@maycombhq/atticus 2.0.0-beta.22 → 2.0.0-beta.24

package/dist/{chunk-CXJ6FUKN.js → chunk-HNPKCRCE.js}

@@ -5,30 +5,31 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readOpenApiDocument
-} from "./chunk-CQDGOPGH.js";
+} from "./chunk-5FPAKAGE.js";
 import {
   globToRegExp
-} from "./chunk-3NFFJL5D.js";
+} from "./chunk-IJQHBK76.js";
 import {
   DECLARED_TOPIC,
-  DEFAULT_CONVENTIONS,
   Fact,
   FactId,
   JOINED_BY_AI,
+  JOINED_BY_BASE_PATH,
   JOINED_BY_PERSON,
   JOINED_TO_SHARED_MAP,
+  JOIN_GUESS_FLAGS,
   JOIN_HOW_FLAGS,
   LINK_EVIDENCE_NOT_GAPS,
   MOCK_FILE,
-  NEVER_CHECKED_STEPS,
   SHARED_MAP_EVIDENCE,
   citedFiles,
   claimOnLines,
   clusterServiceAddress,
   decodeText,
+  dependencyLinkId,
   factIdPart,
   forwardSlashes,
-  gatewayBundleTest,
+  hasSecretShape,
   isBinaryText,
   isLfsPointer,
   isPatternPath,
@@ -36,8 +37,7 @@ import {
   lineNamesClaim,
   linksFor,
   listRepoFilesSync,
-  normalizePath,
-  notDeviceName,
+  looksLikeSecret,
   noteProblem,
   partsBuildWord,
   partsNamePath,
@@ -48,9 +48,16 @@ import {
   redactSecrets,
   staleCite,
   toCanonicalYaml,
-  tokenUnits,
+  tokenUnits
+} from "./chunk-GJVCBTSO.js";
+import {
+  DEFAULT_CONVENTIONS,
+  NEVER_CHECKED_STEPS,
+  gatewayBundleTest,
+  normalizePath,
+  notDeviceName,
   underFolders
-} from "./chunk-Q2TECDIT.js";
+} from "./chunk-QFDPX6C4.js";
 
 // packages/verify/dist/source.js
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
@@ -166,6 +173,269 @@ function tooBigToRead(source, path) {
   return n !== void 0 && n > MAX_SOURCE_BYTES;
 }
 
+// packages/verify/dist/build-coords.js
+var POM = /(^|\/)pom\.xml$|\.pom$/i;
+var GRADLE_BUILD = /(^|\/)build\.gradle(\.kts)?$/i;
+var GRADLE_SETTINGS = /(^|\/)settings\.gradle(\.kts)?$/i;
+var isPomFile = (p) => POM.test(p.replace(/\\/g, "/"));
+var isGradleFile = (p) => GRADLE_BUILD.test(p.replace(/\\/g, "/")) || GRADLE_SETTINGS.test(p.replace(/\\/g, "/"));
+var isBuildFile = (p) => isPomFile(p) || isGradleFile(p);
+var TAG = /<(\/?)([A-Za-z_][\w.:-]*)([^>]*?)(\/?)>/g;
+function pomCoordinates(lines) {
+  const out = { dependencies: [] };
+  const stack = [];
+  let inComment = false;
+  const names = () => stack.map((f) => f.name);
+  lines.forEach((raw, i) => {
+    const n = i + 1;
+    let line = "";
+    let rest = raw;
+    while (rest.length) {
+      if (inComment) {
+        const end = rest.indexOf("-->");
+        if (end < 0)
+          break;
+        rest = rest.slice(end + 3);
+        inComment = false;
+        continue;
+      }
+      const start = rest.indexOf("<!--");
+      if (start < 0) {
+        line += rest;
+        break;
+      }
+      line += rest.slice(0, start);
+      rest = rest.slice(start + 4);
+      inComment = true;
+    }
+    let last = 0;
+    for (const m of line.matchAll(TAG)) {
+      const text = line.slice(last, m.index);
+      last = m.index + m[0].length;
+      const top2 = stack[stack.length - 1];
+      if (top2 && text.trim() && !top2.text) {
+        top2.text = text.trim();
+        top2.textLine = n;
+      }
+      if (m[2].startsWith("?") || m[0].startsWith("<!"))
+        continue;
+      const close = m[1] === "/";
+      const selfClosing = m[4] === "/";
+      if (!close) {
+        if (top2)
+          top2.children = true;
+        if (selfClosing)
+          continue;
+        stack.push({ name: m[2], leaves: /* @__PURE__ */ new Map(), children: false, text: "", textLine: n });
+        continue;
+      }
+      const at = names().lastIndexOf(m[2]);
+      if (at < 0)
+        continue;
+      while (stack.length > at + 1)
+        stack.pop();
+      const done = stack.pop();
+      const parent = stack[stack.length - 1];
+      if (!done.children && done.text && parent)
+        parent.leaves.set(done.name, { value: done.text, line: done.textLine });
+      const path = [...names(), done.name];
+      if (done.name === "dependency") {
+        out.dependencies.push({
+          ...done.leaves.get("groupId") ? { group: done.leaves.get("groupId") } : {},
+          ...done.leaves.get("artifactId") ? { artifact: done.leaves.get("artifactId") } : {},
+          ...done.leaves.get("version") ? { version: done.leaves.get("version") } : {},
+          ...done.leaves.get("scope") ? { scope: done.leaves.get("scope") } : {},
+          managed: path.includes("dependencyManagement"),
+          plugin: path.includes("plugin") || path.includes("extension")
+        });
+      } else if (done.name === "parent" && path.length === 2 && path[0] === "project") {
+        if (done.leaves.get("groupId"))
+          out.parentGroup = done.leaves.get("groupId");
+        if (done.leaves.get("artifactId"))
+          out.parentArtifact = done.leaves.get("artifactId");
+        if (done.leaves.get("version"))
+          out.parentVersion = done.leaves.get("version");
+      } else if (done.name === "project" && path.length === 1) {
+        if (done.leaves.get("groupId"))
+          out.group = done.leaves.get("groupId");
+        if (done.leaves.get("artifactId"))
+          out.artifact = done.leaves.get("artifactId");
+        if (done.leaves.get("version"))
+          out.version = done.leaves.get("version");
+      }
+    }
+    const top = stack[stack.length - 1];
+    const tail = line.slice(last);
+    if (top && tail.trim() && !top.text) {
+      top.text = tail.trim();
+      top.textLine = n;
+    }
+  });
+  return out;
+}
+var QUOTED = `(['"])([^'"\\s]+)\\`;
+var GRADLE_DEP = new RegExp(`^\\s*([A-Za-z][\\w]*)\\s*\\(?\\s*(?:(platform|enforcedPlatform)\\s*\\(\\s*)?${QUOTED}3`);
+var GRADLE_MAP_DEP = /^\s*([A-Za-z]\w*)\s*\(?\s*group\s*[:=]\s*(['"])([^'"]+)\2\s*,\s*name\s*[:=]\s*(['"])([^'"]+)\4(?:\s*,\s*version\s*[:=]\s*(['"])([^'"]+)\6)?/;
+var NOT_A_CONFIGURATION = /* @__PURE__ */ new Set(["id", "apply", "plugin", "include", "classpath", "group"]);
+function scopeOfConfiguration(c, platform) {
+  if (platform)
+    return "import";
+  if (/^test/i.test(c))
+    return "test";
+  if (/^(compileOnly|annotationProcessor|kapt|compileOnlyApi)$/i.test(c))
+    return "provided";
+  if (/^runtimeOnly$/i.test(c))
+    return "runtime";
+  return "compile";
+}
+function gradleDependencyOn(line) {
+  const map = GRADLE_MAP_DEP.exec(line);
+  if (map && !NOT_A_CONFIGURATION.has(map[1]))
+    return {
+      configuration: map[1],
+      group: map[3],
+      name: map[5],
+      ...map[7] ? { version: map[7] } : {},
+      scope: scopeOfConfiguration(map[1], false)
+    };
+  const m = GRADLE_DEP.exec(line);
+  if (!m || NOT_A_CONFIGURATION.has(m[1]))
+    return void 0;
+  const parts = m[4].split(":");
+  if (parts.length < 2 || !parts[0] || !parts[1])
+    return void 0;
+  return {
+    configuration: m[1],
+    group: parts[0],
+    name: parts[1],
+    ...parts[2] ? { version: parts[2] } : {},
+    scope: scopeOfConfiguration(m[1], !!m[2])
+  };
+}
+function gradleGroupOn(line) {
+  return /^\s*(?:project\.)?group\s*=?\s*(['"])([^'"]+)\1\s*$/.exec(line)?.[2];
+}
+function gradleNameOn(line) {
+  return /^\s*(?:rootProject\.name|archivesBaseName|(?:base\.)?archivesName(?:\.set)?)\s*[=(]?\s*(['"])([^'"]+)\1\s*\)?\s*$/.exec(line)?.[2];
+}
+var PROJECT_GROUP = /^\$\{(project\.|pom\.)?groupId\}$/;
+var citedLine = (f, file, line) => f.cite.file === file && f.cite.line === line || (f.cite.with ?? []).some((p) => p.file === file && p.line === line);
+function buildCoordinatesProblem(f, linesOf2) {
+  const file = f.cite.file;
+  const label = `${f.kind} ${f.id}`;
+  const lines = linesOf2(file);
+  if (!lines)
+    return void 0;
+  const where = `${file}:${f.cite.line}`;
+  if (isPomFile(file))
+    return pomProblem(f, label, where, pomCoordinates(lines));
+  if (isGradleFile(file))
+    return gradleProblem(f, label, where, lines, linesOf2);
+  return `${label} cites ${file}, which is no build file Atticus reads coordinates from: cite the pom.xml, build.gradle or settings.gradle line that writes them`;
+}
+function pomProblem(f, label, where, pom) {
+  const line = f.cite.line;
+  const file = f.cite.file;
+  if (f.kind === "artifact") {
+    if (pom.artifact?.line !== line) {
+      const dep2 = pom.dependencies.find((d) => d.artifact?.line === line);
+      const what = dep2 ? `a dependency's <artifactId> (${dep2.artifact.value})` : pom.parentArtifact?.line === line ? `the <parent>'s <artifactId> (${pom.parentArtifact.value})` : "not the project's own <artifactId>";
+      return `${label} says ${where} is the coordinates the build publishes, and that line is ${what}${pom.artifact ? `: the project's own is at line ${pom.artifact.line}` : ""}`;
