned === repos.length,
+      detail: `${cloned} of ${repos.length} cloned`,
+      fix: "Run atticus workspace sync (or Sync repos on the Scans screen); it clones what's missing."
+    },
+    {
+      // ADR 0124: your assistant reads each repo and writes its facts; Atticus checks every one
+      // against its line and puts them in the catalog. The id stays: the app keys on it.
+      id: "scan",
+      label: "Every repo is read and verified",
+      done: generated > 0,
+      detail: `${records.length} record${records.length === 1 ? "" : "s"} in the catalog`,
+      fix: "Read each repo: /atticus-map <repo> in your assistant (or atticus map <repo>), then atticus verify <repo> --write. Verify checks every fact against the line it cites and runs no model."
+    },
+    {
+      id: "knowledge",
+      label: "Existing knowledge is added",
+      done: inputs > 0 || wikis > 0,
+      detail: `${inputs} file${inputs === 1 ? "" : "s"} in inputs/, ${wikis} wiki source${wikis === 1 ? "" : "s"}`,
+      fix: "Drop diagrams, partner specs and exports into inputs/ (atticus intake add <files>), and add wikis to sources.yaml (atticus sources add).",
+      optional: true
+    },
+    {
+      id: "baseline",
+      label: "The catalog is accepted",
+      done: !!baseline,
+      detail: baseline ? `accepted by ${baseline.acceptedBy} on ${baseline.acceptedAt.slice(0, 10)}` : "not yet",
+      fix: "Walk the ecosystem map with the architect, then accept it: atticus baseline (or Accept the catalog on Home), and commit catalog/baseline.yaml through a pull request."
+    }
+  ];
+  return { steps, baselined: !!baseline };
+}
+async function setupCommand(root, o, io) {
+  const s = await setupSteps(root);
+  const open = s.steps.filter((x) => !x.done && !x.optional);
+  if (o.json)
+    io.out(JSON.stringify(s, null, 2));
+  else {
+    for (const x of s.steps) {
+      io.out(`${x.done ? "[x]" : "[ ]"} ${x.label}: ${x.detail}${x.optional ? " (optional)" : ""}`);
+      if (!x.done && x.fix)
+        io.out(`    ${x.fix}`);
+    }
+    io.out(open.length ? `${open.length} step${open.length === 1 ? "" : "s"} to go.` : "Setup is done: the catalog is accepted.");
+  }
+  return open.length ? 1 : 0;
+}
+async function baselineCommand(root, o, io) {
+  if (!o.by) {
+    io.err("Usage: atticus baseline [--by <you>] [--note <text>] [--site <dir>]");
+    return 2;
+  }
+  const records = await catalogRecords(root, io);
+  if (records.length === 0) {
+    io.err("The catalog is empty: read the repos first (atticus map <repo>, then atticus verify <repo> --write), then walk the map and accept it.");
+    return 1;
+  }
+  const kinds = {};
+  for (const r of records)
+    kinds[r.kind] = (kinds[r.kind] ?? 0) + 1;
+  const systems = records.filter((r) => r.kind === "System").map((r) => r.id).sort();
+  const b = CatalogBaseline.parse({
+    schemaVersion: WORKSPACE_SCHEMA_VERSION,
+    acceptedBy: o.by,
+    acceptedAt: o.now ?? (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+    kinds: Object.fromEntries(Object.entries(kinds).sort(([a], [b2]) => a.localeCompare(b2))),
+    systems,
+    ...o.note ? { note: o.note } : {}
+  });
+  await writeFile(join(catalogDirOf(root), BASELINE_FILE), (0, import_yaml.stringify)(b), "utf8");
+  io.out(`Accepted the catalog as the baseline as ${o.by}: ${records.length} records in ${Object.keys(kinds).length} kinds, ${systems.length} systems. Wrote catalog/${BASELINE_FILE}; commit it with the catalog and open a pull request, whose merge makes it the baseline on main.`);
+  if (o.site) {
+    const dir = resolve(o.site);
+    const s = await buildSite(records, dir, {
+      title: "Catalog",
+      builtAt: b.acceptedAt.slice(0, 10),
+      changes: await openChanges(root)
+    });
+    io.out(`Wrote the read-only catalog site to ${dir} (${s.systems.length} systems).`);
