@maycombhq/atticus 2.0.0-beta.23 → 2.0.0-beta.24

package/dist/{chunk-IKAW2KJU.js → chunk-25CUJJTP.js}

@@ -8,18 +8,18 @@ import {
   rereadPlan,
   sameCommit,
   verifyFacts
-} from "./chunk-CZ2ZS7AT.js";
+} from "./chunk-HNPKCRCE.js";
 import {
   featuresForScan,
   namingHint,
   syncSources
-} from "./chunk-4GAB5ZOZ.js";
+} from "./chunk-CZ75S2EZ.js";
 import {
   scanInputs
-} from "./chunk-A4JXVO5O.js";
+} from "./chunk-GFYVVTKH.js";
 import {
   listIngestors
-} from "./chunk-TDSCKP3V.js";
+} from "./chunk-DIYNRYXW.js";
 import {
   BUILT_IN_EXTRACTORS,
   MODEL_READERS,
@@ -34,7 +34,7 @@ import {
   runDialectTests,
   runFrameworkTests,
   unmodelledFrameworks
-} from "./chunk-G6EFXTUO.js";
+} from "./chunk-5FPAKAGE.js";
 import {
   DEFAULT_IGNORES,
   configHash,
@@ -46,31 +46,24 @@ import {
   sandboxedExtractor,
   scanRepo,
   withParseCache
-} from "./chunk-PQQKZPBU.js";
+} from "./chunk-IJQHBK76.js";
+import {
+  buildContextPack,
+  toRunSummary
+} from "./chunk-MOWUP33K.js";
 import {
   baseClonePath,
   changesSince,
   checkoutState,
   inPlaceDir
-} from "./chunk-3EWKO457.js";
-import {
-  buildContextPack,
-  toRunSummary
-} from "./chunk-3424TLIJ.js";
+} from "./chunk-OSZTENIA.js";
 import {
-  AgentDefinition,
   DECLARED_CALLER,
-  DEFAULT_SPEC_TEMPLATE,
   HOSTS_NONE,
   HOSTS_OUTSIDE_INTERNAL,
   HOSTS_OUTSIDE_VENDOR,
-  IsoDateTime,
-  NEVER_CHECKED_STEPS,
+  HOSTS_STEP,
   NO_TARGET,
-  PluginExpected,
-  REPO_TYPE_SCHEMA_VERSION,
-  RecordId,
-  SCAN_SETTINGS_SCHEMA_VERSION,
   TARGETS_ANOTHER_LABEL,
   TARGETS_SPLIT_LABEL,
   TARGETS_STEP_ID,
@@ -83,31 +76,26 @@ import {
   callTargetQuestion,
   callerRecords,
   catalogDirOf,
-  cmpNatural,
-  cmpText,
-  conventionsOf,
   declaredCallsOf,
   deserializeRecord,
-  effectiveComponentTypes,
-  external_exports,
   factIdPart,
   factsDirOf,
   factsRelOf,
   fieldKey,
   flowFiles,
   helperOn,
-  hostMatches,
+  hostOfQuestion,
   hostQuestionText,
   identifierWords,
-  isAiBy,
+  ignoreOption,
+  ignoredAnswer,
   isGuessedJoin,
-  isPathMatch,
   isPrototypeType,
   joinCallers,
-  joinConventions,
   joinFacts,
   joinFlagsOf,
   joinGuessesOf,
+  joinHostOfQuestion,
   joinRecords,
   joinSharedMaps,
   joinTerms,
@@ -116,15 +104,16 @@ import {
   lineNamesWord,
   linkEvidenceOf,
   listQuestions,
-  loadOrgPack,
   mergeCatalog,
-  normalizePath,
   orgPackDirOf,
+  outsideBoundaryOf,
   outsideSystemOf,
+  outsideSystemOfJoinHost,
   pairsFromCorrections,
   parseCorrections,
   parseFacts,
   parseRecord,
+  placeholderIn,
   projectFacts,
   questionId,
   readParsedFiles,
@@ -132,7 +121,6 @@ import {
   serializeRecord,
   sharedJoinAbout,
   singularNoun,
-  slugify,
   specFileHash,
   specFindingFingerprint,
   stackHelpersOff,
@@ -142,14 +130,38 @@ import {
   throwIfCancelled,
   toCanonicalYaml,
   topicOfQuestion,
-  topicQuestionText,
+  topicQuestionText
+} from "./chunk-GJVCBTSO.js";
+import {
+  writeFileAtomic
+} from "./chunk-G3ZFEHCX.js";
+import {
+  AgentDefinition,
+  DEFAULT_SPEC_TEMPLATE,
+  IsoDateTime,
+  NEVER_CHECKED_STEPS,
+  PluginExpected,
+  REPO_TYPE_SCHEMA_VERSION,
+  RecordId,
+  SCAN_SETTINGS_SCHEMA_VERSION,
+  cmpNatural,
+  cmpText,
+  conventionsOf,
+  effectiveComponentTypes,
+  external_exports,
+  hostMatches,
+  isAiBy,
+  isPathMatch,
+  joinConventions,
+  loadOrgPack,
+  normalizePath,
+  slugify,
   urlHostPort
-} from "./chunk-FPBUTZI5.js";
+} from "./chunk-QFDPX6C4.js";
 import {
   SCHEMA_VERSION,
-  keptParse,
-  writeFileAtomic
-} from "./chunk-B4AEL3RF.js";
+  keptParse
+} from "./chunk-CTJHEG6A.js";
 import {
   require_dist
 } from "./chunk-BQGDB6ZL.js";
@@ -1482,17 +1494,401 @@ function estateMergeInput(op, repos, records, modulesOf = (id) => repos.find((r)
 function mergeEstate(op, repos, records, modulesOf, read) {
   return mergeCatalog(estateMergeInput(op, repos, records, modulesOf, read));
 }
-function curatedDirOf(root, op) {
-  return join5(root, ...op.sources.layout.catalog.split("/"), "curated");
+function curatedDirOf(root, op) {
+  return join5(root, ...op.sources.layout.catalog.split("/"), "curated");
+}
+
+// packages/scanner/dist/facts-scan.js
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+
+// packages/scanner/dist/facts-catalog.js
+import { createHash as createHash2 } from "node:crypto";
+
+// packages/scanner/dist/hosts-asked.js
+var segs = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$]/.test(x) ? "{}" : x);
