@maycombhq/atticus 2.0.0-beta.10 → 2.0.0-beta.11

package/dist/{chunk-R4TBNKKC.js → chunk-WIMOJMAK.js}

@@ -12,18 +12,18 @@ import {
   readDrawio,
   readMermaid,
   resolveNames
-} from "./chunk-NIXVDQVO.js";
+} from "./chunk-5V5BJACL.js";
 import {
   openapiExtractor,
   readOpenApiDocument
-} from "./chunk-UR7RMZ3R.js";
+} from "./chunk-GVFUEGGM.js";
 import {
   combine,
   formatOf,
   screenDiagramXml,
   screenOfficeXml,
   screenText
-} from "./chunk-5XDNUJ4P.js";
+} from "./chunk-BKFGGJKA.js";
 import {
   TrafficFile,
   endpointId,
@@ -42,10 +42,10 @@ import {
   routeScore,
   toCanonicalYaml,
   trafficFileText
-} from "./chunk-577AJVRS.js";
+} from "./chunk-JMOLB347.js";
 import {
   writeFileAtomic
-} from "./chunk-D3PO4DOZ.js";
+} from "./chunk-MMB2OHUY.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";
@@ -168,6 +168,10 @@ function classify(fileName, bytes) {
     return { classification: "diagram" };
   if (/^<(!doctype html|html)\b/i.test(head))
     return { classification: "document" };
+  if (ext === "proto" || /^(syntax\s*=\s*["']proto[23]["']|package\s+[\w.]+\s*;)/m.test(head))
+    return { classification: "protobuf" };
+  if (ext === "avsc" || /^\{/.test(head) && /"type"\s*:\s*"record"/.test(head) && /"fields"\s*:/.test(head))
+    return { classification: "avro" };
   if (["json", "yaml", "yml"].includes(ext) || /^[[{]/.test(head)) {
     let data;
     try {
@@ -200,7 +204,10 @@ import { createHash } from "node:crypto";
 var READERS = {
   openapi: `${openapiExtractor.id}@${openapiExtractor.version}`,
   asyncapi: "asyncapi@0.1.0",
-  payload: "payload@0.1.0"
+  payload: "payload@0.1.0",
+  // ADR 0164: a topic's message spec.
+  protobuf: "protobuf@0.1.0",
+  avro: "avro@0.1.0"
 };
 var short = (s) => createHash("sha256").update(s).digest("hex").slice(0, 6);
 function oneFile(path, text3) {
@@ -416,9 +423,9 @@ var opt = {
 };
 
 // packages/intake/dist/scan-inputs.js
-import { createHash as createHash4 } from "node:crypto";
-import { readdir, readFile, stat } from "node:fs/promises";
-import { join, relative, resolve, sep } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { join as join2, relative, resolve, sep } from "node:path";
 
 // packages/intake/dist/screen-file.js
 var PK = (b) => b[0] === 80 && b[1] === 75;
@@ -460,10 +467,314 @@ function screenFile(path, bytes) {
   }
 }
 
+// packages/intake/dist/contract-specs.js
+var import_yaml4 = __toESM(require_dist(), 1);
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+
+// packages/intake/dist/traffic.js
+import { createHash as createHash3 } from "node:crypto";
+var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var key = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+var sha = (s) => createHash3("sha256").update(s, "utf8").digest("hex");
+var IPV4 = /\b\d{1,3}(?:\.\d{1,3}){3}\b/;
+var IPV6 = /[0-9a-f]{0,4}::[0-9a-f]{0,4}|\b[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){2,7}\b/i;
+var EMAIL = /[^\s@/]+@[^\s@/]+/;
+var JWT = /\beyJ[A-Za-z0-9_-]{6,}/;
+var OPAQUE = /\b(?=[A-Za-z0-9+_-]*\d)(?=[A-Za-z0-9+_-]*[A-Za-z])[A-Za-z0-9+_-]{24,}={0,2}/;
+var UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i;
+var HEX = /\b[0-9a-f]{16,}\b/i;
+function looksSensitive(v) {
+  return [IPV4, IPV6, EMAIL, JWT, OPAQUE, UUID, HEX].some((re) => re.test(v));
+}
+function rowsOf(text3) {
+  const t = text3.replace(/^\uFEFF/, "").trim();
+  if (!t)
+    return void 0;
+  if (t.startsWith("[") || t.startsWith("{")) {
+    let v;
+    try {
+      v = JSON.parse(t);
+    } catch {
+      return void 0;
+    }
+    const list2 = Array.isArray(v) ? v : v && typeof v === "object" ? ["rows", "data", "records", "items"].map((k) => v[k]).find((x) => Array.isArray(x)) : void 0;
+    if (!Array.isArray(list2) || !list2.length)
+      return void 0;
+    const out = [];
+    for (const r of list2) {
+      if (!r || typeof r !== "object" || Array.isArray(r))
+        return void 0;
+      const row = {};
+      for (const [k, x] of Object.entries(r))
+        if (typeof x === "string" || typeof x === "number")
+          row[k] = String(x);
+      out.push(row);
+    }
+    return out;
+  }
+  const recs = parseCsv(t);
+  if (recs.length < 2)
+    return void 0;
+  const head = recs[0].cells.map((c) => c.trim());
+  if (head.length < 2)
+    return void 0;
+  return recs.slice(1).map((r) => {
+    const row = {};
+    head.forEach((h, i) => row[h] = (r.cells[i] ?? "").trim());
+    return row;
+  });
+}
+function dayOf(v) {
+  const m = /^(\d{4}-\d{2}-\d{2})/.exec(v.trim());
+  if (m)
+    return m[1];
+  if (/^\d{12,13}$/.test(v.trim()))
+    return new Date(Number(v)).toISOString().slice(0, 10);
+  return void 0;
+}
+var VERSION = /^v\d+(?:\.\d+)*$/i;
+var PARAM = /^(?:\{[A-Za-z_][A-Za-z0-9_.-]{0,40}\}|:[A-Za-z_][A-Za-z0-9_]{0,40}|<[A-Za-z_][A-Za-z0-9_:]{0,40}>)$/;
+var segmentOf = (s) => VERSION.test(s) || PARAM.test(s) || /^[a-z][a-z._-]*$/.test(s) && s.length <= 20 && /[aeiou]/.test(s) && !looksSensitive(s) ? s : "{id}";
+function barePath(path) {
+  let p = path.trim().split(/[?#]/, 1)[0] ?? "";
+  p = p.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, "");
+  return p.replace(/;[^/]*/g, "");
+}
+function safePathOf(path) {
+  const p = barePath(path);
+  if (!p.startsWith("/"))
+    return void 0;
+  return `/${p.split("/").filter(Boolean).map(segmentOf).join("/")}`;
+}
+var MATCH = 100;
+function pathTemplateOf(path, templates) {
+  const p = barePath(path);
+  if (!p.startsWith("/"))
+    return void 0;
+  const sorted2 = [...templates].sort();
+  let best;
+  let score = 0;
+  for (const t of sorted2) {
+    const s = routeScore(p, t);
+    if (s > MATCH && s > score) {
+      score = s;
+      best = t;
+    }
+  }
+  if (best)
+    return best;
+  const segs = p.split("/").filter(Boolean);
+  let prefix;
+  let len = 0;
+  score = 0;
+  for (const t of sorted2) {
+    const n = t.split("/").filter(Boolean).length;
+    if (n === 0 || n >= segs.length || n < len)
+      continue;
+    const s = routeScore(`/${segs.slice(0, n).join("/")}`, t);
+    if (s <= MATCH)
+      continue;
+    if (n > len || s > score) {
+      len = n;
+      score = s;
+      prefix = t;
+    }
+  }
+  return prefix ? `${prefix.replace(/\/+$/, "")}/**` : void 0;
+}
+var appLabelOf = (name) => `app-${sha(name).slice(0, 8)}`;
+function denyListHits(text3, hashes) {
+  const hits = [];
+  text3.toLowerCase().split("\n").forEach((line, i) => {
+    const w = line.match(/[a-z0-9]+/g) ?? [];
+    for (let k = 0; k < w.length; k++)
+      if (hashes.has(sha(w[k])) || k + 1 < w.length && hashes.has(sha(`${w[k]} ${w[k + 1]}`))) {
+        hits.push(i + 1);
+        break;
+      }
+  });
+  return hits;
+}
+function aggregateTraffic(input) {
+  const text3 = Buffer.from(input.bytes).toString("utf8");
+  const rows = rowsOf(text3);
+  const shape = `a CSV with a header row, or a JSON list of rows, with an app, a method and a path column (${input.source}: app ${input.columns.app.join("/")}; method ${input.columns.method.join("/")}; path ${[...input.columns.path, ...input.columns.basepath].join("/")})`;
+  if (!rows)
+    return { ok: false, message: `The file doesn't read as a traffic export: give ${shape}.` };
+  const names = [...new Set(rows.flatMap((r) => Object.keys(r)))];
+  const col = (aliases) => {
+    for (const a of aliases) {
+      const hit = names.find((n) => key(n) === key(a));
+      if (hit)
+        return hit;
+    }
+    return void 0;
+  };
+  const c = {
+    app: col(input.columns.app),
+    method: col(input.columns.method),
+    basepath: col(input.columns.basepath),
+    suffix: col(input.columns.suffix),
+    proxy: col(input.columns.proxy),
+    count: col(input.columns.count),
+    time: col(input.columns.time),
+    path: void 0
+  };
+  if (!c.basepath || !c.suffix)
+    c.path = col(input.columns.path);
+  const missing = [
+    !c.app ? "app" : "",
+    !c.method ? "method" : "",
+    !c.path && !(c.basepath && c.suffix) ? "path" : ""
+  ].filter(Boolean);
+  if (missing.length)
+    return {
+      ok: false,
+      message: `The file has no ${missing.join(", ")} column, so it can't be kept as aggregates: give ${shape}.`
+    };
+  const range = (v) => v && /^\d{4}-\d{2}-\d{2}$/.test(v) ? v : void 0;
+  if (input.from && !range(input.from) || input.to && !range(input.to))
+    return { ok: false, message: "--from and --to are days: YYYY-MM-DD." };
+  if ((!input.from || !input.to) && !c.time)
+    return {
+      ok: false,
+      message: "The export has no date column: give --from and --to (YYYY-MM-DD) for the range it covers."
