@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/chunk-OLWFG75W.js

@@ -0,0 +1,4330 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  featuresForScan,
+  namingHint,
+  syncSources
+} from "./chunk-L24C55VN.js";
+import {
+  dirSource,
+  sameCommit,
+  verifyFacts
+} from "./chunk-PAMPPUR6.js";
+import {
+  scanInputs
+} from "./chunk-23W7VWKR.js";
+import {
+  listIngestors
+} from "./chunk-7EKXJZ2Y.js";
+import {
+  BUILT_IN_EXTRACTORS,
+  MODEL_READERS,
+  PREFIX_CONVENTIONS,
+  SHIPPED_DIALECTS_DIR,
+  applyPipelineModels,
+  detectModules,
+  dialectExtractor,
+  loadShippedDialects,
+  modelCovers,
+  repoImports,
+  runDialectTests,
+  runFrameworkTests,
+  unmodelledFrameworks
+} from "./chunk-MC3H7736.js";
+import {
+  baseClonePath,
+  changesSince,
+  checkoutState
+} from "./chunk-KJPMEAI4.js";
+import {
+  DEFAULT_IGNORES,
+  configHash,
+  createParseCache,
+  fsRepo,
+  fsScanCache,
+  globToRegExp,
+  readPinnedEntry,
+  sandboxedExtractor,
+  scanRepo,
+  withParseCache
+} from "./chunk-GQ4N4WKF.js";
+import {
+  buildContextPack,
+  toRunSummary
+} from "./chunk-CNUKCS2T.js";
+import {
+  AgentDefinition,
+  DECLARED_CALLER,
+  DEFAULT_SPEC_TEMPLATE,
+  HOSTS_NONE,
+  IsoDateTime,
+  NEVER_CHECKED_STEPS,
+  PluginExpected,
+  REPO_TYPE_SCHEMA_VERSION,
+  RecordId,
+  SCAN_SETTINGS_SCHEMA_VERSION,
+  applyCurated,
+  callTargetQuestion,
+  callerRecords,
+  catalogDirOf,
+  declaredCallsOf,
+  deserializeRecord,
+  external_exports,
+  factIdPart,
+  factsDirOf,
+  factsRelOf,
+  fieldKey,
+  flowFiles,
+  hostMatches,
+  hostQuestionText,
+  identifierWords,
+  isPrototypeType,
+  joinCallers,
+  joinFacts,
+  joinRecords,
+  lineNamesField,
+  lineNamesRoute,
+  lineNamesWord,
+  listQuestions,
+  loadOrgPack,
+  mergeCatalog,
+  normalizePath,
+  orgPackDirOf,
+  parseFacts,
+  parseRecord,
+  projectFacts,
+  questionId,
+  readParsedFiles,
+  recordPath,
+  require_dist,
+  serializeRecord,
+  slugify,
+  specFileHash,
+  specFindingFingerprint,
+  throwIfCancelled,
+  toCanonicalYaml,
+  urlHostPort
+} from "./chunk-S2A7YC3Q.js";
+import {
+  SCHEMA_VERSION,
+  writeFileAtomic
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/glossary/dist/proposals.js
+var import_yaml = __toESM(require_dist(), 1);
+import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+var GLOSSARY_DEFINER = "glossary-definer";
+var GLOSSARY_CHANGE = "glossary";
+var GLOSSARY_OUTPUT = "catalog/proposals/glossary-definitions.yaml";
+var DefinitionProposalFile = external_exports.strictObject({
+  schemaVersion: external_exports.literal(1),
+  term: RecordId,
+  definition: external_exports.string().min(1),
+  evidence: external_exports.array(external_exports.string().min(1)).min(1),
+  agent: RecordId,
+  runId: external_exports.string().optional(),
+  at: IsoDateTime
+});
+var LEADING = ["schemaVersion", "term", "definition", "evidence"];
+async function writeDefinitionProposals(dir, proposals) {
+  const written = [];
+  if (!proposals.length)
+    return written;
+  await mkdir(join(dir, "glossaryterm"), { recursive: true });
+  for (const p of proposals) {
+    const file = `glossaryterm/${p.term}.yaml`;
+    const body = DefinitionProposalFile.parse({ schemaVersion: 1, ...p });
+    await writeFile(join(dir, file), toCanonicalYaml(body, LEADING), "utf8");
+    written.push(file);
+  }
+  return written;
+}
+async function readDefinitionProposals(dir) {
+  const proposals = [];
+  const problems = [];
+  let files;
+  try {
+    files = (await readdir(join(dir, "glossaryterm"))).filter((f) => /\.ya?ml$/.test(f)).sort();
+  } catch {
+    return { proposals, problems };
+  }
+  for (const f of files) {
+    const file = `glossaryterm/${f}`;
+    let data;
+    try {
+      data = (0, import_yaml.parse)(await readFile(join(dir, file), "utf8"));
+    } catch (e) {
+      problems.push({ file, message: `invalid YAML: ${e.message.split("\n")[0]}` });
+      continue;
+    }
+    const p = DefinitionProposalFile.safeParse(data);
+    if (!p.success) {
+      problems.push({
+        file,
+        message: p.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+      });
+      continue;
+    }
+    const { schemaVersion: _v, ...rest } = p.data;
+    void _v;
+    proposals.push(rest);
+  }
+  return { proposals, problems };
+}
+function glossaryDefinerAgent(orgPack) {
+  const own = orgPack?.agents.find((a) => a.id === GLOSSARY_DEFINER);
+  if (own)
+    return own;
+  return AgentDefinition.parse({
+    schemaVersion: 1,
+    id: GLOSSARY_DEFINER,
+    role: "business-analyst",
+    description: "Proposes a one-sentence business definition for each glossary term found only in code, from where the code uses it.",
+    inputs: ["glossary", "catalog-slice"],
+    // C5 has no output kind for catalog proposals (see ADR 0031); a definition seeds specs.
+    outputArtifact: "specs",
+    tokenBudget: orgPack?.runtime.budgets.defaultTokens ?? 15e4,
+    allowedRuntimes: ["hand-off", "model", "headless-claude-code", "mock", "replay"]
+  });
+}
+var INSTRUCTIONS = `# Glossary definer
+
+You propose business definitions for words an estate's code uses that no wiki page defines. Each term below is a data block: its id, the word, and the records (endpoints, topics, tables, columns, schema fields) that use it. For each term propose:
+
+- definition: one sentence a product owner would accept, saying what the word means to the business, only from the evidence;
+- evidence: the record ids from that term's block your definition relies on.
+
+Don't invent systems, rules or numbers. A proposal that cites no record id from its term is discarded. Write YAML and nothing else:
+
+terms:
+  - id: <term id>
+    definition: <one sentence>
+    evidence: [<record id>, ...]`;
+var Proposal = external_exports.object({
+  id: external_exports.string().min(1),
+  definition: external_exports.string().trim().min(3).max(400),
+  evidence: external_exports.array(external_exports.coerce.string()).default([])
+});
+function block(e) {
+  return toCanonicalYaml({
+    id: e.id,
+    term: e.term,
+    usedBy: (e.code?.uses ?? []).map((u) => ({
+      id: u.record,
+      kind: u.kind,
+      name: u.name,
+      ...u.evidence.path ? {
+        code: `${u.evidence.repo ? `${u.evidence.repo}:` : ""}${u.evidence.path}${u.evidence.line ? `:${u.evidence.line}` : ""}`
+      } : {}
+    }))
+  }, ["id", "term", "usedBy", "id", "kind", "name", "code"]).trimEnd();
+}
+function parseDefinerOutput(output, entries, meta) {
+  let data;
+  try {
+    data = (0, import_yaml.parse)(output.replace(/^```(?:ya?ml)?\s*\n|\n```\s*$/g, ""));
+  } catch (e) {
+    return {
+      proposals: [],
+      discarded: [{ reason: `the output is not YAML: ${e.message.split("\n")[0]}` }]
+    };
+  }
+  const list = data?.terms;
+  if (!Array.isArray(list))
+    return { proposals: [], discarded: [{ reason: "the output has no terms list" }] };
+  const byId = new Map(entries.map((e) => [e.id, e]));
+  const out = { proposals: [], discarded: [] };
+  for (const raw of list) {
+    const p = Proposal.safeParse(raw);
+    const id = typeof raw?.id === "string" ? raw.id : void 0;
+    if (!p.success) {
+      out.discarded.push({ ...id ? { term: id } : {}, reason: "incomplete proposal" });
+      continue;
+    }
+    const e = byId.get(p.data.id);
+    if (!e) {
+      out.discarded.push({
+        term: p.data.id,
+        reason: `${p.data.id} isn't one of the terms it was given`
+      });
+      continue;
+    }
+    if (out.proposals.some((x) => x.term === e.id)) {
+      out.discarded.push({ term: e.id, reason: "a second proposal for the same term" });
+      continue;
+    }
+    const known = new Set((e.code?.uses ?? []).map((u) => u.record));
+    const evidence = [...new Set(p.data.evidence.filter((x) => known.has(x)))];
+    if (!evidence.length) {
+      out.discarded.push({ term: e.id, reason: "it cites no record that uses the term" });
+      continue;
+    }
+    out.proposals.push({
+      term: e.id,
+      definition: p.data.definition.replace(/\s+/g, " "),
+      evidence,
+      agent: meta.agent,
+      at: meta.at,
+      ...meta.runId ? { runId: meta.runId } : {}
+    });
+  }
+  return out;
+}
+function undefinedCodeTerms(entries) {
+  return entries.filter((e) => e.sources.length === 1 && e.sources[0] === "code" && (e.code?.uses.length ?? 0) > 0);
+}
+async function proposeDefinitions(entries, runtime, o = {}) {
+  const todo = [...entries].sort((a, b) => a.id.localeCompare(b.id));
+  if (!todo.length)
+    return { proposals: [], discarded: [] };
+  const agent = glossaryDefinerAgent(o.orgPack);
+  const now2 = o.now ?? /* @__PURE__ */ new Date();
+  const at3 = now2.toISOString().replace(/\.\d{3}Z$/, "Z");
+  const levels = o.orgPack?.pack?.classification ?? [
+    "public",
+    "internal",
+    "confidential",
+    "restricted"
+  ];
+  const sources = [
+    {
+      id: "0-instructions",
+      kind: "instruction",
+      origin: "atticus/glossary",
+      text: INSTRUCTIONS,
+      classification: "public",
+      trusted: true
+    },
+    ...todo.map((e) => ({
+      id: e.id,
+      kind: "catalog",
+      origin: `catalog/generated/glossaryterm/${e.id}.yaml`,
+      text: block(e),
+      classification: "internal",
+      priority: 10
+    }))
+  ];
+  const pack = buildContextPack({
+    change: GLOSSARY_CHANGE,
+    agent: agent.id,
+    budget: o.orgPack?.runtime.budgets.perAgent[agent.id] ?? agent.tokenBudget,
+    sources,
+    levels,
+    maxClassification: levels.includes("internal") ? "internal" : levels.at(-1),
+    now: now2
+  });
+  const sent = todo.filter((e) => pack.manifest.sources.some((s) => s.id === e.id));
+  const discarded = todo.filter((e) => !sent.includes(e)).map((e) => ({
+    term: e.id,
+    reason: "left out of the context pack (budget or classification)"
+  }));
+  const prepared = await runtime.prepare({
+    change: GLOSSARY_CHANGE,
+    agent,
+    pack,
+    outputPath: GLOSSARY_OUTPUT
+  });
+  const run = await runtime.run(prepared.runId);
+  if (run.state === "waiting" || run.state === "prepared")
+    return {
+      proposals: [],
+      discarded,
+      waiting: run.runId,
+      promptSha256: pack.manifest.promptSha256
+    };
+  if (run.state !== "validated" || run.output === void 0)
+    return {
+      proposals: [],
+      discarded: [
+        ...discarded,
+        { reason: `the glossary definer ${run.state}: ${run.errors.join("; ") || "no output"}` }
+      ],
+      run: toRunSummary(run),
+      promptSha256: pack.manifest.promptSha256
+    };
+  const parsed = parseDefinerOutput(run.output, sent, { agent: agent.id, at: at3, runId: run.runId });
+  return {
+    proposals: parsed.proposals,
+    discarded: [...discarded, ...parsed.discarded],
+    run: toRunSummary(run),
+    promptSha256: pack.manifest.promptSha256
+  };
+}
+
+// packages/glossary/dist/decisions.js
+import { createHash } from "node:crypto";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+
+// packages/glossary/dist/words.js
+var STOP_TOKENS = /* @__PURE__ */ new Set([
+  "a",
+  "an",
+  "and",
+  "api",
+  "at",
+  "by",
+  "create",
+  "created",
+  "delete",
+  "for",
+  "get",
+  "id",
+  "ids",
+  "in",
+  "is",
+  "list",
+  "of",
+  "on",
+  "or",
+  "patch",
+  "post",
+  "put",
+  "the",
+  "to",
+  "ts",
+  "update",
+  "updated",
+  "uuid"
+]);
+var QUALIFIERS = /* @__PURE__ */ new Set([
+  "cur",
+  "curr",
+  "current",
+  "has",
+  "max",
+  "min",
+  "new",
+  "old",
+  "prev",
+  "previous"
+]);
+var splitWords = (s) => identifierWords(s);
+function singular(w) {
+  if (w.length <= 3)
+    return w;
+  if (/ies$/.test(w))
+    return `${w.slice(0, -3)}y`;
+  if (/(ss|us|is)$/.test(w))
+    return w;
+  if (/(sses|shes|ches|xes|zes)$/.test(w))
+    return w.slice(0, -2);
+  if (/ses$/.test(w))
+    return w.slice(0, -1);
+  if (/s$/.test(w))
+    return w.slice(0, -1);
+  return w;
+}
+var isNoise = (w) => STOP_TOKENS.has(w) || /^v\d+$/.test(w) || /^\d+$/.test(w);
+function businessWords(s) {
+  return splitWords(s).filter((w) => !isNoise(w)).map(singular);
+}
+function compoundOf(name) {
+  const w = splitWords(name).filter((x) => !/^\d+$/.test(x));
+  while (w.length && (isNoise(w[0]) || QUALIFIERS.has(w[0])))
+    w.shift();
+  while (w.length && isNoise(w.at(-1)))
+    w.pop();
+  if (w.length < 2 || w.some(isNoise))
+    return void 0;
+  return [...w.slice(0, -1), singular(w.at(-1))].join(" ");
+}
+function singleOf(name) {
+  const w = businessWords(name).filter((x) => !QUALIFIERS.has(x));
+  return w.length === 1 ? w[0] : void 0;
+}
+function termKey(term) {
+  const w = term.toLowerCase().replace(/[`*_"'’]/g, "").split(/[^a-z0-9]+/).filter(Boolean);
+  if (!w.length)
+    return "";
+  return [...w.slice(0, -1), singular(w.at(-1))].join(" ");
+}
+function termId(term) {
+  return `term.${termKey(term).replace(/\s+/g, "-")}`.slice(0, 120);
+}
+function displayTerm(term) {
+  const t = term.trim().replace(/\s+/g, " ");
+  return t.charAt(0).toUpperCase() + t.slice(1);
+}
+function definitionKey(d) {
+  return d.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+
+// packages/glossary/dist/decisions.js
+var GlossaryError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "GlossaryError";
+  }
+};
+var now = () => (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+function decisionId(prefix, key) {
+  const id = `${prefix}.${key}`;
+  if (id.length <= 120)
+    return id;
+  return `${id.slice(0, 110)}-${createHash("sha256").update(id).digest("hex").slice(0, 8)}`;
+}
+function decision(id, target, action, value, reason, o) {
+  if (!o.by.trim())
+    throw new GlossaryError("invalid", "Say who decides (--by <handle>).");
+  const p = parseRecord({
+    schemaVersion: 2,
+    kind: "CuratedDecision",
+    id,
+    status: "current",
+    confidence: "asserted",
+    evidence: [{ source: "manual", by: o.by }],
+    target,
+    action,
+    value,
+    reason: o.reason?.trim() || reason,
+    by: o.by,
+    at: o.at ?? now()
+  });
+  if (!p.ok)
+    throw new GlossaryError("invalid", `That decision isn't valid: ${p.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+  return p.record;
+}
+function resolveTermId(termOrId) {
+  const t = termOrId.trim();
+  if (/^term\.[a-z0-9][a-z0-9._-]*$/.test(t))
+    return t;
+  const id = termId(t);
+  if (id === "term.")
