@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/chunk-PAMPPUR6.js

@@ -0,0 +1,4500 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  globToRegExp
+} from "./chunk-GQ4N4WKF.js";
+import {
+  APIGEE_BUNDLE,
+  Fact,
+  MOCK_FILE,
+  NEVER_CHECKED_STEPS,
+  citedFiles,
+  claimOnLines,
+  isSecretPath,
+  lineNamesClaim,
+  normalizePath,
+  partsBuildWord,
+  partsNamePath,
+  quoteMatches,
+  quoteNotRequired,
+  redactSecrets,
+  staleCite,
+  toCanonicalYaml
+} from "./chunk-S2A7YC3Q.js";
+
+// packages/verify/dist/source.js
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, join, normalize, relative, sep } from "node:path";
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".hg",
+  ".svn",
+  "node_modules",
+  ".atticus",
+  ".idea",
+  ".vscode",
+  ".gradle",
+  ".mvn",
+  "target",
+  "build",
+  "dist",
+  "out",
+  "bin",
+  "obj",
+  "vendor",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".next",
+  ".nuxt",
+  "coverage"
+]);
+function insideRepo(path) {
+  if (path === "" || isAbsolute(path) || /^[A-Za-z]:/.test(path))
+    return false;
+  const n = normalize(path).split(sep).join("/");
+  return n !== ".." && !n.startsWith("../");
+}
+function dirSource(root) {
+  let cache;
+  const walk = (dir, out) => {
+    let names;
+    try {
+      names = readdirSync(dir).sort();
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const full = join(dir, name);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (!SKIP_DIRS.has(name))
+          walk(full, out);
+      } else if (st.isFile())
+        out.push(relative(root, full).split(sep).join("/"));
+    }
+  };
+  return {
+    list() {
+      if (!cache) {
+        cache = [];
+        walk(root, cache);
+      }
+      return cache;
+    },
+    read(path) {
+      if (!insideRepo(path))
+        return void 0;
+      try {
+        return readFileSync(join(root, ...path.split("/")), "utf8");
+      } catch {
+        return void 0;
+      }
+    }
+  };
+}
+
+// packages/verify/dist/frameworks.js
+var FRAMEWORKS = [
+  "spring",
+  "aspnet",
+  "express",
+  "nest",
+  "angular",
+  "react",
+  "vue",
+  "next",
+  "quarkus",
+  "django",
+  "rails",
+  "laravel",
+  "house"
+];
+var KNOWN = [
+  // Java and Kotlin
+  ["spring-boot*", { name: "spring-boot", topic: "spring", shape: "rest" }],
+  ["spring-webmvc", { name: "spring", topic: "spring", shape: "rest" }],
+  ["spring-webflux", { name: "spring", topic: "spring", shape: "rest" }],
+  ["spring-web", { name: "spring", topic: "spring", shape: "rest" }],
+  ["spring-data-rest*", { name: "spring-data-rest", topic: "spring", shape: "rest" }],
+  ["spring-context", { name: "spring", topic: "spring" }],
+  ["spring-core", { name: "spring", topic: "spring" }],
+  ["hibernate-core", { name: "hibernate", topic: "spring", shape: "store" }],
+  ["quarkus-bom", { name: "quarkus", topic: "quarkus" }],
+  ["quarkus-rest*", { name: "quarkus", topic: "quarkus", shape: "rest" }],
+  ["quarkus-resteasy*", { name: "quarkus", topic: "quarkus", shape: "rest" }],
+  ["quarkus*", { name: "quarkus", topic: "quarkus" }],
+  ["micronaut-http-server*", { name: "micronaut", shape: "rest" }],
+  ["micronaut*", { name: "micronaut" }],
+  // .NET
+  ["microsoft.net.sdk.web", { name: "asp.net", topic: "aspnet", shape: "rest" }],
+  ["microsoft.aspnetcore*", { name: "asp.net", topic: "aspnet", shape: "rest" }],
+  ["microsoft.entityframeworkcore*", { name: "entity-framework", topic: "aspnet", shape: "store" }],
+  // Node
+  ["express", { name: "express", topic: "express", shape: "rest" }],
+  ["@nestjs/core", { name: "nest", topic: "nest", shape: "rest" }],
+  ["nestjs/core", { name: "nest", topic: "nest", shape: "rest" }],
+  ["@angular/core", { name: "angular", topic: "angular", shape: "screen" }],
+  ["angular/core", { name: "angular", topic: "angular", shape: "screen" }],
+  ["react", { name: "react", topic: "react", shape: "screen" }],
+  ["vue", { name: "vue", topic: "vue", shape: "screen" }],
+  ["next", { name: "next", topic: "next" }],
+  ["svelte", { name: "svelte" }],
+  ["typeorm", { name: "typeorm", topic: "express", shape: "store" }],
+  ["@prisma/client", { name: "prisma", topic: "express", shape: "store" }],
+  ["prisma/client", { name: "prisma", topic: "express", shape: "store" }],
+  // Python
+  ["django", { name: "django", topic: "django", shape: "rest" }],
+  ["djangorestframework", { name: "django-rest-framework", topic: "django", shape: "rest" }],
+  ["flask", { name: "flask", shape: "rest" }],
+  ["fastapi", { name: "fastapi", shape: "rest" }],
+  ["celery", { name: "celery", topic: "django", shape: "batch-job" }],
+  // Ruby
+  ["rails", { name: "rails", topic: "rails", shape: "rest" }],
+  ["sidekiq", { name: "sidekiq", topic: "rails", shape: "batch-job" }],
+  ["devise", { name: "devise", topic: "rails" }],
+  // PHP
+  ["laravel/framework", { name: "laravel", topic: "laravel", shape: "rest" }],
+  ["laravel", { name: "laravel", topic: "laravel", shape: "rest" }]
+];
+function declarationKey(declared) {
+  const d = declared.trim().toLowerCase();
+  const parts = d.split(":");
+  const colon = parts.length > 1 ? parts[1] ?? d : d;
+  const name = colon.split(/[=<>~!,\s[]/)[0] ?? colon;
+  return name.replace(/^['"]|['"]$/g, "");
+}
+function frameworkOf(declared) {
+  const key = declarationKey(declared);
+  if (!key)
+    return void 0;
+  for (const [pattern, known] of KNOWN) {
+    const star = pattern.endsWith("*");
+    const p = star ? pattern.slice(0, -1) : pattern;
+    if (star ? key.startsWith(p) : key === p)
+      return known;
+  }
+  return void 0;
+}
+function frameworkNameProblem(f) {
+  const known = frameworkOf(f.cite.value);
+  const name = f.name.trim().toLowerCase();
+  if (known) {
+    return name === known.name ? void 0 : `names the framework "${f.name}", but ${f.cite.file}:${f.cite.line} declares ${f.cite.value}, which is ${known.name}`;
+  }
+  const key = declarationKey(f.cite.value);
+  if (declarationKey(name) === key || name === key)
+    return void 0;
+  return `names the framework "${f.name}", which ${f.cite.file}:${f.cite.line} doesn't declare: it declares ${f.cite.value}, and Atticus doesn't know that one, so name it as the build file writes it (${key})`;
+}
+var frameworkFacts = (facts) => facts.filter((f) => f.kind === "framework").sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+function frameworkTopics(facts) {
+  const fws = frameworkFacts(facts);
+  if (!fws.length)
+    return void 0;
+  const topics = /* @__PURE__ */ new Set();
+  for (const f of fws) {
+    const known = frameworkOf(f.cite.value);
+    if (!known?.topic)
+      topics.add("house");
+    else
+      topics.add(known.topic);
+  }
+  return FRAMEWORKS.filter((t) => topics.has(t));
+}
+function frameworkTopicsOfType(type) {
+  const t = (type ?? "").trim().toLowerCase();
+  const topics = t === "spring-boot" || t === "java" ? ["spring"] : t === "dotnet" ? ["aspnet"] : t === "frontend" ? ["angular", "react", "vue", "next"] : t === "node" ? ["express", "nest", "next", "react"] : t === "python" ? ["django"] : [];
+  return FRAMEWORKS.filter((x) => topics.includes(x));
+}
+var SHAPE_WORDS = {
+  rest: "no REST entry",
+  screen: "no screen entry",
+  "batch-job": "no batch-job entry",
+  store: "no table it reads or writes"
+};
+var SHAPE_ASK = {
+  rest: "which routes it serves",
+  screen: "which screens it has",
+  "batch-job": "which jobs it runs",
+  store: "which tables it reads and writes"
+};
+var holdsShape = (facts, shape2) => facts.some((f) => shape2 === "store" ? f.kind === "store" : f.kind === "entry" && f.entryType === (shape2 === "rest" ? "rest" : shape2));
+function frameworkGaps(facts) {
+  const fws = frameworkFacts(facts);
+  if (!fws.length)
+    return [];
+  if (!facts.some((f) => f.kind !== "framework"))
+    return [];
+  const out = [];
+  for (const f of fws) {
+    const shape2 = frameworkOf(f.cite.value)?.shape;
+    if (!shape2 || holdsShape(facts, shape2))
+      continue;
+    out.push({
+      id: f.id,
+      framework: f.name,
+      cite: `${f.cite.file}:${f.cite.line}`,
+      expected: shape2,
+      question: `${f.repo} declares ${f.name} at ${f.cite.file}:${f.cite.line}, and its facts have ${SHAPE_WORDS[shape2]}. Were its entry points missed, or does this repo really have none? Read it again for ${SHAPE_ASK[shape2]}, or say it has none.`
+    });
+  }
+  return out.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+function frameworksToLearn(facts, known = []) {
+  const have = new Set(known.map(declarationKey));
+  return frameworkFacts(facts).filter((f) => !frameworkOf(f.cite.value) && !have.has(declarationKey(f.name)) && !have.has(declarationKey(f.cite.value))).map((f) => ({
+    id: f.id,
+    framework: f.name,
+    cite: `${f.cite.file}:${f.cite.line}`,
+    command: `atticus frameworks learn ${f.name} --from ${f.repo}`,
+    why: `${f.repo} is built on ${f.name} (${f.cite.file}:${f.cite.line}), which Atticus can't read: teach it once and every repo of the house that uses it is read with it.`
+  }));
+}
+
+// packages/verify/dist/apigee-policy.js
+var MAKES = {
+  OAuthV1: ["oauth2"],
+  OAuthV2: ["oauth2"],
+  VerifyAccessToken: ["oauth2"],
+  VerifyJWT: ["oauth2"],
+  VerifyAPIKey: ["api-key"],
+  BasicAuthentication: ["basic"]
+};
+var CHECKS = {
+  oauth2: "an OAuth token",
+  "api-key": "an API key",
+  basic: "a user name and password"
+};
+var MAKES_NONE = /* @__PURE__ */ new Set([
+  "AccessControl",
+  "AccessEntity",
+  "AssignMessage",
+  "ConcurrentRateLimit",
+  "ExtractVariables",
+  "GenerateJWT",
+  "InvalidateCache",
+  "JSONThreatProtection",
+  "JSONToXML",
+  "KeyValueMapOperations",
+  "LookupCache",
+  "MessageLogging",
+  "PopulateCache",
+  "Quota",
+  "RaiseFault",
+  "RegularExpressionProtection",
+  "ResponseCache",
+  "SpikeArrest",
+  "StatisticsCollector",
+  "XMLThreatProtection",
+  "XMLToJSON",
+  "XSL"
+]);
+function bundleRootOf(file) {
+  const m = /^(.*(?:^|\/)(?:apiproxy|sharedflowbundle))\//.exec(file.replace(/\\/g, "/"));
+  return m?.[1];
+}
+function policyElement(file, policy, lines) {
+  const root = bundleRootOf(file);
+  if (!root || !/^[A-Za-z0-9][\w.-]*$/.test(policy))
+    return void 0;
+  const path = `${root}/policies/${policy}.xml`;
+  const ls = lines(path);
+  if (!ls)
+    return void 0;
+  for (const l of ls) {
+    const m = /^\s*<([A-Za-z][\w.-]*)[\s/>]/.exec(l);
+    if (m)
+      return { path, element: m[1] };
+  }
+  return void 0;
+}
+function authPolicyMismatch(auth, file, policy, lines) {
+  const found = policyElement(file, policy, lines);
+  if (!found)
+    return void 0;
+  const makes = MAKES[found.element];
+  if (makes)
+    return makes.includes(auth) ? void 0 : { ...found, makes };
+  return MAKES_NONE.has(found.element) ? found : void 0;
+}
+var authChecks = (auth) => CHECKS[auth] ?? auth;
+
+// packages/verify/dist/corrections.js
+function correctionFor(f, corrections) {
+  const at = (c) => c.target.kind === f.kind && c.target.file === f.cite.file && c.target.line === f.cite.line;
+  const byId = corrections.filter((c) => c.fact === f.id && at(c));
+  const byCite = corrections.filter((c) => at(c) && c.target.value === f.cite.value);
+  const edited = corrections.filter((c) => c.fact === f.id && c.action === "edit");
+  const moved = edited.filter((c) => (c.line ?? c.target.line) === f.cite.line);
+  return [...byId, ...byCite, ...moved].sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : 0)[0];
+}
+function correctedFact(f, c) {
+  const raw = JSON.parse(JSON.stringify(f));
+  for (const [k, v] of Object.entries(c.set ?? {})) {
+    if (k === "value")
+      raw.cite.value = v;
+    else if (v === "")
+      delete raw[k];
+    else
+      raw[k] = v;
+  }
+  if (c.line !== void 0 && c.line !== f.cite.line) {
+    raw.cite.line = c.line;
+    delete raw.cite.quote;
+  }
+  raw.by = "person";
+  raw.verified = "person";
+  const r = Fact.safeParse(raw);
+  if (!r.success)
+    return r.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+  return r.data;
+}
+function applyCorrections(facts, corrections) {
+  const out = [];
+  const applied = [];
+  const used = /* @__PURE__ */ new Set();
+  const stale = [];
+  for (const f of facts) {
+    const c = correctionFor(f, corrections);
+    if (!c) {
+      out.push(f);
+      continue;
+    }
+    used.add(c);
+    if (c.action === "wrong") {
+      applied.push({ fact: f.id, action: "wrong", by: c.by });
+      continue;
+    }
+    const fixed = correctedFact(f, c);
+    if (typeof fixed === "string") {
+      stale.push({
+        correction: c,
+        why: "invalid",
+        message: `${c.by}'s correction of ${f.kind} ${f.id} doesn't make a fact (${fixed}); the fact is kept as it was`
+      });
+      out.push(f);
+      continue;
+    }
+    applied.push({ fact: f.id, action: "edit", by: c.by });
+    out.push(fixed);
+  }
+  for (const c of corrections) {
+    if (used.has(c))
+      continue;
+    const replaced = [...used].some((u) => (u.fact === c.fact || u.target.value === c.target.value) && u.target.kind === c.target.kind && u.target.file === c.target.file && u.target.line === c.target.line);
+    if (replaced || c.action === "wrong")
+      continue;
+    stale.push({
+      correction: c,
+      why: "none",
+      message: `${c.by}'s correction of ${c.target.kind} ${c.fact} (${c.target.file}:${c.target.line}) meets no fact in this read; it is kept in the file and applied when the fact is read again`
+    });
+  }
+  return { facts: out, applied, stale };
+}
+
+// packages/verify/dist/derived.js
+function springSnake(name) {
+  const s = name.replace(/\./g, "_");
+  let out = s[0] ?? "";
+  for (let i = 1; i < s.length; i++) {
+    const before = s[i - 1];
+    const cur = s[i];
+    const after = s[i + 1];
+    if (after !== void 0 && isLower(before) && isUpper(cur) && isLower(after))
+      out += "_";
+    out += cur;
+  }
+  return out.toLowerCase();
+}
+var isLower = (c) => c !== c.toUpperCase() && c === c.toLowerCase();
+var isUpper = (c) => c !== c.toLowerCase() && c === c.toUpperCase();
+var railsUnderscore = (name) => name.replace(/::/g, "/").replace(/([A-Z\d]+)([A-Z][a-z])/g, "$1_$2").replace(/([a-z\d])([A-Z])/g, "$1_$2").replace(/-/g, "_").toLowerCase();
+var laravelSnake = (name) => name.replace(/(.)(?=[A-Z])/g, "$1_").toLowerCase();
+var typeormSnake = (name) => name.replace(/([A-Z])([A-Z])([a-z])/g, "$1_$2$3").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+var UNCOUNTABLE = /* @__PURE__ */ new Set([
+  "equipment",
+  "information",
+  "rice",
+  "money",
+  "species",
+  "series",
+  "fish",
+  "sheep",
+  "jeans",
+  "police"
+]);
+var IRREGULAR = [
+  ["person", "people"],
+  ["man", "men"],
+  ["child", "children"],
+  ["sex", "sexes"],
+  ["move", "moves"],
+  ["zombie", "zombies"]
+];
+var PLURAL = [
+  [/$/, "s"],
+  [/s$/i, "s"],
+  [/^(ax|test)is$/i, "$1es"],
+  [/(octop|vir)us$/i, "$1i"],
+  [/(octop|vir)i$/i, "$1i"],
+  [/(alias|status)$/i, "$1es"],
+  [/(bu)s$/i, "$1ses"],
+  [/(buffal|tomat)o$/i, "$1oes"],
+  [/([ti])um$/i, "$1a"],
+  [/([ti])a$/i, "$1a"],
+  [/sis$/i, "ses"],
+  [/(?:([^f])fe|([lr])f)$/i, "$1$2ves"],
+  [/(hive)$/i, "$1s"],
+  [/([^aeiouy]|qu)y$/i, "$1ies"],
+  [/(x|ch|ss|sh)$/i, "$1es"],
+  [/(matr|vert|ind)(?:ix|ex)$/i, "$1ices"],
+  [/^(m|l)ouse$/i, "$1ice"],
+  [/^(m|l)ice$/i, "$1ice"],
+  [/^(ox)$/i, "$1en"],
+  [/^(oxen)$/i, "$1"],
+  [/(quiz)$/i, "$1zes"]
+].reverse();
+function pluralize(word) {
+  if (UNCOUNTABLE_RE.some((re) => re.test(word)))
+    return word;
+  for (const [one, many] of IRREGULAR) {
+    const m = new RegExp(`(${one[0]})${one.slice(1)}$`, "i").exec(word);
+    if (m)
+      return word.slice(0, m.index) + m[1] + many.slice(1);
+  }
+  for (const [re, to] of PLURAL)
+    if (re.test(word))
+      return word.replace(re, to);
+  return word;
+}
+var UNCOUNTABLE_RE = [...UNCOUNTABLE].map((w) => new RegExp(`(^|[^A-Za-z0-9_])${w}$`, "i"));
+function singularize(word) {
+  for (const [one, many] of IRREGULAR)
+    if (word.endsWith(many))
+      return word.slice(0, -many.length) + one;
+  if (/ies$/.test(word))
+    return word.replace(/ies$/, "y");
+  if (/(x|ch|ss|sh)es$/.test(word))
+    return word.replace(/es$/, "");
+  if (/[^s]s$/.test(word))
+    return word.slice(0, -1);
+  return word;
+}
+var camelize = (s) => s.split("/").map((p) => p.replace(/(?:^|_)([a-z\d])/g, (_, c) => c.toUpperCase())).join("::");
+var CLASS_JVM = /^\s*(?:(?:public|protected|private|abstract|final|static|open|data|internal|sealed)\s+)*class\s+([A-Z]\w*)/;
+var isComment = (l) => /^\s*(\/\/|\/\*|\*|#)/.test(l);
+function annotationsAbove(lines, idx, max = 12) {
+  let from = idx;
+  for (let i = idx - 1; i >= 0 && idx - i <= max; i--) {
+    const l = lines[i];
+    const t = l.trim();
+    if (t === "" || isComment(l)) {
+      from = i;
+      continue;
+    }
+    if (/[;{}]\s*$/.test(t) || /^(import|package)\b/.test(t))
+      break;
+    from = i;
+  }
+  return { text: lines.slice(from, idx).join("\n"), from };
+}
+function classLineOf(lines, idx, re = CLASS_JVM) {
+  if (re.test(lines[idx] ?? ""))
+    return idx;
+  if (!/^\s*@/.test(lines[idx] ?? ""))
+    return void 0;
+  for (let i = idx + 1; i < lines.length && i - idx <= 10; i++) {
+    if (re.test(lines[i]))
+      return i;
+    const t = lines[i].trim();
+    if (t !== "" && !t.startsWith("@") && !isComment(lines[i]) && /[;{}]\s*$/.test(t))
+      return void 0;
+  }
+  return void 0;
+}
+function jpaEntityAt(file, lines, idx) {
+  if (!/\.(java|kt)$/.test(file))
+    return void 0;
+  const cl = classLineOf(lines, idx);
+  if (cl === void 0)
+    return void 0;
+  const { text, from } = annotationsAbove(lines, cl);
+  if (idx < cl && idx < from)
+    return void 0;
+  if (!/@(?:(?:javax|jakarta)\.persistence\.)?Entity\b/.test(text))
+    return void 0;
+  const className = CLASS_JVM.exec(lines[cl])[1];
+  const entityName = /@Entity\s*\(\s*(?:name\s*=\s*)?"([^"]+)"/.exec(text)?.[1] ?? className;
+  const written = /@Table\s*\([^)]*?\bname\s*=\s*"([^"]+)"/.exec(text)?.[1];
+  return {
+    className,
+    entityName,
+    table: written ?? springSnake(entityName),
+    tableWritten: written !== void 0,
+    file,
+    lines,
+    classLine: cl
+  };
+}
+function enclosingJpaEntity(file, lines, idx) {
+  for (let i = idx; i >= 0; i--)
+    if (CLASS_JVM.test(lines[i]))
+      return jpaEntityAt(file, lines, i);
+  return void 0;
+}
+function jpaIdColumn(e) {
+  for (let i = e.classLine + 1; i < e.lines.length; i++) {
+    if (!/^\s*@(Id|EmbeddedId)\b/.test(e.lines[i]))
+      continue;
+    if (/@EmbeddedId/.test(e.lines[i]))
+      return void 0;
+    for (let j = i; j < e.lines.length && j - i <= 5; j++) {
+      const f = jvmField(e.lines[j]);
+      if (f) {
+        const named = /@Column\s*\([^)]*?\bname\s*=\s*"([^"]+)"/.exec(e.lines.slice(i, j + 1).join("\n"))?.[1];
+        return named ?? springSnake(f.name);
+      }
+    }
+  }
+  return void 0;
+}
+function jvmField(line) {
+  const java = /^\s*(?:(?:private|protected|public|final|transient)\s+)*([\w.]+)(?:<\s*([\w.]+)\s*(?:,\s*[\w.]+\s*)?>)?\s+(\w+)\s*(?:=[^;]*)?;/.exec(line);
+  if (java && !/^(return|new|throw)$/.test(java[1]))
+    return { type: java[1], arg: java[2], name: java[3] };
+  const kt = /^\s*(?:(?:private|protected|public|internal|lateinit|override)\s+)*va[lr]\s+(\w+)\s*:\s*([\w.]+)(?:<\s*([\w.]+)\s*>)?/.exec(line);
+  if (kt)
+    return { name: kt[1], type: kt[2], arg: kt[3] };
+  return void 0;
+}
+function findClassFile(env, name, near, exts, declares, imports = []) {
+  const all2 = env.files().filter((p) => exts.test(p));
+  const byFile = all2.filter((p) => new RegExp(`(^|/)${name}\\.[a-z]+$`).test(p));
+  const declaring = (ps) => ps.filter((p) => declares(env.lines(p) ?? []));
+  const imported = imports.map((i) => /import\s+([\w.]+)\s*;?/.exec(i)?.[1]).filter((i) => !!i && i.endsWith(`.${name}`)).map((i) => i.replace(/\./g, "/"));
+  for (const imp of imported) {
+    const hit = declaring(byFile.filter((p) => p.replace(/\.[a-z]+$/, "").endsWith(imp)));
+    if (hit.length === 1)
+      return hit[0];
+  }
+  const dir = near.split("/").slice(0, -1).join("/");
+  const same = declaring(byFile.filter((p) => p.split("/").slice(0, -1).join("/") === dir));
+  if (same.length === 1)
+    return same[0];
+  const candidates = declaring(byFile.length ? byFile : all2);
+  const shared = (p) => {
+    const a = p.split("/");
+    const b = near.split("/");
+    let n = 0;
+    while (n < a.length && n < b.length && a[n] === b[n])
+      n++;
+    return n;
+  };
+  const best = Math.max(-1, ...candidates.map(shared));
+  const top = candidates.filter((p) => shared(p) === best);
+  return top.length === 1 ? top[0] : void 0;
+}
+function jpaEntityByName(env, name, near, nearLines) {
+  const re = new RegExp(`^\\s*(?:[a-z]+\\s+)*class\\s+${name}\\b`);
+  const file = findClassFile(env, name, near, /\.(java|kt)$/, (ls2) => ls2.some((l) => re.test(l)), nearLines.filter((l) => /^\s*import\s/.test(l)));
+  if (!file)
+    return void 0;
+  const ls = env.lines(file) ?? [];
+  const at = ls.findIndex((l) => re.test(l));
+  return at < 0 ? void 0 : jpaEntityAt(file, ls, at);
+}
+function jvmFieldAt(lines, idx) {
+  const at = (j) => {
+    const field = jvmField(lines[j] ?? "");
+    return field ? { field, ann: annotationsAbove(lines, j, 6).text, line: j } : void 0;
+  };
+  const here = at(idx);
+  if (here)
+    return here;
+  if (!/^\s*@/.test(lines[idx] ?? ""))
+    return void 0;
+  for (let j = idx + 1; j < lines.length && j - idx <= 4; j++) {
+    const f = at(j);
+    if (f)
+      return f;
+    if (/[{}]\s*$/.test(lines[j].trim()))
+      return void 0;
+  }
+  return void 0;
+}
+var jpaEntityTable = (file, lines, idx) => {
+  const e = jpaEntityAt(file, lines, idx);
+  if (!e || e.tableWritten)
+    return [];
+  return [{ kind: "word", value: e.table, rule: "jpa-spring-table" }];
+};
+var jpaAssociation = (file, lines, idx, env) => {
+  if (!/\.(java|kt)$/.test(file))
+    return [];
+  const at = jvmFieldAt(lines, idx);
+  if (!at)
+    return [];
+  const { field, ann } = at;