+    }
+    if (pom.artifact.value !== f.name)
+      return `${label} names "${f.name}", and ${where} writes the project's artifactId as "${pom.artifact.value}"`;
+    const group2 = pom.group ?? pom.parentGroup;
+    if (!group2)
+      return `${label} names group "${f.group}", and ${file} writes no groupId of the project or its <parent>`;
+    if (group2.value !== f.group)
+      return `${label} names group "${f.group}", and ${file}:${group2.line} writes "${group2.value}"${pom.group ? "" : " (the <parent>'s, which the project inherits)"}`;
+    if (!citedLine(f, file, group2.line))
+      return `${label}: the group is written at ${file}:${group2.line}${pom.group ? "" : " (the <parent>'s)"}; cite that line in cite.with`;
+    return void 0;
+  }
+  const dep = pom.dependencies.find((d) => d.artifact?.line === line);
+  if (!dep) {
+    const what = pom.artifact?.line === line ? "the project's own <artifactId>" : pom.parentArtifact?.line === line ? "the <parent>'s <artifactId>" : "no dependency's <artifactId>";
+    return `${label} says ${where} declares a dependency, and that line is ${what}: cite the <artifactId> line of the <dependency> in <dependencies>`;
+  }
+  if (dep.managed)
+    return `${label} cites ${where}, a <dependencyManagement> entry, which only pins a version: cite the dependency where <dependencies> declares it`;
+  if (dep.plugin)
+    return `${label} cites ${where}, a dependency of a build plugin, not of the component: leave it out`;
+  if (dep.artifact.value !== f.name)
+    return `${label} names "${f.name}", and ${where} declares "${dep.artifact.value}"`;
+  if (!dep.group)
+    return `${label}: the <dependency> at ${where} writes no <groupId>`;
+  const ownGroup = pom.group ?? pom.parentGroup;
+  const group = PROJECT_GROUP.test(dep.group.value) ? ownGroup : dep.group;
+  if (!group || group.value !== f.group)
+    return `${label} names group "${f.group}", and the <dependency> at ${where} writes "${dep.group.value}"${group && group !== dep.group ? ` (${group.value})` : ""}`;
+  if (!citedLine(f, file, dep.group.line))
+    return `${label}: the dependency's group is written at ${file}:${dep.group.line}; cite that line in cite.with`;
+  const declared = dep.scope?.value ?? "compile";
+  if (declared !== (f.scope ?? "compile"))
+    return `${label} says scope ${f.scope ?? "compile"}, and the <dependency> at ${where} declares ${declared}${dep.scope ? ` (${file}:${dep.scope.line})` : ""}`;
+  return void 0;
+}
+function gradleProblem(f, label, where, lines, linesOf2) {
+  const text = lines[f.cite.line - 1] ?? "";
+  if (f.kind === "dependency") {
+    const d = gradleDependencyOn(text);
+    if (!d)
+      return `${label} says ${where} declares a dependency, and that line declares none: cite the line in dependencies { } that names it`;
+    if (d.group !== f.group || d.name !== f.name)
+      return `${label} names "${f.group}:${f.name}", and ${where} declares "${d.group}:${d.name}"`;
+    if (d.scope !== (f.scope ?? "compile"))
+      return `${label} says scope ${f.scope ?? "compile"}, and ${where} declares it with ${d.configuration} (${d.scope})`;
+    return void 0;
+  }
+  const name = gradleNameOn(text);
+  if (name === void 0)
+    return `${label} says ${where} is the coordinates the build publishes, and that line sets no project name: cite rootProject.name in settings.gradle, or archivesBaseName`;
+  if (name !== f.name)
+    return `${label} names "${f.name}", and ${where} sets "${name}"`;
+  const parts = [{ file: f.cite.file, line: f.cite.line }, ...f.cite.with ?? []];
+  const groups = parts.flatMap((p) => {
+    const g2 = gradleGroupOn(linesOf2(p.file)?.[p.line - 1] ?? "");
+    return g2 === void 0 ? [] : [{ ...p, group: g2 }];
+  });
+  if (!groups.length)
+    return `${label}: no line it cites sets the group; cite the build.gradle line that does (group = '${f.group}') in cite.with`;
+  const g = groups[0];
+  if (g.group !== f.group)
+    return `${label} names group "${f.group}", and ${g.file}:${g.line} sets "${g.group}"`;
+  return void 0;
+}
+function buildUnrecorded(files, linesOf2, kept) {
+  const cited = new Set(kept.filter((f) => f.kind === "artifact" || f.kind === "dependency").map((f) => `${f.cite.file}:${f.cite.line}`));
+  const out = [];
+  const add = (file, line, kind, c) => {
+    if (!cited.has(`${file}:${line}`))
+      out.push({ cite: `${file}:${line}`, kind, coordinates: c });
+  };
+  for (const file of [...files].sort()) {
+    const lines = linesOf2(file);
+    if (!lines)
+      continue;
+    if (isPomFile(file)) {
+      const pom = pomCoordinates(lines);
+      const group = pom.group ?? pom.parentGroup;
+      if (pom.artifact)
+        add(file, pom.artifact.line, "artifact", `${group?.value ?? "?"}:${pom.artifact.value}`);
+      for (const d of pom.dependencies)
+        if (!d.managed && !d.plugin && d.artifact)
+          add(file, d.artifact.line, "dependency", `${d.group?.value ?? "?"}:${d.artifact.value}`);
+    } else if (GRADLE_BUILD.test(file.replace(/\\/g, "/"))) {
+      lines.forEach((l, i) => {
+        const d = gradleDependencyOn(l);
+        if (d && d.scope !== "import")
+          add(file, i + 1, "dependency", `${d.group}:${d.name}`);
+      });
+    }
+  }
+  return out;
+}
+
 // packages/verify/dist/frameworks.js
 var FRAMEWORKS = [
   "spring",
@@ -618,7 +888,7 @@ function applyCorrections(facts, corrections) {
     const p = outsidePairingFor(as, corrections);
     if (!p)
       return f;
-    if (over && over.at > p.at && over.set?.to !== void 0)
+    if (over && over.set?.to !== void 0 && (over.at > p.at || !!p.ai && !over.ai))
       return f;
     const fixed = correctedFact(f, { ...p, action: "edit", set: { to: p.link.system } });
     if (typeof fixed === "string") {
@@ -1530,201 +1800,67 @@ function pageRouteMatches(file, lines, exists, path) {
   const route = pageRouteOf(file, lines, exists);
   if (route === void 0)
     return false;
-  const norm = (p) => normalizePath(p.replace(/\{([^}:?]*)[^}]*\}/g, "{$1}")).toLowerCase() || "/";
-  return norm(route) === norm(path);
+  const norm2 = (p) => normalizePath(p.replace(/\{([^}:?]*)[^}]*\}/g, "{$1}")).toLowerCase() || "/";
+  return norm2(route) === norm2(path);
 }
 
-// packages/verify/dist/reachable.js
-var CODE = /\.(java|kt|kts|scala|groovy|cs|vb|fs|py|rb|go|rs|php|swift|ts|tsx|js|mjs|cjs|dart)$/i;
-var MODEL_DIR = /(^|\/)(models?|dtos?|payloads?|schemas?|pojos?|beans|viewmodels?)\//i;
-var MODEL_NAME = /(dto|request|response|payload|model|body)$/i;
-var MODEL_PART = /[._-](dto|model|schema|payload|request|response)\.[^/.]+$/i;
-var MAPS_TABLE = /@Entity\b|@Table\b|@Document\b|\[Table\(|__tablename__|models\.Model\b|@Entity\(|\bgorm\.Model\b/;
-var ROOT_PART = /[._-](controller|resolver|gateway|handlers?|router|routes?|consumer|listener|subscriber|client|publisher|producer|endpoints?)\.[^/.]+$/i;
-var CLIENT_NAME = /(client|gateway|publisher|producer|sender|feign|proxy|connector)$/i;
-var CLIENT_DIR = /(^|\/)(clients?|gateways?|integrations?|publishers?|producers?|outbound)\//i;
-var base = (path) => path.slice(path.lastIndexOf("/") + 1);
-var stem = (path) => {
-  const b = base(path);
-  const dot = b.indexOf(".");
-  return dot > 0 ? b.slice(0, dot) : b;
-};
-function isModelFile(path, text) {
-  if (!CODE.test(path) || readingRank(path) === 5)
-    return false;
-  if (!MODEL_DIR.test(path) && !MODEL_NAME.test(stem(path)) && !MODEL_PART.test(path))
-    return false;
-  return text === void 0 || !MAPS_TABLE.test(text);
-}
-var ENTRY_POINT_NAME = /(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|servlet|webhook|resolver)$/i;
-var ENTRY_POINT_DIR = /(^|\/)(controllers?|routes|routers|handlers|endpoints|listeners|consumers)\//i;
-var ENTRY_POINT_PART = /[._-](controller|resolver|handlers?|router|routes?|consumer|listener|subscriber|endpoints?)\.[^/.]+$/i;
-function isEntryPointFile(path) {
-  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
-    return false;
-  return ENTRY_POINT_NAME.test(stem(path)) || ENTRY_POINT_DIR.test(path) || ENTRY_POINT_PART.test(path);
-}
-function isRootFile(path) {
-  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
-    return false;
-  return readingRank(path) === 2 || isEntryPointFile(path) || ROOT_PART.test(path) || CLIENT_NAME.test(stem(path)) || CLIENT_DIR.test(path);
-}
-var DECLARES = /\b(?:class|record|interface|struct|enum|object)\s+([A-Za-z_][A-Za-z0-9_]*)|^\s*(?:export\s+)?(?:declare\s+)?type\s+([A-Za-z_][A-Za-z0-9_]*)/gm;
-var IDENT = /[A-Za-z_][A-Za-z0-9_]*/g;
-function declaredTypes(path, text) {
-  const out = [];