+    throw new GlossaryError("invalid", `"${termOrId}" is not a term.`);
+  return id;
+}
+function defineDecision(term, definition, o) {
+  const def = definition.trim().replace(/\s+/g, " ");
+  if (def.length < 3)
+    throw new GlossaryError("invalid", "A definition needs a sentence.");
+  const id = resolveTermId(term);
+  const name = o.existing?.term ?? (term.startsWith("term.") ? void 0 : displayTerm(term));
+  return decision(decisionId("glossary.define", id.slice("term.".length)), id, "assert", { ...name ? { term: name } : {}, definition: def, ...o.owner ? { owner: o.owner } : {} }, `Glossary definition of ${name ?? id}`, o);
+}
+function aliasDecision(term, aliases, o) {
+  const id = resolveTermId(term);
+  const byKey = /* @__PURE__ */ new Map();
+  for (const a of aliases.map((x) => x.trim().replace(/\s+/g, " ")).filter(Boolean))
+    if (!byKey.has(termKey(a)))
+      byKey.set(termKey(a), a);
+  const names = [...byKey.values()].sort();
+  if (!names.length)
+    throw new GlossaryError("invalid", "Give at least one other name.");
+  return decision(decisionId("glossary.alias", id.slice("term.".length)), id, "alias", names, `Other names for ${id}`, o);
+}
+function linkDecision(term, recordId, records, o) {
+  const byId = new Map(records.map((r) => [r.id, r]));
+  const [base2, field] = recordId.split("#");
+  const target = byId.get(base2);
+  if (!target)
+    throw new GlossaryError("not-found", `There is no record ${base2} in the catalog.`);
+  if (field !== void 0) {
+    if (target.kind !== "Schema" || !target.fields.some((f) => f.name === field))
+      throw new GlossaryError("not-found", `${base2} has no schema field ${field}.`);
+  } else if (target.kind === "Column") {
+    return decision(decisionId("glossary.link", target.id), target.id, "assert", { glossaryTerm: term.id }, `${target.id} holds the glossary term ${term.term}`, o);
+  }
+  const fields = [.../* @__PURE__ */ new Set([...term.fields, recordId])].sort();
+  return decision(decisionId("glossary.fields", term.id.slice("term.".length)), term.id, "assert", { fields }, `What the glossary term ${term.term} is linked to`, o);
+}
+async function writeDecisions(curatedDir, decisions) {
+  const out = [];
+  for (const d of decisions) {
+    const rel = recordPath(d);
+    const full = join2(curatedDir, ...rel.split("/"));
+    await mkdir2(dirname(full), { recursive: true });
+    await writeFile2(full, serializeRecord(d), "utf8");
+    out.push(rel);
+  }
+  return out;
+}
+
+// packages/glossary/dist/scan.js
+import { mkdir as mkdir3, readdir as readdir2, readFile as readFile2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname2, join as join3, relative, sep } from "node:path";
+
+// packages/glossary/dist/code.js
+var firstEvidence = (r) => r.evidence[0];
+function named(records) {
+  const out = [];
+  const endpointIds = new Set(records.filter((r) => r.kind === "Endpoint").map((r) => r.id));
+  for (const r of records) {
+    if (r.status === "retired")
+      continue;
+    if (r.kind === "Endpoint") {
+      const e = r;
+      out.push({
+        record: e.id,
+        kind: e.kind,
+        name: e.pathOrTopic,
+        words: businessWords(e.pathOrTopic),
+        isField: false,
+        evidence: firstEvidence(e)
+      });
+    } else if (r.kind === "Interface") {
+      const i = r;
+      if (i.endpoint && endpointIds.has(i.endpoint))
+        continue;
+      out.push({
+        record: i.id,
+        kind: i.kind,
+        name: i.normalizedPath,
+        words: businessWords(i.normalizedPath),
+        isField: false,
+        evidence: firstEvidence(i)
+      });
+    } else if (r.kind === "Table") {
+      const t = r;
+      const compound = compoundOf(t.name);
+      const single = compound ? void 0 : singleOf(t.name);
+      out.push({
+        record: t.id,
+        kind: t.kind,
+        name: t.name,
+        words: businessWords(t.name),
+        ...compound ? { compound } : {},
+        ...single ? { single } : {},
+        isField: false,
+        evidence: firstEvidence(t)
+      });
+    } else if (r.kind === "Column") {
+      const c = r;
+      const compound = compoundOf(c.name);
+      const single = compound ? void 0 : singleOf(c.name);
+      out.push({
+        record: c.id,
+        kind: c.kind,
+        name: c.name,
+        words: businessWords(c.name),
+        ...compound ? { compound } : {},
+        ...single ? { single } : {},
+        type: c.type,
+        isField: true,
+        evidence: firstEvidence(c)
+      });
+    } else if (r.kind === "Schema") {
+      const s = r;
+      for (const f of s.fields) {
+        const compound = compoundOf(f.name);
+        const single = compound ? void 0 : singleOf(f.name);
+        out.push({
+          record: `${s.id}#${f.name}`,
+          kind: "SchemaField",
+          name: f.name,
+          words: businessWords(f.name),
+          ...compound ? { compound } : {},
+          ...single ? { single } : {},
+          ...f.type ? { type: f.type } : {},
+          isField: true,
+          evidence: firstEvidence(s)
+        });
+      }
+    }
+  }
+  return out.sort((a, b) => a.record < b.record ? -1 : a.record > b.record ? 1 : 0);
+}
+function codeTerms(records, aliasOf = (k) => k) {
+  const items = named(records);
+  const byWord = /* @__PURE__ */ new Map();
+  for (const n of items)
+    if (!n.compound)
+      for (const w of new Set(n.words))
+        byWord.set(w, (byWord.get(w) ?? /* @__PURE__ */ new Set()).add(n.record));
+  const tableWords = new Set(items.filter((n) => n.kind === "Table" && n.single).map((n) => n.single));
+  const keys = /* @__PURE__ */ new Set();
+  for (const [w, recs] of byWord)
+    if (recs.size >= 2 || tableWords.has(w))
+      keys.add(w);
+  for (const n of items)
+    if (n.compound)
+      keys.add(n.compound);
+  const out = /* @__PURE__ */ new Map();
+  const get = (key) => {
+    const k = aliasOf(key);
+    let t = out.get(k);
+    if (!t) {
+      t = { key: k, uses: [], fields: [], types: {} };
+      out.set(k, t);
+    }
+    return t;
+  };
+  for (const key of [...keys].sort()) {
+    for (const n of items) {
+      const usesWord = !key.includes(" ") && !n.compound && n.words.includes(key);
+      const isWhole = n.compound === key || !n.compound && n.single === key;
+      if (!usesWord && !isWhole)
+        continue;
+      const t = get(key);
+      if (!t.uses.some((u) => u.record === n.record))
+        t.uses.push({ record: n.record, kind: n.kind, name: n.name, evidence: n.evidence });
+      if (n.isField && isWhole && !t.fields.includes(n.record)) {
+        t.fields.push(n.record);
+        if (n.type)
+          t.types[n.record] = n.type;
+      }
+    }
+  }
+  for (const n of items) {
+    const whole = n.compound ?? n.single;
+    if (!n.isField || !whole)
+      continue;
+    const k = aliasOf(whole);
+    if (k === whole)
+      continue;
+    const t = get(whole);
+    if (!t.fields.includes(n.record)) {
+      t.fields.push(n.record);
+      if (n.type)
+        t.types[n.record] = n.type;
+    }
+    if (!t.uses.some((u) => u.record === n.record))
+      t.uses.push({ record: n.record, kind: n.kind, name: n.name, evidence: n.evidence });
+  }
+  for (const t of out.values()) {
+    t.uses.sort((a, b) => a.record < b.record ? -1 : a.record > b.record ? 1 : 0);
+    t.fields.sort();
+  }
+  return out;
+}
+function fieldNames(records) {
+  return named(records).filter((n) => n.isField).map((n) => ({ record: n.record, name: n.name }));
+}
+
+// packages/glossary/dist/wiki.js
+var GLOSSARY = /\b(glossary|glossaries|definitions|terminology|terms|vocabulary)\b/i;
+var META = /^(owner|owners|last updated|updated|status|version|author|date|classification|approver|approvers|reviewed by|reviewer|lead time|typical lead time|title|tags|see also|note|notes|example|examples|source|link|links|contact|team)$/i;
+var strip = (s) => s.replace(/^\*\*(.+)\*\*$/, "$1").replace(/^__(.+)__$/, "$1").replace(/[`]/g, "").trim();
+function isTermLike(raw) {
+  const t = strip(raw);
+  if (!t || t.length > 60 || !/^[A-Za-z]/.test(t))
+    return false;
+  if (/:\/\/|[|?!;]/.test(t) || /[.,]$/.test(t))
+    return false;
+  if (META.test(t))
+    return false;
+  const words2 = t.split(/\s+/);
+  return words2.length >= 1 && words2.length <= 5;
+}
+var cleanDefinition = (s) => s.replace(/\s+/g, " ").trim();
+var BOLD = /^(?:\*\*([^*]+?)\*\*|__([^_]+?)__)\s*(?::|\s[—–-]\s)\s*(.+)$/;
+var PLAIN = /^([A-Za-z][^:]{0,59}?)\s*(?::|\s[—–-]\s)\s*(.+)$/;
+function lineDefinition(text, scoped) {
+  const b = BOLD.exec(text);
+  if (b) {
+    const term = (b[1] ?? b[2]).trim();
+    const definition = cleanDefinition(b[3]);
+    if (isTermLike(term) && definition.length >= 3)
+      return { term, definition, markup: "bold" };
+    return void 0;
+  }
+  if (!scoped)
+    return void 0;
+  const p = PLAIN.exec(text);
+  if (p && isTermLike(p[1])) {
+    const definition = cleanDefinition(p[2]);
+    if (definition.length >= 3)
+      return { term: strip(p[1]), definition, markup: "line" };
+  }
+  return void 0;
+}
+var TERM_HEADER = /^(term|terms|name|word|phrase|concept)$/i;
+var DEF_HEADER = /^(definition|definitions|meaning|description|what it means)$/i;
+function scopes(page) {
+  const fmType = [page.frontMatter.type, page.frontMatter.kind].filter((v) => typeof v === "string").join(" ");
+  const pageWide = GLOSSARY.test(page.title) || GLOSSARY.test(fmType);
+  const out = [];
+  let openLevel;
+  for (const s of page.sections) {
+    if (openLevel !== void 0 && s.level > 0 && s.level <= openLevel)
+      openLevel = void 0;
+    if (openLevel === void 0 && s.level > 0 && GLOSSARY.test(s.heading))
+      openLevel = s.level;
+    out.push(pageWide || openLevel !== void 0);
+  }
+  return out;
+}
+function pageDefinitions(page) {
+  const out = [];
+  const add = (term, definition, line, markup) => {
+    const t = displayTerm(strip(term));
+    const key = termKey(t);
+    if (!key)
+      return;
+    out.push({
+      term: t,
+      key,
+      definition,
+      path: page.path,
+      line,
+      markup,
+      pageTitle: page.title,
+      ...page.owner ? { owner: page.owner } : {}
+    });
+  };
+  const inScope = scopes(page);
+  page.sections.forEach((s, si) => {
+    const scoped = inScope[si];
+    if (scoped && s.level >= 2 && !GLOSSARY.test(s.heading) && isTermLike(s.heading)) {
+      const first = s.blocks[0];
+      if (first?.type === "paragraph" && !lineDefinition(first.text.split("\n")[0], true))
+        add(s.heading, cleanDefinition(first.text), first.line, "heading");
+    }
+    for (const b of s.blocks) {
+      if (b.type === "paragraph") {
+        const lines = b.text.split("\n");
+        for (let k = 0; k < lines.length; k++) {
+          const l = lines[k];
+          const next = lines[k + 1];
+          if (next !== void 0 && /^:\s+\S/.test(next) && isTermLike(l)) {
+            add(l, cleanDefinition(next.replace(/^:\s+/, "")), b.line + k, "definition-list");
+            k++;
+            continue;
+          }
+          const d = lineDefinition(l, scoped);
+          if (d)
+            add(d.term, d.definition, b.line + k, d.markup);
+        }
+      } else if (b.type === "list") {
+        for (const it of b.items) {
+          const d = lineDefinition(it.text.split("\n")[0], scoped);
+          if (d)
+            add(d.term, cleanDefinition([d.definition, ...it.text.split("\n").slice(1)].join(" ")), it.line, d.markup === "line" ? "list" : d.markup);
+        }
+      } else if (b.type === "table" && scoped) {
+        const ti = b.header.findIndex((h) => TERM_HEADER.test(strip(h)));
+        const di = b.header.findIndex((h) => DEF_HEADER.test(strip(h)));
+        if (ti < 0 || di < 0)
+          continue;
+        for (const r of b.rows) {
+          const term = r.cells[ti] ?? "";
+          const def = cleanDefinition(r.cells[di] ?? "");
+          if (isTermLike(term) && def.length >= 3)
+            add(term, def, r.line, "table");
+        }
+      }
+    }
+  });
+  return out.sort((a, b) => a.line - b.line);
+}
+function wikiDefinitions(pages) {
+  return pages.flatMap(pageDefinitions).sort((a, b) => a.path === b.path ? a.line - b.line : a.path < b.path ? -1 : 1);
+}
+
+// packages/glossary/dist/build.js
+var isDecision = (r) => r.kind === "CuratedDecision" && r.status === "current";
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function typeSort(type) {
+  const t = type.toLowerCase();
+  if (/^(numeric|decimal|number|money|int|integer|bigint|smallint|tinyint|float|double|real|long|short)\b/.test(t))
+    return "number";
+  if (/^(date|time|timestamp|datetime|timestamptz|instant|localdate)/.test(t))
+    return "time";
+  if (/^(bool|boolean|bit)\b/.test(t))
+    return "boolean";
+  if (/^(uuid|guid)\b/.test(t))
+    return "identifier";
+  if (/^(varchar|char|character|nvarchar|nchar|text|string|clob|citext)/.test(t))
+    return "text";
+  return t.replace(/\(.*$/, "");
+}
+function definitionSort(d) {
+  if (/\b(amount|sum|total|count|number of|quantity)\b/i.test(d))
+    return "number";
+  if (/\b(date|timestamp|time at which|day on which)\b/i.test(d))
+    return "time";
+  return void 0;
+}
+var ALIASES = (d) => (Array.isArray(d.value) ? d.value : [d.value]).map(String);
+function buildGlossary(input) {
+  const problems = [];
+  const decisions = (input.decisions ?? []).filter(isDecision);
+  const records = input.records.filter((r) => r.kind !== "GlossaryTerm");
+  const byId = new Map(records.map((r) => [r.id, r]));
+  const aliasTo = /* @__PURE__ */ new Map();
+  const aliasesOf = /* @__PURE__ */ new Map();
+  for (const d of decisions.filter((x) => x.action === "alias" && x.target.startsWith("term."))) {
+    for (const a of ALIASES(d)) {
+      const k = termKey(a);
+      if (!k)
+        continue;
+      aliasTo.set(k, d.target);
+      aliasesOf.set(d.target, [.../* @__PURE__ */ new Set([...aliasesOf.get(d.target) ?? [], a])]);
+    }
+  }
+  const defined = /* @__PURE__ */ new Map();
+  const termFieldDecisions = /* @__PURE__ */ new Map();
+  for (const d of decisions.filter((x) => x.action === "assert" && x.target.startsWith("term."))) {
+    if (!isObj(d.value))
+      continue;
+    if (typeof d.value.definition === "string")
+      defined.set(d.target, d);
+    if (Array.isArray(d.value.fields))
+      termFieldDecisions.set(d.target, d.value.fields.map(String));
+  }
+  const columnDecisions = /* @__PURE__ */ new Map();
+  for (const d of decisions.filter((x) => x.action === "assert")) {
+    if (!isObj(d.value) || typeof d.value.glossaryTerm !== "string")
+      continue;
+    if (byId.get(d.target)?.kind === "Column")
+      columnDecisions.set(d.target, d.value.glossaryTerm);
+  }
+  const idOfKey = (key) => aliasTo.get(key) ?? termId(key);
+  const keyOfAlias = (key) => {
+    const id = aliasTo.get(key);
+    return id ? id.slice("term.".length).replace(/-/g, " ") : key;
+  };
+  const defs = /* @__PURE__ */ new Map();
+  for (const d of wikiDefinitions(input.pages)) {
+    const id = idOfKey(d.key);
+    defs.set(id, [...defs.get(id) ?? [], d]);
+  }
+  const code = /* @__PURE__ */ new Map();
+  for (const t of codeTerms(records, keyOfAlias).values())
+    code.set(idOfKey(t.key), t);
+  const proposals = new Map((input.proposals ?? []).map((p) => [p.term, p]));
+  const known = [.../* @__PURE__ */ new Set([...defs.keys(), ...code.keys(), ...defined.keys()])].map((id) => ({
+    id,
+    term: defs.get(id)?.[0]?.term ?? id.slice("term.".length).replace(/-/g, " "),
+    aliases: aliasesOf.get(id) ?? []
+  }));
+  for (const [id, c] of [...code]) {
+    if (defs.has(id) || defined.has(id) || !c.key.includes(" "))
+      continue;
+    const h = namingHint(id, c.key, known.filter((k) => k.id !== id));
+    if (h?.kind === "abbreviation")
+      code.delete(id);
+  }
+  const ids = /* @__PURE__ */ new Set([...defs.keys(), ...code.keys(), ...defined.keys()]);
+  const entries = [];
+  const terms = [];
+  const conflicts = [];
+  const columnLinks = [];
+  for (const id of [...ids].sort()) {
+    const ds = defs.get(id) ?? [];
+    const c = code.get(id);
+    const person = defined.get(id);
+    const proposal = c && !ds.length && !person ? proposals.get(id) : void 0;
+    const personTerm = person && isObj(person.value) && typeof person.value.term === "string" ? person.value.term : void 0;
+    const term = ds[0]?.term ?? personTerm ?? displayTerm(id.slice("term.".length).replace(/-/g, " "));
+    const linkedColumns = [...columnDecisions].filter(([, t]) => t === id).map(([col]) => col);
+    const linked = [.../* @__PURE__ */ new Set([...linkedColumns, ...termFieldDecisions.get(id) ?? []])].sort();
+    const sources = [];
+    if (ds.length)
+      sources.push("wiki");
+    if (c)
+      sources.push("code");
+    if (person)
+      sources.push("person");
+    if (proposal)
+      sources.push("ai");
+    entries.push({
+      id,
+      term,
+      sources,
+      definitions: ds,
+      ...c ? { code: c } : {},
+      aliases: (aliasesOf.get(id) ?? []).sort(),
+      linked
+    });
+    const flags = [];
+    const distinct = [...new Map(ds.map((d) => [definitionKey(d.definition), d])).values()];
+    if (distinct.length > 1) {
+      if (!person)
+        flags.push("conflict:definition");
+      conflicts.push({
+        term: id,
+        kind: "definition",
+        message: `${term} has ${distinct.length} definitions: ${distinct.map((d) => `"${d.definition}" (${d.path}:${d.line})`).join(" and ")}.`,
+        evidence: distinct.map((d) => ({ source: "document", path: d.path, line: d.line })),
+        resolved: !!person
+      });
+    }
+    const definition = person && isObj(person.value) && typeof person.value.definition === "string" ? person.value.definition : ds[0]?.definition ?? proposal?.definition ?? `Not defined yet. Found in code: ${(c?.uses ?? []).slice(0, 5).map((u) => u.record).join(", ")}.`;
+    if (!ds.length && !person)
+      flags.push(proposal ? "ai-proposed" : "undefined");
+    const fields = [.../* @__PURE__ */ new Set([...c?.fields ?? [], ...linkedColumns])].sort();
+    const types = { ...c?.types ?? {} };
+    for (const col of linkedColumns) {
+      const r = byId.get(col);
+      if (r?.kind === "Column")
+        types[col] = r.type;
+    }
+    const sorts = /* @__PURE__ */ new Map();
+    for (const [f, t] of Object.entries(types))
+      sorts.set(typeSort(t), [...sorts.get(typeSort(t)) ?? [], f]);
+    const expected = ds.length || person || proposal ? definitionSort(definition) : void 0;
+    const off = expected ? Object.entries(types).filter(([, t]) => typeSort(t) !== expected) : [];
+    if (sorts.size > 1 || off.length) {
+      flags.push("conflict:code-usage");
+      const parts = [];
+      if (expected && off.length)
+        parts.push(`the definition says it is ${expected === "number" ? "an amount or count" : "a date or time"}, but ${off.map(([f, t]) => `${f} is ${t}`).join(", ")}`);
+      if (sorts.size > 1)
+        parts.push(`its fields have different types: ${Object.entries(types).sort(([a], [b]) => a.localeCompare(b)).map(([f, t]) => `${f} ${t}`).join(", ")}`);
+      conflicts.push({
+        term: id,
+        kind: "code-usage",
+        message: `${term} is used differently in code: ${parts.join("; ")}.`,
+        evidence: Object.keys(types).sort().map((f) => {
+          const r = byId.get(f.split("#")[0]);
+          const e = r?.evidence[0];
+          return e ?? { source: "code" };
+        }),
+        resolved: false
+      });
+    }
+    const evidence = [
+      ...ds.map((d) => ({ source: "document", path: d.path, line: d.line })),
+      ...(c?.uses ?? []).slice(0, 5).map((u) => u.evidence)
+    ];
+    if (!evidence.length && person)
+      evidence.push({ source: "manual", by: person.by });
+    if (!evidence.length)
+      evidence.push({ source: "manual" });
+    const allFields = [.../* @__PURE__ */ new Set([...fields, ...termFieldDecisions.get(id) ?? []])].sort();
+    const owner = ds.find((d) => d.owner)?.owner;
+    const p = parseRecord({
+      schemaVersion: 2,
+      kind: "GlossaryTerm",
+      id,
+      status: "current",
+      confidence: "inferred",
+      term,
+      definition,
+      fields: allFields,
+      ...owner ? { owner } : {},
+      evidence,
+      ...flags.length ? { flags: [...new Set(flags)].sort() } : {}
+    });
+    if (!p.ok) {
+      problems.push(`${id}: ${p.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+      continue;
+    }
+    terms.push(p.record);
+    for (const f of c?.fields ?? []) {
+      if (byId.get(f)?.kind !== "Column")
+        continue;
+      const r = byId.get(f);
+      const whole = compoundOf(r.name) ?? singleOf(r.name) ?? "";
+      columnLinks.push({ column: f, term: id, how: aliasTo.has(whole) ? "alias" : "name" });
+    }
+    for (const col of linkedColumns)
+      columnLinks.push({ column: col, term: id, how: "decision" });
+  }
+  const decided = new Set(columnLinks.filter((l) => l.how === "decision").map((l) => l.column));
+  const links = columnLinks.filter((l) => l.how === "decision" || !decided.has(l.column)).sort((a, b) => a.column.localeCompare(b.column) || a.term.localeCompare(b.term));
+  const covered = /* @__PURE__ */ new Set([...terms.flatMap((t) => t.fields), ...links.map((l) => l.column)]);
+  const names = entries.map((e) => ({ id: e.id, term: e.term, aliases: e.aliases }));
+  const hints = fieldNames(records).filter((f) => !covered.has(f.record)).map((f) => namingHint(f.record, f.name, names)).filter((h) => !!h);
+  return {
+    terms,
+    entries,
+    columnLinks: links,
+    conflicts: conflicts.sort((a, b) => a.term.localeCompare(b.term) || a.kind.localeCompare(b.kind)),
+    hints,
+    problems
+  };
+}
+function applyGlossary(records, build) {
+  const link = /* @__PURE__ */ new Map();
+  for (const l of build.columnLinks)
+    if (!link.has(l.column))
+      link.set(l.column, l.term);
+  const out = [];
+  for (const r of records) {