+var underPath = (path, base2) => {
+  const b = segs(base2);
+  const c = segs(path);
+  return b.length > 0 && b.length <= c.length && b.every((x, i) => x === c[i]);
+};
+var servesPath = (entry, path) => {
+  const e = segs(entry);
+  const c = segs(path);
+  return e.length === c.length && e.every((x, i) => x === "{}" || c[i] === "{}" || x === c[i]);
+};
+var HTTP_TYPES = /* @__PURE__ */ new Set(["rest", "graphql", "soap", "websocket", "sse", "webhook"]);
+var CONFIG_FILES = [
+  "**/application*.properties",
+  "**/application*.yml",
+  "**/application*.yaml",
+  "**/bootstrap*.properties",
+  "**/bootstrap*.yml",
+  "**/bootstrap*.yaml",
+  "**/.env",
+  "**/.env.*",
+  "**/Dockerfile",
+  "**/docker-compose*.yml",
+  "**/docker-compose*.yaml",
+  "**/compose*.yml",
+  "**/compose*.yaml",
+  "**/package.json"
+];
+function lineSetsPort(line, port) {
+  const p = String(port);
+  const end = "(?![0-9])";
+  return [
+    new RegExp(`port["']?\\s*[:=]\\s*["']?${p}${end}`, "i"),
+    new RegExp(`^\\s*EXPOSE\\s+(?:[0-9]+(?:/[a-z]+)?\\s+)*${p}${end}`, "i"),
+    new RegExp(`--port[=\\s]+${p}${end}`, "i"),
+    new RegExp(`(?:^|[\\s"'-])${p}:[0-9]+`)
+  ].some((re) => re.test(line));
+}
+function callHost(url) {
+  if (url.includes("${"))
+    return void 0;
+  if (tokenHost(url))
+    return void 0;
+  const hp = urlHostPort(url);
+  if (!hp || !hp.host)
+    return void 0;
+  const explicit = /^[a-z][a-z0-9+.-]*:\/\/(?:[^/@?#]*@)?[^/:?#]+:(\d+)/i.exec(url);
+  return {
+    label: explicit ? `${hp.host}:${explicit[1]}` : hp.host,
+    host: hp.host,
+    ...hp.port !== void 0 ? { port: hp.port } : {}
+  };
+}
+function tokenHost(url) {
+  const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(url)?.[1] ?? url;
+  return !!placeholderIn(authority);
+}
+var callHostLabel = (url) => callHost(url)?.label;
+async function unknownHosts(o) {
+  const patterns = o.repos.flatMap((r) => [
+    ...r.hosts,
+    ...(r.modules ?? []).flatMap((m) => m.hosts)
+  ]);
+  const byHost = /* @__PURE__ */ new Map();
+  for (const r of o.records) {
+    if (r.kind !== "Unresolved" || r.unresolvedKind !== "http-call")
+      continue;
+    const url = r.raw.slice(r.raw.indexOf(" ") + 1);
+    const h = callHost(url);
+    if (!h)
+      continue;
+    if (patterns.some((p) => hostMatches(p, h.host, h.port)))
+      continue;
+    const e = r.evidence[0];
+    const repo = e?.repo ?? r.owner;
+    if (!e?.path || e.line === void 0 || !repo)
+      continue;
+    const entry = byHost.get(h.label) ?? {
+      ...h.port !== void 0 ? { port: h.port } : {},
+      explicit: h.label !== h.host,
+      calls: [],
+      paths: /* @__PURE__ */ new Set()
+    };
+    const path = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*(\/[^?#]*)?/i.exec(url)?.[1];
+    if (path)
+      entry.paths.add(path);
+    const at3 = `${e.path}:${e.line}`;
+    if (!entry.calls.some((c) => c.repo === repo && c.at === at3))
+      entry.calls.push({ repo, at: at3 });
+    byHost.set(h.label, entry);
+  }
+  if (byHost.size === 0)
+    return [];
+  const compRepo = /* @__PURE__ */ new Map();
+  for (const r of o.repos) {
+    compRepo.set(r.component ?? r.id, r.id);
+    for (const m of r.modules ?? [])
+      compRepo.set(m.component, r.id);
+  }
+  const serving = /* @__PURE__ */ new Set();
+  for (const r of o.records)
+    if (r.kind === "Endpoint" && HTTP_TYPES.has(r.endpointType)) {
+      const repo = compRepo.get(r.component);
+      if (repo)
+        serving.add(repo);
+    }
+  const servers = [...serving].sort();
+  const configs = /* @__PURE__ */ new Map();
+  const configOf = async (repo) => {
+    if (configs.has(repo))
+      return configs.get(repo);
+    const h = o.handle(repo);
+    const out = [];
+    if (h)
+      for await (const path of h.listFiles(CONFIG_FILES)) {
+        const t = await h.readText(path).catch(() => void 0);
+        if (t !== void 0)
+          out.push({ path, lines: t.replace(/\r\n?/g, "\n").split("\n") });
+      }
+    configs.set(repo, out);
+    return out;
+  };
+  const asks = [];
+  for (const [host, entry] of [...byHost.entries()].sort(([a], [b]) => cmpText(a, b))) {
+    if (servers.length === 0)
+      continue;
+    const hits = [];
+    if (entry.explicit && entry.port !== void 0)
+      for (const repo of servers) {
+        hit: for (const f of await configOf(repo))
+          for (const [i, l] of f.lines.entries())
+            if (lineSetsPort(l, entry.port)) {
