@maycombhq/atticus 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/{chunk-PAMPPUR6.js → chunk-CXJ6FUKN.js}

@@ -3,30 +3,57 @@ import { fileURLToPath as __atticusFileURLToPath } from "node:url";
 var require = __atticusCreateRequire(import.meta.url);
 var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  readOpenApiDocument
+} from "./chunk-CQDGOPGH.js";
 import {
   globToRegExp
-} from "./chunk-GQ4N4WKF.js";
+} from "./chunk-3NFFJL5D.js";
 import {
-  APIGEE_BUNDLE,
+  DECLARED_TOPIC,
+  DEFAULT_CONVENTIONS,
   Fact,
+  FactId,
+  JOINED_BY_AI,
+  JOINED_BY_PERSON,
+  JOINED_TO_SHARED_MAP,
+  JOIN_HOW_FLAGS,
+  LINK_EVIDENCE_NOT_GAPS,
   MOCK_FILE,
   NEVER_CHECKED_STEPS,
+  SHARED_MAP_EVIDENCE,
   citedFiles,
   claimOnLines,
+  clusterServiceAddress,
+  decodeText,
+  factIdPart,
+  forwardSlashes,
+  gatewayBundleTest,
+  isBinaryText,
+  isLfsPointer,
+  isPatternPath,
   isSecretPath,
   lineNamesClaim,
+  linksFor,
+  listRepoFilesSync,
   normalizePath,
+  notDeviceName,
+  noteProblem,
   partsBuildWord,
   partsNamePath,
+  plainPathPrefix,
+  quoteHoldsSecret,
   quoteMatches,
   quoteNotRequired,
   redactSecrets,
   staleCite,
-  toCanonicalYaml
-} from "./chunk-S2A7YC3Q.js";
+  toCanonicalYaml,
+  tokenUnits,
+  underFolders
+} from "./chunk-Q2TECDIT.js";
 
 // packages/verify/dist/source.js
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, normalize, relative, sep } from "node:path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -38,6 +65,13 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".vscode",
   ".gradle",
   ".mvn",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".next",
+  ".nuxt"
+]);
+var BUILD_OUTPUT = /* @__PURE__ */ new Set([
   "target",
   "build",
   "dist",
@@ -45,62 +79,92 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   "bin",
   "obj",
   "vendor",
-  "__pycache__",
-  ".venv",
-  "venv",
-  ".next",
-  ".nuxt",
   "coverage"
 ]);
+var DOTNET = /\.(csproj|fsproj|vbproj|sln)$/i;
+var NODE = /^package\.json$/;
+var MADE_BESIDE = {
+  bin: DOTNET,
+  obj: DOTNET,
+  vendor: /^(go\.mod|composer\.json|Gemfile)$/,
+  target: /^(pom\.xml|build\.sbt|Cargo\.toml)$/,
+  build: /^(build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|CMakeLists\.txt)$/,
+  dist: NODE,
+  coverage: NODE,
+  out: /^(tsconfig\.json|package\.json)$|\.iml$/
+};
+var ONLY_BESIDE = /* @__PURE__ */ new Set(["bin", "obj", "vendor"]);
+function skippedFolder(above, name, siblings) {
+  if (SKIP_DIRS.has(name))
+    return true;
+  if (!BUILD_OUTPUT.has(name))
+    return false;
+  if (siblings.some((x) => MADE_BESIDE[name].test(x)))
+    return true;
+  if (above.some((a) => a.toLowerCase() === "src"))
+    return false;
+  return !ONLY_BESIDE.has(name);
+}
 function insideRepo(path) {
-  if (path === "" || isAbsolute(path) || /^[A-Za-z]:/.test(path))
+  const p = path.replace(/\\/g, "/");
+  if (p === "" || p.includes(":") || isAbsolute(p) || p.startsWith("/"))
     return false;
-  const n = normalize(path).split(sep).join("/");
+  if (p.split("/").some((x) => x !== "." && x !== ".." && /[. ]$/.test(x)))
+    return false;
+  const n = normalize(p).split(sep).join("/");
   return n !== ".." && !n.startsWith("../");
 }
 function dirSource(root) {
   let cache;
-  const walk = (dir, out) => {
-    let names;
+  let realRoot;
+  const fileAt = (path) => {
+    if (!insideRepo(path))
+      return void 0;
+    const full = join(root, ...path.split("/"));
     try {
-      names = readdirSync(dir).sort();
+      if (!lstatSync(full).isFile())
+        return void 0;
+      realRoot ??= realpathSync(root);
+      const r = relative(realRoot, realpathSync(full));
+      if (!r || r.startsWith("..") || isAbsolute(r))
+        return void 0;
+      return full;
     } catch {
-      return;
-    }
-    for (const name of names) {
-      const full = join(dir, name);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (!SKIP_DIRS.has(name))
-          walk(full, out);
-      } else if (st.isFile())
-        out.push(relative(root, full).split(sep).join("/"));
+      return void 0;
     }
   };
   return {
     list() {
-      if (!cache) {
-        cache = [];
-        walk(root, cache);
-      }
+      cache ??= listRepoFilesSync(root, { skipFolder: skippedFolder });
       return cache;
     },
     read(path) {
-      if (!insideRepo(path))
+      const full = fileAt(path);
+      if (!full)
+        return void 0;
+      try {
+        return decodeText(readFileSync(full));
+      } catch {
+        return void 0;
+      }
+    },
+    size(path) {
+      const full = fileAt(path);
+      if (!full)
         return void 0;
       try {
-        return readFileSync(join(root, ...path.split("/")), "utf8");
+        return statSync(full).size;
       } catch {
         return void 0;
       }
     }
   };
 }
+var MAX_SOURCE_BYTES = 5 * 1024 * 1024;
+function tooBigToRead(source, path) {
+  const n = source.size?.(path);
+  return n !== void 0 && n > MAX_SOURCE_BYTES;
+}
 
 // packages/verify/dist/frameworks.js
 var FRAMEWORKS = [
@@ -121,6 +185,11 @@ var FRAMEWORKS = [
 var KNOWN = [
   // Java and Kotlin
   ["spring-boot*", { name: "spring-boot", topic: "spring", shape: "rest" }],
+  // the annotations a Spring Boot app's main class carries, which a reader may cite instead
+  // (matched by `annotationKey`, so bare, qualified or with arguments)
+  ["@springbootapplication", { name: "spring-boot", topic: "spring", shape: "rest" }],
+  ["@enableautoconfiguration", { name: "spring-boot", topic: "spring", shape: "rest" }],
+  ["@quarkusmain", { name: "quarkus", topic: "quarkus" }],
   ["spring-webmvc", { name: "spring", topic: "spring", shape: "rest" }],
   ["spring-webflux", { name: "spring", topic: "spring", shape: "rest" }],
   ["spring-web", { name: "spring", topic: "spring", shape: "rest" }],
@@ -172,23 +241,45 @@ function declarationKey(declared) {
   const name = colon.split(/[=<>~!,\s[]/)[0] ?? colon;
   return name.replace(/^['"]|['"]$/g, "");
 }
-function frameworkOf(declared) {
+function annotationKey(declared) {
+  const m = /^@?(?:[a-z_$][\w$]*\.)*([A-Z][\w$]*)\s*(?:\(.*)?$/s.exec(declared.trim());
+  return m ? `@${m[1].toLowerCase()}` : void 0;
+}
+function houseKnown(extra) {
+  return extra.map((e) => [
+    e.declares.toLowerCase(),
+    {
+      name: e.name,
+      ...e.topic && FRAMEWORKS.includes(e.topic) ? { topic: e.topic } : {},
+      ...e.shape ? { shape: e.shape } : {}
+    }
+  ]);
+}
+function frameworkOf(declared, extra = []) {
   const key = declarationKey(declared);
   if (!key)
     return void 0;
-  for (const [pattern, known] of KNOWN) {
+  const table = extra.length ? [...houseKnown(extra), ...KNOWN] : KNOWN;
+  for (const [pattern, known] of table) {
     const star = pattern.endsWith("*");
     const p = star ? pattern.slice(0, -1) : pattern;
     if (star ? key.startsWith(p) : key === p)
       return known;
   }
+  const ann = annotationKey(declared);
+  if (ann) {
+    for (const [pattern, known] of table)
+      if (pattern === ann)
+        return known;
+  }
   return void 0;
 }
-function frameworkNameProblem(f) {
-  const known = frameworkOf(f.cite.value);
+function frameworkNameProblem(f, extra = []) {
+  const known = frameworkOf(f.cite.value, extra);
   const name = f.name.trim().toLowerCase();
   if (known) {
-    return name === known.name ? void 0 : `names the framework "${f.name}", but ${f.cite.file}:${f.cite.line} declares ${f.cite.value}, which is ${known.name}`;
+    const legacy = annotationKey(f.cite.value) === `@${name}`;
+    return name === known.name.toLowerCase() || legacy ? void 0 : `names the framework "${f.name}", but ${f.cite.file}:${f.cite.line} declares ${f.cite.value}, which is ${known.name}`;
   }
   const key = declarationKey(f.cite.value);
   if (declarationKey(name) === key || name === key)
@@ -196,13 +287,13 @@ function frameworkNameProblem(f) {
   return `names the framework "${f.name}", which ${f.cite.file}:${f.cite.line} doesn't declare: it declares ${f.cite.value}, and Atticus doesn't know that one, so name it as the build file writes it (${key})`;
 }
 var frameworkFacts = (facts) => facts.filter((f) => f.kind === "framework").sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-function frameworkTopics(facts) {
+function frameworkTopics(facts, extra = []) {
   const fws = frameworkFacts(facts);
   if (!fws.length)
     return void 0;
   const topics = /* @__PURE__ */ new Set();
   for (const f of fws) {
-    const known = frameworkOf(f.cite.value);
+    const known = frameworkOf(f.cite.value, extra);
     if (!known?.topic)
       topics.add("house");
     else
@@ -228,7 +319,7 @@ var SHAPE_ASK = {
   store: "which tables it reads and writes"
 };
 var holdsShape = (facts, shape2) => facts.some((f) => shape2 === "store" ? f.kind === "store" : f.kind === "entry" && f.entryType === (shape2 === "rest" ? "rest" : shape2));
-function frameworkGaps(facts) {
+function frameworkGaps(facts, extra = []) {
   const fws = frameworkFacts(facts);
   if (!fws.length)
     return [];
@@ -236,7 +327,7 @@ function frameworkGaps(facts) {
     return [];
   const out = [];
   for (const f of fws) {
-    const shape2 = frameworkOf(f.cite.value)?.shape;
+    const shape2 = frameworkOf(f.cite.value, extra)?.shape;
     if (!shape2 || holdsShape(facts, shape2))
       continue;
     out.push({
@@ -249,9 +340,14 @@ function frameworkGaps(facts) {
   }
   return out.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
 }
-function frameworksToLearn(facts, known = []) {
+function isApigeeBundle(f) {
+  const file = f.cite.file.replace(/\\/g, "/").toLowerCase();
+  const said = `${f.cite.value} ${f.cite.quote ?? ""}`;
+  return /<\s*(APIProxy|SharedFlowBundle)\b/i.test(said) || /^(apiproxy|sharedflowbundle)$/i.test(f.cite.value.trim()) || /(^|\/)(apiproxy|sharedflowbundle|sharedflows)\//.test(file);
+}
+function frameworksToLearn(facts, known = [], extra = []) {
   const have = new Set(known.map(declarationKey));
-  return frameworkFacts(facts).filter((f) => !frameworkOf(f.cite.value) && !have.has(declarationKey(f.name)) && !have.has(declarationKey(f.cite.value))).map((f) => ({
+  return frameworkFacts(facts).filter((f) => !isApigeeBundle(f) && !frameworkOf(f.cite.value, extra) && !have.has(declarationKey(f.name)) && !have.has(declarationKey(f.cite.value))).map((f) => ({
     id: f.id,
     framework: f.name,
     cite: `${f.cite.file}:${f.cite.line}`,
@@ -260,6 +356,88 @@ function frameworksToLearn(facts, known = []) {
   }));
 }
 
+// packages/verify/dist/reviewed.js
+var LINE_RANGE = /^(.+)#L(\d+)-L(\d+)$/;
+function lineRangeOf(path) {
+  const m = LINE_RANGE.exec(path);
+  return m ? { file: m[1], from: Number(m[2]), to: Number(m[3]) } : void 0;
+}
+var SHAPE = `{"path": "<file or glob>", "why": "..."}`;
+function parseReviewed(text) {
+  const entries = [];
+  const bad = [];
+  text.split(/\r?\n/).forEach((raw, i) => {
+    if (!raw.trim())
+      return;
+    const line = i + 1;
+    let json2;
+    try {
+      json2 = JSON.parse(raw);
+    } catch (e) {
+      bad.push({ line, raw, message: `line ${line} is not JSON: ${e.message}` });
+      return;
+    }
+    const o = json2;
+    const issues = [];
+    if (!o || typeof o !== "object" || Array.isArray(o))
+      issues.push("not an object");
+    else {
+      if (typeof o.path !== "string" || !o.path.trim())
+        issues.push("path: a file or glob");
+      if (typeof o.why !== "string" || !o.why.trim())
+        issues.push("why: why it holds nothing");
+      const extra = Object.keys(o).filter((k) => k !== "path" && k !== "why");
+      if (extra.length)
+        issues.push(`unknown keys: ${extra.join(", ")}`);
+    }
+    if (issues.length) {
+      bad.push({ line, raw, message: `line ${line} isn't ${SHAPE}: ${issues.join("; ")}` });
+      return;
+    }
+    const path = forwardSlashes(o.path.trim());
+    entries.push({ line, path, why: o.why.trim() });
+  });
+  return { entries, bad };
+}
+var isGlob = (path) => /[*?]/.test(path);
+
+// packages/verify/dist/conventions.js
+var SPEC_NAME = /(^|\/)[^/]*(openapi|swagger|asyncapi|api-docs)[^/]*\.(ya?ml|json|xml)$|\.oas\.(ya?ml|json)$/i;
+function notReadTest(folders) {
+  const multi = folders.filter((f) => f.includes("/"));
+  const multiRe = underFolders(multi);
+  const names = new Set(folders.filter((f) => !f.includes("/")).map((f) => f.toLowerCase()));
+  return {
+    test(path) {
+      if (multiRe.test(path))
+        return true;
+      const parts = path.split("/").slice(0, -1).map((x) => x.toLowerCase());
+      const src = parts.indexOf("src");
+      return parts.some((x, j) => names.has(x) && !(src >= 0 && j > src && BUILD_OUTPUT.has(x)));
+    }
+  };
+}
+function rulesOf(c) {
+  const folders = underFolders(c.apiSpecFolders, { tail: "(.+/)?[^/]+\\.(ya?ml|json)$" });
+  return {
+    apiSpec: new RegExp(`${SPEC_NAME.source}|${folders.source}`, "i"),
+    notProduct: underFolders(c.notProductFolders),
+    notRead: notReadTest(c.notReadFolders),
+    gatewayBundle: gatewayBundleTest(c.gatewayBundleFolders),
+    frameworks: c.frameworks
+  };
+}
+var DEFAULT_READ_RULES = rulesOf(DEFAULT_CONVENTIONS);
+var made = /* @__PURE__ */ new WeakMap();
+function readRulesOf(c) {
+  if (!c || c === DEFAULT_CONVENTIONS)
+    return DEFAULT_READ_RULES;
+  let r = made.get(c);
+  if (!r)
+    made.set(c, r = rulesOf(c));
+  return r;
+}
+
 // packages/verify/dist/apigee-policy.js
 var MAKES = {
   OAuthV1: ["oauth2"],
@@ -327,9 +505,77 @@ function authPolicyMismatch(auth, file, policy, lines) {
   return MAKES_NONE.has(found.element) ? found : void 0;
 }
 var authChecks = (auth) => CHECKS[auth] ?? auth;
+var bare = (p) => p.trim().replace(/\/+$/, "");
+function apigeePassThrough(o, file, lines, line, path) {
+  if (!bundleRootOf(file))
+    return false;
+  const p = path.trim();
+  const under4 = p.endsWith("/**") ? bare(p.slice(0, -3)) : void 0;
+  const near = lines.slice(Math.max(0, line - 2), line + 1);
+  const element = (tag) => near.flatMap((l) => {
+    const m = new RegExp(`<${tag}>\\s*([^<]*?)\\s*</${tag}>`).exec(l);
+    return m ? [m[1]] : [];
+  });
+  if (o.kind === "entry")
