@maycombhq/atticus 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/{chunk-TANFV3MZ.js → chunk-LO3BLMVG.js}

@@ -5,7 +5,7 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   quantize
-} from "./chunk-CNUKCS2T.js";
+} from "./chunk-QHJJMZLX.js";
 import {
   Runtime,
   external_exports,
@@ -13,8 +13,8 @@ import {
   readTarGz,
   require_dist,
   retrievalOf
-} from "./chunk-S2A7YC3Q.js";
-import "./chunk-D3PO4DOZ.js";
+} from "./chunk-PAINMSID.js";
+import "./chunk-ODMBPDDV.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";

package/dist/chunk-LPV6T362.js

@@ -0,0 +1,250 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  aggregateTraffic,
+  readContractFiles
+} from "./chunk-CPK7QSBG.js";
+import {
+  TRAFFIC_SOURCES
+} from "./chunk-YO2PKTXT.js";
+import {
+  ContractsFile,
+  evidenceDirOf,
+  evidenceRelOf,
+  factsDirOf,
+  factsRelOf,
+  loadOrgPack,
+  orgPackDirOf,
+  readTrafficFile,
+  require_dist,
+  trafficFileName
+} from "./chunk-PAINMSID.js";
+import {
+  writeFileAtomic
+} from "./chunk-ODMBPDDV.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/link-evidence-files.js
+var import_yaml = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readdir, readFile, rm } from "node:fs/promises";
+import { basename, join, resolve } from "node:path";
+var SHOWN = 5;
+async function repoContractsOf(root, repo, dir, facts, onRefused) {
+  const commit = facts.map((f) => f.commit).sort()[0];
+  const own = facts.flatMap((f) => f.kind === "entry" && f.entryType === "rest" ? [{ ...f.method ? { method: f.method } : {}, path: f.path }] : []);
+  const deny = await denyHashesAt(root);
+  return readContractFiles(dir, {
+    repo,
+    ...commit ? { commit } : {},
+    own,
+    ...deny.size ? { denyHashes: deny } : {},
+    ...onRefused ? { onRefused } : {}
+  });
+}
+async function writeRepoContracts(root, repo, dir, facts, onRefused) {
+  const file = await repoContractsOf(root, repo, dir, facts, onRefused);
+  const path = join(factsDirOf(root), `${repo}.contracts.yaml`);
+  if (file.entries.length)
+    await writeFileAtomic(path, (0, import_yaml.stringify)(file, { lineWidth: 0 }));
+  else
+    await rm(path, { force: true });
+  return file;
+}
+async function loadLinkEvidence(root) {
+  const problems = [];
+  const contracts = [];
+  const fRel = factsRelOf(root);
+  for (const n of (await readdir(factsDirOf(root)).catch(() => [])).sort()) {
+    if (!n.endsWith(".contracts.yaml"))
+      continue;
+    let v;
+    try {
+      v = (0, import_yaml.parse)(await readFile(join(factsDirOf(root), n), "utf8"));
+    } catch (e) {
+      problems.push(`${fRel}/${n} isn't YAML (${e.message}); it is left out.`);
+      continue;
+    }
+    const p = ContractsFile.safeParse(v);
+    if (p.success)
+      contracts.push(p.data);
+    else
+      problems.push(`${fRel}/${n} isn't a contracts file; it is left out.`);
+  }
+  const traffic = [];
+  const tDir = join(evidenceDirOf(root), "traffic");
+  const tRel = `${evidenceRelOf(root)}/traffic`;
+  for (const n of (await readdir(tDir).catch(() => [])).sort()) {
+    if (!/\.ya?ml$/.test(n))
+      continue;
+    const r = readTrafficFile(`${tRel}/${n}`, await readFile(join(tDir, n), "utf8"));
+    if (r.ok)
+      traffic.push(r.traffic);
+    else
+      problems.push(`${r.message}; it is left out.`);
+  }
+  return { contracts, traffic, problems };
+}
+function componentsOf(repo, join2) {
+  const out = /* @__PURE__ */ new Set([repo]);
+  for (const j of join2?.joins ?? []) {
+    if (j.call.repo === repo)
+      out.add(j.call.component);
+    if (j.entry.repo === repo)
+      out.add(j.entry.component);
+  }
+  return out;
+}
+function linkEvidenceAbout(repo, le, join2) {
+  const comps = componentsOf(repo, join2);
+  const touches = (l) => !!l && (comps.has(l.from) || comps.has(l.to));
+  return {
+    contracts: {
+      confirmed: le.contracts.confirmed.filter(touches),
+      findings: le.contracts.findings.filter((f) => f.repo === repo || f.links.some(touches))
+    },
+    traffic: {
+      seen: le.traffic.seen.filter(touches),
+      findings: le.traffic.findings.filter((f) => f.component && comps.has(f.component) || touches(f.link)),
+      // An app named like no component is the estate's, not one repo's: listed in every report.