+              hits.push({ repo, at: `${f.path}:${i + 1}`, line: l.trim() });
+              break hit;
+            }
+      }
+    const suggest = hits.length === 1 ? hits[0] : void 0;
+    const calls = entry.calls.sort((a, b) => cmpText(a.repo, b.repo) || cmpNatural(a.at, b.at));
+    const byPath = [];
+    for (const g of o.records) {
+      if (g.kind !== "GatewayRoute")
+        continue;
+      const repo = g.evidence.find((e) => e.repo)?.repo;
+      if (!repo || byPath.some((b) => b.repo === repo))
+        continue;
+      const under2 = [...entry.paths].filter((p) => underPath(p, g.basepath));
+      if (!under2.length)
+        continue;
+      const comps = new Set([...compRepo].filter(([, r]) => r === repo).map(([c]) => c));
+      const hit = o.records.find((r) => r.kind === "Endpoint" && comps.has(r.component) && under2.some((p) => servesPath(r.pathOrTopic, p)));
+      byPath.push({
+        repo,
+        serves: hit ? [hit.method?.toUpperCase(), hit.pathOrTopic].filter(Boolean).join(" ") : `the routes under ${g.basepath}`
+      });
+    }
+    byPath.sort((a, b) => cmpText(a.repo, b.repo));
+    const first = suggest ? [suggest.repo] : byPath.map((b) => b.repo).filter((x) => servers.includes(x));
+    const about = Object.fromEntries(servers.flatMap((s) => {
+      const d = o.repos.find((r) => r.id === s)?.description;
+      return d ? [[s, { text: d.text, trust: d.trust }]] : [];
+    }));
+    asks.push({
+      host,
+      calls,
+      servers: [...first, ...servers.filter((s) => !first.includes(s))],
+      ...suggest ? { suggest } : {},
+      ...Object.keys(about).length ? { about } : {},
+      ...byPath.length ? { byPath } : {}
+    });
+  }
+  return asks;
+}
+function aboutOf(a, repo) {
+  const d = a.about?.[repo];
+  if (!d)
+    return "";
+  return d.trust === "suggested" ? `. What it is, as your assistant drafted it (unconfirmed): ${d.text}` : `. What it is: ${d.text}`;
+}
+function gatewayHostFix(host, byPath) {
+  const repos = byPath.map((b) => b.repo);
+  return `${repos.length === 1 ? `${repos[0]}'s routes serve` : `The routes of ${repos.join(", ")} serve`} the paths the calls to ${host} make, and no repo lists ${host}: it looks like a shared gateway's host. Once, not per call: list ${host} under hosts: on each proxy repo in repos.manifest.yaml (${repos.join(", ")}, and any other proxy on it); the path then picks the proxy, and this question retires itself`;
+}
+function hostQuestionDrafts(asks) {
+  return asks.map((a) => {
+    const repo = a.calls[0].repo;
+    const byPath = new Map((a.byPath ?? []).map((b) => [b.repo, b.serves]));
+    return {
+      repo,
+      ...a.byPath?.length ? { byPath: a.byPath } : {},
+      draft: {
+        question: hostQuestionText(a.host),
+        options: [
+          ...a.servers.map((s) => ({
+            label: s,
+            means: (a.suggest?.repo === s ? `${s} serves HTTP, and its ${a.suggest.at} sets the port ${a.host.split(":").pop()} (${a.suggest.line})` : byPath.has(s) ? `${s} serves ${byPath.get(s)}, a path the calls to ${a.host} make` : `${s} serves HTTP`) + aboutOf(a, s),
+            changes: byPath.has(s) ? `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan; on a shared gateway host, list it on each proxy repo instead (${[...byPath.keys()].join(", ")}, and any other proxy on it), and the path picks the proxy` : `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan`
+          })),
+          // O1: a system outside the estate, declared in the profile with the host as its alias.
+          ...[
+            [HOSTS_OUTSIDE_INTERNAL, "internal", "another team's system"],
+            [HOSTS_OUTSIDE_VENDOR, "vendor", "a vendor's system"]
+          ].map(([label2, boundary, what2]) => ({
+            label: label2,
+            means: `${a.host} is ${what2}, outside this estate, that the org pack doesn't name yet`,
+            changes: `A system ${outsideSystemOf(a.host).id} (boundary ${boundary}, alias ${a.host}) goes into the profile, and the calls to ${a.host} go to it on the next scan`
+          })),
+          {
+            label: HOSTS_NONE,
+            means: `Neither a repo of this estate nor a system to add to the org pack answers on ${a.host}`,
+            changes: "Nothing is added to the manifest or the profile; the calls stay loose ends, and this isn't asked again"
+          },
+          // Beta.24 review: every join question offers Ignore from the start.