+    return under4 !== void 0 && element("BasePath").some((b) => bare(b) === under4);
+  if (!o.forwards)
+    return false;
+  const target = under4 ?? bare(p);
+  const urlPath = (u) => bare(u.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, ""));
+  return element("URL").some((u) => urlPath(u) === target) || element("Path").some((t) => bare(t) === target) || target === "" && near.some((l) => /<RouteRule[\s>]/.test(l));
+}
+
+// packages/verify/dist/call-security-lines.js
+var CLIENT_CERT = /client[-_ .]?cert|keystore|key[-_ .]?store|ssl[-_ .]?bundle|\.pfx\b|\.p12\b|pkcs12|\bpfx\b|\bp12\b/i;
+var CERT_AND_KEY = (l) => /\bcert\b/i.test(l) && /\bkey\b/i.test(l);
+var KINDS = {
+  "tls mtls": {
+    test: (l) => CLIENT_CERT.test(l) || CERT_AND_KEY(l),
+    needs: "a client certificate, a key store or an SSL bundle"
+  },
+  "tls tls": { test: (l) => /https|ssl|tls/i.test(l), needs: "https, SSL or TLS" },
+  "tls none": {
+    test: (l) => !/https:\/\//i.test(l) && (/http:\/\//i.test(l) || /\b(false|disabled?|insecure|plain-?text|off)\b/i.test(l)),
+    needs: "a plain http:// URL or a TLS switch set off"
+  },
+  "auth oauth2": {
+    test: (l) => /oauth|token|bearer|jwt|authori[sz]|client[-_ ]?credentials|access[-_ ]?token/i.test(l),
+    needs: "a token (OAuth, bearer, JWT or an Authorization header)"
+  },
+  "auth api-key": {
+    test: (l) => /api[-_ ]?key|apikey|x-api|subscription[-_ ]?key|[a-z0-9][-_]key\b/i.test(l),
+    needs: "a key"
+  },
+  "auth basic": {
+    test: (l) => /basic|password|passwd|username|credential/i.test(l),
+    needs: "a password or basic credentials"
+  },
+  "auth mtls": {
+    test: (l) => CLIENT_CERT.test(l) || CERT_AND_KEY(l),
+    needs: "a client certificate, a key store or an SSL bundle"
+  }
+};
+function securityLineKind(what, claim, lines) {
+  const k = KINDS[`${what} ${claim}`];
+  if (!k)
+    return void 0;
+  return lines.some((l) => k.test(l)) ? void 0 : k.needs;
+}
+function lineOfValue(lines, line, value) {
+  if (!lines)
+    return void 0;
+  const v = value.toLowerCase();
+  for (const n of [line, line - 1, line + 1]) {
+    const l = lines[n - 1];
+    if (l !== void 0 && l.toLowerCase().includes(v))
+      return l;
+  }
+  return lines[line - 1];
+}
 
 // packages/verify/dist/corrections.js
-function correctionFor(f, corrections) {
+function correctionFor(f, all2) {
+  const corrections = all2.filter((c) => c.action !== "link" && c.action !== "unlink");
   const at = (c) => c.target.kind === f.kind && c.target.file === f.cite.file && c.target.line === f.cite.line;
   const byId = corrections.filter((c) => c.fact === f.id && at(c));
   const byCite = corrections.filter((c) => at(c) && c.target.value === f.cite.value);
@@ -337,6 +583,10 @@ function correctionFor(f, corrections) {
   const moved = edited.filter((c) => (c.line ?? c.target.line) === f.cite.line);
   return [...byId, ...byCite, ...moved].sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : 0)[0];
 }
+function outsidePairingFor(f, all2) {
+  const newest = linksFor(f, all2)[0];
+  return newest?.link?.system ? newest : void 0;
+}
 function correctedFact(f, c) {
   const raw = JSON.parse(JSON.stringify(f));
   for (const [k, v] of Object.entries(c.set ?? {})) {
@@ -363,33 +613,64 @@ function applyCorrections(facts, corrections) {
   const applied = [];
   const used = /* @__PURE__ */ new Set();
   const stale = [];
-  for (const f of facts) {
-    const c = correctionFor(f, corrections);
-    if (!c) {
-      out.push(f);
+  const met = /* @__PURE__ */ new Set();
+  const withPairing = (f, as, over) => {
+    const p = outsidePairingFor(as, corrections);
+    if (!p)
+      return f;
+    if (over && over.at > p.at && over.set?.to !== void 0)
+      return f;
+    const fixed = correctedFact(f, { ...p, action: "edit", set: { to: p.link.system } });
+    if (typeof fixed === "string") {
+      stale.push({
+        correction: p,
+        why: "invalid",
+        message: `${p.by}'s pairing of ${f.kind} ${f.id} with ${p.link.system} doesn't make a fact (${fixed}); the call is kept as it was`
+      });
+      return f;
+    }
+    applied.push({ fact: f.id, action: "link", by: p.by });
+    return { ...fixed, conf: "inferred" };
+  };
+  for (const f0 of facts) {
+    for (const l of linksFor(f0, corrections))
+      met.add(l);
+    const c = correctionFor(f0, corrections);
+    if (c?.action === "wrong") {
+      used.add(c);
+      applied.push({ fact: f0.id, action: "wrong", by: c.by });
       continue;
     }
-    used.add(c);
-    if (c.action === "wrong") {
-      applied.push({ fact: f.id, action: "wrong", by: c.by });
+    if (!c) {
+      out.push(withPairing(f0, f0));
       continue;
     }
-    const fixed = correctedFact(f, c);
+    used.add(c);
+    const fixed = correctedFact(f0, c);
     if (typeof fixed === "string") {
       stale.push({
         correction: c,
         why: "invalid",
-        message: `${c.by}'s correction of ${f.kind} ${f.id} doesn't make a fact (${fixed}); the fact is kept as it was`
+        message: `${c.by}'s correction of ${f0.kind} ${f0.id} doesn't make a fact (${fixed}); the fact is kept as it was`
       });
-      out.push(f);
+      out.push(withPairing(f0, f0));
       continue;
     }
-    applied.push({ fact: f.id, action: "edit", by: c.by });
-    out.push(fixed);
+    applied.push({ fact: f0.id, action: "edit", by: c.by });
+    out.push(withPairing(fixed, f0, c));
   }
   for (const c of corrections) {
     if (used.has(c))
       continue;
+    if (c.action === "link" || c.action === "unlink") {
+      if (!met.has(c))
+        stale.push({
+          correction: c,
+          why: "none",
+          message: `${c.by}'s pairing of call ${c.fact} (${c.target.file}:${c.target.line}) with ${[c.link?.method, c.link?.path].filter(Boolean).join(" ")} on ${c.link?.repo ?? c.link?.system} meets no call in this read; it is kept in the file and applied when the call is read again`
+        });
+      continue;
+    }
     const replaced = [...used].some((u) => (u.fact === c.fact || u.target.value === c.target.value) && u.target.kind === c.target.kind && u.target.file === c.target.file && u.target.line === c.target.line);
     if (replaced || c.action === "wrong")
       continue;
@@ -1199,10 +1480,11 @@ function isLocaleBundle(path) {
 }
 var DATA_FILE_LINES = 2e3;
 var DATA_FILE_CHARS = 2e5;
+var API_SPEC = DEFAULT_READ_RULES.apiSpec;
 var DATA_EXT = /\.(json|xml)$/i;
 var KEEP_BIG = /(^|\/)(pom\.xml|package\.json|composer\.json|angular\.json|project\.json|nx\.json|lerna\.json|workspace\.json|tsconfig[^/]*\.json|jsconfig\.json|appsettings[^/]*\.json|launchSettings\.json|[^/]*(openapi|swagger|asyncapi|api-docs)[^/]*\.(json|xml)|[^/]*mapper[^/]*\.xml)$|(^|\/)(config|configuration|migrations?|db|database|changelogs?|liquibase|flyway)\//i;
-function isDataFile(path, lines) {
-  if (!DATA_EXT.test(path) || KEEP_BIG.test(path))
+function isDataFile(path, lines, rules = DEFAULT_READ_RULES) {
+  if (!DATA_EXT.test(path) || KEEP_BIG.test(path) || rules.apiSpec.test(path))
     return false;
   if (lines.length - (lines[lines.length - 1] === "" ? 1 : 0) > DATA_FILE_LINES)
     return true;
@@ -1252,66 +1534,502 @@ function pageRouteMatches(file, lines, exists, path) {
   return norm(route) === norm(path);
 }
 
-// packages/verify/dist/reviewed.js
-var SHAPE = `{"path": "<file or glob>", "why": "..."}`;
-function parseReviewed(text) {
-  const entries = [];
-  const bad = [];
-  text.split(/\r?\n/).forEach((raw, i) => {
-    if (!raw.trim())
+// packages/verify/dist/reachable.js
+var CODE = /\.(java|kt|kts|scala|groovy|cs|vb|fs|py|rb|go|rs|php|swift|ts|tsx|js|mjs|cjs|dart)$/i;
+var MODEL_DIR = /(^|\/)(models?|dtos?|payloads?|schemas?|pojos?|beans|viewmodels?)\//i;
+var MODEL_NAME = /(dto|request|response|payload|model|body)$/i;
+var MODEL_PART = /[._-](dto|model|schema|payload|request|response)\.[^/.]+$/i;
+var MAPS_TABLE = /@Entity\b|@Table\b|@Document\b|\[Table\(|__tablename__|models\.Model\b|@Entity\(|\bgorm\.Model\b/;
+var ROOT_PART = /[._-](controller|resolver|gateway|handlers?|router|routes?|consumer|listener|subscriber|client|publisher|producer|endpoints?)\.[^/.]+$/i;
+var CLIENT_NAME = /(client|gateway|publisher|producer|sender|feign|proxy|connector)$/i;
+var CLIENT_DIR = /(^|\/)(clients?|gateways?|integrations?|publishers?|producers?|outbound)\//i;
+var base = (path) => path.slice(path.lastIndexOf("/") + 1);
+var stem = (path) => {
+  const b = base(path);
+  const dot = b.indexOf(".");
+  return dot > 0 ? b.slice(0, dot) : b;
+};
+function isModelFile(path, text) {
+  if (!CODE.test(path) || readingRank(path) === 5)
+    return false;
+  if (!MODEL_DIR.test(path) && !MODEL_NAME.test(stem(path)) && !MODEL_PART.test(path))
+    return false;
+  return text === void 0 || !MAPS_TABLE.test(text);
+}
+var ENTRY_POINT_NAME = /(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|servlet|webhook|resolver)$/i;
+var ENTRY_POINT_DIR = /(^|\/)(controllers?|routes|routers|handlers|endpoints|listeners|consumers)\//i;
+var ENTRY_POINT_PART = /[._-](controller|resolver|handlers?|router|routes?|consumer|listener|subscriber|endpoints?)\.[^/.]+$/i;
+function isEntryPointFile(path) {
+  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+    return false;
+  return ENTRY_POINT_NAME.test(stem(path)) || ENTRY_POINT_DIR.test(path) || ENTRY_POINT_PART.test(path);
+}
+function isRootFile(path) {
+  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+    return false;
+  return readingRank(path) === 2 || isEntryPointFile(path) || ROOT_PART.test(path) || CLIENT_NAME.test(stem(path)) || CLIENT_DIR.test(path);
+}
+var DECLARES = /\b(?:class|record|interface|struct|enum|object)\s+([A-Za-z_][A-Za-z0-9_]*)|^\s*(?:export\s+)?(?:declare\s+)?type\s+([A-Za-z_][A-Za-z0-9_]*)/gm;
+var IDENT = /[A-Za-z_][A-Za-z0-9_]*/g;
+function declaredTypes(path, text) {
+  const out = [];
+  const s = stem(path);
+  if (/^[A-Z][A-Za-z0-9_]*$/.test(s))
+    out.push(s);
+  for (const m of text.matchAll(DECLARES)) {
+    const n = m[1] ?? m[2];
+    if (n && !out.includes(n))
+      out.push(n);
+  }
+  return out;
+}
+function identifiers(text) {
+  return [...new Set(text.match(IDENT) ?? [])];
+}
+var NOT_REACHED_WHY = "model classes no entry point, call or field fact reaches (ADR 0169): left out of the read; atticus map <repo> --models all reads them";
+function reachableModels(o) {
+  const texts = /* @__PURE__ */ new Map();
+  const textOf = (p) => {
+    if (!texts.has(p))
+      texts.set(p, o.read(p) ?? "");
+    return texts.get(p);
+  };
+  const ordered = readingOrder(o.paths);
+  const models = ordered.filter((p) => isModelFile(p, textOf(p))).sort();
+  const isModel = new Set(models);
+  const byName = /* @__PURE__ */ new Map();
+  const declared = /* @__PURE__ */ new Map();
+  for (const p of models) {
+    const names = declaredTypes(p, textOf(p));
+    declared.set(p, names);
+    for (const n of names)
+      byName.set(n, [...byName.get(n) ?? [], p]);
+  }
+  const known = new Set(o.paths);
+  const roots = [];
+  const addRoot = (p) => {
+    if (known.has(p) && !isModel.has(p) && !roots.includes(p))
+      roots.push(p);
+  };
+  const facts = o.facts ?? [];
+  const entries = o.from === "entries";
+  const calls2 = new Set(facts.filter((f) => f.kind === "call").map((f) => f.id));
+  for (const f of facts)
+    if (f.kind === "entry" || f.kind === "call" && !entries)
+      for (const p of citedFiles(f))
+        addRoot(p);
+  for (const p of ordered)
+    if (entries ? isEntryPointFile(p) : isRootFile(p))
+      addRoot(p);
+  const reached = /* @__PURE__ */ new Map();
+  const queue = [];
+  const reach = (names, from, own = []) => {
+    for (const n of names) {
+      if (own.includes(n))
+        continue;
+      for (const p of byName.get(n) ?? []) {
+        const r = reached.get(p);
+        if (r) {
+          if (r.from === from && !r.types.includes(n))
+            r.types.push(n);
+          continue;
+        }
+        reached.set(p, { path: p, types: [n], from });
+        queue.push(p);
+      }
+    }
+  };
+  for (const p of roots)
+    reach(identifiers(textOf(p)), p);
+  for (const f of facts) {
+    for (const p of citedFiles(f))
+      if (isModel.has(p) && !reached.has(p)) {
+        reached.set(p, { path: p, types: [...(declared.get(p) ?? []).slice(0, 1)], from: f.id });
+        queue.push(p);
+      }
+    if (f.kind === "field" && !(entries && calls2.has(f.owner)))
+      reach(identifiers([f.type ?? "", f.transform === "message type" ? f.name : ""].join(" ")), f.id);
+  }
+  const rooted = roots.length > 0 || reached.size > 0;
+  if (!rooted)
+    return {
+      rooted,
+      roots,
+      reached: models.map((p) => ({ path: p, types: declared.get(p) ?? [], from: "" })),
+      notReached: [],
+      models: models.length
+    };
+  for (let i = 0; i < queue.length; i++) {
+    const p = queue[i];
+    reach(identifiers(textOf(p)), p, declared.get(p));
+  }
+  return {
+    rooted,
+    roots,
+    reached: queue.map((p) => reached.get(p)),
+    notReached: models.filter((p) => !reached.has(p)),
+    models: models.length
+  };
+}
+
+// packages/verify/dist/method.js
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+function wordsOf(line) {
+  return line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
+}
+function methodOnLines(method, lines) {
+  const m = method.toLowerCase();
+  return lines.some((l) => wordsOf(l).includes(m));
+}
+var CHAIN_LINES = 8;
+var CONTINUES = /^\s*\??\./;
+function chainOf(file, line) {
+  const at = (n) => file?.[n - 1];
+  const cited = at(line);
+  if (cited === void 0)
+    return [];
+  const out = [cited];
+  for (let n = line, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n--) {
+    const above = at(n - 1);
+    if (above === void 0)
+      break;
+    out.push(above);
+  }
+  for (let n = line + 1, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n++)
+    out.push(at(n));
+  return out;
+}
+function methodUnseenOf(f, lines, factOf) {
+  if (f.kind !== "entry" && f.kind !== "call")
+    return void 0;
+  if (!f.method || !HTTP_METHODS.has(f.method.toUpperCase()))
+    return void 0;
