@maycombhq/atticus 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/{chunk-23W7VWKR.js → chunk-CPK7QSBG.js}

@@ -7,27 +7,30 @@ import {
   documentFormat,
   drawioIngestor,
   officeFormat,
+  parseCsv,
   readDocument,
   readDrawio,
   readMermaid,
   resolveNames
-} from "./chunk-7EKXJZ2Y.js";
+} from "./chunk-YO2PKTXT.js";
 import {
   openapiExtractor,
   readOpenApiDocument
-} from "./chunk-MC3H7736.js";
+} from "./chunk-TWQRPM76.js";
 import {
   combine,
   formatOf,
   screenDiagramXml,
   screenOfficeXml,
   screenText
-} from "./chunk-CNUKCS2T.js";
+} from "./chunk-QHJJMZLX.js";
 import {
+  TrafficFile,
   endpointId,
   entryEndpointId,
   factIdPart,
   fieldNameKey,
+  interfaceId,
   joinFacts,
   joinVendorOperations,
   loadOrgPack,
@@ -36,11 +39,13 @@ import {
   parseRecord,
   readZip,
   require_dist,
-  toCanonicalYaml
-} from "./chunk-S2A7YC3Q.js";
+  routeScore,
+  toCanonicalYaml,
+  trafficFileText
+} from "./chunk-PAINMSID.js";
 import {
   writeFileAtomic
-} from "./chunk-D3PO4DOZ.js";
+} from "./chunk-ODMBPDDV.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";
@@ -122,6 +127,151 @@ function fromData(data) {
   }
   return void 0;
 }
+var STRICT_ALIASES = 100;
+var LENIENT_ALIASES = 1e4;
+var LENIENT = { uniqueKeys: false, maxAliasCount: LENIENT_ALIASES };
+var reasonOf = (e) => e.message.split("\n")[0].replace(/\s+at line \d+, column \d+:?\s*$/, "").trim();
+var unreadableOf = (e) => ({
+  reason: reasonOf(e),
+  ...e.linePos?.[0] ? { line: e.linePos[0].line, column: e.linePos[0].col } : {}
+});
+function duplicateKeys(text3) {
+  const lines = text3.split(/\r?\n/);
+  return (0, import_yaml.parseDocument)(text3).errors.filter((e) => e.code === "DUPLICATE_KEY" && e.linePos?.[0]).map((e) => {
+    const { line, col } = e.linePos[0];
+    const key3 = /^\s*["']?([^"':]+)["']?\s*:/.exec((lines[line - 1] ?? "").slice(col - 1))?.[1];
+    return `duplicate key ${key3 ? `"${key3.trim()}" ` : ""}at ${line}:${col}: the last one is kept`;
+  });
+}
+function braceBalance(line) {
+  let n = 0;
+  let quote;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (quote) {
+      if (c === "\\" && quote === '"')
+        i++;
+      else if (c === quote)
+        quote = void 0;
+    } else if (c === '"' || c === "'")
+      quote = c;
+    else if (c === "#" && (i === 0 || /\s/.test(line[i - 1])))
+      return NaN;
+    else if (c === "{")
+      n++;
+    else if (c === "}")
+      n--;
+  }
+  return quote ? NaN : n;
+}
+var indentOf = (l) => /^\s*/.exec(l)[0].length;
+var blank = (l) => !l.trim() || /^\s*#/.test(l);
+function joinServerVariables(text3) {
+  const lines = text3.split(/\r?\n/);
+  const at = [];
+  let servers;
+  let vars;
+  for (let i = 0; i < lines.length; i++) {
+    const l = lines[i];
+    if (blank(l))
+      continue;
+    const ind = indentOf(l);
+    if (vars !== void 0 && ind <= vars)
+      vars = void 0;
+    if (servers !== void 0 && ind <= servers && !/^\s*-(\s|$)/.test(l))
+      servers = void 0;
+    if (servers !== void 0 && ind < servers)
+      servers = void 0;
+    if (/^\s*["']?servers["']?\s*:\s*$/.test(l)) {
+      servers = ind;
+      vars = void 0;
+      continue;
+    }
+    if (servers === void 0)
+      continue;
+    const v = /^(\s*)(-\s+)?["']?variables["']?\s*:\s*$/.exec(l);
+    if (v) {
+      vars = v[1].length + (v[2]?.length ?? 0);
+      continue;
+    }
+    if (vars === void 0)
+      continue;
+    const m = /^(\s*)(["']?[\w.-]+["']?)\s*:\s*(\{.*)$/.exec(l);
+    if (!m)
+      continue;
+    let balance = braceBalance(m[3]);
+    if (Number.isNaN(balance))
+      return void 0;
+    const parts = [m[3].trim()];
+    let j = i;
+    while (balance > 0) {
+      j++;
+      if (j >= lines.length || j - i > 200)
+        return void 0;
+      const b = braceBalance(lines[j]);
+      if (Number.isNaN(b))
+        return void 0;
+      balance += b;
+      parts.push(lines[j].trim());
+    }
+    if (balance < 0)
+      return void 0;
+    const joined = `${m[1]}${m[2]}: ${parts.filter(Boolean).join(" ")}`;
+    if (joined === l && j === i)
+      continue;
+    lines[i] = joined;
+    for (let k = i + 1; k <= j; k++)
+      lines[k] = "";
+    at.push(i + 1);
+    i = j;
+  }
+  return at.length ? { text: lines.join("\n"), at } : void 0;
+}
+var SPEC_KINDS = ["openapi", "swagger", "asyncapi"];
+function readYaml(text3) {
+  let first;
+  try {
+    return { data: (0, import_yaml.parse)(text3) };
+  } catch (e) {
+    first = e;
+  }
+  const notes = [];
+  const dup = first.code === "DUPLICATE_KEY";
+  const aliases = /alias count/i.test(first.message);
+  const lenient = (t) => {
+    try {
+      return { data: (0, import_yaml.parse)(t, LENIENT) };
+    } catch (e) {
+      return { error: e };
+    }
+  };
+  const notesOf = (t) => {
+    const out = duplicateKeys(t);
+    try {
+      (0, import_yaml.parse)(t, { uniqueKeys: false });
+    } catch (e) {
+      if (/alias count/i.test(e.message))
+        out.push(`more aliases than the strict parser allows (${STRICT_ALIASES}): read with a higher limit (${LENIENT_ALIASES})`);
+    }
+    return out;
+  };
+  if (dup || aliases) {
+    const r = lenient(text3);
+    if ("data" in r)
+      return { data: r.data, notes: notesOf(text3) };
+  }
+  const fixed = joinServerVariables(text3);
+  if (fixed) {
+    const r = lenient(fixed.text);
+    if ("data" in r && SPEC_KINDS.includes(fromData(r.data)?.classification ?? "unknown")) {
+      notes.push(...notesOf(fixed.text));
+      const lines = fixed.at.length === 1 ? `line ${fixed.at[0]} is a flow mapping` : `lines ${fixed.at.slice(0, -1).join(", ")} and ${fixed.at.at(-1)} are flow mappings`;
+      notes.push(`servers[].variables at ${lines} written over several lines, not indented past ${fixed.at.length === 1 ? "its key: read as if it were" : "their key: read as if each were"} on one line`);
+      return { data: r.data, notes, text: fixed.text };
+    }
+  }
+  return { error: first };
+}
 function classify(fileName, bytes) {
   const name = fileName.toLowerCase();
   const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1) : "";
@@ -163,19 +313,26 @@ function classify(fileName, bytes) {
     return { classification: "diagram" };
   if (/^<(!doctype html|html)\b/i.test(head))
     return { classification: "document" };
+  if (ext === "proto" || /^(syntax\s*=\s*["']proto[23]["']|package\s+[\w.]+\s*;)/m.test(head))
+    return { classification: "protobuf" };
+  if (ext === "avsc" || /^\{/.test(head) && /"type"\s*:\s*"record"/.test(head) && /"fields"\s*:/.test(head))
+    return { classification: "avro" };
   if (["json", "yaml", "yml"].includes(ext) || /^[[{]/.test(head)) {
-    let data;
-    try {
-      data = (0, import_yaml.parse)(text3);
-    } catch {
-      data = void 0;
-    }
+    const r = readYaml(text3);
+    const named = ["json", "yaml", "yml"].includes(ext);
+    if ("error" in r && named)
+      return { classification: "unknown", unreadable: unreadableOf(r.error) };
+    const data = "data" in r ? r.data : void 0;
+    const lenient = {
+      ..."notes" in r && r.notes?.length ? { notes: r.notes } : {},
+      ..."text" in r && r.text !== void 0 ? { text: r.text } : {}
+    };
     const known = fromData(data);
     if (known)
-      return known;
+      return { ...known, ...lenient };
     if (ext === "json" || /^[[{]/.test(head)) {
       if (isObj(data) || Array.isArray(data))
-        return { classification: "payload", data };
+        return { classification: "payload", data, ...lenient };
     }
     if (ext === "yaml" || ext === "yml")
       return { classification: "unknown" };
@@ -195,7 +352,10 @@ import { createHash } from "node:crypto";
 var READERS = {
   openapi: `${openapiExtractor.id}@${openapiExtractor.version}`,
   asyncapi: "asyncapi@0.1.0",
-  payload: "payload@0.1.0"
+  payload: "payload@0.1.0",
+  // ADR 0164: a topic's message spec.
