@maycombhq/atticus 2.0.0-beta.21 → 2.0.0-beta.22

package/dist/{chunk-EZIN5E5B.js → chunk-BTGPE6CR.js}

@@ -7,11 +7,11 @@ import {
   buildStub,
   generate,
   parseSpec
-} from "./chunk-3LZ6P5EP.js";
+} from "./chunk-MUWDB4R4.js";
 import {
   loadPlanContext,
   parseStory
-} from "./chunk-BEPCKDCP.js";
+} from "./chunk-R7NYHMUU.js";
 import {
   docOf,
   fingerprint,
@@ -20,20 +20,20 @@ import {
   roundsOf,
   sectionLines,
   writeFinding
-} from "./chunk-K332XW7K.js";
+} from "./chunk-S4PMJU6H.js";
 import {
   changeFolder
-} from "./chunk-HSZMPH5T.js";
+} from "./chunk-IDKCWSM5.js";
 import {
   baseClonePath,
   changeWorktreesDir,
   readChangeRepos,
   worktreePath
-} from "./chunk-XOL3GFW2.js";
+} from "./chunk-PKBHS4AA.js";
 import {
   buildContextPack,
   toRunSummary
-} from "./chunk-QHJJMZLX.js";
+} from "./chunk-P32RUW3B.js";
 import {
   AgentDefinition,
   ChecklistPack,
@@ -42,13 +42,15 @@ import {
   changeBranch,
   external_exports,
   normalizePath,
-  require_dist,
   taskBranch,
   toCanonicalYaml
-} from "./chunk-PAINMSID.js";
+} from "./chunk-Q2TECDIT.js";
 import {
   writeFileAtomic
-} from "./chunk-ODMBPDDV.js";
+} from "./chunk-TUULXQRW.js";
+import {
+  require_dist
+} from "./chunk-BQGDB6ZL.js";
 import {
   __toESM
 } from "./chunk-TV45EUGM.js";

package/dist/{chunk-265LWMOA.js → chunk-BTY3HZBO.js}

@@ -5,23 +5,25 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   contractCheckOf
-} from "./chunk-GX74YWR7.js";
-import "./chunk-G6IQYM25.js";
-import "./chunk-LPV6T362.js";
-import "./chunk-TQ4TG57V.js";
+} from "./chunk-T6DQR5TV.js";
+import "./chunk-SFUP7TTO.js";
+import "./chunk-7FTTA3HD.js";
+import "./chunk-ZQ3ON2VQ.js";
 import "./chunk-VOGCSYOI.js";
-import "./chunk-4SLBCEPD.js";
-import "./chunk-64AADMTW.js";
-import "./chunk-JYMIB5XY.js";
-import "./chunk-CPK7QSBG.js";
-import "./chunk-YO2PKTXT.js";
-import "./chunk-TWQRPM76.js";
-import "./chunk-VUVGX5L2.js";
-import "./chunk-XOL3GFW2.js";
-import "./chunk-QHJJMZLX.js";
-import "./chunk-7AB6OWTV.js";
-import "./chunk-PAINMSID.js";
-import "./chunk-ODMBPDDV.js";
+import "./chunk-J2JAKCIW.js";
+import "./chunk-745DAZ4L.js";
+import "./chunk-CXJ6FUKN.js";
+import "./chunk-QKUJMING.js";
+import "./chunk-6ZGLAACW.js";
+import "./chunk-CQDGOPGH.js";
+import "./chunk-3NFFJL5D.js";
+import "./chunk-F3P7N7SF.js";
+import "./chunk-PKBHS4AA.js";
+import "./chunk-P32RUW3B.js";
+import "./chunk-QA4O2GGC.js";
+import "./chunk-Q2TECDIT.js";
+import "./chunk-TUULXQRW.js";
+import "./chunk-BQGDB6ZL.js";
 import "./chunk-TV45EUGM.js";
 
 // packages/cli/dist/contracts-commands.js

package/dist/{chunk-TW3KOSQK.js → chunk-BXYMYEJ4.js}

@@ -5,11 +5,11 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   nearRepos
-} from "./chunk-OMPENNWY.js";
+} from "./chunk-4U276ICE.js";
 import {
   gitUser,
   loadRepos
-} from "./chunk-XOL3GFW2.js";
+} from "./chunk-PKBHS4AA.js";
 import {
   ManifestEditError,
   REPO_DESCRIPTION_MAX,
@@ -21,10 +21,11 @@ import {
   manifestFiles,
   parseFacts,
   setManifestDescription
-} from "./chunk-PAINMSID.js";
+} from "./chunk-Q2TECDIT.js";
 import {
   FileChangedError
-} from "./chunk-ODMBPDDV.js";
+} from "./chunk-TUULXQRW.js";
+import "./chunk-BQGDB6ZL.js";
 import "./chunk-TV45EUGM.js";
 