-  const s = stem(path);
-  if (/^[A-Z][A-Za-z0-9_]*$/.test(s))
-    out.push(s);
-  for (const m of text.matchAll(DECLARES)) {
-    const n = m[1] ?? m[2];
-    if (n && !out.includes(n))
-      out.push(n);
-  }
-  return out;
-}
-function identifiers(text) {
-  return [...new Set(text.match(IDENT) ?? [])];
-}
-var NOT_REACHED_WHY = "model classes no entry point, call or field fact reaches (ADR 0169): left out of the read; atticus map <repo> --models all reads them";
-function reachableModels(o) {
-  const texts = /* @__PURE__ */ new Map();
-  const textOf = (p) => {
-    if (!texts.has(p))
-      texts.set(p, o.read(p) ?? "");
-    return texts.get(p);
-  };
-  const ordered = readingOrder(o.paths);
-  const models = ordered.filter((p) => isModelFile(p, textOf(p))).sort();
-  const isModel = new Set(models);
-  const byName = /* @__PURE__ */ new Map();
-  const declared = /* @__PURE__ */ new Map();
-  for (const p of models) {
-    const names = declaredTypes(p, textOf(p));
-    declared.set(p, names);
-    for (const n of names)
-      byName.set(n, [...byName.get(n) ?? [], p]);
-  }
-  const known = new Set(o.paths);
-  const roots = [];
-  const addRoot = (p) => {
-    if (known.has(p) && !isModel.has(p) && !roots.includes(p))
-      roots.push(p);
-  };
-  const facts = o.facts ?? [];
-  const entries = o.from === "entries";
-  const calls2 = new Set(facts.filter((f) => f.kind === "call").map((f) => f.id));
-  for (const f of facts)
-    if (f.kind === "entry" || f.kind === "call" && !entries)
-      for (const p of citedFiles(f))
-        addRoot(p);
-  for (const p of ordered)
-    if (entries ? isEntryPointFile(p) : isRootFile(p))
-      addRoot(p);
-  const reached = /* @__PURE__ */ new Map();
-  const queue = [];
-  const reach = (names, from, own = []) => {
-    for (const n of names) {
-      if (own.includes(n))
-        continue;
-      for (const p of byName.get(n) ?? []) {
-        const r = reached.get(p);
-        if (r) {
-          if (r.from === from && !r.types.includes(n))
-            r.types.push(n);
-          continue;
-        }
-        reached.set(p, { path: p, types: [n], from });
-        queue.push(p);
-      }
+// packages/verify/dist/secrets.js
+var CONFIG_FILE = /\.(ya?ml|properties|json|xml|config|env|ini|toml|conf|cfg)$|(^|\/)\.env(\.[^/]*)?$|(^|\/)credentials?$/i;
+var isConfigFile = (path) => CONFIG_FILE.test(path.replace(/\\/g, "/"));
+var PLACEHOLDER = /^(<[^>]*>|\*+|x{3,}|changeme|change-me|secret|password|todo|tbd|none|null|nil|dummy|example|sample|test|redacted|your[-_ ].*)$/i;
+var KEY_VALUE = /^\s*(?:-\s+)?(?:export\s+)?["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*(.*?)\s*,?\s*$/;
+var XML_ELEMENT = /<([A-Za-z_][\w.-]*)>([^<]+)<\/\1>/g;
+var XML_NAMED = /\b(?:key|name)\s*=\s*"([^"]+)"\s+value\s*=\s*"([^"]*)"/g;
+var CONNECTION_PAIR = /(?:^|[;"'])\s*([A-Za-z][A-Za-z0-9 _.-]*?)\s*=\s*([^;"'<>\s][^;"'<>]*)/g;
+var TOKEN_VALUE_KEY = /^(value|val)$/i;
+var TOKEN_NAME = /^\s*"(xpath|name|key)"\s*:\s*"([^"]+)"/;
+function isReference(value) {
+  return /^(vault|env|secret|ref|arn|kms|sm|gcp-sm|azure-kv|classpath\*?|file):/i.test(value) || /\$\{|\{\{/.test(value) || /^(~|\.{1,2})?\/[\w.\-/]+$/.test(value) || /^[\w.-]+(\/[\w.-]+)+\.[A-Za-z0-9]{1,10}$/.test(value);
+}
+var unquote = (v) => v.replace(/\s+#.*$/, "").replace(/^["']|["']$/g, "").trim();
+function tokenKeyNear(lines, i) {
+  for (const step of [-1, 1])
+    for (let j = i + step; j >= 0 && j < lines.length && Math.abs(j - i) <= 4; j += step) {
+      const l = lines[j];
+      const m = TOKEN_NAME.exec(l);
+      if (m)
+        return m[2];
+      if (/[{}]/.test(l))
+        break;
     }
-  };
-  for (const p of roots)
-    reach(identifiers(textOf(p)), p);
-  for (const f of facts) {
-    for (const p of citedFiles(f))
-      if (isModel.has(p) && !reached.has(p)) {
-        reached.set(p, { path: p, types: [...(declared.get(p) ?? []).slice(0, 1)], from: f.id });
-        queue.push(p);
-      }
-    if (f.kind === "field" && !(entries && calls2.has(f.owner)))
-      reach(identifiers([f.type ?? "", f.transform === "message type" ? f.name : ""].join(" ")), f.id);
-  }
-  const rooted = roots.length > 0 || reached.size > 0;
-  if (!rooted)
-    return {
-      rooted,
-      roots,
-      reached: models.map((p) => ({ path: p, types: declared.get(p) ?? [], from: "" })),
-      notReached: [],
-      models: models.length
-    };
-  for (let i = 0; i < queue.length; i++) {
-    const p = queue[i];
-    reach(identifiers(textOf(p)), p, declared.get(p));
-  }
-  return {
-    rooted,
-    roots,
-    reached: queue.map((p) => reached.get(p)),
-    notReached: models.filter((p) => !reached.has(p)),
-    models: models.length
-  };
-}
-
-// packages/verify/dist/method.js
-var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-function wordsOf(line) {
-  return line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
-}
-function methodOnLines(method, lines) {
-  const m = method.toLowerCase();
-  return lines.some((l) => wordsOf(l).includes(m));
+  return void 0;
 }
-var CHAIN_LINES = 8;
-var CONTINUES = /^\s*\??\./;
-function chainOf(file, line) {
-  const at = (n) => file?.[n - 1];
-  const cited = at(line);
-  if (cited === void 0)
+function liveSecretsIn(file, lines) {
+  if (!isConfigFile(file))
     return [];
-  const out = [cited];
-  for (let n = line, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n--) {
-    const above = at(n - 1);
-    if (above === void 0)
-      break;
-    out.push(above);
-  }
-  for (let n = line + 1, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n++)
-    out.push(at(n));
+  const out = [];
+  lines.forEach((text, i) => {
+    if (/^\s*(#|\/\/|;|<!--)/.test(text))
+      return;
+    const pairs = [];
+    const kv = KEY_VALUE.exec(text);
+    if (kv) {
+      const key = TOKEN_VALUE_KEY.test(kv[1]) ? tokenKeyNear(lines, i) ?? kv[1] : kv[1];
+      pairs.push({ key, value: unquote(kv[2]) });
+    }
+    for (const m of text.matchAll(XML_ELEMENT))
+      pairs.push({ key: m[1], value: m[2].trim() });
+    for (const m of text.matchAll(XML_NAMED))
+      pairs.push({ key: m[1], value: m[2].trim() });
+    if (text.includes(";"))
+      for (const m of text.matchAll(CONNECTION_PAIR))
+        pairs.push({ key: m[1].trim(), value: m[2].trim() });
+    const named = pairs.find(({ key, value }) => value && !PLACEHOLDER.test(value) && // a key with a nested map under it, or an encrypted value (`{cipher}…`), sets nothing here
+    !/^[{[]/.test(value) && !isReference(value) && looksLikeSecret(key, value));
+    if (named) {
+      out.push({ file, line: i + 1, key: named.key });
+      return;
+    }
+    if (hasSecretShape(text))
+      out.push({ file, line: i + 1, key: pairs[0]?.key ?? "(token)" });
+  });
   return out;
 }
-function methodUnseenOf(f, lines, factOf) {
-  if (f.kind !== "entry" && f.kind !== "call")
-    return void 0;
-  if (!f.method || !HTTP_METHODS.has(f.method.toUpperCase()))
-    return void 0;
-  const at = (file, line) => lines(file)?.[line - 1];
-  const route = f.kind === "call" && f.from ? factOf?.(f.from) : void 0;
-  const forwards = route?.kind === "entry" && route.method?.toUpperCase() === f.method.toUpperCase();
-  const looked = [
-    ...chainOf(lines(f.cite.file), f.cite.line),
-    at(f.cite.file, f.cite.line + 1),
-    ...(f.cite.with ?? []).map((p) => at(p.file, p.line)),
-    ...forwards ? [at(route.cite.file, route.cite.line), at(route.cite.file, route.cite.line + 1)] : []
-  ].filter((l) => l !== void 0);
-  if (methodOnLines(f.method, looked))
-    return void 0;
-  const cite2 = `${f.cite.file}:${f.cite.line}`;
-  const method = f.method.toUpperCase();
-  return {
-    id: f.id,
-    kind: f.kind,
-    method,
-    cite: cite2,
-    message: `${f.id} claims ${method}, which neither ${cite2}, the chain it is in, the next line, a cite.with line nor the route it forwards writes`
-  };
-}
 
 // packages/verify/dist/skipped.js
 function notReadForSkipped(path, rules = DEFAULT_READ_RULES) {
@@ -1744,10 +1880,10 @@ var NOT_TOPIC_LAST = new Set("com org net io dev app ai co uk de fr in jp us eu
 var NOT_TOPIC_FIRST = new Set("com org net io java javax jakarta android androidx kotlin kotlinx scala sun microsoft system google apache spring springframework management server logging hibernate jdk www".split(" "));
 var DOTTED_TOPIC = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*){2,}$/;
 var SEPARATED_NAME = /^[A-Za-z][A-Za-z0-9_]*([._:-][A-Za-z0-9_]+)+$/;
-var QUOTED = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