+  protobuf: "protobuf@0.1.0",
+  avro: "avro@0.1.0"
 };
 var short = (s) => createHash("sha256").update(s).digest("hex").slice(0, 6);
 function oneFile(path, text3) {
@@ -365,8 +525,8 @@ var KIND_ORDER = [
   "needs-reading"
 ];
 var slug = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-function boundedId(prefix, key2) {
-  const id = `${prefix}${key2}`;
+function boundedId(prefix, key3) {
+  const id = `${prefix}${key3}`;
   if (id.length <= 120)
     return id;
   return `${id.slice(0, 110)}-${createHash2("sha256").update(id).digest("hex").slice(0, 8)}`;
@@ -411,9 +571,9 @@ var opt = {
 };
 
 // packages/intake/dist/scan-inputs.js
-import { createHash as createHash4 } from "node:crypto";
-import { readdir, readFile, stat } from "node:fs/promises";
-import { join, relative, resolve, sep } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { join as join2, relative, resolve, sep } from "node:path";
 
 // packages/intake/dist/screen-file.js
 var PK = (b) => b[0] === 80 && b[1] === 75;
@@ -455,10 +615,314 @@ function screenFile(path, bytes) {
   }
 }
 
+// packages/intake/dist/contract-specs.js
+var import_yaml4 = __toESM(require_dist(), 1);
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+
+// packages/intake/dist/traffic.js
+import { createHash as createHash3 } from "node:crypto";
+var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var key = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+var sha = (s) => createHash3("sha256").update(s, "utf8").digest("hex");
+var IPV4 = /\b\d{1,3}(?:\.\d{1,3}){3}\b/;
+var IPV6 = /[0-9a-f]{0,4}::[0-9a-f]{0,4}|\b[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){2,7}\b/i;
+var EMAIL = /[^\s@/]+@[^\s@/]+/;
+var JWT = /\beyJ[A-Za-z0-9_-]{6,}/;
+var OPAQUE = /\b(?=[A-Za-z0-9+_-]*\d)(?=[A-Za-z0-9+_-]*[A-Za-z])[A-Za-z0-9+_-]{24,}={0,2}/;
+var UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i;
+var HEX = /\b[0-9a-f]{16,}\b/i;
+function looksSensitive(v) {
+  return [IPV4, IPV6, EMAIL, JWT, OPAQUE, UUID, HEX].some((re) => re.test(v));
+}
+function rowsOf(text3) {
+  const t = text3.replace(/^\uFEFF/, "").trim();
+  if (!t)
+    return void 0;
+  if (t.startsWith("[") || t.startsWith("{")) {
+    let v;
+    try {
+      v = JSON.parse(t);
+    } catch {
+      return void 0;
+    }
+    const list2 = Array.isArray(v) ? v : v && typeof v === "object" ? ["rows", "data", "records", "items"].map((k) => v[k]).find((x) => Array.isArray(x)) : void 0;
+    if (!Array.isArray(list2) || !list2.length)
+      return void 0;
+    const out = [];
+    for (const r of list2) {
+      if (!r || typeof r !== "object" || Array.isArray(r))
+        return void 0;
+      const row = {};
+      for (const [k, x] of Object.entries(r))
+        if (typeof x === "string" || typeof x === "number")
+          row[k] = String(x);
+      out.push(row);
+    }
+    return out;
+  }
+  const recs = parseCsv(t);
+  if (recs.length < 2)
+    return void 0;
+  const head = recs[0].cells.map((c) => c.trim());
+  if (head.length < 2)
+    return void 0;
+  return recs.slice(1).map((r) => {
+    const row = {};
+    head.forEach((h, i) => row[h] = (r.cells[i] ?? "").trim());
+    return row;
+  });
+}
+function dayOf(v) {
+  const m = /^(\d{4}-\d{2}-\d{2})/.exec(v.trim());
+  if (m)
+    return m[1];
+  if (/^\d{12,13}$/.test(v.trim()))
+    return new Date(Number(v)).toISOString().slice(0, 10);
+  return void 0;
+}
+var VERSION = /^v\d+(?:\.\d+)*$/i;
+var PARAM = /^(?:\{[A-Za-z_][A-Za-z0-9_.-]{0,40}\}|:[A-Za-z_][A-Za-z0-9_]{0,40}|<[A-Za-z_][A-Za-z0-9_:]{0,40}>)$/;
+var segmentOf = (s) => VERSION.test(s) || PARAM.test(s) || /^[a-z][a-z._-]*$/.test(s) && s.length <= 20 && /[aeiou]/.test(s) && !looksSensitive(s) ? s : "{id}";
+function barePath(path) {
+  let p = path.trim().split(/[?#]/, 1)[0] ?? "";
+  p = p.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, "");
+  return p.replace(/;[^/]*/g, "");
+}
+function safePathOf(path) {
+  const p = barePath(path);
+  if (!p.startsWith("/"))
+    return void 0;
+  return `/${p.split("/").filter(Boolean).map(segmentOf).join("/")}`;
+}
+var MATCH = 100;
+function pathTemplateOf(path, templates) {
+  const p = barePath(path);
+  if (!p.startsWith("/"))
+    return void 0;
+  const sorted2 = [...templates].sort();
+  let best;
+  let score = 0;
+  for (const t of sorted2) {
+    const s = routeScore(p, t);
+    if (s > MATCH && s > score) {
+      score = s;
+      best = t;
+    }
+  }
+  if (best)
+    return best;
+  const segs = p.split("/").filter(Boolean);
+  let prefix;
+  let len = 0;
+  score = 0;
+  for (const t of sorted2) {
+    const n = t.split("/").filter(Boolean).length;
+    if (n === 0 || n >= segs.length || n < len)
+      continue;
+    const s = routeScore(`/${segs.slice(0, n).join("/")}`, t);
+    if (s <= MATCH)
+      continue;
+    if (n > len || s > score) {
+      len = n;
+      score = s;
+      prefix = t;
+    }
+  }
+  return prefix ? `${prefix.replace(/\/+$/, "")}/**` : void 0;
+}
+var appLabelOf = (name) => `app-${sha(name).slice(0, 8)}`;
+function denyListHits(text3, hashes) {
+  const hits = [];
+  text3.toLowerCase().split("\n").forEach((line, i) => {
+    const w = line.match(/[a-z0-9]+/g) ?? [];
+    for (let k = 0; k < w.length; k++)
+      if (hashes.has(sha(w[k])) || k + 1 < w.length && hashes.has(sha(`${w[k]} ${w[k + 1]}`))) {
+        hits.push(i + 1);
+        break;
+      }
+  });
+  return hits;
+}
+function aggregateTraffic(input) {
+  const text3 = Buffer.from(input.bytes).toString("utf8");
+  const rows = rowsOf(text3);
+  const shape = `a CSV with a header row, or a JSON list of rows, with an app, a method and a path column (${input.source}: app ${input.columns.app.join("/")}; method ${input.columns.method.join("/")}; path ${[...input.columns.path, ...input.columns.basepath].join("/")})`;
+  if (!rows)
+    return { ok: false, message: `The file doesn't read as a traffic export: give ${shape}.` };
+  const names = [...new Set(rows.flatMap((r) => Object.keys(r)))];
+  const col = (aliases) => {
+    for (const a of aliases) {
+      const hit = names.find((n) => key(n) === key(a));
+      if (hit)
+        return hit;
+    }
+    return void 0;
+  };
+  const c = {
+    app: col(input.columns.app),
+    method: col(input.columns.method),
+    basepath: col(input.columns.basepath),
+    suffix: col(input.columns.suffix),
+    proxy: col(input.columns.proxy),
+    count: col(input.columns.count),
+    time: col(input.columns.time),
+    path: void 0
+  };
+  if (!c.basepath || !c.suffix)
+    c.path = col(input.columns.path);
+  const missing = [
+    !c.app ? "app" : "",
+    !c.method ? "method" : "",
+    !c.path && !(c.basepath && c.suffix) ? "path" : ""
+  ].filter(Boolean);
+  if (missing.length)
+    return {
+      ok: false,
+      message: `The file has no ${missing.join(", ")} column, so it can't be kept as aggregates: give ${shape}.`
+    };
+  const range = (v) => v && /^\d{4}-\d{2}-\d{2}$/.test(v) ? v : void 0;
+  if (input.from && !range(input.from) || input.to && !range(input.to))
+    return { ok: false, message: "--from and --to are days: YYYY-MM-DD." };
+  if ((!input.from || !input.to) && !c.time)
+    return {
+      ok: false,
+      message: "The export has no date column: give --from and --to (YYYY-MM-DD) for the range it covers."
+    };
+  const kept = new Set(Object.values(c).filter((x) => !!x));
+  const dropped = names.filter((n) => !kept.has(n)).sort();
+  const secrets = /* @__PURE__ */ new Set();
+  const keptValues = /* @__PURE__ */ new Set();
+  const agg = /* @__PURE__ */ new Map();
+  let outOfRange = 0;
+  let skipped2 = 0;
+  let unmatched = 0;
+  const known = /* @__PURE__ */ new Map();
+  for (const a of input.apps ?? [])
+    if (a.trim() && !known.has(key(a)))
+      known.set(key(a), a.trim());
+  const days = [];
+  for (const r of rows) {
+    for (const n of dropped) {
+      const v = (r[n] ?? "").trim();
+      const q = /^(?:[a-z][a-z0-9+.-]*:\/\/|\/)/i.test(v) ? v.split(/[?#]/)[1] ?? "" : v;
+      if (q.length >= 6)
+        secrets.add(q);
+    }
+    for (const n of [c.path, c.suffix, c.basepath]) {
+      const v = n ? r[n] ?? "" : "";
+      const q = v.split(/[?#]/)[1] ?? "";
+      if (q.length >= 4)
+        secrets.add(q);
+      for (const m of (v.split(/[?#]/, 1)[0] ?? "").match(/;[^/]*/g) ?? [])
+        if (m.length >= 5)
+          secrets.add(m.slice(1));
+    }
+    if (c.time) {
+      const d = dayOf(r[c.time] ?? "");
+      if (d) {
+        if (input.from && d < input.from || input.to && d > input.to) {
+          outOfRange++;
+          continue;
+        }
+        days.push(d);
+      } else if (!input.from || !input.to) {
+        skipped2++;
+        continue;
+      }
+    }
+    const method = (r[c.method] ?? "").trim().toUpperCase();
+    const rawPath = c.path ? r[c.path] ?? "" : `${(r[c.basepath] ?? "").replace(/\/+$/, "")}/${(r[c.suffix] ?? "").replace(/^\/+/, "")}`;
+    const countText = c.count ? (r[c.count] ?? "").trim() : "1";
+    const count = Number(countText);
+    if (!/^[A-Z]{3,10}$/.test(method) || !barePath(rawPath).startsWith("/") || !Number.isInteger(count) || count < 0) {
+      skipped2++;
+      continue;
+    }
+    const path = pathTemplateOf(rawPath, input.templates);
+    if (!path) {
+      unmatched++;
+      continue;
+    }
+    if (count === 0)
+      continue;
+    const appRaw = (r[c.app] ?? "").trim();
+    const app = !appRaw ? "(none)" : known.get(key(appRaw)) ?? appLabelOf(appRaw);
+    const proxyRaw = c.proxy ? (r[c.proxy] ?? "").trim() : "";
+    const proxy = proxyRaw && !looksSensitive(proxyRaw) ? proxyRaw : void 0;
+    const baseRaw = c.basepath ? (r[c.basepath] ?? "").trim() : "";
+    const basepath = baseRaw ? safePathOf(baseRaw) : void 0;
+    for (const v of [app, proxy, basepath, path])
+      if (v)
+        keptValues.add(v);
+    const k = [app, method, path, proxy ?? "", basepath ?? ""].join("\0");
+    const row = agg.get(k) ?? {
+      app,
+      method,
+      path,
+      ...proxy ? { proxy } : {},
+      ...basepath ? { basepath } : {},
+      count: 0
+    };
+    row.count += count;
+    agg.set(k, row);
+  }
+  if (!agg.size)
+    return {
+      ok: false,
+      message: `No row of the file is a request in the range to a route of the estate (${rows.length} read, ${outOfRange} outside it, ${skipped2} without a method, path or count, ${unmatched} matching no route template of the estate): nothing to keep.`
+    };
+  days.sort();
+  const from = input.from ?? days[0];
+  const to = input.to ?? days[days.length - 1];
+  if (!from || !to)
+    return { ok: false, message: "The rows carry no dates: give --from and --to (YYYY-MM-DD)." };
+  const parsed = TrafficFile.safeParse({
+    schemaVersion: 1,
+    source: input.source,
+    from,
+    to,
+    inputSha256: createHash3("sha256").update(input.bytes).digest("hex"),
+    rows: [...agg.values()].sort((a, b) => cmp(a.app, b.app) || cmp(a.proxy ?? "", b.proxy ?? "") || cmp(a.path, b.path) || cmp(a.method, b.method))
+  });
+  if (!parsed.success)
+    return { ok: false, message: `The aggregate isn't valid: ${parsed.error.issues[0]?.message}.` };
+  const out = trafficFileText(parsed.data);
+  const lower = out.toLowerCase();
+  const leaked = [...secrets].filter((s) => !keptValues.has(s) && lower.includes(s.toLowerCase()));
+  if (leaked.length)
+    return {
+      ok: false,
+      message: `Refused: ${leaked.length} value${leaked.length === 1 ? "" : "s"} of the export's dropped columns would be written. Nothing was written.`
+    };
+  const body = out.replace(/^inputSha256: .*$/m, "");
+  if ([IPV4, IPV6, EMAIL, JWT, OPAQUE, UUID, HEX].some((re) => re.test(body)))
+    return {
+      ok: false,
+      message: "Refused: the aggregate would hold an IP, an email or a token-looking value. Nothing was written."