 // packages/cli/dist/repo-commands.js
@@ -75,8 +76,8 @@ async function typeOf(url, description, frameworks = []) {
   if (!await stat(dir).then((s) => s.isDirectory(), () => false))
     return void 0;
   const [{ detectRepoType }, { fsRepo }] = await Promise.all([
-    import("./chunk-RA33EYS4.js"),
-    import("./chunk-5PV7S2ZP.js")
+    import("./chunk-FFLNS6VP.js"),
+    import("./chunk-CX4RZ2KS.js")
   ]);
   const d = await detectRepoType(fsRepo(basename(dir), dir, "0".repeat(40)), {
     ...description ? { description } : {},

package/dist/{chunk-HK3VOHIE.js → chunk-C3RY6KU6.js}

@@ -10,21 +10,21 @@ import {
   impact,
   openIndex,
   translate
-} from "./chunk-5WERBKLE.js";
+} from "./chunk-ISUAAMGS.js";
 import {
   readRound,
   reviewedGates,
   roundsOf
-} from "./chunk-K332XW7K.js";
+} from "./chunk-S4PMJU6H.js";
 import {
   changeFolder,
   changeStore
-} from "./chunk-HSZMPH5T.js";
+} from "./chunk-IDKCWSM5.js";
 import {
   baseClonePath,
   gitUser,
   loadRepos
-} from "./chunk-XOL3GFW2.js";
+} from "./chunk-PKBHS4AA.js";
 import {
   API_VERSION,
   DEFAULT_PORT,
@@ -32,6 +32,7 @@ import {
   RECORD_KINDS,
   RecordId,
   Severity,
+  api_exports,
   catalogDirOf,
   factsDirOf,
   fastPathOf,
@@ -47,11 +48,11 @@ import {
   runsDirOf,
   specsDirOf,
   withSignal
-} from "./chunk-PAINMSID.js";
+} from "./chunk-Q2TECDIT.js";
 import {
   FileChangedError,
   SCHEMA_VERSION
-} from "./chunk-ODMBPDDV.js";
+} from "./chunk-TUULXQRW.js";
 
 // packages/server/dist/http.js
 var HttpError = class extends Error {
@@ -136,7 +137,7 @@ function intParam(q, name, min, max) {
 var strParam = (q, name) => q.get(name) || void 0;
 
 // packages/server/dist/server.js
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { createServer } from "node:http";
 
 // packages/server/dist/jobs.js
@@ -580,7 +581,7 @@ function appCsp(port, embed) {
   ].join("; ");
 }
 var escapeAttr = (s) => s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
-async function staticFile(givenDir, path, token) {
+async function staticFile(givenDir, path, token, pageKey) {
   const dir = resolve(givenDir);
   let rel;
   try {
@@ -600,7 +601,12 @@ async function staticFile(givenDir, path, token) {
   const ext = extname(target).toLowerCase();
   const type = TYPES[ext] ?? "application/octet-stream";
   if (ext === ".html") {
-    const html = (await readFile2(target, "utf8")).replace(/<meta name="atticus-token" content="[^"]*"\s*\/?>/, `<meta name="atticus-token" content="${escapeAttr(token)}" />`);
+    const tokenMeta = `<meta name="atticus-token" content="${escapeAttr(token)}" />`;
+    const keyMeta = pageKey === void 0 ? "" : `<meta name="atticus-page-key" content="${escapeAttr(pageKey)}" />`;
+    let html = (await readFile2(target, "utf8")).replace(/<meta name="atticus-token" content="[^"]*"\s*\/?>/, () => tokenMeta);
+    if (keyMeta)
+      html = /<meta name="atticus-page-key" content="[^"]*"\s*\/?>/.test(html) ? html.replace(/<meta name="atticus-page-key" content="[^"]*"\s*\/?>/, () => keyMeta) : html.replace(tokenMeta, () => `${tokenMeta}
+    ${keyMeta}`);
     return { status: 200, type, body: html, cache: "no-store" };
   }
   return {
@@ -612,6 +618,91 @@ async function staticFile(givenDir, path, token) {
   };
 }
 