-var KEY_VALUE = /^\s*-?\s*["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*([^\s"'#]+)\s*$/;
+var QUOTED2 = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
+var KEY_VALUE2 = /^\s*-?\s*["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*([^\s"'#]+)\s*$/;
 var ELEMENT_TEXT = /<([A-Za-z][\w:.-]*)[^>]*>([^<\s]+)<\/\1>/g;
-var wordsOf2 = (line) => line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
+var wordsOf = (line) => line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
 var TOPIC_WORDS = /* @__PURE__ */ new Set([
   "topic",
   "topics",
@@ -1761,7 +1897,7 @@ var TOPIC_WORDS = /* @__PURE__ */ new Set([
   "exchanges"
 ]);
 var topicContext = (line) => {
-  const w = wordsOf2(line);
+  const w = wordsOf(line);
   return w.some((x) => TOPIC_WORDS.has(x)) || w.join(" ").includes("routing key");
 };
 var BUILD_KEY_WORDS = new Set("scm git gitlab github bitbucket repository repositories repo registry mirror mirrors nexus artifactory snapshot snapshots distribution maven npm nuget pypi sonar sonarqube jenkins ci".split(" "));
@@ -1772,7 +1908,7 @@ var keysBefore = (prefix) => [
   ...[...prefix.matchAll(/["']?([A-Za-z][\w.-]*)["']?\s*[:=]/g)].map((m) => m[1]),
   ...[...prefix.matchAll(/\b([A-Za-z]\w*)\s*\{/g)].map((m) => m[1])
 ];
-var isBuildUrl = (u, prefix) => /\.git\/?$/i.test(u) || /\bscm:\w+:$/i.test(prefix) || keysBefore(prefix).some((k) => wordsOf2(k).some((w) => BUILD_KEY_WORDS.has(w)));
+var isBuildUrl = (u, prefix) => /\.git\/?$/i.test(u) || /\bscm:\w+:$/i.test(prefix) || keysBefore(prefix).some((k) => wordsOf(k).some((w) => BUILD_KEY_WORDS.has(w)));
 var HEADER_ARG = /header\w*\s*(?:\.\s*\w+\s*)?\(\s*(?:(?:value|name)\s*=\s*)?$/i;
 var isHeaderName = (s, prefix) => /^x-/i.test(s) || HEADER_ARG.test(prefix.replace(/["'`]$/, ""));
 var cleanUrl = (u) => u.replace(/[.:]+$/, "").replace(/^([a-z0-9+.-]+:\/\/)[^/@\s]+@/i, "$1<redacted>@");
@@ -1863,11 +1999,11 @@ function candidatesIn(path, lines) {
         add("url", u);
       urls.push(m[0]);
     }
-    const strings2 = [...code2.matchAll(QUOTED)].map((m) => ({
+    const strings2 = [...code2.matchAll(QUOTED2)].map((m) => ({
       s: m[2],
       before: code2.slice(0, m.index + 1)
     }));
-    const kv = KEY_VALUE.exec(code2);
+    const kv = KEY_VALUE2.exec(code2);
     if (kv)
       strings2.push({ s: kv[2], before: "" });
     for (const m of code2.matchAll(ELEMENT_TEXT))
@@ -1880,125 +2016,537 @@ function candidatesIn(path, lines) {
         add("path", p);
         continue;
       }
-      const t = topicOf(s, context);
-      if (t && !isHeaderName(t, before))
-        add("topic", t);
-    }
-  });
-  return out;
-}
-var cleanUrlIn = (line) => line.replace(/\b([a-z0-9+.-]+:\/\/)[^/@\s"'`]+@/gi, "$1<redacted>@");
-var normPath = (p) => normalizePath(p.replace(/(^|\/)%[sd](?=\/|$)/g, "$1{}"));
-function indexFacts(facts) {
-  const at = /* @__PURE__ */ new Set();
-  const strings2 = /* @__PURE__ */ new Set();
-  const walk = (v) => {
-    if (typeof v === "string") {
-      if (v.length >= 3)
-        strings2.add(v);
-      return;
-    }
-    if (Array.isArray(v))
-      return v.forEach(walk);
-    if (v && typeof v === "object") {
-      const o = v;
-      if (typeof o.file === "string" && typeof o.line === "number")
-        at.add(`${o.file}:${o.line}`);
-      Object.values(o).forEach(walk);
+      const t = topicOf(s, context);
+      if (t && !isHeaderName(t, before))
+        add("topic", t);
+    }
+  });
+  return out;
+}
+var cleanUrlIn = (line) => line.replace(/\b([a-z0-9+.-]+:\/\/)[^/@\s"'`]+@/gi, "$1<redacted>@");
+var normPath = (p) => normalizePath(p.replace(/(^|\/)%[sd](?=\/|$)/g, "$1{}"));
+function indexFacts(facts) {
+  const at = /* @__PURE__ */ new Set();
+  const strings2 = /* @__PURE__ */ new Set();
+  const walk = (v) => {
+    if (typeof v === "string") {
+      if (v.length >= 3)
+        strings2.add(v);
+      return;
+    }
+    if (Array.isArray(v))
+      return v.forEach(walk);
+    if (v && typeof v === "object") {
+      const o = v;
+      if (typeof o.file === "string" && typeof o.line === "number")
+        at.add(`${o.file}:${o.line}`);
+      Object.values(o).forEach(walk);
+    }
+  };
+  facts.forEach(walk);
+  const paths = /* @__PURE__ */ new Set();
+  for (const s of strings2) {
+    if (/\s/.test(s))
+      continue;
+    const u = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s);
+    const p = u ? u[1] : s.includes("/") ? s : void 0;
+    if (p && p.length > 1)
+      paths.add(`${normPath(p)}/`);
+  }
+  return { at, strings: [...strings2].map((s) => s.toLowerCase()), paths: [...paths] };
+}
+function factsCover(file, c, ix) {
+  if ([c.line - 1, c.line, c.line + 1].some((n) => ix.at.has(`${file}:${n}`)))
+    return true;
+  if (c.kind === "path") {
+    const p = `${normPath(c.value)}/`;
+    return ix.paths.some((f) => f.includes(p));
+  }
+  const v = c.value.toLowerCase().replace(/\/+$/, "");
+  return ix.strings.some((s) => s.includes(v));
+}
+var skippedOf = (file, c) => ({
+  cite: `${file}:${c.line}`,
+  kind: c.kind,
+  value: c.value,
+  text: c.text
+});
+var SPEC_MARK = /^\s*["']?(openapi|swagger)["']?\s*:/m;
+var SPEC_EXT = /\.(ya?ml|json)$/i;
+function specOpsUncoveredIn(file, text, facts) {
+  if (!SPEC_EXT.test(file) || !SPEC_MARK.test(text.slice(0, 4e3)))
+    return void 0;
+  let doc;
+  try {
+    doc = readOpenApiDocument(text);
+  } catch {
+    return void 0;
+  }
+  if (!doc || !doc.operations.length)
+    return void 0;
+  const server = (() => {
+    const s = doc.servers[0];
+    if (!s)
+      return "";
+    const p = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s)?.[1] ?? (s.startsWith("/") ? s : "");
+    return p.replace(/\/+$/, "");
+  })();
+  const entries = facts.filter((f) => f.kind === "entry");
+  const atLines = /* @__PURE__ */ new Set();
+  for (const e of entries)
+    for (const k of indexFacts([e]).at)
+      atLines.add(k);
+  const out = [];
+  for (const op of doc.operations) {
+    const lines = [op.methodLine, op.line].filter((n) => n !== void 0);
+    if (lines.some((n) => [n - 1, n, n + 1].some((x) => atLines.has(`${file}:${x}`))))
+      continue;
+    const method = op.method.toUpperCase();
+    const own = normPath(op.path);
+    const full = normPath(`${server}${op.path}`);
+    const covered = entries.some((e) => {
+      if (e.method && e.method.toUpperCase() !== method)
+        return false;
+      const p = normPath(e.path);
+      return p === own || p === full || p.endsWith(own) || p.split("/").length > 2 && own.endsWith(p);
+    });
+    if (covered)
+      continue;
+    const opId = op.node?.get?.("operationId");
+    const line = op.methodLine ?? op.line ?? 1;
+    out.push({
+      spec: file,
+      method,
+      path: op.path,
+      ...typeof opId === "string" ? { operationId: opId } : {},
+      cite: `${file}:${line}`,
+      message: `${file}:${line} declares ${method} ${op.path}${typeof opId === "string" ? ` (${opId})` : ""}, which no entry covers`
+    });
+  }
+  return out;
+}
+var REVIEWED_HOLDS_SHOWN = 5;
+function reviewedHoldsOf(r, skipped) {
+  const n = skipped.length;
+  const first = skipped.slice(0, 3).map((s) => `${s.cite} (${s.value})`);
+  return {
+    path: r.path,
+    why: r.why,
+    count: n,
+    skipped: skipped.slice(0, REVIEWED_HOLDS_SHOWN),
+    message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} is reviewed as holding nothing to record, but ${n} ${n === 1 ? "line in it writes" : "lines in it write"} a path, URL or topic: ${first.join(", ")}${n > 3 ? ` and ${n - 3} more` : ""}`
+  };
+}
+
+// packages/verify/dist/settings-path.js
+var SETTINGS_FILE = /\.(ya?ml|properties|json|xml|config|conf|ini|toml|cfg|env)$|(^|\/)\.env(\.[^/]*)?$/i;
+var isSettingsFile = (path) => SETTINGS_FILE.test(path);
+var isYaml = (path) => /\.ya?ml$/i.test(path);
+var isProperties = (path) => /\.properties$/i.test(path);
+var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var YAML_KEY = /^(["']?)([^\s"'#:{}[\],&*!|>][^"'#:]*?)\1\s*:(?:\s+(.*))?$/;
+function yamlLine(text) {
+  if (!text.trim() || /^\s*#/.test(text) || /^\s*(---|\.\.\.)\s*$/.test(text))
+    return void 0;
+  const lead = /^ */.exec(text)[0].length;
+  const dash = /^ *-(\s+|$)/.exec(text);
+  const col = dash ? dash[0].length : lead;
+  const body = text.slice(col);
+  const m = YAML_KEY.exec(body.trimEnd());
+  const rest = m?.[3]?.trim();
+  return {
+    lead,
+    col,
+    item: !!dash,
+    key: m?.[2]?.trim(),
+    // a comment or an anchor after the key sets nothing
+    rest: rest && !/^[#&]/.test(rest) ? rest : void 0
+  };
+}
+function yamlPathAt(lines, line) {