+  const owner = enclosingJpaEntity(file, lines, at.line);
+  if (!owner)
+    return [];
+  const out = [];
+  const mapped = /\bmappedBy\s*=/.test(ann);
+  const joinTableNamed = /@JoinTable\s*\([^)]*?\bname\s*=/.test(ann);
+  const targetName2 = /targetEntity\s*=\s*(\w+)(?:::|\.)class/.exec(ann)?.[1] ?? field.arg ?? field.type;
+  const target = () => jpaEntityByName(env, targetName2, file, lines);
+  if (/@ElementCollection\b/.test(ann) && !/@CollectionTable\s*\([^)]*?\bname\s*=/.test(ann))
+    out.push({
+      kind: "word",
+      value: springSnake(`${owner.entityName}_${field.name}`),
+      rule: "jpa-collection-table"
+    });
+  const toMany = /@ManyToMany\b/.test(ann) || /@OneToMany\b/.test(ann) && !/@JoinColumn\b/.test(ann);
+  if (toMany && !mapped && field.arg) {
+    const t = target();
+    if (!joinTableNamed) {
+      out.push({
+        kind: "word",
+        value: springSnake(`${owner.table}_${field.name}`),
+        rule: "jpa-spring-join-table"
+      });
+      if (t)
+        out.push({
+          kind: "word",
+          value: springSnake(`${owner.table}_${t.table}`),
+          rule: "jpa-join-table"
+        });
+    }
+    if (!/@JoinTable\s*\([^)]*?joinColumns/.test(ann)) {
+      const ownerId = jpaIdColumn(owner);
+      const inverse = t ? (() => {
+        for (let i = 0; i < t.lines.length; i++)
+          if (new RegExp(`mappedBy\\s*=\\s*"${field.name}"`).test(t.lines[i])) {
+            const f = jvmFieldAt(t.lines, i);
+            if (f)
+              return f.field.name;
+          }
+        return void 0;
+      })() : void 0;
+      if (ownerId)
+        out.push({
+          kind: "field",
+          value: springSnake(`${inverse ?? owner.entityName}_${ownerId}`),
+          rule: "jpa-join-column-owner"
+        });
+      const targetId = t && jpaIdColumn(t);
+      if (targetId)
+        out.push({
+          kind: "field",
+          value: springSnake(`${field.name}_${targetId}`),
+          rule: "jpa-join-column-target"
+        });
+    }
+  }
+  const toOne = /@ManyToOne\b/.test(ann) || /@OneToOne\b/.test(ann) && !mapped;
+  if (toOne && !/@JoinColumn\s*\([^)]*?\bname\s*=/.test(ann)) {
+    const t = target();
+    const id = t && jpaIdColumn(t);
+    if (id)
+      out.push({
+        kind: "field",
+        value: springSnake(`${field.name}_${id}`),
+        rule: "jpa-foreign-key"
+      });
+  }
+  return out;
+};
+var DJANGO_CLASS = /^class\s+(\w+)\s*\(([^)]*)\)\s*:/;
+var djangoAppDir = (file) => /^(?:(.*)\/)?models\.py$/.exec(file)?.[1] ?? /^(?:(.*)\/)?models\/[^/]+\.py$/.exec(file)?.[1];
+function djangoModelAt(file, lines, idx, env) {
+  const appDir = djangoAppDir(file);
+  if (appDir === void 0)
+    return void 0;
+  const m = DJANGO_CLASS.exec(lines[idx] ?? "");
+  if (!m)
+    return void 0;
+  const bases = m[2].split(",").map((b) => b.trim().split(".").pop());
+  if (!bases.some((b) => /Model$|^Abstract\w*User$/.test(b)))
+    return void 0;
+  const body = [];
+  for (let i = idx + 1; i < lines.length; i++) {
+    if (/^\S/.test(lines[i]))
+      break;
+    body.push(lines[i]);
+  }
+  const meta = body.join("\n").split(/^\s+class\s+Meta\b.*$/m)[1] ?? "";
+  if (/^\s+(abstract|proxy)\s*=\s*True\b/m.test(meta))
+    return void 0;
+  const written = /^\s+db_table\s*=\s*["']([^"']+)["']/m.exec(meta)?.[1];
+  const dirs = appDir ? appDir.split("/") : [];
+  let config2;
+  for (let n = dirs.length; n > 0 && !config2; n--) {
+    const dir = dirs.slice(0, n).join("/");
+    const text = env.lines(`${dir}/apps.py`);
+    if (text)
+      config2 = { dir, text: text.join("\n") };
+  }
+  const label = /^\s+app_label\s*=\s*["']([^"']+)["']/m.exec(meta)?.[1] ?? (config2 ? /^\s+label\s*=\s*["']([^"']+)["']/m.exec(config2.text)?.[1] ?? /^\s+name\s*=\s*["']([\w.]+)["']/m.exec(config2.text)?.[1]?.split(".").pop() ?? config2.dir.split("/").pop() : dirs[dirs.length - 1]);
+  if (!label)
+    return void 0;
+  return {
+    name: m[1],
+    table: written ?? `${label}_${m[1].toLowerCase()}`,
+    tableWritten: written !== void 0
+  };
+}
+var djangoModelTable = (file, lines, idx, env) => {
+  const m = djangoModelAt(file, lines, idx, env);
+  return m && !m.tableWritten ? [{ kind: "word", value: m.table, rule: "django-table" }] : [];
+};
+var djangoField = (file, lines, idx, env) => {
+  if (djangoAppDir(file) === void 0)
+    return [];
+  const f = /^\s+(\w+)\s*=\s*(?:models\.)?(ManyToManyField|ForeignKey|OneToOneField)\s*\(/.exec(lines[idx] ?? "");
+  if (!f)
+    return [];
+  let args = "";
+  for (let i = idx, depth = 0; i < lines.length && i - idx < 10; i++) {
+    args += `${lines[i]}
+`;
+    depth += (lines[i].match(/\(/g) ?? []).length - (lines[i].match(/\)/g) ?? []).length;
+    if (depth <= 0)
+      break;
+  }
+  let cls = -1;
+  for (let i = idx - 1; i >= 0; i--)
+    if (/^\S/.test(lines[i])) {
+      cls = DJANGO_CLASS.test(lines[i]) ? i : -1;
+      break;
+    }
+  if (cls < 0)
+    return [];
+  const model = djangoModelAt(file, lines, cls, env);
+  if (!model)
+    return [];
+  if (f[2] === "ManyToManyField")
+    return /\b(through|db_table)\s*=/.test(args) ? [] : [{ kind: "word", value: `${model.table}_${f[1]}`, rule: "django-m2m-table" }];
+  return /\bdb_column\s*=/.test(args) ? [] : [{ kind: "field", value: `${f[1]}_id`, rule: "django-fk-column" }];
+};
+var railsModelTable = (file, lines, idx) => {
+  if (!/\.rb$/.test(file))
+    return [];
+  const m = /^class\s+([A-Z]\w*)\s*<\s*(ApplicationRecord|ActiveRecord::Base)\s*$/.exec(lines[idx] ?? "");
+  if (!m)
+    return [];
+  const text = lines.join("\n");
+  if (/self\.table_name\s*=|self\.abstract_class\s*=\s*true/.test(text))
+    return [];
+  return [{ kind: "word", value: pluralize(railsUnderscore(m[1])), rule: "rails-table" }];
+};
+var LARAVEL_CLASS = /^\s*(?:final\s+)?class\s+(\w+)\s+extends\s+\\?(?:Illuminate\\(?:Database\\Eloquent|Foundation\\Auth)\\)?(Model|Authenticatable|User)\b/;
+var laravelModel = (file, lines, idx) => {
+  if (!/\.php$/.test(file))
+    return [];
+  const text = lines.join("\n");
+  if (/^\s*abstract\s+class\b/m.test(text))
+    return [];
+  const own = lines.map((l) => LARAVEL_CLASS.exec(l)).find((m) => m)?.[1];
+  if (!own)
+    return [];
+  const cls = LARAVEL_CLASS.exec(lines[idx] ?? "");
+  if (cls) {
+    if (/protected\s+\$table\s*=/.test(text))
+      return [];
+    return [{ kind: "word", value: laravelSnake(pluralize(cls[1])), rule: "laravel-table" }];
+  }
+  const rel = /->belongsToMany\(\s*(?:[\w\\]*\\)?(\w+)::class\s*\)/.exec(lines[idx] ?? "");
+  if (!rel)
+    return [];
+  const pivot = [laravelSnake(own), laravelSnake(rel[1])].sort().join("_");
+  return [{ kind: "word", value: pivot, rule: "laravel-pivot" }];
+};
+var TS_CLASS = /^\s*export\s+(?:default\s+)?(?:abstract\s+)?class\s+(\w+)/;
+function typeormEntityAt(lines, idx) {
+  const cl = classLineOf(lines, idx, TS_CLASS);
+  if (cl === void 0)
+    return void 0;
+  const { text } = annotationsAbove(lines, cl);
+  const e = /@Entity\s*\(([^)]*)\)/.exec(text);
+  if (!e)
+    return void 0;
+  const name = TS_CLASS.exec(lines[cl])[1];
+  const written = /^\s*["'`]([^"'`]+)["'`]/.exec(e[1])?.[1] ?? /\bname\s*:\s*["'`]([^"'`]+)["'`]/.exec(e[1])?.[1];
+  return { name, table: written ?? typeormSnake(name), written: written !== void 0 };
+}
+var typeorm = (file, lines, idx, env) => {
+  if (!/\.[cm]?[jt]s$/.test(file))
+    return [];
+  const e = typeormEntityAt(lines, idx);
+  if (e)
+    return e.written ? [] : [{ kind: "word", value: e.table, rule: "typeorm-table" }];
+  let prop = -1;
+  for (let j = idx; j < lines.length && j - idx <= 4; j++)
+    if (/^\s*(?:readonly\s+)?\w+[!?]?\s*:\s*[\w.]+\[\]/.test(lines[j]) || /^\s*\w+[!?]?\s*:\s*(?:Array|Promise)<[\w.]+(?:\[\])?>/.test(lines[j])) {
+      prop = j;
+      break;
+    } else if (j > idx && !/^\s*@/.test(lines[j]))
+      break;
+  if (prop < 0)
+    return [];
+  const ann = annotationsAbove(lines, prop, 6).text;
+  const jt = /@JoinTable\s*\(([^)]*)\)/.exec(ann);
+  const mm = /@ManyToMany\s*\(\s*\(\)\s*=>\s*(\w+)/.exec(ann);
+  if (!jt || !mm || /\bname\s*:/.test(jt[1]))
+    return [];
+  const propName = /^\s*(?:readonly\s+)?(\w+)/.exec(lines[prop])[1];
+  let owner;
+  for (let i = prop; i >= 0; i--)
+    if (TS_CLASS.test(lines[i])) {
+      owner = typeormEntityAt(lines, i);
+      break;
+    }
+  const tre = new RegExp(`^\\s*export\\s+(?:default\\s+)?class\\s+${mm[1]}\\b`);
+  const tfile = findClassFile(env, mm[1], file, /\.[cm]?[jt]s$/, (ls) => ls.some((l) => tre.test(l)));
+  const tl = tfile ? env.lines(tfile) ?? [] : [];
+  const ti = tl.findIndex((l) => tre.test(l));
+  const target = ti >= 0 ? typeormEntityAt(tl, ti) : void 0;
+  if (!owner || !target)
+    return [];
+  return [
+    {
+      kind: "word",
+      value: typeormSnake(`${owner.table}_${propName}_${target.table}`),
+      rule: "typeorm-join-table"
+    }
+  ];
+};
+var prismaImplicitM2M = (file, lines, idx) => {
+  if (!/\.prisma$/.test(file))
+    return [];
+  const f = /^\s*(\w+)\s+(\w+)\[\](?:\s+@relation\(\s*(?:name:\s*)?"([^"]+)"([^)]*)\))?\s*$/.exec(lines[idx] ?? "");
+  if (!f || /fields\s*:/.test(f[4] ?? ""))
+    return [];
+  let model;
+  for (let i = idx; i >= 0; i--) {
+    const m = /^\s*model\s+(\w+)\s*\{/.exec(lines[i]);
+    if (m) {
+      model = m[1];
+      break;
+    }
+    if (/^\s*\}/.test(lines[i]))
+      return [];
+  }
+  const target = f[2];
+  if (!model || model === target)
+    return [];
+  const start = lines.findIndex((l) => new RegExp(`^\\s*model\\s+${target}\\s*\\{`).test(l));
+  if (start < 0)
+    return [];
+  let back = false;
+  for (let i = start + 1; i < lines.length && !/^\s*\}/.test(lines[i]); i++) {
+    const b = /^\s*\w+\s+(\w+)\[\](?:\s+@relation\(\s*(?:name:\s*)?"([^"]+)"[^)]*\))?\s*$/.exec(lines[i]);
+    if (b && b[1] === model && b[2] === f[3])
+      back = true;
+  }
+  if (!back)
+    return [];
+  const value = f[3] ? `_${f[3]}` : `_${[model, target].sort().join("To")}`;
+  return [{ kind: "word", value, rule: "prisma-implicit-m2m" }];
+};
+function railsPrefix(lines, idx) {
+  const stack = [];
+  for (let i = 0; i < idx; i++) {
+    const l = lines[i].replace(/#.*$/, "");
+    if (/^\s*end\b/.test(l)) {
+      stack.pop();
+      continue;
+    }
+    if (!/\bdo\s*(\|[^|]*\|)?\s*$/.test(l))
+      continue;
+    const ns = /^\s*namespace\s+:(\w+)(.*)$/.exec(l);
+    const scope = /^\s*scope\b(.*)$/.exec(l);
+    if (ns) {
+      const path = /\bpath:\s*["']([^"']*)["']/.exec(ns[2])?.[1];
+      stack.push(path ?? ns[1]);
+    } else if (scope) {
+      const path = /^\s*\(?\s*["']([^"']*)["']/.exec(scope[1])?.[1] ?? /\bpath:\s*["']([^"']*)["']/.exec(scope[1])?.[1];
+      if (path === void 0 && /^\s*\(?\s*:\w+\s*(?:,|\)|do)/.test(scope[1]))
+        stack.push(null);
+      else if (path !== void 0 && /[()*]/.test(path))
+        stack.push(null);
+      else
+        stack.push(path ?? "");
+    } else if (/(\.routes\.draw|^\s*(constraints|controller|defaults|devise_scope|as|authenticated?|concern)\b)/.test(l))
+      stack.push("");
+    else
+      stack.push(null);
+  }
+  if (stack.includes(null))
+    return void 0;
+  return stack.flatMap((s) => (s ?? "").split("/")).filter(Boolean).map((s) => `/${s}`).join("");
+}
+var railsRoot = (file, lines, idx) => {
+  if (!/(^|\/)config\/routes(\/[^/]+)?\.rb$/.test(file))
+    return [];
+  if (!/^\s*root\s*(\(|\s)\s*(?:to:\s*|:to\s*=>\s*|controller:\s*)?["':]/.test(lines[idx] ?? ""))
+    return [];
+  const prefix = railsPrefix(lines, idx);
+  return prefix === void 0 ? [] : [{ kind: "route", value: prefix || "/", rule: "rails-root" }];
+};
+var DEVISE = [
+  {
+    module: "database_authenticatable",
+    route: "session",
+    paths: (n) => [`/${n("sign_in")}`, `/${n("sign_out")}`]
+  },
+  {
+    module: "registerable",
+    route: "registration",
+    paths: (n) => {
+      const r = n("registration");
+      const at = r ? `/${r}` : "";
+      return [`${at}/${n("sign_up")}`, at || "/", `${at}/${n("edit")}`, `${at}/${n("cancel")}`];
+    }
+  },
+  {
+    module: "recoverable",
+    route: "password",
+    paths: (n) => [
+      `/${n("password")}`,
+      `/${n("password")}/${n("new")}`,
+      `/${n("password")}/${n("edit")}`
+    ]
+  },
+  {
+    module: "confirmable",
+    route: "confirmation",
+    paths: (n) => [`/${n("confirmation")}`, `/${n("confirmation")}/${n("new")}`]
+  },
+  {
+    module: "lockable",
+    route: "unlock",
+    paths: (n) => [`/${n("unlock")}`, `/${n("unlock")}/${n("new")}`]
+  }
+];
+var deviseFor = (file, lines, idx, env) => {
+  if (!/(^|\/)config\/routes(\/[^/]+)?\.rb$/.test(file))
+    return [];
+  const d = /^\s*devise_for\s+:(\w+)(.*)$/.exec(lines[idx] ?? "");
+  if (!d)
+    return [];
+  const prefix = railsPrefix(lines, idx);
+  if (prefix === void 0)
+    return [];
+  let opts = d[2];
+  for (let i = idx + 1; /,\s*$/.test(lines[i - 1].replace(/#.*$/, "")) && i < lines.length; i++)
+    opts += ` ${lines[i].replace(/#.*$/, "")}`;
+  const resource = /\bpath:\s*["']([^"']*)["']/.exec(opts)?.[1] ?? d[1];
+  const list2 = (k) => {
+    const m = new RegExp(`\\b${k}:\\s*(?:\\[([^\\]]*)\\]|:(\\w+))`).exec(opts);
+    return m ? (m[1] ?? `:${m[2]}`).split(",").map((s) => singularize(s.trim().replace(/^:/, ""))).filter(Boolean) : void 0;
+  };
+  const skip = list2("skip") ?? [];
+  const only = list2("only");
+  const names = { registration: "" };
+  const pn = /\bpath_names:\s*\{([^}]*)\}/.exec(opts)?.[1] ?? "";
+  for (const m of pn.matchAll(/(\w+):\s*["']([^"']*)["']/g))
+    names[m[1]] = m[2];
+  const n = (k) => names[k] ?? k;
+  const cls = /\bclass_name:\s*["']([\w:]+)["']/.exec(opts)?.[1] ?? camelize(singularize(d[1]));
+  const modelFile = `app/models/${railsUnderscore(cls)}.rb`;
+  const ml = env.lines(modelFile) ?? env.lines(file.replace(/config\/routes(\/[^/]+)?\.rb$/, modelFile));
+  if (!ml)
+    return [];
+  const start = ml.findIndex((l) => /^\s*devise\s+:/.test(l));
+  if (start < 0)
+    return [];
+  let call = "";
+  for (let i = start; i < ml.length; i++) {
+    call += ` ${ml[i].replace(/#.*$/, "")}`;
+    if (!/,\s*$/.test(ml[i].replace(/#.*$/, "")))
+      break;
+  }
+  const modules = new Set([...call.replace(/\w+:\s*\[[^\]]*\]|\w+:\s*[^,]+/g, "").matchAll(/:(\w+)/g)].map((m) => m[1]));
+  const allowed = (c) => !skip.includes(c) && !skip.includes("all") && (!only || only.includes(c));
+  const at = `${prefix}${resource ? `/${resource}` : ""}`;
+  const out = [];
+  for (const m of DEVISE)
+    if (modules.has(m.module) && allowed(m.route))
+      for (const p of m.paths(n))
+        out.push({ kind: "route", value: p === "/" ? at || "/" : `${at}${p}`, rule: "devise" });
+  if (modules.has("omniauthable") && allowed("omniauth_callback")) {
+    const providers = new Set([...(/omniauth_providers:\s*\[([^\]]*)\]/.exec(call)?.[1] ?? "").matchAll(/:(\w+)/g)].map((m) => m[1]));
+    for (const l of env.lines("config/initializers/devise.rb") ?? [])
+      for (const m of l.matchAll(/^\s*config\.omniauth\s+:(\w+)/g))
+        providers.add(m[1]);
+    for (const p of providers)
+      out.push({ kind: "route", value: `${at}/auth/${p}`, rule: "devise-omniauth" }, { kind: "route", value: `${at}/auth/${p}/callback`, rule: "devise-omniauth" });
+  }
+  return out;
+};
+var springDataRest = (file, lines, idx) => {
+  if (!/\.(java|kt)$/.test(file))
+    return [];
+  const a = /@RepositoryRestResource\b(?:\s*\(([^)]*)\))?/.exec(lines[idx] ?? "");
+  if (!a || /\bexported\s*=\s*false/.test(a[1] ?? ""))
+    return [];
+  let decl = -1;
+  for (let i = idx; i < lines.length && i - idx <= 6; i++)
+    if (/\binterface\s+\w+/.test(lines[i])) {
+      decl = i;
+      break;
+    }
+  if (decl < 0)
+    return [];
+  const domain = /\binterface\s+\w+\s*(?:extends|:)\s*[\w.]+\s*<\s*([\w.]+)\s*,/.exec(lines.slice(decl, decl + 3).join(" "))?.[1];
+  const path = /\bpath\s*=\s*"([^"]+)"/.exec(a[1] ?? "")?.[1] ?? (domain ? (() => {
+    const p = pluralize(domain.split(".").pop());
+    return p[0].toLowerCase() + p.slice(1);
+  })() : void 0);
+  if (!path)
+    return [];
+  const at = `/${path.replace(/^\/+|\/+$/g, "")}`;
+  const out = [
+    { kind: "route", value: at, rule: "spring-data-rest" },
+    { kind: "route", value: `${at}/{id}`, rule: "spring-data-rest" }
+  ];
+  const methods = [];
+  for (let i = decl + 1, depth = 1; i < lines.length && depth > 0; i++) {
+    const l = lines[i];
+    depth += (l.match(/\{/g) ?? []).length - (l.match(/\}/g) ?? []).length;
+    const m = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*[\w<>[\],.?\s]+?\s+((?:find|read|get|query|search|stream|count|exists)\w*)\s*\(/.exec(l) ?? /^\s*fun\s+((?:find|read|get|query|search|stream|count|exists)\w*)\s*\(/.exec(l);
+    if (!m)
+      continue;
+    const rr = /@RestResource\s*\([^)]*\bpath\s*=\s*"([^"]+)"/.exec(`${lines[i - 1] ?? ""} ${l}`)?.[1];
+    methods.push(rr ?? m[1]);
+  }
+  if (methods.length)
+    out.push({ kind: "route", value: `${at}/search`, rule: "spring-data-rest" });
+  for (const m of methods)
+    out.push({
+      kind: "route",
+      value: `${at}/search/${m.replace(/^\/+/, "")}`,
+      rule: "spring-data-rest"
+    });
+  return out;
+};
+var rubyWorker = (file, lines, idx) => {
+  if (!/\.rb$/.test(file))
+    return [];
+  const m = /^(\s*)class\s+((?:\w+::)*\w+)(?:\s*<\s*([\w:]+))?\s*$/.exec(lines[idx] ?? "");
+  if (!m)
+    return [];
+  const activeJob = /^(ApplicationJob|ActiveJob::Base)$/.test(m[3] ?? "") || /(^|\/)app\/jobs\//.test(file) && /Job$/.test(m[3] ?? "");
+  const sidekiq = lines.slice(idx + 1, idx + 6).some((l) => /^\s*include\s+Sidekiq::(Job|Worker)\b/.test(l));
+  if (!activeJob && !sidekiq)
+    return [];
+  const indent = m[1].length;
+  const modules = [];
+  let level = indent;
+  for (let i = idx - 1; i >= 0 && level > 0; i--) {
+    const mm = /^(\s*)(?:module|class)\s+((?:\w+::)*\w+)/.exec(lines[i]);
+    if (mm && mm[1].length < level) {
+      modules.unshift(mm[2]);
+      level = mm[1].length;
+    }
+  }
+  return [
+    {
+      kind: "word",
+      value: [...modules, m[2]].join("::"),
+      rule: sidekiq ? "sidekiq-worker" : "active-job"
+    }
+  ];
+};
+var celeryTask = (file, lines, idx, env) => {
+  if (!/\.py$/.test(file))
+    return [];
+  let def = -1;
+  for (let j = idx; j < lines.length && j - idx <= 4; j++) {
+    if (/^\s*(?:async\s+)?def\s+\w+/.test(lines[j])) {
+      def = j;
+      break;
+    }
+    if (!/^\s*@/.test(lines[j]))
+      break;
+  }
+  if (def < 0)
+    return [];
+  const decorators = [];
+  for (let i = def - 1; i >= 0 && /^\s*@/.test(lines[i]); i--)
+    decorators.push(lines[i]);
+  const task = decorators.find((d) => /^\s*@(?:shared_task|[\w.]+\.task)\b/.test(d));
+  if (!task || /\bname\s*=/.test(task))
+    return [];
+  const fn = /def\s+(\w+)/.exec(lines[def])[1];
+  const parts = file.replace(/\.py$/, "").split("/");
+  if (parts[parts.length - 1] === "__init__")
+    parts.pop();
+  let top = parts.length - 1;
+  while (top > 0 && env.lines(`${parts.slice(0, top).join("/")}/__init__.py`) !== void 0)
+    top--;
+  const module = parts.slice(top).join(".");
+  return [{ kind: "word", value: `${module}.${fn}`, rule: "celery-task" }];
+};
+var RULES = [
+  jpaEntityTable,
+  jpaAssociation,
+  djangoModelTable,
+  djangoField,
+  railsModelTable,
+  laravelModel,
+  typeorm,
+  prismaImplicitM2M,
+  railsRoot,
+  deviseFor,
+  springDataRest,
+  rubyWorker,
+  celeryTask
+];
+var PARAM_SEG = /^(\{[^}]*\}|:[^/]+|<[^>]+>|\$\{[^}]*\})$/;
+var segsOf = (p) => p.split(/[?#]/, 1)[0].split("/").filter(Boolean).map((s) => PARAM_SEG.test(s) ? "{}" : s.toLowerCase());
+var fieldKey = (f) => f.split(".").pop().toLowerCase().replace(/[^a-z0-9]/g, "");
+function derivedHolds(c, derived, partLines, namesPath) {
+  if (c.kind === "word")
+    return derived.some((d) => d.kind === "word" && d.value.toLowerCase() === c.value.trim().toLowerCase());
+  if (c.kind === "field")
+    return derived.some((d) => d.kind === "field" && fieldKey(d.value) === fieldKey(c.value));
+  const claim = segsOf(c.value);
+  return derived.some((d) => {
+    if (d.kind !== "route")
+      return false;
+    const r = segsOf(d.value);
+    if (claim.length === r.length)
+      return claim.every((s, i) => s === r[i]);
+    if (!partLines.length || claim.length < r.length)
+      return false;
+    const head = claim.slice(0, claim.length - r.length);
+    if (!claim.slice(head.length).every((s, i) => s === r[i]))
+      return false;
+    const original = c.value.split(/[?#]/, 1)[0].split("/").filter(Boolean).slice(0, head.length);
+    return original.some((s) => !PARAM_SEG.test(s)) && namesPath(partLines, `/${original.join("/")}`);
+  });
+}
+function derivedNamesAt(file, lines, line, env) {
+  const out = [];
+  for (let i = Math.max(0, line - 2); i <= Math.min(lines.length - 1, line); i++) {
+    if (isComment(lines[i]))
+      continue;
+    for (const r of RULES)
+      out.push(...r(file, lines, i, env));
+  }
+  return out;
+}
+
+// packages/verify/dist/not-product.js
+var LOCALE_BUNDLE = /(^|\/)(i18n|l10n|locales?|lang|langs|languages|translations?)\/(.+\/)?[^/]+\.(json|ya?ml|properties)$|(^|\/)res\/values[^/]*\/(strings|plurals|arrays)\.xml$/i;
+function isLocaleBundle(path) {
+  return LOCALE_BUNDLE.test(path);
+}
+var DATA_FILE_LINES = 2e3;
+var DATA_FILE_CHARS = 2e5;
+var DATA_EXT = /\.(json|xml)$/i;
+var KEEP_BIG = /(^|\/)(pom\.xml|package\.json|composer\.json|angular\.json|project\.json|nx\.json|lerna\.json|workspace\.json|tsconfig[^/]*\.json|jsconfig\.json|appsettings[^/]*\.json|launchSettings\.json|[^/]*(openapi|swagger|asyncapi|api-docs)[^/]*\.(json|xml)|[^/]*mapper[^/]*\.xml)$|(^|\/)(config|configuration|migrations?|db|database|changelogs?|liquibase|flyway)\//i;
+function isDataFile(path, lines) {
+  if (!DATA_EXT.test(path) || KEEP_BIG.test(path))
+    return false;
+  if (lines.length - (lines[lines.length - 1] === "" ? 1 : 0) > DATA_FILE_LINES)
+    return true;
+  let chars = 0;
+  for (const l of lines)
+    if ((chars += l.length + 1) > DATA_FILE_CHARS)
+      return true;
+  return false;
+}
+
+// packages/verify/dist/pages.js