+// packages/server/dist/confirm.js
+import { randomBytes, timingSafeEqual } from "node:crypto";
+var CONFIRM_TTL_MS = 12e4;
+var MAX_OPEN = 256;
+var Confirmations = class {
+  now;
+  open = /* @__PURE__ */ new Map();
+  constructor(now = () => Date.now()) {
+    this.now = now;
+  }
+  issue(write, target) {
+    const t = this.now();
+    for (const [k, v] of this.open)
+      if (v.until < t)
+        this.open.delete(k);
+    while (this.open.size >= MAX_OPEN)
+      this.open.delete(this.open.keys().next().value);
+    const confirmation = randomBytes(32).toString("base64url");
+    const until = t + CONFIRM_TTL_MS;
+    this.open.set(confirmation, { write, target, until });
+    return { confirmation, write, target, expiresAt: new Date(until).toISOString() };
+  }
+  /**
+   * Whether `given` confirms this write of this target now. It is spent whatever the answer, so a
+   * confirmation is never tried twice: a replay, another target or another write is refused.
+   */
+  take(write, target, given) {
+    if (typeof given !== "string" || !given)
+      return false;
+    const c = this.open.get(given);
+    if (!c)
+      return false;
+    this.open.delete(given);
+    return c.write === write && c.target === target && this.now() <= c.until;
+  }
+};
+function sameSecret(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+var WITHOUT_THE_APP = {
+  handoff: {
+    what: "Raising a hand-off opens a PR",
+    cli: "atticus change handoff <change> --approve"
+  },
+  "release-prs": {
+    what: "Raising the release PRs pushes the change branch and opens PRs",
+    cli: "atticus change release-prs <change> --approve"
+  },
+  merge: { what: "Merging a ready PR", cli: "atticus change sync <change> --approve" },
+  "task-pr": {
+    what: "Raising a task's PR pushes its branch and opens a PR",
+    cli: "atticus task run <change> <task> --level pr --approve"
+  },
+  "digest-send": {
+    what: "Sending the digest posts a message",
+    cli: "atticus digest --send"
+  },
+  propose: {
+    what: "Propose for review pushes a branch and opens a PR",
+    cli: "git commit, push and open the PR yourself"
+  },
+  "step-run": {
+    what: "Running a step with a team's tool acts on their systems",
+    cli: "atticus todo run <step> --with <executor> --approve <you> --inputs <sha-256>"
+  },
+  "ai-model": {
+    what: "Changing where runtime.yaml sends the model's key (its provider, keyEnv or address)",
+    cli: "edit runtime.yaml yourself and propose it for review"
+  },
+  "ai-test": {
+    what: "Testing model settings that aren't committed sends the key to them",
+    cli: "commit runtime.yaml first, or run the step from the command line"
+  }
+};
+function needsConfirmation(write) {
+  const w = WITHOUT_THE_APP[write];
+  return new HttpError(403, "This needs a person's confirmation", `${w.what}, which a person confirms: click it in the Atticus app, or run ${w.cli} in a terminal. The session token alone (atticus ui --show-token, for assistants and scripts) never approves a write to a shared system (ADR 0186).`, { confirm: write });
+}
+function requireConfirmation(c, write, target, given) {
+  if (!c.take(write, target, given))
+    throw needsConfirmation(write);
+}
+
 // packages/server/dist/watch.js
 import { statSync, watch } from "node:fs";
 import { join as join3, relative, sep as sep2 } from "node:path";
@@ -893,11 +984,8 @@ var EventHub = class {
   }
 };
 var MAX_BODY = 4 * 1024 * 1024;
-function sameToken(a, b) {
-  const x = Buffer.from(a);
-  const y = Buffer.from(b);
-  return x.length === y.length && timingSafeEqual(x, y);
-}
+var sameToken = sameSecret;
+var STRONG = /^[A-Za-z0-9_-]{32,}$/;
 async function readBody(req, max = MAX_BODY) {
   const chunks = [];
   let size = 0;
@@ -939,9 +1027,11 @@ async function startServer(o) {
   const host = o.host ?? "127.0.0.1";
   if (host !== "127.0.0.1")
     throw new Error(`Atticus only listens on 127.0.0.1 (asked for ${host}).`);
-  const token = o.token && /^[A-Za-z0-9_-]{32,}$/.test(o.token) ? o.token : randomBytes(32).toString("base64url");
+  const token = o.token && STRONG.test(o.token) ? o.token : randomBytes2(32).toString("base64url");
+  const pageKey = o.pageKey && STRONG.test(o.pageKey) && o.pageKey !== token ? o.pageKey : randomBytes2(32).toString("base64url");
   const events = new EventHub();
   const jobs = new JobManager((e) => events.publish(e));
+  const confirmations = new Confirmations();
   const person = o.user ? { handle: o.user, source: "given" } : await gitUser(o.root);
   const ctx = {
     root: o.root,
@@ -950,9 +1040,17 @@ async function startServer(o) {
     version: o.version ?? "0.0.0",
     full: o.full === true,
     events,
-    jobs
+    jobs,
+    confirmations
   };
-  const router = apiRoutes(new Router(), ctx).add("GET", "/api/jobs/{jobId}", ({ params }) => {
+  const router = apiRoutes(new Router(), ctx).add("POST", "/api/confirmations", ({ body }) => {
+    const b = api_exports.ConfirmationRequest.safeParse(body ?? {});
+    if (!b.success)
+      throw badRequest(`Say which write and what for: { write: ${api_exports.CONFIRMED_WRITES.join(" | ")}, target }.`);
+    if (!b.data.pageKey || !sameSecret(b.data.pageKey, pageKey))
+      throw new HttpError(403, "Only the Atticus app asks for a confirmation", "A write to a shared system is a person's: they click it in the Atticus app, or run its command with --approve in a terminal. The session token alone (atticus ui --show-token) can't confirm one (ADR 0186).");
+    return { status: 201, body: confirmations.issue(b.data.write, b.data.target) };
+  }).add("GET", "/api/jobs/{jobId}", ({ params }) => {
     const j = jobs.get(params.jobId);
     if (!j)
       throw notFound(`There is no job ${params.jobId}.`);
@@ -998,7 +1096,7 @@ async function startServer(o) {
           throw new HttpError(403, "Requests must be addressed to this server");
         if (!o.staticDir || req.method !== "GET" && req.method !== "HEAD")
           throw new HttpError(404, "Not found", `Nothing is served at ${url.pathname}.`);
-        const f = await staticFile(o.staticDir, url.pathname, token);
+        const f = await staticFile(o.staticDir, url.pathname, token, pageKey);
         const { "X-Frame-Options": deny, ...rest } = HARDENING;
         res.writeHead(f.status, {
           ...o.embed ? rest : { ...rest, "X-Frame-Options": deny },
@@ -1064,6 +1162,8 @@ Connection: close\r
     url: `http://127.0.0.1:${port}`,
     port,
     token,
+    pageKey,
+    confirmations,
     events,
     jobs,
     person,
@@ -1085,5 +1185,6 @@ export {
   notFound,
   conflict,
   strParam,
+  requireConfirmation,
   startServer
 };