+    };
+  const hits = input.denyHashes?.size ? denyListHits(out, input.denyHashes) : [];
+  if (hits.length)
+    return {
+      ok: false,
+      message: `Refused: the deny-list names a word on line${hits.length === 1 ? "" : "s"} ${hits.join(", ")} of the aggregate. Nothing was written.`
+    };
+  return {
+    ok: true,
+    file: parsed.data,
+    text: out,
+    read: rows.length,
+    outOfRange,
+    skipped: skipped2,
+    unmatched,
+    dropped
+  };
+}
+
 // packages/intake/dist/vendor-ops.js
 var import_yaml3 = __toESM(require_dist(), 1);
-import { createHash as createHash3 } from "node:crypto";
-var short2 = (s) => createHash3("sha256").update(s).digest("hex").slice(0, 6);
+import { createHash as createHash4 } from "node:crypto";
+var short2 = (s) => createHash4("sha256").update(s).digest("hex").slice(0, 6);
 function specEndpointIds(component, ops) {
   const ids = ops.map((o) => endpointId(component, o.method, o.normalizedPath));
   const count = /* @__PURE__ */ new Map();
@@ -507,7 +971,8 @@ function readVendorSpec(path, text3, system) {
       scopes: op.scopes,
       cite: `${path}:${op.methodLine ?? op.line ?? 1}`,
       request: requestFields(ctx, op, swagger2),
-      response: responseFields(ctx, op, swagger2)
+      response: responseFields(ctx, op, swagger2),
+      ...errorsOf(ctx, op, swagger2)
     };
   });
   const ids = specEndpointIds(system, ops);
@@ -522,6 +987,56 @@ function readVendorSpec(path, text3, system) {
     operations: ops.map((o, i) => ({ id: ids[i], ...o }))
   };
 }
+function errorsOf(ctx, op, swagger2) {
+  const responses = (0, import_yaml3.isMap)(op.node) ? op.node.get("responses") : void 0;
+  if (!(0, import_yaml3.isMap)(responses))
+    return {};
+  const errors = responses.items.flatMap((p) => {
+    const status = (0, import_yaml3.isScalar)(p.key) ? String(p.key.value) : "";
+    if (!/^[45]\d\d$/.test(status))
+      return [];
+    const cite = ctx.at((0, import_yaml3.isScalar)(p.key) ? p.key.range?.[0] : void 0);
+    if (!cite)
+      return [];
+    const fields = [];
+    schemaFields(ctx, bodySchema(ctx, p.value, swagger2), "body", "", 0, /* @__PURE__ */ new Set(), fields);
+    return [{ status, cite, ...fields.length ? { fields } : {} }];
+  });
+  return errors.length ? { errors } : {};
+}
+function bodySchema(ctx, response, swagger2) {
+  if (!swagger2)
+    return contentSchema(ctx, response);
+  const r = deref(ctx, response);
+  return (0, import_yaml3.isMap)(r) ? r.get("schema", true) : void 0;
+}
+function responseHeaders(ctx, response, swagger2) {
+  const r = deref(ctx, response);
+  const headers = (0, import_yaml3.isMap)(r) ? r.get("headers") : void 0;
+  if (!(0, import_yaml3.isMap)(headers))
+    return [];
+  const out = [];
+  for (const pair of headers.items) {
+    if (!(0, import_yaml3.isScalar)(pair.key))
+      continue;
+    const h = deref(ctx, pair.value);
+    if (!(0, import_yaml3.isMap)(h))
+      continue;
+    const schema = swagger2 ? h : deref(ctx, h.get("schema", true));
+    const sm = (0, import_yaml3.isMap)(schema) ? schema : void 0;
+    const type = sm ? typeOf2(sm) : void 0;
+    const values = sm ? strings(sm.get("enum")) : void 0;
+    out.push({
+      name: String(pair.key.value),
+      in: "header",
+      ...type ? { type } : {},
+      ...swagger2 ? {} : { required: h.get("required") === true },
+      ...values ? { enum: values } : {},
+      cite: ctx.at(pair.key.range?.[0]) ?? `${ctx.path}:1`
+    });
+  }
+  return out;
+}
 function deref(ctx, node, seen = /* @__PURE__ */ new Set()) {
   let n = node;
   for (let i = 0; i < 8 && (0, import_yaml3.isMap)(n); i++) {
@@ -536,8 +1051,8 @@ function deref(ctx, node, seen = /* @__PURE__ */ new Set()) {
   }
   return n;
 }
-var offsetOfKey = (map, key2) => {
-  const pair = map.items.find((p) => (0, import_yaml3.isScalar)(p.key) && String(p.key.value) === key2);
+var offsetOfKey = (map, key3) => {
+  const pair = map.items.find((p) => (0, import_yaml3.isScalar)(p.key) && String(p.key.value) === key3);
   return pair && (0, import_yaml3.isScalar)(pair.key) ? pair.key.range?.[0] : void 0;
 };
 var strings = (n) => (0, import_yaml3.isSeq)(n) ? n.items.filter(import_yaml3.isScalar).map((s) => String(s.value)) : void 0;
@@ -587,13 +1102,13 @@ function schemaFields(ctx, node, where, prefix, depth, seen, out) {
     for (const pair of props.items) {
       if (!(0, import_yaml3.isScalar)(pair.key))
         continue;
-      const key2 = String(pair.key.value);
-      const name = prefix ? `${prefix}.${key2}` : key2;
+      const key3 = String(pair.key.value);
+      const name = prefix ? `${prefix}.${key3}` : key3;
       const prop = deref(ctx, pair.value, new Set(refs));
       const p = (0, import_yaml3.isMap)(prop) ? prop : void 0;
       const type = p ? typeOf2(p) : void 0;
       const values = p ? strings(p.get("enum")) : void 0;
-      const req = required.has(key2);
+      const req = required.has(key3);
       out.push({
         name,
         in: where,
@@ -601,7 +1116,7 @@ function schemaFields(ctx, node, where, prefix, depth, seen, out) {
         ...objectLike ? { required: req } : {},
         ...values ? { enum: values } : {},
         cite: ctx.at(pair.key.range?.[0]) ?? `${ctx.path}:1`,
-        ...req && required.get(key2) !== void 0 ? { requiredCite: ctx.at(required.get(key2)) } : {}
+        ...req && required.get(key3) !== void 0 ? { requiredCite: ctx.at(required.get(key3)) } : {}
       });
       if (p && (type === "object" || type === "array"))
         schemaFields(ctx, pair.value, where, name, depth + 1, refs, out);
@@ -683,11 +1198,8 @@ function responseFields(ctx, op, swagger2) {
   if (!ok)
     return [];
   const out = [];
-  const schema = swagger2 ? (() => {
-    const r = deref(ctx, ok.value);
-    return (0, import_yaml3.isMap)(r) ? r.get("schema", true) : void 0;
-  })() : contentSchema(ctx, ok.value);
-  schemaFields(ctx, schema, "body", "", 0, /* @__PURE__ */ new Set(), out);
+  schemaFields(ctx, bodySchema(ctx, ok.value, swagger2), "body", "", 0, /* @__PURE__ */ new Set(), out);
+  out.push(...responseHeaders(ctx, ok.value, swagger2));
   return out;
 }
 var pointer = (s) => s.replace(/~/g, "~0").replace(/\//g, "~1");
@@ -722,12 +1234,442 @@ function operationSchemas(spec) {
   });
 }
 
+// packages/intake/dist/contract-specs.js
+var MAX_BYTES = 1024 * 1024;
+var SKIP = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "vendor",
+  "target",
+  "build",
+  "dist",
+  "out",
+  "bin",
+  "obj",
+  ".gradle",
+  ".idea",
+  ".venv",
+  "__pycache__"
+]);
+var cmp2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function readProtoSpecs(path, text3) {
+  const proto3 = /^\s*syntax\s*=\s*["']proto3["']/m.test(text3);
+  let pkg = "";
+  const out = [];
+  const stack = [];
+  let inComment = false;
+  text3.split(/\r?\n/).forEach((raw, i) => {
+    let line = raw;
+    if (inComment) {
+      const end = line.indexOf("*/");
+      if (end < 0)
+        return;
+      line = line.slice(end + 2);
+      inComment = false;
+    }
+    line = line.replace(/\/\*.*?\*\//g, "").replace(/\/\/.*$/, "");
+    const open = line.indexOf("/*");
+    if (open >= 0) {
+      inComment = true;
+      line = line.slice(0, open);
+    }
+    const n = i + 1;
+    const p = /^\s*package\s+([\w.]+)\s*;/.exec(line);
+    if (p)
+      pkg = p[1];
+    const message = /^\s*message\s+(\w+)\s*\{/.exec(line);
+    const oneof = /^\s*oneof\s+(\w+)\s*\{/.exec(line);
+    const other = /^\s*(enum|service|extend|extensions)\b[^{]*\{/.exec(line);
+    let rest = line;
+    if (message) {
+      const outer = stack.filter((f) => f.kind === "message").map((f) => f.name);
+      const name = [...outer, message[1]].join(".");
+      const spec = {
+        kind: "message",
+        format: "protobuf",
+        role: "schema",
+        file: path,
+        line: n,
+        name: pkg ? `${pkg}.${name}` : name,
+        fields: []
+      };
+      out.push(spec);
+      stack.push({ kind: "message", name: message[1], spec });
+      rest = line.slice(line.indexOf("{") + 1);
+    } else if (oneof || other) {
+      stack.push({ kind: oneof ? "oneof" : "other", name: "" });
+      rest = line.slice(line.indexOf("{") + 1);
+    } else {
+      const top = stack.at(-1);
+      const owner = top?.kind === "message" ? top : top?.kind === "oneof" ? stack.at(-2) : void 0;
+      const f = /^\s*(optional|required|repeated)?\s*(map\s*<[^>]+>|[\w.]+)\s+(\w+)\s*=\s*(\d+)\s*(\[[^\]]*\])?\s*;/.exec(line);
+      if (f && owner?.kind === "message" && owner.spec && !["reserved", "option"].includes(f[2])) {
+        const label = f[1];
+        owner.spec.fields.push({
+          side: "message",
+          name: f[3],
+          type: label === "repeated" ? `repeated ${f[2]}` : f[2].replace(/\s+/g, ""),
+          // proto2's `required` must be there; anything else may be left out (proto3 has no required).