+function pageRouteOf(file, lines, exists) {
+  const first = lines.find((l) => l.trim() !== "")?.trim() ?? "";
+  const razor = /(?:^|\/)(?:Areas\/([^/]+)\/)?Pages\/(.+)\.cshtml$/.exec(file);
+  if (razor && /^@page\b/.test(first)) {
+    const template = /^@page\s+"([^"]*)"/.exec(first)?.[1];
+    if (template?.startsWith("/"))
+      return template;
+    const rel = razor[2].replace(/(^|\/)Index$/, "");
+    const path = `${razor[1] ? `/${razor[1]}` : ""}/${rel}`.replace(/\/+$/, "") || "/";
+    return template ? `${path.replace(/\/$/, "")}/${template}` : path;
+  }
+  if (/\.aspx$/i.test(file) && lines.some((l) => /<%@\s*Page\b/i.test(l))) {
+    const dirs = file.split("/").slice(0, -1);
+    for (let n = dirs.length; n >= 0; n--) {
+      const root = dirs.slice(0, n).join("/");
+      const at = (name) => root ? `${root}/${name}` : name;
+      if (exists(at("Web.config")) || exists(at("web.config")))
+        return `/${file.slice(root ? root.length + 1 : 0)}`;
+    }
+    return void 0;
+  }
+  const param = (s) => s.replace(/^\[\[?(?:\.\.\.)?([^\]]+)\]\]?$/, "{$1}");
+  const app = /(?:^|\/)(?:src\/)?app\/((?:.+\/)?)page\.[jt]sx?$/.exec(file);
+  if (app)
+    return "/" + app[1].split("/").filter((s) => s && !/^\(.*\)$/.test(s) && !s.startsWith("@")).map(param).join("/");
+  const pages = /(?:^|\/)(?:src\/)?pages\/(.+)\.[jt]sx?$/.exec(file);
+  if (pages && !/(^|\/)_(app|document|error)$/.test(pages[1]))
+    return "/" + pages[1].replace(/(^|\/)index$/, "").split("/").filter(Boolean).map(param).join("/");
+  return void 0;
+}
+function pageRouteMatches(file, lines, exists, path) {
+  const route = pageRouteOf(file, lines, exists);
+  if (route === void 0)
+    return false;
+  const norm = (p) => normalizePath(p.replace(/\{([^}:?]*)[^}]*\}/g, "{$1}")).toLowerCase() || "/";
+  return norm(route) === norm(path);
+}
+
+// packages/verify/dist/reviewed.js
+var SHAPE = `{"path": "<file or glob>", "why": "..."}`;
+function parseReviewed(text) {
+  const entries = [];
+  const bad = [];
+  text.split(/\r?\n/).forEach((raw, i) => {
+    if (!raw.trim())
+      return;
+    const line = i + 1;
+    let json2;
+    try {
+      json2 = JSON.parse(raw);
+    } catch (e) {
+      bad.push({ line, raw, message: `line ${line} is not JSON: ${e.message}` });
+      return;
+    }
+    const o = json2;
+    const issues = [];
+    if (!o || typeof o !== "object" || Array.isArray(o))
+      issues.push("not an object");
+    else {
+      if (typeof o.path !== "string" || !o.path.trim())
+        issues.push("path: a file or glob");
+      if (typeof o.why !== "string" || !o.why.trim())
+        issues.push("why: why it holds nothing");
+      const extra = Object.keys(o).filter((k) => k !== "path" && k !== "why");
+      if (extra.length)
+        issues.push(`unknown keys: ${extra.join(", ")}`);
+    }
+    if (issues.length) {
+      bad.push({ line, raw, message: `line ${line} isn't ${SHAPE}: ${issues.join("; ")}` });
+      return;
+    }
+    entries.push({ line, path: o.path.trim(), why: o.why.trim() });
+  });
+  return { entries, bad };
+}
+var isGlob = (path) => /[*?]/.test(path);
+
+// packages/verify/dist/verify.js
+var FOLLOWED_TYPES = ["event-topic", "mq-queue", "rest", "grpc"];
+function entriesNoFlowFollows(facts) {
+  const started = new Set(facts.flatMap((f) => f.kind === "flow" ? [f.entry] : []));
+  return facts.flatMap((f) => f.kind === "entry" && FOLLOWED_TYPES.includes(f.entryType) && !started.has(f.id) && // An Apigee route forwards; its forwarding call is its flow (ADR 0124 addendum A-gateway).
+  !APIGEE_BUNDLE.test(f.cite.file) ? [
+    {
+      id: f.id,
+      entryType: f.entryType,
+      ...f.method ? { method: f.method } : {},
+      path: f.path,
+      cite: `${f.cite.file}:${f.cite.line}`
+    }
+  ] : []).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+var LINES_HELD = 64;
+var SOURCE_EXT = /\.(java|kt|kts|scala|groovy|cs|vb|fs|ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|php|swift|m|mm|c|cc|cpp|h|hpp|sql|graphql|gql|proto|ya?ml|json|xml|properties|toml|ini|conf|tf|tfvars|hcl|bicep|sh|ps1|bat|cmd|gradle|html?|vue|svelte|cshtml|razor|aspx|jsp|ftl|hbs|cob|cbl|cpy|jcl|avsc|wsdl|xsd|csproj|sln|config)$/i;
+var SOURCE_NAME = /(^|\/)(Dockerfile[^/]*|Makefile|Jenkinsfile|Procfile|Containerfile)$/;
+var LOCKFILE = /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|Gemfile\.lock|Cargo\.lock|poetry\.lock|go\.sum|packages\.lock\.json)$/;
+var NOT_PRODUCT = [
+  /(^|\/)(src\/test|src\/it|test|tests|__tests__|__mocks__|spec|specs|e2e|testdata|test-data|fixtures)\//i,
+  /(\.|_|-)(test|spec|tests|specs)\.[a-z0-9]+$/i,
+  /(Test|Tests|IT|Spec)\.(java|kt|scala|groovy|cs|vb)$/,
+  /(^|\/)test_[^/]+\.py$/,
+  /(^|\/)(mvnw|mvnw\.cmd|gradlew|gradlew\.bat)$/,
+  /(^|\/)package-info\.java$/,
+  /(^|\/)messages(_[A-Za-z_]+)?\.properties$/,
+  /\.(resx|po|pot)$/i
+];
+function isSourceFile(path, firstLine = "", lines) {
+  if (isSecretPath(path) || LOCKFILE.test(path))
+    return false;
+  if (NOT_PRODUCT.some((re) => re.test(path)) || isLocaleBundle(path))
+    return false;
+  if (lines && isDataFile(path, lines))
+    return false;
+  if (quoteNotRequired(path, firstLine))
+    return false;
+  return SOURCE_EXT.test(path) || SOURCE_NAME.test(path);
+}
+var lastPart = (s) => s.split(".").pop() ?? s;
+var isCommentLine = (l) => /^\s*(\/\/|\/\*|\*|<!--|-- |#(?!\s*(region|endregion|if|elif|else|endif|define|undef|pragma|nullable|include|import)\b)(?!!))/.test(l);
+var routeOrWord = (v) => v.includes("/") ? { kind: "route", value: v } : { kind: "word", value: v };
+function claimsOf(f) {
+  switch (f.kind) {
+    case "entry":
+    case "call":
+      return [routeOrWord(f.path)];
+    case "store":
+      return [
+        { kind: "word", value: f.name },
+        { kind: "word", value: lastPart(f.name) }
+      ];
+    case "field":
+      return [{ kind: "field", value: f.name }];
+    case "deploy":
+      return [{ kind: "word", value: f.resourceName ?? f.cite.value }];
+    // A-framework: the declaration as the build file writes it (`spring-boot-starter-parent`,
+    // `Microsoft.NET.Sdk.Web`, `express`). The framework's own name follows from it, and is
+    // checked against what Atticus knows that declaration to mean, not against the line.
+    case "framework":
+      return [
+        { kind: "word", value: f.cite.value },
+        { kind: "word", value: f.name }
+      ];
+    case "config": {
+      const tail = f.key.trim().split(/\s+/).pop().replace(/^-+/, "");
+      const lastOf = (k) => k.split(/[.:]|__/).pop() ?? k;
+      return [
+        { kind: "word", value: f.key },
+        { kind: "word", value: lastPart(f.key) },
+        { kind: "word", value: tail },
+        { kind: "word", value: lastOf(tail) }
+      ];
+    }
+    case "flow":
+      return [routeOrWord(f.cite.value)];
+  }
+}
+var sameCommit = (a, b) => a.startsWith(b) || b.startsWith(a);
+function changesFor(carry, commit) {
+  if (!carry)
+    return void 0;
+  const key = Object.keys(carry).find((k) => sameCommit(k, commit));
+  return key === void 0 ? void 0 : carry[key];
+}
+function staleMessage(f, s, commit) {
+  const how = s.how === "renamed" ? `renamed to ${s.to}` : s.how;
+  const then = s.how === "deleted" ? "drop the fact, or cite where the code says it now" : "rewrite the fact with its line as it is now, or drop it";
+  return `${f.kind} ${f.id} cites ${s.file}, which was ${how} since commit ${f.commit}; read it again at ${commit}, then ${then}`;
+}
+function refsOf(f) {
+  const out = [];
+  const add = (field, id) => {
+    if (id !== void 0)
+      out.push({ field, id });
+  };
+  if (f.kind === "call")
+    add("from", f.from);
+  if (f.kind === "store")
+    add("under", f.under);
+  if (f.kind === "field") {
+    add("owner", f.owner);
+    add("mappedTo", f.mappedTo);
+  }
+  if (f.kind === "flow") {
+    add("entry", f.entry);
+    f.steps.forEach((s, i) => add(`steps.${i + 1}.ref`, s.ref));
+  }
+  return out;
+}
+async function verifyFacts(o) {
+  const carriedFrom = /* @__PURE__ */ new Map();
+  const stale = /* @__PURE__ */ new Map();
+  const corrected = applyCorrections(o.facts, o.corrections ?? []);
+  const facts = [...corrected.facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((f) => {
+    if (!o.commit || sameCommit(f.commit, o.commit))
+      return f;
+    const changes = changesFor(o.carry, f.commit);
+    if (!changes)
+      return f;
+    const s = staleCite(f, changes);
+    if (s) {
+      stale.set(f.id, s);
+      return f;
+    }
+    carriedFrom.set(f.id, f.commit);
+    return { ...f, commit: o.commit };
+  });
+  const readLines = (path) => {
+    const text = insideRepo(path) && !isSecretPath(path) ? o.source.read(path) : void 0;
+    return text === void 0 ? void 0 : text.replace(/\r\n?/g, "\n").split("\n");
+  };
+  const linesCache = /* @__PURE__ */ new Map();
+  const linesOf2 = (path) => {
+    if (linesCache.has(path)) {
+      const held = linesCache.get(path);
+      linesCache.delete(path);
+      linesCache.set(path, held);
+      return held;
+    }
+    const lines = readLines(path);
+    linesCache.set(path, lines);
+    if (linesCache.size > LINES_HELD)
+      linesCache.delete(linesCache.keys().next().value);
+    return lines;
+  };
+  let fileList;
+  const deriveEnv = { lines: linesOf2, files: () => fileList ??= o.source.list() };
+  const checkCite = (cite2, claims, label, withHint = true) => {
+    const where = `${cite2.file}:${cite2.line}`;
+    if (!insideRepo(cite2.file))
+      return {
+        code: "outside-repo",
+        message: `${label} cites ${cite2.file}, which is outside the repo`
+      };
+    if (isSecretPath(cite2.file))
+      return {
+        code: "secret-path",
+        message: `${label} cites ${cite2.file}, a file whose lines are never quoted into a map; cite where the code reads the setting instead`
+      };
+    const lines = linesOf2(cite2.file);
+    if (lines === void 0)
+      return {
+        code: "no-file",
+        message: `${label} cites ${cite2.file}, which is not in the repo at this commit`
+      };
+    if (cite2.line > lines.length)
+      return {
+        code: "no-line",
+        message: `${label} cites line ${cite2.line} of ${cite2.file}, which has ${lines.length} lines`
+      };
+    const parts = cite2.with ?? [];
+    const near = (ls, n) => ls.slice(Math.max(0, n - 2), n + 1);
+    const partLines = [];
+    for (const [i, p] of parts.entries()) {
+      const pl = `${label} part ${i + 1}`;
+      if (!insideRepo(p.file))
+        return {
+          code: "outside-repo",
+          message: `${pl} cites ${p.file}, which is outside the repo`
+        };
+      if (isSecretPath(p.file))
+        return {
+          code: "secret-path",
+          message: `${pl} cites ${p.file}, a file never quoted into a map`
+        };
+      const ls = linesOf2(p.file);
+      if (ls === void 0)
+        return {
+          code: "no-file",
+          message: `${pl} cites ${p.file}, which is not in the repo at this commit`
+        };
+      if (p.line > ls.length)
+        return {
+          code: "no-line",
+          message: `${pl} cites line ${p.line} of ${p.file}, which has ${ls.length} lines`
+        };
+      if (!claimOnLines(ls, p.line, routeOrWord(p.value)) && !claimOnLines(ls, p.line, { kind: "word", value: p.value.replace(/^\/+|\/+$/g, "") }) && // a part named at a camelCase start (`Catalog` in `CatalogController`), as the path check does
+      !partsNamePath(near(ls, p.line), p.value))
+        return {
+          code: "claim-not-on-line",
+          message: `${pl} says "${p.value}" is written at ${p.file}:${p.line} (or the line either side), and it isn't`
+        };
+      partLines.push(...near(ls, p.line));
+    }
+    let derived;
+    const derivedHere = () => derived ??= [
+      { file: cite2.file, line: cite2.line },
+      ...parts.map((p) => ({ file: p.file, line: p.line }))
+    ].flatMap((at) => derivedNamesAt(at.file, linesOf2(at.file) ?? [], at.line, deriveEnv));
+    const holds = (c) => claimOnLines(lines, cite2.line, c) || // a framework that routes by file place (Razor Pages, WebForms, Next.js)
+    c.kind === "route" && pageRouteMatches(cite2.file, lines, (p) => linesOf2(p) !== void 0, c.value) || parts.length > 0 && (c.kind === "route" ? partsNamePath([...near(lines, cite2.line), ...partLines], c.value) : partLines.some((l) => lineNamesClaim(l, c)) || // a word put together from parts (`namespace:task`, a key a helper prefixes)
+    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines, cite2.line))) || derivedHolds(c, derivedHere(), partLines, partsNamePath);
+    if (claims && !claims.some(holds))
+      return {
+        code: "claim-not-on-line",
+        message: `${label} claims ${claims.map((c) => `"${c.value}"`).join(" or ")}, which ${where} (or the line either side)${parts.length ? " and its parts" : ""} does not name${parts.length || !withHint ? "" : "; if it is put together from other lines (a base URL, a prefix, a context path), cite them in cite.with"}`
+      };
+    if (claims && !parts.length) {
+      const naming = [cite2.line - 1, cite2.line, cite2.line + 1].map((n) => lines[n - 1]).filter((l) => l !== void 0 && claims.some((c) => lineNamesClaim(l, c)));
+      if (naming.length && !/(^|\/)_redirects$/.test(cite2.file) && naming.every(isCommentLine))
+        return {
+          code: "claim-in-comment",
+          message: `${label} claims ${claims.map((c) => `"${c.value}"`).join(" or ")}, which ${where} writes only in a comment; cite the code that does it`
+        };
+    }
+    const line = lines[cite2.line - 1] ?? "";
+    if (cite2.quote && !quoteNotRequired(cite2.file, line)) {
+      const near2 = [cite2.line - 1, cite2.line, cite2.line + 1].map((n) => lines[n - 1] ?? "");
+      if (!near2.some((l) => quoteMatches(l, cite2.quote)))
+        return {
+          code: "quote-mismatch",
+          message: `${label} quotes "${cite2.quote}", but ${where} reads "${line.trim().slice(0, 200)}"`
+        };
+    }
+    return void 0;
+  };
+  const found = /* @__PURE__ */ new Map();
+  const other = /* @__PURE__ */ new Set();
+  const problem = (fact, code2, message) => found.set(fact.id, [...found.get(fact.id) ?? [], { code: code2, message }]);
+  const add = (fact, p) => {
+    if (p)
+      problem(fact, p.code, p.message);
+  };
+  const stepClaims = (kind, value) => {
+    if (kind === "validate")
+      return value.includes("/") ? [routeOrWord(value), { kind: "word", value }] : [routeOrWord(value)];
+    return NEVER_CHECKED_STEPS.includes(kind) ? void 0 : [routeOrWord(value)];
+  };
+  for (const f of facts) {
+    const label = `${f.kind} ${f.id}`;
+    if (o.commit && !sameCommit(f.commit, o.commit)) {
+      other.add(f.id);
+      const early = !insideRepo(f.cite.file) ? "outside-repo" : isSecretPath(f.cite.file) ? "secret-path" : void 0;
+      if (early)
+        add(f, checkCite(f.cite, void 0, label));
+      else if (stale.has(f.id))
+        problem(f, "cite-changed", staleMessage(f, stale.get(f.id), o.commit));
+      else
+        problem(f, "wrong-commit", `${label} was read at ${f.commit}, not at ${o.commit}; read it again`);
+      continue;
+    }
+    add(f, checkCite(f.cite, claimsOf(f), label));
+    if (f.kind === "entry" && f.authCite)
+      add(f, checkCite({ ...f.authCite }, [{ kind: "word", value: f.authCite.value }], `${label} authCite${f.auth ? ` (auth ${f.auth})` : ""}`, false));
+    if (f.kind === "entry" && f.authCite && f.auth) {
+      const bad = authPolicyMismatch(f.auth, f.authCite.file, f.authCite.value, linesOf2);
+      if (bad)
+        problem(f, "auth-policy-kind", `${label} claims auth ${f.auth} on a line that attaches ${f.authCite.value}, a ${bad.element} policy (${bad.path}), which ${bad.makes ? `checks ${bad.makes.map(authChecks).join(" or ")}, not ${authChecks(f.auth)}` : "authenticates nobody"}; cite the line that attaches the check, or write the auth the policy makes`);
+    }
+    if (f.kind === "entry")
+      (f.scopes ?? []).forEach((s, i) => add(f, checkCite(s, [{ kind: "word", value: s.value }], `${label} scope ${i + 1} ("${s.value}")`)));
+    if (f.kind === "entry")
+      (f.callers ?? []).forEach((c, i) => add(f, checkCite(c, [{ kind: "word", value: c.value }], `${label} caller ${i + 1} (${c.as} "${c.value}")`)));
+    if (f.kind === "framework") {
+      const bad = frameworkNameProblem(f);
+      if (bad)
+        problem(f, "framework-name", `${label} ${bad}`);
+      if (f.version !== void 0)
+        add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
+    }
+    if (f.kind === "flow") {
+      f.steps.forEach((s, i) => add(f, checkCite(s.cite, stepClaims(s.kind, s.cite.value), `${label} step ${i + 1}`)));
+      f.errors.forEach((e, i) => add(f, checkCite(e.cite, [routeOrWord(e.cite.value)], `${label} error ${i + 1}`)));
+    }
+  }
+  const ids = new Set(facts.map((f) => f.id));
+  for (const f of facts) {
+    if (other.has(f.id))
+      continue;
+    for (const d of refsOf(f).filter((r) => !ids.has(r.id)))
+      problem(f, "dangling-ref", `${f.kind} ${f.id} names ${d.field} "${d.id}", which is no fact in this file`);
+  }
+  const byId = new Map(facts.map((f) => [f.id, f]));
+  for (const f of facts) {
+    if (other.has(f.id) || f.kind !== "flow")
+      continue;
+    f.steps.forEach((s, i) => {
+      if (s.kind !== "call-out")
+        return;
+      const to = s.ref === void 0 ? void 0 : byId.get(s.ref);
+      if (to?.kind === "call" || to?.kind === "config")
+        return;
+      if (s.ref !== void 0 && !to)
+        return;
+      const what = s.ref === void 0 ? "names no fact" : `names ${to.kind} ${s.ref}`;
+      problem(f, "call-out-no-call", `flow ${f.id} step ${i + 1} is a call-out that ${what} (${s.cite.file}:${s.cite.line}): give it ref, the id of the call fact it makes, or, for a call through a cloud SDK with no path, the config fact of the client's setting; or make it another kind of step if it calls nothing`);
+    });
+  }
+  for (const f of facts) {
+    if (other.has(f.id) || f.kind !== "flow")
+      continue;
+    f.steps.forEach((s, i) => {
+      if (s.kind !== "publish")
+        return;
+      const to = s.ref === void 0 ? void 0 : byId.get(s.ref);
+      if (to?.kind === "call" && (to.callType === "event-topic" || to.callType === "mq-queue"))
+        return;
+      if (s.ref !== void 0 && !to)
+        return;
+      const what = to === void 0 ? "names no fact" : `names ${to.kind === "call" ? `a ${to.callType} call` : to.kind} ${s.ref}`;
+      problem(f, "publish-no-event", `flow ${f.id} step ${i + 1} is a publish that ${what} (${s.cite.file}:${s.cite.line}): give it ref, the id of the event-topic or mq-queue call fact it publishes (write that call fact if there is none); or make it another kind of step if it publishes nothing`);
+    });
+  }
+  const rejected = /* @__PURE__ */ new Map();
+  for (const f of facts) {
+    const ps = found.get(f.id);
+    if (!ps?.length)
+      continue;
+    rejected.set(f.id, ps.length === 1 ? { fact: f, ...ps[0] } : {
+      fact: f,
+      code: ps[0].code,
+      message: ps.map((p, i) => `(${i + 1}) ${p.message}`).join(" "),
+      problems: ps
+    });
+  }
+  for (let changed = true; changed; ) {
+    changed = false;
+    for (const f of facts) {
+      if (rejected.has(f.id))
+        continue;
+      const r = refsOf(f).find((x) => rejected.has(x.id));
+      if (r) {
+        rejected.set(f.id, {
+          fact: f,
+          code: "ref-rejected",
+          message: `${f.kind} ${f.id} names ${r.field} "${r.id}", which was rejected (${rejected.get(r.id).code})`
+        });
+        changed = true;
+      }
+    }
+  }
+  let redacted = 0;
+  let quotesDropped = 0;
+  const fixQuote = (c) => {
+    if (!c.quote)
+      return c;
+    const line = (linesOf2(c.file) ?? [])[c.line - 1] ?? "";
+    if (quoteNotRequired(c.file, line) && !quoteMatches(line, c.quote)) {
+      quotesDropped++;
+      const { quote: _drop, ...rest } = c;
+      return rest;
+    }
+    const q = redactSecrets(c.quote);
+    if (q !== c.quote)
+      redacted++;
+    return { ...c, quote: q };
+  };
+  const authUncited = [];
+  const accepted = facts.filter((f) => !rejected.has(f.id)).map((f) => {
+    o.room?.();
+    const verified = f.by === "person" && f.verified !== "none" ? f.verified : "line";
+    const base = { ...f, verified, cite: fixQuote(f.cite) };
+    if (base.kind === "entry" && base.auth !== void 0 && !base.authCite && f.by !== "person")
+      authUncited.push({
+        id: base.id,
+        auth: base.auth,
+        cite: `${base.cite.file}:${base.cite.line}`
+      });
+    if (base.kind === "flow")
+      return {
+        ...base,
+        steps: base.steps.map((s) => ({ ...s, cite: fixQuote(s.cite) })),
+        errors: base.errors.map((e) => ({ ...e, cite: fixQuote(e.cite) }))
+      };
+    return base;
+  });
+  const excludeRes = (o.exclude ?? []).map(globToRegExp);
+  const sources = [];
+  const excluded = [];
+  for (const p of o.source.list()) {
+    o.room?.();
+    const ls = readLines(p) ?? [""];
+    if (!isSourceFile(p, ls[0] ?? "", ls))
+      continue;
+    if (excludeRes.some((re) => re.test(p)))
+      excluded.push(p);
+    else
+      sources.push(p);
+  }
+  const touched = new Set(o.routed ?? []);
+  for (const f of accepted)
+    for (const p of citedFiles(f))
+      touched.add(p);
+  const allFiles = o.source.list();
+  const isSource = new Set(sources);
+  const reviewedSet = /* @__PURE__ */ new Set();
+  const reviewed = [];
+  const reviewedProblems = [];
+  for (const r of o.reviewed ?? []) {
+    const refuse = (message) => reviewedProblems.push({
+      ...r.line !== void 0 ? { line: r.line } : {},
+      path: r.path,
+      why: r.why,
+      message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} ${message}`
+    });
+    if (!insideRepo(r.path)) {
+      refuse("is outside the repo");
+      continue;
+    }
+    if (isSecretPath(r.path)) {
+      refuse("is a secret's file, which is never read into a map");
+      continue;
+    }