package/dist/chunk-C4R4JLHE.js

@@ -0,0 +1,40 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  changeEstimateCommand,
+  estimateOf
+} from "./chunk-BDKC6H5P.js";
+import "./chunk-IH2XURVQ.js";
+import "./chunk-WF7B67YE.js";
+import "./chunk-6PPOWY5E.js";
+import "./chunk-OHNCWBKF.js";
+import "./chunk-BTGPE6CR.js";
+import "./chunk-MUWDB4R4.js";
+import "./chunk-R7NYHMUU.js";
+import "./chunk-IVBOQAGB.js";
+import "./chunk-ISUAAMGS.js";
+import "./chunk-S4PMJU6H.js";
+import "./chunk-IDKCWSM5.js";
+import "./chunk-UUU4CLJG.js";
+import "./chunk-7IGKHZ4Z.js";
+import "./chunk-J2JAKCIW.js";
+import "./chunk-745DAZ4L.js";
+import "./chunk-CXJ6FUKN.js";
+import "./chunk-QKUJMING.js";
+import "./chunk-6ZGLAACW.js";
+import "./chunk-CQDGOPGH.js";
+import "./chunk-3NFFJL5D.js";
+import "./chunk-PKBHS4AA.js";
+import "./chunk-P32RUW3B.js";
+import "./chunk-QA4O2GGC.js";
+import "./chunk-Q2TECDIT.js";
+import "./chunk-TUULXQRW.js";
+import "./chunk-BQGDB6ZL.js";
+import "./chunk-TV45EUGM.js";
+export {
+  changeEstimateCommand,
+  estimateOf
+};