+    if (r.kind === "GlossaryTerm")
+      continue;
+    if (r.kind === "Column" && !r.glossaryTerm && link.has(r.id))
+      out.push({ ...r, glossaryTerm: link.get(r.id) });
+    else
+      out.push(r);
+  }
+  return [...out, ...build.terms];
+}
+
+// packages/glossary/dist/scan.js
+async function readRecords(dir) {
+  const records = [];
+  const problems = [];
+  async function walk(d) {
+    let entries;
+    try {
+      entries = await readdir2(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = join3(d, e.name);
+      if (e.isDirectory())
+        await walk(full);
+      else if (/\.ya?ml$/.test(e.name)) {
+        const r = deserializeRecord(await readFile2(full, "utf8"));
+        if (r.ok)
+          records.push(r.record);
+        else
+          problems.push({
+            file: relative(dir, full).split(sep).join("/"),
+            message: r.issues.map((i) => `${i.path}: ${i.message}`).join("; ")
+          });
+      }
+    }
+  }
+  await walk(dir);
+  return { records, problems };
+}
+async function glossaryForScan(i) {
+  const problems = [];
+  let pages = i.pages;
+  if (!pages) {
+    const s = await syncSources({
+      root: i.root,
+      orgPack: i.orgPack,
+      orgPackDir: i.orgPackDir ?? orgPackDirOf(i.root),
+      records: [...i.records]
+    });
+    pages = s.pages;
+    for (const p of s.problems)
+      problems.push(`${p.source}: ${p.message}`);
+  }
+  const prop = await readDefinitionProposals(i.proposalsDir);
+  for (const p of prop.problems)
+    problems.push(`proposals/${p.file}: ${p.message}`);
+  const build = buildGlossary({
+    pages,
+    records: i.records,
+    decisions: i.decisions,
+    proposals: prop.proposals
+  });
+  problems.push(...build.problems);
+  return { build, records: applyGlossary(i.records, build), problems };
+}
+var isGlossaryDecision = (d, columns) => d.kind === "CuratedDecision" && (d.target.startsWith("term.") || columns.has(d.target) && d.action === "assert" && typeof d.value === "object" && d.value !== null && "glossaryTerm" in d.value);
+async function loadGlossary(root) {
+  const orgPack = await loadOrgPack(orgPackDirOf(root));
+  const problems = orgPack.problems.map((p) => `org-pack/${p.file}: ${p.path ? `${p.path}: ` : ""}${p.message}`);
+  const catalogDir = catalogDirOf(root);
+  const generated = await readRecords(join3(catalogDir, "generated"));
+  const curated = await readRecords(join3(catalogDir, "curated"));
+  for (const p of [...generated.problems, ...curated.problems])
+    problems.push(`catalog ${p.file}: ${p.message}`);
+  const base2 = generated.records.filter((r) => r.kind !== "GlossaryTerm");
+  const s = await syncSources({ root, orgPack, orgPackDir: orgPackDirOf(root), records: base2 });
+  for (const p of s.problems)
+    problems.push(`${p.source}: ${p.message}`);
+  const g = await glossaryForScan({
+    root,
+    orgPack,
+    records: base2,
+    decisions: curated.records,
+    proposalsDir: join3(catalogDir, "proposals"),
+    pages: s.pages
+  });
+  problems.push(...g.problems);
+  const columns = new Set(base2.filter((r) => r.kind === "Column").map((r) => r.id));
+  const mine = curated.records.filter((d) => isGlossaryDecision(d, columns));
+  const applied = applyCurated(g.records, mine);
+  for (const p of applied.problems)
+    problems.push(`${p.decision}: ${p.message}`);
+  return {
+    orgPack,
+    catalogDir,
+    base: base2,
+    decisions: curated.records,
+    pages: s.pages,
+    build: g.build,
+    records: applied.records,
+    terms: applied.records.filter((r) => r.kind === "GlossaryTerm"),
+    problems
+  };
+}
+async function scanGlossary(root, o = {}) {
+  let g = await loadGlossary(root);
+  let propose;
+  if (o.runtime) {
+    const todo = undefinedCodeTerms(g.build.entries);
+    propose = await proposeDefinitions(todo, o.runtime, {
+      orgPack: g.orgPack,
+      ...o.now ? { now: o.now } : {}
+    });
+    if (propose.proposals.length) {
+      await writeDefinitionProposals(join3(g.catalogDir, "proposals"), propose.proposals);
+      g = await loadGlossary(root);
+    }
+  }
+  const generated = join3(g.catalogDir, "generated");
+  const written = [];
+  const removed = [];
+  const want = new Map(g.terms.map((t) => [recordPath(t), serializeRecord(t)]));
+  const termDir = join3(generated, "glossaryterm");
+  for (const f of (await readdir2(termDir).catch(() => [])).sort()) {
+    const rel = `glossaryterm/${f}`;
+    if (!want.has(rel)) {
+      await rm2(join3(termDir, f), { force: true });
+      removed.push(rel);
+    }
+  }
+  const before = new Map(g.base.map((r) => [`${r.kind}/${r.id}`, r]));
+  const put = async (rel, text) => {
+    const full = join3(generated, ...rel.split("/"));
+    await mkdir3(dirname2(full), { recursive: true });
+    await writeFile3(full, text, "utf8");
+    written.push(rel);
+  };
+  for (const [rel, text] of want) {
+    const cur = await readFile2(join3(generated, ...rel.split("/")), "utf8").catch(() => void 0);
+    if (cur !== text)
+      await put(rel, text);
+  }
+  const termIds = new Set(g.terms.map((t) => t.id));
+  for (const r of g.records) {
+    if (r.kind !== "Column")
+      continue;
+    const old = before.get(`Column/${r.id}`);
+    if (!old || old.kind !== "Column")
+      continue;
+    const next = r.glossaryTerm && termIds.has(r.glossaryTerm) ? r : { ...r, glossaryTerm: void 0 };
+    if ((old.glossaryTerm ?? "") === (next.glossaryTerm ?? ""))
+      continue;
+    const { glossaryTerm, ...rest } = next;
+    await put(recordPath(r), serializeRecord(glossaryTerm ? next : rest));
+  }
+  return { ...g, written: written.sort(), removed, ...propose ? { propose } : {} };
+}
+async function completeGlossaryDefinitions(root, run, o = {}) {
+  const g = await loadGlossary(root);
+  const at3 = (o.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+  const sent = new Set(run.request.pack.manifest.sources.map((s) => s.id));
+  const todo = undefinedCodeTerms(g.build.entries).filter((e) => sent.has(e.id));
+  const parsed = parseDefinerOutput(run.output ?? "", todo, {
+    agent: run.request.agent.id,
+    at: at3,
+    runId: run.runId
+  });
+  if (parsed.proposals.length)
+    await writeDefinitionProposals(join3(g.catalogDir, "proposals"), parsed.proposals);
+  const propose = {
+    ...parsed,
+    ...run.state ? { run: toRunSummary(run) } : {},
+    promptSha256: run.request.pack.manifest.promptSha256
+  };
+  const scanned = await scanGlossary(root);
+  return { ...scanned, propose };
+}
+
+// packages/scanner/dist/files.js
+import { readdir as readdir3, readFile as readFile3, rm as rm3 } from "node:fs/promises";
+import { join as join4, relative as relative2, resolve, sep as sep2 } from "node:path";
+var kept = /* @__PURE__ */ new Map();
+var keeping = false;
+function keepCatalogsInMemory(on = true) {
+  keeping = on;
+  if (!on)
+    kept.clear();
+}
+function forgetCatalogs() {
+  kept.clear();
+}
+async function readCatalog(dir, o = {}) {
+  if (!keeping)
+    return readCatalogFiles(dir, o.cacheRoot);
+  const key = resolve(dir);
+  let read = kept.get(key);
+  if (!read) {
+    read = readCatalogFiles(dir, o.cacheRoot);
+    kept.set(key, read);
+    read.catch(() => kept.delete(key));
+  }
+  const r = await read;
+  return { records: structuredClone(r.records), problems: r.problems.map((p) => ({ ...p })) };
+}
+var CATALOG_CACHE_VERSION = `c1@${SCHEMA_VERSION}`;
+async function readCatalogFiles(dir, cacheRoot) {
+  const records = [];
+  const problems = [];
+  const files = [];
+  async function walk(d) {
+    let entries;
+    try {
+      entries = await readdir3(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = join4(d, e.name);
+      if (e.isDirectory())
+        await walk(full);
+      else if (/\.ya?ml$/.test(e.name))
+        files.push(relative2(dir, full).split(sep2).join("/"));
+    }
+  }
+  await walk(dir);
+  for (const p of await readParsedFiles({
+    dir,
+    files,
+    name: "catalog",
+    version: CATALOG_CACHE_VERSION,
+    cacheRoot,
+    parse: (text) => {
+      const r = deserializeRecord(text);
+      return r.ok ? { ok: true, value: r.record } : { ok: false, message: r.issues.map((i) => `${i.path}: ${i.message}`).join("; ") };
+    }
+  })) {
+    if (p.problem === void 0)
+      records.push(p.value);
+    else
+      problems.push({ file: p.rel, message: p.problem });
+  }
+  records.sort((a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind));
+  return { records, problems };
+}
+async function writeCatalog(dir, records) {
+  forgetCatalogs();
+  const wanted = new Map(records.map((r) => [recordPath(r), serializeRecord(r)]));
+  let written = 0;
+  let unchanged = 0;
+  for (const [rel, text] of wanted) {
+    const full = join4(dir, ...rel.split("/"));
+    const current = await readFile3(full, "utf8").catch(() => void 0);
+    if (current === text) {
+      unchanged++;
+      continue;
+    }
+    await writeFileAtomic(full, text);
+    written++;
+  }
+  let removed = 0;
+  const existing = await readCatalogPaths(dir);
+  for (const rel of existing) {
+    if (!wanted.has(rel)) {
+      await rm3(join4(dir, ...rel.split("/")), { force: true });
+      removed++;
+    }
+  }
+  return { written, unchanged, removed };
+}
+async function readCatalogPaths(dir) {
+  const out = [];
+  async function walk(d) {
+    let entries;
+    try {
+      entries = await readdir3(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const full = join4(d, e.name);
+      if (e.isDirectory())
+        await walk(full);
+      else if (/\.ya?ml$/.test(e.name))
+        out.push(relative2(dir, full).split(sep2).join("/"));
+    }
+  }
+  await walk(dir);
+  return out;
+}
+function canonical(v) {
+  return JSON.stringify(v, (_k, x) => x && typeof x === "object" && !Array.isArray(x) ? Object.fromEntries(Object.entries(x).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : x);
+}
+function diffCatalogs(before, after) {
+  const key = (r) => `${r.kind}|${r.id}`;
+  const a = new Map(before.map((r) => [key(r), r]));
+  const b = new Map(after.map((r) => [key(r), r]));
+  const diff = { added: [], removed: [], changed: [], evidenceOnly: [] };
+  for (const [k, r] of b) {
+    const old = a.get(k);
+    if (!old) {
+      diff.added.push({ kind: r.kind, id: r.id });
+      continue;
+    }
+    const fields = [.../* @__PURE__ */ new Set([...Object.keys(old), ...Object.keys(r)])].filter((f) => f !== "evidence" && canonical(old[f]) !== canonical(r[f])).sort();
+    if (fields.length > 0)
+      diff.changed.push({ kind: r.kind, id: r.id, fields });
+    else if (canonical(old.evidence) !== canonical(r.evidence))
+      diff.evidenceOnly.push({ kind: r.kind, id: r.id });
+  }
+  for (const [k, r] of a)
+    if (!b.has(k))
+      diff.removed.push({ kind: r.kind, id: r.id });
+  const sort = (xs) => xs.sort((x, y) => x.kind === y.kind ? x.id.localeCompare(y.id) : x.kind.localeCompare(y.kind));
+  sort(diff.added);
+  sort(diff.removed);
+  sort(diff.changed);
+  sort(diff.evidenceOnly);
+  return diff;
+}
+function diffIsEmpty(d) {
+  return d.added.length + d.removed.length + d.changed.length + d.evidenceOnly.length === 0;
+}
+
+// packages/scanner/dist/merge-input.js
+import { join as join5 } from "node:path";
+function estateRepos(op, only) {
+  return op.profiles.flatMap((p) => (p.repos?.repos ?? []).map((r) => ({ ...r, platform: p.platform }))).filter((r) => !r.archived && (!only || only.includes(r.id)));
+}
+function productionRepos(op, only) {
+  return estateRepos(op, only).filter((r) => !isPrototypeType(r.type));
+}
+function prototypeScanNotes(op, only) {
+  return estateRepos(op, only).filter((r) => isPrototypeType(r.type)).map((r) => `${r.id}: a prototype, so not scanned into the catalog; compare it with the estate: atticus change attach <change> --prototype ${r.id}.`);
+}
+function isPrototypeRepo(op, repo) {
+  return estateRepos(op).some((r) => r.id === repo && isPrototypeType(r.type));
+}
+function estateMergeInput(op, repos, records, modulesOf = (id) => repos.find((r) => r.id === id)?.modules ?? []) {
+  return {
+    records,
+    repos: repos.flatMap((r) => [
+      {
+        id: r.id,
+        type: r.type,
+        ...r.component ? { component: r.component } : {},
+        ...r.system ? { system: r.system } : {},
+        hosts: r.hosts
+      },
+      // A module's hosts join calls to its own component (ADR 0057).
+      ...modulesOf(r.id).filter((m) => m.hosts.length > 0).map((m) => ({
+        id: r.id,
+        type: r.type,
+        component: m.component,
+        ...r.system ? { system: r.system } : {},
+        hosts: m.hosts
+      }))
+    ]),
+    systems: op.profiles.flatMap((p) => p.profile?.systems ?? []),
+    patterns: op.patterns,
+    profilePath: op.profiles[0] ? `org-pack/profiles/${op.profiles[0].platform}/profile.yaml` : void 0
+  };
+}
+function mergeEstate(op, repos, records, modulesOf) {
+  return mergeCatalog(estateMergeInput(op, repos, records, modulesOf));
+}
+function curatedDirOf(root, op) {
+  return join5(root, ...op.sources.layout.catalog.split("/"), "curated");
+}
+
+// packages/scanner/dist/facts-catalog.js
+var TARGETS_STEP = "facts-targets";
+var TARGETS_NONE = "None of these";
+var byKindId = (a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind);
+var URL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+var joinUrl = (base2, path) => `${base2.replace(/\/+$/, "")}${path.startsWith("/") ? path : `/${path}`}`;
+function urlOf(f, facts) {
+  if (f.host)
+    return joinUrl(URL_RE.test(f.host) ? f.host : `http://${f.host}`, f.path);
+  if (f.base) {
+    const cfg = facts.find((x) => x.kind === "config" && x.key === f.base && !!x.value);
+    if (cfg?.value && URL_RE.test(cfg.value))
+      return joinUrl(cfg.value, f.path);
+  }
+  return void 0;
+}
+var HTTP_CALLS = /* @__PURE__ */ new Set(["rest", "soap"]);
+var EVENT_CALLS = /* @__PURE__ */ new Set(["event-topic", "mq-queue"]);
+function needsTarget(f, facts) {
+  return f.kind === "call" && !f.to && !EVENT_CALLS.has(f.callType) && !(HTTP_CALLS.has(f.callType) && urlOf(f, facts));
+}
+function targetQuestionFor(f) {
+  if (f.kind !== "call")
+    return void 0;
+  return {
+    question: callTargetQuestion(f, factIdPart(f.component ?? f.repo)),
+    evidence: [`${f.cite.file}:${f.cite.line}`]
+  };
+}
+var SERVES = {
+  rest: ["rest"],
+  soap: ["soap"],
+  graphql: ["graphql"],
+  grpc: ["grpc"],
+  webhook: ["webhook"],
+  sftp: ["file-drop"]
+};
+function targetQuestionDrafts(facts, records, op, asks) {
+  const repoOf = /* @__PURE__ */ new Map();
+  for (const r of records)
+    if (r.kind === "Component" && r.repo)
+      repoOf.set(r.id, r.repo);
+  const vendors = op.profiles.flatMap((p) => p.profile?.systems ?? []).filter((s) => s.boundary === "vendor").sort((a, b) => a.id.localeCompare(b.id));
+  const out = [];
+  for (const f of [...facts].sort((a, b) => a.id.localeCompare(b.id))) {
+    const ask = asks?.find((a) => a.reason === "ambiguous" && a.call.repo === f.repo && a.call.fact === f.id);
+    if (f.kind !== "call" || !needsTarget(f, facts) && !ask)
+      continue;
+    const q = targetQuestionFor(f);
+    const own = slugify(f.component ?? f.repo).replace(/\./g, "-");
+    const types = new Set(SERVES[f.callType] ?? []);
+    const servers = ask ? [...new Set(ask.candidates.map((c) => c.component))].sort() : [
+      ...new Set(records.filter((r) => r.kind === "Endpoint" && types.has(r.endpointType) && r.component !== own).filter((r) => repoOf.get(r.component) !== f.repo).map((r) => r.component))
+    ].sort();
+    const what = [f.method?.toUpperCase(), f.path].filter(Boolean).join(" ");
+    const draft = {
+      question: q.question,
+      options: [
+        ...servers.map((c) => ({
+          label: c,
+          means: `${c}${repoOf.get(c) ? `, built in ${repoOf.get(c)},` : ""} answers ${what}`,
+          changes: `The call joins ${c} when the facts are next written (atticus verify ${f.repo} --write)`
+        })),
+        ...vendors.map((s) => ({
+          label: s.id,
+          means: `${s.name}, an outside system, answers ${what}`,
+          changes: `The call goes to ${s.name} when the facts are next written`
+        })),
+        {
+          label: TARGETS_NONE,
+          means: "Nothing in the estate or the org pack's systems answers it",
+          changes: "The call stays a loose end, and this isn't asked again"
+        }
+      ],
+      evidence: q.evidence,
+      scope: "repo"
+    };
+    out.push({
+      factId: f.id,
+      id: questionId({
+        step: TARGETS_STEP,
+        repo: f.repo,
+        question: q.question,
+        evidence: q.evidence
+      }),
+      repo: f.repo,
+      draft
+    });
+  }
+  return out;
+}
+function targetsFromAnswers(repo, facts, questions) {
+  const byId = new Map(questions.map((q) => [q.id, q]));
+  const out = {};
+  for (const f of [...facts].sort((a, b) => a.id.localeCompare(b.id))) {
+    if (f.kind !== "call")
+      continue;
+    const q = targetQuestionFor(f);
+    if (!q)
+      continue;
+    const asked = byId.get(questionId({ step: TARGETS_STEP, repo, ...q }));
+    if (!asked || asked.state !== "answered" || !asked.answer)
+      continue;
+    const label2 = asked.answer.option !== void 0 ? asked.options[asked.answer.option - 1]?.label : asked.answer.text;
+    if (!label2 || label2 === TARGETS_NONE)
+      continue;
+    const to = slugify(label2);
+    if (to)
+      out[f.id] = to;
+  }
+  return out;
+}
+function componentRenames(repos, op, taken = []) {
+  const manifests = estateRepos(op);
+  const users = /* @__PURE__ */ new Map();
+  const use = (id, repo) => users.set(id, (users.get(id) ?? /* @__PURE__ */ new Set()).add(repo));
+  for (const { repo, facts } of repos) {
+    const fallback = manifests.find((r) => r.id === repo)?.component;
+    for (const f of facts)
+      if (f.kind !== "field")
+        use(factIdPart(f.component ?? fallback ?? repo), repo);
+  }
+  for (const t of taken)
+    if (users.has(t.id))
+      use(t.id, t.repo);
+  const out = {};
+  for (const [id, set] of [...users].sort((a, b) => a[0].localeCompare(b[0]))) {
+    if (set.size < 2)
+      continue;
+    for (const repo of repos.map((r) => r.repo).filter((r) => set.has(r))) {
+      if (factIdPart(repo) === id)
+        continue;
+      (out[repo] ??= {})[id] = factIdPart(`${repo}-${id}`);
+    }
+  }
+  return out;
+}
+function withComponents(repo, facts, op, renames) {
+  const fallback = estateRepos(op).find((r) => r.id === repo)?.component;
+  const mine = renames?.[repo] ?? {};
+  return facts.map((f) => {
+    const c = f.component ?? fallback;
+    if (!c)
+      return f;
+    const to = mine[factIdPart(c)];
+    return to ? { ...f, component: to } : f.component ? f : { ...f, component: c };
+  });
+}
+function factsRecords(input) {
+  const { repo, op } = input;
+  const manifest = estateRepos(op).find((r) => r.id === repo);
+  const facts = withComponents(repo, input.facts, op, input.renames).map((f) => {
+    let g = f;
+    const to = input.targets?.[g.id];
+    if (g.kind === "call" && !g.to && to)
+      g = { ...g, to };
+    return g;
+  });
+  const projected = projectFacts(facts, manifest?.system ? { system: manifest.system } : {});
+  const factById = new Map(facts.map((f) => [f.id, f]));
+  const loose = /* @__PURE__ */ new Map();
+  const looseFact = /* @__PURE__ */ new Map();
+  const extra = [];
+  for (const [factId, id] of Object.entries(projected.ids)) {
+    const f = factById.get(factId);
+    const rec = projected.records.find((r) => r.id === id && r.kind === "Unresolved");
+    if (f.kind === "call" && rec) {
+      looseFact.set(id, factId);
+      const url = HTTP_CALLS.has(f.callType) ? urlOf(f, facts) : void 0;
+      if (url)
+        loose.set(id, {
+          ...rec,
+          unresolvedKind: "http-call",
+          raw: `${f.method?.toUpperCase() ?? "ANY"} ${url}`
+        });
+      else if (EVENT_CALLS.has(f.callType))
+        loose.set(id, { ...rec, unresolvedKind: "event-publish", raw: f.path });
+    }
+    if (f.kind === "entry" && EVENT_CALLS.has(f.entryType)) {
+      const ep = projected.records.find((r) => r.id === id && r.kind === "Endpoint");
+      extra.push({
+        kind: "Unresolved",
+        schemaVersion: 2,
+        id: `unresolved.${id}`,
+        status: "current",
+        confidence: ep.confidence,
+        unresolvedKind: "event-subscribe",
+        raw: f.path,
+        owner: ep.component,
+        evidence: ep.evidence.map((e) => ({ ...e, side: "callee" }))
+      });
+    }
+  }
+  const newRecords = [
+    ...projected.records.filter((r) => r.kind !== "Flow").map((r) => loose.get(r.id) ?? r),
+    ...extra
+  ];
+  const newFlows = projected.records.filter((r) => r.kind === "Flow");
+  return { facts, projected, factById, newRecords, newFlows, loose, looseFact };
+}
+function outsideSystems(op) {
+  return op.profiles.flatMap((p) => p.profile?.systems ?? []).filter((s) => s.boundary === "vendor").flatMap((s) => [s.id, s.name, ...s.aliases]).sort();
+}
+function joinReposOf(op, list, renames) {
+  const manifests = estateRepos(op);
+  return list.map(({ repo, facts }) => {
+    const m = manifests.find((r) => r.id === repo);
+    const modules = (m?.modules ?? []).filter((x) => x.hosts.length > 0);
+    const component = m?.component ? renames?.[repo]?.[factIdPart(m.component)] ?? m.component : void 0;
+    return {
+      repo,
+      facts: renames?.[repo] ? withComponents(repo, facts, op, renames) : facts,
+      ...component ? { component } : {},
+      ...m?.hosts.length ? { hosts: m.hosts } : {},
+      ...modules.length ? { modules: modules.map((x) => ({ component: x.component, hosts: x.hosts })) } : {},
+      // An API gateway's entries are routes the join follows through (ADR 0124 addendum A-gateway).
+      // A type that says which side it faces (`gateway-external`, `gateway-internal`) marks each
+      // hop through it (A-gateway2); a plain `gateway` leaves that to the proxy's virtual host.