+          ignoreOption()
+        ],
+        evidence: a.calls.filter((c) => c.repo === repo).slice(0, 3).map((c) => c.at),
+        scope: "repo"
+      }
+    };
+  });
+}
+
+// packages/scanner/dist/join-host-questions.js
+var HTTP_TYPES2 = /* @__PURE__ */ new Set(["rest", "graphql", "soap", "websocket", "sse", "webhook"]);
+var segs2 = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$*]/.test(x) ? "{}" : x);
+var servesPath2 = (entry, path) => {
+  const e = segs2(entry);
+  const c = segs2(path);
+  if (!c.length || c.length > e.length)
+    return false;
+  const tail = e.slice(e.length - c.length);
+  return tail.every((x, i) => x === "{}" || c[i] === "{}" || x === c[i]);
+};
+var isTokenHost = (host) => !!placeholderIn(host);
+function joinHostQuestionDrafts(input) {
+  const byHost = /* @__PURE__ */ new Map();
+  for (const a of input.asks) {
+    if (a.reason !== "unknown-host" || !a.host || a.call.repo !== input.repo)
+      continue;
+    if (input.skip?.has(a.call.fact))
+      continue;
+    if (!isTokenHost(a.host) && input.hostsAsked?.has(a.host))
+      continue;
+    byHost.set(a.host, [...byHost.get(a.host) ?? [], a]);
+  }
+  if (!byHost.size)
+    return [];
+  const compRepo = /* @__PURE__ */ new Map();
+  for (const r of input.repos) {
+    compRepo.set(r.component ?? r.id, r.id);
+    for (const m of r.modules ?? [])
+      compRepo.set(m.component, r.id);
+  }
+  const endpoints = input.records.filter((r) => r.kind === "Endpoint" && HTTP_TYPES2.has(r.endpointType));
+  const servers = [
+    ...new Set(endpoints.flatMap((e) => compRepo.has(e.component) ? [compRepo.get(e.component)] : []))
+  ].filter((r) => r !== input.repo).sort(cmpText);
+  const factOf = new Map(input.facts.map((f) => [f.id, f]));
+  const out = [];
+  for (const [host, asks] of [...byHost].sort(([a], [b]) => cmpText(a, b))) {
+    const calls = asks.map((a) => ({ id: a.call.fact, at: a.call.at, f: factOf.get(a.call.fact) })).sort((a, b) => cmpNatural(a.at, b.at) || cmpText(a.id, b.id));
+    const paths = calls.flatMap((c) => c.f?.kind === "call" ? [c.f.path] : []);
+    const byPath = [];
+    for (const r of servers) {
+      const hit = endpoints.find((e) => compRepo.get(e.component) === r && paths.some((p) => servesPath2(e.pathOrTopic, p)));
+      if (hit)
+        byPath.push({
+          repo: r,
+          serves: [hit.method?.toUpperCase(), hit.pathOrTopic].filter(Boolean).join(" ")
+        });
+    }
+    const evidence = [...new Set(calls.map((c) => c.at))].sort(cmpNatural);
+    const factIds = [...new Set(calls.map((c) => c.id))].sort(cmpText);
+    if (!isTokenHost(host)) {
+      const first = byPath.map((b) => b.repo);
+      const ask = {
+        host,
+        calls: evidence.map((at3) => ({ repo: input.repo, at: at3 })),
+        servers: [...first, ...servers.filter((s) => !first.includes(s))],
+        ...byPath.length ? { byPath } : {}
+      };
+      const [d] = hostQuestionDrafts([ask]);
+      if (d)
+        out.push({ step: HOSTS_STEP, host, factIds, draft: d.draft });
+      continue;
+    }
+    const n = factIds.length;
+    const them = n === 1 ? "The call" : `The ${n} calls`;
+    const system = outsideSystemOfJoinHost(host);
+    const rerun = `atticus verify ${input.repo} --write`;
+    const serves2 = new Map(byPath.map((b) => [b.repo, b.serves]));
+    const ranked = [...byPath.map((b) => b.repo), ...servers.filter((s) => !serves2.has(s))];
+    out.push({
+      step: TARGETS_STEP_ID,
+      host,
+      factIds,
+      draft: {
+        // The join's words: for a gateway's token, what to read again (forwardHostQuestion).
+        question: asks[0].question,
+        options: [
+          ...ranked.map((r) => ({
+            label: r,
+            means: serves2.has(r) ? `${r} serves ${serves2.get(r)}, a path the calls on ${host} make` : `${r} serves HTTP`,
+            changes: `${them} on ${host} ${n === 1 ? "joins" : "join"} ${r} when the facts are next written (${rerun})`
+          })),
+          ...[
+            [HOSTS_OUTSIDE_INTERNAL, "internal", "another team's system"],
+            [HOSTS_OUTSIDE_VENDOR, "vendor", "a vendor's system"]
+          ].map(([label2, boundary, what2]) => ({
+            label: label2,
+            means: `${host} stands for ${what2}, outside this estate, that the org pack doesn't name yet`,
+            changes: `A system ${system.id} (${system.name}, boundary ${boundary}) goes into the profile, and ${them.toLowerCase()} on ${host} ${n === 1 ? "goes" : "go"} to it when the facts are next written (${rerun})`
+          })),
+          {
+            label: HOSTS_NONE,
+            means: `Neither a repo of this estate nor a system of the org pack answers on ${host}`,
+            changes: `${them} on ${host} ${n === 1 ? "stays a loose end" : "stay loose ends"}, and this isn't asked again`
+          },
+          ignoreOption()
+        ],
+        evidence,
+        scope: "repo"
+      }
+    });
+  }
+  return out;
+}
+var isJoinHostQuestion = (q) => q.askedBy?.step === TARGETS_STEP_ID && joinHostOfQuestion(q) !== void 0;
+function joinHostTarget(q) {
+  if (!isJoinHostQuestion(q) || q.state !== "answered" || !q.answer)
+    return void 0;
+  if (ignoredAnswer(q))
+    return HOSTS_NONE;
+  const label2 = q.answer.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer.text;
+  if (!label2)
+    return void 0;
+  if (outsideBoundaryOf(label2))
+    return outsideSystemOfJoinHost(joinHostOfQuestion(q)).id;
+  return label2;
+}
+function hostsIgnoreCovers(q, call) {
+  if (q.askedBy?.step !== HOSTS_STEP || q.state !== "answered" || !ignoredAnswer(q))
+    return false;
+  return q.repo === call.repo && q.evidence.includes(call.at) || !!call.hostLabel && hostOfQuestion(q) === call.hostLabel;
+}
+function staleJoinHostQuestions(input) {
+  const drafted = new Set(input.drafted.map((d) => d.id));
+  const out = [];