+  }
+  return 0;
+}
+
+export {
+  BASELINE_FILE,
+  readBaseline,
+  setupSteps,
+  setupCommand,
+  baselineCommand
+};

package/dist/chunk-YYQN46FY.js

@@ -0,0 +1,334 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import "./chunk-GLUX4EEP.js";
+import {
+  loadCatalog
+} from "./chunk-FITWGOJ2.js";
+import {
+  repoFor
+} from "./chunk-O3WI5KWW.js";
+import {
+  recordFact,
+  verifyScan
+} from "./chunk-KEM4SDDP.js";
+import "./chunk-ZVM6AKKM.js";
+import {
+  stepJudges
+} from "./chunk-CKSITVS4.js";
+import "./chunk-L6SGQIR3.js";
+import "./chunk-3HI6Z55Y.js";
+import "./chunk-XY3P7JW7.js";
+import "./chunk-4AK7IBVP.js";
+import "./chunk-7JUKDRSZ.js";
+import {
+  checkScanSettings
+} from "./chunk-27NKUS3X.js";
+import "./chunk-L24C55VN.js";
+import "./chunk-PAMPPUR6.js";
+import "./chunk-23W7VWKR.js";
+import "./chunk-7EKXJZ2Y.js";
+import "./chunk-MC3H7736.js";
+import "./chunk-T6AIP7H5.js";
+import "./chunk-EFHQ3TWP.js";
+import {
+  fsRepo
+} from "./chunk-GQ4N4WKF.js";
+import "./chunk-CNUKCS2T.js";
+import {
+  SCAN_VERIFY_SCHEMA_VERSION,
+  ScanSettings,
+  ScanVerifyProposal,
+  listQuestions,
+  loadOrgPack,
+  orgPackDirOf,
+  proposalsDirOf,
+  proposalsRelOf,
+  questionsRelOf,
+  raiseQuestions,
+  require_dist,
+  reusedLine
+} from "./chunk-S2A7YC3Q.js";
+import "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/scan-verify-commands.js
+var import_yaml = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+var KIND_WORDS = {
+  "entry-point": "entry point",
+  call: "call",
+  table: "table",
+  deployment: "deployment",
+  other: "fact"
+};
+var fixWords = (f) => "settings" in f ? "a scan settings entry" : "question" in f ? "a question for a person" : "a reader must change";
+var sentence = (s) => {
+  const t = s.trim();
+  return `${t.charAt(0).toUpperCase()}${t.slice(1)}${/[.!?]$/.test(t) ? "" : "."}`;
+};
+var proposalFile = (root, repo) => join(proposalsDirOf(root), "scan", `${repo}.yaml`);
+var findingsFile = (root, repo) => join(proposalsDirOf(root), "scan", `${repo}.findings.md`);
+var EMPTY = { exclude: [], prefixes: [], clients: [] };
+function newEntries(have, add) {
+  const ex = (e) => e.path;
+  const px = (p) => `${p.paths.join(",")} ${p.prefix}`;
+  const cl = (c) => `${c.paths.join(",")} ${c.base} ${c.names.join(",")}`;
+  const fresh = (had, more, key) => {
+    const seen = new Set(had.map(key));
+    return more.filter((x) => {
+      const k = key(x);
+      if (seen.has(k))
+        return false;
+      seen.add(k);
+      return true;
+    });
+  };
+  return {
+    exclude: fresh(have.exclude, add.exclude, ex),
+    prefixes: fresh(have.prefixes, add.prefixes, px),
+    clients: fresh(have.clients, add.clients, cl)
+  };
+}
+var merge = (a, b) => {
+  const n = newEntries(a, b);
+  return {
+    exclude: [...a.exclude, ...n.exclude],
+    prefixes: [...a.prefixes, ...n.prefixes],
+    clients: [...a.clients, ...n.clients]
+  };
+};
+var size = (s) => s.exclude.length + s.prefixes.length + s.clients.length;
+var describeSettings = (s) => [
+  s.exclude.length ? plural(s.exclude.length, "folder") + " left out" : "",
+  s.prefixes.length ? plural(s.prefixes.length, "prefix", "prefixes") : "",
+  s.clients.length ? plural(s.clients.length, "client base") : ""
+].filter(Boolean).join(", ");
+async function readProposal(root, repo) {
+  const text = await readFile(proposalFile(root, repo), "utf8").catch(() => void 0);
+  return text === void 0 ? void 0 : ScanVerifyProposal.parse((0, import_yaml.parse)(text));
+}
+async function writeProposal(root, p) {
+  await mkdir(join(proposalsDirOf(root), "scan"), { recursive: true });
+  await writeFile(proposalFile(root, p.repo), `# From atticus scan verify (ADR 0082): every item was checked against the code. Accept the settings with atticus scan verify ${p.repo} --accept.