+          required: label === "required" && !proto3,
+          number: Number(f[4]),
+          at: `${path}:${n}`
+        });
+      }
+    }
+    for (const _ of rest.matchAll(/\}/g))
+      stack.pop();
+  });
+  return out;
+}
+function lineOfName(lines, from, name) {
+  const re = new RegExp(`"name"\\s*:\\s*"${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"`);
+  for (let i = Math.max(0, from); i < lines.length; i++)
+    if (re.test(lines[i]))
+      return i + 1;
+  return from + 1;
+}
+function readAvroSpecs(path, text3) {
+  let data;
+  try {
+    data = JSON.parse(text3);
+  } catch {
+    return [];
+  }
+  const lines = text3.split(/\r?\n/);
+  const out = [];
+  let cursor = 0;
+  const typeName = (t) => {
+    if (typeof t === "string")
+      return t;
+    if (Array.isArray(t))
+      return t.map(typeName).join("|");
+    if (t && typeof t === "object") {
+      const o = t;
+      if (o.type === "array")
+        return `repeated ${typeName(o.items)}`;
+      if (o.type === "map")
+        return `map<string,${typeName(o.values)}>`;
+      if (typeof o.logicalType === "string")
+        return String(o.type);
+      if (typeof o.name === "string")
+        return o.name;
+      return typeName(o.type);
+    }
+    return "";
+  };
+  const record = (r, ns) => {
+    if (r.type !== "record" || typeof r.name !== "string" || !Array.isArray(r.fields))
+      return;
+    const space = typeof r.namespace === "string" ? r.namespace : ns;
+    const line = lineOfName(lines, cursor, r.name);
+    cursor = line;
+    const spec = {
+      kind: "message",
+      format: "avro",
+      role: "schema",
+      file: path,
+      line,
+      name: space ? `${space}.${r.name}` : r.name,
+      fields: []
+    };
+    out.push(spec);
+    r.fields.forEach((f, i) => {
+      if (!f || typeof f !== "object")
+        return;
+      const x = f;
+      if (typeof x.name !== "string")
+        return;
+      const at = lineOfName(lines, cursor, x.name);
+      cursor = at;
+      const nullable = Array.isArray(x.type) && x.type.includes("null");
+      const type = typeName(Array.isArray(x.type) ? x.type.filter((t) => t !== "null") : x.type);
+      spec.fields.push({
+        side: "message",
+        name: x.name,
+        ...type ? { type } : {},
+        required: !nullable && !("default" in x),
+        number: i,
+        at: `${path}:${at}`
+      });
+      const inner = Array.isArray(x.type) ? x.type : [x.type];
+      for (const t of inner)
+        if (t && typeof t === "object")
+          record(t, space);
+    });
+  };
+  for (const r of Array.isArray(data) ? data : [data])
+    if (r && typeof r === "object")
+      record(r, "");
+  return out;
+}
+var lineAt = (d, node) => {
+  const r = node?.range;
+  return r ? d.lc.linePos(r[0]).line : 1;
+};
+function deref2(d, node, depth = 0) {
+  if (!(0, import_yaml4.isMap)(node) || depth > 8)
+    return node;
+  const ref = node.get("$ref");
+  if (typeof ref !== "string" || !ref.startsWith("#/"))
+    return node;
+  let at = d.root;
+  for (const p of ref.slice(2).split("/"))
+    at = (0, import_yaml4.isMap)(at) ? at.get(p.replace(/~1/g, "/").replace(/~0/g, "~"), true) : void 0;
+  return deref2(d, at, depth + 1);
+}
+function propsOf(d, schema, prefix, depth, out) {
+  const s = deref2(d, schema);
+  if (!(0, import_yaml4.isMap)(s) || depth > 6)
+    return;
+  const props = s.get("properties", true);
+  const req = s.get("required", true);
+  const required = new Set((0, import_yaml4.isSeq)(req) ? req.items.map((x) => (0, import_yaml4.isScalar)(x) ? String(x.value) : "") : []);
+  if (!(0, import_yaml4.isMap)(props))
+    return;
+  for (const p of props.items) {
+    if (!(0, import_yaml4.isScalar)(p.key))
+      continue;
+    const name = prefix ? `${prefix}.${String(p.key.value)}` : String(p.key.value);
+    const v = deref2(d, p.value);
+    const type = (0, import_yaml4.isMap)(v) ? v.get("type") : void 0;
+    out.push({
+      side: "message",
+      name,
+      ...typeof type === "string" ? { type } : {},
+      required: required.has(String(p.key.value)),
+      at: `${d.path}:${lineAt(d, p.key)}`
+    });
+    if ((0, import_yaml4.isMap)(v)) {
+      if (type === "array")
+        propsOf(d, v.get("items", true), `${name}[]`, depth + 1, out);
+      else
+        propsOf(d, v, name, depth + 1, out);
+    }
+  }
+}
+function docOf(path, text3) {
+  const lc = new import_yaml4.LineCounter();
+  const doc = (0, import_yaml4.parseDocument)(text3, { lineCounter: lc });
+  return (0, import_yaml4.isMap)(doc.contents) ? { path, lc, root: doc.contents } : void 0;
+}
+function readJsonSchemaSpecs(path, text3) {
+  const d = docOf(path, text3);
+  if (!d)
+    return [];
+  const title = d.root.get("title");
+  const id = d.root.get("$id");
+  const fields = [];
+  propsOf(d, d.root, "", 0, fields);
+  if (!fields.length)
+    return [];
+  const name = typeof title === "string" && title ? title : typeof id === "string" && id ? (id.split("/").pop() ?? id).replace(/\.json$/, "") : (path.split("/").pop() ?? path).replace(/\.(schema\.)?json$|\.ya?ml$/i, "");
+  return [
+    { kind: "message", format: "json-schema", role: "schema", file: path, line: 1, name, fields }
+  ];
+}
+function readAsyncApiSpecs(path, text3) {
+  const d = docOf(path, text3);
+  if (!d || d.root.get("asyncapi") === void 0)
+    return [];
+  const out = [];
+  const channels = d.root.get("channels", true);
+  if (!(0, import_yaml4.isMap)(channels))
+    return out;
+  const add = (topic, message) => {
+    const m = deref2(d, message);
+    if (!(0, import_yaml4.isMap)(m))
+      return;
+    const oneOf = m.get("oneOf", true);
+    if ((0, import_yaml4.isSeq)(oneOf)) {
+      for (const x of oneOf.items)
+        add(topic, x);
+      return;
+    }
+    const payload = m.get("payload", true);
+    const fields = [];
+    propsOf(d, payload, "", 0, fields);
+    const p = deref2(d, payload);
+    const title = (0, import_yaml4.isMap)(p) ? p.get("title") : void 0;
+    const name = m.get("name") ?? m.get("title") ?? title;
+    out.push({
+      kind: "message",
+      format: "asyncapi",
+      role: "schema",
+      file: path,
+      line: lineAt(d, m),
+      topic,
+      ...typeof name === "string" && name ? { name } : {},
+      fields
+    });
+  };
+  for (const c of channels.items) {
+    if (!(0, import_yaml4.isScalar)(c.key))
+      continue;
+    const ch = deref2(d, c.value);
+    if (!(0, import_yaml4.isMap)(ch))
+      continue;
+    const address = ch.get("address");
+    const topic = typeof address === "string" && address ? address : String(c.key.value);
+    for (const op of ["publish", "subscribe"]) {
+      const o = ch.get(op, true);
+      if ((0, import_yaml4.isMap)(o))
+        add(topic, o.get("message", true));
+    }
+    const msgs = ch.get("messages", true);
+    if ((0, import_yaml4.isMap)(msgs))
+      for (const m of msgs.items)
+        add(topic, m.value);
+  }
+  return out;
+}
+function openApiContractSpecs(spec) {
+  return spec.operations.map((o) => {
+    const [file, line] = splitAt(o.cite, spec.path);
+    const field2 = (side) => (f) => ({
+      side,
+      name: f.name,
+      ...f.type ? { type: f.type } : {},
+      ...f.required !== void 0 ? { required: f.required } : {},
+      ...f.in ? { in: f.in } : {},
+      at: f.cite
+    });
+    return {
+      kind: "operation",
+      format: "openapi",
+      role: "consumer",
+      file,
+      line,
+      method: o.method,
+      path: o.fullPath,
+      id: o.id,
+      fields: [...o.request.map(field2("request")), ...o.response.map(field2("response"))],
+      ...o.errors?.length ? { errors: o.errors.map((e) => ({ status: e.status, at: e.cite })) } : {}
+    };
+  });
+}
+function splitAt(cite, path) {
+  const m = /^(.*):(\d+)$/.exec(cite);
+  return m ? [m[1], Number(m[2])] : [path, 1];
+}
+function specFormatOf(name, text3) {
+  const lower = name.toLowerCase();
+  if (lower.endsWith(".proto"))
+    return "protobuf";
+  if (lower.endsWith(".avsc"))
+    return "avro";
+  if (!/\.(ya?ml|json)$/.test(lower))
+    return void 0;
+  const head = text3.slice(0, 4e3);
+  if (/^\s*["']?(openapi|swagger)["']?\s*:/m.test(head))
+    return "openapi";
+  if (/^\s*["']?asyncapi["']?\s*:/m.test(head))
+    return "asyncapi";
+  if (/"type"\s*:\s*"record"/.test(head) && /"fields"\s*:/.test(head))
+    return "avro";
+  if (/["']?\$schema["']?\s*:/.test(head) && /json-schema\.org/.test(head))
+    return "json-schema";
+  return void 0;
+}
+function readContractSpecs(path, text3) {
+  switch (specFormatOf(path, text3)) {
+    case "protobuf":
+      return readProtoSpecs(path, text3);
+    case "avro":
+      return readAvroSpecs(path, text3);
+    case "json-schema":
+      return readJsonSchemaSpecs(path, text3);
+    case "asyncapi":
+      return readAsyncApiSpecs(path, text3);
+    case "openapi": {
+      const spec = readVendorSpec(path, text3, "spec");
+      return spec ? openApiContractSpecs(spec) : [];
+    }
+    default:
+      return [];
+  }
+}
+var sameShape = (a, b) => normalizePath(a).replace(/\{[^}]*\}/g, "{}") === normalizePath(b).replace(/\{[^}]*\}/g, "{}");
+var SPEC_FILE = /\.(proto|avsc|ya?ml|json)$/i;
+function cmpPath(a, b) {
+  const x = a.split("/");
+  const y = b.split("/");
+  for (let i = 0; i < Math.min(x.length, y.length); i++) {
+    const c = cmp2(x[i], y[i]);
+    if (c)
+      return c;
+  }
+  return x.length - y.length;
+}
+var skipped = (p) => p.split("/").slice(0, -1).some((d) => SKIP.has(d) || d.startsWith("."));
+function folderTree(dir) {
+  return {
+    async files() {
+      const out = [];
+      const walk2 = async (rel) => {
+        const entries = await readdir(join(dir, ...rel.split("/").filter(Boolean)), {
+          withFileTypes: true
+        }).catch(() => []);
+        for (const e of [...entries].sort((a, b) => cmp2(a.name, b.name))) {
+          const p = rel ? `${rel}/${e.name}` : e.name;
+          if (e.isDirectory()) {
+            if (!SKIP.has(e.name) && !e.name.startsWith("."))