+      unknownApps: le.traffic.findings.filter((f) => f.reason === "unknown-app")
+    }
+  };
+}
+function linkEvidenceLines(about, report, o = {}) {
+  const out = [];
+  const show = (lines) => {
+    const shown = o.verbose ? lines : lines.slice(0, SHOWN);
+    out.push(...shown.map((l) => `    ${l}`));
+    if (shown.length < lines.length)
+      out.push(`    ... and ${lines.length - shown.length} more (in ${report})`);
+  };
+  const c = about.contracts;
+  if (c.confirmed.length || c.findings.length) {
+    out.push(`  Contracts: ${c.confirmed.length} link${c.confirmed.length === 1 ? "" : "s"} confirmed by a consumer's contract file, ${c.findings.length} request${c.findings.length === 1 ? "" : "s"} the join doesn't bear out (under contracts in ${report}):`);
+    show(c.findings.map((f) => `${f.reason}: ${f.message}`));
+  }
+  const t = about.traffic;
+  const apps = t.unknownApps.length;
+  if (t.seen.length || t.findings.length || apps) {
+    out.push(`  Traffic: ${t.seen.length} link${t.seen.length === 1 ? "" : "s"} seen in imported traffic, ${t.findings.length} finding${t.findings.length === 1 ? "" : "s"}${apps ? `; ${apps} app${apps === 1 ? "" : "s"} in the estate's traffic named like no component (name each in its row)` : ""} (under traffic in ${report}):`);
+    show(t.findings.map((f) => `${f.reason}: ${f.message}`));
+  }
+  return out;
+}
+async function intakeTraffic(root, file, o, io) {
+  const sources = Object.keys(TRAFFIC_SOURCES).sort();
+  if (!file) {
+    io.err(`intake traffic needs an export file: atticus intake traffic <file> --source ${sources.join("|")} [--from YYYY-MM-DD --to YYYY-MM-DD]`);
+    return 2;
+  }
+  const columns = o.source ? TRAFFIC_SOURCES[o.source] : void 0;
+  if (!columns) {
+    io.err(`${o.source ? `${o.source} is no source Atticus reads` : "Say which source the export is from"}: --source ${sources.join("|")}.`);
+    return 2;
+  }
+  const path = resolve(file);
+  if (!existsSync(path)) {
+    io.err(`No file at ${file}.`);
+    return 2;
+  }
+  const bytes = new Uint8Array(await readFile(path));
+  const { templates, apps } = await estateNames(root);
+  const deny = await denyHashesAt(root);
+  const r = aggregateTraffic({
+    bytes,
+    source: o.source,
+    columns,
+    templates,
+    apps,
+    ...o.from ? { from: o.from } : {},
+    ...o.to ? { to: o.to } : {},
+    ...deny.size ? { denyHashes: deny } : {}
+  });
+  if (!r.ok) {
+    io.err(`${basename(path)}: ${r.message}`);
+    return 1;
+  }
+  const rel = `${evidenceRelOf(root)}/traffic/${trafficFileName(r.file)}`;
+  await writeFileAtomic(join(evidenceDirOf(root), "traffic", trafficFileName(r.file)), r.text);
+  if (o.json) {
+    io.out(JSON.stringify({
+      written: rel,
+      rows: r.file.rows.length,
+      read: r.read,
+      outOfRange: r.outOfRange,
+      skipped: r.skipped,
+      dropped: r.dropped,
+      from: r.file.from,
+      to: r.file.to,
+      inputSha256: r.file.inputSha256
+    }, null, 2));
+    return 0;
+  }
+  io.out(`Wrote ${rel}: ${r.file.rows.length} aggregate${r.file.rows.length === 1 ? "" : "s"} (caller app, method, path template, proxy and base path) from ${r.read} rows, ${r.file.from} to ${r.file.to}${r.outOfRange ? `; ${r.outOfRange} outside the range` : ""}${r.skipped ? `; ${r.skipped} without a method, path or count` : ""}${r.unmatched ? `; ${r.unmatched} to a path no route template of the estate matches, dropped` : ""}.`);
+  if (r.dropped.length)