+${(0, import_yaml.stringify)(ScanVerifyProposal.parse(p))}`, "utf8");
+}
+var ofRepo = (records, repo) => records.filter((r) => r.evidence.some((e) => e.repo === repo));
+async function pin(repo, r) {
+  const e = r.evidence.find((x) => x.path) ?? r.evidence[0];
+  if (!e?.path)
+    return { record: r.id, at: "?" };
+  if (!e.line)
+    return { record: r.id, at: e.path };
+  const text = await repo.readText(e.path).catch(() => void 0);
+  const line = text?.replace(/\r\n?/g, "\n").split("\n")[e.line - 1];
+  return {
+    record: r.id,
+    at: `${e.path}:${e.line}`,
+    ...line !== void 0 ? { line: createHash("sha256").update(line.trim()).digest("hex").slice(0, 12) } : {}
+  };
+}
+function findings(repo, r, now, records) {
+  const a = r.answer;
+  const items = [];
+  for (const m of a.missed)
+    if ("reader" in m.fix)
+      items.push(`- Missed the ${KIND_WORDS[m.kind]} ${m.method ? `${m.method} ` : ""}${m.name} at ${m.at}. ${sentence(m.why)} What must change: ${sentence(m.fix.reader)}`);
+  for (const w of a.wrong)
+    if ("reader" in w.fix) {
+      const rec = records.find((x) => x.id === w.record);
+      const f = rec ? recordFact(rec) : void 0;
+      items.push(`- Wrong: ${w.record}${f ? ` (the ${KIND_WORDS[f.kind]} ${f.method ? `${f.method} ` : ""}${f.name})` : ""}, shown by ${w.at}. ${sentence(w.why)} What must change: ${sentence(w.fix.reader)}`);
+    }
+  const text = [
+    `# What the scan of ${repo} reads wrong`,
+    "",
+    `Found by atticus scan verify on ${now.toISOString().slice(0, 10)}${r.runId ? ` (run ${r.runId})` : ""}. No scan setting can put these right: each needs a change to a built-in reader or a scanner plugin (ADR 0080). Atticus checked that each cited line says what is quoted.`,
+    "",
+    ...items.length ? items : ["Nothing this time."],
+    ""
+  ].join("\n");
+  return { text, count: items.length };
+}
+async function scanVerify(root, target, o, deps, io) {
+  const repo = await repoFor(root, target);
+  if (!repo) {
+    io.err(`${target} isn't a cloned repo of the manifest or a folder; clone it with atticus workspace sync, or give its folder.`);
+    return 2;
+  }
+  const { records: all } = await loadCatalog(root, { out: () => {
+  }, err: (l) => io.err(l) });
+  const records = ofRepo(all, repo.id);
+  if (records.length === 0) {
+    io.err(`The catalog has nothing from ${repo.id} yet: run atticus scan first.`);
+    return 1;
+  }
+  const op = await loadOrgPack(orgPackDirOf(root));
+  const settings = op.scanSettings.find((s) => s.repo === repo.id);
+  const before = await listQuestions(root, { repo: repo.id }).then((l) => ({
+    ...l,
+    questions: l.questions.filter((q) => q.state !== "retired")
+  }));
+  const handle = fsRepo(repo.id, repo.dir, "0".repeat(40));
+  const now = deps.now ?? /* @__PURE__ */ new Date();
+  const r = await verifyScan(handle, {
+    repoId: repo.id,
+    runtime: deps.runtime,
+    records,
+    ...settings ? { settings } : {},
+    orgPack: op,
+    maxAttempts: o.attempts ?? 3,
+    questions: before.questions,
+    now,
+    ...o.resume ? { resume: o.resume } : {}
+  });
+  if (r.status === "waiting") {
+    io.out(`Handed the check to your assistant (run ${r.runId}). When it is done: atticus handoff done ${r.runId}, then atticus scan verify ${repo.id} --resume ${r.runId}`);
+    return 0;
+  }
+  const handedBack = r.attempts.filter((x, n) => x.problems.length > 0 && n < r.attempts.length - 1);
+  if (r.status !== "checked" || !r.answer) {
+    if (o.json)
+      io.out(JSON.stringify({ status: r.status, attempts: r.attempts }, null, 2));
+    else {
+      for (const a2 of r.attempts) {