+              await walk2(p);
+          } else if (e.isFile() && SPEC_FILE.test(e.name)) {
+            const size = (await stat(join(dir, ...p.split("/"))).catch(() => void 0))?.size;
+            out.push({ path: p, size: size ?? 0 });
+          }
+        }
+      };
+      await walk2("");
+      return out;
+    },
+    read: (p) => readFile(join(dir, ...p.split("/")), "utf8").catch(() => void 0)
+  };
+}
+async function readRepoSpecs(dir, o) {
+  const tree = o.tree ?? folderTree(dir);
+  const files = (await tree.files()).filter((f) => SPEC_FILE.test(f.path) && !skipped(f.path) && f.size > 0 && f.size <= MAX_BYTES).sort((a, b) => cmpPath(a.path, b.path)).map((f) => f.path);
+  const own = o.facts.filter((f) => f.kind === "entry" && f.entryType === "rest");
+  const specs = [];
+  for (const p of files) {
+    const text3 = await tree.read(p);
+    if (text3 === void 0 || !specFormatOf(p, text3))
+      continue;
+    const got = readContractSpecs(p, text3);
+    if (!got.length)
+      continue;
+    if (o.denyHashes?.size && denyListHits(text3, o.denyHashes).length) {
+      o.onRefused?.(`${p}: the deny-list names a word in it, so its specs are left out.`);
+      continue;
+    }
+    for (const s of got) {
+      if (s.kind !== "operation") {
+        specs.push(s);
+        continue;
+      }
+      const vendorPath = readVendorSpec(p, text3, "spec")?.operations.find((x) => x.id === s.id);
+      const paths = [s.path ?? "", vendorPath?.path ?? ""].filter(Boolean);
+      const entry = own.filter((e) => (!e.method || !s.method || e.method.toUpperCase() === s.method) && paths.some((x) => sameShape(x, e.path))).sort((a, b) => cmp2(a.id, b.id))[0];
+      const { id: _id, ...rest } = s;
+      specs.push(entry ? { ...rest, role: "own", entry: entry.id } : rest);
+    }
+  }
+  return {
+    schemaVersion: 1,
+    repo: o.repo,
+    ...o.commit ? { commit: o.commit } : {},
+    specs
+  };
+}
+
 // packages/intake/dist/scan-inputs.js
 var SPECS = ["openapi", "swagger", "asyncapi"];
 var EVIDENCE_SOURCE = {
   openapi: "spec",
   swagger: "spec",
   asyncapi: "spec",
+  protobuf: "spec",
+  avro: "spec",
   diagram: "diagram",
   image: "document",
   document: "document",
@@ -745,14 +1687,14 @@ async function walk(dir, skip) {
       return;
     let entries;
     try {
-      entries = await readdir(d, { withFileTypes: true });
+      entries = await readdir2(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
       if (e.name.startsWith("."))
         continue;
-      const full = join(d, e.name);
+      const full = join2(d, e.name);
       if (e.isDirectory())
         await go(full);
       else if (e.isFile())
@@ -763,7 +1705,7 @@ async function walk(dir, skip) {
   return out;
 }
 var DATE = /(?:^|[-_ .])((\d{4})-?(\d{2})-?(\d{2}))(?=$|[-_ .])/;
-var VERSION = /(?:^|[-_ .])v(\d+(?:[._]\d+)*)(?=$|[-_ .])/i;
+var VERSION2 = /(?:^|[-_ .])v(\d+(?:[._]\d+)*)(?=$|[-_ .])/i;
 function nameParts(stem) {
   let rest = stem;
   let date;
@@ -776,7 +1718,7 @@ function nameParts(stem) {
     }
   }
   let version;
-  const v = VERSION.exec(rest);
+  const v = VERSION2.exec(rest);
   if (v) {
     version = v[1].replace(/_/g, ".");
     rest = rest.replace(v[0], "");
@@ -802,23 +1744,23 @@ function systemsInName(stem, systems) {
   return systems.filter((sys) => [sys.id, sys.name, ...sys.aliases].some((n) => slug(n) && s.includes(`-${slug(n)}-`))).map((sys) => sys.id).sort();
 }
 async function scanInputs(o) {
-  const orgPackDir = typeof o.orgPack === "string" ? o.orgPack : join(orgPackDirOf(o.root));
+  const orgPackDir = typeof o.orgPack === "string" ? o.orgPack : join2(orgPackDirOf(o.root));
   const op = typeof o.orgPack === "object" ? o.orgPack : await loadOrgPack(orgPackDir);
   const systems = op.profiles.flatMap((p) => p.profile?.systems ?? []);
   const legend = op.profiles.find((p) => p.profile?.legend)?.profile?.legend;
   const records = o.records ?? [];
   const ingestors = o.ingestors ?? [drawioIngestor];
   const scannedAt = o.scannedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const inputsDir = o.inputsDir ?? join(o.root, "inputs");
+  const inputsDir = o.inputsDir ?? join2(o.root, "inputs");
   const problems = [];
   const triage = [];
   const authors = /* @__PURE__ */ new Map();
   const wikiDirs = op.sources.wikis.flatMap((w) => /^[a-z][a-z0-9+.-]*:\/\//i.test(w.location) ? [] : [resolve(orgPackDir, w.location), resolve(o.root, w.location)]);
-  const st = await stat(inputsDir).catch(() => void 0);
+  const st = await stat2(inputsDir).catch(() => void 0);
   const paths = st?.isDirectory() ? await walk(inputsDir, wikiDirs) : [];
   const files = [];
   for (const abs of paths) {
-    const bytes = new Uint8Array(await readFile(abs));
+    const bytes = new Uint8Array(await readFile2(abs));
     const path = `inputs/${posix(relative(inputsDir, abs))}`;
     const name = path.split("/").pop();
     const c = classify(name, bytes);
@@ -826,14 +1768,19 @@ async function scanInputs(o) {
       abs,
       path,
       bytes,
-      hash: createHash4("sha256").update(bytes).digest("hex"),
+      hash: createHash5("sha256").update(bytes).digest("hex"),
       stem: name.includes(".") ? name.slice(0, name.lastIndexOf(".")) : name,
       inbox: path.startsWith("inputs/inbox/"),
       ...c.data !== void 0 ? { data: c.data } : {},
+      ...c.text !== void 0 ? { text: c.text } : {},
       doc: {
         path,
         classification: c.classification,
-        status: "no-reader",
+        status: c.unreadable ? "unreadable" : "no-reader",
+        ...c.unreadable ? {
+          reason: `${c.unreadable.reason}${c.unreadable.line !== void 0 ? ` at ${c.unreadable.line}:${c.unreadable.column}` : ""}`
+        } : {},
+        ...c.notes?.length ? { notes: c.notes } : {},
         hash: "",
         ...c.title ? { title: c.title } : {},
         ...c.version ? { version: c.version } : {},
@@ -896,7 +1843,7 @@ async function scanInputs(o) {
     const heads = members.filter((m) => !m.doc.supersededBy);
     if (heads.length < 2)
       continue;
-    const distinct = (vals, cmp3) => vals.every((v) => v !== void 0) && vals.every((v, i) => vals.every((w, j) => i === j || cmp3(v, w) !== 0));
+    const distinct = (vals, cmp5) => vals.every((v) => v !== void 0) && vals.every((v, i) => vals.every((w, j) => i === j || cmp5(v, w) !== 0));
     const byVersion = distinct(heads.map((h) => h.doc.version), compareVersions);
     const byDate = !byVersion && distinct(heads.map((h) => h.doc.date), (a, b) => a < b ? -1 : a > b ? 1 : 0);
     if (byVersion || byDate) {
@@ -939,7 +1886,7 @@ async function scanInputs(o) {
   for (const f of kept) {
     const cls = f.doc.classification;
     const current = !f.doc.supersededBy;
-    const text3 = () => new TextDecoder().decode(f.bytes);
+    const text3 = () => f.text ?? new TextDecoder().decode(f.bytes);
     const linked = /* @__PURE__ */ new Set();
     const unknown = /* @__PURE__ */ new Set();
     if (SPECS.includes(cls)) {
@@ -1053,6 +2000,43 @@ async function scanInputs(o) {
       } catch {
       }
     }
+    if (cls === "protobuf" || cls === "avro") {
+      const specs = cls === "protobuf" ? readProtoSpecs(f.path, text3()) : readAvroSpecs(f.path, text3());
+      const named = new Set(systemsInName(f.stem, systems));
+      for (const s of specs) {
+        const res = s.name ? resolveName(s.name.split(".").slice(0, -1).join(" ")) : void 0;
+        if (res?.id && !named.size)
+          named.add(systemOf(res.id));
+      }
+      for (const s of named)
+        linked.add(s);
+      if (current && specs.length) {
+        for (const s of specs) {
+          const p = parseRecord({
+            schemaVersion: 1,
+            kind: "Schema",
+            id: boundedId("schema.", slug(s.name ?? f.stem)),
+            status: "current",
+            confidence: "verified",
+            format: cls,
+            ref: `${f.path}#${s.name ?? ""}`,
+            fields: s.fields.map((x) => ({
+              name: x.name,
+              ...x.type ? { type: x.type } : {},
+              ...x.required !== void 0 ? { required: x.required } : {}
+            })),
+            evidence: [{ source: "spec", path: f.path, line: s.line, side: "definition" }]
+          });
+          if (!p.ok)
+            continue;
+          const schema = p.record;
+          out.push(schema);
+          f.doc.records.push(schema.id);
+        }
+        f.doc.status = "read";
+        f.doc.reader = cls === "protobuf" ? READERS.protobuf : READERS.avro;
+      }
+    }
     if (current && cls === "payload" && f.data !== void 0) {
       const schema = readPayload(f.path, boundedId("payload.", f.doc.id.slice(4)), f.data);
       out.push(schema);
@@ -1249,9 +2233,9 @@ function safeSniff(ing, path, head) {
     return 0;
   }
 }
-function lineOf(text3, key2) {
+function lineOf(text3, key3) {
   const lines = text3.split(/\r?\n/);
-  const re = new RegExp(`(^|[\\s{,])"?${key2}"?\\s*:`);
+  const re = new RegExp(`(^|[\\s{,])"?${key3}"?\\s*:`);
   const i = lines.findIndex((l) => re.test(l));
   return i >= 0 ? { line: i + 1 } : {};
 }
@@ -1362,11 +2346,11 @@ function imageItems(records) {
     };
   });
 }
-var key = (action, target, value) => `${action}|${target}|${JSON.stringify(value ?? null)}`;
+var key2 = (action, target, value) => `${action}|${target}|${JSON.stringify(value ?? null)}`;
 function buildTriage(input) {
   const decisions = (input.decisions ?? []).filter((d) => d.kind === "CuratedDecision" && d.status === "current");
   const decidedIds = new Set(decisions.map((d) => d.id));
-  const decidedKeys = new Set(decisions.map((d) => key(d.action, d.target, d.value)));
+  const decidedKeys = new Set(decisions.map((d) => key2(d.action, d.target, d.value)));
   const docs = new Map((input.inputs?.documents ?? []).map((d) => [d.path, d.id]));
   const docIdOf = (path) => docs.get(path) ?? boundedId("doc.", slug(path.split("/").pop().replace(/\.[^.]+$/, "")));
   const records = input.records;
@@ -1379,7 +2363,7 @@ function buildTriage(input) {
     ...imageItems([...records, ...inputRecords]),
     ...readingItems(input)
   ];
-  const open = all.filter((i) => !i.options.some((o) => decidedIds.has(o.decision.id) || decidedKeys.has(key(o.decision.action, o.decision.target, o.decision.value))));
+  const open = all.filter((i) => !i.options.some((o) => decidedIds.has(o.decision.id) || decidedKeys.has(key2(o.decision.action, o.decision.target, o.decision.value))));
   const items = sortItems(open);
   return {
     items,
@@ -1420,9 +2404,9 @@ function buildTriage(input) {
 }
 
 // packages/intake/dist/work-items.js
-var import_yaml4 = __toESM(require_dist(), 1);
-import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
-import { join as join2, relative as relative2, sep as sep2 } from "node:path";
+var import_yaml5 = __toESM(require_dist(), 1);
+import { readdir as readdir3, readFile as readFile3 } from "node:fs/promises";
+import { join as join3, relative as relative2, sep as sep2 } from "node:path";
 var WORK_ITEM_READER = "work-items@0.1.0";
 var isObj3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var text = (v) => {
@@ -1528,7 +2512,7 @@ function itemOf(o, path, lineOf2) {
     source: { path, ...line ? { line } : {} }
   };
 }
-function parseCsv(s) {
+function parseCsv2(s) {
   const rows = [];
   let row = [];
   let cell = "";
@@ -1572,7 +2556,7 @@ function parseCsv(s) {
   return rows;
 }
 function fromCsv(textIn, path) {
-  const rows = parseCsv(textIn.replace(/^\uFEFF/, ""));
+  const rows = parseCsv2(textIn.replace(/^\uFEFF/, ""));
   const header = rows[0]?.cells.map((h) => h.trim());
   if (!header)
     return void 0;
@@ -1601,7 +2585,7 @@ function readWorkItemExport(path, bytes) {
     return void 0;
   let data;
   try {
-    data = (0, import_yaml4.parse)(content);
+    data = (0, import_yaml5.parse)(content);
   } catch {
     return void 0;
   }
@@ -1624,22 +2608,22 @@ function readWorkItemExport(path, bytes) {
   return items;
 }
 async function readWorkItemExports(o) {
-  const dir = o.inputsDir ?? join2(o.root, "inputs");
+  const dir = o.inputsDir ?? join3(o.root, "inputs");
   const files = [];
   async function walk2(d) {
     let entries;
     try {
-      entries = await readdir2(d, { withFileTypes: true });
+      entries = await readdir3(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
       if (e.name.startsWith("."))