+    };
+  const kept = new Set(Object.values(c).filter((x) => !!x));
+  const dropped = names.filter((n) => !kept.has(n)).sort();
+  const secrets = /* @__PURE__ */ new Set();
+  const keptValues = /* @__PURE__ */ new Set();
+  const agg = /* @__PURE__ */ new Map();
+  let outOfRange = 0;
+  let skipped2 = 0;
+  let unmatched = 0;
+  const known = /* @__PURE__ */ new Map();
+  for (const a of input.apps ?? [])
+    if (a.trim() && !known.has(key(a)))
+      known.set(key(a), a.trim());
+  const days = [];
+  for (const r of rows) {
+    for (const n of dropped) {
+      const v = (r[n] ?? "").trim();
+      const q = /^(?:[a-z][a-z0-9+.-]*:\/\/|\/)/i.test(v) ? v.split(/[?#]/)[1] ?? "" : v;
+      if (q.length >= 6)
+        secrets.add(q);
+    }
+    for (const n of [c.path, c.suffix, c.basepath]) {
+      const v = n ? r[n] ?? "" : "";
+      const q = v.split(/[?#]/)[1] ?? "";
+      if (q.length >= 4)
+        secrets.add(q);
+      for (const m of (v.split(/[?#]/, 1)[0] ?? "").match(/;[^/]*/g) ?? [])
+        if (m.length >= 5)
+          secrets.add(m.slice(1));
+    }
+    if (c.time) {
+      const d = dayOf(r[c.time] ?? "");
+      if (d) {
+        if (input.from && d < input.from || input.to && d > input.to) {
+          outOfRange++;
+          continue;
+        }
+        days.push(d);
+      } else if (!input.from || !input.to) {
+        skipped2++;
+        continue;
+      }
+    }
+    const method = (r[c.method] ?? "").trim().toUpperCase();
+    const rawPath = c.path ? r[c.path] ?? "" : `${(r[c.basepath] ?? "").replace(/\/+$/, "")}/${(r[c.suffix] ?? "").replace(/^\/+/, "")}`;
+    const countText = c.count ? (r[c.count] ?? "").trim() : "1";
+    const count = Number(countText);
+    if (!/^[A-Z]{3,10}$/.test(method) || !barePath(rawPath).startsWith("/") || !Number.isInteger(count) || count < 0) {
+      skipped2++;
+      continue;
+    }
+    const path = pathTemplateOf(rawPath, input.templates);
+    if (!path) {
+      unmatched++;
+      continue;
+    }
+    if (count === 0)
+      continue;
+    const appRaw = (r[c.app] ?? "").trim();
+    const app = !appRaw ? "(none)" : known.get(key(appRaw)) ?? appLabelOf(appRaw);
+    const proxyRaw = c.proxy ? (r[c.proxy] ?? "").trim() : "";
+    const proxy = proxyRaw && !looksSensitive(proxyRaw) ? proxyRaw : void 0;
+    const baseRaw = c.basepath ? (r[c.basepath] ?? "").trim() : "";
+    const basepath = baseRaw ? safePathOf(baseRaw) : void 0;
+    for (const v of [app, proxy, basepath, path])
+      if (v)
+        keptValues.add(v);
+    const k = [app, method, path, proxy ?? "", basepath ?? ""].join("\0");
+    const row = agg.get(k) ?? {
+      app,
+      method,
+      path,
+      ...proxy ? { proxy } : {},
+      ...basepath ? { basepath } : {},
+      count: 0
+    };
+    row.count += count;
+    agg.set(k, row);
+  }
+  if (!agg.size)
+    return {
+      ok: false,
+      message: `No row of the file is a request in the range to a route of the estate (${rows.length} read, ${outOfRange} outside it, ${skipped2} without a method, path or count, ${unmatched} matching no route template of the estate): nothing to keep.`
+    };
+  days.sort();
+  const from = input.from ?? days[0];
+  const to = input.to ?? days[days.length - 1];
+  if (!from || !to)
+    return { ok: false, message: "The rows carry no dates: give --from and --to (YYYY-MM-DD)." };
+  const parsed = TrafficFile.safeParse({
+    schemaVersion: 1,
+    source: input.source,
+    from,
+    to,
+    inputSha256: createHash3("sha256").update(input.bytes).digest("hex"),
+    rows: [...agg.values()].sort((a, b) => cmp(a.app, b.app) || cmp(a.proxy ?? "", b.proxy ?? "") || cmp(a.path, b.path) || cmp(a.method, b.method))
+  });
+  if (!parsed.success)
+    return { ok: false, message: `The aggregate isn't valid: ${parsed.error.issues[0]?.message}.` };
+  const out = trafficFileText(parsed.data);
+  const lower = out.toLowerCase();
+  const leaked = [...secrets].filter((s) => !keptValues.has(s) && lower.includes(s.toLowerCase()));
+  if (leaked.length)
+    return {
+      ok: false,
+      message: `Refused: ${leaked.length} value${leaked.length === 1 ? "" : "s"} of the export's dropped columns would be written. Nothing was written.`
+    };
+  const body = out.replace(/^inputSha256: .*$/m, "");
+  if ([IPV4, IPV6, EMAIL, JWT, OPAQUE, UUID, HEX].some((re) => re.test(body)))
+    return {
+      ok: false,
+      message: "Refused: the aggregate would hold an IP, an email or a token-looking value. Nothing was written."
+    };
+  const hits = input.denyHashes?.size ? denyListHits(out, input.denyHashes) : [];
+  if (hits.length)
+    return {
+      ok: false,
+      message: `Refused: the deny-list names a word on line${hits.length === 1 ? "" : "s"} ${hits.join(", ")} of the aggregate. Nothing was written.`
+    };
+  return {
+    ok: true,
+    file: parsed.data,
+    text: out,
+    read: rows.length,
+    outOfRange,
+    skipped: skipped2,
+    unmatched,
+    dropped
+  };
+}
+
 // packages/intake/dist/vendor-ops.js
 var import_yaml3 = __toESM(require_dist(), 1);
-import { createHash as createHash3 } from "node:crypto";
-var short2 = (s) => createHash3("sha256").update(s).digest("hex").slice(0, 6);
+import { createHash as createHash4 } from "node:crypto";
+var short2 = (s) => createHash4("sha256").update(s).digest("hex").slice(0, 6);
 function specEndpointIds(component, ops) {
   const ids = ops.map((o) => endpointId(component, o.method, o.normalizedPath));
   const count = /* @__PURE__ */ new Map();
@@ -775,12 +1086,442 @@ function operationSchemas(spec) {
   });
 }
 
+// packages/intake/dist/contract-specs.js
+var MAX_BYTES = 1024 * 1024;
+var SKIP = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "vendor",
+  "target",
+  "build",
+  "dist",
+  "out",
+  "bin",
+  "obj",
+  ".gradle",
+  ".idea",
+  ".venv",
+  "__pycache__"
+]);
+var cmp2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function readProtoSpecs(path, text3) {
+  const proto3 = /^\s*syntax\s*=\s*["']proto3["']/m.test(text3);
+  let pkg = "";
+  const out = [];
+  const stack = [];
+  let inComment = false;
+  text3.split(/\r?\n/).forEach((raw, i) => {
+    let line = raw;
+    if (inComment) {
+      const end = line.indexOf("*/");
+      if (end < 0)
+        return;
+      line = line.slice(end + 2);
+      inComment = false;
+    }
+    line = line.replace(/\/\*.*?\*\//g, "").replace(/\/\/.*$/, "");
+    const open = line.indexOf("/*");
+    if (open >= 0) {
+      inComment = true;
+      line = line.slice(0, open);
+    }
+    const n = i + 1;
+    const p = /^\s*package\s+([\w.]+)\s*;/.exec(line);
+    if (p)
+      pkg = p[1];
+    const message = /^\s*message\s+(\w+)\s*\{/.exec(line);
+    const oneof = /^\s*oneof\s+(\w+)\s*\{/.exec(line);
+    const other = /^\s*(enum|service|extend|extensions)\b[^{]*\{/.exec(line);
+    let rest = line;
+    if (message) {
+      const outer = stack.filter((f) => f.kind === "message").map((f) => f.name);
+      const name = [...outer, message[1]].join(".");
+      const spec = {
+        kind: "message",
+        format: "protobuf",
+        role: "schema",
+        file: path,
+        line: n,
+        name: pkg ? `${pkg}.${name}` : name,
+        fields: []
+      };
+      out.push(spec);
+      stack.push({ kind: "message", name: message[1], spec });
+      rest = line.slice(line.indexOf("{") + 1);
+    } else if (oneof || other) {
+      stack.push({ kind: oneof ? "oneof" : "other", name: "" });
+      rest = line.slice(line.indexOf("{") + 1);
+    } else {
+      const top = stack.at(-1);
+      const owner = top?.kind === "message" ? top : top?.kind === "oneof" ? stack.at(-2) : void 0;
+      const f = /^\s*(optional|required|repeated)?\s*(map\s*<[^>]+>|[\w.]+)\s+(\w+)\s*=\s*(\d+)\s*(\[[^\]]*\])?\s*;/.exec(line);
+      if (f && owner?.kind === "message" && owner.spec && !["reserved", "option"].includes(f[2])) {
+        const label = f[1];
+        owner.spec.fields.push({
+          side: "message",
+          name: f[3],
+          type: label === "repeated" ? `repeated ${f[2]}` : f[2].replace(/\s+/g, ""),
+          // proto2's `required` must be there; anything else may be left out (proto3 has no required).