+        io.out(`Attempt ${a2.attempt}: ${plural(a2.problems.length, "problem")}:`);
+        for (const p of a2.problems)
+          io.out(`  - ${p}`);
+      }
+      io.out(`No answer could be read in ${plural(r.attempts.length, "attempt")}; nothing was written.`);
+    }
+    return 1;
+  }
+  const a = r.answer;
+  let fixes = EMPTY;
+  for (const item of [...a.missed, ...a.wrong])
+    if ("settings" in item.fix)
+      fixes = merge(fixes, item.fix.settings);
+  const earlier = await readProposal(root, repo.id).catch(() => void 0);
+  const proposed = newEntries(settings ?? EMPTY, merge(earlier?.settings ?? EMPTY, fixes));
+  const drafts = [...a.missed, ...a.wrong].flatMap((x) => "question" in x.fix ? [x.fix.question] : []);
+  const judges = stepJudges(root, deps.runtime, repo.id, now);
+  const { raised, known, reused } = await raiseQuestions(root, drafts, {
+    step: "scan-verify",
+    repo: repo.id,
+    command: `atticus scan verify ${repo.id}`,
+    rerun: `atticus scan verify ${repo.id}`,
+    ...r.runId ? { run: r.runId } : {},
+    at: now.toISOString()
+  }, judges);
+  const byId = new Map(records.map((x) => [x.id, x]));
+  const verified = await Promise.all(a.confirmed.map((c) => c.record).sort().map((id) => pin(handle, byId.get(id))));
+  const proposal = {
+    schemaVersion: SCAN_VERIFY_SCHEMA_VERSION,
+    repo: repo.id,
+    ...r.runId ? { run: r.runId } : {},
+    at: now.toISOString(),
+    settings: proposed,
+    missed: a.missed,
+    wrong: a.wrong.map((w) => ({ ...w, ...recordFact(byId.get(w.record)) })),
+    verified,
+    questions: [...new Set([...raised, ...known].map((q) => q.id))].sort(),
+    ...earlier?.accepted ? { accepted: earlier.accepted } : {}
+  };
+  await writeProposal(root, proposal);
+  const f = findings(repo.id, r, now, records);
+  await writeFile(findingsFile(root, repo.id), f.text, "utf8");
+  const rel = proposalsRelOf(root);
+  if (o.json) {
+    io.out(JSON.stringify({
+      status: r.status,
+      proposal,
+      refused: r.refused,
+      attempts: r.attempts,
+      questions: { raised: raised.map((q) => q.id), known: known.map((q) => q.id) },
+      files: {
+        proposal: `${rel}/scan/${repo.id}.yaml`,
+        findings: `${rel}/scan/${repo.id}.findings.md`
+      }
+    }, null, 2));
+    return 0;
+  }
+  io.out(`Checked ${repo.id} against its last scan: ${a.missed.length} missed, ${a.wrong.length} wrong, ${a.confirmed.length} confirmed.`);
+  for (const at of handedBack) {
+    io.out(`Attempt ${at.attempt}: ${plural(at.problems.length, "problem")}, handed back:`);
+    for (const p of at.problems)
+      io.out(`  - ${p}`);
+  }
+  if (r.refused.length) {
+    io.out("Left out, because the last attempt still failed its checks:");
+    for (const p of r.refused)
+      io.out(`  - ${p}`);
+  }
+  for (const m of a.missed)
+    io.out(`  missed: ${KIND_WORDS[m.kind]} ${m.method ? `${m.method} ` : ""}${m.name} (${m.at}); ${fixWords(m.fix)}`);
+  for (const w of a.wrong)
+    io.out(`  wrong: ${w.record} (${w.at}); ${fixWords(w.fix)}`);
+  io.out(`Wrote ${rel}/scan/${repo.id}.yaml: ${plural(size(proposed), "settings entry", "settings entries")} to accept, ${plural(verified.length, "record")} confirmed.`);
+  if (f.count)
+    io.out(`Wrote ${rel}/scan/${repo.id}.findings.md: ${plural(f.count, "thing")} a reader or a scanner plugin must read differently.`);
+  const waiting = known.filter((q) => q.state === "open");
+  if (raised.length) {
+    io.out(`${plural(raised.length, "question")} for a person, in ${questionsRelOf(root)}/:`);
+    for (const q of raised)
+      io.out(`  ${q.id} ${q.question}`);
+  }
+  for (const q of reused)
+    io.out(reusedLine(q));