+      ...m && /^gateway(-|$)/.test(m.type) ? { gateway: true } : {},
+      ...m?.type === "gateway-external" ? { facing: "external" } : m?.type === "gateway-internal" ? { facing: "internal" } : {}
+    };
+  });
+}
+function applyFactJoins(records, join10, repos, withCallers) {
+  const calls = /* @__PURE__ */ new Map();
+  for (const j of join10.joins) {
+    const k = `${j.call.repo}|${j.call.at}|${j.call.component}`;
+    if (!calls.has(k))
+      calls.set(k, j.interface);
+  }
+  const ifaces = new Set(join10.joins.map((j) => j.interface));
+  const madeByCall = (r) => {
+    if (r.kind === "Interface" && ifaces.has(r.id))
+      return r.id;
+    if (r.kind !== "Interface" && r.kind !== "Unresolved")
+      return void 0;
+    const owner = r.kind === "Interface" ? r.from : r.owner;
+    for (const e of r.evidence) {
+      if (e.side === "callee")
+        continue;
+      const to = calls.get(`${e.repo}|${e.path}:${e.line}|${owner}`);
+      if (to)
+        return to;
+    }
+    return void 0;
+  };
+  const was = /* @__PURE__ */ new Map();
+  const kept2 = [];
+  for (const r of records) {
+    const to = madeByCall(r);
+    if (to) {
+      if (to !== r.id)
+        was.set(r.id, to);
+    } else if (!(r.kind === "FieldMapping" && ifaces.has(r.interface)))
+      kept2.push(r);
+  }
+  const re = (id) => {
+    for (const [from, to] of was)
+      if (id === from || id.startsWith(`${from}.`))
+        return to + id.slice(from.length);
+    return id;
+  };
+  const joined = joinRecords(join10, repos);
+  const callers = withCallers ? callerRecords(withCallers.callers, repos, withCallers.join, {
+    ...withCallers.only ? { only: withCallers.only } : {},
+    existing: joined
+  }) : [];
+  const filled = new Set(callers.map((r) => `${r.kind}|${r.id}`));
+  return [
+    ...kept2.map((r) => {
+      if (r.kind === "Schema" && re(r.ref) !== r.ref)
+        return { ...r, id: re(r.id), ref: re(r.ref) };
+      if (r.kind === "FieldMapping" && re(r.interface) !== r.interface)
+        return { ...r, id: re(r.id), interface: re(r.interface) };
+      return r;
+    }),
+    ...joined.filter((r) => !filled.has(`${r.kind}|${r.id}`)),
+    ...callers
+  ];
+}
+var entryText = (j) => j.method ? `${j.method} ${j.path}` : j.path;
+function joinAbout(all, repo) {
+  const joins = all.joins.filter((j) => j.call.repo === repo || j.entry.repo === repo || !!j.gateway?.some((h) => h.entry.repo === repo));
+  const ifaces = new Set(joins.map((j) => j.interface));
+  return {
+    joins,
+    asks: all.asks.filter((a) => a.call.repo === repo),
+    misses: all.misses.filter((m) => m.call.repo === repo),
+    lineage: all.lineage.filter((l) => ifaces.has(l.interface)),
+    gaps: all.gaps.filter((g) => ifaces.has(g.interface))
+  };
+}
+function catalogWithFacts(input) {
+  const { repo, op } = input;
+  if (isPrototypeRepo(op, repo))
+    return prototypeLeftOut(input);
+  const others = (input.estate ?? []).filter((x) => x.repo !== repo && !isPrototypeRepo(op, x.repo));
+  const renames = componentRenames([{ repo, facts: input.facts }, ...others], op, input.existing.flatMap((r) => r.kind === "Component" && r.repo && r.repo !== repo ? [{ id: r.id, repo: r.repo }] : []));
+  const { facts, projected, newRecords, newFlows, looseFact } = factsRecords({
+    ...input,
+    renames
+  });
+  const mine = (e) => e.repo === repo;
+  const oldComponents = new Set(input.existing.filter((r) => r.kind === "Component" && r.repo === repo).map((r) => r.id));
+  const dropped = /* @__PURE__ */ new Set();
+  const kept2 = [];
+  const mixed = [];
+  for (const r of input.existing) {
+    if (r.kind === "Flow" || r.kind === "CuratedDecision")
+      continue;
+    const ev = r.evidence;
+    const m = ev.filter(mine).length;
+    if (m === 0)
+      kept2.push(r);
+    else if (m === ev.length || r.flags?.includes(DECLARED_CALLER))
+      dropped.add(`${r.kind}|${r.id}`);
+    else
+      mixed.push(r);
+  }
+  const droppedEndpoint = (id) => typeof id === "string" && dropped.has(`Endpoint|${id}`);
+  for (const r of mixed) {
+    const ev = r.evidence;
+    const out = { ...r, evidence: ev.filter((e) => !mine(e)) };
+    if (r.kind === "Interface") {
+      if (droppedEndpoint(out.endpoint))
+        delete out.endpoint;
+      if (out.confidence === "verified" && ev.some((e) => mine(e) && e.side === "callee"))
+        out.confidence = "inferred";
+    }
+    if (r.kind === "Table") {
+      out.readers = out.readers.filter((c) => !oldComponents.has(c));
+      out.writers = out.writers.filter((c) => !oldComponents.has(c));
+    }
+    kept2.push(out);
+  }
+  const projectedComponents = new Set(newRecords.filter((r) => r.kind === "Component").map((r) => r.id));
+  const profileSystems = new Set(op.profiles.flatMap((p) => p.profile?.systems ?? []).map((x) => x.id));
+  for (let i = kept2.length - 1; i >= 0; i--) {
+    const r = kept2[i];
+    if (r.kind === "Component" && projectedComponents.has(r.id) && r.confidence === "inferred" && !r.repo || input.estate && r.kind === "System" && profileSystems.has(r.id))
+      kept2.splice(i, 1);
+  }
+  const remap = /* @__PURE__ */ new Map();
+  const stepTo = /* @__PURE__ */ new Map();
+  let join10;
+  let records0 = [...kept2, ...newRecords];
+  if (input.estate) {
+    const repos = joinReposOf(op, [{ repo, facts }, ...others], renames);
+    const whole = joinFacts({
+      repos,
+      targets: { ...input.estateTargets, [repo]: input.targets ?? {} },
+      outside: outsideSystems(op)
+    });
+    join10 = joinAbout(whole, repo);
+    records0 = applyFactJoins(records0, join10, repos, {
+      callers: joinCallers({ repos, join: whole, declared: declaredCallsOf(op.profiles) }),
+      join: whole,
+      only: [repo]
+    });
+    for (const j of join10.joins) {
+      const id = j.call.repo === repo ? projected.ids[j.call.fact] : void 0;
+      if (!id || remap.has(id))
+        continue;
+      remap.set(id, j.interface);
+      stepTo.set(id, { component: j.entry.component, entry: entryText(j) });
+    }
+  }
+  const merged0 = mergeEstate(op, estateRepos(op), records0.sort(byKindId));
+  const heard = new Set((join10?.joins ?? []).filter((j) => j.how === "topic").map((j) => `${j.entry.repo}|${j.entry.at}|${j.entry.component}`));
+  const merged = {
+    ...merged0,
+    records: merged0.records.filter((r) => !(r.kind === "Unresolved" && r.unresolvedKind === "event-subscribe" && r.evidence.some((e) => heard.has(`${e.repo}|${e.path}:${e.line}|${r.owner}`))))
+  };
+  const endpoints = merged.records.filter((r) => r.kind === "Endpoint");
+  for (const r of projected.records) {
+    if (r.kind !== "Endpoint")
+      continue;
+    const hit = r.endpointType === "rest" ? endpoints.find((e) => e.endpointType === "rest" && e.component === r.component && (e.method ?? "") === (r.method ?? "") && e.normalizedPath === normalizePath(r.normalizedPath ?? r.pathOrTopic)) : endpoints.find((e) => e.id === r.id) ?? endpoints.find((e) => e.endpointType === r.endpointType && e.pathOrTopic === r.pathOrTopic);
+    if (hit && hit.id !== r.id)
+      remap.set(r.id, hit.id);
+  }
+  const stillLoose = new Set(merged.records.filter((r) => r.kind === "Unresolved").map((r) => r.id));
+  const joinedTo = /* @__PURE__ */ new Map();
+  for (const [id] of looseFact) {
+    if (stillLoose.has(id))
+      continue;
+    const rec = newRecords.find((r) => r.id === id);
+    const at3 = rec.evidence[0];
+    const iface = merged.records.find((r) => r.kind === "Interface" && r.from === rec.owner && r.evidence.some((e) => e.repo === repo && e.path === at3?.path && e.line === at3?.line));
+    if (iface) {
+      remap.set(id, iface.id);
+      joinedTo.set(id, iface.to);
+    }
+  }
+  const re = (id) => {
+    const exact = remap.get(id);
+    if (exact)
+      return exact;
+    for (const [from, to] of remap)
+      if (id.startsWith(`${from}.`))
+        return to + id.slice(from.length);
+    return id;
+  };
+  const records = merged.records.map((r) => {
+    if (r.kind === "Schema")
+      return { ...r, id: re(r.id), ref: re(r.ref) };
+    if (r.kind === "Endpoint" && r.schemaRefs.length)
+      return { ...r, schemaRefs: r.schemaRefs.map(re).sort() };
+    if (r.kind === "FieldMapping")
+      return { ...r, interface: re(r.interface) };
+    return r;
+  });
+  const applied = applyCurated([...records].sort(byKindId), input.decisions);
+  const newIds = new Set(applied.records.filter((r) => r.evidence.some(mine)).map((r) => r.id));
+  const oldIds = new Set([...dropped].map((k) => k.slice(k.indexOf("|") + 1)));
+  const flows = newFlows.map((f) => {
+    const next = {
+      ...f,
+      trigger: { ...f.trigger, ...f.trigger.ref ? { ref: re(f.trigger.ref) } : {} },
+      steps: f.steps.map((s) => {
+        const was = s.to?.component;
+        const direct = s.refs.map((r) => stepTo.get(r)).find((x) => !!x);
+        const to = s.to && direct ? { ...s.to, ...direct } : s.to && was && joinedTo.has(was) ? { ...s.to, component: joinedTo.get(was) } : s.to;
+        return { ...s, refs: s.refs.map(re), ...to ? { to } : {} };
+      })
+    };
+    const p = parseRecord(next);
+    return p.ok ? p.record : next;
+  });
+  const unresolved = [];
+  for (const r of applied.records) {
+    if (r.kind !== "Unresolved" || !looseFact.has(r.id))
+      continue;
+    unresolved.push({
+      factId: looseFact.get(r.id),
+      id: r.id,
+      unresolvedKind: r.unresolvedKind,
+      raw: r.raw
+    });
+  }
+  unresolved.sort((a, b) => a.factId.localeCompare(b.factId));
+  return {
+    records: applied.records.sort(byKindId),
+    flows: flows.sort((a, b) => a.id.localeCompare(b.id)),
+    unresolved,
+    curated: {
+      applied: applied.applied,
+      suppressed: applied.suppressed,
+      problems: applied.problems.filter((p) => newIds.has(p.target) || oldIds.has(p.target))
+    },
+    projectionIssues: projected.issues.filter((i) => i.code !== "unresolved-target"),
+    invalid: merged.invalid,
+    notes: merged.notes,
+    ...join10 ? { join: join10 } : {}
+  };
+}
+function prototypeLeftOut(input) {
+  const { repo } = input;
+  const records = input.existing.filter((r) => {
+    if (r.kind === "Flow" || r.kind === "CuratedDecision")
+      return false;
+    const ev = r.evidence;
+    return !(ev.length && ev.every((e) => e.repo === repo));
+  });
+  return {
+    records: [...records].sort(byKindId),
+    flows: [],
+    unresolved: [],
+    curated: { applied: [], suppressed: [], problems: [] },
+    projectionIssues: [],
+    invalid: [],
+    notes: [
+      `${repo} is a prototype: its facts are kept in facts/${repo}.jsonl and compared with the estate (atticus change attach <change> --prototype ${repo}), never written into the catalog.`
+    ]
+  };
+}
+
+// packages/scanner/dist/facts-scan.js
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+async function factsForScan(root, op, repo, commit, readerRecords, at3 = {}) {
+  const rel = `${factsRelOf(root)}/${repo}.jsonl`;
+  const text = await readFile4(join6(factsDirOf(root), `${repo}.jsonl`), "utf8").catch(() => void 0);
+  if (text === void 0 || text.trim() === "")
+    return {};
+  const parsed = parseFacts(text);
+  if (!parsed.ok)
+    return {
+      note: `${repo}: ${rel} doesn't read as facts (${parsed.issues[0]?.message ?? "invalid"}); its readers' records are used. Run atticus verify ${repo}.`
+    };
+  let facts = parsed.facts;
+  const unverified = facts.filter((f) => f.verified === "none").length;
+  if (unverified)
+    return {
+      note: `${repo}: ${unverified} of its facts aren't verified yet; its readers' records are used. Run atticus verify ${repo}.`
+    };
+  const older = commit ? facts.filter((f) => !sameCommit(f.commit, commit)) : [];
+  let carriedSaid = "";
+  if (older.length) {
+    const diff = at3.dir ? await changesSince(at3.dir, older.map((f) => f.commit), commit, at3.git) : void 0;
+    if (!diff || diff.missing.length)
+      return {
+        note: `${repo}: its facts are of commit ${(diff?.missing[0] ?? older[0].commit).slice(0, 7)}, the checkout is at ${commit.slice(0, 7)}, and the two can't be compared here; its readers' records are used until it is read again (/atticus-map ${repo}, then atticus verify ${repo} --write).`
+      };
+    const report = await verifyFacts({
+      facts,
+      source: dirSource(at3.dir),
+      commit,
+      carry: diff.changes
+    });
+    const from = [...new Set(older.map((f) => f.commit.slice(0, 7)))].join(", ");
+    if (!report.accepted.length)
+      return {
+        note: `${repo}: every one of its facts (of commit ${from}) cites a file changed since, or names a fact that does; its readers' records are used until it is read again (/atticus-map ${repo}, then atticus verify ${repo} --write).`
+      };
+    facts = report.accepted;
+    const left = report.rejected.length;
+    carriedSaid = `; ${report.carried.length} carried from commit ${from} to ${commit.slice(0, 7)} (the files they cite are unchanged, their lines checked again)${left ? `, ${left} left out until read again (they cite a file changed since, or name a fact that does: /atticus-map ${repo}, then atticus verify ${repo} --write)` : ""}`;
+  }
+  const questions = (await listQuestions(root, { repo }).catch(() => ({ questions: [] }))).questions;
+  const targets = targetsFromAnswers(repo, facts, questions);
+  const others = (await estateFacts(root, op, repo)).repos;
+  const renames = componentRenames([{ repo, facts }, ...others], op);
+  const { newRecords, facts: used } = factsRecords({ repo, facts, op, targets, renames });
+  const keyOf = (r) => {
+    const x = r;
+    if (r.kind === "Endpoint")
+      return `${String(x.method ?? "").toUpperCase()} ${normalizePath(String(x.pathOrTopic))}`;
+    if (r.kind === "Interface")
+      return `${String(x.method ?? "").toUpperCase()} ${String(x.normalizedPath)}`;
+    if (r.kind === "Table")
+      return String(x.name).toLowerCase();
+    if (r.kind === "Column")
+      return `${String(x.table).split(".").pop()}.${String(x.name)}`.toLowerCase();
+    if (r.kind === "Setting")
+      return String(x.key);
+    return void 0;
+  };
+  const have = new Set(newRecords.map((r) => `${r.kind}|${keyOf(r)}`));
+  const extra = /* @__PURE__ */ new Map();
+  for (const r of readerRecords) {
+    const k = keyOf(r);
+    if (k === void 0 || have.has(`${r.kind}|${k}`))
+      continue;
+    extra.set(r.kind, (extra.get(r.kind) ?? 0) + 1);
+  }
+  const said = [...extra.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([k, n]) => `${n} ${k}`).join(", ");
+  return {
+    records: newRecords,
+    facts: used,
+    targets,
+    note: `${repo}: read from its facts (${facts.length}, ${rel}${carriedSaid})${said ? `; its readers found ${said} the facts don't have (a cross-check: read those lines again, or a reader misreads them)` : "; its readers agree"}.`
+  };
+}
+async function estateFacts(root, op, except) {
+  const repos = [];
+  const targets = {};
+  const notes = [];
+  for (const r of productionRepos(op)) {
+    if (r.id === except)
+      continue;
+    const text = await readFile4(join6(factsDirOf(root), `${r.id}.jsonl`), "utf8").catch(() => void 0);
+    if (text === void 0 || text.trim() === "")
+      continue;
+    const parsed = parseFacts(text);
+    if (!parsed.ok) {
+      notes.push(`${r.id}: its facts don't read, so the estate join leaves them out.`);
+      continue;
+    }
+    if (parsed.facts.some((f) => f.verified === "none")) {
+      notes.push(`${r.id}: some of its facts aren't verified yet, so the estate join leaves them out (atticus verify ${r.id}).`);
+      continue;
+    }
+    repos.push({ repo: r.id, facts: parsed.facts });
+    const questions = (await listQuestions(root, { repo: r.id }).catch(() => ({ questions: [] }))).questions;
+    const named2 = targetsFromAnswers(r.id, parsed.facts, questions);
+    if (Object.keys(named2).length)
+      targets[r.id] = named2;
+  }
+  return { repos, targets, notes };
+}
+
+// packages/scanner/dist/scan-settings.js
+var NO_SETTINGS = {
+  exclude: [],
+  prefixes: [],
+  clients: [],
+  problems: []
+};
+var HTTP_ENTRY = /* @__PURE__ */ new Set(["rest", "webhook", "websocket", "sse"]);
+async function citedLine(repo, at3) {
+  const i = at3.lastIndexOf(":");
+  const path = at3.slice(0, i);
+  const n = Number(at3.slice(i + 1));
+  const text = await repo.readText(path).catch(() => void 0);
+  if (text === void 0)
+    return void 0;
+  return text.replace(/\r\n?/g, "\n").split("\n")[n - 1];
+}
+var CODE_EXT = new Set("java kt scala groovy ts tsx js jsx mjs cjs py go rb cs fs vb php rs swift m mm c cc cpp h hpp dart ex exs erl clj lua pl".split(" "));
+var NOT_OWN = /(^|\/)(node_modules|\.git|target|bin|obj|dist|build|\.atticus|vendor)\//;
+var CONFIG_EXT = new Set("xml json jsonc yaml yml toml properties gradle cfg ini conf csproj sln props targets".split(" "));
+var CONFIG_NAME = /^(makefile|dockerfile|build\.gradle\.kts|settings\.gradle\.kts|\.[a-z]*ignore|\.editorconfig)$/i;
+var ext = (f) => /\.([^./]+)$/.exec(f)?.[1]?.toLowerCase() ?? "";
+var base = (f) => f.slice(f.lastIndexOf("/") + 1);
+var isCodeFile = (f) => !NOT_OWN.test(f) && CODE_EXT.has(ext(f));
+var isConfigFile = (f) => CONFIG_EXT.has(ext(f)) || CONFIG_NAME.test(base(f));
+function globName(glob) {
+  return glob.split("/").map((s) => s.replace(/[*?[\]{}!]/g, "")).reduce((a, b) => b.length > a.length ? b : a, "");
+}
+function prefixOf(value) {
+  let v = value.trim().replace(/^["'`]|["'`]$/g, "");
+  const dflt = /^\$\{[^:}]+:([^}]*)\}$/.exec(v);
+  if (dflt)
+    v = dflt[1];
+  const url = /^https?:\/\/[^/?#\s]+(\/[^?#\s]*)?/.exec(v);
+  if (url)
+    v = url[1] ?? "";
+  if (/[${}\s?#]/.test(v))
+    return void 0;
+  const p = `/${v.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+  return p === "/" ? void 0 : p;
+}
+var trimSlash = (p) => p.replace(/\/+$/, "") || "/";
+async function checkScanSettings(s, repo) {
+  const out = { exclude: [], prefixes: [], clients: [], problems: [] };
+  const code = [];
+  if (s.exclude.length) {
+    for await (const f of repo.listFiles(["**/*"]))
+      if (isCodeFile(f))
+        code.push(f);
+  }
+  const perTop = /* @__PURE__ */ new Map();
+  for (const f of code)
+    if (f.includes("/"))
+      perTop.set(f.split("/")[0], (perTop.get(f.split("/")[0]) ?? 0) + 1);
+  const most = Math.max(0, ...perTop.values());
+  const tops = [...perTop].filter(([, n]) => n === most && n > 0).map(([d]) => d);
+  const mainRoots = tops.length === 1 ? tops : [];
+  for (const [i, e] of s.exclude.entries()) {
+    const line = await citedLine(repo, e.at);
+    if (line === void 0) {
+      out.problems.push(`exclude.${i}: ${e.at} isn't in the repo, so ${e.path} is still read`);
+      continue;
+    }
+    const re = globToRegExp(e.path);
+    const file = e.at.slice(0, e.at.lastIndexOf(":"));
+    const name = globName(e.path);
+    const names = name !== "" && line.includes(name);
+    if (!re.test(file) && !names) {
+      out.problems.push(`exclude.${i}: ${e.at} isn't in ${e.path} and doesn't name it, so ${e.path} is still read`);
+      continue;
+    }
+    if (!(isConfigFile(file) && names)) {
+      const dropped = code.filter((f) => re.test(f));
+      const root = mainRoots.find((d) => {
+        const under = code.filter((f) => f.startsWith(`${d}/`));
+        return under.length && under.every((f) => re.test(f));
+      });
+      const why = " so it is still read; only a build or config file that leaves it out itself can say so";
+      if (dropped.length * 2 > code.length) {
+        out.problems.push(`exclude.${i}: ${e.path} leaves out ${dropped.length} of the repo's ${code.length} code files,${why}`);
+        continue;
+      }
+      if (root) {
+        out.problems.push(`exclude.${i}: ${e.path} leaves out ${root}/, where most of the repo's code is (${most} of ${code.length} code files),${why}`);
+        continue;
+      }
+    }
+    out.exclude.push(re);
+  }
+  for (const [i, p] of s.prefixes.entries()) {
+    const line = await citedLine(repo, p.at);
+    if (line === void 0)
+      out.problems.push(`prefixes.${i}: ${p.at} isn't in the repo, so the prefix ${p.prefix} isn't applied`);
+    else if (!line.includes(p.value))
+      out.problems.push(`prefixes.${i}: ${p.at} doesn't say ${p.value}, so the prefix ${p.prefix} isn't applied`);
+    else if (prefixOf(p.value) !== trimSlash(p.prefix))
+      out.problems.push(`prefixes.${i}: the prefix ${p.prefix} isn't the value ${p.value} written at ${p.at}, so it isn't applied`);
+    else
+      out.prefixes.push({ paths: p.paths.map(globToRegExp), prefix: p.prefix });
+  }
+  for (const [i, c] of s.clients.entries()) {
+    const line = await citedLine(repo, c.at);
+    const trim = (x) => x.replace(/\/+$/, "");
+    const paths = c.paths.map(globToRegExp);
+    const missing = line === void 0 ? [] : await namesNotIn(repo, paths, c.names);
+    if (line === void 0)
+      out.problems.push(`clients.${i}: ${c.at} isn't in the repo, so the base isn't applied`);
+    else if (!line.includes(c.value))
+      out.problems.push(`clients.${i}: ${c.at} doesn't say ${c.value}, so the base isn't applied`);
+    else if (!trim(c.base).endsWith(trim(c.value)))
+      out.problems.push(`clients.${i}: the base ${c.base} isn't the value ${c.value} written at ${c.at}, so it isn't applied`);
+    else if (missing.length)
+      out.problems.push(`clients.${i}: ${missing.join(", ")} isn't in any file under ${c.paths.join(", ")}, so the base isn't applied`);
+    else {
+      const k = c.at.lastIndexOf(":");
+      out.clients.push({
+        paths,
+        base: c.base,
+        names: c.names,
+        at: { path: c.at.slice(0, k), line: Number(c.at.slice(k + 1)) }
+      });
+    }
+  }
+  return out;
+}
+async function namesNotIn(repo, paths, names) {
+  const left = new Set(names);
+  if (left.size === 0)
+    return [];
+  for await (const f of repo.listFiles(["**/*"])) {
+    if (!paths.some((x) => x.test(f)))
+      continue;
+    const text = await repo.readText(f).catch(() => "");
+    for (const n of [...left])
+      if (text.includes(n))
+        left.delete(n);
+    if (left.size === 0)
+      break;
+  }
+  return [...left];
+}
+function joinBase(base2, rest) {
+  if (rest === "")
+    return base2;
+  if (/^[?#]/.test(rest))
+    return `${base2.replace(/\/+$/, "")}${rest}`;
+  return `${base2.replace(/\/+$/, "")}/${rest.replace(/^\/+/, "")}`;
+}
+function applyClients(records, clients) {
+  if (clients.length === 0)
+    return records;
+  return records.map((r) => {
+    const x = r;
+    if (r.kind !== "Unresolved" || x.unresolvedKind !== "http-call" || !x.raw)
+      return r;
+    const site = r.evidence[0];
+    const file = site?.path;
+    if (!file)
+      return r;
+    const sp = x.raw.indexOf(" ");
+    const method = x.raw.slice(0, sp);
+    const url = x.raw.slice(sp + 1);
+    for (const c of clients) {
+      if (!c.paths.some((p) => p.test(file)))
+        continue;
+      const name = c.names.find((n) => url.startsWith(`\${${n}}`));
+      const resolved = name !== void 0 ? joinBase(c.base, url.slice(name.length + 3)) : url.startsWith("/") && !url.startsWith("//") ? joinBase(c.base, url) : void 0;
+      if (resolved === void 0)
+        continue;
+      return {
+        ...r,
+        raw: `${method} ${resolved}`,
+        evidence: [
+          ...r.evidence,
+          {
+            source: "config",
+            ...site.repo ? { repo: site.repo } : {},
+            path: c.at.path,
+            line: c.at.line,
+            ...site.commit ? { commit: site.commit } : {},
+            ...site.scannedAt ? { scannedAt: site.scannedAt } : {},
+            side: "caller"
+          }
+        ]
+      };
+    }
+    return r;
+  });
+}
+function withExcludes(repo, exclude) {
+  if (exclude.length === 0)
+    return repo;
+  const wrapped = Object.create(repo);
+  Object.defineProperty(wrapped, "listFiles", {
+    value: async function* (globs) {
+      for await (const f of repo.listFiles(globs))
+        if (!exclude.some((x) => x.test(f)))
+          yield f;
+    }
+  });
+  return wrapped;
+}
+var join7 = (prefix, path) => `${prefix.replace(/\/+$/, "")}${path.startsWith("/") ? path : `/${path}`}`.replace(/\/+$/, "") || "/";
+function applyPrefixes(records, prefixes) {
+  if (prefixes.length === 0)