+          required: label === "required" && !proto3,
+          number: Number(f[4]),
+          at: `${path}:${n}`
+        });
+      }
+    }
+    for (const _ of rest.matchAll(/\}/g))
+      stack.pop();
+  });
+  return out;
+}
+function lineOfName(lines, from, name) {
+  const re = new RegExp(`"name"\\s*:\\s*"${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"`);
+  for (let i = Math.max(0, from); i < lines.length; i++)
+    if (re.test(lines[i]))
+      return i + 1;
+  return from + 1;
+}
+function readAvroSpecs(path, text3) {
+  let data;
+  try {
+    data = JSON.parse(text3);
+  } catch {
+    return [];
+  }
+  const lines = text3.split(/\r?\n/);
+  const out = [];
+  let cursor = 0;
+  const typeName = (t) => {
+    if (typeof t === "string")
+      return t;
+    if (Array.isArray(t))
+      return t.map(typeName).join("|");
+    if (t && typeof t === "object") {
+      const o = t;
+      if (o.type === "array")
+        return `repeated ${typeName(o.items)}`;
+      if (o.type === "map")
+        return `map<string,${typeName(o.values)}>`;
+      if (typeof o.logicalType === "string")
+        return String(o.type);
+      if (typeof o.name === "string")
+        return o.name;
+      return typeName(o.type);
+    }
+    return "";
+  };
+  const record = (r, ns) => {
+    if (r.type !== "record" || typeof r.name !== "string" || !Array.isArray(r.fields))
+      return;
+    const space = typeof r.namespace === "string" ? r.namespace : ns;
+    const line = lineOfName(lines, cursor, r.name);
+    cursor = line;
+    const spec = {
+      kind: "message",
+      format: "avro",
+      role: "schema",
+      file: path,
+      line,
+      name: space ? `${space}.${r.name}` : r.name,
+      fields: []
+    };
+    out.push(spec);
+    r.fields.forEach((f, i) => {
+      if (!f || typeof f !== "object")
+        return;
+      const x = f;
+      if (typeof x.name !== "string")
+        return;
+      const at = lineOfName(lines, cursor, x.name);
+      cursor = at;
+      const nullable = Array.isArray(x.type) && x.type.includes("null");
+      const type = typeName(Array.isArray(x.type) ? x.type.filter((t) => t !== "null") : x.type);
+      spec.fields.push({
+        side: "message",
+        name: x.name,
+        ...type ? { type } : {},
+        required: !nullable && !("default" in x),
+        number: i,
+        at: `${path}:${at}`
+      });
+      const inner = Array.isArray(x.type) ? x.type : [x.type];
+      for (const t of inner)
+        if (t && typeof t === "object")
+          record(t, space);
+    });
+  };
+  for (const r of Array.isArray(data) ? data : [data])
+    if (r && typeof r === "object")
+      record(r, "");
+  return out;
+}
+var lineAt = (d, node) => {
+  const r = node?.range;
+  return r ? d.lc.linePos(r[0]).line : 1;
+};
+function deref2(d, node, depth = 0) {
+  if (!(0, import_yaml4.isMap)(node) || depth > 8)
+    return node;
+  const ref = node.get("$ref");
+  if (typeof ref !== "string" || !ref.startsWith("#/"))
+    return node;
+  let at = d.root;
+  for (const p of ref.slice(2).split("/"))
+    at = (0, import_yaml4.isMap)(at) ? at.get(p.replace(/~1/g, "/").replace(/~0/g, "~"), true) : void 0;
+  return deref2(d, at, depth + 1);
+}
+function propsOf(d, schema, prefix, depth, out) {
+  const s = deref2(d, schema);
+  if (!(0, import_yaml4.isMap)(s) || depth > 6)
+    return;
+  const props = s.get("properties", true);
+  const req = s.get("required", true);
+  const required = new Set((0, import_yaml4.isSeq)(req) ? req.items.map((x) => (0, import_yaml4.isScalar)(x) ? String(x.value) : "") : []);
+  if (!(0, import_yaml4.isMap)(props))
+    return;
+  for (const p of props.items) {
+    if (!(0, import_yaml4.isScalar)(p.key))
+      continue;
+    const name = prefix ? `${prefix}.${String(p.key.value)}` : String(p.key.value);
+    const v = deref2(d, p.value);
+    const type = (0, import_yaml4.isMap)(v) ? v.get("type") : void 0;
+    out.push({
+      side: "message",
+      name,
+      ...typeof type === "string" ? { type } : {},
+      required: required.has(String(p.key.value)),
+      at: `${d.path}:${lineAt(d, p.key)}`
+    });
+    if ((0, import_yaml4.isMap)(v)) {
+      if (type === "array")
+        propsOf(d, v.get("items", true), `${name}[]`, depth + 1, out);
+      else
+        propsOf(d, v, name, depth + 1, out);
+    }
+  }
+}
+function docOf(path, text3) {
+  const lc = new import_yaml4.LineCounter();
+  const doc = (0, import_yaml4.parseDocument)(text3, { lineCounter: lc });
+  return (0, import_yaml4.isMap)(doc.contents) ? { path, lc, root: doc.contents } : void 0;
+}
+function readJsonSchemaSpecs(path, text3) {
+  const d = docOf(path, text3);
+  if (!d)
+    return [];
+  const title = d.root.get("title");
+  const id = d.root.get("$id");
+  const fields = [];
+  propsOf(d, d.root, "", 0, fields);
+  if (!fields.length)
+    return [];
+  const name = typeof title === "string" && title ? title : typeof id === "string" && id ? (id.split("/").pop() ?? id).replace(/\.json$/, "") : (path.split("/").pop() ?? path).replace(/\.(schema\.)?json$|\.ya?ml$/i, "");
+  return [
+    { kind: "message", format: "json-schema", role: "schema", file: path, line: 1, name, fields }
+  ];
+}
+function readAsyncApiSpecs(path, text3) {
+  const d = docOf(path, text3);
+  if (!d || d.root.get("asyncapi") === void 0)
+    return [];
+  const out = [];
+  const channels = d.root.get("channels", true);
+  if (!(0, import_yaml4.isMap)(channels))
+    return out;
+  const add = (topic, message) => {
+    const m = deref2(d, message);
+    if (!(0, import_yaml4.isMap)(m))
+      return;
+    const oneOf = m.get("oneOf", true);
+    if ((0, import_yaml4.isSeq)(oneOf)) {
+      for (const x of oneOf.items)
+        add(topic, x);
+      return;
+    }
+    const payload = m.get("payload", true);
+    const fields = [];
+    propsOf(d, payload, "", 0, fields);
+    const p = deref2(d, payload);
+    const title = (0, import_yaml4.isMap)(p) ? p.get("title") : void 0;
+    const name = m.get("name") ?? m.get("title") ?? title;
+    out.push({
+      kind: "message",
+      format: "asyncapi",
+      role: "schema",
+      file: path,
+      line: lineAt(d, m),
+      topic,
+      ...typeof name === "string" && name ? { name } : {},
+      fields
+    });
+  };
+  for (const c of channels.items) {
+    if (!(0, import_yaml4.isScalar)(c.key))
+      continue;
+    const ch = deref2(d, c.value);
+    if (!(0, import_yaml4.isMap)(ch))
+      continue;
+    const address = ch.get("address");
+    const topic = typeof address === "string" && address ? address : String(c.key.value);
+    for (const op of ["publish", "subscribe"]) {
+      const o = ch.get(op, true);
+      if ((0, import_yaml4.isMap)(o))
+        add(topic, o.get("message", true));
+    }
+    const msgs = ch.get("messages", true);
+    if ((0, import_yaml4.isMap)(msgs))
+      for (const m of msgs.items)
+        add(topic, m.value);
+  }
+  return out;
+}
+function openApiContractSpecs(spec) {
+  return spec.operations.map((o) => {
+    const [file, line] = splitAt(o.cite, spec.path);
+    const field2 = (side) => (f) => ({
+      side,
+      name: f.name,
+      ...f.type ? { type: f.type } : {},
+      ...f.required !== void 0 ? { required: f.required } : {},
+      ...f.in ? { in: f.in } : {},
+      at: f.cite
+    });
+    return {
+      kind: "operation",
+      format: "openapi",
+      role: "consumer",
+      file,
+      line,
+      method: o.method,
+      path: o.fullPath,
+      id: o.id,
+      fields: [...o.request.map(field2("request")), ...o.response.map(field2("response"))],
+      ...o.errors?.length ? { errors: o.errors.map((e) => ({ status: e.status, at: e.cite })) } : {}
+    };
+  });
+}
+function splitAt(cite, path) {
+  const m = /^(.*):(\d+)$/.exec(cite);
+  return m ? [m[1], Number(m[2])] : [path, 1];
+}
+function specFormatOf(name, text3) {
+  const lower = name.toLowerCase();
+  if (lower.endsWith(".proto"))
+    return "protobuf";
+  if (lower.endsWith(".avsc"))
+    return "avro";
+  if (!/\.(ya?ml|json)$/.test(lower))
+    return void 0;
+  const head = text3.slice(0, 4e3);
+  if (/^\s*["']?(openapi|swagger)["']?\s*:/m.test(head))
+    return "openapi";
+  if (/^\s*["']?asyncapi["']?\s*:/m.test(head))
+    return "asyncapi";
+  if (/"type"\s*:\s*"record"/.test(head) && /"fields"\s*:/.test(head))
+    return "avro";
+  if (/["']?\$schema["']?\s*:/.test(head) && /json-schema\.org/.test(head))
+    return "json-schema";
+  return void 0;
+}
+function readContractSpecs(path, text3) {
+  switch (specFormatOf(path, text3)) {
+    case "protobuf":
+      return readProtoSpecs(path, text3);
+    case "avro":
+      return readAvroSpecs(path, text3);
+    case "json-schema":
+      return readJsonSchemaSpecs(path, text3);
+    case "asyncapi":
+      return readAsyncApiSpecs(path, text3);
+    case "openapi": {
+      const spec = readVendorSpec(path, text3, "spec");
+      return spec ? openApiContractSpecs(spec) : [];
+    }
+    default:
+      return [];
+  }
+}
+var sameShape = (a, b) => normalizePath(a).replace(/\{[^}]*\}/g, "{}") === normalizePath(b).replace(/\{[^}]*\}/g, "{}");
+var SPEC_FILE = /\.(proto|avsc|ya?ml|json)$/i;
+function cmpPath(a, b) {
+  const x = a.split("/");
+  const y = b.split("/");
+  for (let i = 0; i < Math.min(x.length, y.length); i++) {
+    const c = cmp2(x[i], y[i]);
+    if (c)
+      return c;
+  }
+  return x.length - y.length;
+}
+var skipped = (p) => p.split("/").slice(0, -1).some((d) => SKIP.has(d) || d.startsWith("."));
+function folderTree(dir) {
+  return {
+    async files() {
+      const out = [];
+      const walk2 = async (rel) => {
+        const entries = await readdir(join(dir, ...rel.split("/").filter(Boolean)), {
+          withFileTypes: true
+        }).catch(() => []);
+        for (const e of [...entries].sort((a, b) => cmp2(a.name, b.name))) {
+          const p = rel ? `${rel}/${e.name}` : e.name;
+          if (e.isDirectory()) {
+            if (!SKIP.has(e.name) && !e.name.startsWith("."))