         continue;
-      const full = join2(d, e.name);
+      const full = join3(d, e.name);
       if (e.isDirectory())
         await walk2(full);
-      else if (/\.(json|ya?ml|csv)$/i.test(e.name))
+      else if (e.isFile() && /\.(json|ya?ml|csv)$/i.test(e.name))
         files.push(full);
     }
   }
@@ -1653,7 +2637,7 @@ async function readWorkItemExports(o) {
     const path = `inputs/${relative2(dir, full).split(sep2).join("/")}`;
     let bytes;
     try {
-      bytes = new Uint8Array(await readFile2(full));
+      bytes = new Uint8Array(await readFile3(full));
     } catch (e) {
       out.problems.push({ path, message: `can't read it: ${e.message}` });
       continue;
@@ -1668,9 +2652,9 @@ async function readWorkItemExports(o) {
 }
 
 // packages/intake/dist/service-requests.js
-var import_yaml5 = __toESM(require_dist(), 1);
-import { readdir as readdir3, readFile as readFile3 } from "node:fs/promises";
-import { join as join3, relative as relative3, sep as sep3 } from "node:path";
+var import_yaml6 = __toESM(require_dist(), 1);
+import { readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
+import { join as join4, relative as relative3, sep as sep3 } from "node:path";
 var SERVICE_REQUEST_READER = "service-requests@0.1.0";
 var isObj4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var text2 = (v) => {
@@ -1821,7 +2805,7 @@ function readServiceRequestExport(path, bytes) {
     return void 0;
   let data;
   try {
-    data = (0, import_yaml5.parse)(content);
+    data = (0, import_yaml6.parse)(content);
   } catch {
     return void 0;
   }
@@ -1851,22 +2835,22 @@ function readServiceRequestExport(path, bytes) {
   return out;
 }
 async function readServiceRequestExports(o) {
-  const dir = o.inputsDir ?? join3(o.root, "inputs");
+  const dir = o.inputsDir ?? join4(o.root, "inputs");
   const found = [];
   async function walk2(d) {
     let entries;
     try {
-      entries = await readdir3(d, { withFileTypes: true });
+      entries = await readdir4(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
       if (e.name.startsWith("."))
         continue;
-      const full = join3(d, e.name);
+      const full = join4(d, e.name);
       if (e.isDirectory())
         await walk2(full);
-      else if (/\.(json|ya?ml|csv)$/i.test(e.name))
+      else if (e.isFile() && /\.(json|ya?ml|csv)$/i.test(e.name))
         found.push(full);
     }
   }
@@ -1880,7 +2864,7 @@ async function readServiceRequestExports(o) {
     const path = `inputs/${relative3(dir, full).split(sep3).join("/")}`;
     let bytes;
     try {
-      bytes = new Uint8Array(await readFile3(full));
+      bytes = new Uint8Array(await readFile4(full));
     } catch (e) {
       out.problems.push({ path, message: `can't read it: ${e.message}` });
       continue;
@@ -1895,15 +2879,15 @@ async function readServiceRequestExports(o) {
 }
 
 // packages/intake/dist/change-inputs.js
-var import_yaml6 = __toESM(require_dist(), 1);
-import { createHash as createHash5 } from "node:crypto";
-import { mkdir, readdir as readdir4, readFile as readFile4 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+var import_yaml7 = __toESM(require_dist(), 1);
+import { createHash as createHash6 } from "node:crypto";
+import { mkdir, readdir as readdir5, readFile as readFile5 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 var INPUTS_DIR = "inputs";
 var INPUTS_INDEX = "inputs/index.yaml";
 var INPUTS_READ_DIR = "inputs/read";
 var CHANGE_INPUTS_SCHEMA_VERSION = 1;
-var sha256 = (b) => createHash5("sha256").update(b).digest("hex");
+var sha256 = (b) => createHash6("sha256").update(b).digest("hex");
 var KEYS = [
   "path",
   "name",
@@ -1923,10 +2907,10 @@ var KEYS = [
   "defences"
 ];
 async function readChangeInputs(dir) {
-  const text3 = await readFile4(join4(dir, ...INPUTS_INDEX.split("/")), "utf8").catch(() => "");
+  const text3 = await readFile5(join5(dir, ...INPUTS_INDEX.split("/")), "utf8").catch(() => "");
   let data;
   try {
-    data = text3 ? (0, import_yaml6.parse)(text3) : void 0;
+    data = text3 ? (0, import_yaml7.parse)(text3) : void 0;
   } catch {
     data = void 0;
   }
@@ -1947,7 +2931,7 @@ async function writeIndex(dir, index) {
         o[k] = f[k];
     return o;
   });
-  await writeFileAtomic(join4(dir, ...INPUTS_INDEX.split("/")), `# Files attached to this change (ADR 0113): atticus change attach writes this file.
+  await writeFileAtomic(join5(dir, ...INPUTS_INDEX.split("/")), `# Files attached to this change (ADR 0113): atticus change attach writes this file.
 ${toCanonicalYaml({ schemaVersion: index.schemaVersion, files }, ["schemaVersion", "files"])}`);
 }
 var isText = (b) => {
@@ -2038,7 +3022,7 @@ function readText(input, bytes, older) {
 async function attachToChange(dir, files, o) {
   const index = await readChangeInputs(dir);
   const out = { added: [], refused: [], notes: [] };
-  const taken = new Set(await readdir4(join4(dir, INPUTS_DIR)).catch(() => []));
+  const taken = new Set((await readdir5(join5(dir, INPUTS_DIR)).catch(() => [])).map((n) => n.toLowerCase()));
   taken.add("index.yaml").add("read");
   const replaced = o.replaces ? index.files.find((x) => x.path === o.replaces.trim().replace(/\\/g, "/")) : void 0;
   let changed = false;
@@ -2076,9 +3060,9 @@ async function attachToChange(dir, files, o) {
     const dot = safe.lastIndexOf(".");
     const [stem, ext] = dot > 0 ? [safe.slice(0, dot), safe.slice(dot)] : [safe, ""];
     let target = safe;
-    for (let n = 2; taken.has(target); n++)
+    for (let n = 2; taken.has(target.toLowerCase()); n++)
       target = `${stem}-${n}${ext}`;
-    taken.add(target);
+    taken.add(target.toLowerCase());
     const found = classify(target, f.bytes).classification;
     const { format, citeBy } = formatOf2(target, f.bytes, found);
     const kind = found === "unknown" && citeBy ? "document" : found;
@@ -2125,11 +3109,11 @@ async function attachToChange(dir, files, o) {
     const where = o.elsewhere?.(hash);
     if (where)
       out.notes.push(`${name} is also in the metarepo's inputs as ${where}.`);
-    await mkdir(join4(dir, INPUTS_DIR), { recursive: true });
-    await writeFileAtomic(join4(dir, INPUTS_DIR, target), f.bytes);
+    await mkdir(join5(dir, INPUTS_DIR), { recursive: true });
+    await writeFileAtomic(join5(dir, INPUTS_DIR, target), f.bytes);
     const text3 = readText(input, f.bytes, older);
     if (text3 !== void 0)
-      await writeFileAtomic(join4(dir, ...input.readAs.split("/")), text3);
+      await writeFileAtomic(join5(dir, ...input.readAs.split("/")), text3);
     index.files.push(input);
     out.added.push(input);
   }
@@ -2155,7 +3139,7 @@ async function changeInputSources(dir, rel) {
   for (const f of (await readChangeInputs(dir)).files) {
     if (f.supersededBy || f.defences?.risk === "high")
       continue;
-    const read = f.readAs ? await readFile4(join4(dir, ...f.readAs.split("/")), "utf8").catch(() => void 0) : void 0;
+    const read = f.readAs ? await readFile5(join5(dir, ...f.readAs.split("/")), "utf8").catch(() => void 0) : void 0;
     const text3 = read ?? `${f.path} (${f.name}) is ${f.kind === "image" ? "a picture; Atticus doesn't read pictures" : `a ${f.format} file no reader takes`}. Open it to see it; say what you rely on from it, citing ${f.path}.`;
     out.push({
       id: f.path,
@@ -2179,9 +3163,12 @@ var KIND_ORDER2 = [
   "field-added",
   "field-required",
   "field-type",
-  "field-enum"
+  "field-enum",
+  "error-added",
+  "error-schema",
+  "error-removed"
 ];
-var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmp3 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var opKey = (o) => `${o.method} ${normalizePath(o.fullPath)}`;
 var opName = (o) => `${o.method} ${o.path}`;
 var list = (xs) => xs.length <= 1 ? xs[0] ?? "" : `${xs.slice(0, -1).join(", ")} and ${xs.at(-1)}`;
@@ -2246,16 +3233,21 @@ function diffVendorSpecs(older, newer) {
       });
   for (const [o, n] of pairs)
     out.push(...operationChanges(o, n));
-  return out.sort((a, b) => cmp(a.severity === "breaking" ? "0" : "1", b.severity === "breaking" ? "0" : "1") || cmp(a.operation.path, b.operation.path) || cmp(a.operation.method, b.operation.method) || KIND_ORDER2.indexOf(a.kind) - KIND_ORDER2.indexOf(b.kind) || cmp(a.side ?? "", b.side ?? "") || cmp(a.field ?? "", b.field ?? ""));
+  return out.sort((a, b) => cmp3(a.severity === "breaking" ? "0" : "1", b.severity === "breaking" ? "0" : "1") || cmp3(a.operation.path, b.operation.path) || cmp3(a.operation.method, b.operation.method) || KIND_ORDER2.indexOf(a.kind) - KIND_ORDER2.indexOf(b.kind) || cmp3(a.side ?? "", b.side ?? "") || cmp3(a.field ?? "", b.field ?? ""));
 }
 var opOf = (o) => ({
   method: o.method,
   path: o.path,
   ...o.operationId ? { operationId: o.operationId } : {}
 });
-function changeId(kind, o, side, field2) {
+function changeId(kind, o, side, field2, status) {
   const op = slug(`${o.method} ${o.path}`);
-  return [kind, op, ...side && field2 ? [side, slug(field2)] : []].join(".");
+  return [
+    kind,
+    op,
+    ...status ? [status] : [],
+    ...side && field2 ? [side, slug(field2)] : []
+  ].join(".");
 }
 function operationChanges(o, n) {
   const out = [];
@@ -2291,15 +3283,61 @@ function operationChanges(o, n) {
   }
   for (const side of ["request", "response"])
     out.push(...fieldChanges(o[side], n[side], side, at, base));
+  out.push(...errorChanges(o, n, at));
+  return out;
+}
+function errorChanges(o, n, at) {
+  const out = [];
+  const olds = new Map((o.errors ?? []).map((e) => [e.status, e]));
