@maycombhq/atticus 2.0.0-beta.10 → 2.0.0-beta.12

package/dist/{chunk-4GZXS6S2.js → chunk-MLAACAES.js}

@@ -5,11 +5,12 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readOpenApiDocument
-} from "./chunk-UR7RMZ3R.js";
+} from "./chunk-34NWVIBC.js";
 import {
   globToRegExp
-} from "./chunk-MKRBG5EF.js";
+} from "./chunk-MRLCNXXR.js";
 import {
+  DECLARED_TOPIC,
   DEFAULT_CONVENTIONS,
   Fact,
   FactId,
@@ -29,6 +30,7 @@ import {
   isSecretPath,
   lineNamesClaim,
   normalizePath,
+  noteProblem,
   partsBuildWord,
   partsNamePath,
   plainPathPrefix,
@@ -38,7 +40,7 @@ import {
   staleCite,
   toCanonicalYaml,
   underFolders
-} from "./chunk-577AJVRS.js";
+} from "./chunk-U25OX22K.js";
 
 // packages/verify/dist/source.js
 import { readdirSync, readFileSync, statSync } from "node:fs";
@@ -136,8 +138,11 @@ var FRAMEWORKS = [
 var KNOWN = [
   // Java and Kotlin
   ["spring-boot*", { name: "spring-boot", topic: "spring", shape: "rest" }],
-  // the annotation a Spring Boot app's main class carries, which a reader may cite instead
+  // the annotations a Spring Boot app's main class carries, which a reader may cite instead
+  // (matched by `annotationKey`, so bare, qualified or with arguments)
   ["@springbootapplication", { name: "spring-boot", topic: "spring", shape: "rest" }],
+  ["@enableautoconfiguration", { name: "spring-boot", topic: "spring", shape: "rest" }],
+  ["@quarkusmain", { name: "quarkus", topic: "quarkus" }],
   ["spring-webmvc", { name: "spring", topic: "spring", shape: "rest" }],
   ["spring-webflux", { name: "spring", topic: "spring", shape: "rest" }],
   ["spring-web", { name: "spring", topic: "spring", shape: "rest" }],
@@ -189,6 +194,10 @@ function declarationKey(declared) {
   const name = colon.split(/[=<>~!,\s[]/)[0] ?? colon;
   return name.replace(/^['"]|['"]$/g, "");
 }
+function annotationKey(declared) {
+  const m = /^@?(?:[a-z_$][\w$]*\.)*([A-Z][\w$]*)\s*(?:\(.*)?$/s.exec(declared.trim());
+  return m ? `@${m[1].toLowerCase()}` : void 0;
+}
 function houseKnown(extra) {
   return extra.map((e) => [
     e.declares.toLowerCase(),
@@ -203,19 +212,27 @@ function frameworkOf(declared, extra = []) {
   const key = declarationKey(declared);
   if (!key)
     return void 0;
-  for (const [pattern, known] of extra.length ? [...houseKnown(extra), ...KNOWN] : KNOWN) {
+  const table = extra.length ? [...houseKnown(extra), ...KNOWN] : KNOWN;
+  for (const [pattern, known] of table) {
     const star = pattern.endsWith("*");
     const p = star ? pattern.slice(0, -1) : pattern;
     if (star ? key.startsWith(p) : key === p)
       return known;
   }
+  const ann = annotationKey(declared);
+  if (ann) {
+    for (const [pattern, known] of table)
+      if (pattern === ann)
+        return known;
+  }
   return void 0;
 }
 function frameworkNameProblem(f, extra = []) {
   const known = frameworkOf(f.cite.value, extra);
   const name = f.name.trim().toLowerCase();
   if (known) {
-    return name === known.name.toLowerCase() ? void 0 : `names the framework "${f.name}", but ${f.cite.file}:${f.cite.line} declares ${f.cite.value}, which is ${known.name}`;