package/dist/{chunk-Z3QFH7YG.js → chunk-CADWLE2T.js}

@@ -6,10 +6,11 @@ var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   routeQuestions,
   ruleOffers
-} from "./chunk-FQ6WH6PB.js";
-import "./chunk-XOL3GFW2.js";
-import "./chunk-PAINMSID.js";
-import "./chunk-ODMBPDDV.js";
+} from "./chunk-JA5FI3QV.js";
+import "./chunk-PKBHS4AA.js";
+import "./chunk-Q2TECDIT.js";
+import "./chunk-TUULXQRW.js";
+import "./chunk-BQGDB6ZL.js";
 import "./chunk-TV45EUGM.js";
 export {
   routeQuestions,

package/dist/{chunk-J2O4LFVI.js → chunk-CBGGOQWU.js}

@@ -5,12 +5,14 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   listRuns
-} from "./chunk-BA2HUMDN.js";
-import "./chunk-QHJJMZLX.js";
+} from "./chunk-GZY6RUZ6.js";
+import "./chunk-P32RUW3B.js";
+import "./chunk-QA4O2GGC.js";
 import {
   runsDirOf
-} from "./chunk-PAINMSID.js";
-import "./chunk-ODMBPDDV.js";
+} from "./chunk-Q2TECDIT.js";
+import "./chunk-TUULXQRW.js";
+import "./chunk-BQGDB6ZL.js";
 import "./chunk-TV45EUGM.js";
 
 // packages/cli/dist/handoff-resume.js

package/dist/chunk-CMDXGQTS.js

@@ -0,0 +1,47 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  REPO_READER,
+  mapCommand,
+  mapStateOf,
+  readAnswer,
+  repoReaderAgent,
+  ruleLineOf,
+  rulesCovering,
+  taughtIn
+} from "./chunk-X5F3Q5LV.js";
+import "./chunk-OUBGGKDU.js";
+import "./chunk-BPK5P77O.js";
+import "./chunk-EHA7RMZ3.js";
+import "./chunk-WXFLMQSR.js";
+import "./chunk-TYQBFTBR.js";
+import "./chunk-2F4CYZKJ.js";
+import "./chunk-LO6P2VYG.js";
+import "./chunk-BEVTIBRH.js";
+import "./chunk-J2JAKCIW.js";
+import "./chunk-745DAZ4L.js";
+import "./chunk-CXJ6FUKN.js";
+import "./chunk-QKUJMING.js";
+import "./chunk-6ZGLAACW.js";
+import "./chunk-CQDGOPGH.js";
+import "./chunk-3NFFJL5D.js";
+import "./chunk-PKBHS4AA.js";
+import "./chunk-P32RUW3B.js";
+import "./chunk-QA4O2GGC.js";
+import "./chunk-Q2TECDIT.js";
+import "./chunk-TUULXQRW.js";
+import "./chunk-BQGDB6ZL.js";
+import "./chunk-TV45EUGM.js";
+export {
+  REPO_READER,
+  mapCommand,
+  mapStateOf,
+  readAnswer,
+  repoReaderAgent,
+  ruleLineOf,
+  rulesCovering,
+  taughtIn
+};