+  if (waiting.length)
+    io.out(`${plural(waiting.length, "question")} still waiting for an answer: ${waiting.map((q) => q.id).join(", ")}`);
+  if (raised.length + waiting.length)
+    io.out(`Answer with atticus questions answer <id> --option <n>, or on the app's Questions page; then run atticus scan verify ${repo.id} again.`);
+  io.out(size(proposed) ? `Next: review ${rel}/scan/${repo.id}.yaml, then atticus scan verify ${repo.id} --accept, and atticus scan.` : `Next: nothing to accept; see ${rel}/scan/${repo.id}.findings.md for what a reader must change.`);
+  return 0;
+}
+async function scanVerifyAccept(root, target, o, io) {
+  const repo = await repoFor(root, target);
+  if (!repo) {
+    io.err(`${target} isn't a cloned repo of the manifest or a folder; clone it with atticus workspace sync, or give its folder.`);
+    return 2;
+  }
+  const proposal = await readProposal(root, repo.id);
+  if (!proposal) {
+    io.err(`There is no proposal for ${repo.id} yet: run atticus scan verify ${repo.id} first.`);
+    return 1;
+  }
+  if (size(proposal.settings) === 0) {
+    io.out(`Nothing to accept for ${repo.id}: the proposal has no settings entries.`);
+    return 0;
+  }
+  const file = join(orgPackDirOf(root), "scan", `${repo.id}.yaml`);
+  const text = await readFile(file, "utf8").catch(() => void 0);
+  const have = text ? ScanSettings.parse((0, import_yaml.parse)(text)) : ScanSettings.parse({ schemaVersion: 1, repo: repo.id });
+  const added = newEntries(have, proposal.settings);
+  const next = ScanSettings.parse({ ...have, ...merge(have, added) });
+  const checked = await checkScanSettings(next, fsRepo(repo.id, repo.dir, "0".repeat(40)));
+  if (checked.problems.length) {
+    io.err(`The settings no longer check out against the code, so nothing was merged:`);
+    for (const p of checked.problems)
+      io.err(`  - ${p}`);
+    return 1;
+  }
+  const now = o.now ?? /* @__PURE__ */ new Date();
+  await mkdir(join(orgPackDirOf(root), "scan"), { recursive: true });
+  await writeFile(file, `# Scan settings for ${repo.id} (ADR 0075); entries accepted from atticus scan verify on ${now.toISOString().slice(0, 10)} by ${o.by} (ADR 0082). Review it like any org-pack change.
+${(0, import_yaml.stringify)(next)}`, "utf8");
+  await writeProposal(root, {
+    ...proposal,
+    settings: EMPTY,
+    accepted: { at: now.toISOString(), by: o.by, entries: size(added) }
+  });
+  io.out(`Merged ${plural(size(added), "entry", "entries")} into org-pack/scan/${repo.id}.yaml${size(added) ? `: ${describeSettings(added)}` : ""}. Review it in a pull request, then run atticus scan.`);
+  return 0;
+}
+export {
+  scanVerify,
+  scanVerifyAccept
+};

package/dist/chunk-Z6LF7HQN.js

@@ -0,0 +1,22 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  codeToolOptions,
+  criticCodeSearch,
+  metarepoToolBox,
+  offerCodeDir
+} from "./chunk-ZVM6AKKM.js";
+import "./chunk-T6AIP7H5.js";
+import "./chunk-CNUKCS2T.js";
+import "./chunk-S2A7YC3Q.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+export {
+  codeToolOptions,
+  criticCodeSearch,
+  metarepoToolBox,
+  offerCodeDir
+};

package/dist/chunk-ZCJDOK2S.js

@@ -0,0 +1,116 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  diffLines
+} from "./chunk-JGZCG5VM.js";
+import "./chunk-RVH5SUW5.js";
+import "./chunk-OT2O76OS.js";
+import "./chunk-IPKHE5D6.js";
+import "./chunk-3HI6Z55Y.js";
+import "./chunk-XY3P7JW7.js";
+import "./chunk-4AK7IBVP.js";
+import "./chunk-7JUKDRSZ.js";
+import {
+  diffCatalogs,
+  readCatalog,
+  scanEstate,
+  writeCatalog
+} from "./chunk-27NKUS3X.js";
+import "./chunk-L24C55VN.js";
+import "./chunk-PAMPPUR6.js";
+import "./chunk-23W7VWKR.js";