+  for (const q of input.open) {
+    if (q.state !== "open" || q.repo !== input.repo || !isJoinHostQuestion(q))
+      continue;
+    if (drafted.has(q.id))
+      continue;
+    const host = joinHostOfQuestion(q);
+    const by = input.drafted.filter((d) => d.host === host).map((d) => d.id);
+    if (by.length) {
+      out.push({
+        id: q.id,
+        why: `the calls on ${host} are asked now in ${by.join(", ")}`,
+        replacedBy: by
+      });
+      continue;
+    }
+    const at3 = new Set(q.evidence);
+    const joined = (input.join?.joins ?? []).filter((j) => j.call.repo === input.repo && at3.has(j.call.at));
+    const outside = (input.join?.outside ?? []).filter((o) => o.call.repo === input.repo && at3.has(o.call.at));
+    const how = [
+      .../* @__PURE__ */ new Set([
+        ...joined.map((j) => `joins ${j.entry.component} in ${j.entry.repo}`),
+        ...outside.map((o) => `goes to ${o.target}, outside the estate`)
+      ])
+    ].sort(cmpText);
+    out.push({
+      id: q.id,
+      why: how.length ? `the join no longer asks about ${host}: the call ${how.join("; ")}` : `the join no longer asks about ${host}: no call of ${input.repo} goes there now`
+    });
+  }
+  return out.sort((a, b) => cmpText(a.id, b.id));
+}
+async function joinAnswerQuestions(root) {
+  const of = (step) => listQuestions(root, { step }).then((r) => r.questions, () => []);
+  return [...await of(TARGETS_STEP_ID), ...await of(HOSTS_STEP)];
 }
 
-// packages/scanner/dist/facts-scan.js
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join6 } from "node:path";
-
-// packages/scanner/dist/facts-catalog.js
-import { createHash as createHash2 } from "node:crypto";
-
 // packages/scanner/dist/target-suggest.js
 var TARGETS_MAX_SUGGESTED = 5;
 var TARGETS_ANOTHER = TARGETS_ANOTHER_LABEL;
@@ -1505,18 +1901,18 @@ function nameWords(s) {
     ...new Set(s.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 3 && !STOP.has(w) && !/^v?\d+$/.test(w)).map((w) => w.length > 4 && w.endsWith("s") && !w.endsWith("ss") ? w.slice(0, -1) : w))
   ];
 }
-var segs = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$]/.test(x) ? "{}" : x);
+var segs3 = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$]/.test(x) ? "{}" : x);
 var sameSeg = (a, b) => a === "{}" || b === "{}" || a === b;
 var under = (path, prefix) => {
-  const a = segs(prefix);
-  const b = segs(path);
+  const a = segs3(prefix);
+  const b = segs3(path);
   return a.length > 0 && a.length <= b.length && a.every((x, i) => x === b[i]);
 };
 function serves(entry, call, bases) {
-  const e = segs(entry);
+  const e = segs3(entry);
   const tries = [
-    segs(call),
-    ...bases.filter((b) => under(call, b)).map((b) => segs(call).slice(segs(b).length))
+    segs3(call),
+    ...bases.filter((b) => under(call, b)).map((b) => segs3(call).slice(segs3(b).length))
   ];
   return tries.some((c) => c.length === e.length && c.every((x, i) => sameSeg(x, e[i])));
 }
@@ -1540,7 +1936,10 @@ function hostOf(f, facts) {
   }
   return void 0;
 }
-var answerLabel = (q) => q.answer?.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer?.text;
+var answerLabel = (q) => (
+  // Beta.24 review: Ignore names no target, so it is never suggested again.
+  ignoredAnswer(q) ? void 0 : q.answer?.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer?.text
+);
 var NOT_A_TARGET = /* @__PURE__ */ new Set(["None of these", TARGETS_SPLIT_LABEL, TARGETS_ANOTHER_LABEL]);
 function candidates(callerRepo, ctx) {
   const manifest = estateRepos(ctx.op).filter((r) => r.id !== callerRepo || !!ctx.only);
@@ -1678,7 +2077,7 @@ function targetSuggestions(f, ctx) {
     },
     {
       from: `the path ${f.path}`,
-      words: nameWords(segs(f.path).filter((x) => x !== "{}").join(" ")),
+      words: nameWords(segs3(f.path).filter((x) => x !== "{}").join(" ")),
       weight: 2
     }
   ].filter((x) => x.from && x.words.length);
@@ -1694,8 +2093,10 @@ function targetSuggestions(f, ctx) {
       s.score += n;
       s.why.push(why);
     };
-    if (only?.has(c.s.label))
-      add(6, "the join found an entry of it that serves the call");
+    if (only?.has(c.s.label)) {
+      const at3 = ctx.onlyAt?.[c.s.label] ?? [];
+      add(6, `the join found an entry of it that serves the call${at3.length ? ` (${at3.join(", ")})` : ""}`);
+    }
     const hit = c.entries.find((e) => (!method || !e.method || e.method === method || e.method === "ANY") && serves(e.path, f.path, c.bases.map((b) => b.path)));
     if (hit && !only) {
       const what2 = [hit.method, hit.path].filter(Boolean).join(" ");
@@ -1952,14 +2353,17 @@ var anotherOption = (op) => {
 function offered(members, facts, records, op, asks, ctx) {
   const merged = /* @__PURE__ */ new Map();
   for (const m of members) {
-    const ambiguous = asks?.some((a) => a.reason === "ambiguous" && a.call.repo === m.f.repo && a.call.fact === m.f.id);
+    const ambiguous = asks?.find((a) => a.reason === "ambiguous" && a.call.repo === m.f.repo && a.call.fact === m.f.id);
+    const onlyAt = {};
+    for (const c of ambiguous?.candidates ?? [])
+      (onlyAt[c.component] ??= []).push(c.at);
     for (const s of targetSuggestions(m.f, {
       op,
       records,
       facts,
       ...ctx.estate ? { estate: ctx.estate } : {},
       ...ctx.questions ? { questions: ctx.questions } : {},
-      ...ambiguous ? { only: m.servers } : {}
+      ...ambiguous ? { only: m.servers, onlyAt } : {}
     })) {
       const x = merged.get(s.label);
       if (!x)
@@ -1995,7 +2399,9 @@ function targetQuestionDrafts(facts, records, op, asks, ctx = {}) {
           label: TARGETS_NONE,
           means: "Nothing in the estate or the org pack's systems answers it",
           changes: "The call stays a loose end, and this isn't asked again"
-        }
+        },
+        // Beta.24 review: every join question offers Ignore from the start.
