@maycombhq/atticus 2.0.0-beta.21 → 2.0.0-beta.23

package/dist/{chunk-JYMIB5XY.js → chunk-CZ2ZS7AT.js}

@@ -5,10 +5,10 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readOpenApiDocument
-} from "./chunk-TWQRPM76.js";
+} from "./chunk-G6EFXTUO.js";
 import {
   globToRegExp
-} from "./chunk-7AB6OWTV.js";
+} from "./chunk-PQQKZPBU.js";
 import {
   DECLARED_TOPIC,
   DEFAULT_CONVENTIONS,
@@ -25,28 +25,35 @@ import {
   citedFiles,
   claimOnLines,
   clusterServiceAddress,
+  decodeText,
   factIdPart,
   forwardSlashes,
   gatewayBundleTest,
+  isBinaryText,
+  isLfsPointer,
   isPatternPath,
   isSecretPath,
   lineNamesClaim,
   linksFor,
+  listRepoFilesSync,
   normalizePath,
+  notDeviceName,
   noteProblem,
   partsBuildWord,
   partsNamePath,
   plainPathPrefix,
+  quoteHoldsSecret,
   quoteMatches,
   quoteNotRequired,
   redactSecrets,
   staleCite,
   toCanonicalYaml,
+  tokenUnits,
   underFolders
-} from "./chunk-PAINMSID.js";
+} from "./chunk-FPBUTZI5.js";
 
 // packages/verify/dist/source.js
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, normalize, relative, sep } from "node:path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -99,54 +106,65 @@ function skippedFolder(above, name, siblings) {
   return !ONLY_BESIDE.has(name);
 }
 function insideRepo(path) {
-  if (path === "" || isAbsolute(path) || /^[A-Za-z]:/.test(path))
+  const p = path.replace(/\\/g, "/");
+  if (p === "" || p.includes(":") || isAbsolute(p) || p.startsWith("/"))
     return false;
-  const n = normalize(path).split(sep).join("/");
+  if (p.split("/").some((x) => x !== "." && x !== ".." && /[. ]$/.test(x)))
+    return false;
+  const n = normalize(p).split(sep).join("/");
   return n !== ".." && !n.startsWith("../");
 }
 function dirSource(root) {
   let cache;
-  const walk = (dir, above, out) => {
-    let names;
+  let realRoot;
+  const fileAt = (path) => {
+    if (!insideRepo(path))
+      return void 0;
+    const full = join(root, ...path.split("/"));
     try {
-      names = readdirSync(dir).sort();
+      if (!lstatSync(full).isFile())
+        return void 0;
+      realRoot ??= realpathSync(root);
+      const r = relative(realRoot, realpathSync(full));
+      if (!r || r.startsWith("..") || isAbsolute(r))
+        return void 0;
+      return full;
     } catch {
-      return;
-    }
-    for (const name of names) {
-      const full = join(dir, name);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (!skippedFolder(above, name, names))
-          walk(full, [...above, name], out);
-      } else if (st.isFile())
-        out.push(relative(root, full).split(sep).join("/"));
+      return void 0;
     }
   };
   return {
     list() {
-      if (!cache) {
-        cache = [];
-        walk(root, [], cache);
-      }
+      cache ??= listRepoFilesSync(root, { skipFolder: skippedFolder });
       return cache;
     },
     read(path) {
-      if (!insideRepo(path))
+      const full = fileAt(path);
+      if (!full)
         return void 0;
       try {
-        return readFileSync(join(root, ...path.split("/")), "utf8");
+        return decodeText(readFileSync(full));
+      } catch {
+        return void 0;
+      }
+    },
+    size(path) {
+      const full = fileAt(path);
+      if (!full)
+        return void 0;
+      try {
+        return statSync(full).size;
       } catch {
         return void 0;
       }
     }
   };
 }
+var MAX_SOURCE_BYTES = 5 * 1024 * 1024;
+function tooBigToRead(source, path) {
+  const n = source.size?.(path);
+  return n !== void 0 && n > MAX_SOURCE_BYTES;
+}
 
 // packages/verify/dist/frameworks.js
 var FRAMEWORKS = [
@@ -487,6 +505,25 @@ function authPolicyMismatch(auth, file, policy, lines) {
   return MAKES_NONE.has(found.element) ? found : void 0;
 }
 var authChecks = (auth) => CHECKS[auth] ?? auth;
+var bare = (p) => p.trim().replace(/\/+$/, "");