+    io.out(`  Dropped before anything was written: the columns ${r.dropped.join(", ")}, every query string and matrix param, any proxy that looked like an IP, an email or a token, and every path but as a route template of the estate. No raw row is kept.`);
+  io.out(`  Review it in a pull request (an app named like no component is written as an app-<hash> label: give its row a component: line), then atticus verify <repo> --write marks the links it shows used, and lists the traffic no link carries and the links none used.`);
+  return 0;
+}
+async function estateNames(root) {
+  const { estateFacts, estateRepos } = await import("./chunk-BXZ4PKIT.js");
+  const apps = /* @__PURE__ */ new Set();
+  const tDir = join(evidenceDirOf(root), "traffic");
+  for (const n of (await readdir(tDir).catch(() => [])).sort()) {
+    if (!/\.ya?ml$/.test(n))
+      continue;
+    const r = readTrafficFile(n, await readFile(join(tDir, n), "utf8"));
+    if (r.ok) {
+      for (const row of r.traffic.file.rows)
+        if (row.component)
+          apps.add(row.app).add(row.component);
+    }
+  }
+  const op = await loadOrgPack(orgPackDirOf(root)).catch(() => void 0);
+  if (!op)
+    return { templates: [], apps: [...apps].sort() };
+  for (const m of estateRepos(op)) {
+    apps.add(m.id);
+    if (m.component)
+      apps.add(m.component);
+    for (const x of m.modules ?? [])
+      apps.add(x.component);
+  }
+  const { repos } = await estateFacts(root, op, "");
+  const out = /* @__PURE__ */ new Set();
+  for (const r of repos) {
+    apps.add(r.repo);
+    for (const f of r.facts) {
+      if (f.component)
+        apps.add(f.component);
+      if (f.kind === "entry" && f.entryType === "rest" || f.kind === "call" && f.callType === "rest") {
+        if (f.path?.startsWith("/"))
+          out.add(f.path);
+      }
+    }
+  }
+  return { templates: [...out].sort(), apps: [...apps].sort() };
+}
+async function denyHashesAt(root) {
+  const text = await readFile(join(root, ".denylist"), "utf8").catch(() => "");
+  return new Set(text.split(/\r?\n/).map((l) => l.trim()).filter((l) => /^[0-9a-f]{64}$/.test(l)));
+}
+var denyHash = (s) => createHash("sha256").update(s.trim().toLowerCase(), "utf8").digest("hex");
+
+export {
+  repoContractsOf,
+  writeRepoContracts,
+  loadLinkEvidence,
+  linkEvidenceAbout,
+  linkEvidenceLines,
+  intakeTraffic,
+  denyHashesAt,
+  denyHash
+};

package/dist/{chunk-2VHF7OXM.js → chunk-LQH4P45K.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-VOGCSYOI.js";
 import {
   openspecStores
-} from "./chunk-XY3P7JW7.js";
+} from "./chunk-HSZMPH5T.js";
 
 // packages/cli/dist/openspec-stores-commands.js
 var plural = (n, w) => `${n} ${w}${n === 1 ? "" : "s"}`;

package/dist/chunk-LU4MQVAL.js

@@ -0,0 +1,41 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  DecideError,
+  aiAuditCandidates,
+  correctDecision,
+  decideAnswers,
+  decideIn,
+  decideLinks,
+  decideState,
+  decisionsView,
+  inAcpSession,
+  proposalsSnapshot,
+  undoBatch
+} from "./chunk-UYLBRRFK.js";
+import "./chunk-THN26IEF.js";
+import "./chunk-Q46QDDMF.js";
+import "./chunk-TGVVUKTG.js";
+import "./chunk-JYMIB5XY.js";
+import "./chunk-TWQRPM76.js";
+import "./chunk-XOL3GFW2.js";
+import "./chunk-7AB6OWTV.js";
+import "./chunk-PAINMSID.js";
+import "./chunk-ODMBPDDV.js";
+import "./chunk-TV45EUGM.js";
+export {
+  DecideError,
+  aiAuditCandidates,
+  correctDecision,
+  decideAnswers,
+  decideIn,
+  decideLinks,
+  decideState,
+  decisionsView,