+  const at = yamlLine(lines[line - 1] ?? "");
+  if (!at?.key)
+    return void 0;
+  const path = [at.key];
+  let col = at.item ? at.lead : at.col;
+  for (let j = line - 2; j >= 0 && col > 0; j--) {
+    const l = lines[j];
+    if (/^\s*(---|\.\.\.)\s*$/.test(l))
+      break;
+    const y = yamlLine(l);
+    if (!y)
+      continue;
+    if (y.item && y.col === col) {
+      col = y.lead;
+      continue;
+    }
+    if (y.col >= col)
+      continue;
+    if (!y.key || y.rest)
+      return void 0;
+    path.unshift(y.key);
+    col = y.lead;
+  }
+  if (col > 0)
+    return void 0;
+  return path.flatMap((k) => k.split("."));
+}
+function yamlChildren(lines, line) {
+  const at = yamlLine(lines[line - 1] ?? "");
+  if (!at?.key)
+    return [];
+  const out = [];
+  let childCol;
+  for (let j = line; j < lines.length; j++) {
+    const y = yamlLine(lines[j]);
+    if (!y)
+      continue;
+    if (y.lead <= at.col)
+      break;
+    childCol ??= y.col;
+    if (y.col < childCol)
+      break;
+    if (y.col === childCol && y.key && !y.item)
+      out.push(y.key);
+  }
+  return out;
+}
+function propertiesKeyAt(lines, line) {
+  const l = lines[line - 1] ?? "";
+  if (/^\s*[#!]/.test(l))
+    return void 0;
+  return /^\s*((?:\\.|[^\s=:\\])+)\s*[=:\s]/.exec(l)?.[1];
+}
+var sameSegs = (a, b) => a.length === b.length && a.every((s, i) => s === b[i]);
+var keySegments = (key) => key.trim().split(".").map((s) => s.replace(/\[[^\]]*\]$/, "")).filter(Boolean);
+var fieldNames = (seg) => [
+  seg,
+  seg.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase())
+];
+var CONFIG_PROPS = /@ConfigurationProperties\s*\(\s*(?:(?:prefix|value)\s*=\s*)?"([^"]+)"/;
+function helperBuildsKey(key, cite2, linesOf2) {
+  if (isSettingsFile(cite2.file))
+    return false;
+  const segs = keySegments(key);
+  if (segs.length < 2 || segs.join(".") !== key.trim())
+    return false;
+  const last = segs[segs.length - 1];
+  const prefix = segs.slice(0, -1);
+  const line = linesOf2(cite2.file)?.[cite2.line - 1];
+  if (line === void 0)
+    return false;
+  const code2 = isCommentLine(line) ? line : line.replace(/\/\*.*?\*\//g, "").replace(/(^|\s)\/\/.*$/, "");
+  if (!new RegExp(`(^|[^A-Za-z0-9_$-])${escape(last)}($|[^A-Za-z0-9_$-])`).test(code2))
+    return false;
+  const parts = cite2.with ?? [];
+  const files = [...new Set(parts.map((p) => p.file))];
+  return files.some((file) => {
+    const ls = linesOf2(file);
+    if (!ls)
+      return false;
+    const here = parts.filter((p) => p.file === file);
+    if (isYaml(file))
+      return here.some((p) => {
+        const at = yamlPathAt(ls, p.line);
+        if (!at)
+          return false;
+        if (sameSegs(at, segs))
+          return true;
+        return sameSegs(at, prefix) && yamlChildren(ls, p.line).includes(last);
+      });
+    if (isProperties(file))
+      return here.some((p) => propertiesKeyAt(ls, p.line) === segs.join("."));
+    if (isSettingsFile(file))
+      return false;
+    return here.some((p) => {
+      const m = CONFIG_PROPS.exec(ls[p.line - 1] ?? "");
+      if (!m)
+        return false;
+      const pre = m[1].split(".");
+      if (pre.length > prefix.length || !pre.every((s, i) => s === prefix[i]))
+        return false;
+      return prefix.slice(pre.length).every((seg) => here.some((q) => q.line > p.line && q.line <= p.line + 40 && fieldNames(seg).some((n) => new RegExp(`(^|[^A-Za-z0-9_$])${escape(n)}($|[^A-Za-z0-9_$])`).test(ls[q.line - 1] ?? ""))));
+    });
+  });
+}
+var norm = (s) => s.replace(/[‘’‚'"“”„`]/g, "").replace(/\s+/g, " ").trim();
+function enclosingObject(lines, line) {
+  let depth = 0;
+  let start = -1;
+  for (let j = line - 1; j >= 0; j--) {
+    const l = lines[j];
+    for (let k = l.length - 1; k >= 0; k--) {
+      if (l[k] === "}" && j !== line - 1)
+        depth++;
+      if (l[k] === "{") {
+        if (depth === 0) {
+          start = j;
+          break;
+        }
+        depth--;
+      }
+    }
+    if (start >= 0)
+      break;
+  }
+  if (start < 0)
+    return void 0;
+  depth = 0;
+  for (let j = start; j < lines.length; j++) {
+    for (const ch of lines[j]) {
+      if (ch === "{")
+        depth++;
+      if (ch === "}" && --depth === 0)
+        return lines.slice(start, j + 1);
+    }
+  }
+  return void 0;
+}
+function configLineProblem(f, linesOf2, listed2) {
+  const lines = linesOf2(f.cite.file);
+  if (!lines)
+    return void 0;
+  const at = lines[f.cite.line - 1] ?? "";
+  const where = `${f.cite.file}:${f.cite.line}`;
+  const segs = keySegments(f.key);
+  const value = f.value === void 0 ? void 0 : norm(f.value);
+  const has = (l) => value !== void 0 && norm(l).includes(value);
+  if (f.key.trim().startsWith("/") && /(^|\/)config\.json$/i.test(f.cite.file)) {
+    const dir = f.cite.file.replace(/[^/]*$/, "");
+    if (!listed2().some((p) => p.startsWith(`${dir}apiproxy/`)))
+      return `config ${where} is a config.json beside no gateway bundle (no ${dir}apiproxy/); a token's setting is read only from the bundle's own`;
+    const obj = enclosingObject(lines, f.cite.line);
+    const xpathRe = new RegExp(`"xpath"\\s*:\\s*"${escape(f.key.trim())}"`);
+    if (!obj || !obj.some((l) => xpathRe.test(l)))
+      return `the token at ${where} has no "xpath" of ${f.key}`;
+    if (value !== void 0 && !obj.some((l) => /"value"\s*:/.test(l) && has(l)))
+      return `the token at ${where} sets no such value; cite the token whose "value" it is`;
+    return void 0;
+  }
+  if (isYaml(f.cite.file)) {
+    const y = yamlLine(at);
+    const path = yamlPathAt(lines, f.cite.line);
+    if (y?.key && path && segs.length && keySegments(y.key).at(-1) === segs.at(-1)) {
+      const tail = path.slice(path.length - segs.length);
+      if (path.length < segs.length || !sameSegs(tail, segs))
+        return `${where} sets ${path.join(".")}, not ${f.key}: the key's parents are not the lines above it`;
+      if (value !== void 0 && y.rest && !/^[|>]/.test(y.rest)) {
+        if (!has(y.rest))
+          return `${where} sets ${y.key} to something other than the value claimed`;
+        return void 0;
+      }
+    }
+  }
+  if (isProperties(f.cite.file)) {
+    const k = propertiesKeyAt(lines, f.cite.line);
+    if (k && k.split(".").at(-1) === segs.at(-1)) {
+      if (k !== segs.join(".") && !k.endsWith(`.${segs.join(".")}`))
+        return `${where} sets ${k}, not ${f.key}`;
+      if (value !== void 0) {
+        if (!has(at.slice(at.indexOf(k) + k.length)))
+          return `${where} sets ${k} to something other than the value claimed`;
+        return void 0;
+      }
+    }
+  }
+  if (value === void 0 || value === "")
+    return void 0;
+  const near = [f.cite.line - 1, f.cite.line, f.cite.line + 1].map((n) => lines[n - 1] ?? "");
+  const partLines = (f.cite.with ?? []).map((p) => linesOf2(p.file)?.[p.line - 1] ?? "");
+  if (![...near, ...partLines].some(has))
+    return `${where} (or the line either side) and its parts don't write the value claimed`;
+  return void 0;
+}
+
+// packages/verify/dist/reachable.js
+var CODE = /\.(java|kt|kts|scala|groovy|cs|vb|fs|py|rb|go|rs|php|swift|ts|tsx|js|mjs|cjs|dart)$/i;
+var MODEL_DIR = /(^|\/)(models?|dtos?|payloads?|schemas?|pojos?|beans|viewmodels?)\//i;
+var MODEL_NAME = /(dto|request|response|payload|model|body)$/i;
+var MODEL_PART = /[._-](dto|model|schema|payload|request|response)\.[^/.]+$/i;
+var MAPS_TABLE = /@Entity\b|@Table\b|@Document\b|\[Table\(|__tablename__|models\.Model\b|@Entity\(|\bgorm\.Model\b/;
+var ROOT_PART = /[._-](controller|resolver|gateway|handlers?|router|routes?|consumer|listener|subscriber|client|publisher|producer|endpoints?)\.[^/.]+$/i;
+var CLIENT_NAME = /(client|gateway|publisher|producer|sender|feign|proxy|connector)$/i;
+var CLIENT_DIR = /(^|\/)(clients?|gateways?|integrations?|publishers?|producers?|outbound)\//i;
+var base = (path) => path.slice(path.lastIndexOf("/") + 1);
+var stem = (path) => {
+  const b = base(path);
+  const dot = b.indexOf(".");
+  return dot > 0 ? b.slice(0, dot) : b;
+};
+function isModelFile(path, text) {
+  if (!CODE.test(path) || readingRank(path) === 5)
+    return false;
+  if (!MODEL_DIR.test(path) && !MODEL_NAME.test(stem(path)) && !MODEL_PART.test(path))
+    return false;
+  return text === void 0 || !MAPS_TABLE.test(text);
+}
+var ENTRY_POINT_NAME = /(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|servlet|webhook|resolver)$/i;
+var ENTRY_POINT_DIR = /(^|\/)(controllers?|routes|routers|handlers|endpoints|listeners|consumers)\//i;
+var ENTRY_POINT_PART = /[._-](controller|resolver|handlers?|router|routes?|consumer|listener|subscriber|endpoints?)\.[^/.]+$/i;