+              await walk2(p);
+          } else if (e.isFile() && SPEC_FILE.test(e.name)) {
+            const size = (await stat(join(dir, ...p.split("/"))).catch(() => void 0))?.size;
+            out.push({ path: p, size: size ?? 0 });
+          }
+        }
+      };
+      await walk2("");
+      return out;
+    },
+    read: (p) => readFile(join(dir, ...p.split("/")), "utf8").catch(() => void 0)
+  };
+}
+async function readRepoSpecs(dir, o) {
+  const tree = o.tree ?? folderTree(dir);
+  const files = (await tree.files()).filter((f) => SPEC_FILE.test(f.path) && !skipped(f.path) && f.size > 0 && f.size <= MAX_BYTES).sort((a, b) => cmpPath(a.path, b.path)).map((f) => f.path);
+  const own = o.facts.filter((f) => f.kind === "entry" && f.entryType === "rest");
+  const specs = [];
+  for (const p of files) {
+    const text3 = await tree.read(p);
+    if (text3 === void 0 || !specFormatOf(p, text3))
+      continue;
+    const got = readContractSpecs(p, text3);
+    if (!got.length)
+      continue;
+    if (o.denyHashes?.size && denyListHits(text3, o.denyHashes).length) {
+      o.onRefused?.(`${p}: the deny-list names a word in it, so its specs are left out.`);
+      continue;
+    }
+    for (const s of got) {
+      if (s.kind !== "operation") {
+        specs.push(s);
+        continue;
+      }
+      const vendorPath = readVendorSpec(p, text3, "spec")?.operations.find((x) => x.id === s.id);
+      const paths = [s.path ?? "", vendorPath?.path ?? ""].filter(Boolean);
+      const entry = own.filter((e) => (!e.method || !s.method || e.method.toUpperCase() === s.method) && paths.some((x) => sameShape(x, e.path))).sort((a, b) => cmp2(a.id, b.id))[0];
+      const { id: _id, ...rest } = s;
+      specs.push(entry ? { ...rest, role: "own", entry: entry.id } : rest);
+    }
+  }
+  return {
+    schemaVersion: 1,
+    repo: o.repo,
+    ...o.commit ? { commit: o.commit } : {},
+    specs
+  };
+}
+
 // packages/intake/dist/scan-inputs.js
 var SPECS = ["openapi", "swagger", "asyncapi"];
 var EVIDENCE_SOURCE = {
   openapi: "spec",
   swagger: "spec",
   asyncapi: "spec",
+  protobuf: "spec",
+  avro: "spec",
   diagram: "diagram",
   image: "document",
   document: "document",
@@ -798,14 +1539,14 @@ async function walk(dir, skip) {
       return;
     let entries;
     try {
-      entries = await readdir(d, { withFileTypes: true });
+      entries = await readdir2(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
       if (e.name.startsWith("."))
         continue;
-      const full = join(d, e.name);
+      const full = join2(d, e.name);
       if (e.isDirectory())
         await go(full);
       else if (e.isFile())
@@ -816,7 +1557,7 @@ async function walk(dir, skip) {
   return out;
 }
 var DATE = /(?:^|[-_ .])((\d{4})-?(\d{2})-?(\d{2}))(?=$|[-_ .])/;
-var VERSION = /(?:^|[-_ .])v(\d+(?:[._]\d+)*)(?=$|[-_ .])/i;
+var VERSION2 = /(?:^|[-_ .])v(\d+(?:[._]\d+)*)(?=$|[-_ .])/i;
 function nameParts(stem) {
   let rest = stem;
   let date;
@@ -829,7 +1570,7 @@ function nameParts(stem) {
     }
   }
   let version;
-  const v = VERSION.exec(rest);
+  const v = VERSION2.exec(rest);
   if (v) {
     version = v[1].replace(/_/g, ".");
     rest = rest.replace(v[0], "");
@@ -855,23 +1596,23 @@ function systemsInName(stem, systems) {
   return systems.filter((sys) => [sys.id, sys.name, ...sys.aliases].some((n) => slug(n) && s.includes(`-${slug(n)}-`))).map((sys) => sys.id).sort();
 }
 async function scanInputs(o) {
-  const orgPackDir = typeof o.orgPack === "string" ? o.orgPack : join(orgPackDirOf(o.root));
+  const orgPackDir = typeof o.orgPack === "string" ? o.orgPack : join2(orgPackDirOf(o.root));
   const op = typeof o.orgPack === "object" ? o.orgPack : await loadOrgPack(orgPackDir);
   const systems = op.profiles.flatMap((p) => p.profile?.systems ?? []);
   const legend = op.profiles.find((p) => p.profile?.legend)?.profile?.legend;
   const records = o.records ?? [];
   const ingestors = o.ingestors ?? [drawioIngestor];
   const scannedAt = o.scannedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const inputsDir = o.inputsDir ?? join(o.root, "inputs");
+  const inputsDir = o.inputsDir ?? join2(o.root, "inputs");
   const problems = [];
   const triage = [];
   const authors = /* @__PURE__ */ new Map();
   const wikiDirs = op.sources.wikis.flatMap((w) => /^[a-z][a-z0-9+.-]*:\/\//i.test(w.location) ? [] : [resolve(orgPackDir, w.location), resolve(o.root, w.location)]);
-  const st = await stat(inputsDir).catch(() => void 0);
+  const st = await stat2(inputsDir).catch(() => void 0);
   const paths = st?.isDirectory() ? await walk(inputsDir, wikiDirs) : [];
   const files = [];
   for (const abs of paths) {
-    const bytes = new Uint8Array(await readFile(abs));
+    const bytes = new Uint8Array(await readFile2(abs));
     const path = `inputs/${posix(relative(inputsDir, abs))}`;
     const name = path.split("/").pop();
     const c = classify(name, bytes);
@@ -879,7 +1620,7 @@ async function scanInputs(o) {
       abs,
       path,
       bytes,
-      hash: createHash4("sha256").update(bytes).digest("hex"),
+      hash: createHash5("sha256").update(bytes).digest("hex"),
       stem: name.includes(".") ? name.slice(0, name.lastIndexOf(".")) : name,
       inbox: path.startsWith("inputs/inbox/"),
       ...c.data !== void 0 ? { data: c.data } : {},
@@ -949,7 +1690,7 @@ async function scanInputs(o) {
     const heads = members.filter((m) => !m.doc.supersededBy);
     if (heads.length < 2)
       continue;
-    const distinct = (vals, cmp4) => vals.every((v) => v !== void 0) && vals.every((v, i) => vals.every((w, j) => i === j || cmp4(v, w) !== 0));
+    const distinct = (vals, cmp5) => vals.every((v) => v !== void 0) && vals.every((v, i) => vals.every((w, j) => i === j || cmp5(v, w) !== 0));
     const byVersion = distinct(heads.map((h) => h.doc.version), compareVersions);
     const byDate = !byVersion && distinct(heads.map((h) => h.doc.date), (a, b) => a < b ? -1 : a > b ? 1 : 0);
     if (byVersion || byDate) {
@@ -1106,6 +1847,43 @@ async function scanInputs(o) {
       } catch {
       }
     }
+    if (cls === "protobuf" || cls === "avro") {
+      const specs = cls === "protobuf" ? readProtoSpecs(f.path, text3()) : readAvroSpecs(f.path, text3());
+      const named = new Set(systemsInName(f.stem, systems));
+      for (const s of specs) {
+        const res = s.name ? resolveName(s.name.split(".").slice(0, -1).join(" ")) : void 0;
+        if (res?.id && !named.size)
+          named.add(systemOf(res.id));
+      }
+      for (const s of named)
+        linked.add(s);
+      if (current && specs.length) {
+        for (const s of specs) {
+          const p = parseRecord({
+            schemaVersion: 1,
+            kind: "Schema",
+            id: boundedId("schema.", slug(s.name ?? f.stem)),
+            status: "current",
+            confidence: "verified",
+            format: cls,
+            ref: `${f.path}#${s.name ?? ""}`,
+            fields: s.fields.map((x) => ({
+              name: x.name,
+              ...x.type ? { type: x.type } : {},
+              ...x.required !== void 0 ? { required: x.required } : {}
+            })),
+            evidence: [{ source: "spec", path: f.path, line: s.line, side: "definition" }]
+          });
+          if (!p.ok)
+            continue;
+          const schema = p.record;
+          out.push(schema);
+          f.doc.records.push(schema.id);
+        }
+        f.doc.status = "read";
+        f.doc.reader = cls === "protobuf" ? READERS.protobuf : READERS.avro;
+      }
+    }
     if (current && cls === "payload" && f.data !== void 0) {
       const schema = readPayload(f.path, boundedId("payload.", f.doc.id.slice(4)), f.data);
       out.push(schema);
@@ -1415,11 +2193,11 @@ function imageItems(records) {
     };
   });
 }
-var key = (action, target, value) => `${action}|${target}|${JSON.stringify(value ?? null)}`;
+var key2 = (action, target, value) => `${action}|${target}|${JSON.stringify(value ?? null)}`;
 function buildTriage(input) {
   const decisions = (input.decisions ?? []).filter((d) => d.kind === "CuratedDecision" && d.status === "current");
   const decidedIds = new Set(decisions.map((d) => d.id));
-  const decidedKeys = new Set(decisions.map((d) => key(d.action, d.target, d.value)));
+  const decidedKeys = new Set(decisions.map((d) => key2(d.action, d.target, d.value)));
   const docs = new Map((input.inputs?.documents ?? []).map((d) => [d.path, d.id]));
   const docIdOf = (path) => docs.get(path) ?? boundedId("doc.", slug(path.split("/").pop().replace(/\.[^.]+$/, "")));
   const records = input.records;
@@ -1432,7 +2210,7 @@ function buildTriage(input) {
     ...imageItems([...records, ...inputRecords]),
     ...readingItems(input)
   ];
-  const open = all.filter((i) => !i.options.some((o) => decidedIds.has(o.decision.id) || decidedKeys.has(key(o.decision.action, o.decision.target, o.decision.value))));
+  const open = all.filter((i) => !i.options.some((o) => decidedIds.has(o.decision.id) || decidedKeys.has(key2(o.decision.action, o.decision.target, o.decision.value))));
   const items = sortItems(open);
   return {
     items,
@@ -1473,9 +2251,9 @@ function buildTriage(input) {
 }
 
 // packages/intake/dist/work-items.js
-var import_yaml4 = __toESM(require_dist(), 1);
-import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
-import { join as join2, relative as relative2, sep as sep2 } from "node:path";
+var import_yaml5 = __toESM(require_dist(), 1);
+import { readdir as readdir3, readFile as readFile3 } from "node:fs/promises";
+import { join as join3, relative as relative2, sep as sep2 } from "node:path";
 var WORK_ITEM_READER = "work-items@0.1.0";
 var isObj3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var text = (v) => {
@@ -1654,7 +2432,7 @@ function readWorkItemExport(path, bytes) {
     return void 0;
   let data;
   try {
-    data = (0, import_yaml4.parse)(content);
+    data = (0, import_yaml5.parse)(content);
   } catch {
     return void 0;
   }
@@ -1677,19 +2455,19 @@ function readWorkItemExport(path, bytes) {
   return items;
 }
 async function readWorkItemExports(o) {
-  const dir = o.inputsDir ?? join2(o.root, "inputs");
+  const dir = o.inputsDir ?? join3(o.root, "inputs");
   const files = [];
   async function walk2(d) {
     let entries;
     try {
-      entries = await readdir2(d, { withFileTypes: true });
+      entries = await readdir3(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
       if (e.name.startsWith("."))