+  const at = (file, line) => lines(file)?.[line - 1];
+  const route = f.kind === "call" && f.from ? factOf?.(f.from) : void 0;
+  const forwards = route?.kind === "entry" && route.method?.toUpperCase() === f.method.toUpperCase();
+  const looked = [
+    ...chainOf(lines(f.cite.file), f.cite.line),
+    at(f.cite.file, f.cite.line + 1),
+    ...(f.cite.with ?? []).map((p) => at(p.file, p.line)),
+    ...forwards ? [at(route.cite.file, route.cite.line), at(route.cite.file, route.cite.line + 1)] : []
+  ].filter((l) => l !== void 0);
+  if (methodOnLines(f.method, looked))
+    return void 0;
+  const cite2 = `${f.cite.file}:${f.cite.line}`;
+  const method = f.method.toUpperCase();
+  return {
+    id: f.id,
+    kind: f.kind,
+    method,
+    cite: cite2,
+    message: `${f.id} claims ${method}, which neither ${cite2}, the chain it is in, the next line, a cite.with line nor the route it forwards writes`
+  };
+}
+
+// packages/verify/dist/skipped.js
+function notReadForSkipped(path, rules = DEFAULT_READ_RULES) {
+  return rules.notRead.test(path);
+}
+var isCommentLine = (l) => /^\s*(\/\/|\/\*|\*|<!--|-- |#(?!\s*(region|endregion|if|elif|else|endif|define|undef|pragma|nullable|include|import)\b)(?!!))/.test(l);
+var IMPORT_LINE = /^\s*(import|export\s+[^=]*\bfrom\b|from\s+\S+\s+import|package|using|require|#\s*include|@import|@use|use|library)\b/;
+var IMPORT_CALL = /\brequire\s*\(|\bimport\s*\(|\bfrom\s+["'`]/;
+var NAMESPACE_LINE = /\bxmlns(:\w+)?\s*=|schemaLocation\s*=|<!DOCTYPE|^\s*<\?xml/i;
+var URL_RE = /\b(?:https?|wss?|grpcs?|amqps?):\/\/[^\s"'`<>()[\],;\\|^]+/gi;
+var STANDARD_HOST = /^(www\.)?(w3\.org|json-schema\.org|maven\.apache\.org|apache\.org|springframework\.org|java\.sun\.com|xmlns\.jcp\.org|purl\.org|opensource\.org|gnu\.org|schema\.org|schemas\.[^/]+|xmlns\.[^/]+|ietf\.org|tools\.ietf\.org|creativecommons\.org)$/i;
+var FS_ROOT = /^\/(usr|etc|var|tmp|bin|sbin|opt|home|dev|proc|sys|lib|lib64|mnt|root|Users|private|Library|System|Applications|Volumes)(\/|$)/;
+var FILE_EXT = /\.(m?js|cjs|jsx|tsx?|css|scss|less|png|jpe?g|gif|svg|ico|webp|bmp|woff2?|ttf|eot|otf|map|jar|war|ear|class|so|dll|exe|sh|bat|ps1|py|rb|txt|log|pem|crt|key|lock|ya?ml|properties|conf|ini|env|md|mp[34]|wav|pdf|zip|gz|tar)$/i;
+var PATH_SEG = "[A-Za-z0-9_.~{}$:<>*%@+=-]+";
+var PATH_RE = new RegExp(`^(?:\\$\\{[^}]+\\}|%s|\\{[A-Za-z_]+\\})?((?:\\/${PATH_SEG})+\\/?)$`);
+var NOT_TOPIC_LAST = new Set("com org net io dev app ai co uk de fr in jp us eu example internal local localhost test cloud corp lan svc java kt scala cs ts js json xml yml yaml properties html htm txt md sql proto csv log jar dll exe sh py rb go class png svg gif jpg css".split(" "));
+var NOT_TOPIC_FIRST = new Set("com org net io java javax jakarta android androidx kotlin kotlinx scala sun microsoft system google apache spring springframework management server logging hibernate jdk www".split(" "));
+var DOTTED_TOPIC = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*){2,}$/;
+var SEPARATED_NAME = /^[A-Za-z][A-Za-z0-9_]*([._:-][A-Za-z0-9_]+)+$/;
+var QUOTED = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
+var KEY_VALUE = /^\s*-?\s*["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*([^\s"'#]+)\s*$/;
+var ELEMENT_TEXT = /<([A-Za-z][\w:.-]*)[^>]*>([^<\s]+)<\/\1>/g;
+var wordsOf2 = (line) => line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
+var TOPIC_WORDS = /* @__PURE__ */ new Set([
+  "topic",
+  "topics",
+  "queue",
+  "queues",
+  "channel",
+  "channels",
+  "destination",
+  "destinations",
+  "exchange",
+  "exchanges"
+]);
+var topicContext = (line) => {
+  const w = wordsOf2(line);
+  return w.some((x) => TOPIC_WORDS.has(x)) || w.join(" ").includes("routing key");
+};
+var BUILD_KEY_WORDS = new Set("scm git gitlab github bitbucket repository repositories repo registry mirror mirrors nexus artifactory snapshot snapshots distribution maven npm nuget pypi sonar sonarqube jenkins ci".split(" "));
+var BUILD_BLOCK_TAG = /<(\/?)(repositories|repository|pluginRepositories|pluginRepository|snapshotRepository|distributionManagement|scm|mirrors|mirror|site)\b[^>]*?(\/?)>/gi;
+var BUILD_BLOCK_OPEN = /\b(repositories|publishing|pluginManagement|dependencyResolutionManagement)\s*\{/;
+var keysBefore = (prefix) => [
+  ...[...prefix.matchAll(/<([A-Za-z][\w:.-]*)/g)].map((m) => m[1]),
+  ...[...prefix.matchAll(/["']?([A-Za-z][\w.-]*)["']?\s*[:=]/g)].map((m) => m[1]),
+  ...[...prefix.matchAll(/\b([A-Za-z]\w*)\s*\{/g)].map((m) => m[1])
+];
+var isBuildUrl = (u, prefix) => /\.git\/?$/i.test(u) || /\bscm:\w+:$/i.test(prefix) || keysBefore(prefix).some((k) => wordsOf2(k).some((w) => BUILD_KEY_WORDS.has(w)));
+var HEADER_ARG = /header\w*\s*(?:\.\s*\w+\s*)?\(\s*(?:(?:value|name)\s*=\s*)?$/i;
+var isHeaderName = (s, prefix) => /^x-/i.test(s) || HEADER_ARG.test(prefix.replace(/["'`]$/, ""));
+var cleanUrl = (u) => u.replace(/[.:]+$/, "").replace(/^([a-z0-9+.-]+:\/\/)[^/@\s]+@/i, "$1<redacted>@");
+var hostOf = (u) => /^[a-z0-9+.-]+:\/\/([^/:?#]+)/i.exec(u)?.[1] ?? "";
+function pathOf(s) {
+  const m = PATH_RE.exec(s);
+  if (!m)
+    return void 0;
+  const p = m[1];
+  if (p.length < 2 || p.includes("//") || !/[A-Za-z]/.test(p))
+    return void 0;
+  if (FS_ROOT.test(p) || FILE_EXT.test(p))
+    return void 0;
+  return p;
+}
+function topicOf(s, context) {
+  if (DOTTED_TOPIC.test(s)) {
+    const parts = s.split(".");
+    if (!NOT_TOPIC_LAST.has(parts.at(-1)) && !NOT_TOPIC_FIRST.has(parts[0]))
+      return s;
+  }
+  if (context && SEPARATED_NAME.test(s) && !FILE_EXT.test(s)) {
+    const last = s.split(".").at(-1);
+    if (!s.includes(".") || !NOT_TOPIC_LAST.has(last))
+      return s;
+  }
+  return void 0;
+}
+function codeOf(raw, state) {
+  let s = raw;
+  let out = "";
+  for (; ; ) {
+    if (state.block) {
+      const close = state.block === "c" ? "*/" : "-->";
+      const i = s.indexOf(close);
+      if (i < 0)
+        return out;
+      s = s.slice(i + close.length);
+      state.block = void 0;
+    }
+    const m = /(^|\s)(\/\*|<!--)/.exec(s);
+    if (!m)
+      return out + s;
+    out += s.slice(0, m.index + m[1].length);
+    s = s.slice(m.index + m[0].length);
+    state.block = m[2] === "/*" ? "c" : "xml";
+  }
+}
+function candidatesIn(path, lines) {
+  const out = [];
+  const state = {};
+  let xmlDepth = 0;
+  let braceDepth = 0;
+  lines.forEach((raw, i) => {
+    const wasBlock = state.block !== void 0;
+    let code2 = codeOf(raw, state);
+    const inBuild = xmlDepth > 0 || braceDepth > 0;
+    for (const m of code2.matchAll(BUILD_BLOCK_TAG))
+      if (!m[3])
+        xmlDepth = Math.max(0, xmlDepth + (m[1] ? -1 : 1));
+    if (braceDepth > 0 || BUILD_BLOCK_OPEN.test(code2)) {
+      const from = braceDepth > 0 ? code2 : code2.slice(BUILD_BLOCK_OPEN.exec(code2).index);
+      braceDepth = Math.max(0, braceDepth + (from.match(/\{/g)?.length ?? 0) - (from.match(/\}/g)?.length ?? 0));
+    }
+    if (!code2.trim())
       return;
-    const line = i + 1;
-    let json2;
-    try {
-      json2 = JSON.parse(raw);
-    } catch (e) {
-      bad.push({ line, raw, message: `line ${line} is not JSON: ${e.message}` });
+    if (!wasBlock && isCommentLine(raw))
+      return;
+    if (IMPORT_LINE.test(code2) || IMPORT_CALL.test(code2) || NAMESPACE_LINE.test(code2))
       return;
+    code2 = code2.replace(/(^|[\s;,)}])\/\/.*$/, "$1").replace(/\s#\s.*$/, "");
+    const seen = /* @__PURE__ */ new Set();
+    const text = redactSecrets(cleanUrlIn(raw.trim())).slice(0, 200);
+    const add = (kind, value) => {
+      const key = `${kind} ${value}`;
+      if (seen.has(key))
+        return;
+      seen.add(key);
+      out.push({ line: i + 1, kind, value, text });
+    };
+    const context = topicContext(code2);
+    const urls = [];
+    const opened = inBuild || xmlDepth > 0 || braceDepth > 0;
+    for (const m of code2.matchAll(URL_RE)) {
+      const u = cleanUrl(m[0]);
+      const build = opened || isBuildUrl(u, code2.slice(0, m.index));
+      if (!build && !STANDARD_HOST.test(hostOf(u)))
+        add("url", u);
+      urls.push(m[0]);
     }
-    const o = json2;
-    const issues = [];
-    if (!o || typeof o !== "object" || Array.isArray(o))
-      issues.push("not an object");
-    else {
-      if (typeof o.path !== "string" || !o.path.trim())
-        issues.push("path: a file or glob");
-      if (typeof o.why !== "string" || !o.why.trim())
-        issues.push("why: why it holds nothing");
-      const extra = Object.keys(o).filter((k) => k !== "path" && k !== "why");
-      if (extra.length)
-        issues.push(`unknown keys: ${extra.join(", ")}`);
+    const strings2 = [...code2.matchAll(QUOTED)].map((m) => ({
+      s: m[2],
+      before: code2.slice(0, m.index + 1)
+    }));
+    const kv = KEY_VALUE.exec(code2);
+    if (kv)
+      strings2.push({ s: kv[2], before: "" });
+    for (const m of code2.matchAll(ELEMENT_TEXT))
+      strings2.push({ s: m[2], before: "" });
+    for (const { s, before } of strings2) {
+      if (urls.some((u) => s.includes(u) || u.includes(s)))
+        continue;
+      const p = pathOf(s);
+      if (p) {
+        add("path", p);
+        continue;
+      }
+      const t = topicOf(s, context);
+      if (t && !isHeaderName(t, before))
+        add("topic", t);
     }
-    if (issues.length) {
-      bad.push({ line, raw, message: `line ${line} isn't ${SHAPE}: ${issues.join("; ")}` });
+  });
+  return out;
+}
+var cleanUrlIn = (line) => line.replace(/\b([a-z0-9+.-]+:\/\/)[^/@\s"'`]+@/gi, "$1<redacted>@");
+var normPath = (p) => normalizePath(p.replace(/(^|\/)%[sd](?=\/|$)/g, "$1{}"));
+function indexFacts(facts) {
+  const at = /* @__PURE__ */ new Set();
+  const strings2 = /* @__PURE__ */ new Set();
+  const walk = (v) => {
+    if (typeof v === "string") {
+      if (v.length >= 3)
+        strings2.add(v);
       return;
     }
-    entries.push({ line, path: o.path.trim(), why: o.why.trim() });
-  });
-  return { entries, bad };
+    if (Array.isArray(v))
+      return v.forEach(walk);
+    if (v && typeof v === "object") {
+      const o = v;
+      if (typeof o.file === "string" && typeof o.line === "number")
+        at.add(`${o.file}:${o.line}`);
+      Object.values(o).forEach(walk);
+    }
+  };
+  facts.forEach(walk);
+  const paths = /* @__PURE__ */ new Set();
+  for (const s of strings2) {
+    if (/\s/.test(s))
+      continue;
+    const u = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s);
+    const p = u ? u[1] : s.includes("/") ? s : void 0;
+    if (p && p.length > 1)
+      paths.add(`${normPath(p)}/`);
+  }
+  return { at, strings: [...strings2].map((s) => s.toLowerCase()), paths: [...paths] };
+}
+function factsCover(file, c, ix) {
+  if ([c.line - 1, c.line, c.line + 1].some((n) => ix.at.has(`${file}:${n}`)))
+    return true;
+  if (c.kind === "path") {
+    const p = `${normPath(c.value)}/`;
+    return ix.paths.some((f) => f.includes(p));
+  }
+  const v = c.value.toLowerCase().replace(/\/+$/, "");
+  return ix.strings.some((s) => s.includes(v));
+}
+var skippedOf = (file, c) => ({
+  cite: `${file}:${c.line}`,
+  kind: c.kind,
+  value: c.value,
+  text: c.text
+});
+var SPEC_MARK = /^\s*["']?(openapi|swagger)["']?\s*:/m;
+var SPEC_EXT = /\.(ya?ml|json)$/i;
+function specOpsUncoveredIn(file, text, facts) {
+  if (!SPEC_EXT.test(file) || !SPEC_MARK.test(text.slice(0, 4e3)))
+    return void 0;
+  let doc;
+  try {
+    doc = readOpenApiDocument(text);
+  } catch {
+    return void 0;
+  }
+  if (!doc || !doc.operations.length)
+    return void 0;
+  const server = (() => {
+    const s = doc.servers[0];
+    if (!s)
+      return "";
+    const p = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s)?.[1] ?? (s.startsWith("/") ? s : "");
+    return p.replace(/\/+$/, "");
+  })();
+  const entries = facts.filter((f) => f.kind === "entry");
+  const atLines = /* @__PURE__ */ new Set();
+  for (const e of entries)
+    for (const k of indexFacts([e]).at)
+      atLines.add(k);
+  const out = [];
+  for (const op of doc.operations) {
+    const lines = [op.methodLine, op.line].filter((n) => n !== void 0);
+    if (lines.some((n) => [n - 1, n, n + 1].some((x) => atLines.has(`${file}:${x}`))))
+      continue;
+    const method = op.method.toUpperCase();
+    const own = normPath(op.path);
+    const full = normPath(`${server}${op.path}`);
+    const covered = entries.some((e) => {
+      if (e.method && e.method.toUpperCase() !== method)
+        return false;
+      const p = normPath(e.path);
+      return p === own || p === full || p.endsWith(own) || p.split("/").length > 2 && own.endsWith(p);
+    });
+    if (covered)
+      continue;
+    const opId = op.node?.get?.("operationId");
+    const line = op.methodLine ?? op.line ?? 1;
+    out.push({
+      spec: file,
+      method,
+      path: op.path,
+      ...typeof opId === "string" ? { operationId: opId } : {},
+      cite: `${file}:${line}`,
+      message: `${file}:${line} declares ${method} ${op.path}${typeof opId === "string" ? ` (${opId})` : ""}, which no entry covers`
+    });
+  }
+  return out;
+}
+var REVIEWED_HOLDS_SHOWN = 5;
+function reviewedHoldsOf(r, skipped) {
+  const n = skipped.length;
+  const first = skipped.slice(0, 3).map((s) => `${s.cite} (${s.value})`);
+  return {
+    path: r.path,
+    why: r.why,
+    count: n,
+    skipped: skipped.slice(0, REVIEWED_HOLDS_SHOWN),
+    message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} is reviewed as holding nothing to record, but ${n} ${n === 1 ? "line in it writes" : "lines in it write"} a path, URL or topic: ${first.join(", ")}${n > 3 ? ` and ${n - 3} more` : ""}`
+  };
 }
-var isGlob = (path) => /[*?]/.test(path);
 
 // packages/verify/dist/verify.js
 var FOLLOWED_TYPES = ["event-topic", "mq-queue", "rest", "grpc"];
-function entriesNoFlowFollows(facts) {
+function entriesNoFlowFollows(facts, rules = DEFAULT_READ_RULES) {
   const started = new Set(facts.flatMap((f) => f.kind === "flow" ? [f.entry] : []));
-  return facts.flatMap((f) => f.kind === "entry" && FOLLOWED_TYPES.includes(f.entryType) && !started.has(f.id) && // An Apigee route forwards; its forwarding call is its flow (ADR 0124 addendum A-gateway).