+    const legacy = annotationKey(f.cite.value) === `@${name}`;
+    return name === known.name.toLowerCase() || legacy ? void 0 : `names the framework "${f.name}", but ${f.cite.file}:${f.cite.line} declares ${f.cite.value}, which is ${known.name}`;
   }
   const key = declarationKey(f.cite.value);
   if (declarationKey(name) === key || name === key)
@@ -405,6 +422,54 @@ function authPolicyMismatch(auth, file, policy, lines) {
 }
 var authChecks = (auth) => CHECKS[auth] ?? auth;
 
+// packages/verify/dist/call-security-lines.js
+var CLIENT_CERT = /client[-_ .]?cert|keystore|key[-_ .]?store|ssl[-_ .]?bundle|\.pfx\b|\.p12\b|pkcs12|\bpfx\b|\bp12\b/i;
+var CERT_AND_KEY = (l) => /\bcert\b/i.test(l) && /\bkey\b/i.test(l);
+var KINDS = {
+  "tls mtls": {
+    test: (l) => CLIENT_CERT.test(l) || CERT_AND_KEY(l),
+    needs: "a client certificate, a key store or an SSL bundle"
+  },
+  "tls tls": { test: (l) => /https|ssl|tls/i.test(l), needs: "https, SSL or TLS" },
+  "tls none": {
+    test: (l) => !/https:\/\//i.test(l) && (/http:\/\//i.test(l) || /\b(false|disabled?|insecure|plain-?text|off)\b/i.test(l)),
+    needs: "a plain http:// URL or a TLS switch set off"
+  },
+  "auth oauth2": {
+    test: (l) => /oauth|token|bearer|jwt|authori[sz]|client[-_ ]?credentials|access[-_ ]?token/i.test(l),
+    needs: "a token (OAuth, bearer, JWT or an Authorization header)"
+  },
+  "auth api-key": {
+    test: (l) => /api[-_ ]?key|apikey|x-api|subscription[-_ ]?key|[a-z0-9][-_]key\b/i.test(l),
+    needs: "a key"
+  },
+  "auth basic": {
+    test: (l) => /basic|password|passwd|username|credential/i.test(l),
+    needs: "a password or basic credentials"
+  },
+  "auth mtls": {
+    test: (l) => CLIENT_CERT.test(l) || CERT_AND_KEY(l),
+    needs: "a client certificate, a key store or an SSL bundle"
+  }
+};
+function securityLineKind(what, claim, lines) {
+  const k = KINDS[`${what} ${claim}`];
+  if (!k)
+    return void 0;
+  return lines.some((l) => k.test(l)) ? void 0 : k.needs;
+}
+function lineOfValue(lines, line, value) {
+  if (!lines)
+    return void 0;
+  const v = value.toLowerCase();
+  for (const n of [line, line - 1, line + 1]) {
+    const l = lines[n - 1];
+    if (l !== void 0 && l.toLowerCase().includes(v))
+      return l;
+  }
+  return lines[line - 1];
+}
+
 // packages/verify/dist/corrections.js
 function correctionFor(f, corrections) {
   const at = (c) => c.target.kind === f.kind && c.target.file === f.cite.file && c.target.line === f.cite.line;
@@ -1445,6 +1510,17 @@ var topicContext = (line) => {
   const w = wordsOf2(line);
   return w.some((x) => TOPIC_WORDS.has(x)) || w.join(" ").includes("routing key");
 };
+var BUILD_KEY_WORDS = new Set("scm git gitlab github bitbucket repository repositories repo registry mirror mirrors nexus artifactory snapshot snapshots distribution maven npm nuget pypi sonar sonarqube jenkins ci".split(" "));
+var BUILD_BLOCK_TAG = /<(\/?)(repositories|repository|pluginRepositories|pluginRepository|snapshotRepository|distributionManagement|scm|mirrors|mirror|site)\b[^>]*?(\/?)>/gi;
+var BUILD_BLOCK_OPEN = /\b(repositories|publishing|pluginManagement|dependencyResolutionManagement)\s*\{/;