+    return records;
+  return records.map((r) => {
+    if (r.kind !== "Endpoint")
+      return r;
+    const e = r;
+    if (!HTTP_ENTRY.has(e.endpointType))
+      return r;
+    const file = r.evidence[0]?.path;
+    if (!file)
+      return r;
+    const apply = prefixes.filter((p) => p.paths.some((x) => x.test(file))).reverse();
+    if (apply.length === 0)
+      return r;
+    let path = e.pathOrTopic;
+    let normalized = e.normalizedPath;
+    for (const p of apply) {
+      path = join7(p.prefix, path);
+      if (normalized !== void 0)
+        normalized = join7(p.prefix, normalized);
+    }
+    return {
+      ...r,
+      pathOrTopic: path,
+      ...normalized !== void 0 ? { normalizedPath: normalized } : {}
+    };
+  });
+}
+
+// packages/scanner/dist/plugins.js
+var import_yaml2 = __toESM(require_dist(), 1);
+import { readdir as readdir4, readFile as readFile5 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+var TEST_COMMIT = "0".repeat(40);
+var TEST_AT = "2026-01-01T00:00:00Z";
+function canonical2(v) {
+  return JSON.stringify(v, (_k, x) => x && typeof x === "object" && !Array.isArray(x) ? Object.fromEntries(Object.entries(x).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : x);
+}
+function pluginExtractor(manifest, source) {
+  return sandboxedExtractor({
+    id: manifest.id,
+    version: manifest.version,
+    emits: manifest.emits,
+    limits: manifest.limits,
+    source,
+    entry: manifest.entry
+  });
+}
+async function runPluginTests(dir, manifest, source) {
+  const cases = (await readdir4(join8(dir, "test"), { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const extractor = pluginExtractor(manifest, source);
+  const results = [];
+  for (const name of cases) {
+    const failures = [];
+    const caseDir = join8(dir, "test", name);
+    let want;
+    try {
+      const parsed = PluginExpected.safeParse((0, import_yaml2.parse)(await readFile5(join8(caseDir, "expected.yaml"), "utf8")) ?? {});
+      if (!parsed.success) {
+        results.push({
+          name,
+          failures: parsed.error.issues.map((i) => `expected.yaml ${i.path.map(String).join(".")}: ${i.message}`)
+        });
+        continue;
+      }
+      want = parsed.data;
+    } catch (e) {
+      results.push({ name, failures: [`can't read expected.yaml: ${e.message}`] });
+      continue;
+    }
+    const c = want.context;
+    const scan = await scanRepo({
+      repo: fsRepo(name, join8(caseDir, "repo"), TEST_COMMIT),
+      extractors: [extractor],
+      dialects: c?.dialects ?? [],
+      scannedAt: TEST_AT,
+      repoInfo: {
+        ...c?.component ? { component: c.component } : {},
+        ...c?.system ? { system: c.system } : {},
+        ...c?.repoType ? { repoType: c.repoType } : {}
+      }
+    });
+    for (const run of scan.runs.filter((r) => r.status === "failed"))
+      failures.push(run.error ?? "failed");
+    for (const r of scan.rejected)
+      failures.push(`produced an invalid record: ${r.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+    const byId = new Map(scan.records.map((r) => [`${r.kind}/${r.id}`, r]));
+    for (const e of want.expect) {
+      const got = byId.get(`${e.kind}/${e.id}`);
+      if (!got) {
+        failures.push(`expected ${e.kind} ${e.id}, got ${[...byId.keys()].join(", ") || "nothing"}`);
+        continue;
+      }
+      for (const [k, v] of Object.entries(e))
+        if (canonical2(got[k]) !== canonical2(v))
+          failures.push(`${e.id}.${k}: expected ${canonical2(v)}, got ${canonical2(got[k])}`);
+    }
+    if (want.exact) {
+      const listed = new Set(want.expect.map((e) => `${e.kind}/${e.id}`));
+      for (const k of byId.keys())
+        if (!listed.has(k))
+          failures.push(`${k} isn't expected`);
+    }
+    for (const id of want.absent)
+      if (scan.records.some((r) => r.id === id))
+        failures.push(`${id} should not be produced`);
+    results.push({ name, failures });
+  }
+  return results;
+}
+function pluginApplies(manifest, repo) {
+  const a = manifest.appliesTo;
+  return a.repoTypes.includes("*") || a.repoTypes.includes(repo.type) || a.dialects.some((d) => repo.dialects.includes(d));
+}
+async function usablePlugins(op) {
+  const plugins = [];
+  const problems = [];
+  for (const { manifest, dir } of op.plugins) {
+    if (!manifest.enabled)
+      continue;
+    const source = `plugin ${manifest.id}`;
+    const notUsed = (message) => problems.push({ source, message: `${message}; the plugin is not used` });
+    const entry = await readPinnedEntry(dir, manifest);
+    if (!entry.ok) {
+      notUsed(entry.message);
+      continue;
+    }
+    const results = await runPluginTests(dir, manifest, entry.source);
+    if (results.length === 0) {
+      notUsed("has no golden tests (test/<case>/repo/ and expected.yaml)");
+      continue;
+    }
+    const failed = results.flatMap((r) => r.failures.map((f) => `test "${r.name}": ${f}`));
+    if (failed.length > 0) {
+      for (const f of failed)
+        notUsed(f);
+      continue;
+    }
+    plugins.push({
+      manifest,
+      dir,
+      extractor: pluginExtractor(manifest, entry.source),
+      config: configHash({ plugin: `${manifest.sha256}|${JSON.stringify(manifest.limits)}` })
+    });
+  }
+  return { plugins, problems };
+}
+function withPluginScan(scan, extra) {
+  return {
+    ...scan,
+    records: [...scan.records, ...extra.records].sort((a, b) => a.kind === b.kind ? a.id < b.id ? -1 : a.id > b.id ? 1 : 0 : a.kind < b.kind ? -1 : 1),
+    runs: [...scan.runs, ...extra.runs],
+    warnings: [...scan.warnings, ...extra.warnings],
+    rejected: [...scan.rejected, ...extra.rejected]
+  };
+}
+
+// packages/scanner/dist/scan.js
+import { stat } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute, join as join9, resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// packages/scanner/dist/federate-loose.js
+function resolveFederatedLooseEnds(o) {
+  const originOf = (r) => (r.flags ?? []).find((f) => f.startsWith("federated:"))?.slice("federated:".length);
+  const loose = o.federated.filter((r) => r.kind === "Unresolved");
+  if (!loose.length)
+    return { federated: o.federated, resolved: /* @__PURE__ */ new Map() };
+  const fedComponents = o.federated.filter((r) => r.kind === "Component");
+  const result = o.merge([...o.raw, ...fedComponents, ...loose]);
+  const have = new Set(o.local.map((r) => `${r.kind}/${r.id}`));
+  const known = /* @__PURE__ */ new Set([
+    ...o.local.filter((r) => r.kind === "Component" || r.kind === "System").map((r) => r.id),
+    ...fedComponents.map((r) => r.id)
+  ]);
+  const origin = new Map(fedComponents.map((c) => [c.id, originOf(c)]));
+  const stillLoose = new Set(result.records.filter((r) => r.kind === "Unresolved").map((r) => r.id));
+  const added = [];
+  for (const r of result.records) {
+    if (r.kind !== "Interface" || have.has(`Interface/${r.id}`))
+      continue;
+    const i = r;
+    const from = origin.get(i.from) ?? origin.get(i.to);
+    if (!from || !known.has(i.from) || !known.has(i.to))
+      continue;
+    added.push({ ...r, flags: [.../* @__PURE__ */ new Set([...r.flags ?? [], `federated:${from}`])] });
+  }
+  const key = (e) => JSON.stringify(e);
+  const carried = new Set(added.flatMap((i) => i.evidence.map(key)));
+  const resolved = /* @__PURE__ */ new Map();
+  const kept2 = o.federated.filter((r) => {
+    if (r.kind !== "Unresolved" || stillLoose.has(r.id))
+      return true;
+    if (!r.evidence.some((e) => e.source !== "export" && carried.has(key(e))))
+      return true;
+    const id = originOf(r) ?? "";
+    resolved.set(id, (resolved.get(id) ?? 0) + 1);
+    return false;
+  });
+  return {
+    federated: [...kept2, ...added].sort((a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind)),
+    resolved
+  };
+}
+
+// packages/scanner/dist/scan.js
+var STRUCTURED = /\.(ya?ml|json|xml|tf|tfvars|properties|toml|conf|hcl)$/i;
+var TOOLING = /(^|\/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|tsconfig[^/]*\.json|\.eslintrc[^/]*|\.prettierrc[^/]*|renovate\.json|\.vscode\/.*|\.idea\/.*|pom\.xml|catalog-info\.yaml|mkdocs\.yml|codecov\.yml)$/i;
+async function isDir(p) {
+  try {
+    return (await stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function orgPackDirFor(root) {
+  if (!await isDir(join9(root, "org-pack")) && await isDir(join9(root, ".atticus", "org-pack")))
+    return { dir: join9(root, ".atticus", "org-pack"), adopted: true };
+  return { dir: join9(root, "org-pack"), adopted: false };
+}
+function inPlace(root, url) {
+  if (url === "." || url === "./")
+    return root;
+  if (url.startsWith("./") && !url.split("/").includes(".."))
+    return join9(root, url.slice(2));
+  return void 0;
+}
+async function federate(local, sources, problems, root) {
+  const have = new Set(local.map((r) => `${r.kind}/${r.id}`));
+  const records = [];
+  const contributions = [];
+  for (const s of sources) {
+    const theirs = await loadOrgPack((await orgPackDirFor(s.dir)).dir);
+    const catalogRel = `${theirs.sources.layout.catalog}/generated`;
+    const cat = await readCatalog(join9(s.dir, ...catalogRel.split("/")), { cacheRoot: root });
+    for (const p of cat.problems)
+      problems.push({ source: `federated ${s.id}`, message: `${p.file}: ${p.message}` });
+    const c = { id: s.id, added: 0, shadowed: [] };
+    for (const r of cat.records) {
+      const key = `${r.kind}/${r.id}`;
+      if (have.has(key)) {
+        c.shadowed.push(key);
+        continue;
+      }
+      have.add(key);
+      records.push({
+        ...r,
+        flags: [.../* @__PURE__ */ new Set([...r.flags ?? [], `federated:${s.id}`])],
+        evidence: [
+          ...r.evidence,
+          {
+            source: "export",
+            repo: s.id,
+            path: `${catalogRel}/${r.kind.toLowerCase()}/${r.id}.yaml`
+          }
+        ]
+      });
+      c.added++;
+    }
+    contributions.push(c);
+  }
+  return { records, contributions };
+}
+var REMOTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
+var SCP_URL = /^[^/]+@[^:/]+:/;
+async function federationSources(root, stateDir, op) {
+  const out = [];
+  for (const a of op.sources.absorbed) {
+    if (a.format !== "atticus" || a.mode !== "link")
+      continue;
+    const local = a.url.startsWith("file://") ? fileURLToPath(a.url) : REMOTE_URL.test(a.url) || SCP_URL.test(a.url) ? void 0 : isAbsolute(a.url) ? a.url : resolve2(root, a.url);
+    const copy = join9(stateDir, "absorbed", a.id);
+    if (local && await isDir(local) && !await isDir(join9(local, "objects")))
+      out.push({ id: a.id, dir: local });
+    else if (await isDir(copy))
+      out.push({ id: a.id, dir: copy });
+  }
+  return out;
+}
+async function usableDialects(op, orgPackDir, problems, broken = /* @__PURE__ */ new Set()) {
+  const own = new Set(op.dialects.map((d) => d.name));
+  const shipped = (await loadShippedDialects().catch(() => [])).filter((d) => !own.has(d.name));
+  const all = [
+    ...shipped.map((d) => ({ d, dir: SHIPPED_DIALECTS_DIR })),
+    ...op.dialects.map((d) => ({ d, dir: join9(orgPackDir, "dialects") }))
+  ];
+  const byName = new Map(all.map(({ d }) => [d.name, d]));
+  const ok = [];
+  for (const { d, dir } of all) {
+    const failures = await runDialectTests(d, dir, byName).catch((e) => [
+      { test: "(load)", message: e.message }
+    ]);
+    if (failures.length > 0) {
+      for (const f of failures)
+        problems.push({ source: `dialect ${d.name}`, message: `test "${f.test}": ${f.message}` });
+      broken.add(d.name);
+      continue;
+    }
+    ok.push(d);
+  }
+  return ok;
+}
+async function usableFrameworks(op, problems) {
+  const ok = [];
+  for (const m of op.frameworks) {
+    const failures = await runFrameworkTests(m).catch((e) => [
+      { test: "(load)", message: e.message }
+    ]);
+    if (failures.length > 0) {
+      for (const f of failures)
+        problems.push({
+          source: `framework ${m.name}`,
+          message: `test "${f.test}": ${f.message}; the model is not used`
+        });
+      continue;
+    }
+    ok.push(m);
+  }
+  return ok;
+}
+async function modelsReadingNothing(x, models, cache, scannedAt) {
+  const used = models.filter((m) => [...x.imports.modules.keys()].some((mod) => modelCovers(m, mod)));
+  if (used.length === 0)
+    return [];
+  const read = async (with_) => {
+    const s = await scanRepo({
+      repo: x.handle,
+      extractors: [...MODEL_READERS],
+      dialects: x.dialects,
+      scannedAt,
+      dirty: x.dirty,
+      ...cache ? { cache } : {},
+      frameworks: with_,
+      repoInfo: x.repoInfo
+    });
+    return applyPipelineModels(s.records, with_).map((r) => JSON.stringify({ ...r, evidence: void 0 })).sort().join("\n");
+  };
+  const all = await read(models);
+  const out = [];
+  for (const m of used)
+    if (await read(models.filter((o) => o !== m)) === all)
+      out.push(m.name);
+  return out;
+}
+async function scanEstate(o) {
+  const pack = o.orgPack ? void 0 : await orgPackDirFor(o.root);
+  const orgPackDir = o.orgPack ?? pack.dir;
+  const stateDir = pack?.adopted ? join9(o.root, ".atticus") : o.root;
+  const op = await loadOrgPack(orgPackDir);
+  const problems = op.problems.map((p) => ({
+    source: `org-pack/${p.file}`,
+    message: `${p.path ? `${p.path}: ` : ""}${p.message}`
+  }));
+  const brokenDialects = /* @__PURE__ */ new Set();
+  const dialects = await usableDialects(op, orgPackDir, problems, brokenDialects);
+  const frameworks = await usableFrameworks(op, problems);
+  const pluginSet = await usablePlugins(op);
+  problems.push(...pluginSet.problems);
+  const byName = new Map(dialects.map((d) => [d.name, d]));
+  const dialectExtractors = dialects.map((d) => ({ d, x: dialectExtractor(d, byName) }));
+  const cache = o.cache === null ? void 0 : o.cache ?? fsScanCache(join9(stateDir, ".index", "scan-cache"));
+  const scannedAt = o.scannedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const repos = productionRepos(op, o.repos);
+  const results = [];
+  const factNotes = prototypeScanNotes(op, o.repos);
+  const factRepos = [];
+  const structuredOf = /* @__PURE__ */ new Map();
+  const modulesOf = /* @__PURE__ */ new Map();
+  const readers = /* @__PURE__ */ new Map();
+  let done = 0;
+  for (const r of repos) {
+    throwIfCancelled();
+    const dir = o.repoDir?.(r.id) ?? inPlace(o.root, r.url) ?? baseClonePath(o.root, r.id);
+    let state;
+    if (!o.repoState && !await stat(dir).catch(() => void 0)) {
+      problems.push({
+        repo: r.id,
+        source: "workspace",
+        message: "isn't cloned here yet; run atticus workspace sync"
+      });
+      continue;
+    }
+    try {
+      state = o.repoState ? await o.repoState(r.id, dir) : await checkoutState(dir);
+    } catch (e) {
+      problems.push({
+        repo: r.id,
+        source: "workspace",
+        message: `can't read the base clone (${e.message}); run atticus workspace sync`
+      });
+      continue;
+    }
+    const extractors = [
+      ...BUILT_IN_EXTRACTORS,
+      ...o.extractors ?? [],
+      ...dialectExtractors.filter(({ d }) => r.dialects.includes(d.name) || d.appliesTo.repoTypes.includes(r.type) || // "*": any repo where the marker matches (ADR 0062).
+      d.appliesTo.repoTypes.includes("*")).map(({ x }) => x)
+    ];
+    const parsed = createParseCache();
+    const files = fsRepo(r.id, dir, state.commit, { ignore: [...DEFAULT_IGNORES, ".atticus"] });
+    const settingsFor = op.scanSettings.find((s) => s.repo === r.id);
+    const settings = settingsFor ? await checkScanSettings(settingsFor, files) : NO_SETTINGS;
+    for (const message of settings.problems)
+      problems.push({ repo: r.id, source: `org-pack/scan/${r.id}.yaml`, message });
+    const handle = withParseCache(withExcludes(files, settings.exclude), parsed);
+    let scan;
+    try {
+      const modules = r.modules.length ? r.modules : (await detectModules(handle)).map((m) => ({ ...m, hosts: [] }));
+      modulesOf.set(r.id, modules);
+      const structured = [];
+      for await (const f of handle.listFiles(["**/*"]))
+        if (STRUCTURED.test(f) && !TOOLING.test(f))
+          structured.push(f);
+      structuredOf.set(r.id, structured.sort());
+      const repoInfo = {
+        ...modules.length ? { modules: modules.map(({ path, component }) => ({ path, component })) } : {},
+        ...r.component ? { component: r.component } : {},
+        ...r.system ? { system: r.system } : {},
+        repoType: r.type
+      };
+      scan = await scanRepo({
+        repo: handle,
+        extractors,
+        dialects: r.dialects,
+        scannedAt,
+        dirty: state.dirty,
+        ...cache ? { cache } : {},
+        configFor: (x) => {
+          const d = dialectExtractors.find((de) => de.x === x)?.d;
+          return d ? configHash({ dialect: JSON.stringify(d) }) : void 0;
+        },
+        frameworks,
+        repoInfo
+      });
+      const here = pluginSet.plugins.filter((p) => pluginApplies(p.manifest, r));
+      if (here.length > 0)
+        scan = withPluginScan(scan, await scanRepo({
+          repo: handle,
+          extractors: here.map((p) => p.extractor),
+          dialects: r.dialects,
+          scannedAt,
+          dirty: state.dirty,
+          ...cache ? { cache } : {},
+          configFor: (x) => here.find((p) => p.extractor === x)?.config,
+          frameworks,
+          repoInfo
+        }));
+      readers.set(r.id, {
+        handle,
+        repoInfo,
+        dialects: r.dialects,
+        dirty: state.dirty,
+        imports: await repoImports(handle)
+      });
+    } finally {
+      parsed.dispose();
+    }
+    for (const run of scan.runs.filter((x) => x.status === "failed"))
+      problems.push({ repo: r.id, source: run.extractor, message: run.error ?? "failed" });
+    for (const rej of scan.rejected)
+      problems.push({
+        repo: r.id,
+        source: rej.extractor,
+        message: `invalid record: ${rej.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`
+      });
+    const readerRecords = applyClients(applyPrefixes(scan.records, settings.prefixes), settings.clients);
+    const fromFacts = await factsForScan(o.root, op, r.id, state.commit, readerRecords, {
+      dir,
+      ...o.git ? { git: o.git } : {}
+    });
+    if (fromFacts.note)
+      factNotes.push(fromFacts.note);
+    if (fromFacts.facts)
+      factRepos.push({ repo: r.id, facts: fromFacts.facts, targets: fromFacts.targets ?? {} });
+    results.push({ ...scan, records: fromFacts.records ?? readerRecords });
+    o.onProgress?.(++done, repos.length, r.id);
+  }
+  const mergeInput = (records) => estateMergeInput(op, repos, records, (id) => modulesOf.get(id) ?? []);
+  let codeRecords = applyPipelineModels(results.flatMap((s) => s.records), frameworks);
+  if (factRepos.length) {
+    const joinRepos = joinReposOf(op, factRepos);
+    const join10 = joinFacts({
+      repos: joinRepos,
+      targets: Object.fromEntries(factRepos.map((x) => [x.repo, x.targets])),
+      outside: outsideSystems(op)
+    });
+    codeRecords = applyFactJoins(codeRecords, join10, joinRepos, {
+      callers: joinCallers({ repos: joinRepos, join: join10, declared: declaredCallsOf(op.profiles) }),
+      join: join10
+    });
+  }
+  let merged = mergeCatalog(mergeInput(codeRecords));
+  const curatedDir = o.curatedDir ?? curatedDirOf(o.root, op);
+  const curated = await readCatalog(curatedDir, { cacheRoot: o.root });
+  for (const p of curated.problems)
+    problems.push({ source: `catalog/curated/${p.file}`, message: p.message });
+  let inputs;
+  if (o.inputsDir !== null) {
+    inputs = await scanInputs({
+      root: o.root,
+      orgPack: op,
+      inputsDir: o.inputsDir ?? join9(stateDir, "inputs"),
+      records: [...merged.records, ...curated.records],
+      ingestors: listIngestors(),
+      scannedAt
+    });
+    for (const p of inputs.problems)
+      problems.push({ source: "intake", message: `${p.path ? `${p.path}: ` : ""}${p.message}` });
+    if (inputs.records.length > 0)
+      merged = mergeCatalog(mergeInput([...codeRecords, ...inputs.records]));
+  }
+  const found = await featuresForScan({
+    records: merged.records,
+    decisions: curated.records,
+    proposalsDir: join9(dirname3(curatedDir), "proposals")
+  });
+  for (const p of found.problems)
+    problems.push({ source: "features", message: `${p.decision}: ${p.message}` });
+  const fedSources = o.federated ?? await federationSources(o.root, stateDir, op);
+  let federated;
+  let fedRecords = [];
+  if (fedSources.length) {
+    const fed = await federate([...merged.records, ...found.features], fedSources, problems, o.root);
+    const placed = resolveFederatedLooseEnds({
+      local: merged.records,
+      raw: [...codeRecords, ...inputs?.records ?? []],
+      federated: fed.records,
+      merge: (records) => mergeCatalog(mergeInput(records))
+    });
+    fedRecords = placed.federated;
+    federated = fed.contributions.map((c) => placed.resolved.get(c.id) ? { ...c, resolved: placed.resolved.get(c.id) } : c);
+  }
+  const glossary = await glossaryForScan({
+    root: o.root,
+    orgPack: op,
+    records: [...merged.records, ...found.features],
+    decisions: curated.records,
+    proposalsDir: join9(dirname3(curatedDir), "proposals"),
+    orgPackDir
+  });
+  const notes = [...factNotes, ...merged.notes, ...glossary.problems.map((p) => `glossary: ${p}`)];
+  const withFeatures = [...glossary.records, ...fedRecords].sort((a, b) => a.kind === b.kind ? a.id.localeCompare(b.id) : a.kind.localeCompare(b.kind));
+  const applied = applyCurated(withFeatures, curated.records);
+  for (const p of applied.problems)
+    problems.push({ source: "curated", message: JSON.stringify(p) });
+  merged = { ...merged, records: applied.records };
+  for (const i of merged.invalid)
+    problems.push({
+      source: "merge",
+      message: `invalid record: ${i.issues.map((x) => `${x.path}: ${x.message}`).join("; ")}`
+    });
+  const runs = results.flatMap((s) => s.runs);
+  const unmodelled = unmodelledFrameworks([...readers.values()].map((x) => x.imports), op.frameworks);
+  const idleModels = /* @__PURE__ */ new Map();
+  for (const [id, x] of readers)
+    idleModels.set(id, await modelsReadingNothing(x, frameworks, cache, scannedAt));
+  const coverage = repos.filter((r) => results.some((s) => s.repo === r.id)).map((r) => {
+    const own = /* @__PURE__ */ new Set([
+      r.component ?? r.id,
+      ...merged.records.filter((x) => x.kind === "Component" && x.repo === r.id).map((x) => x.id)
+    ]);
+    const scan = results.find((s) => s.repo === r.id);
+    const cited = new Set(scan.records.flatMap((x) => x.evidence.map((e) => e.path ?? "")));
+    const unreadConfig = (structuredOf.get(r.id) ?? []).filter((f) => !cited.has(f));
+    const readSomething = scan.records.some((x) => x.kind !== "Component");
+    return {
+      repo: r.id,
+      joined: merged.records.filter((x) => x.kind === "Interface" && own.has(String(x.from))).length,
+      open: merged.records.filter((x) => x.kind === "Unresolved" && own.has(String(x.owner))).length,
+      unreadFiles: new Set(scan.warnings.filter((w) => /but no call to it was read here/.test(w.message)).map((w) => w.path)).size,
+      unreadConfig,
+      needsOnboarding: !readSomething && unreadConfig.length > 0,
+      redraft: r.dialects.flatMap((name) => {
+        if (brokenDialects.has(name))
+          return [{ dialect: name, why: "tests-fail" }];
+        const run = scan.runs.find((x) => x.extractor === `dialect-${name}`);
+        return run && run.status !== "failed" && run.records === 0 ? [{ dialect: name, why: "reads-nothing" }] : [];
+      }),
+      redraftFrameworks: (idleModels.get(r.id) ?? []).map((framework) => ({
+        framework,
+        why: "reads-nothing"
+      }))
+    };
+  });
+  return {
+    coverage,
+    unmodelled,
+    records: merged.records,
+    repos: results,
+    problems,
+    stats: {
+      repos: results.length,
+      cachedRuns: runs.filter((r) => r.status === "cached").length,
+      ranRuns: runs.filter((r) => r.status === "ran").length,
+      records: merged.records.length,
+      ...merged.stats,
+      // A file several extractors left out is one warning.