-  !APIGEE_BUNDLE.test(f.cite.file) ? [
-    {
-      id: f.id,
-      entryType: f.entryType,
-      ...f.method ? { method: f.method } : {},
-      path: f.path,
-      cite: `${f.cite.file}:${f.cite.line}`
-    }
-  ] : []).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  const forwarded = new Set(facts.flatMap((f) => f.kind === "call" && f.from ? [f.from] : []));
+  return facts.flatMap((f) => {
+    if (f.kind !== "entry" || !FOLLOWED_TYPES.includes(f.entryType))
+      return [];
+    const route = rules.gatewayBundle.test(f.cite.file);
+    if (route ? forwarded.has(f.id) : started.has(f.id))
+      return [];
+    return [
+      {
+        id: f.id,
+        entryType: f.entryType,
+        ...f.method ? { method: f.method } : {},
+        path: f.path,
+        cite: `${f.cite.file}:${f.cite.line}`,
+        ...route ? { route: true } : {}
+      }
+    ];
+  }).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
 }
 var LINES_HELD = 64;
 var SOURCE_EXT = /\.(java|kt|kts|scala|groovy|cs|vb|fs|ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|php|swift|m|mm|c|cc|cpp|h|hpp|sql|graphql|gql|proto|ya?ml|json|xml|properties|toml|ini|conf|tf|tfvars|hcl|bicep|sh|ps1|bat|cmd|gradle|html?|vue|svelte|cshtml|razor|aspx|jsp|ftl|hbs|cob|cbl|cpy|jcl|avsc|wsdl|xsd|csproj|sln|config)$/i;
 var SOURCE_NAME = /(^|\/)(Dockerfile[^/]*|Makefile|Jenkinsfile|Procfile|Containerfile)$/;
 var LOCKFILE = /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|Gemfile\.lock|Cargo\.lock|poetry\.lock|go\.sum|packages\.lock\.json)$/;
 var NOT_PRODUCT = [
-  /(^|\/)(src\/test|src\/it|test|tests|__tests__|__mocks__|spec|specs|e2e|testdata|test-data|fixtures)\//i,
   /(\.|_|-)(test|spec|tests|specs)\.[a-z0-9]+$/i,
   /(Test|Tests|IT|Spec)\.(java|kt|scala|groovy|cs|vb)$/,
   /(^|\/)test_[^/]+\.py$/,
@@ -1320,19 +2038,44 @@ var NOT_PRODUCT = [
   /(^|\/)messages(_[A-Za-z_]+)?\.properties$/,
   /\.(resx|po|pot)$/i
 ];
-function isSourceFile(path, firstLine = "", lines) {
+function isSourceFile(path, firstLine = "", lines, rules = DEFAULT_READ_RULES) {
   if (isSecretPath(path) || LOCKFILE.test(path))
     return false;
-  if (NOT_PRODUCT.some((re) => re.test(path)) || isLocaleBundle(path))
+  if (rules.notProduct.test(path) || NOT_PRODUCT.some((re) => re.test(path)))
     return false;
-  if (lines && isDataFile(path, lines))
+  if (isLocaleBundle(path))
+    return false;
+  if (lines && isDataFile(path, lines, rules))
     return false;
   if (quoteNotRequired(path, firstLine))
     return false;
+  if (isLfsPointer(firstLine))
+    return false;
+  if (isBinaryText(firstLine) || lines && binaryLines(lines))
+    return false;
   return SOURCE_EXT.test(path) || SOURCE_NAME.test(path);
 }
+function binaryLines(lines) {
+  let n = 0;
+  for (const l of lines) {
+    if (isBinaryText(l))
+      return true;
+    if ((n += l.length + 1) > 8e3)
+      return false;
+  }
+  return false;
+}
 var lastPart = (s) => s.split(".").pop() ?? s;
-var isCommentLine = (l) => /^\s*(\/\/|\/\*|\*|<!--|-- |#(?!\s*(region|endregion|if|elif|else|endif|define|undef|pragma|nullable|include|import)\b)(?!!))/.test(l);
+var TEMPLATED = /\{\{|\}\}|\$\{/;
+function pathIsAName(path) {
+  const p = (path ?? "").trim().replace(/\(\s*[^)]*\)$/, "");
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(p) && /[a-z][A-Z]|_|\$/.test(p);
+}
+var serviceAddress = (f) => f.host !== void 0 && /^service$/i.test(f.resourceType ?? "") ? clusterServiceAddress(f.host) : void 0;
+var repoModule = (exposes) => {
+  const m = /^([^/]+)\/([^/]+)$/.exec(exposes.trim());
+  return m ? { repo: m[1], module: m[2] } : void 0;
+};
 var routeOrWord = (v) => v.includes("/") ? { kind: "route", value: v } : { kind: "word", value: v };
 function claimsOf(f) {
   switch (f.kind) {
@@ -1368,6 +2111,12 @@ function claimsOf(f) {
     }
     case "flow":
       return [routeOrWord(f.cite.value)];
+    // ADR 0163: the value as written, on its line.
+    case "term":
+      return [{ kind: "word", value: f.value }];
+    // ADR 0180: the signal the type rests on, as written on its line.
+    case "component":
+      return [{ kind: "word", value: f.cite.value }];
   }
 }
 var sameCommit = (a, b) => a.startsWith(b) || b.startsWith(a);
@@ -1402,11 +2151,47 @@ function refsOf(f) {
   }
   return out;
 }
+function withCanonicalFiles(f, canonical) {
+  const walk = (x) => {
+    if (Array.isArray(x)) {
+      const out2 = x.map(walk);
+      return out2.some((v, i) => v !== x[i]) ? out2 : x;
+    }
+    if (!x || typeof x !== "object")
+      return x;
+    const o = x;
+    let out;
+    for (const [k, v] of Object.entries(o)) {
+      const w = k === "file" && typeof v === "string" && typeof o.line === "number" ? canonical(v) : walk(v);
+      if (w !== v)
+        (out ??= { ...o })[k] = w;
+    }
+    return out ?? o;
+  };
+  return walk(f);
+}
 async function verifyFacts(o) {
+  const rules = readRulesOf(o.conventions);
   const carriedFrom = /* @__PURE__ */ new Map();
   const stale = /* @__PURE__ */ new Map();
   const corrected = applyCorrections(o.facts, o.corrections ?? []);
-  const facts = [...corrected.facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((f) => {
+  let fileList;
+  const listed2 = () => fileList ??= o.source.list();
+  let listedSet;
+  let folded;
+  const fold = (p) => p.replace(/\\/g, "/").toLowerCase();
+  const canonical = (path) => {
+    listedSet ??= new Set(listed2());
+    if (listedSet.has(path))
+      return path;
+    if (!folded) {
+      folded = /* @__PURE__ */ new Map();
+      for (const p of listed2())
+        folded.set(fold(p), folded.has(fold(p)) ? null : p);
+    }
+    return folded.get(fold(path)) ?? path;
+  };
+  const facts = [...corrected.facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((f) => withCanonicalFiles(f, canonical)).map((f) => {
     if (!o.commit || sameCommit(f.commit, o.commit))
       return f;
     const changes = changesFor(o.carry, f.commit);
@@ -1421,7 +2206,8 @@ async function verifyFacts(o) {
     return { ...f, commit: o.commit };
   });
   const readLines = (path) => {
-    const text = insideRepo(path) && !isSecretPath(path) ? o.source.read(path) : void 0;
+    listedSet ??= new Set(listed2());
+    const text = insideRepo(path) && !isSecretPath(path) && listedSet.has(path) ? o.source.read(path) : void 0;
     return text === void 0 ? void 0 : text.replace(/\r\n?/g, "\n").split("\n");
   };
   const linesCache = /* @__PURE__ */ new Map();
@@ -1438,9 +2224,8 @@ async function verifyFacts(o) {
       linesCache.delete(linesCache.keys().next().value);
     return lines;
   };
-  let fileList;
-  const deriveEnv = { lines: linesOf2, files: () => fileList ??= o.source.list() };
-  const checkCite = (cite2, claims, label, withHint = true) => {
+  const deriveEnv = { lines: linesOf2, files: listed2 };
+  const checkCite = (cite2, claims, label, withHint = true, alsoHolds) => {
     const where = `${cite2.file}:${cite2.line}`;
     if (!insideRepo(cite2.file))
       return {
@@ -1504,7 +2289,7 @@ async function verifyFacts(o) {
     ].flatMap((at) => derivedNamesAt(at.file, linesOf2(at.file) ?? [], at.line, deriveEnv));
     const holds = (c) => claimOnLines(lines, cite2.line, c) || // a framework that routes by file place (Razor Pages, WebForms, Next.js)
     c.kind === "route" && pageRouteMatches(cite2.file, lines, (p) => linesOf2(p) !== void 0, c.value) || parts.length > 0 && (c.kind === "route" ? partsNamePath([...near(lines, cite2.line), ...partLines], c.value) : partLines.some((l) => lineNamesClaim(l, c)) || // a word put together from parts (`namespace:task`, a key a helper prefixes)
-    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines, cite2.line))) || derivedHolds(c, derivedHere(), partLines, partsNamePath);
+    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines, cite2.line))) || o.derivedNames !== false && derivedHolds(c, derivedHere(), partLines, partsNamePath) || alsoHolds !== void 0 && alsoHolds(lines, cite2.line);
     if (claims && !claims.some(holds))
       return {
         code: "claim-not-on-line",
@@ -1541,6 +2326,9 @@ async function verifyFacts(o) {
       return value.includes("/") ? [routeOrWord(value), { kind: "word", value }] : [routeOrWord(value)];
     return NEVER_CHECKED_STEPS.includes(kind) ? void 0 : [routeOrWord(value)];
   };
+  const estate = o.estate ? new Set(o.estate.components.map(factIdPart)) : void 0;
+  const serves2 = facts.some((f) => f.kind === "entry");
+  const repoComponents = new Map(Object.entries(o.estate?.repoComponents ?? {}).map(([r, cs]) => [factIdPart(r), new Set(cs.map(factIdPart))]));
   for (const f of facts) {
     const label = `${f.kind} ${f.id}`;
     if (o.commit && !sameCommit(f.commit, o.commit)) {
@@ -1554,7 +2342,7 @@ async function verifyFacts(o) {
         problem(f, "wrong-commit", `${label} was read at ${f.commit}, not at ${o.commit}; read it again`);
       continue;
     }
-    add(f, checkCite(f.cite, claimsOf(f), label));
+    add(f, checkCite(f.cite, claimsOf(f), label, true, f.kind === "entry" || f.kind === "call" ? (ls, n) => apigeePassThrough({ kind: f.kind, forwards: f.kind === "call" && !!f.from }, f.cite.file, ls, n, f.path) : void 0));
     if (f.kind === "entry" && f.authCite)
       add(f, checkCite({ ...f.authCite }, [{ kind: "word", value: f.authCite.value }], `${label} authCite${f.auth ? ` (auth ${f.auth})` : ""}`, false));
     if (f.kind === "entry" && f.authCite && f.auth) {
@@ -1566,8 +2354,80 @@ async function verifyFacts(o) {
       (f.scopes ?? []).forEach((s, i) => add(f, checkCite(s, [{ kind: "word", value: s.value }], `${label} scope ${i + 1} ("${s.value}")`)));
     if (f.kind === "entry")
       (f.callers ?? []).forEach((c, i) => add(f, checkCite(c, [{ kind: "word", value: c.value }], `${label} caller ${i + 1} (${c.as} "${c.value}")`)));
+    if (f.kind === "call" && (f.callType === "rest" || f.callType === "soap") && pathIsAName(f.path))
+      problem(f, "call-path-is-a-name", `${label} path "${f.path}" is the name of what holds the path, not the path: follow it to where it is set and write the literal path, or the setting's placeholder with its whole key (\`\${forge.uris.refund}\`) with the line that sets it in cite.with, and record the setting as a config fact`);
+    if (f.kind === "deploy" && (f.host !== void 0 || f.basePath !== void 0)) {
+      if (f.host !== void 0 && TEMPLATED.test(f.host))
+        problem(f, "exposure-template", `${label} host "${f.host}" is a template: give the host the values file sets, with that line in cite.with (one fact per environment's values file, each with its env)`);
+      else if (f.host !== void 0 && serviceAddress(f) !== void 0) {
+        const a = serviceAddress(f);
+        const parts = [
+          ["name", a.name],
+          ["namespace", a.namespace],
+          ...a.port !== void 0 ? [["port", String(a.port)]] : []
+        ];
+        for (const [what, value] of parts)
+          add(f, checkCite(f.cite, [{ kind: "word", value }], `${label} host's ${what}`, false));
+      } else if (f.host !== void 0)
+        add(f, checkCite(f.cite, [{ kind: "word", value: f.host }], `${label} host`, false));
+      if (f.basePath !== void 0 && isPatternPath(f.basePath))
+        problem(f, "exposure-regex", `${label} basePath "${f.basePath}" is a regular expression: write its plain prefix, "${plainPathPrefix(f.basePath)}" (the segments before the first pattern), and keep the line that writes the expression cited`);
+      else if (f.basePath !== void 0)
+        add(f, checkCite(f.cite, [routeOrWord(f.basePath), { kind: "word", value: f.basePath }], `${label} basePath`, false));
+      const inModule = f.exposes !== void 0 ? repoModule(f.exposes) : void 0;
+      if (inModule && estate && estate.has(factIdPart(inModule.repo))) {
+        const known = repoComponents.get(factIdPart(inModule.repo));
+        if (known && !known.has(factIdPart(inModule.module)))
+          problem(f, "exposure-component", `${label} exposes "${f.exposes}": ${inModule.repo}'s facts name no component ${inModule.module} (they name ${[...known].sort().join(", ")}); name the module as its facts do, or write a question when no file says which`);
+      } else if (f.exposes !== void 0 && estate && !estate.has(factIdPart(inModule?.repo ?? f.exposes)))
+        problem(f, "exposure-component", `${label} exposes "${f.exposes}", which is no component or repo of the estate (repos.manifest.yaml): name the component the route reaches, or write a question when no file says which`);
+      if (f.exposes === void 0 && !serves2)
+        problem(f, "exposure-component", `${label} says where a component is reached and names none: this repo's facts serve nothing, so its routes reach another repo's component; name it in exposes (one of the estate's components), or write a question when no file says which`);
+    }
+    if (f.kind === "call") {
+      for (const [what, claim, at] of [
+        ["auth", f.auth, f.authCite],
+        ["tls", f.tls, f.tlsCite]
+      ]) {
+        if (claim !== void 0 && !at && f.by !== "person")
+          problem(f, "security-uncited", `${label} claims ${what} ${claim} and cites no line for it: give ${what}Cite, the line that sets it (a client certificate, a token, an https URL) and what it writes there, or leave ${what} out`);
+        if (!at)
+          continue;
+        const bad = checkCite({ ...at }, [{ kind: "word", value: at.value }], `${label} ${what}Cite${claim ? ` (${what} ${claim})` : ""}`, false);
+        add(f, bad);
+        if (bad || claim === void 0)
+          continue;
+        const lines = [at, ...at.with ?? []].flatMap((p) => {
+          const l = lineOfValue(linesOf2(p.file), p.line, p.value);
+          return l === void 0 ? [] : [l];
+        });
+        const needs = securityLineKind(what, claim, lines);
+        if (needs)
+          problem(f, "security-line-kind", `${label} claims ${what} ${claim} at ${at.file}:${at.line}${at.with?.length ? " and its parts" : ""}, which write${at.with?.length ? "" : "s"} no ${needs}: cite the line that sets it (with the line that builds it in ${what}Cite.with), or write the ${what} the line sets`);
+      }
+    }
+    if (f.kind === "term") {
+      const m = f.meaning;
+      if (m && m.file !== f.cite.file)
+        problem(f, "term-meaning", `${label} says ${m.file}:${m.line} gives "${f.value}" its meaning, and the value is in ${f.cite.file}: cite the line of the same file (the list's or the block's key) that does`);
+      else if (m && m.line > f.cite.line)
+        problem(f, "term-meaning", `${label} says line ${m.line} gives "${f.value}" its meaning, below the value's line ${f.cite.line}: cite the line above it (the list's or the block's key) that does`);
+      else if (m)
+        add(f, checkCite({ ...m }, [{ kind: "word", value: m.value }], `${label} meaning`, false));
+      const bad = f.note !== void 0 && o.notes ? noteProblem(f.note, o.notes) : void 0;
+      if (bad)
+        problem(f, bad.code, `${label} ${bad.message}`);
+    }
+    if (f.kind === "component") {
+      if (o.componentTypes && !o.componentTypes.has(f.type))
+        problem(f, "component-type", `${label} says the component is a ${f.type}, which isn't one of the organisation's component types: add it (org-pack/component-types/${f.type}/type.yaml) or say one of ${[...o.componentTypes].join(", ")}`);
+      const subject = factIdPart(f.component ?? f.repo);