+  inAcpSession,
+  proposalsSnapshot,
+  undoBatch
+};

package/dist/chunk-LWDNKE4X.js

@@ -0,0 +1,273 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  rulesLackingAll
+} from "./chunk-GIFMBCTW.js";
+import {
+  loadReadPlan
+} from "./chunk-MD7KUEJ3.js";
+import {
+  carryOf,
+  checkoutOf,
+  excludesOf
+} from "./chunk-Q46QDDMF.js";
+import {
+  isMetarepo,
+  notMetarepo
+} from "./chunk-3G4YI4ZU.js";
+import {
+  dirSource,
+  rereadPlan,
+  sameCommit
+} from "./chunk-JYMIB5XY.js";
+import {
+  loadRepos
+} from "./chunk-XOL3GFW2.js";
+import {
+  citedFiles,
+  factsDirOf,
+  factsFileOf,
+  factsRelOf,
+  headFromFiles,
+  parseFacts
+} from "./chunk-PAINMSID.js";
+
+// packages/cli/dist/estate-fresh.js
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+var FRESH_STATES = [
+  /** Facts cite files that changed, or source files changed: read again. */
+  "stale",
+  /** The clone doesn't have the commit the facts were read at: they can't be compared. */
+  "unknown-commit",
+  /** The clone moved, but nothing the facts cite changed and no source file did: carry them. */
+  "moved",
+  /**
+   * ADR 0167: the facts are of the clone's commit, but the read lacked rule sets added since
+   * (or recorded none, before 2.0.0-beta.12): a top-up reads the files those sets apply to.
+   */
+  "rules-changed",
+  /** No clone to compare with. */
+  "no-checkout",
+  /** The facts are of the commit the clone is at. */
+  "fresh",
+  /** No facts yet: the repo isn't read. */
+  "not-read"
+];
+var RANK = Object.fromEntries(FRESH_STATES.map((s, i) => [s, i]));
+function freshOrder(a, b) {
+  return RANK[a.state] - RANK[b.state] || b.reread - a.reread || b.citedChanged - a.citedChanged || b.toRead - a.toRead || b.changed - a.changed || (a.repo < b.repo ? -1 : a.repo > b.repo ? 1 : 0);
+}
+async function pool(xs, n, f) {
+  const out = new Array(xs.length);
+  let next = 0;
+  const worker = async () => {
+    for (let i = next++; i < xs.length; i = next++)
+      out[i] = await f(xs[i]);
+  };
+  await Promise.all(Array.from({ length: Math.min(n, xs.length) }, worker));
+  return out;
+}
+var firstLine = (e) => String(e?.message ?? e).split("\n")[0];
+async function freshOf(root, repo, o, problems) {
+  const factsFile = `${factsRelOf(root)}/${repo}.jsonl`;
+  const base = {
+    repo,
+    factsFile,
+    facts: 0,
+    factsCommits: [],
+    current: 0,
+    carried: 0,
+    reread: 0,
+    citedChanged: 0,
+    changed: 0,
+    toRead: 0,
+    unknown: []
+  };
+  const read = { command: `atticus map ${repo}`, slash: `/atticus-map ${repo}` };
+  const text = await readFile(join(factsDirOf(root), `${repo}.jsonl`), "utf8").catch(() => void 0);
+  if (text === void 0 || !text.trim())
+    return { ...base, state: "not-read", ...read };
+  const parsed = parseFacts(text);
+  if (!parsed.ok) {
+    problems.push({
+      file: factsFile,
+      message: `doesn't read as facts: ${parsed.issues[0]?.message ?? "invalid"}`
+    });
+    return { ...base, state: "not-read", ...read };
+  }
+  const facts = parsed.facts;
+  const commits = [...new Set(facts.map((f) => f.commit))].sort();
+  const counted = { ...base, facts: facts.length, factsCommits: commits };
+  const dir = await checkoutOf(root, repo).catch(() => void 0);
+  const head = dir ? await headFromFiles(dir) : void 0;
+  if (!dir || !head)
+    return { ...counted, state: "no-checkout", command: "atticus workspace sync" };
+  const at = { ...counted, head };