+    const re = isGlob(r.path) ? globToRegExp(r.path) : void 0;
+    const matched = re ? allFiles.filter((p) => re.test(p)) : allFiles.filter((p) => p === r.path);
+    if (!matched.length) {
+      refuse(re ? "matches no file in the repo at this commit; name the files you read" : "is not in the repo at this commit; name a file you read");
+      continue;
+    }
+    const files = matched.filter((p) => isSource.has(p) && !touched.has(p)).sort();
+    for (const p of files)
+      reviewedSet.add(p);
+    reviewed.push({ path: r.path, why: r.why, files });
+  }
+  const read = sources.filter((p) => touched.has(p)).sort();
+  const reviewedFiles = sources.filter((p) => reviewedSet.has(p)).sort();
+  const unknown = sources.filter((p) => !touched.has(p) && !reviewedSet.has(p)).sort();
+  const total = read.length + reviewedFiles.length + unknown.length;
+  const ratio = total === 0 ? 1 : Math.round(read.length / total * 1e3) / 1e3;
+  return {
+    accepted,
+    // a rejected fact goes back as it was read, at its own commit, even one that was carried
+    rejected: [...rejected.values()].map((r) => carriedFrom.has(r.fact.id) ? { ...r, fact: { ...r.fact, commit: carriedFrom.get(r.fact.id) } } : r).sort((a, b) => a.fact.id < b.fact.id ? -1 : a.fact.id > b.fact.id ? 1 : 0),
+    coverage: { read, reviewed: reviewedFiles, unknown, excluded: excluded.sort(), ratio },
+    redacted,
+    quotesDropped,
+    carried: accepted.flatMap((f) => carriedFrom.has(f.id) ? [{ id: f.id, from: carriedFrom.get(f.id) }] : []),
+    corrections: { applied: corrected.applied, stale: corrected.stale },
+    entriesNoFlowFollows: entriesNoFlowFollows(accepted),
+    reviewed,
+    reviewedProblems,
+    authUncited: authUncited.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0),
+    frameworkGaps: frameworkGaps(accepted)
+  };
+}
+
+// packages/verify/dist/batches.js
+var BUILD = /(^|\/)(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|go\.mod|Cargo\.toml|pyproject\.toml|setup\.py|requirements[^/]*\.txt|Gemfile|[^/]+\.gemspec|composer\.json|[^/]+\.(csproj|sln|tf|tfvars|bicep|hcl)|Dockerfile[^/]*|Containerfile|Jenkinsfile|Makefile|Procfile|(docker-)?compose[^/]*\.ya?ml|Chart\.yaml|values[^/]*\.ya?ml|azure-pipelines[^/]*\.ya?ml|\.gitlab-ci\.yml|bitbucket-pipelines\.yml|serverless\.ya?ml|template\.ya?ml|manifest\.ya?ml)$/;
+var DEPLOY_DIR = /(^|\/)(\.github\/workflows|\.circleci|k8s|kubernetes|helm|charts|deploy|deployment|deployments|manifests|infra|terraform|pipelines?)\//;
+var CONFIG = /(^|\/)((application|bootstrap)[^/]*\.(ya?ml|properties)|appsettings[^/]*\.json|[^/]+\.(properties|conf|ini|toml)|web\.config|config\/[^/]+\.(ya?ml|json))$/;
+var ENTRY_NAME = /(^|[._-])(main|app|application|server|program|startup|index|lambda|handler|function|cli)$|(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|api|job|scheduler|worker|webhook|servlet|page|screen|view)$/i;
+var ENTRY_DIR = /(^|\/)(controllers?|routes|routers|handlers|api|endpoints|jobs|listeners|consumers|functions|pages|screens)\//i;
+var BOUNDARY_NAME = /(client|gateway|repository|repo|dao|mapper|entity|model|dto|request|response|publisher|producer|store|cache|schema)$/i;
+var BOUNDARY_FILE = /\.(sql|proto|graphql|gql|avsc|wsdl|xsd)$|(^|\/)(openapi|swagger)[^/]*\.(ya?ml|json)$/i;
+var BOUNDARY_DIR = /(^|\/)(clients?|gateways?|repositories|dao|models?|entities|dto|migrations?)\//i;
+var TEST = /(^|\/)(test|tests|__tests__|spec|specs|e2e|it)\/|[._-](test|spec)\.[^/.]+$|(Test|Tests|IT|Spec)\.[^/.]+$|(^|\/)test_[^/]+$|_test\.go$/;
+var stem = (path) => {
+  const base = path.slice(path.lastIndexOf("/") + 1);
+  const dot = base.indexOf(".");
+  return dot > 0 ? base.slice(0, dot) : base;
+};
+function readingRank(path) {
+  if (TEST.test(path))
+    return 5;
+  if (BUILD.test(path) || DEPLOY_DIR.test(path))
+    return 0;
+  if (CONFIG.test(path))
+    return 1;
+  const s = stem(path);
+  if (ENTRY_NAME.test(s) || ENTRY_DIR.test(path))
+    return 2;
+  if (BOUNDARY_NAME.test(s) || BOUNDARY_FILE.test(path) || BOUNDARY_DIR.test(path))
+    return 3;
+  return 4;
+}
+var FILE_KINDS = [
+  "frontend",
+  "backend",
+  "routes",
+  "data",
+  "deploy",
+  "config",
+  "protocols",
+  "flows",
+  "gateway",
+  "mocks"
+];
+var SSO_FILE = /(^|\/)(sso|oidc|keycloak|okta|auth0)[^/]*\.[a-z]+$/i;
+var GATEWAY_FILE = /(^|\/)(apiproxy|sharedflowbundle)\/|(^|\/)(targetservers?|kvms?)\.json$|(^|\/)resources\/edge\/(env|org|api)\//i;
+var GATEWAY_KINDS = ["config", "gateway"];
+var ANY_KINDS = FILE_KINDS.filter((k) => k !== "gateway" && k !== "mocks");
+var BACKEND_KINDS = ["backend", "routes", "data", "protocols", "flows"];
+var FRONTEND_KINDS = ["frontend", "flows"];
+var PAGE_KINDS = ["frontend", "routes", "flows"];
+var CODE_KINDS = ["frontend", ...BACKEND_KINDS];
+var DATAFILE_KINDS = [
+  "routes",
+  "data",
+  "deploy",
+  "config",
+  "protocols"
+];
+var SERVER_CODE = /\.(java|kt|kts|scala|groovy|cs|vb|fs|py|rb|go|rs|php|c|cc|cpp|h|hpp|cob|cbl|cpy|jcl)$/i;
+var DEVICE_CODE = /\.(swift|m|mm)$/i;
+var SCRIPT_CODE = /\.(ts|js|mjs|cjs)$/i;
+var SPA_FILE = /\.(tsx|jsx|vue|svelte)$|\.(component|directive|pipe)\.([jt]s|html)$/i;
+var PAGE_FILE = /\.(html?|cshtml|razor|aspx|ascx|master|jsp|ftl|hbs)$/i;
+var PAGE_CODE = /\.(cshtml|razor|aspx|ascx|master)\.(cs|vb)$/i;
+var SERVER_UI = /(^|\/)(app|pages|routes|server|api)\//;
+var FRONT_DIR = /(^|\/)(components|hooks|composables|views|screens|public|static|assets|wwwroot|ClientApp|frontend|front-end)\//i;
+var BACK_SCRIPT = /\.(controller|resolver|gateway|entity|repository|module|guard|middleware|consumer|processor)\.[jt]s$|(^|\/)(server|functions|lambdas?|src\/main)\//;
+var DEVICE_DIR = /(^|\/)(android|ios|mobile|ui|screens?|activities|fragments|compose)\//i;
+var CONFIG_CODE = /(^|\/)(config|configuration|settings|environments?)(\/|\.[^/]+$)|(^|\/)environment[^/]*\.[jt]s$/i;
+var IAC = /\.(tf|tfvars|hcl|bicep)$|(^|\/)(serverless|template)[^/]*\.ya?ml$|(^|\/)(cdk|pulumi|terraform)\//;
+var DATA_FILE = /\.sql$|(^|\/)(migrations?|db|database|changelogs?|liquibase|flyway)\//i;
+var CONTRACT = /\.(proto|avsc|wsdl|xsd)$/i;
+var API_SCHEMA = /\.(graphql|gql)$|(^|\/)(openapi|swagger|asyncapi)[^/]*\.(ya?ml|json)$/i;
+var STRUCTURED = /\.(ya?ml|json|xml|config|properties|toml|ini|conf)$/i;
+function fileKinds(path) {
+  if (GATEWAY_FILE.test(path))
+    return [...GATEWAY_KINDS];
+  const k = /* @__PURE__ */ new Set();
+  const add = (ks) => ks.forEach((x) => k.add(x));
+  if (BUILD.test(path) || DEPLOY_DIR.test(path)) {
+    add(["deploy", "config"]);
+    if (IAC.test(path))
+      add(DATAFILE_KINDS);
+  }
+  if (CONFIG.test(path))
+    add(["config"]);
+  if (DATA_FILE.test(path))
+    add(["data"]);
+  if (CONTRACT.test(path))
+    add(["protocols"]);
+  if (API_SCHEMA.test(path))
+    add(["routes", "protocols"]);
+  const isCode = SERVER_CODE.test(path) || DEVICE_CODE.test(path) || SCRIPT_CODE.test(path);
+  if (PAGE_CODE.test(path) || DEVICE_CODE.test(path))
+    add(CODE_KINDS);
+  else if (SPA_FILE.test(path))
+    add(/\.(tsx|jsx)$/i.test(path) && SERVER_UI.test(path) ? CODE_KINDS : FRONTEND_KINDS);
+  else if (PAGE_FILE.test(path))
+    add(PAGE_KINDS);
+  else if (SERVER_CODE.test(path))
+    add(/\.(kt|java)$/i.test(path) && DEVICE_DIR.test(path) ? CODE_KINDS : BACKEND_KINDS);
+  else if (SCRIPT_CODE.test(path))
+    add(BACK_SCRIPT.test(path) ? BACKEND_KINDS : FRONT_DIR.test(path) ? FRONTEND_KINDS : CODE_KINDS);
+  if (isCode && CONFIG_CODE.test(path))
+    add(["config"]);
+  const mock = MOCK_FILE.test(path) || SSO_FILE.test(path);
+  if (!k.size && !(mock && STRUCTURED.test(path)))
+    add(STRUCTURED.test(path) ? DATAFILE_KINDS : ANY_KINDS);
+  if (mock)
+    add(["mocks"]);
+  return FILE_KINDS.filter((x) => k.has(x));
+}
+function kindsOf(paths) {
+  const k = /* @__PURE__ */ new Set();
+  for (const p of paths)
+    for (const x of fileKinds(p))
+      k.add(x);
+  return FILE_KINDS.filter((x) => k.has(x));
+}
+function readingOrder(paths) {
+  return [...paths].map((p) => ({ p, r: readingRank(p) })).sort((a, b) => a.r - b.r || (a.p < b.p ? -1 : a.p > b.p ? 1 : 0)).map((x) => x.p);
+}
+var linesOf = (text) => {
+  const t = text.replace(/\r\n?/g, "\n");
+  return (t.endsWith("\n") ? t.slice(0, -1) : t).split("\n");
+};
+function numberedSlice(text, s) {
+  return linesOf(text).slice(s.from - 1, s.to).map((l, i) => `${s.from + i}| ${l}`).join("\n");
+}
+var header = (s) => `${s.path} lines ${s.from}-${s.to} of ${s.of} (numbered as in the file)`;
+function sliceText(source, s) {
+  return `${header(s)}
+${numberedSlice(source.read(s.path) ?? "", s)}`;
+}
+var tokensOf = (chars) => Math.ceil(chars / 4);
+function planBatches(source, o) {
+  const room = Math.max(1, o.room);
+  const excludeRes = (o.exclude ?? []).map(globToRegExp);
+  const excluded = [];
+  const paths = [];
+  const texts = /* @__PURE__ */ new Map();
+  for (const p of source.list()) {
+    const text = source.read(p);
+    if (text === void 0)
+      continue;
+    const ls = linesOf(text);
+    if (!isSourceFile(p, ls[0] ?? "", ls))
+      continue;
+    if (excludeRes.some((re) => re.test(p))) {
+      excluded.push(p);
+      continue;
+    }
+    if (!text.trim())
+      continue;
+    paths.push(p);
+    texts.set(p, text);
+  }
+  const costs = /* @__PURE__ */ new Map();
+  const overhead = (kinds2) => {
+    if (!o.overhead)
+      return 0;
+    const key = kinds2.join(",");
+    if (!costs.has(key))
+      costs.set(key, o.overhead(kinds2));
+    return costs.get(key);
+  };
+  const slices = [];
+  let lines = 0;
+  let leastRoom = room;
+  for (const path of readingOrder(paths)) {
+    const kinds2 = fileKinds(path);
+    const left = room - overhead(kinds2);
+    leastRoom = Math.min(leastRoom, left);
+    const fileRoom = Math.max(1, left);
+    const all2 = linesOf(texts.get(path));
+    const of = all2.length;
+    lines += of;
+    const sizes = all2.map((l, i) => `${i + 1}| ${l}`.length + 1);
+    const cost = (from2, chars) => tokensOf(header({ path, from: from2, to: of, of }).length + chars);
+    const total = sizes.reduce((n, c) => n + c, 0);
+    if (cost(1, total) <= fileRoom) {
+      slices.push({ path, from: 1, to: of, of, tokens: cost(1, total), kinds: kinds2 });
+      continue;
+    }
+    let from = 1;
+    while (from <= of) {
+      let to = from;
+      let chars = sizes[from - 1];
+      while (to < of && cost(from, chars + sizes[to]) <= fileRoom)
+        chars += sizes[to++];
+      slices.push({ path, from, to, of, tokens: cost(from, chars), kinds: kinds2 });
+      from = to + 1;
+    }
+  }
+  const batches = [];
+  let current = [];
+  let kinds = /* @__PURE__ */ new Set();
+  let used = 0;
+  for (const { kinds: own, ...s } of slices) {
+    const joined = FILE_KINDS.filter((x) => kinds.has(x) || own.includes(x));
+    if (current.length && used + s.tokens + overhead(joined) > room) {
+      batches.push(current);
+      current = [];
+      kinds = /* @__PURE__ */ new Set();
+      used = 0;
+    }
+    current.push(s);
+    own.forEach((x) => kinds.add(x));
+    used += s.tokens;
+  }
+  if (current.length)
+    batches.push(current);
+  return {
+    files: paths.length,
+    lines,
+    tokens: slices.reduce((n, s) => n + s.tokens, 0),
+    batches,
+    excluded: excluded.sort(),
+    leastRoom
+  };
+}
+
+// packages/verify/dist/vendored.js
+var LICENSE_FILE = /^(LICEN[CS]E|COPYING)([._-][^/]*)?$/i;
+var BUILD_FILE = /^(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|go\.mod|Cargo\.toml|pyproject\.toml|setup\.py|setup\.cfg|composer\.json|Gemfile|[^/]+\.(csproj|vbproj|fsproj|sln))$/i;
+var AGGREGATOR = /^(pom\.xml|settings\.gradle(\.kts)?|package\.json|pnpm-workspace\.yaml|lerna\.json|Cargo\.toml|go\.work)$/;
+var byPath = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var nameOf = (path) => path.slice(path.lastIndexOf("/") + 1);
+var dirOf = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+var under = (path, dir) => !dir || path.startsWith(`${dir}/`);
+var quoted = (s) => [...s.matchAll(/["']([^"'\n]+)["']/g)].map((m) => m[1]);
+var clean = (m) => m.trim().replace(/^\.\//, "").replace(/\/pom\.xml$/, "").replace(/\/+$/, "");
+function json(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+function buildModules(path, text) {
+  const name = nameOf(path);
+  const dir = dirOf(path);
+  let found = [];
+  if (name === "pom.xml")
+    found = [...text.matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)].map((m) => m[1]);
+  else if (/^settings\.gradle(\.kts)?$/.test(name)) {
+    const calls2 = /\binclude(Build|Flat)?\b\s*(\(([^)]*)\)|((?:\s*["'][^"'\n]+["']\s*,?)+))/g;
+    for (const m of text.matchAll(calls2))
+      for (const q of quoted(m[3] ?? m[4] ?? ""))
+        found.push(m[1] === "Build" ? q : q.replace(/^:/, "").replace(/:/g, "/"));
+    for (const m of text.matchAll(/projectDir\s*=\s*(?:file|new\s+File)\s*\(([^)]*)\)/g)) {
+      const q = quoted(m[1]);
+      if (q.length)
+        found.push(q[q.length - 1]);
+    }
+  } else if (name === "package.json") {
+    const w = json(text)?.workspaces;
+    found = Array.isArray(w) ? strings(w) : strings(w?.packages);
+  } else if (name === "lerna.json")
+    found = strings(json(text)?.packages);
+  else if (name === "pnpm-workspace.yaml") {
+    let inPackages = false;
+    for (const line of text.split(/\r?\n/)) {
+      if (/^packages:\s*$/.test(line))
+        inPackages = true;
+      else if (/^\S/.test(line))
+        inPackages = false;
+      else if (inPackages) {
+        const m = /^\s*-\s*["']?([^"'#]+?)["']?\s*(#.*)?$/.exec(line);
+        if (m)
+          found.push(m[1]);
+      }
+    }
+  } else if (name === "Cargo.toml") {
+    const m = /\[workspace\][^[]*?members\s*=\s*\[([^\]]*)\]/s.exec(text);
+    if (m)
+      found = quoted(m[1]);
+  } else if (name === "go.work") {
+    for (const m of text.matchAll(/^\s*use\s*(\(([^)]*)\)|(\S+))/gm))
+      found.push(...m[2] ? m[2].split(/\s+/).filter(Boolean) : [m[3]]);
+  }
+  return found.filter((m) => !m.startsWith("!")).map(clean).filter(Boolean).map((m) => dir ? `${dir}/${m}` : m);
+}
+var JAVA_LIKE = /\.(java|kt|kts|scala|groovy)$/i;
+var DOTNET = /\.(cs|vb|fs)$/i;
+var rootOf = (name) => name.split(".").slice(0, 2).join(".").toLowerCase();
+function packageRoot(path, text) {
+  const re = JAVA_LIKE.test(path) ? /^\s*package\s+([A-Za-z_][\w.]*)/m : DOTNET.test(path) ? /^\s*namespace\s+([A-Za-z_][\w.]*)/m : void 0;
+  const m = re?.exec(text);
+  return m ? rootOf(m[1]) : void 0;
+}
+var PACKAGE_SAMPLE = 2e3;
+function packageRoots(paths, inits, read) {
+  const roots = /* @__PURE__ */ new Set();
+  let readCount = 0;
+  for (const p of paths) {
+    if (/\.py$/i.test(p)) {
+      let d = dirOf(p);
+      let top;
+      while (d && inits.has(d)) {
+        top = d;
+        d = dirOf(d);
+      }
+      if (top)
+        roots.add(nameOf(top).toLowerCase());
+    } else if ((JAVA_LIKE.test(p) || DOTNET.test(p)) && readCount < PACKAGE_SAMPLE) {
+      readCount++;
+      const r = packageRoot(p, read(p) ?? "");
+      if (r)
+        roots.add(r);
+    }
+  }
+  return roots;
+}
+var listed = (names, max = 3) => names.length > max ? `${names.slice(0, max).join(", ")} and ${names.length - max} more` : names.join(", ");
+function vendoredProjects(all2, read) {
+  const files = [...all2].sort(byPath);
+  const licenses = /* @__PURE__ */ new Map();
+  const builds = /* @__PURE__ */ new Map();
+  for (const p of files) {
+    const d = dirOf(p);
+    if (LICENSE_FILE.test(nameOf(p)) && !licenses.has(d))
+      licenses.set(d, p);
+    if (BUILD_FILE.test(nameOf(p)))
+      builds.set(d, [...builds.get(d) ?? [], nameOf(p)]);
+  }
+  const modules = [];
+  if (read) {
+    for (const p of files)
+      if (AGGREGATOR.test(nameOf(p)))
+        for (const m of buildModules(p, read(p) ?? ""))
+          modules.push({ from: dirOf(p), re: globToRegExp(m) });
+  }
+  const included = (dir) => modules.some((m) => m.from !== dir && under(dir, m.from) && m.re.test(dir));
+  const nested = [];
+  const copied = [];
+  for (const [dir, license] of licenses) {
+    if (!dir)
+      continue;
+    const own = builds.get(dir);
+    if (!own)
+      copied.push(dir);
+    else if (read && !included(dir))
+      nested.push({
+        dir,
+        at: `${license}:1`,
+        why: `a project of its own (${[nameOf(license), ...own].sort(byPath).join(", ")}) that the repo's build doesn't include as a module: vendored third-party code? Check before accepting`
+      });
+  }
+  const out = [...nested];
+  if (copied.length) {
+    const inits = new Set(files.filter((p) => nameOf(p) === "__init__.py").map(dirOf));
+    const apart = [...copied, ...nested.map((n) => n.dir)];
+    const text = read ?? (() => void 0);
+    const mine = packageRoots(files.filter((p) => !apart.some((d) => under(p, d))), inits, text);
+    for (const dir of copied) {
+      const theirs = packageRoots(files.filter((p) => under(p, dir)), inits, text);
+      const shared = [...theirs].some((r) => mine.has(r));
+      if (shared)
+        continue;
+      const known = theirs.size > 0 && mine.size > 0;
+      out.push({
+        dir,
+        at: `${licenses.get(dir)}:1`,
+        why: known ? `its own LICENSE and no build file, and its packages (${listed([...theirs].sort(byPath))}) aren't the repo's own (${listed([...mine].sort(byPath))}): a vendored copy of third-party code? Check before accepting` : "its own LICENSE and no build file: a vendored copy of third-party code? Check before accepting"
+      });
+    }
+  }
+  return out.sort((a, b) => byPath(a.dir, b.dir));
+}
+
+// packages/verify/dist/read-plan.js
+var PROPOSE_MIN_TOKENS = 1e4;
+var PROPOSE_MIN_SHARE = 0.02;
+var PROPOSE_DATA_SHARE = 0.9;
+var SHOWN_PROPOSALS = 10;
+var DOCS_TOP = /^(docs?|documentation|site|website|javadoc|apidocs)\//i;
+var DATA_EXT2 = /\.(json|xml|ya?ml)$/i;
+var TEXT_PAGE = /\.(html?|xhtml)$/i;
+var PRODUCT_PAGES = /(^|\/)(src|app|apps|web|www|wwwroot|webapp|public|static|assets|resources|templates?|views?|pages|layouts?|partials|components|emails?|mail|ui|client|frontend|site)\//i;
+var SPA_PAGE = /\.(component|directive|pipe)\.html$/i;
+var sum = (fs) => fs.reduce((n, f) => n + f.tokens, 0);
+var plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;
+var extOf = (path) => /\.[^./]+$/.exec(path)?.[0].toLowerCase() ?? path.split("/").pop();
+var byPath2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var under2 = (path, dir) => path.startsWith(`${dir}/`);
+var whatOf = (v) => v.why.replace(/: (a )?vendored [^:]*\? Check before accepting$/, "");
+function natureOf(path) {
+  if (DOCS_TOP.test(path))
+    return "docs";
+  if (TEXT_PAGE.test(path))
+    return PRODUCT_PAGES.test(path) || SPA_PAGE.test(path) ? void 0 : "page";
+  if (!DATA_EXT2.test(path))
+    return void 0;
+  const kinds = fileKinds(path);
+  return kinds.length === DATAFILE_KINDS.length && kinds.every((k) => DATAFILE_KINDS.includes(k)) ? "data" : void 0;
+}
+function proposeExclusions(files, all2, read, o = {}) {
+  const before = sum(files);
+  const floor = o.saysNotProduct ? PROPOSE_MIN_TOKENS / 4 : PROPOSE_MIN_TOKENS;
+  const share = o.saysNotProduct ? PROPOSE_MIN_SHARE / 4 : PROPOSE_MIN_SHARE;
+  const min = Math.max(floor, share * before);
+  const vendored = vendoredProjects(all2, read);
+  const vendoredOf = (path) => vendored.find((v) => under2(path, v.dir));
+  const folders = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    const nature = vendoredOf(f.path) ? "vendored" : natureOf(f.path);
+    const keeps = !nature && readingRank(f.path) <= 1;
+    const parts = f.path.split("/");
+    for (let d = 1; d < parts.length; d++) {
+      const key = parts.slice(0, d).join("/");
+      const x = folders.get(key) ?? { files: [], odd: [], keeps: false };
+      x.files.push(f);
+      if (nature)
+        x.odd.push({ f, nature });
+      x.keeps ||= keeps;
+      folders.set(key, x);
+    }
+  }
+  const biggest = (fs) => [...fs].sort((a, b) => b.tokens - a.tokens || byPath2(a.path, b.path))[0];
+  const counts = (fs) => {
+    const n = /* @__PURE__ */ new Map();
+    for (const f of fs)
+      n.set(extOf(f.path), (n.get(extOf(f.path)) ?? 0) + 1);
+    return [...n.entries()].sort((a, b) => b[1] - a[1] || byPath2(a[0], b[0])).map(([ext, c]) => plural(c, `${ext} file`)).join(", ");
+  };
+  const candidates = /* @__PURE__ */ new Map();
+  for (const [dir, x] of folders) {
+    const tokens = sum(x.files);
+    if (tokens < min || x.keeps)
+      continue;
+    const self = vendored.find((v) => v.dir === dir);
+    if (self) {
+      candidates.set(dir, {
+        path: `${dir}/**`,
+        why: self.why,
+        at: self.at,
+        files: x.files.length,
+        tokens
+      });
+      continue;
+    }
+    if (sum(x.odd.map((o2) => o2.f)) < PROPOSE_DATA_SHARE * tokens)
+      continue;
+    const docsTop = DOCS_TOP.test(`${dir}/`);
+    const pages = x.odd.some((o2) => o2.nature === "page");
+    const others = x.files.length - x.odd.length;
+    if (!docsTop && pages && others)
+      continue;
+    const odd = x.odd.filter((o2) => o2.nature !== "vendored").map((o2) => o2.f);
+    const inside = vendored.filter((v) => under2(v.dir, dir) && !vendored.some((w) => w !== v && under2(v.dir, w.dir)));
+    if (!odd.length && inside.length < 2)
+      continue;
+    const tokensOf2 = (v) => sum(x.files.filter((f) => under2(f.path, v.dir)));
+    const [main] = [...inside].sort((a, b) => tokensOf2(b) - tokensOf2(a) || byPath2(a.dir, b.dir));
+    const kind = docsTop ? "documentation, not the product" : pages ? "documents, not code" : "data, not code";
+    const projects = `${plural(inside.length, "vendored project")}: ${inside.length === 1 ? `${inside[0].dir}, ${whatOf(inside[0])}` : inside.map((v) => v.dir).join(", ")}`;
+    candidates.set(dir, {
+      path: `${dir}/**`,
+      why: odd.length ? `${kind}: ${counts(odd)}${others ? `; also ${plural(others, "other file")}` : ""}${inside.length ? `; with ${projects}` : ""}` : `vendored code, not the product: ${projects}`,
+      // Its biggest vendored project's LICENSE when vendored code is most of it.