+      const first = facts.find((x) => x.kind === "component" && factIdPart(x.component ?? x.repo) === subject && (x === f || !found.has(x.id)));
+      if (first && first !== f)
+        problem(f, "component-type", `${label} says what ${subject} is a second time (${first.id} already does): one fact says what a component is`);
+    }
     if (f.kind === "framework") {
-      const bad = frameworkNameProblem(f);
+      const bad = frameworkNameProblem(f, rules.frameworks);
       if (bad)
         problem(f, "framework-name", `${label} ${bad}`);
       if (f.version !== void 0)
@@ -1656,36 +2516,49 @@ async function verifyFacts(o) {
       return rest;
     }
     const q = redactSecrets(c.quote);
+    if (q === c.quote && quoteHoldsSecret(q)) {
+      redacted++;
+      const { quote: _secret, ...rest } = c;
+      return rest;
+    }
     if (q !== c.quote)
       redacted++;
     return { ...c, quote: q };
   };
   const authUncited = [];
+  const methodUnseen = [];
+  const kept = new Map(facts.filter((f) => !rejected.has(f.id)).map((f) => [f.id, f]));
+  const factById = (id) => kept.get(id);
   const accepted = facts.filter((f) => !rejected.has(f.id)).map((f) => {
     o.room?.();
     const verified = f.by === "person" && f.verified !== "none" ? f.verified : "line";
-    const base = { ...f, verified, cite: fixQuote(f.cite) };
-    if (base.kind === "entry" && base.auth !== void 0 && !base.authCite && f.by !== "person")
+    const base2 = { ...f, verified, cite: fixQuote(f.cite) };
+    if (base2.kind === "entry" && base2.auth !== void 0 && !base2.authCite && f.by !== "person")
       authUncited.push({
-        id: base.id,
-        auth: base.auth,
-        cite: `${base.cite.file}:${base.cite.line}`
+        id: base2.id,
+        auth: base2.auth,
+        cite: `${base2.cite.file}:${base2.cite.line}`
       });
-    if (base.kind === "flow")
+    const unseen = methodUnseenOf(base2, linesOf2, factById);
+    if (unseen)
+      methodUnseen.push(unseen);
+    if (base2.kind === "flow")
       return {
-        ...base,
-        steps: base.steps.map((s) => ({ ...s, cite: fixQuote(s.cite) })),
-        errors: base.errors.map((e) => ({ ...e, cite: fixQuote(e.cite) }))
+        ...base2,
+        steps: base2.steps.map((s) => ({ ...s, cite: fixQuote(s.cite) })),
+        errors: base2.errors.map((e) => ({ ...e, cite: fixQuote(e.cite) }))
       };
-    return base;
+    return base2;
   });
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
   const sources = [];
   const excluded = [];
   for (const p of o.source.list()) {
     o.room?.();
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
+      continue;
     const ls = readLines(p) ?? [""];
-    if (!isSourceFile(p, ls[0] ?? "", ls))
+    if (!isSourceFile(p, ls[0] ?? "", ls, rules))
       continue;
     if (excludeRes.some((re) => re.test(p)))
       excluded.push(p);
@@ -1701,6 +2574,8 @@ async function verifyFacts(o) {
   const reviewedSet = /* @__PURE__ */ new Set();
   const reviewed = [];
   const reviewedProblems = [];
+  const reviewedDropped = [];
+  const reviewedGlobs = [];
   for (const r of o.reviewed ?? []) {
     const refuse = (message) => reviewedProblems.push({
       ...r.line !== void 0 ? { line: r.line } : {},
@@ -1716,36 +2591,105 @@ async function verifyFacts(o) {
       refuse("is a secret's file, which is never read into a map");
       continue;
     }
-    const re = isGlob(r.path) ? globToRegExp(r.path) : void 0;
-    const matched = re ? allFiles.filter((p) => re.test(p)) : allFiles.filter((p) => p === r.path);
+    const range = lineRangeOf(r.path);
+    if (range) {
+      const text = allFiles.includes(range.file) ? o.source.read(range.file) : void 0;
+      if (text === void 0) {
+        refuse("is not in the repo at this commit; name a file you read");
+        continue;
+      }
+      const last = text.split(/\r?\n/).length;
+      if (range.from < 1 || range.from > range.to || range.to > last) {
+        refuse(`is past the file's last line (${last}) or out of order; name the lines you read`);
+        continue;
+      }
+    }
+    const target = range ? range.file : r.path;
+    const re = !range && isGlob(r.path) ? globToRegExp(r.path) : void 0;
+    const matched = re ? allFiles.filter((p) => re.test(p)) : allFiles.filter((p) => p === target);
     if (!matched.length) {
-      refuse(re ? "matches no file in the repo at this commit; name the files you read" : "is not in the repo at this commit; name a file you read");
+      if (re)
+        reviewedDropped.push({
+          ...r.line !== void 0 ? { line: r.line } : {},
+          path: r.path,
+          why: r.why,
+          message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} matches no file in the repo at this commit; dropped (it stands for no file)`
+        });
+      else
+        refuse("is not in the repo at this commit; name a file you read");
+      continue;
+    }
+    const entryPoints = re ? matched.filter((p) => isSource.has(p) && !touched.has(p) && isEntryPointFile(p)) : [];
+    if (entryPoints.length) {
+      refuse(`covers ${entryPoints[0]}, an entry point (a controller, route, handler or listener)${entryPoints.length > 1 ? ` and ${entryPoints.length - 1} more` : ""} no fact cites: read it, and write its entries and the fields of the classes it takes and returns; never mark an entry point reviewed with a glob (name it alone if it truly holds nothing)`);
       continue;
     }
     const files = matched.filter((p) => isSource.has(p) && !touched.has(p)).sort();
     for (const p of files)
       reviewedSet.add(p);
     reviewed.push({ path: r.path, why: r.why, files });
+    if (re)
+      reviewedGlobs.push({ entry: r, files });
   }
   const read = sources.filter((p) => touched.has(p)).sort();
   const reviewedFiles = sources.filter((p) => reviewedSet.has(p)).sort();
-  const unknown = sources.filter((p) => !touched.has(p) && !reviewedSet.has(p)).sort();
+  const leftOut = new Set(o.notReached ?? []);
+  const notReached = sources.filter((p) => leftOut.has(p) && !touched.has(p) && !reviewedSet.has(p)).sort();
+  const unknown = sources.filter((p) => !touched.has(p) && !reviewedSet.has(p) && !leftOut.has(p)).sort();
   const total = read.length + reviewedFiles.length + unknown.length;
   const ratio = total === 0 ? 1 : Math.round(read.length / total * 1e3) / 1e3;
+  const ix = indexFacts(accepted);
+  const specOpsUncovered = [];
+  const specs = /* @__PURE__ */ new Set();
+  for (const p of sources) {
+    if (notReadForSkipped(p, rules))
+      continue;
+    o.room?.();
+    const text = o.readers !== false && /\.(ya?ml|json)$/i.test(p) ? o.source.read(p) : void 0;
+    const ops = text === void 0 ? void 0 : specOpsUncoveredIn(p, text, accepted);
+    if (!ops)
+      continue;
+    specs.add(p);
+    specOpsUncovered.push(...ops);
+  }
+  const skippedIn = (p) => {
+    if (specs.has(p) || notReadForSkipped(p, rules))
+      return [];
+    o.room?.();
+    const ls = readLines(p);
+    return ls ? candidatesIn(p, ls).flatMap((c) => factsCover(p, c, ix) ? [] : [skippedOf(p, c)]) : [];
+  };
+  const skipped = read.flatMap(skippedIn);
+  const reviewedHolds = reviewedGlobs.flatMap(({ entry, files }) => {
+    const held = files.flatMap(skippedIn);
+    return held.length ? [reviewedHoldsOf(entry, held)] : [];
+  });
   return {
     accepted,
     // a rejected fact goes back as it was read, at its own commit, even one that was carried
     rejected: [...rejected.values()].map((r) => carriedFrom.has(r.fact.id) ? { ...r, fact: { ...r.fact, commit: carriedFrom.get(r.fact.id) } } : r).sort((a, b) => a.fact.id < b.fact.id ? -1 : a.fact.id > b.fact.id ? 1 : 0),
-    coverage: { read, reviewed: reviewedFiles, unknown, excluded: excluded.sort(), ratio },
+    coverage: {
+      read,
+      reviewed: reviewedFiles,
+      unknown,
+      excluded: excluded.sort(),
+      notReached,
+      ratio
+    },
     redacted,
     quotesDropped,
     carried: accepted.flatMap((f) => carriedFrom.has(f.id) ? [{ id: f.id, from: carriedFrom.get(f.id) }] : []),
     corrections: { applied: corrected.applied, stale: corrected.stale },
-    entriesNoFlowFollows: entriesNoFlowFollows(accepted),
+    entriesNoFlowFollows: entriesNoFlowFollows(accepted, rules),
     reviewed,
     reviewedProblems,
+    reviewedDropped,
     authUncited: authUncited.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0),
-    frameworkGaps: frameworkGaps(accepted)
+    methodUnseen: methodUnseen.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0),
+    skipped,
+    reviewedHolds,
+    specOpsUncovered,
+    frameworkGaps: frameworkGaps(accepted, rules.frameworks)
   };
 }
 
@@ -1758,11 +2702,11 @@ var ENTRY_DIR = /(^|\/)(controllers?|routes|routers|handlers|api|endpoints|jobs|
 var BOUNDARY_NAME = /(client|gateway|repository|repo|dao|mapper|entity|model|dto|request|response|publisher|producer|store|cache|schema)$/i;
 var BOUNDARY_FILE = /\.(sql|proto|graphql|gql|avsc|wsdl|xsd)$|(^|\/)(openapi|swagger)[^/]*\.(ya?ml|json)$/i;
 var BOUNDARY_DIR = /(^|\/)(clients?|gateways?|repositories|dao|models?|entities|dto|migrations?)\//i;
-var TEST = /(^|\/)(test|tests|__tests__|spec|specs|e2e|it)\/|[._-](test|spec)\.[^/.]+$|(Test|Tests|IT|Spec)\.[^/.]+$|(^|\/)test_[^/]+$|_test\.go$/;
-var stem = (path) => {
-  const base = path.slice(path.lastIndexOf("/") + 1);
-  const dot = base.indexOf(".");
-  return dot > 0 ? base.slice(0, dot) : base;
+var TEST = /(^|\/)(test|tests|__tests__|spec|specs|e2e|it)\/|(^|\/)(test|tests)[-_][a-z0-9_-]+\/|[._-](test|spec)\.[^/.]+$|(Test|Tests|IT|Spec)\.[^/.]+$|(^|\/)test_[^/]+$|_test\.go$/;
+var stem2 = (path) => {
+  const base2 = path.slice(path.lastIndexOf("/") + 1);
+  const dot = base2.indexOf(".");
+  return dot > 0 ? base2.slice(0, dot) : base2;
 };
 function readingRank(path) {
   if (TEST.test(path))
@@ -1771,7 +2715,7 @@ function readingRank(path) {
     return 0;
   if (CONFIG.test(path))
     return 1;
-  const s = stem(path);
+  const s = stem2(path);
   if (ENTRY_NAME.test(s) || ENTRY_DIR.test(path))
     return 2;
   if (BOUNDARY_NAME.test(s) || BOUNDARY_FILE.test(path) || BOUNDARY_DIR.test(path))
@@ -1819,9 +2763,9 @@ var CONFIG_CODE = /(^|\/)(config|configuration|settings|environments?)(\/|\.[^/]
 var IAC = /\.(tf|tfvars|hcl|bicep)$|(^|\/)(serverless|template)[^/]*\.ya?ml$|(^|\/)(cdk|pulumi|terraform)\//;
 var DATA_FILE = /\.sql$|(^|\/)(migrations?|db|database|changelogs?|liquibase|flyway)\//i;
 var CONTRACT = /\.(proto|avsc|wsdl|xsd)$/i;
-var API_SCHEMA = /\.(graphql|gql)$|(^|\/)(openapi|swagger|asyncapi)[^/]*\.(ya?ml|json)$/i;
+var API_SCHEMA = /\.(graphql|gql)$/i;
 var STRUCTURED = /\.(ya?ml|json|xml|config|properties|toml|ini|conf)$/i;
-function fileKinds(path) {
+function fileKinds(path, rules = DEFAULT_READ_RULES) {
   if (GATEWAY_FILE.test(path))
     return [...GATEWAY_KINDS];
   const k = /* @__PURE__ */ new Set();
@@ -1837,7 +2781,7 @@ function fileKinds(path) {
     add(["data"]);
   if (CONTRACT.test(path))
     add(["protocols"]);
-  if (API_SCHEMA.test(path))
+  if (API_SCHEMA.test(path) || rules.apiSpec.test(path))
     add(["routes", "protocols"]);
   const isCode = SERVER_CODE.test(path) || DEVICE_CODE.test(path) || SCRIPT_CODE.test(path);
   if (PAGE_CODE.test(path) || DEVICE_CODE.test(path))
@@ -1873,27 +2817,45 @@ var linesOf = (text) => {
   const t = text.replace(/\r\n?/g, "\n");
   return (t.endsWith("\n") ? t.slice(0, -1) : t).split("\n");
 };
+var LONG_LINE = 1e3;
+function shownLine(line) {
+  if (line.length <= LONG_LINE)
+    return line;
+  const code2 = line.charCodeAt(LONG_LINE - 1);
+  const at = code2 >= 55296 && code2 <= 56319 ? LONG_LINE - 1 : LONG_LINE;
+  return `${line.slice(0, at)} \u2026 [line cut: ${line.length} characters]`;
+}
 function numberedSlice(text, s) {
-  return linesOf(text).slice(s.from - 1, s.to).map((l, i) => `${s.from + i}| ${l}`).join("\n");
+  return linesOf(text).slice(s.from - 1, s.to).map((l, i) => `${s.from + i}| ${shownLine(l)}`).join("\n");
 }
 var header = (s) => `${s.path} lines ${s.from}-${s.to} of ${s.of} (numbered as in the file)`;
 function sliceText(source, s) {
   return `${header(s)}
 ${numberedSlice(source.read(s.path) ?? "", s)}`;
 }
-var tokensOf = (chars) => Math.ceil(chars / 4);
+var tokensOf = (units) => Math.ceil(units / 4);
+var wrapUnits = (path) => tokenUnits(`<atticus-data id="1-file-0000" kind="code" origin="${path}#L0000000-0000000">
+
+</atticus-data>
+
+`);
 function planBatches(source, o) {
   const room = Math.max(1, o.room);
+  const rules = readRulesOf(o.conventions);
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
   const excluded = [];
+  const leaveOut = new Set(o.reach?.leaveOut ?? []);
+  const notReached = [];
   const paths = [];
   const texts = /* @__PURE__ */ new Map();
   for (const p of source.list()) {
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(source, p))
+      continue;
     const text = source.read(p);
     if (text === void 0)
       continue;
     const ls = linesOf(text);
-    if (!isSourceFile(p, ls[0] ?? "", ls))
+    if (!isSourceFile(p, ls[0] ?? "", ls, rules))
       continue;
     if (excludeRes.some((re) => re.test(p))) {
       excluded.push(p);
@@ -1901,6 +2863,10 @@ function planBatches(source, o) {
     }
     if (!text.trim())
       continue;
+    if (leaveOut.has(p)) {
+      notReached.push(p);
+      continue;
+    }
     paths.push(p);
     texts.set(p, text);
   }
@@ -1916,16 +2882,17 @@ function planBatches(source, o) {
   const slices = [];
   let lines = 0;
   let leastRoom = room;
-  for (const path of readingOrder(paths)) {
-    const kinds2 = fileKinds(path);
+  for (const path of reachOrder(paths, o.reach?.first)) {
+    const kinds2 = fileKinds(path, rules);
     const left = room - overhead(kinds2);
     leastRoom = Math.min(leastRoom, left);
     const fileRoom = Math.max(1, left);
     const all2 = linesOf(texts.get(path));
     const of = all2.length;
     lines += of;
-    const sizes = all2.map((l, i) => `${i + 1}| ${l}`.length + 1);
-    const cost = (from2, chars) => tokensOf(header({ path, from: from2, to: of, of }).length + chars);
+    const sizes = all2.map((l, i) => tokenUnits(`${i + 1}| ${shownLine(l)}`) + 1);
+    const wrap = wrapUnits(path);
+    const cost = (from2, units) => tokensOf(tokenUnits(header({ path, from: from2, to: of, of })) + wrap + units);
     const total = sizes.reduce((n, c) => n + c, 0);
     if (cost(1, total) <= fileRoom) {
       slices.push({ path, from: 1, to: of, of, tokens: cost(1, total), kinds: kinds2 });
@@ -1965,9 +2932,20 @@ function planBatches(source, o) {
     tokens: slices.reduce((n, s) => n + s.tokens, 0),
     batches,
     excluded: excluded.sort(),
-    leastRoom
+    leastRoom,
+    notReached: notReached.sort()
   };
 }
+function reachOrder(paths, first) {
+  const order = readingOrder(paths);
+  if (!first?.length)
+    return order;
+  const has = new Set(paths);
+  const head = order.filter((p) => readingRank(p) <= 1);
+  const lead = [...new Set(first)].filter((p) => has.has(p) && readingRank(p) > 1);
+  const taken = /* @__PURE__ */ new Set([...head, ...lead]);
+  return [...head, ...lead, ...order.filter((p) => !taken.has(p))];
+}
 
 // packages/verify/dist/vendored.js
 var LICENSE_FILE = /^(LICEN[CS]E|COPYING)([._-][^/]*)?$/i;
@@ -2032,10 +3010,10 @@ function buildModules(path, text) {
   return found.filter((m) => !m.startsWith("!")).map(clean).filter(Boolean).map((m) => dir ? `${dir}/${m}` : m);
 }
 var JAVA_LIKE = /\.(java|kt|kts|scala|groovy)$/i;
-var DOTNET = /\.(cs|vb|fs)$/i;