+  if (facts.every((f) => sameCommit(f.commit, head))) {
+    const lacking = await rulesLackingAll(root, repo, (await loadReadPlan(root, repo).catch(() => void 0))?.rules, { dir });
+    return lacking.length ? {
+      ...at,
+      state: "rules-changed",
+      current: facts.length,
+      rulesLacking: lacking,
+      command: `atticus map ${repo} --rules`,
+      slash: `/atticus-map ${repo} --rules`
+    } : { ...at, state: "fresh", current: facts.length };
+  }
+  let carry;
+  try {
+    carry = await carryOf(dir, facts, head, o.git);
+  } catch (e) {
+    problems.push({
+      file: factsFile,
+      message: `git couldn't compare the commits: ${firstLine(e)}`
+    });
+    return { ...at, state: "unknown-commit", unknown: commits, reread: facts.length, ...read };
+  }
+  const plan = rereadPlan({
+    facts,
+    commit: head,
+    carry: carry.carry,
+    source: dirSource(dir),
+    exclude: await excludesOf(root, repo)
+  });
+  const unknown = [.../* @__PURE__ */ new Set([...plan.unknown, ...carry.missing])].sort();
+  const lost = facts.filter((f) => unknown.some((c) => sameCommit(c, f.commit))).length;
+  const changedPaths = /* @__PURE__ */ new Set();
+  for (const cs of Object.values(carry.carry))
+    for (const c of cs) {
+      changedPaths.add(c.path);
+      if (c.from)
+        changedPaths.add(c.from);
+    }
+  const cited = /* @__PURE__ */ new Set();
+  for (const f of facts) {
+    if (sameCommit(f.commit, head) || unknown.some((c) => sameCommit(c, f.commit)))
+      continue;
+    for (const p of citedFiles(f))
+      if (changedPaths.has(p))
+        cited.add(p);
+  }
+  const changed = new Set(Object.values(carry.carry).flatMap((cs) => cs.map((c) => c.path))).size;
+  const out = {
+    ...at,
+    current: plan.current,
+    carried: plan.carried,
+    reread: plan.reread.length + lost,
+    citedChanged: cited.size,
+    changed,
+    toRead: plan.files.length,
+    unknown
+  };
+  if (unknown.length)
+    return { ...out, state: "unknown-commit", command: "atticus workspace sync" };
+  if (!out.reread && !out.toRead)
+    return { ...out, state: "moved", command: `atticus verify ${repo} --write` };
+  return { ...out, state: "stale", ...read };
+}
+async function estateFreshness(root, o = {}) {
+  const problems = [];
+  const ids = [];
+  try {
+    for (const r of await loadRepos(root))
+      if (!r.archived)
+        ids.push(r.id);
+  } catch (e) {
+    problems.push({ file: "org-pack/profiles", message: firstLine(e) });
+  }
+  for (const n of (await readdir(factsDirOf(root)).catch(() => [])).sort()) {
+    const of = factsFileOf(n);
+    if (of?.facts && !ids.includes(of.repo))
+      ids.push(of.repo);
+  }
+  const want = o.repos ? ids.filter((id) => o.repos.includes(id)) : ids;
+  const repos = await pool(want, 4, (id) => freshOf(root, id, o, problems));
+  return { factsDir: factsRelOf(root), repos: repos.sort(freshOrder), problems };
+}
+var short = (c) => c.slice(0, 12);
+var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+var factsCommitWords = (r) => r.factsCommits.length === 0 ? "-" : r.factsCommits.length === 1 ? short(r.factsCommits[0]) : `${short(r.factsCommits[0])} +${r.factsCommits.length - 1}`;
+function freshWhy(r) {
+  switch (r.state) {
+    case "stale":
+      return `${plural(r.reread, "fact")} to read again (${plural(r.citedChanged, "file")} they cite changed), ${r.carried} carried as they are; ${plural(r.toRead, "source file")} to read.`;
+    case "unknown-commit":