+var keysBefore = (prefix) => [
+  ...[...prefix.matchAll(/<([A-Za-z][\w:.-]*)/g)].map((m) => m[1]),
+  ...[...prefix.matchAll(/["']?([A-Za-z][\w.-]*)["']?\s*[:=]/g)].map((m) => m[1]),
+  ...[...prefix.matchAll(/\b([A-Za-z]\w*)\s*\{/g)].map((m) => m[1])
+];
+var isBuildUrl = (u, prefix) => /\.git\/?$/i.test(u) || /\bscm:\w+:$/i.test(prefix) || keysBefore(prefix).some((k) => wordsOf2(k).some((w) => BUILD_KEY_WORDS.has(w)));
+var HEADER_ARG = /header\w*\s*(?:\.\s*\w+\s*)?\(\s*(?:(?:value|name)\s*=\s*)?$/i;
+var isHeaderName = (s, prefix) => /^x-/i.test(s) || HEADER_ARG.test(prefix.replace(/["'`]$/, ""));
 var cleanUrl = (u) => u.replace(/[.:]+$/, "").replace(/^([a-z0-9+.-]+:\/\/)[^/@\s]+@/i, "$1<redacted>@");
 var hostOf = (u) => /^[a-z0-9+.-]+:\/\/([^/:?#]+)/i.exec(u)?.[1] ?? "";
 function pathOf(s) {
@@ -1494,9 +1570,19 @@ function codeOf(raw, state) {
 function candidatesIn(path, lines) {
   const out = [];
   const state = {};
+  let xmlDepth = 0;
+  let braceDepth = 0;
   lines.forEach((raw, i) => {
     const wasBlock = state.block !== void 0;
     let code2 = codeOf(raw, state);
+    const inBuild = xmlDepth > 0 || braceDepth > 0;
+    for (const m of code2.matchAll(BUILD_BLOCK_TAG))
+      if (!m[3])
+        xmlDepth = Math.max(0, xmlDepth + (m[1] ? -1 : 1));
+    if (braceDepth > 0 || BUILD_BLOCK_OPEN.test(code2)) {
+      const from = braceDepth > 0 ? code2 : code2.slice(BUILD_BLOCK_OPEN.exec(code2).index);
+      braceDepth = Math.max(0, braceDepth + (from.match(/\{/g)?.length ?? 0) - (from.match(/\}/g)?.length ?? 0));
+    }
     if (!code2.trim())
       return;
     if (!wasBlock && isCommentLine(raw))
@@ -1515,19 +1601,24 @@ function candidatesIn(path, lines) {
     };
     const context = topicContext(code2);
     const urls = [];
+    const opened = inBuild || xmlDepth > 0 || braceDepth > 0;
     for (const m of code2.matchAll(URL_RE)) {
       const u = cleanUrl(m[0]);
-      if (!STANDARD_HOST.test(hostOf(u)))
+      const build = opened || isBuildUrl(u, code2.slice(0, m.index));
+      if (!build && !STANDARD_HOST.test(hostOf(u)))
         add("url", u);
       urls.push(m[0]);
     }
-    const strings2 = [...code2.matchAll(QUOTED)].map((m) => m[2]);
+    const strings2 = [...code2.matchAll(QUOTED)].map((m) => ({
+      s: m[2],
+      before: code2.slice(0, m.index + 1)
+    }));
     const kv = KEY_VALUE.exec(code2);
     if (kv)
-      strings2.push(kv[2]);
+      strings2.push({ s: kv[2], before: "" });
     for (const m of code2.matchAll(ELEMENT_TEXT))
-      strings2.push(m[2]);
-    for (const s of strings2) {
+      strings2.push({ s: m[2], before: "" });
+    for (const { s, before } of strings2) {
       if (urls.some((u) => s.includes(u) || u.includes(s)))
         continue;
       const p = pathOf(s);
@@ -1536,7 +1627,7 @@ function candidatesIn(path, lines) {
         continue;
       }
       const t = topicOf(s, context);
-      if (t)
+      if (t && !isHeaderName(t, before))
         add("topic", t);
     }
   });
@@ -1740,6 +1831,9 @@ function claimsOf(f) {
     }
     case "flow":
       return [routeOrWord(f.cite.value)];
+    // ADR 0163: the value as written, on its line.