+function isEntryPointFile(path) {
+  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+    return false;
+  return ENTRY_POINT_NAME.test(stem(path)) || ENTRY_POINT_DIR.test(path) || ENTRY_POINT_PART.test(path);
+}
+function isRootFile(path) {
+  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+    return false;
+  return readingRank(path) === 2 || isEntryPointFile(path) || ROOT_PART.test(path) || CLIENT_NAME.test(stem(path)) || CLIENT_DIR.test(path);
+}
+var DECLARES = /\b(?:class|record|interface|struct|enum|object)\s+([A-Za-z_][A-Za-z0-9_]*)|^\s*(?:export\s+)?(?:declare\s+)?type\s+([A-Za-z_][A-Za-z0-9_]*)/gm;
+var IDENT = /[A-Za-z_][A-Za-z0-9_]*/g;
+function declaredTypes(path, text) {
+  const out = [];
+  const s = stem(path);
+  if (/^[A-Z][A-Za-z0-9_]*$/.test(s))
+    out.push(s);
+  for (const m of text.matchAll(DECLARES)) {
+    const n = m[1] ?? m[2];
+    if (n && !out.includes(n))
+      out.push(n);
+  }
+  return out;
+}
+function identifiers(text) {
+  return [...new Set(text.match(IDENT) ?? [])];
+}
+var NOT_REACHED_WHY = "model classes no entry point, call or field fact reaches (ADR 0169): left out of the read; atticus map <repo> --models all reads them";
+function reachableModels(o) {
+  const texts = /* @__PURE__ */ new Map();
+  const textOf = (p) => {
+    if (!texts.has(p))
+      texts.set(p, o.read(p) ?? "");
+    return texts.get(p);
+  };
+  const ordered = readingOrder(o.paths);
+  const models = ordered.filter((p) => isModelFile(p, textOf(p))).sort();
+  const isModel = new Set(models);
+  const byName = /* @__PURE__ */ new Map();
+  const declared = /* @__PURE__ */ new Map();
+  for (const p of models) {
+    const names = declaredTypes(p, textOf(p));
+    declared.set(p, names);
+    for (const n of names)
+      byName.set(n, [...byName.get(n) ?? [], p]);
+  }
+  const known = new Set(o.paths);
+  const roots = [];
+  const addRoot = (p) => {
+    if (known.has(p) && !isModel.has(p) && !roots.includes(p))
+      roots.push(p);
+  };
+  const facts = o.facts ?? [];
+  const entries = o.from === "entries";
+  const calls2 = new Set(facts.filter((f) => f.kind === "call").map((f) => f.id));
+  for (const f of facts)
+    if (f.kind === "entry" || f.kind === "call" && !entries)
+      for (const p of citedFiles(f))
+        addRoot(p);
+  for (const p of ordered)
+    if (entries ? isEntryPointFile(p) : isRootFile(p))
+      addRoot(p);
+  const reached = /* @__PURE__ */ new Map();
+  const queue = [];
+  const reach = (names, from, own = []) => {
+    for (const n of names) {
+      if (own.includes(n))
+        continue;
+      for (const p of byName.get(n) ?? []) {
+        const r = reached.get(p);
+        if (r) {
+          if (r.from === from && !r.types.includes(n))
+            r.types.push(n);
+          continue;
+        }
+        reached.set(p, { path: p, types: [n], from });
+        queue.push(p);
+      }
     }
   };
-  facts.forEach(walk);
-  const paths = /* @__PURE__ */ new Set();
-  for (const s of strings2) {
-    if (/\s/.test(s))
-      continue;
-    const u = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s);
-    const p = u ? u[1] : s.includes("/") ? s : void 0;
-    if (p && p.length > 1)
-      paths.add(`${normPath(p)}/`);
+  for (const p of roots)
+    reach(identifiers(textOf(p)), p);
+  for (const f of facts) {
+    for (const p of citedFiles(f))
+      if (isModel.has(p) && !reached.has(p)) {
+        reached.set(p, { path: p, types: [...(declared.get(p) ?? []).slice(0, 1)], from: f.id });
+        queue.push(p);
+      }
+    if (f.kind === "field" && !(entries && calls2.has(f.owner)))
+      reach(identifiers([f.type ?? "", f.transform === "message type" ? f.name : ""].join(" ")), f.id);
   }
-  return { at, strings: [...strings2].map((s) => s.toLowerCase()), paths: [...paths] };
+  const rooted = roots.length > 0 || reached.size > 0;
+  if (!rooted)
+    return {
+      rooted,
+      roots,
+      reached: models.map((p) => ({ path: p, types: declared.get(p) ?? [], from: "" })),
+      notReached: [],
+      models: models.length
+    };
+  for (let i = 0; i < queue.length; i++) {
+    const p = queue[i];
+    reach(identifiers(textOf(p)), p, declared.get(p));
+  }
+  return {
+    rooted,
+    roots,
+    reached: queue.map((p) => reached.get(p)),
+    notReached: models.filter((p) => !reached.has(p)),
+    models: models.length
+  };
 }
-function factsCover(file, c, ix) {
-  if ([c.line - 1, c.line, c.line + 1].some((n) => ix.at.has(`${file}:${n}`)))
-    return true;
-  if (c.kind === "path") {
-    const p = `${normPath(c.value)}/`;
-    return ix.paths.some((f) => f.includes(p));
+
+// packages/verify/dist/method.js
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+function wordsOf2(line) {
+  return line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
+}
+function methodOnLines(method, lines) {
+  const m = method.toLowerCase();
+  return lines.some((l) => wordsOf2(l).includes(m));
+}
+var CHAIN_LINES = 8;
+var CONTINUES = /^\s*\??\./;
+function chainOf(file, line) {
+  const at = (n) => file?.[n - 1];
+  const cited = at(line);
+  if (cited === void 0)
+    return [];
+  const out = [cited];
+  for (let n = line, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n--) {
+    const above = at(n - 1);
+    if (above === void 0)
+      break;
+    out.push(above);
   }
-  const v = c.value.toLowerCase().replace(/\/+$/, "");
-  return ix.strings.some((s) => s.includes(v));
+  for (let n = line + 1, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n++)
+    out.push(at(n));
+  return out;
 }
-var skippedOf = (file, c) => ({
-  cite: `${file}:${c.line}`,
-  kind: c.kind,
-  value: c.value,
-  text: c.text
-});
-var SPEC_MARK = /^\s*["']?(openapi|swagger)["']?\s*:/m;
-var SPEC_EXT = /\.(ya?ml|json)$/i;
-function specOpsUncoveredIn(file, text, facts) {
-  if (!SPEC_EXT.test(file) || !SPEC_MARK.test(text.slice(0, 4e3)))
+function methodUnseenOf(f, lines, factOf) {
+  if (f.kind !== "entry" && f.kind !== "call")
     return void 0;
-  let doc;
-  try {
-    doc = readOpenApiDocument(text);
-  } catch {
+  if (!f.method || !HTTP_METHODS.has(f.method.toUpperCase()))
     return void 0;
-  }
-  if (!doc || !doc.operations.length)
+  const at = (file, line) => lines(file)?.[line - 1];
+  const route = f.kind === "call" && f.from ? factOf?.(f.from) : void 0;
+  const forwards = route?.kind === "entry" && route.method?.toUpperCase() === f.method.toUpperCase();
+  const looked = [
+    ...chainOf(lines(f.cite.file), f.cite.line),
+    at(f.cite.file, f.cite.line + 1),
+    ...(f.cite.with ?? []).map((p) => at(p.file, p.line)),
+    ...forwards ? [at(route.cite.file, route.cite.line), at(route.cite.file, route.cite.line + 1)] : []
+  ].filter((l) => l !== void 0);
+  if (methodOnLines(f.method, looked))
     return void 0;
-  const server = (() => {
-    const s = doc.servers[0];
-    if (!s)
-      return "";
-    const p = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s)?.[1] ?? (s.startsWith("/") ? s : "");
-    return p.replace(/\/+$/, "");
-  })();
-  const entries = facts.filter((f) => f.kind === "entry");
-  const atLines = /* @__PURE__ */ new Set();
-  for (const e of entries)
-    for (const k of indexFacts([e]).at)
-      atLines.add(k);
-  const out = [];
-  for (const op of doc.operations) {
-    const lines = [op.methodLine, op.line].filter((n) => n !== void 0);
-    if (lines.some((n) => [n - 1, n, n + 1].some((x) => atLines.has(`${file}:${x}`))))
-      continue;
-    const method = op.method.toUpperCase();
-    const own = normPath(op.path);
-    const full = normPath(`${server}${op.path}`);
-    const covered = entries.some((e) => {
-      if (e.method && e.method.toUpperCase() !== method)
-        return false;
-      const p = normPath(e.path);
-      return p === own || p === full || p.endsWith(own) || p.split("/").length > 2 && own.endsWith(p);
-    });
-    if (covered)
-      continue;
-    const opId = op.node?.get?.("operationId");
-    const line = op.methodLine ?? op.line ?? 1;
-    out.push({
-      spec: file,
-      method,
-      path: op.path,
-      ...typeof opId === "string" ? { operationId: opId } : {},
-      cite: `${file}:${line}`,
-      message: `${file}:${line} declares ${method} ${op.path}${typeof opId === "string" ? ` (${opId})` : ""}, which no entry covers`
-    });
-  }
-  return out;
-}
-var REVIEWED_HOLDS_SHOWN = 5;
-function reviewedHoldsOf(r, skipped) {
-  const n = skipped.length;
-  const first = skipped.slice(0, 3).map((s) => `${s.cite} (${s.value})`);