+function apigeePassThrough(o, file, lines, line, path) {
+  if (!bundleRootOf(file))
+    return false;
+  const p = path.trim();
+  const under4 = p.endsWith("/**") ? bare(p.slice(0, -3)) : void 0;
+  const near = lines.slice(Math.max(0, line - 2), line + 1);
+  const element = (tag) => near.flatMap((l) => {
+    const m = new RegExp(`<${tag}>\\s*([^<]*?)\\s*</${tag}>`).exec(l);
+    return m ? [m[1]] : [];
+  });
+  if (o.kind === "entry")
+    return under4 !== void 0 && element("BasePath").some((b) => bare(b) === under4);
+  if (!o.forwards)
+    return false;
+  const target = under4 ?? bare(p);
+  const urlPath = (u) => bare(u.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, ""));
+  return element("URL").some((u) => urlPath(u) === target) || element("Path").some((t) => bare(t) === target) || target === "" && near.some((l) => /<RouteRule[\s>]/.test(l));
+}
 
 // packages/verify/dist/call-security-lines.js
 var CLIENT_CERT = /client[-_ .]?cert|keystore|key[-_ .]?store|ssl[-_ .]?bundle|\.pfx\b|\.p12\b|pkcs12|\bpfx\b|\bp12\b/i;
@@ -581,7 +618,7 @@ function applyCorrections(facts, corrections) {
     const p = outsidePairingFor(as, corrections);
     if (!p)
       return f;
-    if (over && over.at > p.at && over.set?.to !== void 0)
+    if (over && over.set?.to !== void 0 && (over.at > p.at || !!p.ai && !over.ai))
       return f;
     const fixed = correctedFact(f, { ...p, action: "edit", set: { to: p.link.system } });
     if (typeof fixed === "string") {
@@ -2012,8 +2049,22 @@ function isSourceFile(path, firstLine = "", lines, rules = DEFAULT_READ_RULES) {
     return false;
   if (quoteNotRequired(path, firstLine))
     return false;
+  if (isLfsPointer(firstLine))
+    return false;
+  if (isBinaryText(firstLine) || lines && binaryLines(lines))
+    return false;
   return SOURCE_EXT.test(path) || SOURCE_NAME.test(path);
 }
+function binaryLines(lines) {
+  let n = 0;
+  for (const l of lines) {
+    if (isBinaryText(l))
+      return true;
+    if ((n += l.length + 1) > 8e3)
+      return false;
+  }
+  return false;
+}
 var lastPart = (s) => s.split(".").pop() ?? s;
 var TEMPLATED = /\{\{|\}\}|\$\{/;
 function pathIsAName(path) {
@@ -2100,12 +2151,47 @@ function refsOf(f) {
   }
   return out;
 }
+function withCanonicalFiles(f, canonical) {
+  const walk = (x) => {
+    if (Array.isArray(x)) {
+      const out2 = x.map(walk);
+      return out2.some((v, i) => v !== x[i]) ? out2 : x;
+    }
+    if (!x || typeof x !== "object")
+      return x;
+    const o = x;
+    let out;
+    for (const [k, v] of Object.entries(o)) {
+      const w = k === "file" && typeof v === "string" && typeof o.line === "number" ? canonical(v) : walk(v);
+      if (w !== v)
+        (out ??= { ...o })[k] = w;
+    }
+    return out ?? o;
+  };
+  return walk(f);
+}
 async function verifyFacts(o) {
   const rules = readRulesOf(o.conventions);
   const carriedFrom = /* @__PURE__ */ new Map();
   const stale = /* @__PURE__ */ new Map();
   const corrected = applyCorrections(o.facts, o.corrections ?? []);
-  const facts = [...corrected.facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((f) => {
+  let fileList;
+  const listed2 = () => fileList ??= o.source.list();
+  let listedSet;
+  let folded;
+  const fold = (p) => p.replace(/\\/g, "/").toLowerCase();
+  const canonical = (path) => {
+    listedSet ??= new Set(listed2());
+    if (listedSet.has(path))
+      return path;
+    if (!folded) {
+      folded = /* @__PURE__ */ new Map();
+      for (const p of listed2())
+        folded.set(fold(p), folded.has(fold(p)) ? null : p);
+    }
+    return folded.get(fold(path)) ?? path;
+  };
+  const facts = [...corrected.facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0).map((f) => withCanonicalFiles(f, canonical)).map((f) => {
     if (!o.commit || sameCommit(f.commit, o.commit))
       return f;