         continue;
-      const full = join2(d, e.name);
+      const full = join3(d, e.name);
       if (e.isDirectory())
         await walk2(full);
       else if (/\.(json|ya?ml|csv)$/i.test(e.name))
@@ -1706,7 +2484,7 @@ async function readWorkItemExports(o) {
     const path = `inputs/${relative2(dir, full).split(sep2).join("/")}`;
     let bytes;
     try {
-      bytes = new Uint8Array(await readFile2(full));
+      bytes = new Uint8Array(await readFile3(full));
     } catch (e) {
       out.problems.push({ path, message: `can't read it: ${e.message}` });
       continue;
@@ -1721,9 +2499,9 @@ async function readWorkItemExports(o) {
 }
 
 // packages/intake/dist/service-requests.js
-var import_yaml5 = __toESM(require_dist(), 1);
-import { readdir as readdir3, readFile as readFile3 } from "node:fs/promises";
-import { join as join3, relative as relative3, sep as sep3 } from "node:path";
+var import_yaml6 = __toESM(require_dist(), 1);
+import { readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
+import { join as join4, relative as relative3, sep as sep3 } from "node:path";
 var SERVICE_REQUEST_READER = "service-requests@0.1.0";
 var isObj4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var text2 = (v) => {
@@ -1874,7 +2652,7 @@ function readServiceRequestExport(path, bytes) {
     return void 0;
   let data;
   try {
-    data = (0, import_yaml5.parse)(content);
+    data = (0, import_yaml6.parse)(content);
   } catch {
     return void 0;
   }
@@ -1904,19 +2682,19 @@ function readServiceRequestExport(path, bytes) {
   return out;
 }
 async function readServiceRequestExports(o) {
-  const dir = o.inputsDir ?? join3(o.root, "inputs");
+  const dir = o.inputsDir ?? join4(o.root, "inputs");
   const found = [];
   async function walk2(d) {
     let entries;
     try {
-      entries = await readdir3(d, { withFileTypes: true });
+      entries = await readdir4(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
       if (e.name.startsWith("."))
         continue;
-      const full = join3(d, e.name);
+      const full = join4(d, e.name);
       if (e.isDirectory())
         await walk2(full);
       else if (/\.(json|ya?ml|csv)$/i.test(e.name))
@@ -1933,7 +2711,7 @@ async function readServiceRequestExports(o) {
     const path = `inputs/${relative3(dir, full).split(sep3).join("/")}`;
     let bytes;
     try {
-      bytes = new Uint8Array(await readFile3(full));
+      bytes = new Uint8Array(await readFile4(full));
     } catch (e) {
       out.problems.push({ path, message: `can't read it: ${e.message}` });
       continue;
@@ -1948,15 +2726,15 @@ async function readServiceRequestExports(o) {
 }
 
 // packages/intake/dist/change-inputs.js
-var import_yaml6 = __toESM(require_dist(), 1);
-import { createHash as createHash5 } from "node:crypto";
-import { mkdir, readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+var import_yaml7 = __toESM(require_dist(), 1);
+import { createHash as createHash6 } from "node:crypto";
+import { mkdir, readdir as readdir5, readFile as readFile5 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 var INPUTS_DIR = "inputs";
 var INPUTS_INDEX = "inputs/index.yaml";
 var INPUTS_READ_DIR = "inputs/read";
 var CHANGE_INPUTS_SCHEMA_VERSION = 1;
-var sha256 = (b) => createHash5("sha256").update(b).digest("hex");
+var sha256 = (b) => createHash6("sha256").update(b).digest("hex");
 var KEYS = [
   "path",
   "name",
@@ -1976,10 +2754,10 @@ var KEYS = [
   "defences"
 ];
 async function readChangeInputs(dir) {
-  const text3 = await readFile4(join4(dir, ...INPUTS_INDEX.split("/")), "utf8").catch(() => "");
+  const text3 = await readFile5(join5(dir, ...INPUTS_INDEX.split("/")), "utf8").catch(() => "");
   let data;
   try {
-    data = text3 ? (0, import_yaml6.parse)(text3) : void 0;
+    data = text3 ? (0, import_yaml7.parse)(text3) : void 0;
   } catch {
     data = void 0;
   }
@@ -2000,7 +2778,7 @@ async function writeIndex(dir, index) {
         o[k] = f[k];
     return o;
   });
-  await writeFileAtomic(join4(dir, ...INPUTS_INDEX.split("/")), `# Files attached to this change (ADR 0113): atticus change attach writes this file.
+  await writeFileAtomic(join5(dir, ...INPUTS_INDEX.split("/")), `# Files attached to this change (ADR 0113): atticus change attach writes this file.
 ${toCanonicalYaml({ schemaVersion: index.schemaVersion, files }, ["schemaVersion", "files"])}`);
 }
 var isText = (b) => {
@@ -2091,7 +2869,7 @@ function readText(input, bytes, older) {
 async function attachToChange(dir, files, o) {
   const index = await readChangeInputs(dir);
   const out = { added: [], refused: [], notes: [] };
-  const taken = new Set(await readdir4(join4(dir, INPUTS_DIR)).catch(() => []));
+  const taken = new Set(await readdir5(join5(dir, INPUTS_DIR)).catch(() => []));
   taken.add("index.yaml").add("read");
   const replaced = o.replaces ? index.files.find((x) => x.path === o.replaces.trim().replace(/\\/g, "/")) : void 0;
   let changed = false;
@@ -2178,11 +2956,11 @@ async function attachToChange(dir, files, o) {
     const where = o.elsewhere?.(hash);
     if (where)
       out.notes.push(`${name} is also in the metarepo's inputs as ${where}.`);
-    await mkdir(join4(dir, INPUTS_DIR), { recursive: true });
-    await writeFileAtomic(join4(dir, INPUTS_DIR, target), f.bytes);
+    await mkdir(join5(dir, INPUTS_DIR), { recursive: true });
+    await writeFileAtomic(join5(dir, INPUTS_DIR, target), f.bytes);
     const text3 = readText(input, f.bytes, older);
     if (text3 !== void 0)
-      await writeFileAtomic(join4(dir, ...input.readAs.split("/")), text3);
+      await writeFileAtomic(join5(dir, ...input.readAs.split("/")), text3);
     index.files.push(input);
     out.added.push(input);
   }
@@ -2208,7 +2986,7 @@ async function changeInputSources(dir, rel) {
   for (const f of (await readChangeInputs(dir)).files) {
     if (f.supersededBy || f.defences?.risk === "high")
       continue;
-    const read = f.readAs ? await readFile4(join4(dir, ...f.readAs.split("/")), "utf8").catch(() => void 0) : void 0;
+    const read = f.readAs ? await readFile5(join5(dir, ...f.readAs.split("/")), "utf8").catch(() => void 0) : void 0;
     const text3 = read ?? `${f.path} (${f.name}) is ${f.kind === "image" ? "a picture; Atticus doesn't read pictures" : `a ${f.format} file no reader takes`}. Open it to see it; say what you rely on from it, citing ${f.path}.`;
     out.push({
       id: f.path,
@@ -2237,7 +3015,7 @@ var KIND_ORDER2 = [
   "error-schema",
   "error-removed"
 ];
-var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmp3 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var opKey = (o) => `${o.method} ${normalizePath(o.fullPath)}`;
 var opName = (o) => `${o.method} ${o.path}`;
 var list = (xs) => xs.length <= 1 ? xs[0] ?? "" : `${xs.slice(0, -1).join(", ")} and ${xs.at(-1)}`;
@@ -2302,7 +3080,7 @@ function diffVendorSpecs(older, newer) {
       });
   for (const [o, n] of pairs)
     out.push(...operationChanges(o, n));
-  return out.sort((a, b) => cmp(a.severity === "breaking" ? "0" : "1", b.severity === "breaking" ? "0" : "1") || cmp(a.operation.path, b.operation.path) || cmp(a.operation.method, b.operation.method) || KIND_ORDER2.indexOf(a.kind) - KIND_ORDER2.indexOf(b.kind) || cmp(a.side ?? "", b.side ?? "") || cmp(a.field ?? "", b.field ?? ""));
+  return out.sort((a, b) => cmp3(a.severity === "breaking" ? "0" : "1", b.severity === "breaking" ? "0" : "1") || cmp3(a.operation.path, b.operation.path) || cmp3(a.operation.method, b.operation.method) || KIND_ORDER2.indexOf(a.kind) - KIND_ORDER2.indexOf(b.kind) || cmp3(a.side ?? "", b.side ?? "") || cmp3(a.field ?? "", b.field ?? ""));
 }
 var opOf = (o) => ({
   method: o.method,
@@ -2493,7 +3271,7 @@ function fieldChanges(olds, news, side, at, base) {
 
 // packages/intake/dist/vendor-impact.js
 var MAX_UPSTREAM = 4;
-var cmp2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmp4 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var sorted = (xs) => [...new Set(xs)].sort();
 var joinVendorOf = (input, spec) => ({
   system: input.vendor.system,
@@ -2516,7 +3294,7 @@ var versionOf = (v) => ({
 function vendorImpact(input) {
   const diff = diffVendorSpecs(input.older.spec, input.newer.spec);
   const bundle = input.bundleFolders ? { bundleFolders: input.bundleFolders } : {};
-  const join6 = joinFacts({
+  const join7 = joinFacts({
     repos: input.repos,
     ...input.targets ? { targets: input.targets } : {},