+var DOTNET2 = /\.(cs|vb|fs)$/i;
 var rootOf = (name) => name.split(".").slice(0, 2).join(".").toLowerCase();
 function packageRoot(path, text) {
-  const re = JAVA_LIKE.test(path) ? /^\s*package\s+([A-Za-z_][\w.]*)/m : DOTNET.test(path) ? /^\s*namespace\s+([A-Za-z_][\w.]*)/m : void 0;
+  const re = JAVA_LIKE.test(path) ? /^\s*package\s+([A-Za-z_][\w.]*)/m : DOTNET2.test(path) ? /^\s*namespace\s+([A-Za-z_][\w.]*)/m : void 0;
   const m = re?.exec(text);
   return m ? rootOf(m[1]) : void 0;
 }
@@ -2053,7 +3031,7 @@ function packageRoots(paths, inits, read) {
       }
       if (top)
         roots.add(nameOf(top).toLowerCase());
-    } else if ((JAVA_LIKE.test(p) || DOTNET.test(p)) && readCount < PACKAGE_SAMPLE) {
+    } else if ((JAVA_LIKE.test(p) || DOTNET2.test(p)) && readCount < PACKAGE_SAMPLE) {
       readCount++;
       const r = packageRoot(p, read(p) ?? "");
       if (r)
@@ -2233,6 +3211,27 @@ function exclusionYaml(proposals) {
   ].join("\n");
 }
 var SESSION_TOKENS = 15e4;
+var SESSION_SHARE = 0.45;
+function sessionTokensFor(limit) {
+  return limit && limit > 0 ? Math.floor(limit * SESSION_SHARE) : SESSION_TOKENS;
+}
+var RANGE_OVERLAP_LINES = 20;
+var RANGE_OVERLAP_SHARE = 0.02;
+function rangeOverlap(each) {
+  return Math.min(Math.floor(each / 5), Math.max(RANGE_OVERLAP_LINES, Math.ceil(RANGE_OVERLAP_SHARE * each)));
+}
+function lineRanges(f, room) {
+  const n = Math.max(1, Math.min(f.lines, Math.ceil(f.tokens / (0.8 * room))));
+  const each = Math.ceil(f.lines / n);
+  const overlap = rangeOverlap(each);
+  const out = [];
+  for (let start = 1; start <= f.lines; start += each) {
+    const from = start === 1 ? 1 : start - overlap;
+    const to = Math.min(f.lines, start + each - 1);
+    out.push({ from, to, start, tokens: Math.ceil(f.tokens * (to - from + 1) / f.lines) });
+  }
+  return out;
+}
 function unitsOf(dir, fs, room) {
   const prefix = dir ? `${dir}/` : "";
   const direct = [];
@@ -2254,15 +3253,105 @@ function unitsOf(dir, fs, room) {
     out.push(...unitsOf(child, children.get(child), room));
   return out;
 }
-function planParts(files, room = SESSION_TOKENS) {
+function groupUnits(dir, fs, room, holds) {
+  const prefix = dir ? `${dir}/` : "";
+  const direct = [];
+  const children = /* @__PURE__ */ new Map();
+  for (const f of fs) {
+    const rest = f.path.slice(prefix.length);
+    const slash = rest.indexOf("/");
+    if (slash < 0)
+      direct.push(f);
+    else {
+      const child = prefix + rest.slice(0, slash);
+      children.set(child, [...children.get(child) ?? [], f]);
+    }
+  }
+  if (dir && holds(dir, true, fs.length) && (sum(fs) <= room || !children.size))
+    return [{ glob: `${dir}/**`, files: fs.length, tokens: sum(fs) }];
+  const out = [];
+  if (direct.length) {
+    if (holds(dir, false, direct.length))
+      out.push({ glob: `${prefix}*`, files: direct.length, tokens: sum(direct) });
+    else
+      for (const f of [...direct].sort((a, b) => byPath2(a.path, b.path)))
+        out.push({ glob: f.path, files: 1, tokens: f.tokens });
+  }
+  for (const child of [...children.keys()].sort(byPath2))
+    out.push(...groupUnits(child, children.get(child), room, holds));
+  return out;
+}
+function rangeUnits(f, room) {
+  return lineRanges({ ...f, lines: f.lines }, room).map((r, i) => ({
+    glob: `${f.path}#L${r.from}-L${r.to}`,
+    files: i === 0 ? 1 : 0,
+    tokens: r.tokens
+  }));
+}
+function orderedUnits(files, room, o) {
+  const isBig = (f) => f.tokens > room && (f.lines ?? 0) > 1;
+  const byFile = new Map(files.map((f) => [f.path, f]));
+  const head = new Set(o.head.filter((p) => byFile.has(p)));
+  const models = [...new Set(o.models)].filter((p) => byFile.has(p) && !head.has(p));
+  const inModels = new Set(models);
+  const rest = files.filter((f) => !head.has(f.path) && !inModels.has(f.path));
+  const all2 = [...files.map((f) => f.path), ...o.leftOut];
+  const counts = () => {
+    const deep = /* @__PURE__ */ new Map();
+    const own = /* @__PURE__ */ new Map();
+    const count = (m, k) => m.set(k, (m.get(k) ?? 0) + 1);
+    for (const p of all2) {
+      const parts = p.split("/");
+      count(own, parts.slice(0, -1).join("/"));
+      for (let d = 1; d < parts.length; d++)
+        count(deep, parts.slice(0, d).join("/"));
+    }
+    return (dir, isDeep, n) => (isDeep ? deep.get(dir) : own.get(dir)) === n;
+  };
+  const holds = counts();
+  const unitsOfGroup = (group) => {
+    const small = group.filter((f) => !isBig(f)).sort((a, b) => byPath2(a.path, b.path));
+    const out = groupUnits("", small, room, holds);
+    for (const f of group.filter(isBig))
+      out.push(...rangeUnits(f, room));
+    return out;
+  };
+  return [
+    ...unitsOfGroup(files.filter((f) => head.has(f.path))),
+    ...models.flatMap((p) => {
+      const f = byFile.get(p);
+      return isBig(f) ? rangeUnits(f, room) : [{ glob: p, files: 1, tokens: f.tokens }];
+    }),
+    ...unitsOfGroup(rest)
+  ];
+}
+function planParts(files, room = SESSION_TOKENS, order) {
   const total = sum(files);
   if (total <= room)
     return [];
-  const sorted = [...files].sort((a, b) => byPath2(a.path, b.path));
+  let units;
+  if (order)
+    units = orderedUnits(files, room, order);
+  else {
+    const big = files.filter((f) => f.tokens > room && (f.lines ?? 0) > 1);
+    const rest = files.filter((f) => !big.includes(f));
+    const ranges = [];
+    for (const f of big)
+      for (const [i, r] of lineRanges({ ...f, lines: f.lines }, room).entries())
+        ranges.push({
+          glob: `${f.path}#L${r.from}-L${r.to}`,
+          files: i === 0 ? 1 : 0,
+          tokens: r.tokens,
+          key: `${f.path}\0${String(r.start).padStart(12, "0")}`
+        });
+    const sorted = [...rest].sort((a, b) => byPath2(a.path, b.path));
+    const keyOf = (g) => g.replace(/\/?\*\*?$/, "");
+    units = [...unitsOf("", sorted, room).map((u) => ({ ...u, key: keyOf(u.glob) })), ...ranges].sort((a, b) => byPath2(a.key, b.key)).map(({ key: _k, ...u }) => u);
+  }
   const target = total / Math.ceil(total / room);
   const parts = [];
   let current;
-  for (const u of unitsOf("", sorted, room)) {
+  for (const u of units) {
     if (current && (current.tokens + u.tokens > room || current.tokens >= target)) {
       parts.push(current);
       current = void 0;
@@ -2277,13 +3366,104 @@ function planParts(files, room = SESSION_TOKENS) {
   return parts;
 }
 
+// packages/verify/dist/gaps.js
+var GAP_CONTEXT_LINES = 20;
+var byPath3 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function quoted2(v) {
+  return JSON.stringify(v).replace(/[\u007f-\u009f\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function split(cite2) {
+  const m = /^(.+):(\d+)$/.exec(cite2);
+  return m ? { file: m[1], line: Number(m[2]) } : void 0;
+}
+function planGaps(from, size, room, o = {}) {
+  const whole = new Set(from.unknown ?? []);
+  const lines = /* @__PURE__ */ new Map();
+  const note = (cite2, why) => {
+    const at = split(cite2);
+    if (!at)
+      return;
+    const of = lines.get(at.file) ?? /* @__PURE__ */ new Map();
+    of.set(at.line, [...of.get(at.line) ?? [], why]);
+    lines.set(at.file, of);
+  };
+  for (const s of from.skipped ?? [])
+    note(s.cite, `writes the ${s.kind} ${quoted2(s.value)}, which no fact cites`);
+  for (const h of from.reviewedHolds ?? [])
+    for (const s of h.skipped)
+      note(s.cite, `writes the ${s.kind} ${quoted2(s.value)}, but ${quoted2(h.path)} is reviewed as ${quoted2(h.why)}: write its fact, or narrow the reviewed line`);
+  for (const o2 of from.specOpsUncovered ?? [])
+    note(o2.cite, `declares ${o2.method} ${quoted2(o2.path)}, which no entry covers: find the code that serves it`);
+  for (const e of from.entriesNoFlowFollows ?? [])
+    note(e.cite, e.route ? `is ${e.id} (${[e.method, quoted2(e.path)].filter(Boolean).join(" ")}), a gateway route with no forwarding call: write the call it forwards to its RouteRule's target, \`from\` it, as the gateway rules say` : `is ${e.id} (${[e.entryType, e.method, quoted2(e.path)].filter(Boolean).join(" ")}), which no flow follows: write its flow`);
+  const unlisted = Math.max(0, (from.skippedCount ?? 0) - (from.skipped?.length ?? 0)) + Math.max(0, (from.specOpsUncoveredCount ?? 0) - (from.specOpsUncovered?.length ?? 0));
+  const gone = [];
+  const reads = [];
+  const named = [.../* @__PURE__ */ new Set([...whole, ...lines.keys()])].sort(byPath3);
+  const files = o.first?.length ? reachOrder(named, o.first) : named;
+  for (const file of files) {
+    const sz = size(file);
+    if (!sz) {
+      gone.push(file);
+      continue;
+    }
+    const at = lines.get(file) ?? /* @__PURE__ */ new Map();
+    const whys = (a, b) => [...at.entries()].filter(([l]) => l >= a && l <= b).sort((x, y) => x[0] - y[0]).flatMap(([l, ws]) => [...new Set(ws)].sort().map((w) => `line ${l} ${w}`));
+    const share = (a, b) => Math.ceil(sz.tokens * (b - a + 1) / sz.lines);
+    if (whole.has(file)) {
+      const head = "no fact cites it: read it whole";
+      if (sz.tokens <= room || sz.lines <= 1) {
+        reads.push({ path: file, file, tokens: sz.tokens, why: [head, ...whys(1, sz.lines)] });
+        continue;
+      }
+      for (const r of lineRanges(sz, room))
+        reads.push({
+          path: `${file}#L${r.from}-L${r.to}`,
+          file,
+          tokens: r.tokens,
+          // R4: a line the ranges share is named in the range it is its own in, the earlier one.
+          why: ["no fact cites the file: read these lines", ...whys(r.start, r.to)]
+        });
+      continue;
+    }
+    const windows = [];
+    for (const l of [...at.keys()].sort((a, b) => a - b)) {
+      const a = Math.max(1, l - GAP_CONTEXT_LINES);
+      const b = Math.min(sz.lines, l + GAP_CONTEXT_LINES);
+      const last = windows.at(-1);
+      if (last && a <= last[1] + 1)
+        last[1] = Math.max(last[1], b);
+      else
+        windows.push([a, b]);
+    }
+    for (const [a, b] of windows)
+      reads.push({ path: `${file}#L${a}-L${b}`, file, tokens: share(a, b), why: whys(a, b) });
+  }
+  const sessions = [];
+  for (const r of reads) {
+    const last = sessions.at(-1);
+    if (last && last.tokens + r.tokens <= room) {
+      last.reads.push(r);
+      last.tokens += r.tokens;
+    } else
+      sessions.push({ reads: [r], tokens: r.tokens });
+  }
+  return {
+    sessions,
+    files: new Set(reads.map((r) => r.file)).size,
+    tokens: reads.reduce((n, r) => n + r.tokens, 0),
+    unlisted,
+    gone
+  };
+}
+
 // packages/diagrams/dist/views.js
 var VIEW_NAMES = ["context", "container", "data", "event", "sequence"];
 var ViewError = class extends Error {
 };
 var cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var slug = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-var normPath = (p) => p.replace(/\{[^}]*\}/g, "{}").replace(/\/+$/, "") || "/";
+var normPath2 = (p) => p.replace(/\{[^}]*\}/g, "{}").replace(/\/+$/, "") || "/";
 function legendOf(status) {
   if (status === "planned-new")
     return "new";
@@ -2372,7 +3552,7 @@ var Catalog = class {
       what = this.topicOf(i);
     else {
       const ep = i.endpoint ? this.endpoints.get(i.endpoint) : void 0;
-      const path = ep?.endpointType === "rest" && normPath(ep.pathOrTopic) === normPath(i.normalizedPath) ? ep.pathOrTopic : i.normalizedPath;
+      const path = ep?.endpointType === "rest" && normPath2(ep.pathOrTopic) === normPath2(i.normalizedPath) ? ep.pathOrTopic : i.normalizedPath;
       what = [i.method?.toUpperCase(), path].filter(Boolean).join(" ");
     }
     return [i.pattern?.code, what].filter(Boolean).join(" ");
@@ -2776,8 +3956,8 @@ function changeView(records2, change, flows, known = []) {
   const nodes = [];
   for (const id of comps) {
     const sys = c.components.has(id) ? c.systemOf(id) : void 0;
-    const base = c.components.has(id) || c.isSystem(id) ? c.endNode(id, sys) : { id, label: id, kind: "component" };
-    const { legend: _status, ...rest } = base;
+    const base2 = c.components.has(id) || c.isSystem(id) ? c.endNode(id, sys) : { id, label: id, kind: "component" };
+    const { legend: _status, ...rest } = base2;
     nodes.push({ ...rest, label: marked(rest.label, legends.get(id)), ...withMark(id) });
   }
   for (const t of tables) {
@@ -2873,14 +4053,14 @@ var Ids = class {
     const known = this.map.get(key);
     if (known)
       return known;
-    let base = raw.replace(/[^A-Za-z0-9_]/g, "_");
-    if (!/^[A-Za-z]/.test(base))
-      base = `n_${base}`;
-    if (RESERVED.has(base.toLowerCase()))
-      base = `${base}_`;
-    let id = base;
+    let base2 = raw.replace(/[^A-Za-z0-9_]/g, "_");
+    if (!/^[A-Za-z]/.test(base2))
+      base2 = `n_${base2}`;
+    if (RESERVED.has(base2.toLowerCase()))
+      base2 = `${base2}_`;
+    let id = base2;
     for (let n = 2; this.used.has(id); n++)
-      id = `${base}_${n}`;
+      id = `${base2}_${n}`;
     this.used.add(id);
     this.map.set(key, id);
     return id;
@@ -3069,8 +4249,8 @@ function nodeStyle(n) {
     return styleText(SHAPES.topic, legend);
   if (n.boundary === "vendor")
     return styleText(SHAPES.vendor, n.kind === "component" ? { atticusKind: "component" } : {}, legend);
-  const base = n.kind === "system" ? SHAPES.system : SHAPES.component;
-  return styleText(base, n.boundary ? BOUNDARY[n.boundary] : void 0, legend);
+  const base2 = n.kind === "system" ? SHAPES.system : SHAPES.component;
+  return styleText(base2, n.boundary ? BOUNDARY[n.boundary] : void 0, legend);
 }
 function groupStyle(g) {
   return styleText(SHAPES.group, g.kind === "datastore" ? { atticusKind: "datastore-group" } : {}, g.boundary ? { strokeColor: BOUNDARY[g.boundary].strokeColor } : void 0, g.legend ? LEGEND[g.legend] : void 0);
@@ -3161,14 +4341,14 @@ function edgeStyle(e) {
 }
 var compress = (xml) => deflateRawSync(Buffer.from(encodeURIComponent(xml), "utf8"), { level: 9 }).toString("base64");
 function shapeLibrary() {
-  const base = [
+  const base2 = [
     ["System", SHAPES.system, W, H],
     ["Component", SHAPES.component, W, H],
     ["Vendor", SHAPES.vendor, W, H + 20],
     ["Data store", SHAPES.datastore, 120, 80],
     ["Topic", SHAPES.topic, W, H]
   ];
-  const entries = base.flatMap(([title, style, w, h]) => [void 0, "new", "modify", "retire"].map((legend) => {
+  const entries = base2.flatMap(([title, style, w, h]) => [void 0, "new", "modify", "retire"].map((legend) => {
     const value = attr(title);
     const st = attr(styleText(style, legend ? LEGEND[legend] : void 0));
     const xml = `<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="${value}" style="${st}" vertex="1" parent="1"><mxGeometry width="${w}" height="${h}" as="geometry"/></mxCell></root></mxGraphModel>`;
@@ -3307,12 +4487,91 @@ var STATE = {
 };
 function recordGaps(r) {
   const g = [];
-  if (r.confidence === "inferred")
+  if (r.confidence === "inferred" && !r.flags?.includes(JOINED_BY_PERSON))
     g.push("inferred");
   for (const f of r.flags ?? [])
-    g.push(f);
+    if (!JOIN_HOW_FLAGS.has(f) && !LINK_EVIDENCE_NOT_GAPS.has(f))
+      g.push(f);
   return g;
 }
+var MAX_JOINS = 20;
+var HOW_OF_FLAG = {
+  "joined-by-path": "path",
+  "joined-by-label": "label",
+  "joined-by-platform-setting": "platform-setting",
+  "joined-by-folder-name": "folder-name",
+  "joined-despite-conflict": "conflict",
+  "joined-by-service-name": "service-name",
+  // G1 (ADR 0174): a person paired the call with the entry on the canvas.