+  const cite2 = `${f.cite.file}:${f.cite.line}`;
+  const method = f.method.toUpperCase();
   return {
-    path: r.path,
-    why: r.why,
-    count: n,
-    skipped: skipped.slice(0, REVIEWED_HOLDS_SHOWN),
-    message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} is reviewed as holding nothing to record, but ${n} ${n === 1 ? "line in it writes" : "lines in it write"} a path, URL or topic: ${first.join(", ")}${n > 3 ? ` and ${n - 3} more` : ""}`
+    id: f.id,
+    kind: f.kind,
+    method,
+    cite: cite2,
+    message: `${f.id} claims ${method}, which neither ${cite2}, the chain it is in, the next line, a cite.with line nor the route it forwards writes`
   };
 }
 
@@ -2076,9 +2624,12 @@ var repoModule = (exposes) => {
   const m = /^([^/]+)\/([^/]+)$/.exec(exposes.trim());
   return m ? { repo: m[1], module: m[2] } : void 0;
 };
+var PLACEHOLDER_KEY = /^\$\{([A-Za-z_][A-Za-z0-9_.-]*)\}$/;
 var routeOrWord = (v) => v.includes("/") ? { kind: "route", value: v } : { kind: "word", value: v };
 function claimsOf(f) {
   switch (f.kind) {
+    // A call whose path is a setting's placeholder a helper puts together is checked apart
+    // (`helperBuildsKey`): its bare key is never a claim, or a settings line would be a call.
     case "entry":
     case "call":
       return [routeOrWord(f.path)];
@@ -2117,6 +2668,14 @@ function claimsOf(f) {
     // ADR 0180: the signal the type rests on, as written on its line.
     case "component":
       return [{ kind: "word", value: f.cite.value }];
+    // ADR 0192: the coordinates as the build file writes them on the line (the name, or a
+    // Gradle line's whole `group:name:version`); `buildCoordinatesProblem` reads the rest.
+    case "artifact":
+    case "dependency":
+      return [
+        { kind: "word", value: f.cite.value },
+        { kind: "word", value: f.name }
+      ];
   }
 }
 var sameCommit = (a, b) => a.startsWith(b) || b.startsWith(a);
@@ -2295,6 +2854,11 @@ async function verifyFacts(o) {
         code: "claim-not-on-line",
         message: `${label} claims ${claims.map((c) => `"${c.value}"`).join(" or ")}, which ${where} (or the line either side)${parts.length ? " and its parts" : ""} does not name${parts.length || !withHint ? "" : "; if it is put together from other lines (a base URL, a prefix, a context path), cite them in cite.with"}`
       };
+    if (claims && parts.length && isCommentLine(lines[cite2.line - 1] ?? "") && !/(^|\/)_redirects$/.test(cite2.file))
+      return {
+        code: "claim-in-comment",
+        message: `${label} cites ${where}, which is a comment; cite the code that does it`
+      };
     if (claims && !parts.length) {
       const naming = [cite2.line - 1, cite2.line, cite2.line + 1].map((n) => lines[n - 1]).filter((l) => l !== void 0 && claims.some((c) => lineNamesClaim(l, c)));
       if (naming.length && !/(^|\/)_redirects$/.test(cite2.file) && naming.every(isCommentLine))
@@ -2342,7 +2906,16 @@ async function verifyFacts(o) {
         problem(f, "wrong-commit", `${label} was read at ${f.commit}, not at ${o.commit}; read it again`);
       continue;
     }
-    add(f, checkCite(f.cite, claimsOf(f), label, true, f.kind === "entry" || f.kind === "call" ? (ls, n) => apigeePassThrough({ kind: f.kind, forwards: f.kind === "call" && !!f.from }, f.cite.file, ls, n, f.path) : void 0));
+    add(f, checkCite(f.cite, claimsOf(f), label, true, f.kind === "entry" || f.kind === "call" ? (ls, n) => apigeePassThrough({ kind: f.kind, forwards: f.kind === "call" && !!f.from }, f.cite.file, ls, n, f.path) || // A path written as a setting's placeholder that no line writes whole (ADR 0172,
+    // beta.24): a helper puts the key together (a `@ConfigurationProperties` prefix, a
+    // map field, the name passed to a lookup). The cited line is code naming the key's
+    // last segment, and one file among the parts proves the rest of the key nests so.
+    f.kind === "call" && PLACEHOLDER_KEY.test(f.path.trim()) && helperBuildsKey(PLACEHOLDER_KEY.exec(f.path.trim())[1], f.cite, linesOf2) : void 0));
+    if (f.kind === "config" && !found.has(f.id)) {
+      const bad = configLineProblem(f, linesOf2, listed2);
+      if (bad)
+        problem(f, "claim-not-on-line", `${label}: ${bad}`);
+    }
     if (f.kind === "entry" && f.authCite)
       add(f, checkCite({ ...f.authCite }, [{ kind: "word", value: f.authCite.value }], `${label} authCite${f.auth ? ` (auth ${f.auth})` : ""}`, false));
     if (f.kind === "entry" && f.authCite && f.auth) {
@@ -2433,6 +3006,13 @@ async function verifyFacts(o) {
       if (f.version !== void 0)
         add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
     }
+    if ((f.kind === "artifact" || f.kind === "dependency") && !found.has(f.id)) {
+      const bad = buildCoordinatesProblem(f, linesOf2);
+      if (bad)
+        problem(f, "build-coordinates", bad);
+      else if (f.version !== void 0)
+        add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
+    }
     if (f.kind === "flow") {
       f.steps.forEach((s, i) => add(f, checkCite(s.cite, stepClaims(s.kind, s.cite.value), `${label} step ${i + 1}`)));
       f.errors.forEach((e, i) => add(f, checkCite(e.cite, [routeOrWord(e.cite.value)], `${label} error ${i + 1}`)));
@@ -2553,8 +3133,18 @@ async function verifyFacts(o) {
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
   const sources = [];
   const excluded = [];
+  const secrets = [];
   for (const p of o.source.list()) {
     o.room?.();
+    if (isSecretPath(p)) {
+      if (insideRepo(p) && isConfigFile(p) && !rules.notProduct.test(p) && !tooBigToRead(o.source, p)) {
+        const text = o.source.read(p);
+        const ls2 = text === void 0 ? void 0 : text.replace(/\r\n?/g, "\n").split("\n");
+        if (ls2 && !binaryLines(ls2))
+          secrets.push(...liveSecretsIn(p, ls2));
+      }
+      continue;
+    }
     if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
       continue;
     const ls = readLines(p) ?? [""];
@@ -2562,8 +3152,10 @@ async function verifyFacts(o) {
       continue;
     if (excludeRes.some((re) => re.test(p)))
       excluded.push(p);
-    else
+    else {
       sources.push(p);
+      secrets.push(...liveSecretsIn(p, ls));
+    }
   }
   const touched = new Set(o.routed ?? []);
   for (const f of accepted)
@@ -2664,6 +3256,7 @@ async function verifyFacts(o) {
     const held = files.flatMap(skippedIn);
     return held.length ? [reviewedHoldsOf(entry, held)] : [];
   });
+  const unrecorded = buildUnrecorded([...touched].filter((p) => isBuildFile(p) && insideRepo(p) && !isSecretPath(p)), (p) => linesOf2(p), accepted);
   return {
     accepted,
     // a rejected fact goes back as it was read, at its own commit, even one that was carried
@@ -2677,6 +3270,7 @@ async function verifyFacts(o) {
       ratio
     },
     redacted,
+    secrets: secrets.sort((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line),
     quotesDropped,
     carried: accepted.flatMap((f) => carriedFrom.has(f.id) ? [{ id: f.id, from: carriedFrom.get(f.id) }] : []),
     corrections: { applied: corrected.applied, stale: corrected.stale },
@@ -2689,7 +3283,8 @@ async function verifyFacts(o) {
     skipped,
     reviewedHolds,
     specOpsUncovered,
-    frameworkGaps: frameworkGaps(accepted, rules.frameworks)
+    frameworkGaps: frameworkGaps(accepted, rules.frameworks),
+    ...unrecorded.length ? { buildUnrecorded: unrecorded } : {}
   };
 }
 
@@ -4446,8 +5041,25 @@ var LENS_KINDS = {
   infrastructure: /* @__PURE__ */ new Set(["estate", "system", "repo", "component", "deployment", "environment"])
 };
 var LENS_EDGES = {
-  architecture: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes", "uses", "reads", "writes"]),
-  repo: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes", "uses", "reads", "writes", "references"]),
+  architecture: /* @__PURE__ */ new Set([
+    "calls",
+    "publishes",
+    "subscribes",
+    "uses",
+    "depends-on",
+    "reads",
+    "writes"
+  ]),
+  repo: /* @__PURE__ */ new Set([
+    "calls",
+    "publishes",
+    "subscribes",
+    "uses",
+    "depends-on",
+    "reads",
+    "writes",
+    "references"
+  ]),
   data: /* @__PURE__ */ new Set(["reads", "writes", "references"]),
   integration: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes"]),
   infrastructure: /* @__PURE__ */ new Set(["deployed-to"])
@@ -4510,30 +5122,57 @@ var HOW_OF_FLAG = {
   "joined-by-name": "named",
   "joined-by-repo": "repo",
   "joined-by-host": "host",
+  // beta.24: a call whose host nothing resolves, by the one proxy BasePath its path starts with.