     const changes = changesFor(o.carry, f.commit);
@@ -2120,7 +2206,8 @@ async function verifyFacts(o) {
     return { ...f, commit: o.commit };
   });
   const readLines = (path) => {
-    const text = insideRepo(path) && !isSecretPath(path) ? o.source.read(path) : void 0;
+    listedSet ??= new Set(listed2());
+    const text = insideRepo(path) && !isSecretPath(path) && listedSet.has(path) ? o.source.read(path) : void 0;
     return text === void 0 ? void 0 : text.replace(/\r\n?/g, "\n").split("\n");
   };
   const linesCache = /* @__PURE__ */ new Map();
@@ -2137,9 +2224,8 @@ async function verifyFacts(o) {
       linesCache.delete(linesCache.keys().next().value);
     return lines;
   };
-  let fileList;
-  const deriveEnv = { lines: linesOf2, files: () => fileList ??= o.source.list() };
-  const checkCite = (cite2, claims, label, withHint = true) => {
+  const deriveEnv = { lines: linesOf2, files: listed2 };
+  const checkCite = (cite2, claims, label, withHint = true, alsoHolds) => {
     const where = `${cite2.file}:${cite2.line}`;
     if (!insideRepo(cite2.file))
       return {
@@ -2203,7 +2289,7 @@ async function verifyFacts(o) {
     ].flatMap((at) => derivedNamesAt(at.file, linesOf2(at.file) ?? [], at.line, deriveEnv));
     const holds = (c) => claimOnLines(lines, cite2.line, c) || // a framework that routes by file place (Razor Pages, WebForms, Next.js)
     c.kind === "route" && pageRouteMatches(cite2.file, lines, (p) => linesOf2(p) !== void 0, c.value) || parts.length > 0 && (c.kind === "route" ? partsNamePath([...near(lines, cite2.line), ...partLines], c.value) : partLines.some((l) => lineNamesClaim(l, c)) || // a word put together from parts (`namespace:task`, a key a helper prefixes)
-    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines, cite2.line))) || o.derivedNames !== false && derivedHolds(c, derivedHere(), partLines, partsNamePath);
+    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines, cite2.line))) || o.derivedNames !== false && derivedHolds(c, derivedHere(), partLines, partsNamePath) || alsoHolds !== void 0 && alsoHolds(lines, cite2.line);
     if (claims && !claims.some(holds))
       return {
         code: "claim-not-on-line",
@@ -2256,7 +2342,7 @@ async function verifyFacts(o) {
         problem(f, "wrong-commit", `${label} was read at ${f.commit}, not at ${o.commit}; read it again`);
       continue;
     }
-    add(f, checkCite(f.cite, claimsOf(f), label));
+    add(f, checkCite(f.cite, claimsOf(f), label, true, f.kind === "entry" || f.kind === "call" ? (ls, n) => apigeePassThrough({ kind: f.kind, forwards: f.kind === "call" && !!f.from }, f.cite.file, ls, n, f.path) : void 0));
     if (f.kind === "entry" && f.authCite)
       add(f, checkCite({ ...f.authCite }, [{ kind: "word", value: f.authCite.value }], `${label} authCite${f.auth ? ` (auth ${f.auth})` : ""}`, false));
     if (f.kind === "entry" && f.authCite && f.auth) {
@@ -2430,6 +2516,11 @@ async function verifyFacts(o) {
       return rest;
     }
     const q = redactSecrets(c.quote);
+    if (q === c.quote && quoteHoldsSecret(q)) {
+      redacted++;
+      const { quote: _secret, ...rest } = c;
+      return rest;
+    }
     if (q !== c.quote)
       redacted++;
     return { ...c, quote: q };
@@ -2464,6 +2555,8 @@ async function verifyFacts(o) {
   const excluded = [];
   for (const p of o.source.list()) {
     o.room?.();
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
+      continue;
     const ls = readLines(p) ?? [""];
     if (!isSourceFile(p, ls[0] ?? "", ls, rules))
       continue;
@@ -2724,15 +2817,28 @@ var linesOf = (text) => {
   const t = text.replace(/\r\n?/g, "\n");
   return (t.endsWith("\n") ? t.slice(0, -1) : t).split("\n");
 };
+var LONG_LINE = 1e3;
+function shownLine(line) {
+  if (line.length <= LONG_LINE)
+    return line;
+  const code2 = line.charCodeAt(LONG_LINE - 1);