+  const news = new Map((n.errors ?? []).map((e) => [e.status, e]));
+  const head = (kind, status) => ({
+    id: changeId(kind, n, void 0, void 0, status),
+    kind,
+    operation: opOf(n),
+    endpoints: { older: o.id, newer: n.id },
+    status
+  });
+  for (const [status, e] of news)
+    if (!olds.has(status))
+      out.push({
+        ...head("error-added", status),
+        severity: "breaking",
+        after: { value: status, cite: e.cite },
+        says: `${at}: it may now answer ${status}; a caller that doesn't handle ${status} must.`
+      });
+  for (const [status, e] of olds)
+    if (!news.has(status))
+      out.push({
+        ...head("error-removed", status),
+        severity: "additive",
+        before: { value: status, cite: e.cite },
+        says: `${at}: it no longer answers ${status}; no caller has to change.`
+      });
+  for (const [status, a] of olds) {
+    const b = news.get(status);
+    if (!b)
+      continue;
+    const base = (_kind, side, field2) => ({
+      id: changeId("error-schema", n, side, field2, status),
+      kind: "error-schema",
+      operation: opOf(n),
+      endpoints: { older: o.id, newer: n.id },
+      ...side ? { side } : {},
+      ...field2 ? { field: field2 } : {},
+      status
+    });
+    out.push(...fieldChanges(a.fields ?? [], b.fields ?? [], "response", `${at} (its ${status} response)`, base));
+  }
   return out;
 }
 function fieldChanges(olds, news, side, at, base) {
   const out = [];
-  const key2 = (f) => `${f.in}|${f.name}`;
-  const byOld = new Map(olds.map((f) => [key2(f), f]));
-  const byNew = new Map(news.map((f) => [key2(f), f]));
-  let removed = olds.filter((f) => !byNew.has(key2(f)));
-  let added = news.filter((f) => !byOld.has(key2(f)));
+  const what = (f) => `${side} ${f.in === "header" ? "header" : "field"}`;
+  const key3 = (f) => `${f.in}|${f.name}`;
+  const byOld = new Map(olds.map((f) => [key3(f), f]));
+  const byNew = new Map(news.map((f) => [key3(f), f]));
+  let removed = olds.filter((f) => !byNew.has(key3(f)));
+  let added = news.filter((f) => !byOld.has(key3(f)));
   const req = side === "request";
   const parent = (f) => `${f.in}|${f.name.includes(".") ? f.name.slice(0, f.name.lastIndexOf(".")) : ""}`;
   const renamed = [];
@@ -2317,7 +3355,7 @@ function fieldChanges(olds, news, side, at, base) {
       severity: "breaking",
       before: { value: r.name, cite: r.cite },
       after: { value: a.name, cite: a.cite },
-      says: `${at}: the ${side} field ${r.name} is now ${a.name}; ${req ? `a caller that still sends ${r.name} no longer sets it` : `a caller that reads ${r.name} gets nothing`}.`
+      says: `${at}: the ${what(r)} ${r.name} is now ${a.name}; ${req ? `a caller that still sends ${r.name} no longer sets it` : `a caller that reads ${r.name} gets nothing`}.`
     });
   }
   removed = removed.filter((f) => !renamed.some(([r]) => r === f));
@@ -2329,7 +3367,7 @@ function fieldChanges(olds, news, side, at, base) {
       ...base("field-removed", side, f.name),
       severity: "breaking",
       before: { value: f.name, cite: f.cite },
-      says: req ? `${at}: the request field ${f.name} is gone; a caller that sends it may be refused, and what it meant is lost.` : `${at}: the response field ${f.name} is gone; a caller that reads it gets nothing.`
+      says: req ? `${at}: the ${what(f)} ${f.name} is gone; a caller that sends it may be refused, and what it meant is lost.` : `${at}: the ${what(f)} ${f.name} is gone; a caller that reads it gets nothing.`
     });
   for (const f of topAdded) {
     const breaks = req && f.required === true;
@@ -2337,7 +3375,7 @@ function fieldChanges(olds, news, side, at, base) {
       ...base("field-added", side, f.name),
       severity: breaks ? "breaking" : "additive",
       after: { value: f.name, cite: f.requiredCite ?? f.cite },
-      says: !req ? `${at}: the response has a new field ${f.name}; no caller has to change.` : breaks ? `${at}: the request needs a new field ${f.name}; a caller that doesn't send it is refused.` : `${at}: the request takes a new optional field ${f.name}; no caller has to change.`
+      says: !req ? `${at}: the response has a new ${f.in === "header" ? "header" : "field"} ${f.name}; no caller has to change.` : breaks ? `${at}: the request needs a new ${f.in === "header" ? "header" : "field"} ${f.name}; a caller that doesn't send it is refused.` : `${at}: the request takes a new optional ${f.in === "header" ? "header" : "field"} ${f.name}; no caller has to change.`
     });
   }
   for (const [k, a] of byOld) {
@@ -2352,7 +3390,7 @@ function fieldChanges(olds, news, side, at, base) {
         severity: breaks ? "breaking" : "additive",
         before: { value: a.required ? "required" : "optional", cite: a.requiredCite ?? a.cite },
         after: { value: b.required ? "required" : "optional", cite: b.requiredCite ?? b.cite },
-        says: req ? nowRequired ? `${at}: the request field ${a.name} is now required; a caller that leaves it out is refused.` : `${at}: the request field ${a.name} is now optional; no caller has to change.` : nowRequired ? `${at}: the response field ${a.name} is now always there; no caller has to change.` : `${at}: the response field ${a.name} may now be left out; a caller that counts on it must allow for that.`
+        says: req ? nowRequired ? `${at}: the ${what(a)} ${a.name} is now required; a caller that leaves it out is refused.` : `${at}: the ${what(a)} ${a.name} is now optional; no caller has to change.` : nowRequired ? `${at}: the ${what(a)} ${a.name} is now always there; no caller has to change.` : `${at}: the ${what(a)} ${a.name} may now be left out; a caller that counts on it must allow for that.`
       });
     }
     if (a.type && b.type && a.type !== b.type)
@@ -2361,7 +3399,7 @@ function fieldChanges(olds, news, side, at, base) {
         severity: "breaking",
         before: { value: a.type, cite: a.cite },
         after: { value: b.type, cite: b.cite },
-        says: `${at}: the ${side} field ${a.name} was ${a.type} and is now ${b.type}; a caller that ${req ? "sends" : "reads"} it must change.`
+        says: `${at}: the ${what(a)} ${a.name} was ${a.type} and is now ${b.type}; a caller that ${req ? "sends" : "reads"} it must change.`
       });
     if (a.enum || b.enum) {
       const was = a.enum ?? [];
@@ -2371,7 +3409,7 @@ function fieldChanges(olds, news, side, at, base) {
       if (!gained.length && !lost.length)
         continue;
       const breaks = req ? lost.length > 0 : gained.length > 0;
-      const words = req ? lost.length ? `${at}: the request field ${a.name} no longer takes ${list(lost)}${gained.length ? ` and now takes ${list(gained)}` : ""}; a caller that sends a value it no longer takes is refused.` : `${at}: the request field ${a.name} now also takes ${list(gained)}; no caller has to change.` : gained.length ? `${at}: the response field ${a.name} may now be ${orList(gained)}; a caller that reads it must handle the new value${gained.length > 1 ? "s" : ""}.` : `${at}: the response field ${a.name} no longer returns ${list(lost)}; no caller has to change.`;
+      const words = req ? lost.length ? `${at}: the ${what(a)} ${a.name} no longer takes ${list(lost)}${gained.length ? ` and now takes ${list(gained)}` : ""}; a caller that sends a value it no longer takes is refused.` : `${at}: the ${what(a)} ${a.name} now also takes ${list(gained)}; no caller has to change.` : gained.length ? `${at}: the ${what(a)} ${a.name} may now be ${orList(gained)}; a caller that reads it must handle the new value${gained.length > 1 ? "s" : ""}.` : `${at}: the ${what(a)} ${a.name} no longer returns ${list(lost)}; no caller has to change.`;
       out.push({
         ...base("field-enum", side, a.name),
         severity: breaks ? "breaking" : "additive",
@@ -2386,12 +3424,13 @@ function fieldChanges(olds, news, side, at, base) {
 
 // packages/intake/dist/vendor-impact.js
 var MAX_UPSTREAM = 4;
-var cmp2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmp4 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var sorted = (xs) => [...new Set(xs)].sort();
 var joinVendorOf = (input, spec) => ({
   system: input.vendor.system,
   names: input.vendor.names,
   hosts: [.../* @__PURE__ */ new Set([...spec.hosts, ...input.vendor.hosts ?? []])],
+  ...input.vendor.boundary ? { boundary: input.vendor.boundary } : {},
   operations: spec.operations.map((o) => ({
     id: o.id,
     method: o.method,
@@ -2407,20 +3446,24 @@ var versionOf = (v) => ({
 });
 function vendorImpact(input) {
   const diff = diffVendorSpecs(input.older.spec, input.newer.spec);
-  const join5 = joinFacts({
+  const bundle = input.bundleFolders ? { bundleFolders: input.bundleFolders } : {};
+  const join7 = joinFacts({
     repos: input.repos,
     ...input.targets ? { targets: input.targets } : {},
-    ...input.facing ? { facing: input.facing } : {}
+    ...input.facing ? { facing: input.facing } : {},
+    ...bundle
   });
   const today = joinVendorOperations({
     repos: input.repos,
     vendors: [joinVendorOf(input, input.older.spec)],
-    ...input.targets ? { targets: input.targets } : {}
+    ...input.targets ? { targets: input.targets } : {},
+    ...bundle
   });
   const next = joinVendorOperations({
     repos: input.repos,
     vendors: [joinVendorOf(input, input.newer.spec)],
-    ...input.targets ? { targets: input.targets } : {}
+    ...input.targets ? { targets: input.targets } : {},
+    ...bundle
   });
   const k = (e) => `${e.repo}\0${e.fact}`;
   const facts = /* @__PURE__ */ new Map();