+      at: main && 2 * sum(inside.flatMap((v) => x.files.filter((f) => under2(f.path, v.dir)))) >= tokens ? main.at : `${biggest(odd).path}:1`,
+      files: x.files.length,
+      tokens
+    });
+  }
+  const depth = (d) => d.split("/").length;
+  const picked = [];
+  for (const dir of [...candidates.keys()].sort((a, b) => depth(a) - depth(b) || byPath2(a, b)))
+    if (!picked.some((p) => dir.startsWith(`${p}/`)))
+      picked.push(dir);
+  const proposals = picked.map((d) => candidates.get(d)).sort((a, b) => b.tokens - a.tokens || byPath2(a.path, b.path));
+  return { proposals, before, after: before - proposals.reduce((n, p) => n + p.tokens, 0) };
+}
+function exclusionYaml(proposals) {
+  if (!proposals.length)
+    return "";
+  const q = (s) => JSON.stringify(s);
+  return [
+    "exclude:",
+    ...proposals.map((p) => `  - { path: ${q(p.path)}, why: ${q(p.why)}, at: ${q(p.at)} }`),
+    ""
+  ].join("\n");
+}
+var SESSION_TOKENS = 15e4;
+function unitsOf(dir, fs, room) {
+  const prefix = dir ? `${dir}/` : "";
+  const direct = [];
+  const children = /* @__PURE__ */ new Map();
+  for (const f of fs) {
+    const rest = f.path.slice(prefix.length);
+    const slash = rest.indexOf("/");
+    if (slash < 0)
+      direct.push(f);
+    else {
+      const child = prefix + rest.slice(0, slash);
+      children.set(child, [...children.get(child) ?? [], f]);
+    }
+  }
+  if (dir && (sum(fs) <= room || !children.size))
+    return [{ glob: `${dir}/**`, files: fs.length, tokens: sum(fs) }];
+  const out = direct.length ? [{ glob: `${prefix}*`, files: direct.length, tokens: sum(direct) }] : [];
+  for (const child of [...children.keys()].sort(byPath2))
+    out.push(...unitsOf(child, children.get(child), room));
+  return out;
+}
+function planParts(files, room = SESSION_TOKENS) {
+  const total = sum(files);
+  if (total <= room)
+    return [];
+  const sorted = [...files].sort((a, b) => byPath2(a.path, b.path));
+  const target = total / Math.ceil(total / room);
+  const parts = [];
+  let current;
+  for (const u of unitsOf("", sorted, room)) {
+    if (current && (current.tokens + u.tokens > room || current.tokens >= target)) {
+      parts.push(current);
+      current = void 0;
+    }
+    current ??= { paths: [], files: 0, tokens: 0 };
+    current.paths.push(u.glob);
+    current.files += u.files;
+    current.tokens += u.tokens;
+  }
+  if (current)
+    parts.push(current);
+  return parts;
+}
+
+// packages/diagrams/dist/views.js
+var VIEW_NAMES = ["context", "container", "data", "event", "sequence"];
+var ViewError = class extends Error {
+};
+var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var slug = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+var normPath = (p) => p.replace(/\{[^}]*\}/g, "{}").replace(/\/+$/, "") || "/";
+function legendOf(status) {
+  if (status === "planned-new")
+    return "new";
+  if (status === "planned-modify")
+    return "modify";
+  if (status === "planned-retire")
+    return "retire";
+  return void 0;
+}
+var withLegend = (status) => {
+  const l = legendOf(status);
+  return l ? { legend: l } : {};
+};
+var Catalog = class {
+  byId = /* @__PURE__ */ new Map();
+  systems = /* @__PURE__ */ new Map();
+  components = /* @__PURE__ */ new Map();
+  endpoints = /* @__PURE__ */ new Map();
+  stores = /* @__PURE__ */ new Map();
+  interfaces;
+  tables;
+  constructor(records2) {
+    const live = records2.filter((r) => r.status !== "retired").sort((a, b) => cmp(a.id, b.id));
+    for (const r of live) {
+      if (r.kind !== "CuratedDecision")
+        this.byId.set(r.id, r);
+      if (r.kind === "System")
+        this.systems.set(r.id, r);
+      else if (r.kind === "Component")
+        this.components.set(r.id, r);
+      else if (r.kind === "Endpoint")
+        this.endpoints.set(r.id, r);
+      else if (r.kind === "DataStore")
+        this.stores.set(r.id, r);
+    }
+    this.interfaces = live.filter((r) => r.kind === "Interface");
+    this.tables = live.filter((r) => r.kind === "Table");
+  }
+  isSystem(id) {
+    return this.systems.has(id) || [...this.components.values()].some((c) => c.system === id);
+  }
+  /** A component's system; a system is its own. */
+  systemOf(id) {
+    return this.components.get(id)?.system ?? (this.isSystem(id) ? id : void 0);
+  }
+  boundaryOf(id) {
+    const s = this.systemOf(id);
+    return s ? this.systems.get(s)?.boundary : void 0;
+  }
+  systemName(id) {
+    return this.systems.get(id)?.name ?? id;
+  }
+  /** Does `drawn` (a component or system) stand for this interface end? */
+  same(drawn, end) {
+    return drawn === end || !this.components.has(drawn) && this.systemOf(end) === drawn;
+  }
+  componentsOf(system) {
+    return [...this.components.values()].filter((c) => c.system === system).map((c) => c.id);
+  }
+  /** A node for a component or system end of an interface. */
+  endNode(id, group) {
+    const sys = this.components.has(id) ? void 0 : this.systems.get(id);
+    const boundary = this.boundaryOf(id);
+    return {
+      id,
+      label: sys ? sys.name : id,
+      kind: this.components.has(id) ? "component" : this.isSystem(id) ? "system" : "box",
+      ...boundary ? { boundary } : {},
+      ...withLegend((sys ?? this.components.get(id))?.status),
+      ...group ? { group } : {}
+    };
+  }
+  /** The topic an async interface carries. */
+  topicOf(i) {
+    const ep = i.endpoint ? this.endpoints.get(i.endpoint) : void 0;
+    return ep?.endpointType === "event-topic" ? ep.pathOrTopic : i.normalizedPath;
+  }
+  /**
+   * An interface's label in the grammar reconcile reads back: pattern code, then METHOD and
+   * path, or the topic. The path is the endpoint's own template when it normalizes to the
+   * interface's path, because that is what people recognise.
+   */
+  interfaceLabel(i) {
+    let what;
+    if (i.sync === "async")
+      what = this.topicOf(i);
+    else {
+      const ep = i.endpoint ? this.endpoints.get(i.endpoint) : void 0;
+      const path = ep?.endpointType === "rest" && normPath(ep.pathOrTopic) === normPath(i.normalizedPath) ? ep.pathOrTopic : i.normalizedPath;
+      what = [i.method?.toUpperCase(), path].filter(Boolean).join(" ");
+    }
+    return [i.pattern?.code, what].filter(Boolean).join(" ");
+  }
+  interfaceEdge(i, from, to) {
+    return {
+      id: i.id,
+      from,
+      to,
+      label: this.interfaceLabel(i),
+      async: i.sync === "async",
+      ...withLegend(i.status)
+    };
+  }
+};
+var byEdge = (a, b) => cmp(a.from, b.from) || cmp(a.to, b.to) || cmp(a.label, b.label) || cmp(a.id, b.id);
+function contextView(records2) {
+  const c = new Catalog(records2);
+  const nodes = /* @__PURE__ */ new Map();
+  for (const id of c.systems.keys())
+    nodes.set(id, c.endNode(id));
+  for (const comp of c.components.values())
+    if (!nodes.has(comp.system))
+      nodes.set(comp.system, c.endNode(comp.system));
+  const edges = [];
+  for (const i of c.interfaces) {
+    const from = c.systemOf(i.from) ?? i.from;
+    const to = c.systemOf(i.to) ?? i.to;
+    for (const end of [from, to])
+      if (!nodes.has(end))
+        nodes.set(end, c.endNode(end));
+    edges.push(c.interfaceEdge(i, from, to));
+  }
+  return {
+    type: "context",
+    title: "Context view",
+    groups: [],
+    nodes: [...nodes.values()].sort((a, b) => cmp(a.id, b.id)),
+    edges: edges.sort(byEdge)
+  };
+}
+function containerView(records2, system) {
+  const c = new Catalog(records2);
+  if (!c.isSystem(system))
+    throw new ViewError(`No system "${system}" in the catalog.`);
+  const own = c.componentsOf(system).sort(cmp);
+  const inside = (id) => id === system || own.includes(id);
+  const sys = c.systems.get(system);
+  const groups = [];
+  const nodes = /* @__PURE__ */ new Map();
+  const groupOf = (s) => {
+    const rec = c.systems.get(s);
+    return {
+      id: s,
+      label: c.systemName(s),
+      kind: "system",
+      ...rec?.boundary ? { boundary: rec.boundary } : {},
+      ...withLegend(rec?.status)
+    };
+  };
+  if (own.length > 0) {
+    groups.push(groupOf(system));
+    for (const id of own)
+      nodes.set(id, c.endNode(id, system));
+  } else
+    nodes.set(system, c.endNode(system));
+  const edges = [];
+  const neighbourGroups = /* @__PURE__ */ new Map();
+  for (const i of c.interfaces) {
+    if (!inside(i.from) && !inside(i.to))
+      continue;
+    for (const end of [i.from, i.to]) {
+      if (nodes.has(end))
+        continue;
+      const comp = c.components.get(end);
+      if (comp) {
+        if (!neighbourGroups.has(comp.system))
+          neighbourGroups.set(comp.system, groupOf(comp.system));
+        nodes.set(end, c.endNode(end, comp.system));
+      } else
+        nodes.set(end, c.endNode(end));
+    }
+    edges.push(c.interfaceEdge(i, i.from, i.to));
+  }
+  for (const id of own)
+    for (const to of c.components.get(id)?.uses ?? [])
+      if (nodes.has(to))
+        edges.push({ id: `uses.${id}.${to}`, from: id, to, label: "uses", async: false });
+  groups.push(...[...neighbourGroups.values()].sort((a, b) => cmp(a.id, b.id)));
+  const order = new Map(groups.map((g, n) => [g.id, n]));
+  const sorted = [...nodes.values()].sort((a, b) => (a.group !== void 0 ? order.get(a.group) : groups.length) - (b.group !== void 0 ? order.get(b.group) : groups.length) || cmp(a.id, b.id));
+  return {
+    type: "container",
+    title: `Container view of ${sys?.name ?? system}`,
+    groups,
+    nodes: sorted,
+    edges: edges.sort(byEdge)
+  };
+}
+function scopeOf(c, focus) {
+  if (c.components.has(focus))
+    return /* @__PURE__ */ new Set([focus]);
+  if (c.isSystem(focus))
+    return /* @__PURE__ */ new Set([focus, ...c.componentsOf(focus)]);
+  return void 0;
+}
+function dataView(records2, focus) {
+  const c = new Catalog(records2);
+  let tables = c.tables;
+  if (focus !== void 0) {
+    const scope = scopeOf(c, focus);
+    if (scope)
+      tables = tables.filter((t) => [...t.readers, ...t.writers, ...t.ownerComponent ? [t.ownerComponent] : []].some((x) => scope.has(x)));
+    else if (c.stores.has(focus) || tables.some((t) => t.dataStore === focus))
+      tables = tables.filter((t) => t.dataStore === focus);
+    else if (c.byId.get(focus)?.kind === "Table")
+      tables = tables.filter((t) => t.id === focus);
+    else
+      throw new ViewError(`"${focus}" isn't in the catalog.`);
+  }
+  const groups = [...new Set(tables.map((t) => t.dataStore))].sort(cmp).map((s) => {
+    const store = c.stores.get(s);
+    return {
+      id: s,
+      label: store ? `${s} (${store.storeType})` : s,
+      kind: "datastore",
+      ...withLegend(store?.status)
+    };
+  });
+  const nodes = [];
+  for (const g of groups)
+    for (const t of tables.filter((x) => x.dataStore === g.id))
+      nodes.push({ id: t.id, label: t.name, kind: "table", group: g.id, ...withLegend(t.status) });
+  const users = [...new Set(tables.flatMap((t) => [...t.readers, ...t.writers]))].sort(cmp);
+  for (const u of users)
+    nodes.push(c.endNode(u));
+  const edges = [];
+  for (const u of users)
+    for (const t of tables) {
+      const reads = t.readers.includes(u);
+      const writes = t.writers.includes(u);
+      if (!reads && !writes)
+        continue;
+      edges.push({
+        id: `access.${u}.${t.id}`,
+        from: u,
+        to: t.id,
+        label: reads && writes ? "reads and writes" : reads ? "reads" : "writes",
+        async: false
+      });
+    }
+  return {
+    type: "data",
+    title: focus ? `Data view of ${focus}` : "Data view",
+    groups,
+    nodes,
+    edges: edges.sort(byEdge)
+  };
+}
+function eventView(records2, focus) {
+  const c = new Catalog(records2);
+  const topics = /* @__PURE__ */ new Map();
+  const topic = (name, id = `topic.${slug(name)}`, status) => {
+    let t = topics.get(name);
+    if (!t) {
+      t = { id, label: name, ...withLegend(status), pubs: /* @__PURE__ */ new Map(), subs: /* @__PURE__ */ new Map() };
+      topics.set(name, t);
+    }
+    return t;
+  };
+  for (const ep of c.endpoints.values())
+    if (ep.endpointType === "event-topic")
+      topic(ep.pathOrTopic, ep.id, ep.status);
+  for (const i of c.interfaces) {
+    if (i.sync !== "async")
+      continue;
+    const t = topic(c.topicOf(i));
+    if (!t.pubs.has(i.from))
+      t.pubs.set(i.from, legendOf(i.status));
+    if (!t.subs.has(i.to))
+      t.subs.set(i.to, legendOf(i.status));
+  }
+  for (const ep of c.endpoints.values()) {
+    if (ep.endpointType !== "event-topic")
+      continue;
+    const t = topics.get(ep.pathOrTopic);
+    const known = c.components.has(ep.component) || c.isSystem(ep.component);
+    if (known && !t.pubs.has(ep.component))
+      t.pubs.set(ep.component, t.legend);
+  }
+  let chosen = [...topics.values()];
+  if (focus !== void 0) {
+    const byId = chosen.find((t) => t.id === focus);
+    const scope = scopeOf(c, focus);
+    if (byId)
+      chosen = [byId];
+    else if (scope)
+      chosen = chosen.filter((t) => [...t.pubs.keys(), ...t.subs.keys()].some((x) => scope.has(x)));
+    else
+      throw new ViewError(`"${focus}" isn't in the catalog.`);
+  }
+  chosen.sort((a, b) => cmp(a.id, b.id));
+  const ends = [...new Set(chosen.flatMap((t) => [...t.pubs.keys(), ...t.subs.keys()]))].sort(cmp);
+  const nodes = [
+    ...ends.map((e) => c.endNode(e)),
+    ...chosen.map((t) => ({
+      id: t.id,
+      label: t.label,
+      kind: "topic",
+      ...t.legend ? { legend: t.legend } : {}
+    }))
+  ];
+  const edges = [];
+  for (const t of chosen) {
+    for (const [p, legend] of [...t.pubs].sort((a, b) => cmp(a[0], b[0])))
+      edges.push({
+        id: `pub.${p}.${t.id}`,
+        from: p,
+        to: t.id,
+        label: "publishes",
+        async: true,
+        ...legend ? { legend } : {}
+      });
+    for (const [s, legend] of [...t.subs].sort((a, b) => cmp(a[0], b[0])))
+      edges.push({
+        id: `sub.${t.id}.${s}`,
+        from: t.id,
+        to: s,
+        label: "delivers to",
+        async: true,
+        ...legend ? { legend } : {}
+      });
+  }
+  return {
+    type: "event",
+    title: focus ? `Event view of ${focus}` : "Event view",
+    groups: [],
+    nodes,
+    edges
+  };
+}
+function sequenceView(records2, ids) {
+  const c = new Catalog(records2);
+  if (ids.length === 0)
+    throw new ViewError("Name at least one record for the sequence.");
+  const participants = /* @__PURE__ */ new Map();
+  const steps = [];
+  const topics = new Map([...c.endpoints.values()].filter((e) => e.endpointType === "event-topic").map((e) => [e.id, e]));
+  const add = (id) => {
+    if (participants.has(id))
+      return;
+    const rec = c.byId.get(id);
+    const label = rec?.kind === "System" ? rec.name : rec?.kind === "Endpoint" && rec.endpointType === "event-topic" ? rec.pathOrTopic : id;
+    participants.set(id, { id, label, ...withLegend(rec?.status) });
+  };
+  const message = (from, to, label, async, status) => steps.push({ kind: "message", from, to, label, async, ...withLegend(status) });
+  const access = (comp, table) => {
+    const r = table.readers.includes(comp);
+    const w = table.writers.includes(comp);
+    return r && w ? "reads and writes" : r ? "reads" : w ? "writes" : void 0;
+  };
+  const link2 = (a, b) => {
+    const between = (x, y) => c.interfaces.filter((i) => c.same(x, i.from) && c.same(y, i.to)).sort((p, q) => cmp(c.interfaceLabel(p), c.interfaceLabel(q)) || cmp(p.id, q.id));
+    for (const [x, y] of [
+      [a, b],
+      [b, a]
+    ]) {
+      const found = between(x, y);
+      if (found.length > 0) {
+        for (const i of found)
+          message(x, y, c.interfaceLabel(i), i.sync === "async", i.status);
+        return;
+      }
+    }
+    for (const [comp, other] of [
+      [a, b],
+      [b, a]
+    ]) {
+      const rec = c.byId.get(other);
+      if (rec?.kind === "Table") {
+        const how = access(comp, rec);
+        if (how)
+          return message(comp, other, how, false);
+      }
+      const t = topics.get(other);
+      if (t) {
+        const on = c.interfaces.filter((i) => i.sync === "async" && c.topicOf(i) === t.pathOrTopic);
+        if (t.component === comp || on.some((i) => c.same(comp, i.from)))
+          return message(comp, other, "publishes", true);
+        if (on.some((i) => c.same(comp, i.to)))
+          return message(other, comp, "delivers to", true);
+      }
+    }
+    steps.push({ kind: "note", over: [a, b], text: `No known link between ${a} and ${b}` });
+  };
+  let prev;
+  for (const raw of ids) {
+    const rec = c.byId.get(raw);
+    if (!rec && !c.isSystem(raw))
+      throw new ViewError(`"${raw}" isn't in the catalog.`);
+    if (rec?.kind === "Interface") {
+      add(rec.from);
+      add(rec.to);
+      message(rec.from, rec.to, c.interfaceLabel(rec), rec.sync === "async", rec.status);
+      prev = rec.to;
+      continue;
+    }
+    let id = raw;
+    if (rec?.kind === "Endpoint" && rec.endpointType !== "event-topic")
+      id = rec.component;
+    else if (rec && rec.kind !== "Component" && rec.kind !== "System" && rec.kind !== "Table" && rec.kind !== "Endpoint")
+      throw new ViewError(`${raw} is a ${rec.kind}; a sequence shows components, systems, interfaces, endpoints, tables and topics.`);
+    add(id);
+    if (prev !== void 0 && prev !== id)
+      link2(prev, id);
+    prev = id;
+  }
+  return {
+    type: "sequence",
+    title: `Sequence view: ${ids.join(", ")}`,
+    participants: [...participants.values()],
+    steps
+  };
+}
+var SIGN = { new: "+", modify: "\u25C7", retire: "\u2715" };
+var stronger = (a, b) => a === "new" || b === "new" ? "new" : a === "modify" || b === "modify" ? "modify" : a ?? b;
+function lineLegend(marks) {
+  if (marks.size === 1) {
+    const [m] = [...marks];
+    if (m === "added")
+      return "new";
+    if (m === "removed")
+      return "retire";
+    if (m === "same")
+      return void 0;
+  }
+  return "modify";
+}
+function changeView(records2, change, flows, known = []) {
+  const c = new Catalog(records2);
+  const inSpecs = new Set(known);
+  const isKnown = (id) => c.components.has(id) || c.isSystem(id) || inSpecs.has(id);
+  const legends = /* @__PURE__ */ new Map();
+  const mark = (id, l) => legends.set(id, stronger(legends.get(id), l));
+  const tables = /* @__PURE__ */ new Set();
+  const comps = /* @__PURE__ */ new Set();
+  const lines = /* @__PURE__ */ new Map();
+  const line = (from, to, label, async, m) => {
+    const key = `${from}->${to}:${label}`;
+    const l = lines.get(key) ?? { from, to, label, async, marks: /* @__PURE__ */ new Set() };
+    l.marks.add(m);
+    lines.set(key, l);
+  };
+  for (const f of flows) {
+    comps.add(f.component);
+    const touched = f.change !== "modify" || f.steps.some((s) => s.mark !== "same");
+    mark(f.component, f.change === "new" && !isKnown(f.component) ? "new" : touched ? "modify" : void 0);
+    for (const s of f.steps) {
+      if (s.to) {
+        comps.add(s.to.component);
+        mark(s.to.component, s.to.new && s.mark !== "removed" ? isKnown(s.to.component) ? "modify" : "new" : void 0);
+        const moved = s.mark === "changed" && s.was?.to;
+        line(f.component, s.to.component, s.to.entry, s.kind === "publish", moved ? "added" : s.mark);
+        if (moved) {
+          comps.add(moved.component);
+          line(f.component, moved.component, moved.entry, s.kind === "publish", "removed");
+        }
+      }
+      if (s.store) {
+        tables.add(s.store.table);
+        mark(s.store.table, s.store.new && s.mark !== "removed" ? "new" : s.store.migration && s.mark !== "removed" ? "modify" : void 0);
+        line(f.component, s.store.table, s.kind, false, s.mark);
+      }
+    }
+  }
+  const withMark = (id) => {
+    const l = legends.get(id);