package/dist/{chunk-TWQRPM76.js → chunk-CQDGOPGH.js}

@@ -10,13 +10,14 @@ import {
   globToRegExp,
   memoryRepo,
   scanRepo
-} from "./chunk-7AB6OWTV.js";
+} from "./chunk-3NFFJL5D.js";
 import {
   Dialect,
   FrameworkModel,
   MESH_KEY,
   RECORD_SCHEMAS,
   RecordId,
+  cmpText,
   fieldTemplates,
   interfaceId,
   matchType,
@@ -24,9 +25,11 @@ import {
   readTarGz,
   readZip,
   renderExpr,
-  renderTemplate,
+  renderTemplate
+} from "./chunk-Q2TECDIT.js";
+import {
   require_dist
-} from "./chunk-PAINMSID.js";
+} from "./chunk-BQGDB6ZL.js";
 import {
   __commonJS,
   __require,
@@ -1677,7 +1680,7 @@ async function configSources(repo, globs = [
 }
 function layer(sources2, keep) {
   const rank = (s) => !s.profile ? 0 : PROD.test(s.profile) ? 1 : 2;
-  const ordered = sources2.filter(keep).sort((a, b) => rank(a) - rank(b) || (a.profile ?? "").localeCompare(b.profile ?? "") || a.file.split("/").pop().length - b.file.split("/").pop().length || a.file.localeCompare(b.file));
+  const ordered = sources2.filter(keep).sort((a, b) => rank(a) - rank(b) || cmpText(a.profile ?? "", b.profile ?? "") || a.file.split("/").pop().length - b.file.split("/").pop().length || cmpText(a.file, b.file));
   const out2 = /* @__PURE__ */ new Map();
   for (const s of ordered)
     for (const [k, v] of s.values)
@@ -2670,7 +2673,7 @@ async function dotenv(repo) {
   for await (const p of repo.listFiles([".env", "**/.env", ".env.example", "**/.env.example"]))
     if (!skipPath(p))
       files.push(p);
-  files.sort((a, b) => Number(a.endsWith(".example")) - Number(b.endsWith(".example")) || a.split("/").length - b.split("/").length || a.localeCompare(b));
+  files.sort((a, b) => Number(a.endsWith(".example")) - Number(b.endsWith(".example")) || a.split("/").length - b.split("/").length || cmpText(a, b));
   for (const f of files) {
     (await repo.readText(f)).split(/\r?\n/).forEach((raw, i2) => {
       const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*(.*?)\s*$/.exec(raw);
@@ -4087,7 +4090,7 @@ async function wrapperRequests(repo, paths, scriptOf = (_p, t) => t) {
     if (url)
       out2.push({ method: w.method.v, url, path: w.at.path, line: w.at.line });
   }
-  return out2.sort((x, y) => x.path.localeCompare(y.path) || x.line - y.line);
+  return out2.sort((x, y) => cmpText(x.path, y.path) || x.line - y.line);
 }
 