+  [JOINED_BY_BASE_PATH]: "base-path",
   "declared-caller": "declared",
   // ADR 0162 §6 (F8): a topic or queue the profile names as an outside system's: a person's word.
   [DECLARED_TOPIC]: "declared",
   // ADR 0160 (O3): answered by an entry of another team's shared map.
   [JOINED_TO_SHARED_MAP]: "shared"
 };
+var GUESS_FLAGS = new Set(JOIN_GUESS_FLAGS);
 function joinHow(i) {
-  for (const f of i.flags ?? [])
+  const flags = i.flags ?? [];
+  const topic = i.via === "event-bus" || i.via === "mq";
+  if (i.confidence === "verified") {
+    for (const f of flags)
+      if (HOW_OF_FLAG[f] && !GUESS_FLAGS.has(f))
+        return HOW_OF_FLAG[f];
+    if (topic)
+      return "topic";
+  }
+  for (const f of flags)
     if (HOW_OF_FLAG[f])
       return HOW_OF_FLAG[f];
-  if (i.via === "event-bus" || i.via === "mq")
+  if (topic)
     return "topic";
   return "unknown";
 }
+var GUESS_HOWS = new Set(JOIN_GUESS_FLAGS.map((f) => HOW_OF_FLAG[f]).filter(Boolean));
+function alsoOf(i, how) {
+  if (i.confidence !== "verified" || GUESS_HOWS.has(how))
+    return [];
+  return [
+    ...new Set((i.flags ?? []).flatMap((f) => GUESS_FLAGS.has(f) && HOW_OF_FLAG[f] ? [HOW_OF_FLAG[f]] : []))
+  ];
+}
 function joinOf(i) {
   const side = (s) => evidenceOf(i.evidence.filter((e) => e.side === s));
   const sided = /* @__PURE__ */ new Set(["caller", "callee", "gateway"]);
+  const how = joinHow(i);
+  const also = alsoOf(i, how);
   return {
     interface: i.id,
     from: i.from,
     to: i.to,
-    how: joinHow(i),
+    how,
     gateway: i.via === "gateway",
-    verified: i.confidence === "verified",
+    // A link is verified when one of its calls is (ADR 0135 section 5): its how is that call's,
+    // and the guesses its other calls rest on are `also`, never the reason. One with no how but
+    // a guess has no call that wasn't guessed to show, so it is never shown verified beside the
+    // guess's words (beta.24).
+    verified: i.confidence === "verified" && !GUESS_HOWS.has(how),
+    ...also.length ? { also } : {},
     ...i.method ? { method: i.method } : {},
     ...i.normalizedPath ? { path: i.normalizedPath } : {},
     caller: side("caller"),
@@ -4565,12 +5204,12 @@ function sharedOf(i) {
     }
   };
 }
-function mergeJoins(a, b) {
+function mergeJoins(a, b, cap = MAX_JOINS) {
   const by = new Map(a.map((j) => [j.interface, j]));
   for (const j of b)
     if (!by.has(j.interface))
       by.set(j.interface, j);
-  return [...by.values()].sort((x, y) => x.interface < y.interface ? -1 : x.interface > y.interface ? 1 : 0).slice(0, MAX_JOINS);
+  return [...by.values()].sort((x, y) => x.interface < y.interface ? -1 : x.interface > y.interface ? 1 : 0).slice(0, cap);
 }
 var props = (o) => {
   const out = {};
@@ -4586,7 +5225,29 @@ var props = (o) => {
   return out;
 };
 var all = (rs, k) => rs.filter((r) => r.kind === k).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-function buildEstate(records2) {
+function dependencyJoin(l) {
+  const lines = (end) => end.lines.map((at) => ({ source: "code", repo: end.repo, at }));
+  return {
+    interface: dependencyLinkId(l),
+    from: l.from.component,
+    to: l.to.component,
+    how: "coordinates",
+    gateway: false,
+    // code at both ends, each claim checked on its line, and nobody had to guess
+    verified: true,
+    caller: lines(l.from),
+    callee: lines(l.to),
+    hops: [],
+    other: [],
+    dependency: {
+      group: l.group,
+      name: l.name,
+      ...l.version ? { version: l.version } : {},
+      ...l.scope ? { scope: l.scope } : {}
+    }
+  };
+}
+function buildEstate(records2, o = {}) {
   const nodes = /* @__PURE__ */ new Map();
   const atoms = [];
   const add = (n) => {
@@ -4692,6 +5353,11 @@ function buildEstate(records2) {
       }
     });
   }
+  for (const [sys, n] of [...nodes.entries()].filter(([id]) => id.startsWith("system:"))) {
+    const inside = [...repoSystem.entries()].filter(([, s]) => `system:${s}` === sys && systems.has(s)).map(([r]) => r).sort();
+    if (inside.length)
+      n.properties = { ...n.properties, repos: inside };
+  }
   const unknown = (ref) => add({
     id: `unknown:${slug2(ref)}`,
     kind: "unknown",
@@ -4892,6 +5558,19 @@ function buildEstate(records2) {
         evidence: evidenceOf(c.evidence),
         gaps: recordGaps(c)
       });
+  for (const l of o.dependsOn ?? []) {
+    if (!components.has(l.from.component) || !components.has(l.to.component))
+      continue;
+    const join2 = dependencyJoin(l);
+    atoms.push({
+      from: `component:${l.from.component}`,
+      to: `component:${l.to.component}`,
+      type: "depends-on",
+      evidence: mergeEvidence(join2.caller.slice(0, 1), join2.callee.slice(0, 1)),
+      gaps: [],
+      join: join2
+    });
+  }
   for (const t of tables) {
     const ev = evidenceOf(t.evidence);
     const part = (ref) => {
@@ -5044,7 +5723,7 @@ function need(est, lens, id) {
   if (!est.visible.get(lens).has(id))
     throw new NoSuchNode(`There is no node ${id} in the ${lens} lens.`);
 }
-function merge(mapped) {
+function merge(mapped, cap = MAX_JOINS) {
   const by = /* @__PURE__ */ new Map();
   for (const { from, to, atom } of mapped) {
     const id = `${atom.type}:${from}>${to}`;
@@ -5066,7 +5745,7 @@ function merge(mapped) {
       continue;
     }
     if (atom.join)
-      e.joins = mergeJoins(e.joins ?? [], [atom.join]);
+      e.joins = mergeJoins(e.joins ?? [], [atom.join], cap);
     e.count++;
     if (atom.sync && e.sync !== atom.sync)
       e.sync = "mixed";
@@ -5155,7 +5834,7 @@ function nodeView(est, id, o) {
       continue;
     mapped.push({ from, to, atom });
   }
-  let edges = merge(mapped);
+  let edges = merge(mapped, o.everyJoin ? Infinity : MAX_JOINS);
   let hidden = 0;
   if (!o.all)
     ({ edges, hidden } = reduceUses(edges));
@@ -5200,7 +5879,7 @@ function focusView(est, id, o) {
     node: toNode(est, lens, id),
     path: ancestors(est, id).map((n) => toNode(est, lens, n)),
     neighbours: [...near].sort().map((n) => toNode(est, lens, n)),
-    edges: merge(ends.filter((e) => set.has(e.from) && set.has(e.to)))
+    edges: merge(ends.filter((e) => set.has(e.from) && set.has(e.to)), o.everyJoin ? Infinity : MAX_JOINS)
   };
 }
 
@@ -6091,6 +6770,7 @@ function houseImportsUntaught(source, o) {
 export {
   insideRepo,
   dirSource,
+  isBuildFile,
   correctionFor,
   outsidePairingFor,
   correctedFact,