+    return l ? { legend: l } : {};
+  };
+  const marked = (label, l) => l ? `${SIGN[l]} ${label}` : label;
+  const storeOf = (t) => c.byId.get(t)?.dataStore ?? t.split(".")[0];
+  const systems = [
+    ...new Set([...comps].map((id) => c.systemOf(id)).filter((s) => !!s))
+  ].sort(cmp);
+  const stores2 = [...new Set([...tables].map(storeOf))].sort(cmp);
+  const groups = [
+    ...systems.map((s) => {
+      const rec = c.systems.get(s);
+      return {
+        id: s,
+        label: c.systemName(s),
+        kind: "system",
+        ...rec?.boundary ? { boundary: rec.boundary } : {}
+      };
+    }),
+    ...stores2.map((s) => {
+      const store = c.stores.get(s);
+      return { id: s, label: store ? `${s} (${store.storeType})` : s, kind: "datastore" };
+    })
+  ];
+  const nodes = [];
+  for (const id of comps) {
+    const sys = c.components.has(id) ? c.systemOf(id) : void 0;
+    const base = c.components.has(id) || c.isSystem(id) ? c.endNode(id, sys) : { id, label: id, kind: "component" };
+    const { legend: _status, ...rest } = base;
+    nodes.push({ ...rest, label: marked(rest.label, legends.get(id)), ...withMark(id) });
+  }
+  for (const t of tables) {
+    const rec = c.byId.get(t);
+    nodes.push({
+      id: t,
+      label: marked(rec?.name ?? t.slice(storeOf(t).length + 1), legends.get(t)),
+      kind: "table",
+      group: storeOf(t),
+      ...withMark(t)
+    });
+  }
+  const order = new Map(groups.map((g, n) => [g.id, n]));
+  nodes.sort((a, b) => (a.group !== void 0 ? order.get(a.group) : groups.length) - (b.group !== void 0 ? order.get(b.group) : groups.length) || cmp(a.id, b.id));
+  const edges = [...lines.values()].map((l) => {
+    const legend = lineLegend(l.marks);
+    return {
+      id: `change.${l.from}.${l.to}.${slug(l.label)}`,
+      from: l.from,
+      to: l.to,
+      label: marked(l.label, legend),
+      async: l.async,
+      ...legend ? { legend } : {}
+    };
+  });
+  return {
+    type: "diagram",
+    title: `Change ${change.id}: ${change.title}`,
+    ...change.source ? { source: change.source } : {},
+    groups,
+    nodes,
+    edges: edges.sort(byEdge)
+  };
+}
+function buildView(records2, name, focus) {
+  switch (name) {
+    case "context":
+      return contextView(records2);
+    case "container":
+      if (!focus)
+        throw new ViewError("A container view needs a system: --focus <system>.");
+      return containerView(records2, focus);
+    case "data":
+      return dataView(records2, focus);
+    case "event":
+      return eventView(records2, focus);
+    case "sequence":
+      if (!focus)
+        throw new ViewError("A sequence view needs record ids: --focus <id>,<id>,...");
+      return sequenceView(records2, focus.split(",").map((s) => s.trim()).filter(Boolean));
+  }
+}
+
+// packages/diagrams/dist/mermaid.js
+var RESERVED = /* @__PURE__ */ new Set([
+  "end",
+  "graph",
+  "subgraph",
+  "flowchart",
+  "class",
+  "classdef",
+  "style",
+  "linkstyle",
+  "click",
+  "direction",
+  "default",
+  "participant",
+  "actor",
+  "note",
+  "loop",
+  "alt",
+  "else",
+  "opt",
+  "par",
+  "and",
+  "rect",
+  "critical",
+  "break",
+  "box",
+  "autonumber",
+  "activate",
+  "deactivate"
+]);
+var LEGEND_NODES = [
+  ["new", "legend_new", "+ New"],
+  ["modify", "legend_modify", "\u25C7 Modify"],
+  ["retire", "legend_retire", "\u2715 Retire"]
+];
+var Ids = class {
+  used = /* @__PURE__ */ new Set(["legend", ...LEGEND_NODES.map((l) => l[1])]);
+  map = /* @__PURE__ */ new Map();
+  get(key, raw) {
+    const known = this.map.get(key);
+    if (known)
+      return known;
+    let base = raw.replace(/[^A-Za-z0-9_]/g, "_");
+    if (!/^[A-Za-z]/.test(base))
+      base = `n_${base}`;
+    if (RESERVED.has(base.toLowerCase()))
+      base = `${base}_`;
+    let id = base;
+    for (let n = 2; this.used.has(id); n++)
+      id = `${base}_${n}`;
+    this.used.add(id);
+    this.map.set(key, id);
+    return id;
+  }
+};
+var esc = (s) => s.replace(/"/g, "#quot;");
+var HEADER = "Generated from the catalog by Atticus: change the catalog, not this file.";
+var header2 = (v) => `%% ${v.title}. ${v.source ? `Rendered by Atticus from ${v.source}.` : HEADER}`;
+var CLASS_DEFS = [
+  ["product", "fill:#dae8fc,stroke:#6c8ebf"],
+  ["internal", "fill:#d5e8d4,stroke:#82b366"],
+  ["vendor", "fill:#f5f5f5,stroke:#666666,stroke-dasharray:5 5"],
+  ["plannedNew", "stroke:#2e7d32,stroke-width:3px,stroke-dasharray:6 3"],
+  ["plannedModify", "stroke:#ed6c02,stroke-width:3px"],
+  ["plannedRetire", "stroke:#b71c1c,stroke-width:3px,stroke-dasharray:2 2"]
+];
+var LEGEND_CLASS = {
+  new: "plannedNew",
+  modify: "plannedModify",
+  retire: "plannedRetire"
+};
+var LINK_STYLE = {
+  new: "stroke:#2e7d32,stroke-width:2px,stroke-dasharray:6 3",
+  modify: "stroke:#ed6c02,stroke-width:2px",
+  retire: "stroke:#b71c1c,stroke-width:2px,stroke-dasharray:2 2"
+};
+function shape(n, id) {
+  const l = esc(n.label);
+  if (n.kind === "table")
+    return `${id}[("${l}")]`;
+  if (n.kind === "topic")
+    return `${id}>"${l}"]`;
+  return `${id}["${l}"]`;
+}
+function flow(v) {
+  const ids = new Ids();
+  const gid = (id) => ids.get(`g:${id}`, id);
+  const nid = (id) => ids.get(`n:${id}`, id);
+  const lines = [header2(v), "flowchart LR"];
+  const classes = new Map(CLASS_DEFS.map(([c]) => [c, /* @__PURE__ */ new Set()]));
+  const tag = (id, x) => {
+    if (x.boundary)
+      classes.get(x.boundary)?.add(id);
+    if (x.legend)
+      classes.get(LEGEND_CLASS[x.legend]).add(id);
+  };
+  for (const g of v.groups) {
+    const id = gid(g.id);
+    tag(id, g);
+    lines.push(`  subgraph ${id}["${esc(g.label)}"]`);
+    for (const n of v.nodes.filter((x) => x.group === g.id)) {
+      lines.push(`    ${shape(n, nid(n.id))}`);
+      tag(nid(n.id), n);
+    }
+    lines.push("  end");
+  }
+  const grouped = new Set(v.groups.map((g) => g.id));
+  for (const n of v.nodes.filter((x) => x.group === void 0 || !grouped.has(x.group))) {
+    lines.push(`  ${shape(n, nid(n.id))}`);
+    tag(nid(n.id), n);
+  }
+  const links = { new: [], modify: [], retire: [] };
+  v.edges.forEach((e, i) => {
+    const label = e.label ? `|"${esc(e.label)}"|` : "";
+    lines.push(`  ${nid(e.from)} ${e.async ? "-.->" : "-->"}${label} ${nid(e.to)}`);
+    if (e.legend)
+      links[e.legend].push(i);
+  });
+  const planned = [...v.groups, ...v.nodes, ...v.edges].some((x) => x.legend);
+  if (planned) {
+    lines.push('  subgraph legend["Legend"]');
+    for (const [legend, id, text] of LEGEND_NODES) {
+      lines.push(`    ${id}["${text}"]`);
+      classes.get(LEGEND_CLASS[legend]).add(id);
+    }
+    lines.push("  end");
+  }
+  for (const [c, def] of CLASS_DEFS)
+    if (classes.get(c).size > 0)
+      lines.push(`  classDef ${c} ${def}`);
+  for (const [c] of CLASS_DEFS) {
+    const members = [...classes.get(c)].sort(cmp);
+    if (members.length > 0)
+      lines.push(`  class ${members.join(",")} ${c}`);
+  }
+  for (const legend of ["new", "modify", "retire"])
+    if (links[legend].length > 0)
+      lines.push(`  linkStyle ${links[legend].join(",")} ${LINK_STYLE[legend]}`);
+  return `${lines.join("\n")}
+`;
+}
+var seqText = (s) => s.replace(/;/g, "#59;").replace(/\s+/g, " ");
+var suffix = (legend) => legend ? ` (${legend})` : "";
+function sequence(v) {
+  const ids = new Ids();
+  const pid = (id) => ids.get(`p:${id}`, id);
+  const lines = [header2(v), "sequenceDiagram"];
+  for (const p of v.participants)
+    lines.push(`  participant ${pid(p.id)} as ${seqText(p.label + suffix(p.legend))}`);
+  for (const s of v.steps)
+    lines.push(s.kind === "message" ? `  ${pid(s.from)}${s.reply ? "-->>" : s.async ? "-)" : "->>"}${pid(s.to)}: ${seqText(s.label + suffix(s.legend))}` : `  Note over ${s.over.map(pid).join(",")}: ${seqText(s.text)}`);
+  return `${lines.join("\n")}
+`;
+}
+function toMermaid(view) {
+  return view.type === "sequence" ? sequence(view) : flow(view);
+}
+
+// packages/diagrams/dist/drawio.js
+import { deflateRawSync } from "node:zlib";
+var BOX = { rounded: "1", whiteSpace: "wrap", html: "0" };
+var BOUNDARY = {
+  product: { fillColor: "#dae8fc", strokeColor: "#6c8ebf" },
+  internal: { fillColor: "#d5e8d4", strokeColor: "#82b366" },
+  vendor: { fillColor: "#f5f5f5", strokeColor: "#666666" }
+};
+var SHAPES = {
+  system: { ...BOX, ...BOUNDARY.product, atticusKind: "system" },
+  component: { ...BOX, atticusKind: "component" },
+  vendor: {
+    shape: "cloud",
+    whiteSpace: "wrap",
+    html: "0",
+    ...BOUNDARY.vendor,
+    atticusKind: "vendor"
+  },
+  datastore: {
+    shape: "cylinder3",
+    whiteSpace: "wrap",
+    html: "0",
+    boundedLbl: "1",
+    size: "12",
+    fillColor: "#fff2cc",
+    strokeColor: "#d6b656",
+    atticusKind: "datastore"
+  },
+  topic: {
+    shape: "parallelogram",
+    perimeter: "parallelogramPerimeter",
+    whiteSpace: "wrap",
+    html: "0",
+    fillColor: "#e1d5e7",
+    strokeColor: "#9673a6",
+    atticusKind: "topic"
+  },
+  group: {
+    rounded: "0",
+    whiteSpace: "wrap",
+    html: "0",
+    container: "1",
+    collapsible: "0",
+    dashed: "1",
+    fillColor: "none",
+    verticalAlign: "top",
+    align: "left",
+    spacingLeft: "8",
+    fontStyle: "1",
+    atticusKind: "group"
+  }
+};
+var LEGEND = {
+  new: { legend: "new", strokeColor: "#2e7d32", strokeWidth: "3", dashed: "1" },
+  modify: { legend: "modify", strokeColor: "#ed6c02", strokeWidth: "3" },
+  retire: {
+    legend: "retire",
+    strokeColor: "#b71c1c",
+    strokeWidth: "3",
+    dashed: "1",
+    dashPattern: "2 2"
+  }
+};
+var EDGE = {
+  edgeStyle: "orthogonalEdgeStyle",
+  rounded: "1",
+  html: "0",
+  endArrow: "block",
+  endFill: "1"
+};
+var styleText = (...parts) => Object.entries(Object.assign({}, ...parts)).map(([k, v]) => `${k}=${v}`).join(";") + ";";
+var attr = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/\n/g, "&#10;");
+function nodeStyle(n) {
+  const legend = n.legend ? LEGEND[n.legend] : void 0;
+  if (n.kind === "table")
+    return styleText(SHAPES.datastore, { atticusKind: "table" }, legend);
+  if (n.kind === "topic")
+    return styleText(SHAPES.topic, legend);
+  if (n.boundary === "vendor")
+    return styleText(SHAPES.vendor, n.kind === "component" ? { atticusKind: "component" } : {}, legend);
+  const base = n.kind === "system" ? SHAPES.system : SHAPES.component;
+  return styleText(base, n.boundary ? BOUNDARY[n.boundary] : void 0, legend);
+}
+function groupStyle(g) {
+  return styleText(SHAPES.group, g.kind === "datastore" ? { atticusKind: "datastore-group" } : {}, g.boundary ? { strokeColor: BOUNDARY[g.boundary].strokeColor } : void 0, g.legend ? LEGEND[g.legend] : void 0);
+}
+function boxText(x) {
+  if (x.kind !== "system" && x.kind !== "component")
+    return x.label;
+  return slug(x.label) === x.id ? x.label : x.id;
+}
+var W = 160;
+var H = 60;
+var GAP = 80;
+var PER_ROW = 4;
+function toDrawio(view, o = {}) {
+  if (view.type === "sequence")
+    throw new Error("A sequence view can't be exported to draw.io: render it as Mermaid.");
+  const cells = [];
+  const cellOf = /* @__PURE__ */ new Map();
+  const grouped = new Set(view.groups.map((g) => g.id));
+  const blocks = [];
+  const vertex = (id, value, style, parent, x, y2, w, h) => cells.push(`        <mxCell id="${attr(id)}" value="${attr(value)}" style="${attr(style)}" vertex="1" parent="${attr(parent)}">
+          <mxGeometry x="${x}" y="${y2}" width="${w}" height="${h}" as="geometry"/>
+        </mxCell>`);
+  for (const g of view.groups) {
+    const members = view.nodes.filter((n) => n.group === g.id);
+    const gw = W + 40;
+    const gh = 40 + members.length * (H + 20);
+    blocks.push({
+      w: gw,
+      h: gh,
+      emit: (x, y2) => {
+        const gcell = `group.${g.id}`;
+        vertex(gcell, boxText(g), groupStyle(g), "1", x, y2, gw, gh);
+        members.forEach((n, i) => {
+          const cell = `node.${n.id}`;
+          cellOf.set(n.id, cell);
+          vertex(cell, boxText(n), nodeStyle(n), gcell, 20, 30 + i * (H + 20), W, H);
+        });
+      }
+    });
+  }
+  for (const n of view.nodes.filter((x) => x.group === void 0 || !grouped.has(x.group)))
+    blocks.push({
+      w: W,
+      h: H,
+      emit: (x, y2) => {
+        const cell = `node.${n.id}`;
+        cellOf.set(n.id, cell);
+        vertex(cell, boxText(n), nodeStyle(n), "1", x, y2, W, H);
+      }
+    });
+  let y = 40;
+  for (let r = 0; r < blocks.length; r += PER_ROW) {
+    const row = blocks.slice(r, r + PER_ROW);
+    let x = 40;
+    for (const b of row) {
+      b.emit(x, y);
+      x += b.w + GAP;
+    }
+    y += Math.max(...row.map((b) => b.h)) + GAP;
+  }
+  for (const e of view.edges) {
+    const source = cellOf.get(e.from);
+    const target = cellOf.get(e.to);
+    if (!source || !target)
+      continue;
+    cells.push(`        <mxCell id="${attr(`edge.${e.id}`)}" value="${attr(e.label)}" style="${attr(edgeStyle(e))}" edge="1" parent="1" source="${attr(source)}" target="${attr(target)}">
+          <mxGeometry relative="1" as="geometry"/>
+        </mxCell>`);
+  }
+  return [
+    `<mxfile host="atticus">`,
+    `  <diagram id="${attr(view.type)}" name="${attr(o.page ?? view.title)}">`,
+    `    <mxGraphModel grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1169" pageHeight="827">`,
+    `      <root>`,
+    `        <mxCell id="0"/>`,
+    `        <mxCell id="1" parent="0"/>`,
+    ...cells,
+    `      </root>`,
+    `    </mxGraphModel>`,
+    `  </diagram>`,
+    `</mxfile>`,
+    ``
+  ].join("\n");
+}
+function edgeStyle(e) {
+  return styleText(EDGE, e.async ? { dashed: "1" } : void 0, e.legend ? { legend: e.legend, strokeColor: LEGEND[e.legend].strokeColor, strokeWidth: "2" } : void 0);
+}
+var compress = (xml) => deflateRawSync(Buffer.from(encodeURIComponent(xml), "utf8"), { level: 9 }).toString("base64");
+function shapeLibrary() {
+  const base = [
+    ["System", SHAPES.system, W, H],
+    ["Component", SHAPES.component, W, H],
+    ["Vendor", SHAPES.vendor, W, H + 20],
+    ["Data store", SHAPES.datastore, 120, 80],
+    ["Topic", SHAPES.topic, W, H]
+  ];
+  const entries = base.flatMap(([title, style, w, h]) => [void 0, "new", "modify", "retire"].map((legend) => {
+    const value = attr(title);
+    const st = attr(styleText(style, legend ? LEGEND[legend] : void 0));
+    const xml = `<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="${value}" style="${st}" vertex="1" parent="1"><mxGeometry width="${w}" height="${h}" as="geometry"/></mxCell></root></mxGraphModel>`;
+    return {
+      xml: compress(xml),
+      w,
+      h,
+      aspect: "fixed",
+      title: legend ? `${title} (${legend})` : title
+    };
+  }));
+  return `<mxlibrary>${JSON.stringify(entries)}</mxlibrary>
+`;
+}
+function viewFromDiagram(diagram, source) {
+  const multi = new Set(diagram.nodes.map((n) => n.page)).size > 1;
+  const key = (page, cell) => multi ? `${page}:${cell}` : cell;
+  const nodes = diagram.nodes.map((n) => ({
+    id: key(n.page, n.cell),
+    label: n.label,
+    kind: "box",
+    ...n.legend ? { legend: n.legend } : {}
+  }));
+  const find = (page, label) => diagram.nodes.find((n) => n.page === page && n.label === label);
+  const edges = [];
+  for (const e of diagram.edges) {
+    const from = find(e.page, e.from);
+    const to = find(e.page, e.to);
+    if (!from || !to)
+      continue;
+    edges.push({
+      id: key(e.page, e.cell),
+      from: key(from.page, from.cell),
+      to: key(to.page, to.cell),
+      label: e.label,
+      async: e.topic !== void 0,
+      ...e.legend ? { legend: e.legend } : {}
+    });
+  }
+  return { type: "diagram", title: "Diagram view", source, groups: [], nodes, edges };
+}
+
+// packages/diagrams/dist/hierarchy.js
+var NoSuchNode = class extends Error {
+};
+var KIND_ORDER = [
+  "estate",
+  "system",
+  "repo",
+  "component",
+  "endpoint",
+  "topic",
+  "client",
+  "store",
+  "table",
+  "deployment",
+  "environment",
+  "unknown"
+];
+var LENS_KINDS = {
+  architecture: /* @__PURE__ */ new Set([
+    "estate",
+    "system",
+    "repo",
+    "component",
+    "endpoint",
+    "topic",
+    "client",
+    "store",
+    "unknown"
+  ]),
+  repo: /* @__PURE__ */ new Set([
+    "estate",
+    "system",
+    "repo",
+    "component",
+    "endpoint",
+    "topic",
+    "client",
+    "store",
+    "table",
+    "unknown"
+  ]),
+  data: /* @__PURE__ */ new Set(["estate", "system", "repo", "component", "store", "table", "unknown"]),
+  integration: /* @__PURE__ */ new Set([
+    "estate",
+    "system",
+    "repo",
+    "component",
+    "endpoint",
+    "topic",
+    "client",
+    "unknown"
+  ]),
+  infrastructure: /* @__PURE__ */ new Set(["estate", "system", "repo", "component", "deployment", "environment"])
+};
+var LENS_EDGES = {
+  architecture: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes", "uses", "reads", "writes"]),
+  repo: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes", "uses", "reads", "writes", "references"]),
+  data: /* @__PURE__ */ new Set(["reads", "writes", "references"]),
+  integration: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes"]),
+  infrastructure: /* @__PURE__ */ new Set(["deployed-to"])
+};
+var LENS_ANCHORS = {
+  data: /* @__PURE__ */ new Set(["store", "table"]),
+  integration: /* @__PURE__ */ new Set(["endpoint", "topic", "client"]),
+  infrastructure: /* @__PURE__ */ new Set(["deployment", "environment"])
+};
+var DETAILED_LIMIT = 60;
+var MAX_EVIDENCE = 5;
+var TOPIC_TYPES = /* @__PURE__ */ new Set(["event-topic", "mq-queue"]);
+var slug2 = (s) => s.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+/, "").slice(0, 120) || "x";
+function viewKey(lens, node, mode = "node") {
+  return [lens, ...mode === "focus" ? ["focus"] : [], node.replace(/:/g, "-")].join(".");
+}
+function evidenceOf(es) {
+  return es.map((e) => ({
+    source: e.source,
+    ...e.repo ? { repo: e.repo } : {},
+    at: e.path ? e.line ? `${e.path}:${e.line}` : e.path : e.repo ?? e.source
+  }));
+}
+function mergeEvidence(...lists) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const l of lists)
+    for (const e of l)
+      seen.set(`${e.repo ?? ""}\0${e.at}\0${e.source}`, e);
+  return [...seen.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, e]) => e).slice(0, MAX_EVIDENCE);
+}
+var STATE = {
+  current: "current",
+  "planned-new": "new",
+  "planned-modify": "changed",
+  "planned-retire": "retired",
+  retired: "retired"
+};
+function recordGaps(r) {
+  const g = [];
+  if (r.confidence === "inferred")
+    g.push("inferred");
+  for (const f of r.flags ?? [])
+    g.push(f);
+  return g;
+}
+var props = (o) => {
+  const out = {};
+  for (const [k, v] of Object.entries(o)) {
+    if (v === void 0 || v === null)
+      continue;
+    if (Array.isArray(v)) {
+      if (v.length)
+        out[k] = v.map(String);
+    } else if (typeof v === "string" || typeof v === "number" || typeof v === "boolean")
+      out[k] = v;
+  }
+  return out;
+};
+var all = (rs, k) => rs.filter((r) => r.kind === k).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+function buildEstate(records2) {
+  const nodes = /* @__PURE__ */ new Map();
+  const atoms = [];
+  const add = (n) => {
+    if (!nodes.has(n.id))
+      nodes.set(n.id, n);
+    return n.id;
+  };
+  const fromRecord = (r, id, kind, label, parent, p, extraGaps = []) => ({
+    id,
+    kind,
+    label,
+    parent,
+    record: r,
+    state: STATE[r.status] ?? "current",
+    gaps: [...recordGaps(r), ...extraGaps],
+    evidence: evidenceOf(r.evidence),
+    properties: props({ ...p, confidence: r.confidence }),
+    next: {
+      command: `atticus impact ${r.id}`,
+      why: "See what a change here reaches, with owners and open questions."