 // packages/extractors/dist/lang/sql.js
@@ -4709,7 +4712,7 @@ var migrationsExtractor = defineExtractor({
       for (let i2 = 0; i2 < Math.max(x.length, y.length); i2++)
         if ((x[i2] ?? 0) !== (y[i2] ?? 0))
           return (x[i2] ?? 0) - (y[i2] ?? 0);
-      return a.path.localeCompare(b.path);
+      return cmpText(a.path, b.path);
     });
     let first2 = true;
     const state = new DesignState();
@@ -6293,7 +6296,7 @@ var springExtractor = defineExtractor({
   }
 });
 function* settings(repoName, component2, config) {
-  for (const [key, v] of [...config.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+  for (const [key, v] of [...config.entries()].sort(([a], [b]) => cmpText(a, b))) {
     const kind = SETTING_KIND.find(([re2]) => re2.test(key.split(".").pop() ?? ""))?.[1];
     if (!kind || v.value === "")
       continue;
@@ -6922,7 +6925,7 @@ var int = (v) => {
   return Number.isInteger(n) && n >= 0 ? n : void 0;
 };
 function deployment(f) {
-  const ingress = [...f.ingress ?? []].sort((a, b) => `${a.host}|${a.path ?? ""}`.localeCompare(`${b.host}|${b.path ?? ""}`));
+  const ingress = [...f.ingress ?? []].sort((a, b) => cmpText(`${a.host}|${a.path ?? ""}`, `${b.host}|${b.path ?? ""}`));
   return {
     schemaVersion: 1,
     kind: "Deployment",
@@ -7003,7 +7006,7 @@ async function loadTerraform(repo, ctx, relevant) {
     byDir.set(dirOf2(path), [...byDir.get(dirOf2(path)) ?? [], { path, text: text2 }]);
   }
   const folders = /* @__PURE__ */ new Map();
-  for (const [dir, list2] of [...byDir.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+  for (const [dir, list2] of [...byDir.entries()].sort(([a], [b]) => cmpText(a, b))) {
     const f = {
       dir,
       relevant: list2.some((x) => x.path.endsWith(".tf") && relevant.test(x.text)),
@@ -7608,6 +7611,7 @@ async function repoConfigFiles(repo, globs) {
 }
 function dialectExtractor(dialect, parents = /* @__PURE__ */ new Map(), o = {}) {
   const rules = /* @__PURE__ */ new Map();
+  const applied = /* @__PURE__ */ new Set();
   const visit = (d, seen) => {
     for (const p of d.extends) {
       if (seen.has(p))
@@ -7615,8 +7619,11 @@ function dialectExtractor(dialect, parents = /* @__PURE__ */ new Map(), o = {})
       const parent = parents.get(p);
       if (!parent)
         throw new Error(`dialect ${d.name} extends ${p}, which isn't loaded`);
+      if (applied.has(p))
+        continue;
       visit(parent, /* @__PURE__ */ new Set([...seen, p]));
     }
+    applied.add(d.name);
     for (const r of d.rules)
       rules.set(r.id, r);
   };
@@ -7738,7 +7745,7 @@ function dialectExtractor(dialect, parents = /* @__PURE__ */ new Map(), o = {})
         }
         tables.set(name2, table);
       }
-      for (const rule of [...rules.values()].sort((a, b) => a.id.localeCompare(b.id))) {
+      for (const rule of [...rules.values()].sort((a, b) => cmpText(a.id, b.id))) {
         const emits = Array.isArray(rule.emit) ? rule.emit : [rule.emit];
         const yamlValues = await yamlFor([
           ...emits.flatMap(templatesOf),
@@ -8218,7 +8225,7 @@ function attrGroup(src, open, close) {
 }
 async function appsettings(repo) {
   const files = await listSources(repo, ["**/appsettings.json", "**/appsettings.*.json"]);
-  files.sort((a, b) => a.split("/").pop().length - b.split("/").pop().length || a.localeCompare(b));
+  files.sort((a, b) => a.split("/").pop().length - b.split("/").pop().length || cmpText(a, b));
   const out2 = /* @__PURE__ */ new Map();
   for (const f of files) {
     const flat2 = flattenYaml(stripJsonComments(await repo.readText(f)), f, repo.parseCache);
@@ -8487,7 +8494,7 @@ var dotnetExtractor = defineExtractor({
     }
     const csproj = (await listSources(repo, ["**/*.csproj"])).map((p) => repo.readText(p));
     const packages = (await Promise.all(csproj)).join("\n");
-    for (const [key, v] of [...config.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    for (const [key, v] of [...config.entries()].sort(([a], [b]) => cmpText(a, b))) {
       if (!key.startsWith("connectionstrings."))
         continue;
       const scheme = /Npgsql/i.test(packages) ? "postgresql" : /MySql|Pomelo/i.test(packages) ? "mysql" : /SqlClient|SqlServer/i.test(packages) ? "sqlserver" : /Oracle/i.test(packages) ? "oracle" : /(^|;)\s*Host\s*=/i.test(v.value) ? "postgresql" : "sqlserver";
@@ -14737,7 +14744,7 @@ async function readEfCore(repo) {
   const has = (p, name2) => p.attrs.find((a) => a.name === name2);
   const scalar2 = (p) => SCALARS.has(p.type.replace(/^System\./, "")) || enums.has(p.type);
   const info2 = /* @__PURE__ */ new Map();
-  const sorted = entities.map((n) => classes.get(n)).sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line);
+  const sorted = entities.map((n) => classes.get(n)).sort((a, b) => cmpText(a.path, b.path) || a.line - b.line);
   for (const c of sorted) {
     const tableAttr = has(c, "Table");
     const name2 = fluent.get(c.name) ?? (tableAttr && firstString(tableAttr)) ?? sets.get(c.name) ?? c.name;
@@ -16005,7 +16012,7 @@ async function markers(repo, ctx) {
         line: firstLine2(text2, /<Use(WPF|WindowsForms)>/i)
       });
   }
-  return found.sort((a, b) => order.indexOf(a.runtime) - order.indexOf(b.runtime) || a.path.localeCompare(b.path));
+  return found.sort((a, b) => order.indexOf(a.runtime) - order.indexOf(b.runtime) || cmpText(a.path, b.path));
 }
 function joinBase(base, path) {
   if (!base || /^https?:\/\//.test(path))
@@ -19385,7 +19392,7 @@ async function detectModules(repo) {
   }
   if (parts2.size + (rootPart ? 1 : 0) < 2)
     return [];
-  return [...parts2].sort(([a], [b]) => a.localeCompare(b)).map(([path, component2]) => ({ path, component: component2 }));
+  return [...parts2].sort(([a], [b]) => cmpText(a, b)).map(([path, component2]) => ({ path, component: component2 }));
 }
 
 // packages/extractors/dist/dependencies.js