+    case "term":
+      return [{ kind: "word", value: f.value }];
   }
 }
 var sameCommit = (a, b) => a.startsWith(b) || b.startsWith(a);
@@ -1970,6 +2064,40 @@ async function verifyFacts(o) {
       if (f.exposes === void 0 && !serves2)
         problem(f, "exposure-component", `${label} says where a component is reached and names none: this repo's facts serve nothing, so its routes reach another repo's component; name it in exposes (one of the estate's components), or write a question when no file says which`);
     }
+    if (f.kind === "call") {
+      for (const [what, claim, at] of [
+        ["auth", f.auth, f.authCite],
+        ["tls", f.tls, f.tlsCite]
+      ]) {
+        if (claim !== void 0 && !at && f.by !== "person")
+          problem(f, "security-uncited", `${label} claims ${what} ${claim} and cites no line for it: give ${what}Cite, the line that sets it (a client certificate, a token, an https URL) and what it writes there, or leave ${what} out`);
+        if (!at)
+          continue;
+        const bad = checkCite({ ...at }, [{ kind: "word", value: at.value }], `${label} ${what}Cite${claim ? ` (${what} ${claim})` : ""}`, false);
+        add(f, bad);
+        if (bad || claim === void 0)
+          continue;
+        const lines = [at, ...at.with ?? []].flatMap((p) => {
+          const l = lineOfValue(linesOf2(p.file), p.line, p.value);
+          return l === void 0 ? [] : [l];
+        });
+        const needs = securityLineKind(what, claim, lines);
+        if (needs)
+          problem(f, "security-line-kind", `${label} claims ${what} ${claim} at ${at.file}:${at.line}${at.with?.length ? " and its parts" : ""}, which write${at.with?.length ? "" : "s"} no ${needs}: cite the line that sets it (with the line that builds it in ${what}Cite.with), or write the ${what} the line sets`);
+      }
+    }
+    if (f.kind === "term") {
+      const m = f.meaning;
+      if (m && m.file !== f.cite.file)
+        problem(f, "term-meaning", `${label} says ${m.file}:${m.line} gives "${f.value}" its meaning, and the value is in ${f.cite.file}: cite the line of the same file (the list's or the block's key) that does`);
+      else if (m && m.line > f.cite.line)
+        problem(f, "term-meaning", `${label} says line ${m.line} gives "${f.value}" its meaning, below the value's line ${f.cite.line}: cite the line above it (the list's or the block's key) that does`);
+      else if (m)
+        add(f, checkCite({ ...m }, [{ kind: "word", value: m.value }], `${label} meaning`, false));
+      const bad = f.note !== void 0 && o.notes ? noteProblem(f.note, o.notes) : void 0;
+      if (bad)
+        problem(f, bad.code, `${label} ${bad.message}`);
+    }
     if (f.kind === "framework") {
       const bad = frameworkNameProblem(f, rules.frameworks);
       if (bad)
@@ -3922,6 +4050,8 @@ var HOW_OF_FLAG = {
   "joined-by-repo": "repo",
   "joined-by-host": "host",
   "declared-caller": "declared",
+  // ADR 0162 §6 (F8): a topic or queue the profile names as an outside system's: a person's word.
+  [DECLARED_TOPIC]: "declared",
   // ADR 0160 (O3): answered by an entry of another team's shared map.
   [JOINED_TO_SHARED_MAP]: "shared"
 };
@@ -4123,6 +4253,7 @@ function buildEstate(records2) {
     add(fromRecord(c, `component:${c.id}`, "component", c.id, parent, { type: c.type, runtime: c.runtime, repo: c.repo, path: c.path }, gaps));
   }
   const endpointNode = /* @__PURE__ */ new Map();
+  const topicByPath = /* @__PURE__ */ new Map();
   for (const e of all(records2, "Endpoint")) {
     const topic = TOPIC_TYPES.has(e.endpointType);
     const id = `${topic ? "topic" : "endpoint"}:${e.id}`;
@@ -4139,7 +4270,30 @@ function buildEstate(records2) {
       auth: e.auth
     }, gaps));
     endpointNode.set(e.id, id);
+    if (topic)
+      topicByPath.set(e.pathOrTopic, id);
   }
+  const busTopic = (name, parent, ev = []) => {
+    const known = topicByPath.get(name);
+    if (known)
+      return known;
+    const id = add({
+      id: `topic:bus.${slug2(name)}`,
+      kind: "topic",
+      label: name,
+      parent,
+      state: "current",
+      gaps: [],
+      evidence: ev,
+      properties: { pathOrTopic: name },
+      next: {
+        command: `atticus query "${name}"`,
+        why: "List the records that name this topic or queue."