+  const at = code2 >= 55296 && code2 <= 56319 ? LONG_LINE - 1 : LONG_LINE;
+  return `${line.slice(0, at)} \u2026 [line cut: ${line.length} characters]`;
+}
 function numberedSlice(text, s) {
-  return linesOf(text).slice(s.from - 1, s.to).map((l, i) => `${s.from + i}| ${l}`).join("\n");
+  return linesOf(text).slice(s.from - 1, s.to).map((l, i) => `${s.from + i}| ${shownLine(l)}`).join("\n");
 }
 var header = (s) => `${s.path} lines ${s.from}-${s.to} of ${s.of} (numbered as in the file)`;
 function sliceText(source, s) {
   return `${header(s)}
 ${numberedSlice(source.read(s.path) ?? "", s)}`;
 }
-var tokensOf = (chars) => Math.ceil(chars / 4);
+var tokensOf = (units) => Math.ceil(units / 4);
+var wrapUnits = (path) => tokenUnits(`<atticus-data id="1-file-0000" kind="code" origin="${path}#L0000000-0000000">
+
+</atticus-data>
+
+`);
 function planBatches(source, o) {
   const room = Math.max(1, o.room);
   const rules = readRulesOf(o.conventions);
@@ -2743,6 +2849,8 @@ function planBatches(source, o) {
   const paths = [];
   const texts = /* @__PURE__ */ new Map();
   for (const p of source.list()) {
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(source, p))
+      continue;
     const text = source.read(p);
     if (text === void 0)
       continue;
@@ -2782,8 +2890,9 @@ function planBatches(source, o) {
     const all2 = linesOf(texts.get(path));
     const of = all2.length;
     lines += of;
-    const sizes = all2.map((l, i) => `${i + 1}| ${l}`.length + 1);
-    const cost = (from2, chars) => tokensOf(header({ path, from: from2, to: of, of }).length + chars);
+    const sizes = all2.map((l, i) => tokenUnits(`${i + 1}| ${shownLine(l)}`) + 1);
+    const wrap = wrapUnits(path);
+    const cost = (from2, units) => tokensOf(tokenUnits(header({ path, from: from2, to: of, of })) + wrap + units);
     const total = sizes.reduce((n, c) => n + c, 0);
     if (cost(1, total) <= fileRoom) {
       slices.push({ path, from: 1, to: of, of, tokens: cost(1, total), kinds: kinds2 });
@@ -4583,6 +4692,11 @@ function buildEstate(records2) {
       }
     });
   }
+  for (const [sys, n] of [...nodes.entries()].filter(([id]) => id.startsWith("system:"))) {
+    const inside = [...repoSystem.entries()].filter(([, s]) => `system:${s}` === sys && systems.has(s)).map(([r]) => r).sort();
+    if (inside.length)
+      n.properties = { ...n.properties, repos: inside };
+  }
   const unknown = (ref) => add({
     id: `unknown:${slug2(ref)}`,
     kind: "unknown",
@@ -5706,10 +5820,20 @@ function rereadPlan(o) {
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
   const status = /* @__PURE__ */ new Map();
   for (const changes of used.values())
-    for (const c of changes)
-      if (c.status !== "deleted")
+    for (const c of changes) {
+      if (c.status === "deleted")
+        continue;
+      if (c.gitlink) {
+        for (const p of o.source.list())
+          if (p.startsWith(`${c.path}/`))
+            status.set(p, "modified");
+      } else
         status.set(c.path, c.status);
+    }
+  const rules = readRulesOf(o.conventions);
   const readable = [...status.keys()].filter((p) => {
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
+      return false;
     const text = o.source.read(p);
     if (text === void 0 || !text.trim())
       return false;
@@ -5740,7 +5864,8 @@ function onlyFiles(source, paths) {
 
 // packages/verify/dist/slips.js
 function slugFactId(id) {
-  return id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/-{2,}/g, "-").replace(/^[^a-z0-9]+/, "").replace(/-+$/, "").slice(0, 120);
+  const slug3 = id.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/-{2,}/g, "-").replace(/^[^a-z0-9]+/, "").replace(/-+$/, "");
+  return notDeviceName(slug3).slice(0, 120);
 }
 var isId = (x) => typeof x === "string" && FactId.safeParse(x).success;
 var isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);