+    }
+  });
+  add({
+    id: "estate",
+    kind: "estate",
+    label: "Estate",
+    state: "current",
+    gaps: [],
+    evidence: [],
+    properties: {},
+    next: {
+      command: "atticus map <repo>",
+      why: "Read a repo again when its code has changed: your assistant writes its facts, then atticus verify <repo> --write puts them here."
+    }
+  });
+  const systemRecords = new Map(all(records2, "System").map((s) => [s.id, s]));
+  const components = new Map(all(records2, "Component").map((c) => [c.id, c]));
+  const named = /* @__PURE__ */ new Set();
+  for (const c of components.values())
+    if (!systemRecords.has(c.system))
+      named.add(c.system);
+  const outside = /* @__PURE__ */ new Set();
+  for (const i of all(records2, "Interface"))
+    for (const end of [i.from, i.to])
+      if (!components.has(end) && !systemRecords.has(end) && !named.has(end))
+        outside.add(end);
+  const systems = /* @__PURE__ */ new Set([...systemRecords.keys(), ...named, ...outside]);
+  for (const id of [...named, ...outside].sort())
+    add({
+      id: `system:${id}`,
+      kind: "system",
+      label: id,
+      parent: "estate",
+      state: "current",
+      gaps: [],
+      evidence: [],
+      properties: { boundary: outside.has(id) ? "outside" : "product" },
+      next: outside.has(id) ? {
+        command: `atticus query "kind:interface to:${id}"`,
+        why: "List the calls made to it: it is outside the estate, named by the code that calls it."
+      } : {
+        command: `atticus query "system:${id}"`,
+        why: "List what the catalog holds of it: the manifest names it, and no System record says more yet."
+      }
+    });
+  for (const s of systemRecords.values())
+    add({
+      ...fromRecord(s, `system:${s.id}`, "system", s.name || s.id, "estate", {
+        boundary: s.boundary,
+        owner: s.owner,
+        repos: s.repos,
+        tags: s.tags
+      }),
+      next: {
+        command: `atticus guide ${s.id}`,
+        why: "Read the system's guide: its parts, calls, data and what isn't known yet."
+      }
+    });
+  const repoSystem = /* @__PURE__ */ new Map();
+  for (const s of systemRecords.values())
+    for (const repo of s.repos)
+      if (!repoSystem.has(repo))
+        repoSystem.set(repo, s.id);
+  for (const c of components.values())
+    if (c.repo && !repoSystem.has(c.repo))
+      repoSystem.set(c.repo, c.system);
+  const repoNode = (repo) => `repo:${slug2(repo)}`;
+  for (const [repo, sys] of [...repoSystem.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
+    const parent = systems.has(sys) ? `system:${sys}` : "estate";
+    const ev = [...components.values()].filter((c) => c.repo === repo).flatMap((c) => evidenceOf(c.evidence).filter((e) => !e.repo || e.repo === repo));
+    add({
+      id: repoNode(repo),
+      kind: "repo",
+      label: repo,
+      parent,
+      state: "current",
+      gaps: parent === "estate" ? ["no-system"] : [],
+      evidence: mergeEvidence(ev),
+      properties: { name: repo },
+      next: {
+        command: `atticus map ${repo}`,
+        why: "Read the repo again when its code has changed; Map \u203A Trust says how far its map is trusted now."
+      }
+    });
+  }
+  const unknown = (ref) => add({
+    id: `unknown:${slug2(ref)}`,
+    kind: "unknown",
+    label: ref,
+    parent: "estate",
+    state: "current",
+    gaps: ["not-in-catalog"],
+    evidence: [],
+    properties: {},
+    next: {
+      command: `atticus query "refs:${ref}"`,
+      why: "Find the records that name it; the catalog has no record of its own for it."
+    }
+  });
+  const partNode = (ref) => components.has(ref) ? `component:${ref}` : systems.has(ref) ? `system:${ref}` : unknown(ref);
+  for (const c of components.values()) {
+    const gaps = [];
+    let parent;
+    if (c.repo)
+      parent = repoNode(c.repo);
+    else {
+      gaps.push("no-repo");
+      parent = systems.has(c.system) ? `system:${c.system}` : "estate";
+    }
+    if (!systems.has(c.system))
+      gaps.push("no-system");
+    add(fromRecord(c, `component:${c.id}`, "component", c.id, parent, { type: c.type, runtime: c.runtime, repo: c.repo, path: c.path }, gaps));
+  }
+  const endpointNode = /* @__PURE__ */ new Map();
+  for (const e of all(records2, "Endpoint")) {
+    const topic = TOPIC_TYPES.has(e.endpointType);
+    const id = `${topic ? "topic" : "endpoint"}:${e.id}`;
+    const gaps = [];
+    let parent = `component:${e.component}`;
+    if (!components.has(e.component)) {
+      gaps.push("no-component");
+      parent = systems.has(e.component) ? `system:${e.component}` : "estate";
+    }
+    add(fromRecord(e, id, topic ? "topic" : "endpoint", !topic && e.method ? `${e.method} ${e.pathOrTopic}` : e.pathOrTopic, parent, {
+      endpointType: e.endpointType,
+      method: e.method,
+      pathOrTopic: e.pathOrTopic,
+      auth: e.auth
+    }, gaps));
+    endpointNode.set(e.id, id);
+  }
+  const storeNode = /* @__PURE__ */ new Map();
+  for (const d of all(records2, "DataStore")) {
+    const owner = d.ownerComponent && components.has(d.ownerComponent);
+    const id = `store:${d.id}`;
+    add(fromRecord(d, id, "store", d.id, owner ? `component:${d.ownerComponent}` : "estate", { storeType: d.storeType, entitiesHeld: d.entitiesHeld }, owner ? [] : ["no-owner"]));
+    storeNode.set(d.id, id);
+  }
+  const tables = all(records2, "Table");
+  for (const t of tables) {
+    const store = storeNode.get(t.dataStore);
+    add(fromRecord(t, `table:${t.id}`, "table", t.name, store ?? "estate", { tableKind: t.tableKind, retention: t.retention, dataStore: t.dataStore }, store ? [] : ["no-store"]));
+  }
+  for (const d of all(records2, "Deployment")) {
+    const env = `environment:${slug2(d.env)}`;
+    add({
+      id: env,
+      kind: "environment",
+      label: d.env,
+      parent: "estate",
+      state: "current",
+      gaps: [],
+      evidence: [],
+      properties: { env: d.env },
+      next: {
+        command: `atticus query "kind:deployment env:${d.env}"`,
+        why: "List what is deployed here."
+      }
+    });
+    const parent = components.has(d.component) ? `component:${d.component}` : "estate";
+    const id = add(fromRecord(d, `deployment:${d.id}`, "deployment", `${d.env} on ${d.platform}`, parent, { env: d.env, platform: d.platform, replicas: d.replicas }, parent === "estate" ? ["no-component"] : []));
+    atoms.push({
+      from: id,
+      to: env,
+      type: "deployed-to",
+      evidence: evidenceOf(d.evidence),
+      gaps: recordGaps(d)
+    });
+  }
+  for (const i of all(records2, "Interface")) {
+    const from = partNode(i.from);
+    const to = partNode(i.to);
+    const ev = evidenceOf(i.evidence);
+    const gaps = [...recordGaps(i), ...i.conflicts.length ? ["conflicts"] : []];
+    const target = i.endpoint ? endpointNode.get(i.endpoint) : void 0;
+    if (target?.startsWith("topic:")) {
+      atoms.push({ from, to: target, type: "publishes", evidence: ev, gaps });
+      atoms.push({ from: to, to: target, type: "subscribes", evidence: ev, gaps });
+      continue;
+    }
+    let caller = from;
+    if (from.startsWith("component:")) {
+      caller = add({
+        id: `client:${i.from}.${slug2(i.to)}`,
+        kind: "client",
+        label: `Calls ${i.to}`,
+        parent: from,
+        state: "current",
+        gaps: [],
+        evidence: [],
+        properties: { target: i.to },
+        next: {
+          command: `atticus query "kind:interface from:${i.from} to:${i.to}"`,
+          why: "List each call this client makes."
+        }
+      });
+      const c = nodes.get(caller);
+      const callerSide = evidenceOf(i.evidence.filter((x) => x.side === "caller"));
+      c.evidence = mergeEvidence(c.evidence, callerSide.length ? callerSide : ev);
+      c.gaps = [.../* @__PURE__ */ new Set([...c.gaps, ...gaps])].sort();
+    }
+    atoms.push({
+      from: caller,
+      to: target ?? to,
+      type: "calls",
+      sync: i.sync,
+      via: i.via,
+      evidence: ev,
+      gaps: [...gaps, ...i.endpoint && !target ? ["no-endpoint"] : []]
+    });
+  }
+  for (const c of components.values())
+    for (const u of c.uses ?? [])
+      atoms.push({
+        from: `component:${c.id}`,
+        to: partNode(u),
+        type: "uses",
+        evidence: evidenceOf(c.evidence),
+        gaps: recordGaps(c)
+      });
+  for (const t of tables) {
+    const ev = evidenceOf(t.evidence);
+    const part = (ref) => {
+      const n = partNode(ref);
+      const repo = components.get(ref)?.repo;
+      const mine = repo ? ev.filter((e) => e.repo === repo) : [];
+      return { n, ev: mine.length ? mine : ev };
+    };
+    for (const r of t.readers) {
+      const p = part(r);
+      atoms.push({
+        from: p.n,
+        to: `table:${t.id}`,
+        type: "reads",
+        evidence: p.ev,
+        gaps: recordGaps(t)
+      });
+    }
+    for (const w of t.writers) {
+      const p = part(w);
+      atoms.push({
+        from: p.n,
+        to: `table:${t.id}`,
+        type: "writes",
+        evidence: p.ev,
+        gaps: recordGaps(t)
+      });
+    }
+  }
+  const tableIds = new Set(tables.map((t) => t.id));
+  for (const k of all(records2, "IndexConstraint")) {
+    if (k.constraintKind !== "foreign-key" || !k.references)
+      continue;
+    if (!tableIds.has(k.table))
+      continue;
+    atoms.push({
+      from: `table:${k.table}`,
+      to: tableIds.has(k.references.table) ? `table:${k.references.table}` : unknown(k.references.table),
+      type: "references",
+      evidence: evidenceOf(k.evidence),
+      gaps: recordGaps(k)
+    });
+  }
+  const kids = /* @__PURE__ */ new Map();
+  for (const n of nodes.values()) {
+    if (!n.parent)
+      continue;
+    if (!nodes.has(n.parent))
+      n.parent = "estate";
+    const l = kids.get(n.parent) ?? [];
+    l.push(n.id);
+    kids.set(n.parent, l);
+  }
+  const rank = (id) => KIND_ORDER.indexOf(nodes.get(id).kind);
+  for (const l of kids.values())
+    l.sort((a, b) => rank(a) - rank(b) || (a < b ? -1 : a > b ? 1 : 0));
+  for (const n of nodes.values())
+    n.gaps = [...new Set(n.gaps)].sort();
+  const est = { nodes, kids, atoms, visible: /* @__PURE__ */ new Map() };
+  for (const lens of Object.keys(LENS_KINDS))
+    est.visible.set(lens, visibleIn(est, lens));
+  return est;
+}
+function visibleIn(est, lens) {
+  const kinds = LENS_KINDS[lens];
+  const anchors = LENS_ANCHORS[lens];
+  const ok = (id) => kinds.has(est.nodes.get(id).kind);
+  if (!anchors)
+    return new Set([...est.nodes.keys()].filter(ok));
+  const seeds = /* @__PURE__ */ new Set();
+  for (const n of est.nodes.values())
+    if (anchors.has(n.kind))
+      seeds.add(n.id);
+  for (const a of est.atoms)
+    if (LENS_EDGES[lens].has(a.type)) {
+      seeds.add(a.from);
+      seeds.add(a.to);
+    }
+  const out = /* @__PURE__ */ new Set(["estate"]);
+  for (const s of seeds)
+    for (let id = s; id; id = est.nodes.get(id)?.parent)
+      if (ok(id))
+        out.add(id);
+  return out;
+}
+var ancestors = (est, id) => {
+  const out = [];
+  for (let p = est.nodes.get(id)?.parent; p; p = est.nodes.get(p)?.parent)
+    out.unshift(p);
+  return out;
+};
+var lift = (est, lens, id) => {
+  const vis = est.visible.get(lens);
+  let cur = id;
+  while (cur && !vis.has(cur))
+    cur = est.nodes.get(cur)?.parent;
+  return cur ?? "estate";
+};
+var kidsIn = (est, lens, id) => (est.kids.get(id) ?? []).filter((k) => est.visible.get(lens).has(k));
+function toNode(est, lens, id) {
+  const r = est.nodes.get(id);
+  return {
+    id: r.id,
+    kind: r.kind,
+    label: r.label,
+    ...r.parent ? { parent: r.parent } : {},
+    childCount: kidsIn(est, lens, id).length,
+    state: r.state,
+    gaps: r.gaps,
+    evidence: r.evidence,
+    properties: r.properties,
+    ...r.record ? { record: { kind: r.record.kind, id: r.record.id } } : {},
+    ...r.next ? { next: r.next } : {}
+  };
+}
+function need(est, lens, id) {
+  if (!est.nodes.has(id))
+    throw new NoSuchNode(`There is no node ${id}.`);
+  if (!est.visible.get(lens).has(id))
+    throw new NoSuchNode(`There is no node ${id} in the ${lens} lens.`);
+}
+function merge(mapped) {
+  const by = /* @__PURE__ */ new Map();
+  for (const { from, to, atom } of mapped) {
+    const id = `${atom.type}:${from}>${to}`;
+    const e = by.get(id);
+    if (!e) {
+      by.set(id, {
+        id,
+        from,
+        to,
+        type: atom.type,
+        ...atom.sync ? { sync: atom.sync } : {},
+        ...atom.via ? { via: atom.via } : {},
+        count: 1,
+        state: "current",
+        gaps: [...new Set(atom.gaps)].sort(),
+        evidence: mergeEvidence(atom.evidence)
+      });
+      continue;
+    }
+    e.count++;
+    if (atom.sync && e.sync !== atom.sync)
+      e.sync = "mixed";
+    if (atom.via && e.via !== atom.via)
+      e.via = "mixed";
+    e.gaps = [.../* @__PURE__ */ new Set([...e.gaps, ...atom.gaps])].sort();
+    e.evidence = mergeEvidence(e.evidence, atom.evidence);
+  }
+  return [...by.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+function reduceUses(edges) {
+  const uses = edges.filter((e) => e.type === "uses");
+  const out = /* @__PURE__ */ new Map();
+  for (const e of uses)
+    out.set(e.from, [...out.get(e.from) ?? [], e.to]);
+  const reachesWithout = (from, to, skip) => {
+    const seen = /* @__PURE__ */ new Set();
+    const stack = (out.get(from) ?? []).filter((n) => !(from === skip.from && n === skip.to));
+    while (stack.length) {
+      const n = stack.pop();
+      if (n === to)
+        return true;
+      if (seen.has(n))
+        continue;
+      seen.add(n);
+      stack.push(...out.get(n) ?? []);
+    }
+    return false;
+  };
+  const drop = new Set(uses.filter((e) => reachesWithout(e.from, e.to, e)).map((e) => e.id));
+  return { edges: edges.filter((e) => !drop.has(e.id)), hidden: drop.size };
+}
+function nodeView(est, id, o) {
+  const { lens } = o;
+  const depth = Math.max(1, Math.min(3, o.depth ?? 1));
+  need(est, lens, id);
+  const shown = [];
+  let level = [id];
+  for (let d = 0; d < depth; d++) {
+    level = level.flatMap((n) => kidsIn(est, lens, n));
+    shown.push(...level);
+  }
+  const shownSet = new Set(shown);
+  const upToN = [...ancestors(est, id), id];
+  const inside = (x) => x === id || ancestors(est, x).includes(id);
+  const place = (x) => {
+    if (x === id)
+      return x;
+    if (inside(x)) {
+      let cur = x;
+      while (cur && !shownSet.has(cur) && cur !== id)
+        cur = est.nodes.get(cur)?.parent;
+      return cur ?? id;
+    }
+    if (upToN.includes(x))
+      return x;
+    const ax = [...ancestors(est, x), x];
+    let i = 0;
+    while (i < ax.length && ax[i] === upToN[i])
+      i++;
+    return ax[i] ?? x;
+  };
+  const types = LENS_EDGES[lens];
+  const mapped = [];
+  for (const atom of est.atoms) {
+    if (!types.has(atom.type))
+      continue;
+    const a = lift(est, lens, atom.from);
+    const b = lift(est, lens, atom.to);
+    if (!inside(a) && !inside(b))
+      continue;
+    const from = place(a);
+    const to = place(b);
+    if (from === to)
+      continue;
+    mapped.push({ from, to, atom });
+  }
+  let edges = merge(mapped);
+  let hidden = 0;
+  if (!o.all)
+    ({ edges, hidden } = reduceUses(edges));
+  const outside = [...new Set(edges.flatMap((e) => [e.from, e.to]))].filter((n) => n !== id && !shownSet.has(n)).sort();
+  const children = shown.map((n) => toNode(est, lens, n));
+  const firstTable = children.find((c) => c.kind === "table");
+  const suggest = lens === "data" && firstTable ? { mode: "focus", id: firstTable.id } : shown.length + outside.length > DETAILED_LIMIT ? { mode: "group" } : void 0;
+  return {
+    lens,
+    node: toNode(est, lens, id),
+    path: ancestors(est, id).map((n) => toNode(est, lens, n)),
+    children,
+    outside: outside.map((n) => toNode(est, lens, n)),
+    edges,
+    reduced: !o.all,
+    hiddenEdges: hidden,
+    ...suggest ? { suggest } : {}
+  };
+}
+function focusView(est, id, o) {
+  const { lens } = o;
+  need(est, lens, id);
+  const inside = (x) => x === id || ancestors(est, x).includes(id);
+  const types = LENS_EDGES[lens];
+  const ends = est.atoms.filter((a) => types.has(a.type)).map((atom) => {
+    const a = lift(est, lens, atom.from);
+    const b = lift(est, lens, atom.to);
+    return { from: inside(a) ? id : a, to: inside(b) ? id : b, atom };
+  }).filter((e) => e.from !== e.to);
+  const near = /* @__PURE__ */ new Set();
+  for (const e of ends) {
+    if (e.from === id)
+      near.add(e.to);
+    if (e.to === id)
+      near.add(e.from);
+  }
+  const set = /* @__PURE__ */ new Set([id, ...near]);
+  return {
+    lens,
+    node: toNode(est, lens, id),
+    path: ancestors(est, id).map((n) => toNode(est, lens, n)),
+    neighbours: [...near].sort().map((n) => toNode(est, lens, n)),
+    edges: merge(ends.filter((e) => set.has(e.from) && set.has(e.to)))
+  };
+}
+
+// packages/diagrams/dist/flow-sequence.js
+var CALLER = {
+  endpoint: "Caller not known",
+  listener: "A message",
+  job: "A schedule",
+  action: "A person",
+  page: "A person"
+};
+function flowSequenceView(flow2, o = {}) {
+  const participants = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lane = (id, label = id) => {
+    if (seen.has(id))
+      return;
+    seen.add(id);
+    participants.push({ id, label });
+  };
+  const caller = flow2.trigger.caller?.who ?? CALLER[flow2.trigger.kind];
+  lane("caller", caller);
+  lane(flow2.component);
+  const steps = [
+    { kind: "message", from: "caller", to: flow2.component, label: flow2.trigger.what, async: false }
+  ];
+  flow2.steps.forEach((s, i) => {
+    const n = `${i + 1}. ${s.kind}`;
+    if ((s.kind === "call-out" || s.kind === "publish") && s.to) {
+      const target = s.kind === "publish" ? s.to.entry : s.to.component;
+      lane(target);
+      steps.push({
+        kind: "message",
+        from: flow2.component,
+        to: target,
+        label: `${n}: ${s.to.entry}`,
+        async: s.kind === "publish"
+      });
+    } else if (s.store && (s.kind === "read" || s.kind === "lookup" || s.kind === "write")) {
+      lane(s.store.table);
+      const cols = s.store.columns.length ? ` (${s.store.columns.join(", ")})` : "";
+      steps.push({
+        kind: "message",
+        from: flow2.component,
+        to: s.store.table,
+        label: `${n}: ${s.what}${cols}`,
+        async: false
+      });
+    } else if (s.kind === "respond") {
+      steps.push({
+        kind: "message",
+        from: flow2.component,
+        to: "caller",
+        label: `${n}: ${s.what}`,
+        async: false,
+        reply: true
+      });
+    } else
+      steps.push({ kind: "note", over: [flow2.component], text: `${n}: ${s.what}` });
+  });
+  return {
+    type: "sequence",
+    title: flow2.name,
+    ...o.source ? { source: o.source } : {},
+    participants,
+    steps
+  };
+}
+
+// packages/verify/dist/map.js
+import { posix } from "node:path";
+var cmp2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var HEADER2 = (repo, what) => `<!-- Rendered by atticus map render ${repo} from ${what} (ADR 0124). Don't edit: correct the facts and run atticus verify ${repo} --write. -->`;
+function trustOf(report) {
+  const r = report;
+  if (!r || typeof r.accepted !== "number" || typeof r.rejected !== "number")
+    return void 0;
+  const ratio = typeof r.coverage?.ratio === "number" ? r.coverage.ratio : 0;
+  const unknown = Array.isArray(r.coverage?.unknown) ? r.coverage.unknown.length : 0;
+  const commit = typeof r.commit === "string" ? r.commit : void 0;
+  const reviewed = typeof r.coverage?.reviewed === "number" ? r.coverage.reviewed : 0;
+  return {
+    accepted: r.accepted,
+    rejected: r.rejected,
+    ratio,
+    unknown,
+    ...reviewed > 0 ? { reviewed } : {},
+    ...commit ? { commit } : {}
+  };
+}
+function codeLinkerFor(o) {
+  let web;
+  const url = o.url?.trim();
+  if (url && /^https?:\/\//i.test(url))
+    web = url;
+  else if (url) {
+    const scp = /^[^@/\s]+@([^:/\s]+):(.+)$/.exec(url);
+    if (scp)
+      web = `https://${scp[1]}/${scp[2]}`;
+  }
+  if (web) {
+    const base = web.replace(/\/+$/, "").replace(/\.git$/, "");
+    const ado = /(^https?:\/\/dev\.azure\.com\/)|(\.visualstudio\.com\/)/i.test(base);
+    return (path, line, commit) => {
+      const p = encodeURI(path);
+      if (ado)
+        return `${base}?path=/${p}${commit ? `&version=GC${commit}` : ""}${line ? `&line=${line}` : ""}`;
+      return `${base}/blob/${commit ?? "HEAD"}/${p}${line ? `#L${line}` : ""}`;
+    };
+  }
+  const dir = (o.dir ?? "").replace(/\/+$/, "");
+  return (path, line, _commit, from) => {
+    const target = dir ? `${dir}/${path}` : path;
+    const rel = posix.relative(posix.dirname(from), target);
+    return `${encodeURI(rel)}${line ? `#L${line}` : ""}`;
+  };
+}
+function ownEvidence(r, repo) {
+  const ev = r.evidence.filter((e) => e.path && (!e.repo || e.repo === repo));
+  return ev[0];
+}
+function cite(c, e) {
+  if (!e?.path)
+    return "(no citation)";
+  const commit = e.commit ?? c.i.trust?.commit;
+  const at = `${e.path}${e.line ? `:${e.line}` : ""}`;
+  return `[${at}](${c.i.codeLink(e.path, e.line, commit, c.from)})`;
+}
+var code = (s) => `\`${s.replace(/`/g, "'")}\``;
+var list = (xs) => xs.join(", ");