+      }
+    });
+    topicByPath.set(name, id);
+    return id;
+  };
   const storeNode = /* @__PURE__ */ new Map();
   for (const d of all(records2, "DataStore")) {
     const owner = d.ownerComponent && components.has(d.ownerComponent);
@@ -4190,6 +4344,29 @@ function buildEstate(records2) {
       atoms.push({ from: to, to: target, type: "subscribes", evidence: ev, gaps, join: join2 });
       continue;
     }
+    if (!i.endpoint && (i.via === "event-bus" || i.via === "mq") && i.normalizedPath) {
+      const isSystem = (n) => n.startsWith("system:") || n.startsWith("unknown:");
+      const [home, homeRef] = !isSystem(to) && isSystem(from) ? [from, i.from] : [to, i.to];
+      const t = busTopic(i.normalizedPath, home);
+      const owner = nodes.get(t);
+      if (owner.parent === home && isSystem(home)) {
+        owner.properties = { ...owner.properties, owner: nodes.get(home)?.label ?? home };
+        const b = nodes.get(home)?.properties.boundary;
+        if (outside.has(homeRef) || b === "vendor" || b === "outside")
+          owner.properties.ownerOutside = true;
+      }
+      if (join2.shared)
+        owner.properties = { ...owner.properties, owner: join2.shared.team, ownerOutside: true };
+      if (i.flags?.includes(DECLARED_TOPIC)) {
+        owner.properties = { ...owner.properties, declared: true };
+        owner.gaps = [.../* @__PURE__ */ new Set([...owner.gaps, DECLARED_TOPIC])];
+        owner.evidence = mergeEvidence(owner.evidence, evidenceOf(i.evidence.filter((e) => e.source === "manual")));
+      }
+      atoms.push({ from, to: t, type: "publishes", evidence: ev, gaps, join: join2 });
+      if (to.startsWith("component:"))
+        atoms.push({ from: to, to: t, type: "subscribes", evidence: ev, gaps, join: join2 });
+      continue;
+    }
     let caller = from;
     if (from.startsWith("component:")) {
       caller = add({
@@ -4222,6 +4399,22 @@ function buildEstate(records2) {
       join: join2
     });
   }
+  for (const u of all(records2, "Unresolved")) {
+    if (u.unresolvedKind !== "event-publish" && u.unresolvedKind !== "event-subscribe")
+      continue;
+    if (!u.raw || u.raw.includes("${"))
+      continue;
+    const owner = u.owner ? partNode(u.owner) : "estate";
+    const ev = evidenceOf(u.evidence);
+    const t = busTopic(u.raw, u.unresolvedKind === "event-subscribe" ? owner : "estate", ev);
+    atoms.push({
+      from: owner,
+      to: t,
+      type: u.unresolvedKind === "event-publish" ? "publishes" : "subscribes",
+      evidence: ev,
+      gaps: recordGaps(u)
+    });
+  }
   for (const c of components.values())
     for (const u of c.uses ?? [])
       atoms.push({
@@ -4274,6 +4467,37 @@ function buildEstate(records2) {
       gaps: recordGaps(k)
     });
   }
+  const busy = /* @__PURE__ */ new Set();
+  const internal = (id) => {
+    const n = nodes.get(id);
+    return !!n && n.kind !== "unknown" && n.properties.boundary !== "outside" && n.properties.boundary !== "vendor";
+  };
+  for (const a of atoms)
+    if (a.type === "publishes" || a.type === "subscribes") {
+      if (internal(a.from))
+        busy.add(`${a.type}|${a.to}`);
+    }
+  for (const n of nodes.values()) {
+    if (n.kind !== "topic")
+      continue;
+    if (n.properties.owner === void 0) {
+      let p = n.parent ? nodes.get(n.parent) : void 0;
+      while (p && p.kind !== "system" && p.kind !== "repo" && p.kind !== "estate")
+        p = p.parent ? nodes.get(p.parent) : void 0;
+      if (p && p.kind !== "estate") {
+        let sys = p;
+        while (sys && sys.kind !== "system")
+          sys = sys.parent ? nodes.get(sys.parent) : void 0;
+        n.properties = { ...n.properties, owner: (sys ?? p).label };