     ...input.facing ? { facing: input.facing } : {},
@@ -2556,8 +3334,8 @@ function vendorImpact(input) {
     const f = facts.get(k(call))?.fact;
     return f?.kind === "call" && f.from ? endOf(call.repo, f.from) : void 0;
   };
-  const hops = new Set(join6.joins.flatMap((j) => (j.gateway ?? []).map((h) => k(h.call))));
-  const joins = join6.joins.filter((j) => j.how !== "topic" && !hops.has(k(j.call)));
+  const hops = new Set(join7.joins.flatMap((j) => (j.gateway ?? []).map((h) => k(h.call))));
+  const joins = join7.joins.filter((j) => j.how !== "topic" && !hops.has(k(j.call)));
   const via = (j) => j.gateway?.length ? { via: j.gateway.map((h) => h.route) } : {};
   const upstreamOf = (start) => {
     const out = [];
@@ -2586,422 +3364,121 @@ function vendorImpact(input) {
     }
     return out;
   };
-  const fieldUse = (call, change) => {
-    if (!change.side || !change.field || change.status)
-      return void 0;
-    const side = change.side;
-    const mine = (input.repos.find((r) => r.repo === call.repo)?.facts ?? []).filter((f) => f.kind === "field" && f.owner === call.fact && (f.side ?? "request") === side).sort((a, b) => cmp2(a.id, b.id));
-    if (!mine.length)
-      return void 0;
-    const want = fieldNameKey(change.field);
-    const hit = mine.find((f) => fieldNameKey(f.name) === want);
-    const req = side === "request";
-    return hit ? { uses: req ? "sends" : "reads", at: `${hit.cite.file}:${hit.cite.line}` } : { uses: req ? "does-not-send" : "does-not-read" };
-  };
-  const changes = diff.map((c) => {
-    const older = c.endpoints.older;
-    const matches = older ? today.matches.filter((m) => m.operation === older) : next.matches.filter((m) => m.operation === c.endpoints.newer);
-    const forwards = matches.map((m) => {
-      if (m.direct) {
-        const f = facts.get(k(m.call))?.fact;
-        const field2 = fieldUse(m.call, c);
-        const self = {
-          call: m.call,
-          interface: interfaceId(m.call.component, factIdPart(f?.to ?? input.vendor.system), m.method, m.path),
-          ...field2 ? { field: field2 } : {},
-          ...m.route ? { under: m.route } : {},
-          upstream: upstreamOf(m.route)
-        };
-        return {
-          call: m.call,
-          ...m.route ? { route: m.route } : {},
-          operation: m.operation,
-          direct: true,
-          callers: [self]
-        };
-      }
-      const callers = m.route ? joins.filter((j) => k(j.entry) === k(m.route) || (j.gateway ?? []).some((h) => k(h.entry) === k(m.route))).map((j) => {
-        const u = under(j.call);
-        const field2 = fieldUse(j.call, c);
-        return {
-          call: j.call,
-          interface: j.interface,
-          ...via(j),
-          ...field2 ? { field: field2 } : {},
-          ...u ? { under: u } : {},
-          upstream: upstreamOf(u)
-        };
-      }) : [];
-      return {
-        call: m.call,
-        ...m.route ? { route: m.route } : {},
-        ...m.tie ? { tie: m.tie } : {},
-        operation: m.operation,
-        callers
-      };
-    });
-    return { id: c.id, severity: c.severity, says: c.says, forwards };
-  });
-  const repos = /* @__PURE__ */ new Set();
-  const interfaces = /* @__PURE__ */ new Set();
-  const endpoints = /* @__PURE__ */ new Set();
-  const entries = /* @__PURE__ */ new Set();
-  for (const c of changes)
-    for (const f of c.forwards) {
-      repos.add(f.call.repo);
-      endpoints.add(f.operation);
-      for (const s of f.callers) {
-        repos.add(s.call.repo);
-        interfaces.add(s.interface);
-        if (s.under)
-          entries.add(k(s.under));
-        for (const u of s.upstream) {
-          repos.add(u.call.repo);
-          interfaces.add(u.interface);
-          entries.add(k(u.reaches));
-          if (u.under)
-            entries.add(k(u.under));
-        }
-      }
-    }
-  const endpointIds = /* @__PURE__ */ new Set();
-  for (const e of entries) {
-    const got = facts.get(e);
-    if (got?.fact.kind === "entry")
-      endpointIds.add(entryEndpointId(got.fact, componentOf(got.repo, got.fact)));
-  }
-  const flows = (input.flows ?? []).filter((f) => f.trigger && endpointIds.has(f.trigger) || (f.refs ?? []).some((r) => endpointIds.has(r))).map((f) => ({ id: f.id, repo: f.repo })).sort((a, b) => cmp2(a.id, b.id));
-  for (const f of flows)
-    repos.add(f.repo);
-  const systems = /* @__PURE__ */ new Set([input.vendor.system]);
-  for (const r of repos) {
-    const s = input.systemOfRepo?.[r];
-    if (s)
-      systems.add(s);
-  }
-  return {
-    diff,
-    impact: {
-      vendor: input.vendor.system,
-      older: versionOf(input.older),
-      newer: versionOf(input.newer),
-      changes,
-      repos: sorted(repos),
-      systems: sorted(systems),
-      flows,
-      interfaces: sorted(interfaces),
-      endpoints: sorted(endpoints),
-      gaps: today.gaps,
-      asks: today.asks
-    }
-  };
-}
-
-// packages/intake/dist/contract-files.js
-var import_yaml7 = __toESM(require_dist(), 1);
-import { readdir as readdir5, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { join as join5 } from "node:path";
-
-// packages/intake/dist/traffic.js
-import { createHash as createHash6 } from "node:crypto";
-var cmp3 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
-var key2 = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
-var sha = (s) => createHash6("sha256").update(s, "utf8").digest("hex");
-var IPV4 = /\b\d{1,3}(?:\.\d{1,3}){3}\b/;
-var IPV6 = /[0-9a-f]{0,4}::[0-9a-f]{0,4}|\b[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){2,7}\b/i;
-var EMAIL = /[^\s@/]+@[^\s@/]+/;
-var JWT = /\beyJ[A-Za-z0-9_-]{6,}/;
-var OPAQUE = /\b(?=[A-Za-z0-9+_-]*\d)(?=[A-Za-z0-9+_-]*[A-Za-z])[A-Za-z0-9+_-]{24,}={0,2}/;
-var UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i;
-var HEX = /\b[0-9a-f]{16,}\b/i;
-function looksSensitive(v) {
-  return [IPV4, IPV6, EMAIL, JWT, OPAQUE, UUID, HEX].some((re) => re.test(v));
-}
-function rowsOf(text3) {
-  const t = text3.replace(/^\uFEFF/, "").trim();
-  if (!t)
-    return void 0;
-  if (t.startsWith("[") || t.startsWith("{")) {
-    let v;
-    try {
-      v = JSON.parse(t);
-    } catch {
-      return void 0;
-    }
-    const list2 = Array.isArray(v) ? v : v && typeof v === "object" ? ["rows", "data", "records", "items"].map((k) => v[k]).find((x) => Array.isArray(x)) : void 0;
-    if (!Array.isArray(list2) || !list2.length)
-      return void 0;
-    const out = [];
-    for (const r of list2) {
-      if (!r || typeof r !== "object" || Array.isArray(r))
-        return void 0;
-      const row = {};
-      for (const [k, x] of Object.entries(r))
-        if (typeof x === "string" || typeof x === "number")
-          row[k] = String(x);
-      out.push(row);
-    }
-    return out;
-  }
-  const recs = parseCsv(t);
-  if (recs.length < 2)
-    return void 0;
-  const head = recs[0].cells.map((c) => c.trim());
-  if (head.length < 2)
-    return void 0;
-  return recs.slice(1).map((r) => {
-    const row = {};
-    head.forEach((h, i) => row[h] = (r.cells[i] ?? "").trim());
-    return row;
-  });
-}
-function dayOf(v) {
-  const m = /^(\d{4}-\d{2}-\d{2})/.exec(v.trim());
-  if (m)
-    return m[1];
-  if (/^\d{12,13}$/.test(v.trim()))
-    return new Date(Number(v)).toISOString().slice(0, 10);
-  return void 0;
-}
-var VERSION2 = /^v\d+(?:\.\d+)*$/i;
-var PARAM = /^(?:\{[A-Za-z_][A-Za-z0-9_.-]{0,40}\}|:[A-Za-z_][A-Za-z0-9_]{0,40}|<[A-Za-z_][A-Za-z0-9_:]{0,40}>)$/;
-var segmentOf = (s) => VERSION2.test(s) || PARAM.test(s) || /^[a-z][a-z._-]*$/.test(s) && s.length <= 20 && /[aeiou]/.test(s) && !looksSensitive(s) ? s : "{id}";
-function barePath(path) {
-  let p = path.trim().split(/[?#]/, 1)[0] ?? "";
-  p = p.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, "");
-  return p.replace(/;[^/]*/g, "");
-}
-function safePathOf(path) {
-  const p = barePath(path);
-  if (!p.startsWith("/"))
-    return void 0;
-  return `/${p.split("/").filter(Boolean).map(segmentOf).join("/")}`;
-}
-var MATCH = 100;
-function pathTemplateOf(path, templates) {
-  const p = barePath(path);
-  if (!p.startsWith("/"))
-    return void 0;
-  const sorted2 = [...templates].sort();
-  let best;
-  let score = 0;
-  for (const t of sorted2) {
-    const s = routeScore(p, t);
-    if (s > MATCH && s > score) {
-      score = s;
-      best = t;
-    }
-  }
-  if (best)
-    return best;