+        ignoreOption()
       ],
       evidence: q.evidence,
       scope: "repo"
@@ -2059,7 +2465,7 @@ function targetGroupWordings(repo, f, facts) {
 }
 var repo0 = (members) => members[0].f.repo;
 var byLine = (a, b) => cmpNatural(a, b);
-var answerLabel2 = (q) => q.answer?.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer?.text;
+var answerLabel2 = (q) => ignoredAnswer(q) ? TARGETS_NONE : q.answer?.option !== void 0 ? q.options[q.answer.option - 1]?.label : q.answer?.text;
 function splitTargetGroups(questions) {
   return new Set(questions.filter((q) => q.askedBy?.step === TARGETS_STEP && q.state === "answered" && answerLabel2(q) === TARGETS_SPLIT).map((q) => q.question.trim()));
 }
@@ -2104,7 +2510,8 @@ function groupedTargetDrafts(facts, records, op, asks, o) {
           label: TARGETS_NONE,
           means: "Nothing in the estate or the org pack's systems answers any of them",
           changes: "The calls stay loose ends, and this isn't asked again"
-        }
+        },
+        ignoreOption()
       ],
       evidence,
       scope: "repo"
@@ -2185,6 +2592,8 @@ function targetsFromAnswers(repo, facts, questions, o = {}) {
   for (const q of [...questions].filter((x) => x.askedBy?.step === TARGETS_STEP && x.state === "answered" && !!x.answer && typeof x.question === "string").sort((a, b) => cmpText(a.answer.at, b.answer.at) || cmpText(a.id, b.id)))
     groups.set(q.question.trim(), q);
   const ruled = ruledTargets(repo, facts, questions, o);
+  const joinHosts = questions.filter((x) => x.repo === repo && isJoinHostQuestion(x) && x.state === "answered").sort((a, b) => cmpText(b.answer.at, a.answer.at) || cmpText(a.id, b.id));
+  const ignoredHosts = questions.filter((x) => x.askedBy?.step === HOSTS_STEP && x.state === "answered" && !!ignoredAnswer(x));
   const out = {};
   for (const f of [...facts].sort((a, b) => cmpText(a.id, b.id))) {
     if (f.kind !== "call")
@@ -2199,6 +2608,21 @@ function targetsFromAnswers(repo, facts, questions, o = {}) {
     }
     let label2 = asked && asked.state === "answered" && asked.answer ? answerLabel2(asked) : void 0;
     let byAi = label2 && asked?.answer && isAiBy(asked.answer.by) ? asked.answer.by : void 0;
+    const at3 = q.evidence[0];
+    if (!label2 || label2 === TARGETS_SPLIT || label2 === TARGETS_ANOTHER) {
+      const jh = joinHosts.find((x) => x.evidence.includes(at3) && !!joinHostTarget(x));
+      if (jh) {
+        label2 = joinHostTarget(jh);
+        byAi = jh.answer && isAiBy(jh.answer.by) ? jh.answer.by : void 0;
+      } else if (ignoredHosts.length) {
+        const url = urlOf(f, facts);
+        const hostLabel = url ? callHostLabel(url) : void 0;
+        if (ignoredHosts.some((x) => hostsIgnoreCovers(x, { repo, at: at3, hostLabel }))) {
+          label2 = TARGETS_NONE;
+          byAi = void 0;
+        }
+      }
+    }
     if (!label2 || label2 === TARGETS_SPLIT || label2 === TARGETS_ANOTHER) {
       label2 = ruled.get(f.id)?.label;
       byAi = void 0;
@@ -2872,7 +3296,7 @@ async function factsForScan(root, op, repo, commit, readerRecords, at3 = {}) {
     const left = report.rejected.length;
     carriedSaid = `; ${report.carried.length} carried from commit ${from} to ${commit.slice(0, 7)} (the files they cite are unchanged, their lines checked again)${left ? `, ${left} left out until read again (they cite a file changed since, or name a fact that does: /atticus-map ${repo}, then atticus verify ${repo} --write)` : ""}`;
   }
-  const questions = (await listQuestions(root, { step: TARGETS_STEP }).catch(() => ({ questions: [] }))).questions;
+  const questions = await joinAnswerQuestions(root);
   const targets = targetsFromAnswers(repo, facts, questions, {
     repoType: estateRepos(op).find((r) => r.id === repo)?.type
   });
@@ -2923,7 +3347,7 @@ async function estateFacts(root, op, except) {
   const pairs = {};
   const notes = [];
   const unverified = [];
-  const questions = (await listQuestions(root, { step: TARGETS_STEP }).catch(() => ({ questions: [] }))).questions;
+  const questions = await joinAnswerQuestions(root);
   for (const r of productionRepos(op)) {
     if (r.id === except)
       continue;
@@ -4661,7 +5085,7 @@ function parseEntry(s) {
   const m = /^([A-Za-z]+)\s+(\S+)$/.exec(s.trim());
   return m ? { method: m[1].toUpperCase(), path: m[2] } : { path: s.trim() };
 }
-var segs2 = (p) => normalizePath(p).toLowerCase().split("/").filter(Boolean);
+var segs4 = (p) => normalizePath(p).toLowerCase().split("/").filter(Boolean);
 var sameMethod = (a, b) => !a || !b || a.toUpperCase() === b.toUpperCase();
 async function joinEstate(o) {
   const byId = new Map(o.records.map((r) => [r.id, r]));
@@ -4673,8 +5097,8 @@ async function joinEstate(o) {
     const out = [i.normalizedPath];
     const route = i.route ? byId.get(i.route) : void 0;
     if (route?.kind === "GatewayRoute") {
-      const base2 = segs2(route.basepath);
-      const p = segs2(i.normalizedPath);
+      const base2 = segs4(route.basepath);
+      const p = segs4(i.normalizedPath);
       if (base2.length && base2.every((s, k) => p[k] === s))