@@ -2444,8 +3487,8 @@ function vendorImpact(input) {
     const f = facts.get(k(call))?.fact;
     return f?.kind === "call" && f.from ? endOf(call.repo, f.from) : void 0;
   };
-  const hops = new Set(join5.joins.flatMap((j) => (j.gateway ?? []).map((h) => k(h.call))));
-  const joins = join5.joins.filter((j) => j.how !== "topic" && !hops.has(k(j.call)));
+  const hops = new Set(join7.joins.flatMap((j) => (j.gateway ?? []).map((h) => k(h.call))));
+  const joins = join7.joins.filter((j) => j.how !== "topic" && !hops.has(k(j.call)));
   const via = (j) => j.gateway?.length ? { via: j.gateway.map((h) => h.route) } : {};
   const upstreamOf = (start) => {
     const out = [];
@@ -2475,10 +3518,10 @@ function vendorImpact(input) {
     return out;
   };
   const fieldUse = (call, change) => {
-    if (!change.side || !change.field)
+    if (!change.side || !change.field || change.status)
       return void 0;
     const side = change.side;
-    const mine = (input.repos.find((r) => r.repo === call.repo)?.facts ?? []).filter((f) => f.kind === "field" && f.owner === call.fact && (f.side ?? "request") === side).sort((a, b) => cmp2(a.id, b.id));
+    const mine = (input.repos.find((r) => r.repo === call.repo)?.facts ?? []).filter((f) => f.kind === "field" && f.owner === call.fact && (f.side ?? "request") === side).sort((a, b) => cmp4(a.id, b.id));
     if (!mine.length)
       return void 0;
     const want = fieldNameKey(change.field);
@@ -2490,6 +3533,24 @@ function vendorImpact(input) {
     const older = c.endpoints.older;
     const matches = older ? today.matches.filter((m) => m.operation === older) : next.matches.filter((m) => m.operation === c.endpoints.newer);
     const forwards = matches.map((m) => {
+      if (m.direct) {
+        const f = facts.get(k(m.call))?.fact;
+        const field2 = fieldUse(m.call, c);
+        const self = {
+          call: m.call,
+          interface: interfaceId(m.call.component, factIdPart(f?.to ?? input.vendor.system), m.method, m.path),
+          ...field2 ? { field: field2 } : {},
+          ...m.route ? { under: m.route } : {},
+          upstream: upstreamOf(m.route)
+        };
+        return {
+          call: m.call,
+          ...m.route ? { route: m.route } : {},
+          operation: m.operation,
+          direct: true,
+          callers: [self]
+        };
+      }
       const callers = m.route ? joins.filter((j) => k(j.entry) === k(m.route) || (j.gateway ?? []).some((h) => k(h.entry) === k(m.route))).map((j) => {
         const u = under(j.call);
         const field2 = fieldUse(j.call, c);
@@ -2540,7 +3601,7 @@ function vendorImpact(input) {
     if (got?.fact.kind === "entry")
       endpointIds.add(entryEndpointId(got.fact, componentOf(got.repo, got.fact)));
   }
-  const flows = (input.flows ?? []).filter((f) => f.trigger && endpointIds.has(f.trigger) || (f.refs ?? []).some((r) => endpointIds.has(r))).map((f) => ({ id: f.id, repo: f.repo })).sort((a, b) => cmp2(a.id, b.id));
+  const flows = (input.flows ?? []).filter((f) => f.trigger && endpointIds.has(f.trigger) || (f.refs ?? []).some((r) => endpointIds.has(r))).map((f) => ({ id: f.id, repo: f.repo })).sort((a, b) => cmp4(a.id, b.id));
   for (const f of flows)
     repos.add(f.repo);
   const systems = /* @__PURE__ */ new Set([input.vendor.system]);
@@ -2567,7 +3628,174 @@ function vendorImpact(input) {
   };
 }
 
+// packages/intake/dist/contract-files.js
+var import_yaml8 = __toESM(require_dist(), 1);
+import { readdir as readdir6, readFile as readFile6, stat as stat3 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+function safeServerUrl(url) {
+  const m = /^([a-z][a-z0-9+.-]*:\/\/)([^/?#]*)(.*)$/i.exec(url.trim());
+  if (!m) {
+    const p = safePathOf(url);
+    return p === "/" ? void 0 : p;
+  }
+  const host = m[2].replace(/^.*@/, "");
+  if (!host)
+    return void 0;
+  const rest = (m[3] ?? "").split(/[?#]/, 1)[0] ?? "";
+  const path = rest && rest !== "/" ? safePathOf(rest) : "";
+  return `${m[1].toLowerCase()}${host}${path === "/" ? "" : path ?? ""}`;
+}
+var str2 = (m, key3) => {
+  const v = m?.get(key3);
+  return typeof v === "string" && v.trim() ? v.trim() : void 0;
+};
+var mapAt = (m, key3) => {
+  const v = (0, import_yaml8.isMap)(m) ? m.get(key3, true) : void 0;
+  return (0, import_yaml8.isMap)(v) ? v : void 0;
+};
+function readPactFile(text3, file) {
+  const lc = new import_yaml8.LineCounter();
+  let doc;
+  try {
+    doc = (0, import_yaml8.parseDocument)(text3, { lineCounter: lc });
+  } catch {
+    return void 0;
+  }
+  if (doc.errors.length || !(0, import_yaml8.isMap)(doc.contents))
+    return void 0;
+  const root = doc.contents;
+  const consumer = str2(mapAt(root, "consumer"), "name");
+  const provider = str2(mapAt(root, "provider"), "name");
+  const list2 = root.get("interactions", true);
+  if (!consumer || !provider || !(0, import_yaml8.isSeq)(list2))
+    return void 0;
+  const out = [];
+  for (const it of list2.items) {
+    if (!(0, import_yaml8.isMap)(it))
+      continue;
+    const type = str2(it, "type");
+    if (type && !/http/i.test(type))
+      continue;
+    const req = mapAt(it, "request");
+    if (!req)
+      continue;
+    const method = str2(req, "method");
+    const pair = req.items.find((p) => (0, import_yaml8.isScalar)(p.key) && p.key.value === "path");
+    const path = pair && (0, import_yaml8.isScalar)(pair.value) ? String(pair.value.value) : void 0;
+    const safe = path?.startsWith("/") ? safePathOf(path) : void 0;
+    if (!safe)
+      continue;
+    const range = pair.key.range;
+    out.push({
+      format: "pact",
+      file,
+      line: range ? lc.linePos(range[0]).line : 1,
+      consumer,
+      provider,
+      ...method ? { method: method.toUpperCase() } : {},
+      path: safe
+    });
+  }
+  return out;
+}
+function readConsumerOpenApi(text3, file, own) {
+  let read;
+  try {
+    read = readOpenApiDocument(text3);
+  } catch {
+    return void 0;
+  }
+  if (!read)
+    return void 0;
+  const served = read.operations.some((op) => own.some((e) => (!e.method || e.method.toUpperCase() === op.method.toUpperCase()) && routeScore(op.path, e.path) >= 500));
+  if (served)
+    return [];
+  const title = read.doc.getIn(["info", "title"]);
+  const provider = typeof title === "string" && title.trim() ? title.trim() : void 0;
+  const hosts = [...new Set(read.servers.map(safeServerUrl).filter((h) => !!h))];
+  return read.operations.flatMap((op) => {
+    const path = safePathOf(op.path);
+    return path ? [
+      {
+        format: "openapi",
+        file,
+        line: op.methodLine ?? op.line ?? 1,
+        ...provider ? { provider } : {},
+        ...hosts.length ? { hosts } : {},
+        method: op.method.toUpperCase(),
+        path
+      }
+    ] : [];
+  });
+}
+var SKIP2 = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "vendor",
+  "target",
+  "build",
+  "dist",
+  "out",
+  ".venv",
+  "venv",
+  "__pycache__",
+  ".gradle",
+  ".idea",
+  ".atticus"
+]);
+var MAX_BYTES2 = 5 * 1024 * 1024;
+var PACT = /pact/i;
+var SPEC = /(openapi|swagger)/i;
+async function readContractFiles(dir, o) {
+  const files = [];
+  const walk2 = async (rel) => {
+    const entries2 = await readdir6(join6(dir, ...rel.split("/").filter(Boolean)), {
+      withFileTypes: true
+    }).catch(() => []);
+    for (const e of [...entries2].sort((a, b) => a.name < b.name ? -1 : 1)) {
+      const p = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) {
+        if (!SKIP2.has(e.name))
+          await walk2(p);
+      } else if (e.isFile()) {
+        if (/\.json$/i.test(e.name) && PACT.test(p))
+          files.push(p);
+        else if (/\.(ya?ml|json)$/i.test(e.name) && SPEC.test(e.name))
+          files.push(p);
+      }
+    }
+  };
+  await walk2("");
+  const entries = [];
+  for (const p of files) {
+    const full = join6(dir, ...p.split("/"));
+    const size = (await stat3(full).catch(() => void 0))?.size ?? 0;
+    if (size === 0 || size > MAX_BYTES2)
+      continue;
+    const text3 = await readFile6(full, "utf8");
+    const got = (/\.json$/i.test(p) && PACT.test(p) ? readPactFile(text3, p) : void 0) ?? (SPEC.test(p) ? readConsumerOpenApi(text3, p, o.own ?? []) : void 0);
+    if (!got?.length)
+      continue;
+    if (o.denyHashes?.size) {
+      const text4 = got.map((e) => [e.file, e.consumer, e.provider, ...e.hosts ?? [], e.method, e.path].join("\n")).join("\n");
+      if (denyListHits(text4, o.denyHashes).length) {
+        o.onRefused?.(`${p}: the deny-list names a word in it, so its requests are left out.`);
+        continue;
+      }
+    }
+    entries.push(...got);
+  }
+  entries.sort((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line);
+  return {
+    schemaVersion: 1,
+    repo: o.repo,
+    ...o.commit ? { commit: o.commit } : {},
+    entries
+  };
+}
+
 export {
+  joinServerVariables,
   classify,
   READERS,
   readOpenApiSpec,
@@ -2580,9 +3808,24 @@ export {
   sortItems,
   opt,
   screenFile,
+  looksSensitive,
+  segmentOf,
+  safePathOf,
+  pathTemplateOf,
+  appLabelOf,
+  denyListHits,
+  aggregateTraffic,
   specEndpointIds,
   readVendorSpec,
   operationSchemas,
+  readProtoSpecs,
+  readAvroSpecs,
+  readJsonSchemaSpecs,
+  readAsyncApiSpecs,
+  openApiContractSpecs,
+  specFormatOf,
+  readContractSpecs,
+  readRepoSpecs,
   nameParts,
   compareVersions,
   scanInputs,
@@ -2605,5 +3848,9 @@ export {
   changeInputSources,
   diffVendorSpecs,
   MAX_UPSTREAM,
-  vendorImpact
+  vendorImpact,
+  safeServerUrl,
+  readPactFile,
+  readConsumerOpenApi,
+  readContractFiles
 };