+      warnings: new Set(results.flatMap((s) => s.warnings.map((w) => JSON.stringify([s.repo, w.path, w.message])))).size
+    },
+    ...inputs ? { inputs } : {},
+    curated: { applied: applied.applied, suppressed: applied.suppressed },
+    notes,
+    ...federated ? { federated } : {}
+  };
+}
+
+// packages/scanner/dist/repo-types.js
+var import_yaml3 = __toESM(require_dist(), 1);
+var CLEAR_MATCH = 0.7;
+var PARTIAL_MATCH = 0.4;
+var TIE_MARGIN = 0.1;
+var MAX_FILES_PER_SIGNAL = 2e3;
+var MAX_LINE = 2e3;
+var MAX_EVIDENCE = 3;
+var SKIP = /(^|\/)(node_modules|\.git|target|bin|obj|dist|build|\.atticus|vendor)\//;
+var RepoFiles = class {
+  repo;
+  files;
+  lines = /* @__PURE__ */ new Map();
+  constructor(repo) {
+    this.repo = repo;
+  }
+  async all() {
+    if (!this.files) {
+      const out = [];
+      for await (const f of this.repo.listFiles(["**/*"]))
+        if (!SKIP.test(f))
+          out.push(f);
+      this.files = out.sort();
+    }
+    return this.files;
+  }
+  async matching(globs) {
+    const res = globs.map(globToRegExp);
+    return (await this.all()).filter((f) => res.some((re) => re.test(f)));
+  }
+  async linesOf(path) {
+    if (!this.lines.has(path)) {
+      const text = await this.repo.readText(path).catch(() => void 0);
+      this.lines.set(path, text === void 0 ? null : text.replace(/\r\n?/g, "\n").split("\n"));
+    }
+    return this.lines.get(path);
+  }
+  /** The first lines (path:line) in files matching `globs` that pass `test`, up to `max`. */
+  async lineHits(globs, test, max = MAX_EVIDENCE) {
+    const hits = [];
+    for (const f of (await this.matching(globs)).slice(0, MAX_FILES_PER_SIGNAL)) {
+      const lines = await this.linesOf(f);
+      if (!lines)
+        continue;
+      const i = lines.findIndex((l) => l.length <= MAX_LINE && test(l));
+      if (i >= 0)
+        hits.push(`${f}:${i + 1}`);
+      if (hits.length >= max)
+        break;
+    }
+    return hits;
+  }
+};
+var words = (line) => line.split(/[^A-Za-z0-9_.@/-]+/).filter(Boolean);
+var nameTest = (names) => {
+  const tests = names.map((n) => n.endsWith("*") ? (w) => w.startsWith(n.slice(0, -1)) : (w) => w === n);
+  return (line) => words(line).some((w) => tests.some((t) => t(w)));
+};
+function label(s) {
+  switch (s.kind) {
+    case "build-file":
+      return `build file ${s.globs.join(" or ")}`;
+    case "dependency":
+      return `dependency ${s.names.join(" or ")}`;
+    case "marker":
+      return `marker /${s.pattern}/ in ${s.in.join(", ")}`;
+    case "layout":
+      return `files in ${s.globs.join(" or ")}`;
+  }
+}
+async function evidenceFor(s, files) {
+  switch (s.kind) {
+    case "build-file":
+    case "layout":
+      return (await files.matching(s.globs)).slice(0, MAX_EVIDENCE);
+    case "dependency":
+      return files.lineHits(s.in, nameTest(s.names));
+    case "marker": {
+      const re = new RegExp(s.pattern);
+      return files.lineHits(s.in, (l) => re.test(l));
+    }
+  }
+}
+async function scoreType(t, files) {
+  const signals = [];
+  for (const s of t.fingerprint) {
+    const evidence = await evidenceFor(s, files);
+    signals.push({
+      kind: s.kind,
+      label: label(s),
+      weight: s.weight,
+      required: s.required,
+      found: evidence.length > 0,
+      evidence
+    });
+  }
+  const total = signals.reduce((n, s) => n + s.weight, 0);
+  const got = signals.filter((s) => s.found).reduce((n, s) => n + s.weight, 0);
+  return {
+    type: t.id,
+    name: t.name,
+    score: Math.round(got * 100 / total) / 100,
+    got,
+    total,
+    ruledOut: signals.some((s) => s.required && !s.found),
+    signals
+  };
+}
+function typeFromWords(description, types) {
+  const text = (description ?? "").toLowerCase();
+  if (!text)
+    return void 0;
+  const hits = [];
+  for (const t of types)
+    for (const words2 of [t.name.toLowerCase(), t.id.replace(/[-_.]+/g, " ")])
+      if (words2.length > 2 && new RegExp(`(^|[^a-z0-9])${escapeRe(words2)}([^a-z0-9]|$)`).test(text))
+        hits.push({ type: t.id, words: words2 });
+  const ids = new Set(hits.map((h) => h.type));
+  if (ids.size !== 1)
+    return void 0;
+  return [...hits].sort((a, b) => b.words.length - a.words.length)[0];
+}
+async function matchRepoType(repo, types, o = {}) {
+  const files = new RepoFiles(repo);
+  const matches = [];
+  for (const t of types)
+    matches.push(await scoreType(t, files));
+  const pct = (m) => Math.round(m.score * 100);
+  matches.sort((a, b) => Number(a.ruledOut) - Number(b.ruledOut) || pct(b) - pct(a) || a.type.localeCompare(b.type));
+  const said = typeFromWords(o.description, types);
+  const eligible = matches.filter((m) => !m.ruledOut && pct(m) >= PARTIAL_MATCH * 100);
+  const top2 = eligible[0];
+  if (!top2)
+    return { verdict: "none", matches, ...said ? { fromDescription: said } : {} };
+  const tied = eligible.filter((m) => pct(top2) - pct(m) < TIE_MARGIN * 100);
+  if (tied.length > 1) {
+    const ids = tied.map((m) => m.type);
+    return {
+      verdict: "tie",
+      tied: ids,
+      matches,
+      // Only a tie among the types that actually tie is leaned: the description never introduces
+      // a type the fingerprints ruled out or never reached.
+      ...said && ids.includes(said.type) ? { fromDescription: said } : {}
+    };
+  }
+  return {
+    verdict: pct(top2) >= CLEAR_MATCH * 100 ? "clear" : "partial",
+    best: top2.type,
+    matches
+  };
+}
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+async function readRule(rule, path, files) {
+  const lines = await files.linesOf(path);
+  if (!lines)
+    return void 0;
+  if (rule.pattern !== void 0) {
+    const re2 = new RegExp(rule.pattern);
+    for (const [i, l] of lines.entries()) {
+      if (l.length > MAX_LINE)
+        continue;
+      const m = re2.exec(l);
+      if (m)
+        return { value: (m[1] ?? m[0]).trim(), line: i + 1 };
+    }
+    return void 0;
+  }
+  const key = rule.key;
+  if (/\.ya?ml$/i.test(path)) {
+    const counter = new import_yaml3.LineCounter();
+    const text = lines.join("\n");
+    for (const doc of (0, import_yaml3.parseAllDocuments)(text, { lineCounter: counter })) {
+      if (!("getIn" in doc))
+        continue;
+      for (const node of [doc.getIn(key.split("."), true), doc.get(key, true)]) {
+        if ((0, import_yaml3.isScalar)(node) && node.range && node.value !== null && node.value !== void 0)
+          return { value: String(node.value), line: counter.linePos(node.range[0]).line };
+      }
+    }
+    return void 0;
+  }
+  const re = new RegExp(`^\\s*${escapeRe(key)}\\s*[=:]\\s*(.*?)\\s*$`);
+  for (const [i, l] of lines.entries()) {
+    const m = re.exec(l);
+    if (m)
+      return { value: m[1], line: i + 1 };
+  }
+  return void 0;
+}
+function asPrefix(value) {
+  if (/[${}]/.test(value))
+    return void 0;
+  const p = `/${value.trim().replace(/^\/+/, "").replace(/\/+$/, "")}`;
+  return p !== "/" && /^\/[^\s?#]*$/.test(p) ? p : void 0;
+}
+async function resolveSettingsTemplate(t, repo, repoId) {
+  const files = new RepoFiles(repo);
+  const out = {
+    schemaVersion: SCAN_SETTINGS_SCHEMA_VERSION,
+    repo: repoId,
+    exclude: [],
+    prefixes: [],
+    clients: []
+  };
+  for (const e of t.settings.exclude) {
+    const first = (await files.matching([e.path]))[0];
+    if (first)
+      out.exclude.push({ path: e.path, why: e.why, at: `${first}:1` });
+  }
+  for (const rule of t.settings.prefixes) {
+    const candidates = (await files.matching(rule.files)).sort((a, b) => a.length - b.length || a.localeCompare(b));
+    for (const f of candidates) {
+      const hit = await readRule(rule, f, files);
+      if (!hit)
+        continue;
+      const prefix = asPrefix(hit.value);
+      const line = (await files.linesOf(f))?.[hit.line - 1] ?? "";
+      if (prefix && hit.value && line.includes(hit.value))
+        out.prefixes.push({
+          paths: rule.paths,
+          prefix,
+          why: rule.why,
+          at: `${f}:${hit.line}`,
+          value: hit.value
+        });
+      break;
+    }
+  }
+  return out;
+}
+var BUILD_FILES = [
+  ["pom.xml", "pom.xml"],
+  ["build.gradle", "build.gradle"],
+  ["build.gradle.kts", "build.gradle.kts"],
+  ["package.json", "package.json"],
+  ["*.csproj", "*.csproj"],
+  ["pyproject.toml", "pyproject.toml"],
+  ["requirements.txt", "requirements.txt"],
+  ["go.mod", "go.mod"],
+  ["Cargo.toml", "Cargo.toml"],
+  ["Gemfile", "Gemfile"],
+  ["composer.json", "composer.json"]
+].map(([name, glob]) => ({ name, glob, re: globToRegExp(`**/${glob}`) }));
+var PACKAGE_NAME = /^[A-Za-z0-9_.@/-]+$/;
+function declaredDependencies(path, text) {
+  const out = [];
+  const all = (re, g = 1) => {
+    for (const m of text.matchAll(re))
+      if (m[g])
+        out.push(m[g].trim());
+  };
+  if (path.endsWith("pom.xml")) {
+    for (const block2 of text.matchAll(/<(parent|dependency|plugin)>([\s\S]*?)<\/\1>/g)) {
+      const a = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/.exec(block2[2]);
+      if (a)
+        out.push(a[1]);
+    }
+  } else if (/build\.gradle(\.kts)?$/.test(path)) {
+    all(/['"]([\w.-]+):([\w.-]+)(?::[^'"]*)?['"]/g, 2);
+  } else if (path.endsWith("package.json")) {
+    try {
+      const j = JSON.parse(text);
+      const deps = Object.keys(j.dependencies ?? {});
+      out.push(...deps.length ? deps : Object.keys(j.devDependencies ?? {}));
+    } catch {
+    }
+  } else if (path.endsWith(".csproj")) {
+    all(/<PackageReference\s+Include="([^"]+)"/g);
+  } else if (path.endsWith("requirements.txt")) {
+    all(/^\s*([A-Za-z0-9_.-]+)/gm);
+  } else if (path.endsWith("go.mod")) {
+    all(/^\s*(?:require\s+)?([\w.-]+\.[\w.-]+\/[\w./-]+)\s+v/gm);
+  }
+  return out;
+}
+var PLAIN_ANNOTATIONS = /* @__PURE__ */ new Set([
+  "Override",
+  "Deprecated",
+  "SuppressWarnings",
+  "FunctionalInterface",
+  "SafeVarargs",
+  "Test",
+  "JvmStatic"
+]);
+function top(counts, n) {
+  return [...counts].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, n).map(([k]) => k);
+}
+var TEST_FILE = /(^|\/)(test|tests|__tests__|src\/test)\/|\.(spec|test)\.[jt]sx?$|Tests?\.(java|kt|cs)$/;
+async function draftMarkers(files) {
+  const out = [];
+  const source = async (globs) => (await files.matching(globs)).filter((f) => !TEST_FILE.test(f)).slice(0, MAX_FILES_PER_SIGNAL);
+  const marker = (pattern, globs) => ({
+    kind: "marker",
+    pattern,
+    in: globs,
+    weight: 2,
+    required: false
+  });
+  for (const [globs, re] of [
+    [["**/*.java"], /^\s*@([A-Z][A-Za-z0-9_]*)/],
+    [["**/*.kt"], /^\s*@([A-Z][A-Za-z0-9_]*)/],
+    [["**/*.cs"], /^\s*\[([A-Z][A-Za-z0-9_]*)[(\]]/]
+  ]) {
+    const counts2 = /* @__PURE__ */ new Map();
+    for (const f of await source(globs)) {
+      const lines = await files.linesOf(f) ?? [];
+      const seen = /* @__PURE__ */ new Set();
+      lines.forEach((l, i) => {
+        const m = re.exec(l);
+        if (!m || PLAIN_ANNOTATIONS.has(m[1]))
+          return;
+        const next = lines.slice(i + 1, i + 20).find((x) => x.trim() !== "" && !re.test(x)) ?? "";
+        if (/\b(class|interface|record|enum|object)\b/.test(next))
+          seen.add(m[1]);
+      });
+      for (const s of seen)
+        counts2.set(s, (counts2.get(s) ?? 0) + 1);
+    }
+    for (const name of top(counts2, 3))
+      out.push(marker(globs[0] === "**/*.cs" ? `\\[${name}\\b` : `@${name}\\b`, [...globs]));
+  }
+  const js = ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"];
+  const counts = /* @__PURE__ */ new Map();
+  for (const f of await source(js)) {
+    if (f.endsWith(".d.ts"))
+      continue;
+    const seen = /* @__PURE__ */ new Set();
+    for (const l of await files.linesOf(f) ?? []) {
+      const m = /\bfrom\s+["']([^"'./][^"']*)["']/.exec(l);
+      if (!m)
+        continue;
+      const parts = m[1].split("/");
+      const pkg = m[1].startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+      if (!pkg.startsWith("node:"))
+        seen.add(pkg);
+    }
+    for (const s of seen)
+      counts.set(s, (counts.get(s) ?? 0) + 1);
+  }
+  for (const pkg of top(counts, 3))
+    out.push(marker(`from ["']${escapeRe(pkg)}(/[^"']*)?["']`, js));
+  return out;
+}
+var LAYOUTS = [
+  "src/main/java/**",
+  "src/main/kotlin/**",
+  "src/main/resources/**",
+  "src/app/**",
+  "app/**",
+  "src/**",
+  "lib/**",
+  "cmd/**",
+  "internal/**",
+  "public/**"
+];
+async function draftRepoType(repo, id) {
+  const files = new RepoFiles(repo);
+  const all = await files.all();
+  const fingerprint = [];
+  const builds = all.filter((f) => BUILD_FILES.some((b) => b.re.test(f))).slice(0, 20);
+  const buildGlobs = [];
+  for (const b of BUILD_FILES) {
+    const hits = builds.filter((f) => b.re.test(f));
+    if (hits.length === 0)
+      continue;
+    buildGlobs.push(hits.some((f) => !f.includes("/")) ? b.glob : `**/${b.glob}`);
+  }
+  if (buildGlobs.length)
+    fingerprint.push({ kind: "build-file", globs: buildGlobs, weight: 2, required: true });
+  const deps = /* @__PURE__ */ new Map();
+  for (const f of builds) {
+    const text = (await files.linesOf(f) ?? []).join("\n");
+    const glob = buildGlobs.find((g) => globToRegExp(g).test(f));
+    for (const d of declaredDependencies(f, text)) {
+      if (!PACKAGE_NAME.test(d) || d === repo.name)
+        continue;
+      if (!deps.has(d))
+        deps.set(d, /* @__PURE__ */ new Set());
+      if (glob)
+        deps.get(d).add(glob);
+    }
+  }
+  for (const [name, globs] of [...deps].slice(0, 6))
+    fingerprint.push({
+      kind: "dependency",
+      names: [name],
+      in: globs.size ? [...globs] : [...buildGlobs],
+      weight: 2,
+      required: false
+    });
+  fingerprint.push(...await draftMarkers(files));
+  const layouts = [];
+  for (const g of LAYOUTS) {
+    if (layouts.length >= 3)
+      break;
+    if (g === "src/**" && layouts.some((l) => l.startsWith("src/")))
+      continue;
+    if ((await files.matching([g])).length)
+      layouts.push(g);
+  }
+  for (const g of layouts)
+    fingerprint.push({ kind: "layout", globs: [g], weight: 1, required: false });
+  if (fingerprint.length === 0)
+    return void 0;
+  const prefixes = [];
+  for (const c of PREFIX_CONVENTIONS) {
+    const seen = c.lineIncludes ? (await files.lineHits(c.files, (l) => l.includes(c.lineIncludes), 1)).length > 0 : (await files.matching(c.files)).length > 0;
+    if (!seen)
+      continue;
+    const src = c.paths.filter((g) => layouts.includes(g));
+    prefixes.push({
+      ...c.rule.key ? { key: c.rule.key } : {},
+      ...c.rule.pattern ? { pattern: c.rule.pattern } : {},
+      files: c.files,
+      paths: src.length ? src : ["**"],
+      why: c.rule.why
+    });
+  }
+  return {
+    schemaVersion: REPO_TYPE_SCHEMA_VERSION,
+    id,
+    name: id,
+    description: `Drafted from ${repo.name} by atticus repo-type new. Say what kind of repo this is, and keep only the signals every repo of the kind has.`,
+    fingerprint,
+    settings: { exclude: [], prefixes },
+    skills: []
+  };
+}
+
+// packages/scanner/dist/spec-check.js
+var at = (e) => e?.path ? `${e.path}${e.line !== void 0 ? `:${e.line}` : ""}` : void 0;
+function repoComponents(records, repoId) {
+  return new Set(records.filter((r) => r.kind === "Component" && (r.repo === repoId || r.evidence.some((e) => e.repo === repoId))).map((r) => r.id));
+}
+var pathSegs = (p) => normalizePath(p).toLowerCase().split("/").filter(Boolean);
+function pathScore(called, served) {
+  if (!called.includes("/") || !served.includes("/"))
+    return called.trim().toLowerCase() === served.trim().toLowerCase() ? 1e3 : 0;
+  const a = pathSegs(called);
+  const b = pathSegs(served);
+  if (a.join("/") === b.join("/"))
+    return 1e3;
+  const [short, long] = a.length <= b.length ? [a, b] : [b, a];
+  if (short.length === 0 || !short.some((s) => s !== "{}"))
+    return 0;
+  const tail = long.slice(long.length - short.length);
+  return tail.join("/") === short.join("/") ? short.length : 0;
+}
+var resourceKey = (path) => {
+  let p = normalizePath(path).toLowerCase();
+  while (p.endsWith("/{}"))
+    p = p.slice(0, -3);
+  return p || "/";
+};
+var endpointLabel = (e) => `${e.method ? `${e.method.toUpperCase()} ` : ""}${e.pathOrTopic}`;
+var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var work = (e) => !e.method || e.method.toUpperCase() === "ANY" ? void 0 : READ_METHODS.has(e.method.toUpperCase()) ? "read" : "write";
+function familyMismatches(f, byId, template) {
+  const out = [];
+  const trig = f.trigger.ref ? byId.get(f.trigger.ref) : void 0;
+  const key = trig?.kind === "Endpoint" ? resourceKey(trig.pathOrTopic) : void 0;
+  for (const m of f.family) {
+    const r = byId.get(m);
+    if (!r)
+      continue;
+    if (!template.families.length)
+      out.push({
+        member: m,
+        message: `${f.id} stands for ${m}, but the template ${template.repoType}@${template.version} has no families`
+      });
+    else if (r.kind !== "Endpoint" || trig?.kind !== "Endpoint" || r.component !== trig.component || resourceKey(r.pathOrTopic) !== key)
+      out.push({
+        member: m,
+        message: `${f.id} stands for ${m}, which isn't on the same resource (${key ?? "its trigger has no path"}) of the same component`
+      });
+    else if (work(r) && work(trig) && work(r) !== work(trig))
+      out.push({
+        member: m,
+        message: `${f.id} stands for ${m} (${endpointLabel(r)}), a ${work(r)}, but its trigger ${trig.id} (${endpointLabel(trig)}) is a ${work(trig)}`
+      });
+  }
+  return out;
+}
+function specTriggers(records, repoId, template) {
+  const comps = repoComponents(records, repoId);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const t of template.triggers) {
+    if (!t.from)
+      continue;
+    for (const r of records) {
+      if (seen.has(r.id))
+        continue;
+      const from = t.from;
+      if (from.kind === "Endpoint" && r.kind === "Endpoint" && comps.has(r.component) && from.endpointType.includes(r.endpointType)) {
+        seen.add(r.id);
+        out.push({
+          id: r.id,
+          kind: t.kind,
+          label: endpointLabel(r),
+          ...at(r.evidence[0]) ? { evidence: at(r.evidence[0]) } : {}
+        });
+      } else if (from.kind === "Interface" && r.kind === "Interface" && comps.has(r.to) && from.via.includes(r.via) && from.direction.includes(r.direction)) {
+        seen.add(r.id);
+        out.push({
+          id: r.id,
+          kind: t.kind,
+          label: `${r.method ? `${r.method} ` : ""}${r.normalizedPath}`,
+          ...at(r.evidence[0]) ? { evidence: at(r.evidence[0]) } : {}
+        });
+      }
+    }
+  }
+  return out.sort((a, b) => a.id.localeCompare(b.id));
+}
+var methodPath = (s) => {
+  const m = /^([A-Za-z]+)\s+(\S+)$/.exec(s.trim());
+  return m ? { method: m[1].toUpperCase(), path: m[2] } : void 0;
+};
+var OUT_STEPS = /* @__PURE__ */ new Set(["call-out", "publish"]);
+var lineNamesUiWord = (line, words2) => {
+  const l = line.toLowerCase();
+  return words2.some((w) => {
+    const word = w.toLowerCase();
+    for (let k = l.indexOf(word); k >= 0; k = l.indexOf(word, k + 1))
+      if (k === 0 || !/[a-z]/.test(line[k - 1]) || /[A-Z]/.test(line[k]))
+        return true;
+    return false;
+  });
+};
+var namesAny = lineNamesUiWord;
+function uiFindings(f, triggerLines, stepLines, template) {
+  const kind = f.trigger.kind;
+  if (kind !== "action" && kind !== "page")
+    return [];
+  const out = [];
+  const ui = template.ui;
+  const fileOf = (e) => e.map((x) => x.path).filter((p) => !!p);
+  const calls = f.steps.flatMap((s, i) => OUT_STEPS.has(s.kind) ? [i] : []);
+  const callFiles = new Set(calls.flatMap((i) => fileOf(f.steps[i].evidence)));
+  const startWords = kind === "action" ? ui.actionWords : [...ui.pageWords, ...ui.actionWords];
+  const trigAt = at(f.trigger.evidence[0]);
+  const atCall = fileOf(f.trigger.evidence).some((p) => callFiles.has(p));