-  const segs = p.split("/").filter(Boolean);
-  let prefix;
-  let len = 0;
-  score = 0;
-  for (const t of sorted2) {
-    const n = t.split("/").filter(Boolean).length;
-    if (n === 0 || n >= segs.length || n < len)
-      continue;
-    const s = routeScore(`/${segs.slice(0, n).join("/")}`, t);
-    if (s <= MATCH)
-      continue;
-    if (n > len || s > score) {
-      len = n;
-      score = s;
-      prefix = t;
-    }
-  }
-  return prefix ? `${prefix.replace(/\/+$/, "")}/**` : void 0;
-}
-var appLabelOf = (name) => `app-${sha(name).slice(0, 8)}`;
-function denyListHits(text3, hashes) {
-  const hits = [];
-  text3.toLowerCase().split("\n").forEach((line, i) => {
-    const w = line.match(/[a-z0-9]+/g) ?? [];
-    for (let k = 0; k < w.length; k++)
-      if (hashes.has(sha(w[k])) || k + 1 < w.length && hashes.has(sha(`${w[k]} ${w[k + 1]}`))) {
-        hits.push(i + 1);
-        break;
-      }
-  });
-  return hits;
-}
-function aggregateTraffic(input) {
-  const text3 = Buffer.from(input.bytes).toString("utf8");
-  const rows = rowsOf(text3);
-  const shape = `a CSV with a header row, or a JSON list of rows, with an app, a method and a path column (${input.source}: app ${input.columns.app.join("/")}; method ${input.columns.method.join("/")}; path ${[...input.columns.path, ...input.columns.basepath].join("/")})`;
-  if (!rows)
-    return { ok: false, message: `The file doesn't read as a traffic export: give ${shape}.` };
-  const names = [...new Set(rows.flatMap((r) => Object.keys(r)))];
-  const col = (aliases) => {
-    for (const a of aliases) {
-      const hit = names.find((n) => key2(n) === key2(a));
-      if (hit)
-        return hit;
-    }
-    return void 0;
-  };
-  const c = {
-    app: col(input.columns.app),
-    method: col(input.columns.method),
-    basepath: col(input.columns.basepath),
-    suffix: col(input.columns.suffix),
-    proxy: col(input.columns.proxy),
-    count: col(input.columns.count),
-    time: col(input.columns.time),
-    path: void 0
+  const fieldUse = (call, change) => {
+    if (!change.side || !change.field || change.status)
+      return void 0;
+    const side = change.side;
+    const mine = (input.repos.find((r) => r.repo === call.repo)?.facts ?? []).filter((f) => f.kind === "field" && f.owner === call.fact && (f.side ?? "request") === side).sort((a, b) => cmp4(a.id, b.id));
+    if (!mine.length)
+      return void 0;
+    const want = fieldNameKey(change.field);
+    const hit = mine.find((f) => fieldNameKey(f.name) === want);
+    const req = side === "request";
+    return hit ? { uses: req ? "sends" : "reads", at: `${hit.cite.file}:${hit.cite.line}` } : { uses: req ? "does-not-send" : "does-not-read" };
   };
-  if (!c.basepath || !c.suffix)
-    c.path = col(input.columns.path);
-  const missing = [
-    !c.app ? "app" : "",
-    !c.method ? "method" : "",
-    !c.path && !(c.basepath && c.suffix) ? "path" : ""
-  ].filter(Boolean);
-  if (missing.length)
-    return {
-      ok: false,
-      message: `The file has no ${missing.join(", ")} column, so it can't be kept as aggregates: give ${shape}.`
-    };
-  const range = (v) => v && /^\d{4}-\d{2}-\d{2}$/.test(v) ? v : void 0;
-  if (input.from && !range(input.from) || input.to && !range(input.to))
-    return { ok: false, message: "--from and --to are days: YYYY-MM-DD." };
-  if ((!input.from || !input.to) && !c.time)
-    return {
-      ok: false,
-      message: "The export has no date column: give --from and --to (YYYY-MM-DD) for the range it covers."
-    };
-  const kept = new Set(Object.values(c).filter((x) => !!x));
-  const dropped = names.filter((n) => !kept.has(n)).sort();
-  const secrets = /* @__PURE__ */ new Set();
-  const keptValues = /* @__PURE__ */ new Set();
-  const agg = /* @__PURE__ */ new Map();
-  let outOfRange = 0;
-  let skipped = 0;
-  let unmatched = 0;
-  const known = /* @__PURE__ */ new Map();
-  for (const a of input.apps ?? [])
-    if (a.trim() && !known.has(key2(a)))
-      known.set(key2(a), a.trim());
-  const days = [];
-  for (const r of rows) {
-    for (const n of dropped) {
-      const v = (r[n] ?? "").trim();
-      const q = /^(?:[a-z][a-z0-9+.-]*:\/\/|\/)/i.test(v) ? v.split(/[?#]/)[1] ?? "" : v;
-      if (q.length >= 6)
-        secrets.add(q);
-    }
-    for (const n of [c.path, c.suffix, c.basepath]) {
-      const v = n ? r[n] ?? "" : "";
-      const q = v.split(/[?#]/)[1] ?? "";
-      if (q.length >= 4)
-        secrets.add(q);
-      for (const m of (v.split(/[?#]/, 1)[0] ?? "").match(/;[^/]*/g) ?? [])
-        if (m.length >= 5)
-          secrets.add(m.slice(1));
-    }
-    if (c.time) {
-      const d = dayOf(r[c.time] ?? "");
-      if (d) {
-        if (input.from && d < input.from || input.to && d > input.to) {
-          outOfRange++;
-          continue;
+  const changes = diff.map((c) => {
+    const older = c.endpoints.older;
+    const matches = older ? today.matches.filter((m) => m.operation === older) : next.matches.filter((m) => m.operation === c.endpoints.newer);
+    const forwards = matches.map((m) => {
+      if (m.direct) {
+        const f = facts.get(k(m.call))?.fact;
+        const field2 = fieldUse(m.call, c);
+        const self = {
+          call: m.call,
+          interface: interfaceId(m.call.component, factIdPart(f?.to ?? input.vendor.system), m.method, m.path),
+          ...field2 ? { field: field2 } : {},
+          ...m.route ? { under: m.route } : {},
+          upstream: upstreamOf(m.route)
+        };
+        return {
+          call: m.call,
+          ...m.route ? { route: m.route } : {},
+          operation: m.operation,
+          direct: true,
+          callers: [self]
+        };
+      }
+      const callers = m.route ? joins.filter((j) => k(j.entry) === k(m.route) || (j.gateway ?? []).some((h) => k(h.entry) === k(m.route))).map((j) => {
+        const u = under(j.call);
+        const field2 = fieldUse(j.call, c);
+        return {
+          call: j.call,
+          interface: j.interface,
+          ...via(j),
+          ...field2 ? { field: field2 } : {},
+          ...u ? { under: u } : {},
+          upstream: upstreamOf(u)
+        };
+      }) : [];
+      return {
+        call: m.call,
+        ...m.route ? { route: m.route } : {},
+        ...m.tie ? { tie: m.tie } : {},
+        operation: m.operation,
+        callers
+      };
+    });
+    return { id: c.id, severity: c.severity, says: c.says, forwards };
+  });
+  const repos = /* @__PURE__ */ new Set();
+  const interfaces = /* @__PURE__ */ new Set();
+  const endpoints = /* @__PURE__ */ new Set();
+  const entries = /* @__PURE__ */ new Set();
+  for (const c of changes)
+    for (const f of c.forwards) {
+      repos.add(f.call.repo);
+      endpoints.add(f.operation);
+      for (const s of f.callers) {
+        repos.add(s.call.repo);
+        interfaces.add(s.interface);
+        if (s.under)
+          entries.add(k(s.under));
+        for (const u of s.upstream) {
+          repos.add(u.call.repo);
+          interfaces.add(u.interface);
+          entries.add(k(u.reaches));
+          if (u.under)
+            entries.add(k(u.under));
         }
-        days.push(d);
-      } else if (!input.from || !input.to) {
-        skipped++;
-        continue;
       }
     }
-    const method = (r[c.method] ?? "").trim().toUpperCase();
-    const rawPath = c.path ? r[c.path] ?? "" : `${(r[c.basepath] ?? "").replace(/\/+$/, "")}/${(r[c.suffix] ?? "").replace(/^\/+/, "")}`;
-    const countText = c.count ? (r[c.count] ?? "").trim() : "1";
-    const count = Number(countText);
-    if (!/^[A-Z]{3,10}$/.test(method) || !barePath(rawPath).startsWith("/") || !Number.isInteger(count) || count < 0) {
-      skipped++;
-      continue;
-    }
-    const path = pathTemplateOf(rawPath, input.templates);
-    if (!path) {
-      unmatched++;
-      continue;
-    }
-    if (count === 0)
-      continue;
-    const appRaw = (r[c.app] ?? "").trim();
-    const app = !appRaw ? "(none)" : known.get(key2(appRaw)) ?? appLabelOf(appRaw);
-    const proxyRaw = c.proxy ? (r[c.proxy] ?? "").trim() : "";
-    const proxy = proxyRaw && !looksSensitive(proxyRaw) ? proxyRaw : void 0;
-    const baseRaw = c.basepath ? (r[c.basepath] ?? "").trim() : "";
-    const basepath = baseRaw ? safePathOf(baseRaw) : void 0;
-    for (const v of [app, proxy, basepath, path])
-      if (v)
-        keptValues.add(v);
-    const k = [app, method, path, proxy ?? "", basepath ?? ""].join("\0");