+var pct = (r) => `${Math.round(r * 100)}%`;
+var plural2 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+function records(c, kind) {
+  return c.i.records.filter((r) => r.kind === kind).sort((a, b) => cmp2(a.id, b.id));
+}
+function link(from, to) {
+  return encodeURI(posix.relative(posix.dirname(from), to));
+}
+function questionsFor(c, e) {
+  if (!e?.path || !e.line)
+    return [];
+  const at = `${e.path}:${e.line}`;
+  return (c.i.questions ?? []).filter((q) => q.evidence.includes(at));
+}
+function asked(c, e) {
+  const qs = questionsFor(c, e).sort((a, b) => cmp2(a.id, b.id));
+  if (!qs.length)
+    return "";
+  return ` Asked: ${qs.map((q) => `[${q.question}](${link(c.from, `${c.i.paths.questions}/${q.id}.yaml`)})`).join("; ")}`;
+}
+var APIGEE_FILE = /(^|\/)(apiproxy|sharedflowbundle)\//;
+var lineKey = (e) => e?.path ? `${e.path}:${e.line ?? ""}` : "";
+function callersOf(c, e) {
+  const own = ownEvidence(e, c.i.repo);
+  const at = lineKey(own);
+  const route = at ? records(c, "GatewayRoute").find((r) => lineKey(r.evidence[0]) === at) : void 0;
+  if (!route && !(own?.path && APIGEE_FILE.test(own.path)))
+    return void 0;
+  if (!route)
+    return "callers unknown";
+  const grants = records(c, "AccessGrant").filter((g) => g.resource === route.id);
+  const kindOf = (g) => g.flags?.find((f) => f.startsWith("caller:"))?.slice("caller:".length) ?? g.subjectKind;
+  const grantAt = new Map(grants.map((g) => [lineKey(g.evidence[0]), g]));
+  const linked = /* @__PURE__ */ new Set();
+  const declared = [];
+  const scanned = /* @__PURE__ */ new Set();
+  for (const i of records(c, "Interface").filter((x) => x.route === route.id)) {
+    if (i.confidence !== "asserted") {
+      scanned.add(i.from);
+      continue;
+    }
+    const g = i.evidence.map((x) => grantAt.get(lineKey(x))).find((x) => !!x);
+    if (g)
+      linked.add(g.id);
+    const sys = c.byId.get(i.from);
+    const name = sys?.kind === "System" ? sys.name : i.from;
+    declared.push(`${name} (declared${g ? `; ${kindOf(g)} ${g.subject}` : ""})`);
+  }
+  const order = (k) => k === "product" ? 1 : 0;
+  const named = grants.filter((g) => !linked.has(g.id)).sort((a, b) => order(kindOf(a)) - order(kindOf(b)) || cmp2(a.subject, b.subject)).map((g) => `${kindOf(g)} ${g.subject}`);
+  const all2 = [...new Set(declared)].sort(cmp2).concat(named, [...scanned].sort(cmp2));
+  return all2.length ? `callers ${list(all2)}` : "callers unknown";
+}
+function serves(c) {
+  const eps = records(c, "Endpoint").filter((e) => c.comps.has(e.component));
+  if (!eps.length)
+    return ["Nothing read yet."];
+  const out = [];
+  for (const comp of [...new Set(eps.map((e) => e.component))].sort(cmp2)) {
+    out.push(`### ${comp}`, "");
+    const mine = eps.filter((e) => e.component === comp).sort((a, b) => cmp2(a.pathOrTopic, b.pathOrTopic) || cmp2(a.method ?? "", b.method ?? "") || cmp2(a.id, b.id));
+    for (const e of mine) {
+      const what = [e.method, e.pathOrTopic].filter(Boolean).join(" ");
+      const notes = [e.endpointType, ...e.auth ? [`auth ${e.auth}`] : []];
+      const who = callersOf(c, e);
+      if (who)
+        notes.push(who);
+      for (const side of ["request", "response"]) {
+        const s = c.byId.get(`${e.id}.${side}`);
+        if (s?.kind === "Schema" && s.fields.length)
+          notes.push(`${side}: ${list(s.fields.map((f) => f.name))}`);
+      }
+      out.push(`- ${code(what)} (${notes.join("; ")}): ${cite(c, ownEvidence(e, c.i.repo))}`);
+    }
+    out.push("");
+  }
+  return out.slice(0, -1);
+}
+var LOOSE_CALLS = /* @__PURE__ */ new Set(["http-call", "call", "event-publish", "graphql-call", "grpc-call"]);
+function targetName(c, id) {
+  const r = c.byId.get(id);
+  if (r?.kind === "System")
+    return `${id} (${r.name}, ${r.boundary})`;
+  if (r?.kind === "Component")
+    return `${id} (${r.system}${r.repo ? `, ${r.repo}` : ""})`;
+  return id;
+}
+function gatewayHops(c, i) {
+  if (i.via !== "gateway")
+    return [];
+  const order = i.evidence.filter((e) => e.side === "gateway" && e.path).map((e) => `${e.repo ?? ""}|${e.path}:${e.line}`);
+  if (!order.length)
+    return [];
+  return records(c, "GatewayRoute").flatMap((r) => {
+    const own = r.evidence[0];
+    const at = own?.path ? `${own.repo ?? ""}|${own.path}:${own.line}` : "";
+    const n = order.indexOf(at);
+    return n < 0 ? [] : [{ r, n }];
+  }).sort((a, b) => a.n - b.n || cmp2(a.r.id, b.r.id)).map((x) => x.r);
+}
+function hopText(r) {
+  const what = [
+    ...r.policies.length ? [list(r.policies)] : [],
+    r.scopes.length ? `scopes ${list(r.scopes)}` : "no scope"
+  ];
+  return `${r.proxy} ${r.basepath} (${what.join("; ")})`;
+}
+function calls(c) {
+  const ifs = records(c, "Interface").filter((i) => c.comps.has(i.from));
+  const loose = records(c, "Unresolved").filter((u) => u.owner && c.comps.has(u.owner) && LOOSE_CALLS.has(u.unresolvedKind));
+  if (!ifs.length && !loose.length)
+    return ["Nothing read yet."];
+  const out = [];
+  for (const to of [...new Set(ifs.map((i) => i.to))].sort(cmp2)) {
+    out.push(`### ${targetName(c, to)}`, "");
+    for (const i of ifs.filter((x) => x.to === to).sort((a, b) => cmp2(a.normalizedPath ?? "", b.normalizedPath ?? "") || cmp2(a.id, b.id))) {
+      const what = [i.method, i.normalizedPath].filter(Boolean).join(" ");
+      const req = c.byId.get(`${i.id}.request`);
+      const hops = gatewayHops(c, i);
+      const notes = [
+        `from ${i.from}`,
+        i.sync,
+        hops.length ? `via ${hops.map(hopText).join(" then ")}` : `via ${i.via}`,
+        ...hops.length && i.auth ? [`the caller meets ${i.auth}`] : [],
+        ...i.endpoint ? [`reaches ${i.endpoint}`] : [],
+        ...req?.kind === "Schema" && req.fields.length ? [`sends ${list(req.fields.map((f) => f.name))}`] : []
+      ];
+      const e = i.evidence.find((x) => x.side === "caller" && x.repo === c.i.repo) ?? ownEvidence(i, c.i.repo);
+      out.push(`- ${code(what || i.id)} (${notes.join("; ")}): ${cite(c, e)}`);
+    }
+    out.push("");
+  }
+  if (loose.length) {
+    out.push("### Not joined yet", "");
+    for (const u of loose.sort((a, b) => cmp2(a.raw, b.raw) || cmp2(a.id, b.id))) {
+      const e = ownEvidence(u, c.i.repo);
+      out.push(`- ${code(u.raw)} (from ${u.owner}; ${u.unresolvedKind}): ${cite(c, e)}.${asked(c, e)}`);
+    }
+    out.push("");
+  }
+  return out.slice(0, -1);
+}
+function stores(c) {
+  const tables = records(c, "Table").filter((t) => t.ownerComponent && c.comps.has(t.ownerComponent) || t.readers.some((x) => c.comps.has(x)) || t.writers.some((x) => c.comps.has(x)));
+  if (!tables.length)
+    return ["Nothing read yet."];
+  const columns = records(c, "Column");
+  const out = [];
+  for (const ds of [...new Set(tables.map((t) => t.dataStore))].sort(cmp2)) {
+    const store = c.byId.get(ds);
+    out.push(`### ${ds}${store?.kind === "DataStore" ? ` (${store.storeType})` : ""}`, "");
+    for (const t of tables.filter((x) => x.dataStore === ds)) {
+      const how = [
+        ...t.readers.length ? [`read by ${list(t.readers)}`] : [],
+        ...t.writers.length ? [`written by ${list(t.writers)}`] : []
+      ];
+      out.push(`- ${code(t.name)} (${t.tableKind}${how.length ? `; ${how.join("; ")}` : ""}): ${cite(c, ownEvidence(t, c.i.repo))}`);
+      for (const col of columns.filter((x) => x.table === t.id).sort((a, b) => cmp2(a.name, b.name))) {
+        const notes = [
+          col.type,
+          ...col.nullable === false ? ["not null"] : [],
+          ...col.classification ? [col.classification] : []
+        ];
+        out.push(`  - ${code(col.name)} (${notes.join("; ")}): ${cite(c, ownEvidence(col, c.i.repo))}`);
+      }
+    }
+    out.push("");
+  }
+  return out.slice(0, -1);
+}
+function deploys(c) {
+  const ds = records(c, "Deployment").filter((d) => c.comps.has(d.component));
+  if (!ds.length)
+    return ["Nothing read yet."];
+  return ds.map((d) => {
+    const notes = [
+      `env ${d.env}`,
+      ...d.replicas !== void 0 ? [plural2(d.replicas, "replica")] : []
+    ];
+    return `- ${code(d.component)} on ${d.platform} (${notes.join("; ")}): ${cite(c, ownEvidence(d, c.i.repo))}`;
+  });
+}
+var NAMES_A_SYSTEM = /^[a-z][a-z0-9+.-]*:\/\//i;
+function config(c) {
+  const ss = records(c, "Setting").filter((s) => c.comps.has(s.component) && (s.target || NAMES_A_SYSTEM.test(s.valueOrRef)));
+  if (!ss.length)
+    return ["Nothing read yet."];
+  return ss.sort((a, b) => cmp2(a.key, b.key) || cmp2(a.id, b.id)).map((s) => {
+    const notes = [s.settingKind, `in ${s.component}`, ...s.target ? [`for ${s.target}`] : []];
+    return `- ${code(`${s.key} = ${s.valueOrRef}`)} (${notes.join("; ")}): ${cite(c, ownEvidence(s, c.i.repo))}`;
+  });
+}
+var flowFile = (f) => `flows/${f.id}.md`;
+function flowsList(c) {
+  if (!c.i.flows.length)
+    return ["Nothing read yet."];
+  return sortedFlows(c.i.flows).map((f) => {
+    const notes = [
+      `starts at ${code(f.trigger.what)}`,
+      plural2(f.steps.length, "step"),
+      plural2(f.errors.length, "error path")
+    ];
+    return `- [${f.name}](${flowFile(f)}) (${notes.join("; ")}): ${cite(c, f.trigger.evidence[0])}`;
+  });
+}
+function contracts(c, files) {
+  const out = [];
+  for (const [rel] of Object.entries(files).filter(([k]) => k.startsWith("contracts/"))) {
+    const comp = rel.slice("contracts/".length, -".openapi.yaml".length);
+    const n = restEndpoints(c, comp).length;
+    out.push(`- [${rel.slice("contracts/".length)}](${rel}): OpenAPI 3.1, ${plural2(n, "REST entry", "REST entries")} of ${comp}`);
+  }
+  const events = records(c, "Endpoint").filter((e) => c.comps.has(e.component) && (e.endpointType === "event-topic" || e.endpointType === "mq-queue"));
+  const publishes = records(c, "Interface").filter((i) => c.comps.has(i.from) && i.sync === "async");
+  if (events.length || publishes.length) {
+    out.push("", "Events (listed here; no AsyncAPI file is written):", "");
+    for (const e of events)
+      out.push(`- ${code(e.pathOrTopic)} (${e.endpointType}, listened to by ${e.component}): ${cite(c, ownEvidence(e, c.i.repo))}`);
+    for (const i of publishes)
+      out.push(`- ${code(i.normalizedPath ?? i.id)} (published by ${i.from} to ${i.to}): ${cite(c, ownEvidence(i, c.i.repo))}`);
+  }
+  return out.length ? out : ["Nothing read yet."];
+}
+function openQuestions(c) {
+  const qs = [...c.i.questions ?? []].sort((a, b) => cmp2(a.question, b.question) || cmp2(a.id, b.id));
+  if (!qs.length)
+    return ["None open."];
+  return qs.map((q) => `- [${q.question}](${link(c.from, `${c.i.paths.questions}/${q.id}.yaml`)}): cites ${list(q.evidence.map((e) => code(e)))}`);
+}
+function aboutLine(a, repo) {
+  if (!a)
+    return [`**What it is:** Nothing says yet: \`atticus repo describe ${repo}\`.`, ""];
+  const who = a.by ? `, ${a.by}` : "";
+  return [
+    a.trust === "suggested" ? `**What it is (unconfirmed draft${who}):** ${a.text} \u2014 drafted from the code and waiting for a person: \`atticus repo describe ${repo} --accept\`.` : `**What it is${who ? ` (${a.by})` : ""}:** ${a.text}`,
+    "",
+    "A person's note from the manifest, not read from the code: where the two disagree, the facts below are what the code says.",
+    ""
+  ];
+}
+function builtOnLine(c) {
+  const f = c.i.frameworks;
+  if (!f?.built.length)
+    return [];
+  const one = (b) => `${b.name}${b.version ? ` ${b.version}` : ""}${b.component ? ` (${b.component})` : ""} ${cite(c, b.cite)}`;
+  return [
+    `**Built on:** ${f.built.map(one).join(", ")} \u2014 read from the build files, each on the line that declares it.`,
+    "",
+    ...f.gaps?.length ? [
+      ...f.gaps.map((g) => `**Open: ${g.framework} shows none of its patterns here.** ${g.question}`),
+      ""
+    ] : []
+  ];
+}
+function trustLine(t, repo) {
+  if (!t)
+    return `**Trust:** No verify report yet: run \`atticus verify ${repo}\`.`;
+  return `**Trust:** ${plural2(t.accepted, "fact")} verified on their lines; coverage ${pct(t.ratio)} of source files (${plural2(t.unknown, "unknown file")}: cited by no fact and opened through no Atticus tool)${t.reviewed ? `; ${plural2(t.reviewed, "file")} reviewed by the reader with nothing to record (each with why, in the verify report)` : ""}; ${t.rejected} rejected.${t.commit ? ` Commit ${t.commit}.` : ""}`;
+}
+var sortedFlows = (fs) => [...fs].sort((a, b) => cmp2(a.id, b.id));
+var CONFIRMED = {
+  check: "Confirmed by the line check",
+  ai: "Confirmed by the assistant's check",
+  person: "Confirmed by a person"
+};
+function flowPage(c, f) {
+  const spec = `${c.i.paths.specs}/${f.id}.yaml`;
+  const out = [
+    `# ${f.name}`,
+    "",
+    HEADER2(c.i.repo, spec),
+    "",
+    `- Component: ${f.component}`,
+    `- Starts at: ${f.trigger.kind} ${code(f.trigger.what)}${f.trigger.ref ? ` (${code(f.trigger.ref)})` : ""}: ${cite(c, f.trigger.evidence[0])}`,
+    `- Spec: [${posix.basename(spec)}](${link(c.from, spec)})`,
+    "",
+    "## Steps",
+    ""
+  ];
+  f.steps.forEach((s, n) => {
+    const head = s.to && (s.kind === "call-out" || s.kind === "publish") ? ` to ${s.to.component} ${code(s.to.entry)}` : s.store ? ` ${code(s.store.table)}` : "";
+    out.push(`${n + 1}. **${s.kind}**${head}: ${s.what}. ${cite(c, s.evidence[0])}`);
+    const fields = [];
+    const d = s.data;
+    if (d)
+      for (const k of ["sends", "returns", "reads", "checks", "from", "to"]) {
+        const names = d[k] ?? [];
+        if (names.length)
+          fields.push(`${k} ${list(names)}`);
+      }
+    if (s.store?.columns.length)
+      fields.push(`columns ${list(s.store.columns)}`);
+    if (fields.length)
+      out.push(`   - Fields: ${fields.join("; ")}`);
+    if (s.refs.length)
+      out.push(`   - Refs: ${list(s.refs.map(code))}`);
+    out.push(`   - ${s.confirmedBy ? CONFIRMED[s.confirmedBy] : "Not confirmed yet"}`);
+  });
+  out.push("", "## Errors", "");
+  if (!f.errors.length)
+    out.push("None read.");
+  for (const e of f.errors)
+    out.push(`- When ${e.when}: ${e.then}. ${cite(c, e.evidence[0])}`);
+  out.push("", "## Sequence", "", "```mermaid", toMermaid(flowSequenceView(f, { source: spec })).trimEnd(), "```", "");
+  return out.join("\n");
+}
+function restEndpoints(c, comp) {
+  return records(c, "Endpoint").filter((e) => e.component === comp && e.endpointType === "rest");
+}
+var OPENAPI_KEYS = [
+  "openapi",
+  "info",
+  "title",
+  "version",
+  "description",
+  "paths",
+  "operationId",
+  "summary",
+  "parameters",
+  "name",
+  "in",
+  "required",
+  "requestBody",
+  "responses",
+  "content",
+  "schema",
+  "type",
+  "properties",
+  "items"
+];
+function jsonType(t) {
+  const x = (t ?? "").toLowerCase().replace(/\(.*$/, "").trim();
+  if (/^(int|integer|long|short|bigint|smallint|int32|int64|byte)$/.test(x))
+    return { type: "integer" };
+  if (/^(decimal|numeric|number|double|float|real|bigdecimal|money)$/.test(x))
+    return { type: "number" };
+  if (/^(bool|boolean)$/.test(x))
+    return { type: "boolean" };
+  if (/(\[\]$)|^(list|array|set)\b/.test(x))
+    return { type: "array", items: {} };
+  if (!x || /^(string|str|text|varchar|char|uuid|date|datetime|timestamp|instant)$/.test(x))
+    return { type: "string" };
+  return { type: "string", "x-atticus-type": t };
+}
+function bodyOf(s) {
+  if (s?.kind !== "Schema" || !s.fields.length)
+    return void 0;
+  const properties = {};
+  for (const f of [...s.fields].sort((a, b) => cmp2(a.name, b.name)))
+    properties[f.name] = {
+      ...jsonType(f.type),
+      ...f.classification ? { "x-atticus-classification": f.classification } : {}
+    };
+  return { content: { "application/json": { schema: { type: "object", properties } } } };
+}
+function openApiOf(i, comp) {
+  const c = ctxOf(i, "");
+  const eps = restEndpoints(c, comp);
+  if (!eps.length)
+    return void 0;
+  const paths = {};
+  for (const e of eps) {
+    const params = [...e.pathOrTopic.matchAll(/\{([^}]+)\}/g)].map((m) => ({
+      name: m[1],
+      in: "path",
+      required: true,
+      schema: { type: "string" }
+    }));
+    const req = bodyOf(c.byId.get(`${e.id}.request`));
+    const res = bodyOf(c.byId.get(`${e.id}.response`));
+    const ev = ownEvidence(e, i.repo);
+    (paths[e.pathOrTopic] ??= {})[(e.method ?? "get").toLowerCase()] = {
+      operationId: e.id,
+      ...params.length ? { parameters: params } : {},
+      ...req ? { requestBody: { required: true, ...req } } : {},
+      responses: res ? { "200": { description: "What the code returns", ...res } } : { default: { description: "The response isn't read yet." } },
+      ...e.auth ? { "x-atticus-auth": e.auth } : {},
+      ...ev?.path ? { "x-atticus-evidence": `${ev.path}${ev.line ? `:${ev.line}` : ""}` } : {}
+    };
+  }
+  const commit = eps.map((e) => ownEvidence(e, i.repo)?.commit).find(Boolean) ?? i.trust?.commit;
+  const doc = {
+    openapi: "3.1.0",
+    info: {
+      title: comp,
+      version: commit ?? "unversioned",
+      description: `The REST entries of ${comp} as ${i.repo}'s code shows them${commit ? ` at ${commit}` : ""}, from the assistant's verified facts (ADR 0124). Rendered by atticus map render ${i.repo}; don't edit.`
+    },
+    paths
+  };
+  return toCanonicalYaml(doc, OPENAPI_KEYS);
+}
+function ctxOf(i, file) {
+  const comps = new Set(i.records.filter((r) => r.kind === "Component" && r.repo === i.repo).map((r) => r.id));
+  for (const f of i.flows)
+    comps.add(f.component);
+  return {
+    i,
+    comps,
+    byId: new Map(i.records.map((r) => [r.id, r])),
+    from: `${i.paths.map}/${file}`
+  };
+}
+function renderMap(i) {
+  const files = {};
+  const base = ctxOf(i, "map.md");
+  for (const comp of [...base.comps].sort(cmp2)) {
+    const yaml = openApiOf(i, comp);
+    if (yaml)
+      files[`contracts/${comp}.openapi.yaml`] = yaml;
+  }
+  for (const f of sortedFlows(i.flows))
+    files[flowFile(f)] = flowPage(ctxOf(i, flowFile(f)), f);
+  const section = (title, body) => [`## ${title}`, "", ...body, ""];
+  files["map.md"] = [
+    `# The map of ${i.repo}`,
+    "",
+    HEADER2(i.repo, "the catalog and its specs"),
+    "",
+    ...aboutLine(i.about, i.repo),
+    ...builtOnLine(base),
+    trustLine(i.trust, i.repo),
+    "",
+    ...section("What it serves", serves(base)),
+    ...section("What it calls", calls(base)),
+    ...section("What it stores", stores(base)),
+    ...section("Where it runs", deploys(base)),
+    ...section("Config that names other systems", config(base)),
+    ...section("Flows", flowsList(base)),
+    ...section("Contracts", contracts(base, files)),
+    ...section("Open questions", openQuestions(base))
+  ].join("\n");
+  return Object.fromEntries(Object.entries(files).sort(([a], [b]) => cmp2(a, b)));
+}
+
+// packages/verify/dist/carry.js
+function rereadPlan(o) {
+  let current = 0;
+  let carried = 0;
+  const reread = [];
+  const unknown = /* @__PURE__ */ new Set();
+  const used = /* @__PURE__ */ new Map();
+  for (const f of [...o.facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0)) {
+    if (sameCommit(f.commit, o.commit)) {
+      current++;
+      continue;
+    }
+    const changes = changesFor(o.carry, f.commit);
+    if (!changes) {
+      unknown.add(f.commit);
+      continue;
+    }
+    used.set(f.commit, changes);
+    const s = staleCite(f, changes);
+    if (s)
+      reread.push({ id: f.id, kind: f.kind, from: f.commit, ...s });
+    else
+      carried++;
+  }
+  const excludeRes = (o.exclude ?? []).map(globToRegExp);
+  const status = /* @__PURE__ */ new Map();
+  for (const changes of used.values())
+    for (const c of changes)
+      if (c.status !== "deleted")
+        status.set(c.path, c.status);
+  const readable = [...status.keys()].filter((p) => {
+    const text = o.source.read(p);
+    if (text === void 0 || !text.trim())
+      return false;
+    const ls = text.split(/\r?\n/);
+    if (!isSourceFile(p, ls[0] ?? "", ls))
+      return false;
+    return !excludeRes.some((re) => re.test(p));
+  });
+  const files = readingOrder(readable).map((path) => ({
+    path,
+    status: status.get(path),
+    facts: reread.filter((r) => (r.to ?? r.file) === path).length
+  }));
+  return {
+    commit: o.commit,
+    from: [...used.entries()].map(([commit, changes]) => ({ commit, changed: changes.length })).sort((a, b) => a.commit < b.commit ? -1 : 1),
+    current,
+    carried,
+    reread,
+    files,
+    unknown: [...unknown].sort()
+  };
+}
+function onlyFiles(source, paths) {
+  const keep = new Set(paths);
+  return { list: () => source.list().filter((p) => keep.has(p)), read: (p) => source.read(p) };
+}
+
+export {
+  insideRepo,
+  dirSource,
+  correctionFor,
+  correctedFact,
+  applyCorrections,
+  frameworkFacts,
+  frameworkTopics,
+  frameworkTopicsOfType,
+  frameworkGaps,
+  frameworksToLearn,
+  parseReviewed,
+  sameCommit,
+  staleMessage,
+  verifyFacts,
+  FILE_KINDS,
+  kindsOf,
+  numberedSlice,
+  sliceText,
+  planBatches,
+  SHOWN_PROPOSALS,
+  proposeExclusions,
+  exclusionYaml,
+  SESSION_TOKENS,
+  planParts,
+  VIEW_NAMES,
+  ViewError,
+  changeView,
+  buildView,
+  toMermaid,
+  toDrawio,
+  shapeLibrary,
+  viewFromDiagram,
+  NoSuchNode,
+  viewKey,
+  buildEstate,
+  nodeView,
+  focusView,
+  trustOf,
+  codeLinkerFor,
+  renderMap,
+  rereadPlan,
+  onlyFiles
+};