+        if (sys && (sys.properties.boundary === "outside" || sys.properties.boundary === "vendor"))
+          n.properties.ownerOutside = true;
+      }
+    }
+    if (!busy.has(`publishes|${n.id}`))
+      n.gaps.push("no-publisher");
+    if (!busy.has(`subscribes|${n.id}`))
+      n.gaps.push("no-listener");
+  }
   const kids = /* @__PURE__ */ new Map();
   for (const n of nodes.values()) {
     if (!n.parent)
@@ -4438,16 +4662,27 @@ function nodeView(est, id, o) {
     return ax[i] ?? x;
   };
   const types = LENS_EDGES[lens];
+  const onBus = (atom, b) => (atom.type === "publishes" || atom.type === "subscribes") && est.nodes.get(b)?.kind === "topic" && b !== id;
+  const drawnTopics = /* @__PURE__ */ new Set();
+  for (const atom of est.atoms) {
+    if (!types.has(atom.type))
+      continue;
+    const a = lift(est, lens, atom.from);
+    const b = lift(est, lens, atom.to);
+    if (onBus(atom, b) && (inside(a) || inside(b)))
+      drawnTopics.add(b);
+  }
   const mapped = [];
   for (const atom of est.atoms) {
     if (!types.has(atom.type))
       continue;
     const a = lift(est, lens, atom.from);
     const b = lift(est, lens, atom.to);
-    if (!inside(a) && !inside(b))
+    const bus = onBus(atom, b);
+    if (!inside(a) && !inside(b) && !(bus && drawnTopics.has(b)))
       continue;
     const from = place(a);
-    const to = place(b);
+    const to = bus ? b : place(b);
     if (from === to)
       continue;
     mapped.push({ from, to, atom });
@@ -4456,10 +4691,12 @@ function nodeView(est, id, o) {
   let hidden = 0;
   if (!o.all)
     ({ edges, hidden } = reduceUses(edges));
-  const outside = [...new Set(edges.flatMap((e) => [e.from, e.to]))].filter((n) => n !== id && !shownSet.has(n)).sort();
-  const children = shown.map((n) => toNode(est, lens, n));
+  const ends = [...new Set(edges.flatMap((e) => [e.from, e.to]))].filter((n) => n !== id && !shownSet.has(n));
+  const deeper = ends.filter((n) => drawnTopics.has(n) && inside(n)).sort();
+  const outside = ends.filter((n) => !deeper.includes(n)).sort();
+  const children = [...shown, ...deeper].map((n) => toNode(est, lens, n));
   const firstTable = children.find((c) => c.kind === "table");
-  const suggest = lens === "data" && firstTable ? { mode: "focus", id: firstTable.id } : shown.length + outside.length > DETAILED_LIMIT ? { mode: "group" } : void 0;
+  const suggest = lens === "data" && firstTable ? { mode: "focus", id: firstTable.id } : shown.length + deeper.length + outside.length > DETAILED_LIMIT ? { mode: "group" } : void 0;
   return {
     lens,
     node: toNode(est, lens, id),
@@ -4818,6 +5055,27 @@ function config(c) {
     return `- ${code(`${s.key} = ${s.valueOrRef}`)} (${notes.join("; ")}): ${cite(c, ownEvidence(s, c.i.repo))}`;
   });
 }
+function terms(c) {
+  const ts = c.i.terms ?? [];
+  const owners = /* @__PURE__ */ new Map();
+  for (const r of records(c, "Component"))
+    for (const f of r.flags ?? []) {
+      const m = /^term:[^=]+=(.+)$/.exec(f);
+      if (m && !c.comps.has(r.id))
+        owners.set(m[1], [...owners.get(m[1]) ?? [], r.id]);
+    }
+  const listing = /* @__PURE__ */ new Map();
+  for (const g of records(c, "AccessGrant"))
+    if (g.flags?.some((f) => f.startsWith("term:"))) {
+      const route = c.byId.get(g.resource);
+      const by = route?.kind === "GatewayRoute" ? route.proxy : g.resource;
+      listing.set(g.subject, [.../* @__PURE__ */ new Set([...listing.get(g.subject) ?? [], by])]);
+    }
+  return [...ts].sort((a, b) => cmp2(a.term, b.term) || cmp2(a.value, b.value)).map((t) => {