+  "joined-by-person": "person",
+  // ADR 0181: the AI paired it, applied by Atticus from its run: the AI's word, not a person's.
+  [JOINED_BY_AI]: "ai",
+  "joined-by-answer": "answer",
+  "joined-by-name": "named",
+  "joined-by-repo": "repo",
+  "joined-by-host": "host",
+  "declared-caller": "declared",
+  // ADR 0162 §6 (F8): a topic or queue the profile names as an outside system's: a person's word.
+  [DECLARED_TOPIC]: "declared",
+  // ADR 0160 (O3): answered by an entry of another team's shared map.
+  [JOINED_TO_SHARED_MAP]: "shared"
+};
+function joinHow(i) {
+  for (const f of i.flags ?? [])
+    if (HOW_OF_FLAG[f])
+      return HOW_OF_FLAG[f];
+  if (i.via === "event-bus" || i.via === "mq")
+    return "topic";
+  return "unknown";
+}
+function joinOf(i) {
+  const side = (s) => evidenceOf(i.evidence.filter((e) => e.side === s));
+  const sided = /* @__PURE__ */ new Set(["caller", "callee", "gateway"]);
+  return {
+    interface: i.id,
+    from: i.from,
+    to: i.to,
+    how: joinHow(i),
+    gateway: i.via === "gateway",
+    verified: i.confidence === "verified",
+    ...i.method ? { method: i.method } : {},
+    ...i.normalizedPath ? { path: i.normalizedPath } : {},
+    caller: side("caller"),
+    callee: side("callee"),
+    hops: side("gateway"),
+    other: evidenceOf(i.evidence.filter((e) => !e.side || !sided.has(e.side))),
+    ...sharedOf(i),
+    ...aiRunOf(i)
+  };
+}
+function aiRunOf(i) {
+  if (!i.flags?.includes(JOINED_BY_AI))
+    return {};
+  const run = i.evidence.find((e) => e.source === "ai" && e.run)?.run;
+  return run ? { run } : {};
+}
+function sharedOf(i) {
+  if (!i.flags?.includes(JOINED_TO_SHARED_MAP))
+    return {};
+  const e = i.evidence.find((x) => x.extractor === SHARED_MAP_EVIDENCE && x.side === "callee" && x.repo && x.path);
+  if (!e)
+    return {};
+  return {
+    shared: {
+      team: e.by ?? "",
+      repo: e.repo,
+      at: e.line === void 0 ? e.path : `${e.path}:${e.line}`,
+      ...e.commit ? { commit: e.commit } : {}
+    }
+  };
+}
+function mergeJoins(a, b) {
+  const by = new Map(a.map((j) => [j.interface, j]));
+  for (const j of b)
+    if (!by.has(j.interface))
+      by.set(j.interface, j);
+  return [...by.values()].sort((x, y) => x.interface < y.interface ? -1 : x.interface > y.interface ? 1 : 0).slice(0, MAX_JOINS);
+}
 var props = (o) => {
   const out = {};
   for (const [k, v] of Object.entries(o)) {
@@ -3462,6 +4721,7 @@ function buildEstate(records2) {
     add(fromRecord(c, `component:${c.id}`, "component", c.id, parent, { type: c.type, runtime: c.runtime, repo: c.repo, path: c.path }, gaps));
   }
   const endpointNode = /* @__PURE__ */ new Map();
+  const topicByPath = /* @__PURE__ */ new Map();
   for (const e of all(records2, "Endpoint")) {
     const topic = TOPIC_TYPES.has(e.endpointType);
     const id = `${topic ? "topic" : "endpoint"}:${e.id}`;
@@ -3478,7 +4738,30 @@ function buildEstate(records2) {
       auth: e.auth
     }, gaps));
     endpointNode.set(e.id, id);
+    if (topic)
+      topicByPath.set(e.pathOrTopic, id);
   }
+  const busTopic = (name, parent, ev = []) => {
+    const known = topicByPath.get(name);
+    if (known)
+      return known;
+    const id = add({
+      id: `topic:bus.${slug2(name)}`,
+      kind: "topic",
+      label: name,
+      parent,
+      state: "current",
+      gaps: [],
+      evidence: ev,
+      properties: { pathOrTopic: name },
+      next: {
+        command: `atticus query "${name}"`,
+        why: "List the records that name this topic or queue."
+      }
+    });
+    topicByPath.set(name, id);
+    return id;
+  };
   const storeNode = /* @__PURE__ */ new Map();
   for (const d of all(records2, "DataStore")) {
     const owner = d.ownerComponent && components.has(d.ownerComponent);
@@ -3523,9 +4806,33 @@ function buildEstate(records2) {
     const ev = evidenceOf(i.evidence);
     const gaps = [...recordGaps(i), ...i.conflicts.length ? ["conflicts"] : []];
     const target = i.endpoint ? endpointNode.get(i.endpoint) : void 0;
+    const join2 = joinOf(i);
     if (target?.startsWith("topic:")) {
-      atoms.push({ from, to: target, type: "publishes", evidence: ev, gaps });
-      atoms.push({ from: to, to: target, type: "subscribes", evidence: ev, gaps });
+      atoms.push({ from, to: target, type: "publishes", evidence: ev, gaps, join: join2 });
+      atoms.push({ from: to, to: target, type: "subscribes", evidence: ev, gaps, join: join2 });
+      continue;
+    }
+    if (!i.endpoint && (i.via === "event-bus" || i.via === "mq") && i.normalizedPath) {
+      const isSystem = (n) => n.startsWith("system:") || n.startsWith("unknown:");
+      const [home, homeRef] = !isSystem(to) && isSystem(from) ? [from, i.from] : [to, i.to];
+      const t = busTopic(i.normalizedPath, home);
+      const owner = nodes.get(t);
+      if (owner.parent === home && isSystem(home)) {
+        owner.properties = { ...owner.properties, owner: nodes.get(home)?.label ?? home };
+        const b = nodes.get(home)?.properties.boundary;
+        if (outside.has(homeRef) || b === "vendor" || b === "outside")
+          owner.properties.ownerOutside = true;
+      }
+      if (join2.shared)
+        owner.properties = { ...owner.properties, owner: join2.shared.team, ownerOutside: true };
+      if (i.flags?.includes(DECLARED_TOPIC)) {
+        owner.properties = { ...owner.properties, declared: true };
+        owner.gaps = [.../* @__PURE__ */ new Set([...owner.gaps, DECLARED_TOPIC])];
+        owner.evidence = mergeEvidence(owner.evidence, evidenceOf(i.evidence.filter((e) => e.source === "manual")));
+      }
+      atoms.push({ from, to: t, type: "publishes", evidence: ev, gaps, join: join2 });
+      if (to.startsWith("component:"))
+        atoms.push({ from: to, to: t, type: "subscribes", evidence: ev, gaps, join: join2 });
       continue;
     }
     let caller = from;
@@ -3556,7 +4863,24 @@ function buildEstate(records2) {
       sync: i.sync,
       via: i.via,
       evidence: ev,
-      gaps: [...gaps, ...i.endpoint && !target ? ["no-endpoint"] : []]
+      gaps: [...gaps, ...i.endpoint && !target ? ["no-endpoint"] : []],
+      join: join2
+    });
+  }
+  for (const u of all(records2, "Unresolved")) {
+    if (u.unresolvedKind !== "event-publish" && u.unresolvedKind !== "event-subscribe")
+      continue;
+    if (!u.raw || u.raw.includes("${"))
+      continue;
+    const owner = u.owner ? partNode(u.owner) : "estate";
+    const ev = evidenceOf(u.evidence);
+    const t = busTopic(u.raw, u.unresolvedKind === "event-subscribe" ? owner : "estate", ev);
+    atoms.push({
+      from: owner,
+      to: t,
+      type: u.unresolvedKind === "event-publish" ? "publishes" : "subscribes",
+      evidence: ev,
+      gaps: recordGaps(u)
     });
   }
   for (const c of components.values())
@@ -3611,6 +4935,37 @@ function buildEstate(records2) {
       gaps: recordGaps(k)
     });
   }
+  const busy = /* @__PURE__ */ new Set();
+  const internal = (id) => {
+    const n = nodes.get(id);
+    return !!n && n.kind !== "unknown" && n.properties.boundary !== "outside" && n.properties.boundary !== "vendor";
+  };
+  for (const a of atoms)
+    if (a.type === "publishes" || a.type === "subscribes") {
+      if (internal(a.from))
+        busy.add(`${a.type}|${a.to}`);
+    }
+  for (const n of nodes.values()) {
+    if (n.kind !== "topic")
+      continue;
+    if (n.properties.owner === void 0) {
+      let p = n.parent ? nodes.get(n.parent) : void 0;
+      while (p && p.kind !== "system" && p.kind !== "repo" && p.kind !== "estate")
+        p = p.parent ? nodes.get(p.parent) : void 0;
+      if (p && p.kind !== "estate") {
+        let sys = p;
+        while (sys && sys.kind !== "system")
+          sys = sys.parent ? nodes.get(sys.parent) : void 0;
+        n.properties = { ...n.properties, owner: (sys ?? p).label };
+        if (sys && (sys.properties.boundary === "outside" || sys.properties.boundary === "vendor"))
+          n.properties.ownerOutside = true;
+      }
+    }
+    if (!busy.has(`publishes|${n.id}`))
+      n.gaps.push("no-publisher");
+    if (!busy.has(`subscribes|${n.id}`))
+      n.gaps.push("no-listener");
+  }
   const kids = /* @__PURE__ */ new Map();
   for (const n of nodes.values()) {
     if (!n.parent)
@@ -3705,10 +5060,13 @@ function merge(mapped) {
         count: 1,
         state: "current",
         gaps: [...new Set(atom.gaps)].sort(),
-        evidence: mergeEvidence(atom.evidence)
+        evidence: mergeEvidence(atom.evidence),
+        ...atom.join ? { joins: [atom.join] } : {}
       });
       continue;
     }
+    if (atom.join)
+      e.joins = mergeJoins(e.joins ?? [], [atom.join]);
     e.count++;
     if (atom.sync && e.sync !== atom.sync)
       e.sync = "mixed";
@@ -3772,16 +5130,27 @@ function nodeView(est, id, o) {
     return ax[i] ?? x;
   };
   const types = LENS_EDGES[lens];
+  const onBus = (atom, b) => (atom.type === "publishes" || atom.type === "subscribes") && est.nodes.get(b)?.kind === "topic" && b !== id;
+  const drawnTopics = /* @__PURE__ */ new Set();
+  for (const atom of est.atoms) {
+    if (!types.has(atom.type))
+      continue;
+    const a = lift(est, lens, atom.from);
+    const b = lift(est, lens, atom.to);
+    if (onBus(atom, b) && (inside(a) || inside(b)))
+      drawnTopics.add(b);
+  }
   const mapped = [];
   for (const atom of est.atoms) {
     if (!types.has(atom.type))
       continue;
     const a = lift(est, lens, atom.from);
     const b = lift(est, lens, atom.to);
-    if (!inside(a) && !inside(b))
+    const bus = onBus(atom, b);
+    if (!inside(a) && !inside(b) && !(bus && drawnTopics.has(b)))
       continue;
     const from = place(a);
-    const to = place(b);
+    const to = bus ? b : place(b);
     if (from === to)
       continue;
     mapped.push({ from, to, atom });
@@ -3790,10 +5159,12 @@ function nodeView(est, id, o) {
   let hidden = 0;
   if (!o.all)
     ({ edges, hidden } = reduceUses(edges));
-  const outside = [...new Set(edges.flatMap((e) => [e.from, e.to]))].filter((n) => n !== id && !shownSet.has(n)).sort();
-  const children = shown.map((n) => toNode(est, lens, n));
+  const ends = [...new Set(edges.flatMap((e) => [e.from, e.to]))].filter((n) => n !== id && !shownSet.has(n));
+  const deeper = ends.filter((n) => drawnTopics.has(n) && inside(n)).sort();
+  const outside = ends.filter((n) => !deeper.includes(n)).sort();
+  const children = [...shown, ...deeper].map((n) => toNode(est, lens, n));
   const firstTable = children.find((c) => c.kind === "table");
-  const suggest = lens === "data" && firstTable ? { mode: "focus", id: firstTable.id } : shown.length + outside.length > DETAILED_LIMIT ? { mode: "group" } : void 0;
+  const suggest = lens === "data" && firstTable ? { mode: "focus", id: firstTable.id } : shown.length + deeper.length + outside.length > DETAILED_LIMIT ? { mode: "group" } : void 0;
   return {
     lens,
     node: toNode(est, lens, id),
@@ -3931,13 +5302,13 @@ function codeLinkerFor(o) {
       web = `https://${scp[1]}/${scp[2]}`;
   }
   if (web) {
-    const base = web.replace(/\/+$/, "").replace(/\.git$/, "");
-    const ado = /(^https?:\/\/dev\.azure\.com\/)|(\.visualstudio\.com\/)/i.test(base);
+    const base2 = web.replace(/\/+$/, "").replace(/\.git$/, "");
+    const ado = /(^https?:\/\/dev\.azure\.com\/)|(\.visualstudio\.com\/)/i.test(base2);
     return (path, line, commit) => {
       const p = encodeURI(path);
       if (ado)
-        return `${base}?path=/${p}${commit ? `&version=GC${commit}` : ""}${line ? `&line=${line}` : ""}`;
-      return `${base}/blob/${commit ?? "HEAD"}/${p}${line ? `#L${line}` : ""}`;
+        return `${base2}?path=/${p}${commit ? `&version=GC${commit}` : ""}${line ? `&line=${line}` : ""}`;
+      return `${base2}/blob/${commit ?? "HEAD"}/${p}${line ? `#L${line}` : ""}`;
     };
   }
   const dir = (o.dir ?? "").replace(/\/+$/, "");
@@ -4152,6 +5523,27 @@ function config(c) {
     return `- ${code(`${s.key} = ${s.valueOrRef}`)} (${notes.join("; ")}): ${cite(c, ownEvidence(s, c.i.repo))}`;
   });
 }
+function terms(c) {
+  const ts = c.i.terms ?? [];
+  const owners = /* @__PURE__ */ new Map();
+  for (const r of records(c, "Component"))
+    for (const f of r.flags ?? []) {
+      const m = /^term:[^=]+=(.+)$/.exec(f);
+      if (m && !c.comps.has(r.id))
+        owners.set(m[1], [...owners.get(m[1]) ?? [], r.id]);
+    }
+  const listing = /* @__PURE__ */ new Map();
+  for (const g of records(c, "AccessGrant"))
+    if (g.flags?.some((f) => f.startsWith("term:"))) {
+      const route = c.byId.get(g.resource);
+      const by = route?.kind === "GatewayRoute" ? route.proxy : g.resource;
+      listing.set(g.subject, [.../* @__PURE__ */ new Set([...listing.get(g.subject) ?? [], by])]);
+    }
+  return [...ts].sort((a, b) => cmp2(a.term, b.term) || cmp2(a.value, b.value)).map((t) => {