+import "./chunk-7EKXJZ2Y.js";
+import "./chunk-MC3H7736.js";
+import {
+  branchSlug,
+  createWorkspace,
+  isInPlace,
+  loadRepos
+} from "./chunk-EFHQ3TWP.js";
+import "./chunk-GQ4N4WKF.js";
+import "./chunk-CNUKCS2T.js";
+import {
+  catalogDirOf,
+  require_dist
+} from "./chunk-S2A7YC3Q.js";
+import {
+  writeFileAtomic
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/branch-scan-commands.js
+var import_yaml = __toESM(require_dist(), 1);
+import { join } from "node:path";
+var branchCatalogRel = (branch) => `branches/${branchSlug(branch)}`;
+var fromRepos = (records, repos) => records.filter((r) => r.evidence.some((e) => e.repo && repos.has(e.repo)));
+async function scanBranch(root, branch, o, io) {
+  const all = (await loadRepos(root)).filter((r) => !r.archived && !isInPlace(r.url));
+  const named = o.repos?.length ? all.filter((r) => o.repos.includes(r.id)) : void 0;
+  const baseline = (named ?? all).filter((r) => r.defaultBranch === branch);
+  if (baseline.length) {
+    io.err(`${branch} is the default branch of ${baseline.map((r) => r.id).join(", ")}: its catalog is the baseline. Run atticus scan for it.`);
+    return 2;
+  }
+  const repos = named ?? all.filter((r) => r.branches.includes(branch));
+  if (!repos.length) {
+    io.err(`No repo lists ${branch} under branches in its manifest. Add it there (or on Set up \u203A Repos), or name the repos: atticus scan --ref ${branch} --repos <id>,<id>.`);
+    return 2;
+  }
+  const ws = createWorkspace(root);
+  const dirs = /* @__PURE__ */ new Map();
+  const commits = [];
+  let problems = 0;
+  for (const r of repos)
+    try {
+      const c = await ws.checkoutBranch(r, branch);
+      dirs.set(r.id, c.dir);
+      commits.push({ id: r.id, commit: c.commit });
+    } catch (e) {
+      io.err(`${e.message}; it is left out of this scan.`);
+      problems++;
+    }
+  if (!dirs.size)
+    return 1;
+  const ids = [...dirs.keys()];
+  const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const scan = await scanEstate({
+    root,
+    repos: ids,
+    repoDir: (id) => dirs.get(id),
+    // The branch's code only: inputs/ and other metarepos belong to the baseline.
+    inputsDir: null,
+    federated: [],
+    scannedAt,
+    ...o.full ? { cache: null } : {}
+  });
+  const rel = branchCatalogRel(branch);
+  const dir = join(catalogDirOf(root), ...rel.split("/"));
+  const write = await writeCatalog(join(dir, "generated"), scan.records);
+  await writeFileAtomic(join(dir, "branch.yaml"), (0, import_yaml.stringify)({ schemaVersion: 1, branch, scannedAt, repos: commits }));
+  const ofRepos = new Set(ids);
+  const before = await readCatalog(join(catalogDirOf(root), "generated"), { cacheRoot: root });
+  const diff = diffCatalogs(fromRepos(before.records, ofRepos), fromRepos(scan.records, ofRepos));
+  problems += scan.problems.length;
+  if (o.json) {
+    io.out(JSON.stringify({ branch, repos: commits, folder: `catalog/${rel}`, diff, problems: scan.problems }, null, 2));
+    return problems ? 1 : 0;
+  }
+  io.out(`Scanned ${branch} of ${ids.join(", ")}: ${scan.records.length} records in catalog/${rel}/generated (${write.written} written, ${write.unchanged} unchanged, ${write.removed} removed).`);
+  const lines = diffLines(diff);
+  io.out(`${branch} against the baseline: ${lines[0]}`);
+  for (const l of lines.slice(1))
+    io.out(l);
+  for (const p of scan.problems)
+    io.err(`${"repo" in p && p.repo ? `${p.repo}: ` : ""}${p.message}`);
+  io.out(`The baseline (catalog/generated) is unchanged: a branch is compared with it, never merged into it.`);
+  return problems ? 1 : 0;
+}
+export {
+  branchCatalogRel,
+  scanBranch
+};