+      return `The clone doesn't have ${r.unknown.map(short).join(", ")}, the commit the facts were read at: sync it, or read the repo again whole.`;
+    case "moved":
+      return `The clone moved, but nothing the facts cite changed and no source file did: verify carries all ${plural(r.carried + r.current, "fact")}.`;
+    case "rules-changed":
+      return `Its facts are of the clone's commit, but it was read before these reading rules: ${(r.rulesLacking ?? []).join(", ")}. A top-up reads only the files they apply to.`;
+    case "no-checkout":
+      return "No clone to compare the facts with.";
+    case "fresh":
+      return "The facts are of the commit the clone is at.";
+    default:
+      return "Not read yet.";
+  }
+}
+async function estateFresh(root, o, io) {
+  if (!isMetarepo(root)) {
+    io.err(notMetarepo(root));
+    return 2;
+  }
+  const v = await estateFreshness(root, o.git ? { git: o.git } : {});
+  if (o.json) {
+    io.out(JSON.stringify(v, null, 2));
+    return 0;
+  }
+  for (const p of v.problems)
+    io.err(`Couldn't read ${p.file}: ${p.message}`);
+  const read = v.repos.filter((r) => r.state !== "not-read");
+  if (!read.length) {
+    io.out(v.repos.length ? `No repo is read yet, so none can be stale: atticus next says which to read first.` : "No repo is listed yet: atticus next says how to start.");
+    return 0;
+  }
+  const stale = read.filter((r) => r.state !== "fresh");
+  const moved = stale.filter((r) => r.state !== "rules-changed");
+  const rules = stale.length - moved.length;
+  const facts = moved.reduce((n, r) => n + r.reread, 0);
+  if (moved.length || !rules)
+    io.out(moved.length ? `${plural(moved.length, "repo")} of ${read.length} read ${moved.length === 1 ? "has" : "have"} moved past ${moved.length === 1 ? "its" : "their"} facts' commit: ${plural(facts, "fact")} to read again. Most stale first:` : `All ${plural(read.length, "repo")} read are fresh: each one's facts are of the commit its clone is at.`);
+  if (rules)
+    io.out(`${plural(rules, "repo")} of ${read.length} read ${rules === 1 ? "was" : "were"} read before reading rules added since: atticus map --all --stale tops ${rules === 1 ? "it" : "them"} up, reading only the files the new rules apply to.`);
+  const shown = o.all ? read : stale;
+  if (shown.length) {
+    const rows = shown.map((r) => [
+      r.repo,
+      r.state,
+      factsCommitWords(r),
+      r.head ? short(r.head) : "-",
+      String(r.citedChanged),
+      String(r.reread),
+      r.command ?? ""
+    ]);
+    const head = ["repo", "state", "facts at", "clone at", "cited changed", "to read again", "run"];
+    const w = head.map((h, i) => Math.max(h.length, ...rows.map((x) => x[i].length)));
+    const line = (cells) => cells.map((c, i) => i === cells.length - 1 ? c : c.padEnd(w[i])).join("  ").trimEnd();
+    io.out(line(head));
+    for (const r of rows)
+      io.out(line(r));
+    for (const r of shown.filter((x) => x.state !== "fresh"))
+      io.out(`  ${r.repo}: ${freshWhy(r)}`);
+  }
+  const fresh = read.length - stale.length;
+  if (fresh && !o.all && stale.length)
+    io.out(`${plural(fresh, "repo")} fresh (--all lists them too).`);
+  const unread = v.repos.length - read.length;
+  if (unread)
+    io.out(`${plural(unread, "repo")} not read yet: atticus next says which to read first.`);
+  return 0;
+}
+
+export {
+  FRESH_STATES,
+  freshOrder,
+  estateFreshness,
+  factsCommitWords,
+  freshWhy,
+  estateFresh
+};