+    const means = t.role === "owner" ? `this repo's own id${listing.get(t.value)?.length ? `; let in by ${list(listing.get(t.value).sort())}` : ""}` : t.role === "consumer" ? `a consumer it lets in${owners.get(t.value)?.length ? `: ${list(owners.get(t.value).sort())}` : ", whose own repo no fact names yet"}` : t.role === "none" ? "names no system" : `**open:** nothing says what it means${owners.get(t.value)?.length ? `; the same value is ${list(owners.get(t.value).sort())}'s own id (a possible link)` : ""}`;
+    return `- ${code(t.term)} ${code(t.value)}: ${means} ${cite(c, t.cite)}${t.meaning ? ` (its role from ${cite(c, t.meaning)})` : ""}`;
+  });
+}
 var flowFile = (f) => `flows/${f.id}.md`;
 function flowsList(c) {
   if (!c.i.flows.length)
@@ -4365,8 +5757,8 @@ function ctxOf(i, file) {
 }
 function renderMap(i) {
   const files = {};
-  const base = ctxOf(i, "map.md");
-  for (const comp of [...base.comps].sort(cmp2)) {
+  const base2 = ctxOf(i, "map.md");
+  for (const comp of [...base2.comps].sort(cmp2)) {
     const yaml = openApiOf(i, comp);
     if (yaml)
       files[`contracts/${comp}.openapi.yaml`] = yaml;
@@ -4380,17 +5772,18 @@ function renderMap(i) {
     HEADER2(i.repo, "the catalog and its specs"),
     "",
     ...aboutLine(i.about, i.repo),
-    ...builtOnLine(base),
+    ...builtOnLine(base2),
     trustLine(i.trust, i.repo),
     "",
-    ...section("What it serves", serves(base)),
-    ...section("What it calls", calls(base)),
-    ...section("What it stores", stores(base)),
-    ...section("Where it runs", deploys(base)),
-    ...section("Config that names other systems", config(base)),
-    ...section("Flows", flowsList(base)),
-    ...section("Contracts", contracts(base, files)),
-    ...section("Open questions", openQuestions(base))
+    ...section("What it serves", serves(base2)),
+    ...section("What it calls", calls(base2)),
+    ...section("What it stores", stores(base2)),
+    ...section("Where it runs", deploys(base2)),
+    ...section("Config that names other systems", config(base2)),
+    ...i.terms?.length ? section("Terms", terms(base2)) : [],
+    ...section("Flows", flowsList(base2)),
+    ...section("Contracts", contracts(base2, files)),
+    ...section("Open questions", openQuestions(base2))
   ].join("\n");
   return Object.fromEntries(Object.entries(files).sort(([a], [b]) => cmp2(a, b)));
 }
@@ -4422,15 +5815,25 @@ function rereadPlan(o) {
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
   const status = /* @__PURE__ */ new Map();
   for (const changes of used.values())
-    for (const c of changes)
-      if (c.status !== "deleted")
+    for (const c of changes) {
+      if (c.status === "deleted")
+        continue;
+      if (c.gitlink) {
+        for (const p of o.source.list())
+          if (p.startsWith(`${c.path}/`))
+            status.set(p, "modified");
+      } else
         status.set(c.path, c.status);
+    }
+  const rules = readRulesOf(o.conventions);
   const readable = [...status.keys()].filter((p) => {
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
+      return false;
     const text = o.source.read(p);
     if (text === void 0 || !text.trim())
       return false;
     const ls = text.split(/\r?\n/);
-    if (!isSourceFile(p, ls[0] ?? "", ls))
+    if (!isSourceFile(p, ls[0] ?? "", ls, readRulesOf(o.conventions)))
       return false;
     return !excludeRes.some((re) => re.test(p));
   });
@@ -4454,10 +5857,242 @@ function onlyFiles(source, paths) {
   return { list: () => source.list().filter((p) => keep.has(p)), read: (p) => source.read(p) };
 }
 
+// packages/verify/dist/slips.js
+function slugFactId(id) {
+  const slug3 = id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/-{2,}/g, "-").replace(/^[^a-z0-9]+/, "").replace(/-+$/, "");
+  return notDeviceName(slug3).slice(0, 120);
+}
+var isId = (x) => typeof x === "string" && FactId.safeParse(x).success;
+var isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+var REF_FIELDS = ["from", "under", "owner", "mappedTo", "entry"];
+function repairFormSlips(facts, bad, onFile = []) {
+  const slips = [];
+  const cands = bad.flatMap((b) => {
+    if (b.issues.some((i) => i.code === "not-json" || i.code === "duplicate-id"))
+      return [];
+    let json2;
+    try {
+      json2 = JSON.parse(b.raw);
+    } catch {
+      return [];
+    }
+    return isObj(json2) ? [{ b, json: json2 }] : [];
+  });
+  const taken = /* @__PURE__ */ new Map();
+  for (const f of facts)
+    taken.set(f.id, (taken.get(f.id) ?? 0) + 1);
+  for (const { json: json2 } of cands)
+    if (isId(json2.id))
+      taken.set(json2.id, (taken.get(json2.id) ?? 0) + 1);
+  const wanted = /* @__PURE__ */ new Map();
+  for (const { json: json2 } of cands)
+    if (typeof json2.id === "string" && !isId(json2.id)) {
+      const s = slugFactId(json2.id);
+      if (isId(s))
+        wanted.set(s, (wanted.get(s) ?? 0) + 1);
+    }
+  const known = new Set([...facts, ...onFile].map((f) => f.id));
+  const renames = /* @__PURE__ */ new Map();
+  const collided = /* @__PURE__ */ new Map();
+  for (const { b, json: json2 } of cands) {
+    if (typeof json2.id !== "string" || isId(json2.id))
+      continue;
+    const s = slugFactId(json2.id);
+    if (!isId(s))
+      continue;
+    if (taken.has(s) || (wanted.get(s) ?? 0) > 1) {
+      const message = `line ${b.line}: fact id ${json2.id} would slug to ${s}, which another fact already has; rename one of them`;
+      slips.push({ line: b.line, code: "id-collision", fact: json2.id, message });
+      collided.set(b, message);
+      continue;
+    }
+    renames.set(json2.id, s);
+  }
+  const rewritten = cands.map(({ b, json: json2 }) => {
+    const o = structuredClone(json2);
+    const fixes = [];
+    if (typeof o.id === "string" && renames.has(o.id)) {
+      fixes.push({
+        line: b.line,
+        code: "id-slugged",
+        fact: renames.get(o.id),
+        message: `line ${b.line}: fact id ${o.id} slugged to ${renames.get(o.id)}, and every reference to it`
+      });
+      o.id = renames.get(o.id);
+    }
+    const ref = (v) => {
+      if (typeof v !== "string")
+        return void 0;
+      if (renames.has(v))
+        return renames.get(v);
+      if (isId(v))
+        return void 0;
+      const s = slugFactId(v);
+      return known.has(s) ? s : void 0;
+    };
+    const said = (field, from, to) => fixes.push({
+      line: b.line,
+      code: "ref-rewritten",
+      fact: String(o.id),
+      message: `line ${b.line}: ${String(o.id)}'s ${field} ${from} rewritten as ${to}`
+    });
+    for (const k of REF_FIELDS) {
+      const to = ref(o[k]);
+      if (to) {
+        said(k, o[k], to);
+        o[k] = to;
+      }
+    }
+    if (Array.isArray(o.steps))
+      o.steps.forEach((st, i) => {
+        if (!isObj(st))
+          return;
+        const to = ref(st.ref);
+        if (to) {
+          said(`step ${i + 1} ref`, st.ref, to);
+          st.ref = to;
+        }
+      });
+    return { b, o, fixes };
+  });
+  const entries = /* @__PURE__ */ new Map();
+  for (const f of [...onFile, ...facts])
+    if (f.kind === "entry")
+      entries.set(f.id, f);
+  for (const { o } of rewritten)
+    if (o.kind === "entry" && typeof o.id === "string" && isObj(o.cite))
+      entries.set(o.id, o);
+  for (const r of rewritten) {
+    const { o, b } = r;
+    if (o.kind !== "flow" || o.cite !== void 0 || typeof o.entry !== "string")
+      continue;
+    const e = entries.get(o.entry);
+    if (!e || !isObj(e.cite))
+      continue;
+    o.cite = structuredClone(e.cite);
+    const c = e.cite;
+    r.fixes.push({
+      line: b.line,
+      code: "flow-cite-from-entry",
+      fact: String(o.id),
+      message: `line ${b.line}: flow ${String(o.id)} had no cite; it takes its entry ${o.entry}'s line (${String(c.file)}:${String(c.line)})`
+    });
+  }
+  const kept = [...facts];
+  const seen = new Set(facts.map((f) => f.id));
+  const fixedLines = /* @__PURE__ */ new Set();
+  for (const { b, o, fixes } of rewritten) {
+    if (!fixes.length || collided.has(b))
+      continue;
+    const p = Fact.safeParse(o);
+    if (!p.success || seen.has(p.data.id))
+      continue;
+    seen.add(p.data.id);
+    kept.push(p.data);
+    fixedLines.add(b);
+    slips.push(...fixes);
+  }
+  const still = bad.filter((b) => !fixedLines.has(b)).map((b) => collided.has(b) ? {
+    ...b,
+    issues: [
+      ...b.issues,
+      { line: b.line, code: "id-collision", message: collided.get(b) }
+    ]
+  } : b);
+  slips.sort((x, y) => x.line - y.line);
+  return { facts: kept, bad: still, slips };
+}
+
+// packages/verify/dist/house-imports.js
+var CODE2 = /\.(java|kt|kts|scala|groovy|cs|vb|fs|ts|tsx|js|jsx|mjs|cjs|vue|svelte|py|go|rb|php|swift)$/i;
+var IMPORTS = [
+  // Java, Kotlin, Scala, Groovy, Python's `import a.b`, Go's one-line import
+  /^\s*import\s+(?:static\s+)?([A-Za-z_][\w.]*)/,
+  // C#, F#
+  /^\s*(?:global\s+)?using\s+(?:static\s+)?([A-Za-z_][\w.]*)\s*;/,
+  /^\s*open\s+([A-Za-z_][\w.]*)\s*$/,
+  // Python
+  /^\s*from\s+([A-Za-z_][\w.]*)\s+import\b/,
+  // JavaScript, TypeScript: import ... from "x", export ... from "x", import "x", require("x"), import("x")
+  /\bfrom\s+["']([^"'\s]+)["']/,
+  /^\s*import\s+["']([^"'\s]+)["']/,
+  /\brequire\s*\(\s*["']([^"'\s]+)["']\s*\)/,
+  /\bimport\s*\(\s*["']([^"'\s]+)["']\s*\)/
+];
+var GO_IMPORT = /^\s*(?:import\s+)?(?:[\w.]+\s+)?"([\w.-]+(?:\/[\w.-]+)+)"\s*$/;
+function modulesOf(line, go) {
+  const out = [];
+  for (const re of go ? [...IMPORTS, GO_IMPORT] : IMPORTS) {
+    const m = re.exec(line);
+    if (m?.[1])
+      out.push(m[1]);
+  }
+  return out;
+}
+var lower = (s) => s.toLowerCase();
+var under3 = (module, pkg) => module === pkg || module.startsWith(pkg) && (/[./]$/.test(pkg) || /[./]/.test(module[pkg.length] ?? ""));
+function packageOf(module, prefix) {
+  let i = prefix.length;
+  while (i < module.length && /[./]/.test(module[i]))
+    i++;
+  const rest = module.slice(i);
+  const part = /^[^./]*/.exec(rest)?.[0] ?? "";
+  return module.slice(0, i + part.length).replace(/[./]+$/, "");
+}
+function nameOf2(pkg) {
+  const parts = lower(pkg).split(/[^a-z0-9]+/).filter(Boolean);
+  if (parts.length > 2 && /^(com|org|net|io|dev|co|uk|de|fr|nl|ch)$/.test(parts[0]))
+    parts.shift();
+  return parts.join("-") || "house-framework";
+}
+function houseImportsUntaught(source, o) {
+  if (!o.prefixes.length)
+    return [];
+  const rules = o.rules ?? DEFAULT_READ_RULES;
+  const prefixes = o.prefixes.map(lower);
+  const taught = o.taught.map(lower);
+  const found = /* @__PURE__ */ new Map();
+  const paths = source.list().filter((p) => CODE2.test(p) && !rules.notRead.test(p) && !(o.exclude ?? []).some((re) => re.test(p)) && isSourceFile(p, "", void 0, rules)).sort();
+  for (const p of paths) {
+    const text = source.read(p);
+    if (text === void 0)
+      continue;
+    const lines = text.split(/\r?\n/);
+    const go = /\.go$/i.test(p);
+    lines.forEach((line, i) => {
+      if (!/\b(import|using|from|require|open)\b/.test(line) && !(go && /^\s*"/.test(line)))
+        return;
+      for (const m of modulesOf(line, go)) {
+        const ml = lower(m);
+        const prefix = prefixes.find((x) => ml.startsWith(x));
+        if (!prefix)
+          continue;
+        if (taught.some((t) => under3(ml, t)))
+          continue;
+        const pkg = packageOf(m, prefix);
+        const f = found.get(pkg) ?? { files: /* @__PURE__ */ new Set(), first: `${p}:${i + 1}` };
+        f.files.add(p);
+        found.set(pkg, f);
+      }
+    });
+  }
+  return [...found.entries()].map(([pkg, f]) => {
+    const name = nameOf2(pkg);
+    return {
+      package: pkg,
+      name,
+      files: f.files.size,
+      first: f.first,
+      command: `atticus frameworks learn ${name} --from <its source, JAR or npm package> --package ${pkg}`
+    };
+  }).sort((a, b) => b.files - a.files || (a.package < b.package ? -1 : a.package > b.package ? 1 : 0));
+}
+
 export {
   insideRepo,
   dirSource,
   correctionFor,
+  outsidePairingFor,
   correctedFact,
   applyCorrections,
   frameworkFacts,
@@ -4465,20 +6100,28 @@ export {
   frameworkTopicsOfType,
   frameworkGaps,
   frameworksToLearn,
+  readRulesOf,
+  lineRangeOf,
   parseReviewed,
-  sameCommit,
-  staleMessage,
-  verifyFacts,
+  readingRank,
   FILE_KINDS,
+  fileKinds,
   kindsOf,
   numberedSlice,
   sliceText,
   planBatches,
+  isEntryPointFile,
+  NOT_REACHED_WHY,
+  reachableModels,
+  sameCommit,
+  staleMessage,
+  verifyFacts,
   SHOWN_PROPOSALS,
   proposeExclusions,
   exclusionYaml,
-  SESSION_TOKENS,
+  sessionTokensFor,
   planParts,
+  planGaps,
   VIEW_NAMES,
   ViewError,
   changeView,
@@ -4496,5 +6139,7 @@ export {
   codeLinkerFor,
   renderMap,
   rereadPlan,
-  onlyFiles
+  onlyFiles,
+  repairFormSlips,
+  houseImportsUntaught
 };