-    const row = agg.get(k) ?? {
-      app,
-      method,
-      path,
-      ...proxy ? { proxy } : {},
-      ...basepath ? { basepath } : {},
-      count: 0
-    };
-    row.count += count;
-    agg.set(k, row);
+  const endpointIds = /* @__PURE__ */ new Set();
+  for (const e of entries) {
+    const got = facts.get(e);
+    if (got?.fact.kind === "entry")
+      endpointIds.add(entryEndpointId(got.fact, componentOf(got.repo, got.fact)));
+  }
+  const flows = (input.flows ?? []).filter((f) => f.trigger && endpointIds.has(f.trigger) || (f.refs ?? []).some((r) => endpointIds.has(r))).map((f) => ({ id: f.id, repo: f.repo })).sort((a, b) => cmp4(a.id, b.id));
+  for (const f of flows)
+    repos.add(f.repo);
+  const systems = /* @__PURE__ */ new Set([input.vendor.system]);
+  for (const r of repos) {
+    const s = input.systemOfRepo?.[r];
+    if (s)
+      systems.add(s);
   }
-  if (!agg.size)
-    return {
-      ok: false,
-      message: `No row of the file is a request in the range to a route of the estate (${rows.length} read, ${outOfRange} outside it, ${skipped} without a method, path or count, ${unmatched} matching no route template of the estate): nothing to keep.`
-    };
-  days.sort();
-  const from = input.from ?? days[0];
-  const to = input.to ?? days[days.length - 1];
-  if (!from || !to)
-    return { ok: false, message: "The rows carry no dates: give --from and --to (YYYY-MM-DD)." };
-  const parsed = TrafficFile.safeParse({
-    schemaVersion: 1,
-    source: input.source,
-    from,
-    to,
-    inputSha256: createHash6("sha256").update(input.bytes).digest("hex"),
-    rows: [...agg.values()].sort((a, b) => cmp3(a.app, b.app) || cmp3(a.proxy ?? "", b.proxy ?? "") || cmp3(a.path, b.path) || cmp3(a.method, b.method))
-  });
-  if (!parsed.success)
-    return { ok: false, message: `The aggregate isn't valid: ${parsed.error.issues[0]?.message}.` };
-  const out = trafficFileText(parsed.data);
-  const lower = out.toLowerCase();
-  const leaked = [...secrets].filter((s) => !keptValues.has(s) && lower.includes(s.toLowerCase()));
-  if (leaked.length)
-    return {
-      ok: false,
-      message: `Refused: ${leaked.length} value${leaked.length === 1 ? "" : "s"} of the export's dropped columns would be written. Nothing was written.`
-    };
-  const body = out.replace(/^inputSha256: .*$/m, "");
-  if ([IPV4, IPV6, EMAIL, JWT, OPAQUE, UUID, HEX].some((re) => re.test(body)))
-    return {
-      ok: false,
-      message: "Refused: the aggregate would hold an IP, an email or a token-looking value. Nothing was written."
-    };
-  const hits = input.denyHashes?.size ? denyListHits(out, input.denyHashes) : [];
-  if (hits.length)
-    return {
-      ok: false,
-      message: `Refused: the deny-list names a word on line${hits.length === 1 ? "" : "s"} ${hits.join(", ")} of the aggregate. Nothing was written.`
-    };
   return {
-    ok: true,
-    file: parsed.data,
-    text: out,
-    read: rows.length,
-    outOfRange,
-    skipped,
-    unmatched,
-    dropped
+    diff,
+    impact: {
+      vendor: input.vendor.system,
+      older: versionOf(input.older),
+      newer: versionOf(input.newer),
+      changes,
+      repos: sorted(repos),
+      systems: sorted(systems),
+      flows,
+      interfaces: sorted(interfaces),
+      endpoints: sorted(endpoints),
+      gaps: today.gaps,
+      asks: today.asks
+    }
   };
 }
 
 // packages/intake/dist/contract-files.js
+var import_yaml8 = __toESM(require_dist(), 1);
+import { readdir as readdir6, readFile as readFile6, stat as stat3 } from "node:fs/promises";
+import { join as join6 } from "node:path";
 function safeServerUrl(url) {
   const m = /^([a-z][a-z0-9+.-]*:\/\/)([^/?#]*)(.*)$/i.exec(url.trim());
   if (!m) {
@@ -3020,28 +3497,28 @@ var str2 = (m, key3) => {
   return typeof v === "string" && v.trim() ? v.trim() : void 0;
 };
 var mapAt = (m, key3) => {
-  const v = (0, import_yaml7.isMap)(m) ? m.get(key3, true) : void 0;
-  return (0, import_yaml7.isMap)(v) ? v : void 0;
+  const v = (0, import_yaml8.isMap)(m) ? m.get(key3, true) : void 0;
+  return (0, import_yaml8.isMap)(v) ? v : void 0;
 };
 function readPactFile(text3, file) {
-  const lc = new import_yaml7.LineCounter();
+  const lc = new import_yaml8.LineCounter();
   let doc;
   try {
-    doc = (0, import_yaml7.parseDocument)(text3, { lineCounter: lc });
+    doc = (0, import_yaml8.parseDocument)(text3, { lineCounter: lc });
   } catch {
     return void 0;
   }
-  if (doc.errors.length || !(0, import_yaml7.isMap)(doc.contents))
+  if (doc.errors.length || !(0, import_yaml8.isMap)(doc.contents))
     return void 0;
   const root = doc.contents;
   const consumer = str2(mapAt(root, "consumer"), "name");
   const provider = str2(mapAt(root, "provider"), "name");
   const list2 = root.get("interactions", true);
-  if (!consumer || !provider || !(0, import_yaml7.isSeq)(list2))
+  if (!consumer || !provider || !(0, import_yaml8.isSeq)(list2))
     return void 0;
   const out = [];
   for (const it of list2.items) {
-    if (!(0, import_yaml7.isMap)(it))
+    if (!(0, import_yaml8.isMap)(it))
       continue;
     const type = str2(it, "type");
     if (type && !/http/i.test(type))
@@ -3050,8 +3527,8 @@ function readPactFile(text3, file) {
     if (!req)
       continue;
     const method = str2(req, "method");
-    const pair = req.items.find((p) => (0, import_yaml7.isScalar)(p.key) && p.key.value === "path");
-    const path = pair && (0, import_yaml7.isScalar)(pair.value) ? String(pair.value.value) : void 0;
+    const pair = req.items.find((p) => (0, import_yaml8.isScalar)(p.key) && p.key.value === "path");
+    const path = pair && (0, import_yaml8.isScalar)(pair.value) ? String(pair.value.value) : void 0;
     const safe = path?.startsWith("/") ? safePathOf(path) : void 0;
     if (!safe)
       continue;
@@ -3098,7 +3575,7 @@ function readConsumerOpenApi(text3, file, own) {
     ] : [];
   });
 }
-var SKIP = /* @__PURE__ */ new Set([
+var SKIP2 = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
   "vendor",
@@ -3113,19 +3590,19 @@ var SKIP = /* @__PURE__ */ new Set([
   ".idea",
   ".atticus"
 ]);
-var MAX_BYTES = 5 * 1024 * 1024;
+var MAX_BYTES2 = 5 * 1024 * 1024;
 var PACT = /pact/i;
 var SPEC = /(openapi|swagger)/i;
 async function readContractFiles(dir, o) {
   const files = [];
   const walk2 = async (rel) => {
-    const entries2 = await readdir5(join5(dir, ...rel.split("/").filter(Boolean)), {
+    const entries2 = await readdir6(join6(dir, ...rel.split("/").filter(Boolean)), {
       withFileTypes: true
     }).catch(() => []);
     for (const e of [...entries2].sort((a, b) => a.name < b.name ? -1 : 1)) {
       const p = rel ? `${rel}/${e.name}` : e.name;
       if (e.isDirectory()) {
-        if (!SKIP.has(e.name))
+        if (!SKIP2.has(e.name))
           await walk2(p);
       } else if (e.isFile()) {
         if (/\.json$/i.test(e.name) && PACT.test(p))
@@ -3138,11 +3615,11 @@ async function readContractFiles(dir, o) {
   await walk2("");
   const entries = [];
   for (const p of files) {
-    const full = join5(dir, ...p.split("/"));
-    const size = (await stat2(full).catch(() => void 0))?.size ?? 0;
-    if (size === 0 || size > MAX_BYTES)
+    const full = join6(dir, ...p.split("/"));
+    const size = (await stat3(full).catch(() => void 0))?.size ?? 0;
+    if (size === 0 || size > MAX_BYTES2)
       continue;
-    const text3 = await readFile5(full, "utf8");
+    const text3 = await readFile6(full, "utf8");
     const got = (/\.json$/i.test(p) && PACT.test(p) ? readPactFile(text3, p) : void 0) ?? (SPEC.test(p) ? readConsumerOpenApi(text3, p, o.own ?? []) : void 0);
     if (!got?.length)
       continue;
@@ -3177,9 +3654,24 @@ export {
   sortItems,
   opt,
   screenFile,
+  looksSensitive,
+  segmentOf,
+  safePathOf,
+  pathTemplateOf,
+  appLabelOf,
+  denyListHits,
+  aggregateTraffic,
   specEndpointIds,
   readVendorSpec,
   operationSchemas,
+  readProtoSpecs,
+  readAvroSpecs,
+  readJsonSchemaSpecs,
+  readAsyncApiSpecs,
+  openApiContractSpecs,
+  specFormatOf,
+  readContractSpecs,
+  readRepoSpecs,
   nameParts,
   compareVersions,
   scanInputs,
@@ -3203,13 +3695,6 @@ export {
   diffVendorSpecs,
   MAX_UPSTREAM,
   vendorImpact,
-  looksSensitive,
-  segmentOf,
-  safePathOf,
-  pathTemplateOf,
-  appLabelOf,
-  denyListHits,
-  aggregateTraffic,
   safeServerUrl,
   readPactFile,
   readConsumerOpenApi,