+  const opensWithEntry = f.steps[0]?.kind === "entry";
+  if (!triggerLines.some((l) => namesAny(l, startWords)) && (atCall || opensWithEntry))
+    out.push({
+      rule: "ui-start-not-action",
+      target: `${f.id} trigger`,
+      ...trigAt ? { evidence: trigAt } : {},
+      message: kind === "action" ? `${f.id} starts at ${trigAt ?? "its trigger"}, ${atCall ? "where the call to the server is made" : "with an entry"}, not at the person's action: start it at the button or form in the component or template, with a validate step for the form's own checks and a transform where the form's value becomes what is sent` : `${f.id} starts at ${trigAt ?? "its trigger"}, ${atCall ? "where the call to the server is made" : "with an entry"}, not where the page loads: start it at the page's route or load hook`
+    });
+  const last = calls.at(-1);
+  if (last !== void 0) {
+    const after = f.steps.slice(last + 1);
+    const ends = after.some((s, k) => fileOf(s.evidence).some((p) => !callFiles.has(p)) || (stepLines[last + 1 + k] ?? []).some((l) => namesAny(l, ui.endWords)));
+    if (!ends)
+      out.push({
+        rule: "ui-end-missing",
+        target: `${f.id} end`,
+        ...at(f.steps[last].evidence[0]) ? { evidence: at(f.steps[last].evidence[0]) } : {},
+        message: `${f.id} ends at the call in step ${last + 1}${after.length ? " and what goes back from it" : ""}, not at what the screen does after the response: add a last step citing the line that navigates, refreshes, shows the result or shows an error`
+      });
+  }
+  return out;
+}
+async function checkSpec(o) {
+  const byId = new Map(o.records.map((r) => [r.id, r]));
+  const comps = repoComponents(o.records, o.repoId);
+  const endpoints = o.records.filter((r) => r.kind === "Endpoint");
+  const interfaces = o.records.filter((r) => r.kind === "Interface");
+  const columnsOf = /* @__PURE__ */ new Map();
+  for (const r of o.records)
+    if (r.kind === "Column") {
+      const s = columnsOf.get(r.table) ?? /* @__PURE__ */ new Set();
+      s.add(r.name.toLowerCase());
+      columnsOf.set(r.table, s);
+    }
+  const findings = [];
+  const add = (f) => {
+    const fingerprint = specFindingFingerprint(f.rule, f.target, f.evidence ?? "");
+    if (!findings.some((x) => x.fingerprint === fingerprint))
+      findings.push({ ...f, fingerprint });
+  };
+  const texts = /* @__PURE__ */ new Map();
+  const linesOf = async (path) => {
+    if (!texts.has(path)) {
+      const t = await o.repo.readText(path).catch(() => void 0);
+      texts.set(path, t === void 0 ? null : t.replace(/\r\n?/g, "\n").replace(/\n$/, "").split("\n"));
+    }
+    return texts.get(path);
+  };
+  const cited = async (ev, flow, where) => {
+    const out = [];
+    for (const e of ev) {
+      const a = at(e);
+      if (!e.path || e.line === void 0) {
+        add({
+          rule: "line-missing",
+          target: `${flow} ${where}`,
+          ...a ? { evidence: a } : {},
+          message: `${flow} ${where} cites ${a ?? "nothing"}, not a file and line`,
+          flow
+        });
+        continue;
+      }
+      const lines = await linesOf(e.path);
+      if (!lines)
+        add({
+          rule: "line-missing",
+          target: `${flow} ${where}`,
+          evidence: a,
+          message: `${flow} ${where} cites ${a}: ${e.path} isn't in the repo`,
+          flow
+        });
+      else if (e.line < 1 || e.line > lines.length)
+        add({
+          rule: "line-missing",
+          target: `${flow} ${where}`,
+          evidence: a,
+          message: `${flow} ${where} cites ${a}: ${e.path} has ${lines.length} lines`,
+          flow
+        });
+      else
+        out.push(lines[e.line - 1]);
+    }
+    return out;
+  };
+  const known = (id, flow, where, ev) => {
+    if (byId.has(id))
+      return true;
+    add({
+      rule: "ref-unknown",
+      target: `${flow} ${where} ${id}`,
+      ...ev ? { evidence: ev } : {},
+      message: `${flow} ${where} names ${id}, which isn't in the catalog`,
+      flow
+    });
+    return false;
+  };
+  const requires = new Map(o.template.steps.map((s) => [s.kind, s.requires]));
+  const has = (s, req) => {
+    switch (req) {
+      case "to":
+        return !!s.to;
+      case "store.table":
+        return !!s.store?.table;
+      case "store.columns":
+        return (s.store?.columns.length ?? 0) > 0;
+      case "repeats":
+        return !!s.repeats;
+      default: {
+        const k = req.slice(5);
+        return (s.data?.[k]?.length ?? 0) > 0;
+      }
+    }
+  };
+  const target = (component, entry) => {
+    const rec = byId.get(entry);
+    if (rec?.kind === "Endpoint")
+      return { path: rec.pathOrTopic, found: true };
+    if (rec?.kind === "Interface")
+      return { path: rec.normalizedPath, found: true };
+    const mp = methodPath(entry);
+    const path = mp?.path ?? entry.trim();
+    const norm = normalizePath(path).toLowerCase();
+    const sameMethod2 = (m) => !mp || !m || m.toUpperCase() === mp.method;
+    const found = endpoints.some((e) => e.component === component && sameMethod2(e.method) && pathScore(path, e.normalizedPath ?? e.pathOrTopic) > 0) || interfaces.some((i) => comps.has(i.from) && i.to === component && sameMethod2(i.method) && normalizePath(i.normalizedPath).toLowerCase() === norm);
+    return { path, found };
+  };
+  let confirmed = 0;
+  let unconfirmable = 0;
+  const flows = [];
+  for (const f of o.flows) {
+    const fid = f.id;
+    const trigLines = await cited(f.trigger.evidence, fid, "trigger");
+    const trig = f.trigger.ref ? byId.get(f.trigger.ref) : void 0;
+    if (f.trigger.ref)
+      known(f.trigger.ref, fid, "trigger", at(f.trigger.evidence[0]));
+    const caller = f.trigger.caller;
+    if (caller) {
+      await cited(caller.evidence, fid, "caller");
+      if (caller.ref)
+        known(caller.ref, fid, "caller", at(caller.evidence[0]));
+    } else if (f.trigger.kind === "endpoint" || f.trigger.kind === "listener") {
+      const cites = f.trigger.evidence.map(at).filter((x) => !!x);
+      const asked = (o.questions ?? []).some((q) => q.evidence.some((e) => cites.includes(e)));
+      const label2 = trig?.kind === "Endpoint" ? endpointLabel(trig) : "its trigger";
+      const inbound = trig?.kind === "Endpoint" ? interfaces.filter((i) => i.endpoint === trig.id || i.to === trig.component && (!i.method || !trig.method || i.method.toUpperCase() === trig.method.toUpperCase()) && pathScore(i.normalizedPath, trig.normalizedPath ?? trig.pathOrTopic) === 1e3) : [];
+      const callers = [...new Set(inbound.map((i) => `${i.from} (${i.id}, ${i.via})`))];
+      if (callers.length)
+        add({
+          rule: "caller-unknown",
+          target: `${fid} trigger caller`,
+          ...cites[0] ? { evidence: cites[0] } : {},
+          message: `${fid}: trigger.caller is missing, and the catalog has ${callers.join(", ")} calling ${label2}: name the caller and its route in, in trigger.caller`,
+          flow: fid,
+          callers
+        });
+      else if (!asked)
+        add({
+          rule: "caller-unknown",
+          target: `${fid} trigger caller`,
+          ...cites[0] ? { evidence: cites[0] } : {},
+          message: `${fid}: nothing says who calls ${label2} or how the call arrives (through a gateway, or direct); name them in trigger.caller where the code or config says so, else ask a person`,
+          flow: fid
+        });
+    }
+    if (!comps.has(f.component) && comps.size > 0)
+      known(f.component, fid, "component", at(f.trigger.evidence[0]));
+    for (const m of f.family)
+      known(m, fid, "family", at(f.trigger.evidence[0]));
+    for (const m of familyMismatches(f, byId, o.template))
+      add({
+        rule: "family-mismatch",
+        target: `${fid} family ${m.member}`,
+        message: m.message,
+        flow: fid
+      });
+    for (const [i, e] of f.errors.entries())
+      await cited(e.evidence, fid, `error ${i + 1}`);
+    const seenFields = new Set(f.trigger.what.split(/[^A-Za-z0-9_]+/).filter(Boolean).map(fieldKey));
+    if (trig?.kind === "Endpoint")
+      for (const m of trig.pathOrTopic.matchAll(/[{:<]\$?\{?([A-Za-z_]\w*)/g))
+        seenFields.add(fieldKey(m[1]));
+    const steps = [];
+    const stepLines = [];
+    for (const [i, s] of f.steps.entries()) {
+      const where = `step ${i + 1} (${s.kind})`;
+      const ev = at(s.evidence[0]);
+      const lines = await cited(s.evidence, fid, where);
+      stepLines.push(lines);
+      for (const r of s.refs)
+        known(r, fid, where, ev);
+      for (const req of requires.get(s.kind) ?? [])
+        if (!has(s, req))
+          add({
+            rule: "template-requires",
+            target: `${fid} ${where} ${req}`,
+            ...ev ? { evidence: ev } : {},
+            message: `${fid} ${where}: the template ${o.template.repoType}@${o.template.version} asks a ${s.kind} for ${req}`,
+            flow: fid
+          });
+      let route;
+      if (s.to) {
+        const comp = byId.get(s.to.component);
+        if (!comp || comp.kind !== "Component")
+          add({
+            rule: "call-out-target",
+            target: `${fid} ${where} ${s.to.component}`,
+            ...ev ? { evidence: ev } : {},
+            message: `${fid} ${where} goes to ${s.to.component}, which isn't a component in the catalog`,
+            flow: fid
+          });
+        const t = target(s.to.component, s.to.entry);
+        route = t.path;
+        if (comp?.kind === "Component" && !t.found)
+          add({
+            rule: "call-out-target",
+            target: `${fid} ${where} ${s.to.entry}`,
+            ...ev ? { evidence: ev } : {},
+            message: `${fid} ${where} goes to ${s.to.entry} on ${s.to.component}, which the catalog has no entry point or interface for`,
+            flow: fid
+          });
+      }
+      let table;
+      if (s.store) {
+        if (known(s.store.table, fid, where, ev)) {
+          const r = byId.get(s.store.table);
+          if (r.kind === "Table")
+            table = r;
+          else
+            add({
+              rule: "write-store",
+              target: `${fid} ${where} ${s.store.table}`,
+              ...ev ? { evidence: ev } : {},
+              message: `${fid} ${where} stores in ${s.store.table}, which is a ${r.kind}, not a Table`,
+              flow: fid
+            });
+        }
+        const cols = table ? columnsOf.get(table.id) : void 0;
+        if (cols) {
+          for (const c of s.store.columns)
+            if (!cols.has(c.toLowerCase()))
+              add({
+                rule: "column-unknown",
+                target: `${fid} ${where} ${s.store.table}.${c}`,
+                ...ev ? { evidence: ev } : {},
+                message: `${fid} ${where} names the column ${c}, which ${table.name} doesn't have in the catalog`,
+                flow: fid
+              });
+        }
+      }
+      if (s.kind === "write" && (!s.store || s.store.columns.length === 0))
+        add({
+          rule: "write-store",
+          target: `${fid} ${where}`,
+          ...ev ? { evidence: ev } : {},
+          message: `${fid} ${where} is a write that names no ${s.store ? "columns" : "table and columns"}`,
+          flow: fid
+        });
+      if (s.kind === "write" && s.store && s.store.columns.length) {
+        const cols = s.store.columns;
+        const colKeys = new Set(cols.map(fieldKey));
+        const from = s.data?.from ?? [];
+        const to = s.data?.to ?? [];
+        const list = cols.join(", ");
+        from.forEach((x, k) => {
+          const c = to[k];
+          if (c !== void 0 && !cols.some((y) => y.toLowerCase() === c.toLowerCase()))
+            add({
+              rule: "write-unmapped",
+              target: `${fid} ${where} ${x}`,
+              ...ev ? { evidence: ev } : {},
+              message: `${fid} ${where} maps ${x} to ${c}, which isn't one of its columns (${list})`,
+              flow: fid
+            });
+        });
+        const mapped = new Set(from.filter((_, k) => to[k] !== void 0).map(fieldKey));
+        for (const x of s.data?.sends ?? [])
+          if (!colKeys.has(fieldKey(x)) && !mapped.has(fieldKey(x)))
+            add({
+              rule: "write-unmapped",
+              target: `${fid} ${where} ${x}`,
+              ...ev ? { evidence: ev } : {},
+              message: `${fid} ${where} sends ${x}, which none of its columns (${list}) takes; map it to a column with data.from and data.to, or leave it out`,
+              flow: fid
+            });
+      }
+      if (i > 0) {
+        for (const x of [...s.data?.sends ?? [], ...s.data?.from ?? []])
+          if (!seenFields.has(fieldKey(x)))
+            add({
+              rule: "field-from-nowhere",
+              target: `${fid} ${where} ${x}`,
+              ...ev ? { evidence: ev } : {},
+              message: `${fid} ${where} uses ${x}, which no earlier step or the trigger names; where it comes from another field (a form value, a request, a DTO, an entity), add a transform step before it that maps one to the other in data.from and data.to`,
+              flow: fid
+            });
+      }
+      for (const x of [
+        ...Object.values(s.data ?? {}).flat(),
+        ...s.store?.columns ?? []
+      ])
+        seenFields.add(fieldKey(x));
+      const claims = [];
+      if (!NEVER_CHECKED_STEPS.includes(s.kind)) {
+        if (s.kind === "entry") {
+          const e = [trig, ...s.refs.map((r) => byId.get(r))].find((r) => r?.kind === "Endpoint");
+          if (e?.kind === "Endpoint")
+            claims.push(e.pathOrTopic.includes("/") ? { kind: "route", value: e.pathOrTopic } : { kind: "word", value: e.pathOrTopic });
+        } else if (s.to && route)
+          claims.push(route.includes("/") ? { kind: "route", value: route } : { kind: "word", value: route });
+        else if (table)
+          claims.push({ kind: "word", value: table.name.split(".").pop() });
+        else
+          for (const x of [
+            ...s.data?.sends ?? [],
+            ...s.data?.returns ?? [],
+            ...s.data?.reads ?? []
+          ])
+            claims.push({ kind: "field", value: x });
+      }
+      const holds = claims.length > 0 && lines.length === s.evidence.length && claims.every((c) => lines.some((l) => c.kind === "route" ? lineNamesRoute(l, c.value) : c.kind === "word" ? lineNamesWord(l, c.value) : lineNamesField(l, c.value)));
+      if (claims.length === 0)
+        unconfirmable++;
+      let confirmedBy = s.confirmedBy;
+      if (holds) {
+        confirmed++;
+        if (confirmedBy !== "person")
+          confirmedBy = "check";
+      } else if (s.confirmedBy === "check")
+        add({
+          rule: "check-fails",
+          target: `${fid} ${where}`,
+          ...ev ? { evidence: ev } : {},
+          message: claims.length ? `${fid} ${where} says the check confirmed it, but its cited lines don't name ${claims.map((c) => c.value).join(", ")}` : `${fid} ${where} says the check confirmed it, but it names nothing the check can look for`,
+          flow: fid
+        });
+      steps.push({ ...s, ...confirmedBy ? { confirmedBy } : {} });
+    }
+    for (const u of uiFindings(f, trigLines, stepLines, o.template))
+      add({ ...u, flow: fid });
+    flows.push({ ...f, steps });
+  }
+  const triggers = specTriggers(o.records, o.repoId, o.template).map((t) => {
+    const flow = o.flows.find((f) => f.trigger.ref === t.id || f.family.includes(t.id));
+    return { ...t, ...flow ? { flow: flow.id } : {} };
+  });
+  if (!o.perFlowOnly)
+    for (const t of triggers.filter((x) => !x.flow))
+      add({
+        rule: "no-flow",
+        target: `trigger ${t.id}`,
+        ...t.evidence ? { evidence: t.evidence } : {},
+        message: `The ${t.kind} ${t.label} (${t.id}) has no flow`
+      });
+  return { findings, flows, triggers, confirmed, unconfirmable };
+}
+async function staleFlows(repo, flows, hashes) {
+  const now2 = /* @__PURE__ */ new Map();
+  const hashOf = async (p) => {
+    if (!now2.has(p)) {
+      const t = await repo.readText(p).catch(() => void 0);
+      now2.set(p, t === void 0 ? null : specFileHash(t));
+    }
+    return now2.get(p);
+  };
+  const out = [];
+  for (const f of flows) {
+    const changed = [];
+    for (const p of flowFiles(f))
+      if (hashes[p] === void 0 || await hashOf(p) !== hashes[p])
+        changed.push(p);
+    if (changed.length)
+      out.push({ flow: f.id, files: changed });
+  }
+  return out;
+}
+async function citedFileHashes(repo, flows) {
+  const out = {};
+  for (const p of [...new Set(flows.flatMap(flowFiles))].sort()) {
+    const t = await repo.readText(p).catch(() => void 0);
+    if (t !== void 0)
+      out[p] = specFileHash(t);
+  }
+  return out;
+}
+
+// packages/scanner/dist/estate.js
+var estateStepKey = (flow, step) => `${flow}#${step}`;
+var at2 = (e) => e?.path && e.line !== void 0 ? `${e.path}:${e.line}` : void 0;
+function parseEntry(s) {
+  const m = /^([A-Za-z]+)\s+(\S+)$/.exec(s.trim());
+  return m ? { method: m[1].toUpperCase(), path: m[2] } : { path: s.trim() };
+}
+var segs = (p) => normalizePath(p).toLowerCase().split("/").filter(Boolean);
+var sameMethod = (a, b) => !a || !b || a.toUpperCase() === b.toUpperCase();
+async function joinEstate(o) {
+  const byId = new Map(o.records.map((r) => [r.id, r]));
+  const endpoints = o.records.filter((r) => r.kind === "Endpoint");
+  const interfaces = o.records.filter((r) => r.kind === "Interface");
+  const flows = o.specs.flatMap((s) => s.flows.map((f) => ({ repo: s.repo, flow: f })));
+  const cited = async (repo, ev) => !!ev?.path && ev.line !== void 0 && (!o.cited || await o.cited(ev.repo ?? repo, ev.path, ev.line));
+  const arrivals = (i) => {
+    const out = [i.normalizedPath];
+    const route = i.route ? byId.get(i.route) : void 0;
+    if (route?.kind === "GatewayRoute") {
+      const base2 = segs(route.basepath);
+      const p = segs(i.normalizedPath);
+      if (base2.length && base2.every((s, k) => p[k] === s))
+        out.push(`/${p.slice(base2.length).join("/")}`);
+    }
+    return out;
+  };
+  const bestEndpoint = (component, method, paths) => {
+    let best;
+    for (const e of endpoints) {
+      if (e.component !== component || !sameMethod(method, e.method))
+        continue;
+      const score = Math.max(...paths.map((p) => pathScore(p, e.normalizedPath ?? e.pathOrTopic)));
+      if (score > 0 && (!best || score > best.score))
+        best = { e, score };
+    }
+    return best?.e;
+  };
+  const templateOf = (repo) => o.templates?.[repo] ?? DEFAULT_SPEC_TEMPLATE;
+  const flowAt = (endpoint) => {
+    const own = flows.find((x) => x.flow.trigger.ref === endpoint);
+    if (own)
+      return { found: own };
+    let wrong;
+    for (const x of flows.filter((y) => y.flow.family.includes(endpoint))) {
+      const bad = familyMismatches(x.flow, byId, templateOf(x.repo)).find((m) => m.member === endpoint);
+      if (!bad)
+        return { found: x };
+      wrong ??= { ...x, finding: bad.message };
+    }
+    return wrong ? { wrong } : void 0;
+  };
+  const isComponent = (id) => byId.get(id)?.kind === "Component";
+  const repoOfComponent = (id) => {
+    const c = byId.get(id);
+    return c?.kind === "Component" ? c.repo ?? c.evidence.find((e) => e.repo)?.repo : void 0;
+  };
+  const servingExactly = (caller, want, scope) => endpoints.filter((e) => e.component !== caller && (!scope || scope.has(e.component)) && sameMethod(want.method, e.method) && pathScore(want.path, e.normalizedPath ?? e.pathOrTopic) === 1e3).sort((a, b) => a.id.localeCompare(b.id));
+  const joins = [];
+  const unmatched = [];
+  const inferred = [];
+  const asks = [];
+  for (const { repo, flow } of flows) {
+    const callers = repoComponents(o.records, repo);
+    callers.add(flow.component);
+    for (const [i, s] of flow.steps.entries()) {
+      if (!s.to)
+        continue;
+      const step = i + 1;