+    const means = t.role === "owner" ? `this repo's own id${listing.get(t.value)?.length ? `; let in by ${list(listing.get(t.value).sort())}` : ""}` : t.role === "consumer" ? `a consumer it lets in${owners.get(t.value)?.length ? `: ${list(owners.get(t.value).sort())}` : ", whose own repo no fact names yet"}` : t.role === "none" ? "names no system" : `**open:** nothing says what it means${owners.get(t.value)?.length ? `; the same value is ${list(owners.get(t.value).sort())}'s own id (a possible link)` : ""}`;
+    return `- ${code(t.term)} ${code(t.value)}: ${means} ${cite(c, t.cite)}${t.meaning ? ` (its role from ${cite(c, t.meaning)})` : ""}`;
+  });
+}
 var flowFile = (f) => `flows/${f.id}.md`;
 function flowsList(c) {
   if (!c.i.flows.length)
@@ -5054,6 +5312,7 @@ function renderMap(i) {
     ...section("What it stores", stores(base)),
     ...section("Where it runs", deploys(base)),
     ...section("Config that names other systems", config(base)),
+    ...i.terms?.length ? section("Terms", terms(base)) : [],
     ...section("Flows", flowsList(base)),
     ...section("Contracts", contracts(base, files)),
     ...section("Open questions", openQuestions(base))
@@ -5367,7 +5626,9 @@ export {
   sameCommit,
   staleMessage,
   verifyFacts,
+  readingRank,
   FILE_KINDS,
+  fileKinds,
   kindsOf,
   numberedSlice,
   sliceText,

package/dist/{chunk-D3PO4DOZ.js → chunk-MMB2OHUY.js}

@@ -5,7 +5,7 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 
 // packages/core/dist/schema/version.js
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 
 // packages/core/dist/fs.js
 import { randomBytes } from "node:crypto";
@@ -105,7 +105,9 @@ var LOCAL_ONLY = [
   "backups/",
   "history/",
   "probe/",
-  "cache/"
+  "cache/",
+  // ADR 0161: where `atticus map --all` is in the estate, so running it again resumes.
+  "map-all/"
 ];
 async function ensureLocalIgnore(root) {
   const file = join(root, ".atticus", ".gitignore");

package/dist/{chunk-DDAHCPGA.js → chunk-MNCQ2GL7.js}

@@ -14,26 +14,26 @@ import {
   scaffoldDialect,
   surveyRepos,
   testDialect
-} from "./chunk-Y5PZHS4K.js";
-import "./chunk-AY2IUF4K.js";
-import "./chunk-6JLPXDWN.js";
-import "./chunk-4GZXS6S2.js";
-import "./chunk-R4TBNKKC.js";
-import "./chunk-NIXVDQVO.js";
+} from "./chunk-INCECZ2E.js";
+import "./chunk-22GLUHGE.js";
+import "./chunk-QR65C3DV.js";
+import "./chunk-MLAACAES.js";
+import "./chunk-HY2VVVFZ.js";
+import "./chunk-PJRMMWU4.js";
 import {
   SYNTAX_LANGUAGES,
   syntaxLanguageOf,
   syntaxOutline
-} from "./chunk-UR7RMZ3R.js";
-import "./chunk-PGKHJYOB.js";
-import "./chunk-MKRBG5EF.js";
-import "./chunk-5XDNUJ4P.js";
+} from "./chunk-34NWVIBC.js";
+import "./chunk-RA64IK43.js";
+import "./chunk-MRLCNXXR.js";
+import "./chunk-CQD26SMZ.js";
 import {
   RecordId,
   orgPackDirOf,
   require_dist
-} from "./chunk-577AJVRS.js";
-import "./chunk-D3PO4DOZ.js";
+} from "./chunk-U25OX22K.js";
+import "./chunk-MMB2OHUY.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";

package/dist/{chunk-UYYN2IUZ.js → chunk-MNUZX67F.js}

@@ -5,17 +5,17 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   changeStore
-} from "./chunk-XQ3YIV5R.js";
+} from "./chunk-U5T4A2QV.js";
 import {
   ManualNotifier,
   fileStepStore
-} from "./chunk-NGPU2ARF.js";
+} from "./chunk-DW4BM73R.js";
 import {
   readCatalog
-} from "./chunk-AY2IUF4K.js";
+} from "./chunk-22GLUHGE.js";
 import {
   readServiceRequestExports
-} from "./chunk-R4TBNKKC.js";
+} from "./chunk-HY2VVVFZ.js";
 import {
   Initiative,
   IsoDate,
@@ -32,10 +32,10 @@ import {
   serializeRecord,
   stateDirOf,
   toCanonicalYaml
-} from "./chunk-577AJVRS.js";
+} from "./chunk-U25OX22K.js";
 import {
   SCHEMA_VERSION
-} from "./chunk-D3PO4DOZ.js";
+} from "./chunk-MMB2OHUY.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";