         out.push(`/${p.slice(base2.length).join("/")}`);
     }
@@ -5036,219 +5460,6 @@ function fieldLineage(f, field) {
   return out;
 }
 
-// packages/scanner/dist/hosts-asked.js
-var segs3 = (p) => p.split(/[?#]/)[0].split("/").filter(Boolean).map((x) => /^[{:<$]/.test(x) ? "{}" : x);
-var underPath = (path, base2) => {
-  const b = segs3(base2);
-  const c = segs3(path);
-  return b.length > 0 && b.length <= c.length && b.every((x, i) => x === c[i]);
-};
-var servesPath = (entry, path) => {
-  const e = segs3(entry);
-  const c = segs3(path);
-  return e.length === c.length && e.every((x, i) => x === "{}" || c[i] === "{}" || x === c[i]);
-};
-var HTTP_TYPES = /* @__PURE__ */ new Set(["rest", "graphql", "soap", "websocket", "sse", "webhook"]);
-var CONFIG_FILES = [
-  "**/application*.properties",
-  "**/application*.yml",
-  "**/application*.yaml",
-  "**/bootstrap*.properties",
-  "**/bootstrap*.yml",
-  "**/bootstrap*.yaml",
-  "**/.env",
-  "**/.env.*",
-  "**/Dockerfile",
-  "**/docker-compose*.yml",
-  "**/docker-compose*.yaml",
-  "**/compose*.yml",
-  "**/compose*.yaml",
-  "**/package.json"
-];
-function lineSetsPort(line, port) {
-  const p = String(port);
-  const end = "(?![0-9])";
-  return [
-    new RegExp(`port["']?\\s*[:=]\\s*["']?${p}${end}`, "i"),
-    new RegExp(`^\\s*EXPOSE\\s+(?:[0-9]+(?:/[a-z]+)?\\s+)*${p}${end}`, "i"),
-    new RegExp(`--port[=\\s]+${p}${end}`, "i"),
-    new RegExp(`(?:^|[\\s"'-])${p}:[0-9]+`)
-  ].some((re) => re.test(line));
-}
-function callHost(url) {
-  if (url.includes("${"))
-    return void 0;
-  const hp = urlHostPort(url);
-  if (!hp || !hp.host)
-    return void 0;
-  const explicit = /^[a-z][a-z0-9+.-]*:\/\/(?:[^/@?#]*@)?[^/:?#]+:(\d+)/i.exec(url);
-  return {
-    label: explicit ? `${hp.host}:${explicit[1]}` : hp.host,
-    host: hp.host,
-    ...hp.port !== void 0 ? { port: hp.port } : {}
-  };
-}
-async function unknownHosts(o) {
-  const patterns = o.repos.flatMap((r) => [
-    ...r.hosts,
-    ...(r.modules ?? []).flatMap((m) => m.hosts)
-  ]);
-  const byHost = /* @__PURE__ */ new Map();
-  for (const r of o.records) {
-    if (r.kind !== "Unresolved" || r.unresolvedKind !== "http-call")
-      continue;
-    const url = r.raw.slice(r.raw.indexOf(" ") + 1);
-    const h = callHost(url);
-    if (!h)
-      continue;
-    if (patterns.some((p) => hostMatches(p, h.host, h.port)))
-      continue;
-    const e = r.evidence[0];
-    const repo = e?.repo ?? r.owner;
-    if (!e?.path || e.line === void 0 || !repo)
-      continue;
-    const entry = byHost.get(h.label) ?? {
-      ...h.port !== void 0 ? { port: h.port } : {},
-      explicit: h.label !== h.host,
-      calls: [],
-      paths: /* @__PURE__ */ new Set()
-    };
-    const path = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*(\/[^?#]*)?/i.exec(url)?.[1];
-    if (path)
-      entry.paths.add(path);
-    const at3 = `${e.path}:${e.line}`;
-    if (!entry.calls.some((c) => c.repo === repo && c.at === at3))
-      entry.calls.push({ repo, at: at3 });
-    byHost.set(h.label, entry);
-  }
-  if (byHost.size === 0)
-    return [];
-  const compRepo = /* @__PURE__ */ new Map();
-  for (const r of o.repos) {
-    compRepo.set(r.component ?? r.id, r.id);
-    for (const m of r.modules ?? [])
-      compRepo.set(m.component, r.id);
-  }
-  const serving = /* @__PURE__ */ new Set();
-  for (const r of o.records)
-    if (r.kind === "Endpoint" && HTTP_TYPES.has(r.endpointType)) {
-      const repo = compRepo.get(r.component);
-      if (repo)
-        serving.add(repo);
-    }
-  const servers = [...serving].sort();
-  const configs = /* @__PURE__ */ new Map();
-  const configOf = async (repo) => {
-    if (configs.has(repo))
-      return configs.get(repo);
-    const h = o.handle(repo);
-    const out = [];
-    if (h)
-      for await (const path of h.listFiles(CONFIG_FILES)) {
-        const t = await h.readText(path).catch(() => void 0);
-        if (t !== void 0)
-          out.push({ path, lines: t.replace(/\r\n?/g, "\n").split("\n") });
-      }
-    configs.set(repo, out);
-    return out;
-  };
-  const asks = [];
-  for (const [host, entry] of [...byHost.entries()].sort(([a], [b]) => cmpText(a, b))) {
-    if (servers.length === 0)
-      continue;
-    const hits = [];
-    if (entry.explicit && entry.port !== void 0)
-      for (const repo of servers) {
-        hit: for (const f of await configOf(repo))
-          for (const [i, l] of f.lines.entries())
-            if (lineSetsPort(l, entry.port)) {
-              hits.push({ repo, at: `${f.path}:${i + 1}`, line: l.trim() });
-              break hit;
-            }
-      }
-    const suggest = hits.length === 1 ? hits[0] : void 0;
-    const calls = entry.calls.sort((a, b) => cmpText(a.repo, b.repo) || cmpNatural(a.at, b.at));
-    const byPath = [];
-    for (const g of o.records) {
-      if (g.kind !== "GatewayRoute")
-        continue;
-      const repo = g.evidence.find((e) => e.repo)?.repo;
-      if (!repo || byPath.some((b) => b.repo === repo))
-        continue;
-      const under2 = [...entry.paths].filter((p) => underPath(p, g.basepath));
-      if (!under2.length)