+      const fromAt = at2(s.evidence[0]);
+      const from = { repo, flow: flow.id, step, ...fromAt ? { evidence: fromAt } : {} };
+      const entry = `${s.to.component} ${s.to.entry}`;
+      const miss = (u) => unmatched.push({ from, entry, ...u });
+      const answer = o.targets?.[estateStepKey(flow.id, step)];
+      const name = answer ?? s.to.component;
+      const comp = byId.get(name);
+      const ofRepo = repoComponents(o.records, name);
+      const unknown = comp?.kind !== "Component" && ofRepo.size === 0;
+      if (unknown && (answer || comp?.kind === "System")) {
+        miss({
+          reason: "no-target",
+          message: answer ? `${answer}, which a person named for it, isn't a component in the catalog` : `${name} isn't a component in the catalog`
+        });
+        continue;
+      }
+      const reach = comp?.kind === "Component" ? /* @__PURE__ */ new Set([name]) : unknown ? void 0 : ofRepo;
+      const reaches = (to) => reach ? reach.has(to) : isComponent(to);
+      const named2 = byId.get(s.to.entry);
+      const want = named2?.kind === "Endpoint" ? { method: named2.method, path: named2.normalizedPath ?? named2.pathOrTopic } : named2?.kind === "Interface" ? { method: named2.method, path: named2.normalizedPath } : parseEntry(s.to.entry);
+      let iface = [named2, ...s.refs.map((r) => byId.get(r))].find((r) => r?.kind === "Interface" && reaches(r.to));
+      if (!iface) {
+        let best = 0;
+        for (const x of interfaces) {
+          if (!callers.has(x.from) || !reaches(x.to) || !sameMethod(want.method, x.method))
+            continue;
+          const score = Math.max(...arrivals(x).map((p) => pathScore(want.path, p)));
+          if (score > best) {
+            best = score;
+            iface = x;
+          }
+        }
+      }
+      let target;
+      let how;
+      let guess;
+      const stepName = `${flow.id} step ${step}`;
+      const unnamed = `${stepName} names ${s.to.component}, which isn't a component in the catalog`;
+      if (iface) {
+        how = "interface";
+        if (unknown)
+          guess = {
+            within: "interface",
+            message: `${unnamed}: joined through ${iface.id}, the Interface from ${flow.component} that reaches ${s.to.entry}`
+          };
+        const e = iface.endpoint ? byId.get(iface.endpoint) : void 0;
+        target = e?.kind === "Endpoint" ? e : bestEndpoint(iface.to, iface.method ?? want.method, arrivals(iface));
+        if (!target) {
+          miss({
+            reason: "no-target",
+            interface: iface.id,
+            message: `${iface.id} reaches ${iface.to}, but none of its entry points is ${iface.method ? `${iface.method} ` : ""}${iface.normalizedPath}`
+          });
+          continue;
+        }
+      } else if (named2?.kind === "Endpoint") {
+        how = "endpoint";
+        target = named2;
+      } else if (unknown) {
+        how = "path";
+        const own = repoComponents(o.records, repo);
+        let within = "repo";
+        let hits = servingExactly(flow.component, want, own);
+        if (hits.length === 0) {
+          within = "estate";
+          hits = servingExactly(flow.component, want);
+        }
+        const candidates = [...new Set(hits.map((e) => e.component))].sort();
+        if (candidates.length === 0) {
+          miss({
+            reason: "no-target",
+            message: `${s.to.component} isn't a component in the catalog, and neither an Interface from ${flow.component} nor an entry point of the estate serves ${s.to.entry}`
+          });
+          continue;
+        }
+        if (candidates.length > 1) {
+          const repos = [...new Set(candidates.map(repoOfComponent))];
+          const of = repos.length === 1 && repos[0] ? repos[0] : "the estate";
+          miss({
+            reason: "no-target",
+            message: `${s.to.component} isn't a component in the catalog, and ${candidates.length} components of ${of} serve ${s.to.entry} (${candidates.join(", ")}): a person says which`
+          });
+          asks.push({
+            from,
+            caller: flow.component,
+            named: s.to.component,
+            what: s.to.entry,
+            candidates
+          });
+          continue;
+        }
+        target = hits[0];
+        guess = {
+          within,
+          message: `${unnamed}: joined by method and path to ${target.id}, the only entry point of ${within === "repo" ? `its own repo (${repo})` : "the estate"} that serves ${s.to.entry}`
+        };
+      } else if (comp?.kind !== "Component") {
+        miss({
+          reason: "no-target",
+          message: `${name} isn't a component in the catalog, and no Interface from ${flow.component} reaches ${s.to.entry}`
+        });
+        continue;
+      } else {
+        how = "path";
+        target = bestEndpoint(name, want.method, [want.path]);
+        if (!target) {
+          miss({
+            reason: "no-target",
+            message: `${name} has no entry point for ${s.to.entry}, and no Interface from ${flow.component} reaches it`
+          });
+          continue;
+        }
+      }
+      const reached = flowAt(target.id);
+      const ifaceId = iface ? { interface: iface.id } : {};
+      if (!reached) {
+        miss({
+          reason: "no-flow",
+          trigger: target.id,
+          ...ifaceId,
+          message: `${s.to.entry} reaches ${target.id}, but no flow of ${target.component} starts there`
+        });
+        continue;
+      }
+      if ("wrong" in reached) {
+        const w = reached.wrong;
+        miss({
+          reason: "family-mismatch",
+          trigger: target.id,
+          ...ifaceId,
+          message: `${s.to.entry === target.id ? "The call" : s.to.entry} reaches ${target.id}, which only ${w.flow.id} stands for, in its family, and atticus spec check finds that wrong: ${w.finding}. Redraft it: atticus spec draft ${w.repo}`
+        });
+        continue;
+      }
+      const callee = reached.found;
+      const toEv = callee.flow.trigger.evidence[0];
+      const ends = [
+        await cited(repo, s.evidence[0]) ? void 0 : `${flow.id} step ${step}`,
+        await cited(callee.repo, toEv) ? void 0 : `the trigger of ${callee.flow.id}`
+      ].filter((x) => !!x);
+      if (ends.length) {
+        miss({
+          reason: "no-citation",
+          trigger: target.id,
+          ...ifaceId,
+          message: `${ends.join(" and ")} ${ends.length === 1 ? "cites" : "cite"} no file and line that exists, so the join has no citation at both ends`
+        });
+        continue;
+      }
+      joins.push({
+        from: { repo, flow: flow.id, step, evidence: fromAt },
+        to: { repo: callee.repo, flow: callee.flow.id, trigger: target.id, evidence: at2(toEv) },
+        entry,
+        ...ifaceId,
+        how
+      });
+      if (guess)
+        inferred.push({ from: { repo, flow: flow.id, step }, named: s.to.component, ...guess });
+    }
+  }
+  const order = (a, b) => a.from.flow.localeCompare(b.from.flow) || a.from.step - b.from.step;
+  return {
+    joins: joins.sort(order),
+    unmatched: unmatched.sort(order),
+    inferred: inferred.sort(order),
+    asks: asks.sort(order)
+  };
+}
+var stepFields = (s) => [
+  ...Object.values(s.data ?? {}).flatMap((v) => v ?? []),
+  ...s.store?.columns ?? []
+];
+function crossing(caller, callee) {
+  const sends = caller.data?.sends ?? [];
+  const first = callee.steps[0];
+  const receives = first ? [...first.data?.reads ?? [], ...first.data?.sends ?? [], ...first.data?.from ?? []] : [];
+  const returned = callee.steps.filter((s) => s.kind === "respond").flatMap((s) => s.data?.returns ?? []);
+  const named2 = new Set(callee.steps.flatMap(stepFields).map(fieldKey));
+  const taken = new Set(receives.map(fieldKey));
+  const sent = new Set(sends.map(fieldKey));
+  const loose = sends.filter((x) => !taken.has(fieldKey(x)));
+  const owner = (r) => {
+    const parts = r.split(".");
+    return parts.length > 1 ? fieldKey(parts[parts.length - 2]) : void 0;
+  };
+  const objects = [];
+  for (const x of loose) {
+    const on = receives.filter((r) => owner(r) === fieldKey(x));
+    if (on.length)
+      objects.push({ sent: x, fields: on });
+  }
+  if (objects.length === 0 && loose.length === 1) {
+    const fields = receives.filter((r) => !sent.has(fieldKey(r)) && owner(r) === void 0);
+    if (fields.length)
+      objects.push({ sent: loose[0], fields });
+  }
+  const mapped = new Set(objects.map((m) => m.sent));
+  return {
+    sends,
+    receives,
+    returns: returned.length ? returned : caller.data?.returns ?? [],
+    unused: sends.filter((f) => !named2.has(fieldKey(f)) && !mapped.has(f)),
+    objects
+  };
+}
+function estateFlow(o) {
+  const flows = new Map(o.specs.flatMap((s) => s.flows.map((f) => [f.id, { repo: s.repo, flow: f }])));
+  const limit = o.depth ?? 5;
+  const key = (flow, step) => `${flow}#${step}`;
+  const joins = new Map(o.joins.joins.map((j) => [key(j.from.flow, j.from.step), j]));
+  const misses = new Map(o.joins.unmatched.map((u) => [key(u.from.flow, u.from.step), u]));
+  const walk = (id, prefix, path) => {
+    const f = flows.get(id);
+    if (!f)
+      return void 0;
+    const steps = f.flow.steps.map((s, i) => {
+      const n = `${prefix}${i + 1}`;
+      const out = { n, repo: f.repo, flow: id, step: s };
+      if (!s.to)
+        return out;
+      const j = joins.get(key(id, i + 1));
+      const u = misses.get(key(id, i + 1));
+      if (j && j.from.evidence === at2(s.evidence[0]) && flows.has(j.to.flow)) {
+        const callee = flows.get(j.to.flow).flow;
+        const call = { join: j, crossing: crossing(s, callee) };
+        if (path.includes(j.to.flow))
+          call.stopped = "cycle";
+        else if (path.length > limit)
+          call.stopped = "depth";
+        else
+          call.callee = walk(j.to.flow, `${n}.`, [...path, j.to.flow]);
+        out.call = call;
+      } else if (u && !j)
+        out.call = { unmatched: u };
+      else
+        out.call = { stopped: "stale" };
+      return out;
+    });
+    return { repo: f.repo, flow: f.flow, steps };
+  };
+  return walk(o.flow, "", [o.flow]);
+}
+function flattenEstateFlow(f) {
+  return f.steps.flatMap((s) => [s, ...s.call?.callee ? flattenEstateFlow(s.call.callee) : []]);
+}
+function fieldLineage(f, field) {
+  const steps = flattenEstateFlow(f);
+  const want = fieldKey(field);
+  const out = { flow: f.flow.id, field, links: [] };
+  const link = (s, as, name) => {
+    const e = s.step.evidence[0];
+    const ev = at2(e);
+    return {
+      n: s.n,
+      repo: s.repo,
+      flow: s.flow,
+      kind: s.step.kind,
+      what: s.step.what,
+      as,
+      field: name,
+      ...ev ? { evidence: `${e.repo ?? s.repo}:${ev}` } : {}
+    };
+  };
+  const inObject = (s) => s.call?.crossing?.objects.find((m) => m.fields.some((x) => fieldKey(x) === want));
+  const start = steps.findIndex((s) => (s.step.data?.sends ?? []).some((x) => fieldKey(x) === want) || !!inObject(s));
+  if (start < 0) {
+    out.breaks = { message: `No step of ${f.flow.id}, or of the flows it calls, sends ${field}.` };
+    return out;
+  }
+  const s0 = steps[start];
+  const direct = (s0.step.data?.sends ?? []).find((x) => fieldKey(x) === want);
+  const obj = inObject(s0);
+  out.links.push(link(s0, "sent", direct ?? `${obj.sent}.${obj.fields.find((x) => fieldKey(x) === want).split(".").pop()}`));
+  const tracked = /* @__PURE__ */ new Set([want]);
+  const names = /* @__PURE__ */ new Map([[want, field]]);
+  let last = s0;
+  for (const s of steps.slice(start + 1)) {
+    const d = s.step.data ?? {};
+    const mappedTo = s.step.kind === "write" && s.step.store ? d.to?.[d.from?.findIndex((x) => tracked.has(fieldKey(x))) ?? -1] : void 0;
+    const col = s.step.kind === "write" && (mappedTo ?? s.step.store?.columns.find((c) => tracked.has(fieldKey(c))));
+    if (col) {
+      out.links.push(link(s, "stored", `${s.step.store.table}.${col}`));
+      out.stored = { table: s.step.store.table, column: col };
+      return out;
+    }
+    if (s.step.kind === "transform" && d.from?.length && d.to?.length) {
+      const renamed = [];
+      d.from.forEach((x, k) => {
+        const to = d.to[k];
+        if (to === void 0 || !tracked.has(fieldKey(x)))
+          return;
+        renamed.push(`${x} \u2192 ${to}`);
+        tracked.add(fieldKey(to));
+        names.set(fieldKey(to), to);
+      });
+      if (renamed.length) {
+        out.links.push(link(s, "renamed", renamed.join(", ")));
+        last = s;
+        continue;
+      }
+    }
+    const hit = stepFields(s.step).find((x) => tracked.has(fieldKey(x)));
+    if (hit) {
+      out.links.push(link(s, "named", hit));
+      last = s;
+    }
+  }
+  const now2 = [...names.values()].join(" or ");
+  const call = last.call;
+  const message = call?.unmatched && last.step.data?.sends?.some((x) => tracked.has(fieldKey(x))) ? `${last.n} sends ${now2} to ${last.step.to.component}, but that call-out isn't joined to a flow: ${call.unmatched.message}.` : call?.stopped && call.stopped !== "stale" ? `${last.n} sends ${now2} on, but the callee isn't followed (${call.stopped === "cycle" ? "it is already on the path" : "the depth limit"}).` : `After ${last.n} no step names ${now2}, and no write stores it.`;
+  out.breaks = { after: last.n, message };
+  return out;
+}
+
+// packages/scanner/dist/hosts-asked.js
+var HTTP_TYPES = /* @__PURE__ */ new Set(["rest", "graphql", "soap", "websocket", "sse", "webhook"]);
+var CONFIG_FILES = [
+  "**/application*.properties",
+  "**/application*.yml",
+  "**/application*.yaml",
+  "**/bootstrap*.properties",
+  "**/bootstrap*.yml",
+  "**/bootstrap*.yaml",
+  "**/.env",
+  "**/.env.*",
+  "**/Dockerfile",
+  "**/docker-compose*.yml",
+  "**/docker-compose*.yaml",
+  "**/compose*.yml",
+  "**/compose*.yaml",
+  "**/package.json"
+];
+function lineSetsPort(line, port) {
+  const p = String(port);
+  const end = "(?![0-9])";
+  return [
+    new RegExp(`port["']?\\s*[:=]\\s*["']?${p}${end}`, "i"),
+    new RegExp(`^\\s*EXPOSE\\s+(?:[0-9]+(?:/[a-z]+)?\\s+)*${p}${end}`, "i"),
+    new RegExp(`--port[=\\s]+${p}${end}`, "i"),
+    new RegExp(`(?:^|[\\s"'-])${p}:[0-9]+`)
+  ].some((re) => re.test(line));
+}
+function callHost(url) {
+  if (url.includes("${"))
+    return void 0;
+  const hp = urlHostPort(url);
+  if (!hp || !hp.host)
+    return void 0;
+  const explicit = /^[a-z][a-z0-9+.-]*:\/\/(?:[^/@?#]*@)?[^/:?#]+:(\d+)/i.exec(url);
+  return {
+    label: explicit ? `${hp.host}:${explicit[1]}` : hp.host,
+    host: hp.host,
+    ...hp.port !== void 0 ? { port: hp.port } : {}
+  };
+}
+async function unknownHosts(o) {
+  const patterns = o.repos.flatMap((r) => [
+    ...r.hosts,
+    ...(r.modules ?? []).flatMap((m) => m.hosts)
+  ]);
+  const byHost = /* @__PURE__ */ new Map();
+  for (const r of o.records) {
+    if (r.kind !== "Unresolved" || r.unresolvedKind !== "http-call")
+      continue;
+    const url = r.raw.slice(r.raw.indexOf(" ") + 1);
+    const h = callHost(url);
+    if (!h)
+      continue;
+    if (patterns.some((p) => hostMatches(p, h.host, h.port)))
+      continue;
+    const e = r.evidence[0];
+    const repo = e?.repo ?? r.owner;
+    if (!e?.path || e.line === void 0 || !repo)
+      continue;
+    const entry = byHost.get(h.label) ?? {
+      ...h.port !== void 0 ? { port: h.port } : {},
+      explicit: h.label !== h.host,
+      calls: []
+    };
+    const at3 = `${e.path}:${e.line}`;
+    if (!entry.calls.some((c) => c.repo === repo && c.at === at3))
+      entry.calls.push({ repo, at: at3 });
+    byHost.set(h.label, entry);
+  }
+  if (byHost.size === 0)
+    return [];
+  const compRepo = /* @__PURE__ */ new Map();
+  for (const r of o.repos) {
+    compRepo.set(r.component ?? r.id, r.id);
+    for (const m of r.modules ?? [])
+      compRepo.set(m.component, r.id);
+  }
+  const serving = /* @__PURE__ */ new Set();
+  for (const r of o.records)
+    if (r.kind === "Endpoint" && HTTP_TYPES.has(r.endpointType)) {
+      const repo = compRepo.get(r.component);
+      if (repo)
+        serving.add(repo);
+    }
+  const servers = [...serving].sort();
+  const configs = /* @__PURE__ */ new Map();
+  const configOf = async (repo) => {
+    if (configs.has(repo))
+      return configs.get(repo);
+    const h = o.handle(repo);
+    const out = [];
+    if (h)
+      for await (const path of h.listFiles(CONFIG_FILES)) {
+        const t = await h.readText(path).catch(() => void 0);
+        if (t !== void 0)
+          out.push({ path, lines: t.replace(/\r\n?/g, "\n").split("\n") });
+      }
+    configs.set(repo, out);
+    return out;
+  };
+  const asks = [];
+  for (const [host, entry] of [...byHost.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    if (servers.length === 0)
+      continue;
+    const hits = [];
+    if (entry.explicit && entry.port !== void 0)
+      for (const repo of servers) {
+        hit: for (const f of await configOf(repo))
+          for (const [i, l] of f.lines.entries())
+            if (lineSetsPort(l, entry.port)) {
+              hits.push({ repo, at: `${f.path}:${i + 1}`, line: l.trim() });
+              break hit;
+            }
+      }
+    const suggest = hits.length === 1 ? hits[0] : void 0;
+    const calls = entry.calls.sort((a, b) => a.repo.localeCompare(b.repo) || a.at.localeCompare(b.at, "en", { numeric: true }));
+    const about = Object.fromEntries(servers.flatMap((s) => {
+      const d = o.repos.find((r) => r.id === s)?.description;
+      return d ? [[s, { text: d.text, trust: d.trust }]] : [];
+    }));
+    asks.push({
+      host,
+      calls,
+      servers: suggest ? [suggest.repo, ...servers.filter((s) => s !== suggest.repo)] : servers,
+      ...suggest ? { suggest } : {},
+      ...Object.keys(about).length ? { about } : {}
+    });
+  }
+  return asks;
+}
+function aboutOf(a, repo) {
+  const d = a.about?.[repo];
+  if (!d)
+    return "";
+  return d.trust === "suggested" ? `. What it is, as your assistant drafted it (unconfirmed): ${d.text}` : `. What it is: ${d.text}`;
+}
+function hostQuestionDrafts(asks) {
+  return asks.map((a) => {
+    const repo = a.calls[0].repo;
+    return {
+      repo,
+      draft: {
+        question: hostQuestionText(a.host),
+        options: [
+          ...a.servers.map((s) => ({
+            label: s,
+            means: (a.suggest?.repo === s ? `${s} serves HTTP, and its ${a.suggest.at} sets the port ${a.host.split(":").pop()} (${a.suggest.line})` : `${s} serves HTTP`) + aboutOf(a, s),
+            changes: `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan`
+          })),
+          {
+            label: HOSTS_NONE,
+            means: `An outside system answers on ${a.host}, not a repo of this estate`,
+            changes: "Nothing is added to the manifest; the calls stay loose ends, and this isn't asked again"
+          }
+        ],
+        evidence: a.calls.filter((c) => c.repo === repo).slice(0, 3).map((c) => c.at),
+        scope: "repo"
+      }
+    };
+  });
+}
+
+export {
+  buildGlossary,
+  GLOSSARY_CHANGE,
+  GLOSSARY_OUTPUT,
+  undefinedCodeTerms,
+  proposeDefinitions,
+  GlossaryError,
+  resolveTermId,
+  defineDecision,
+  aliasDecision,
+  linkDecision,
+  writeDecisions,
+  loadGlossary,
+  scanGlossary,
+  completeGlossaryDefinitions,
+  keepCatalogsInMemory,
+  forgetCatalogs,
+  readCatalog,
+  writeCatalog,
+  diffCatalogs,
+  diffIsEmpty,
+  estateRepos,
+  isPrototypeRepo,
+  TARGETS_STEP,
+  targetQuestionDrafts,
+  targetsFromAnswers,
+  outsideSystems,
+  joinReposOf,
+  catalogWithFacts,
+  prototypeLeftOut,
+  estateFacts,
+  citedLine,
+  checkScanSettings,
+  runPluginTests,
+  scanEstate,
+  matchRepoType,
+  resolveSettingsTemplate,
+  draftRepoType,
+  repoComponents,
+  specTriggers,
+  checkSpec,
+  staleFlows,
+  citedFileHashes,
+  estateStepKey,
+  joinEstate,
+  estateFlow,
+  fieldLineage,
+  unknownHosts,
+  hostQuestionDrafts
+};