-        continue;
-      const comps = new Set([...compRepo].filter(([, r]) => r === repo).map(([c]) => c));
-      const hit = o.records.find((r) => r.kind === "Endpoint" && comps.has(r.component) && under2.some((p) => servesPath(r.pathOrTopic, p)));
-      byPath.push({
-        repo,
-        serves: hit ? [hit.method?.toUpperCase(), hit.pathOrTopic].filter(Boolean).join(" ") : `the routes under ${g.basepath}`
-      });
-    }
-    byPath.sort((a, b) => cmpText(a.repo, b.repo));
-    const first = suggest ? [suggest.repo] : byPath.map((b) => b.repo).filter((x) => servers.includes(x));
-    const about = Object.fromEntries(servers.flatMap((s) => {
-      const d = o.repos.find((r) => r.id === s)?.description;
-      return d ? [[s, { text: d.text, trust: d.trust }]] : [];
-    }));
-    asks.push({
-      host,
-      calls,
-      servers: [...first, ...servers.filter((s) => !first.includes(s))],
-      ...suggest ? { suggest } : {},
-      ...Object.keys(about).length ? { about } : {},
-      ...byPath.length ? { byPath } : {}
-    });
-  }
-  return asks;
-}
-function aboutOf(a, repo) {
-  const d = a.about?.[repo];
-  if (!d)
-    return "";
-  return d.trust === "suggested" ? `. What it is, as your assistant drafted it (unconfirmed): ${d.text}` : `. What it is: ${d.text}`;
-}
-function gatewayHostFix(host, byPath) {
-  const repos = byPath.map((b) => b.repo);
-  return `${repos.length === 1 ? `${repos[0]}'s routes serve` : `The routes of ${repos.join(", ")} serve`} the paths the calls to ${host} make, and no repo lists ${host}: it looks like a shared gateway's host. Once, not per call: list ${host} under hosts: on each proxy repo in repos.manifest.yaml (${repos.join(", ")}, and any other proxy on it); the path then picks the proxy, and this question retires itself`;
-}
-function hostQuestionDrafts(asks) {
-  return asks.map((a) => {
-    const repo = a.calls[0].repo;
-    const byPath = new Map((a.byPath ?? []).map((b) => [b.repo, b.serves]));
-    return {
-      repo,
-      ...a.byPath?.length ? { byPath: a.byPath } : {},
-      draft: {
-        question: hostQuestionText(a.host),
-        options: [
-          ...a.servers.map((s) => ({
-            label: s,
-            means: (a.suggest?.repo === s ? `${s} serves HTTP, and its ${a.suggest.at} sets the port ${a.host.split(":").pop()} (${a.suggest.line})` : byPath.has(s) ? `${s} serves ${byPath.get(s)}, a path the calls to ${a.host} make` : `${s} serves HTTP`) + aboutOf(a, s),
-            changes: byPath.has(s) ? `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan; on a shared gateway host, list it on each proxy repo instead (${[...byPath.keys()].join(", ")}, and any other proxy on it), and the path picks the proxy` : `${a.host} goes under hosts for ${s} in repos.manifest.yaml, and the calls to it join ${s} on the next scan`
-          })),
-          // O1: a system outside the estate, declared in the profile with the host as its alias.
-          ...[
-            [HOSTS_OUTSIDE_INTERNAL, "internal", "another team's system"],
-            [HOSTS_OUTSIDE_VENDOR, "vendor", "a vendor's system"]
-          ].map(([label2, boundary, what2]) => ({
-            label: label2,
-            means: `${a.host} is ${what2}, outside this estate, that the org pack doesn't name yet`,
-            changes: `A system ${outsideSystemOf(a.host).id} (boundary ${boundary}, alias ${a.host}) goes into the profile, and the calls to ${a.host} go to it on the next scan`
-          })),
-          {
-            label: HOSTS_NONE,
-            means: `Neither a repo of this estate nor a system to add to the org pack answers on ${a.host}`,
-            changes: "Nothing is added to the manifest or the profile; the calls stay loose ends, and this isn't asked again"
-          }
-        ],
-        evidence: a.calls.filter((c) => c.repo === repo).slice(0, 3).map((c) => c.at),
-        scope: "repo"
-      }
-    };
-  });
-}
-
 // packages/scanner/dist/measure-links.js
 var import_yaml4 = __toESM(require_dist(), 1);
 var METHODS = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|ANY)\s+(\S.*)$/i;
@@ -5344,12 +5555,12 @@ function parseLinkReference(source) {
   return { ok: true, reference: { ...estate ? { estate } : {}, repos } };
 }
 var stripped = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
-function segs4(path) {
+function segs5(path) {
   return path.split(/[?#]/)[0].split("/").filter(Boolean).map((s) => /^(\{[^}]*\}|:\w+|\*)$/.test(s) ? "{}" : s.toLowerCase());
 }
 function pathMatch(a, b) {
-  const x = segs4(a);
-  const y = segs4(b);
+  const x = segs5(a);
+  const y = segs5(b);
   if (x.length === y.length && x.every((s, i) => s === y[i]))
     return 2;
   const [short, long] = x.length < y.length ? [x, y] : [y, x];
@@ -5646,6 +5857,19 @@ export {
   estateMergeInput,
   mergeEstate,
   curatedDirOf,
+  lineSetsPort,
+  tokenHost,
+  callHostLabel,
+  unknownHosts,
+  gatewayHostFix,
+  hostQuestionDrafts,
+  isTokenHost,
+  joinHostQuestionDrafts,
+  isJoinHostQuestion,
+  joinHostTarget,
+  hostsIgnoreCovers,
+  staleJoinHostQuestions,
+  joinAnswerQuestions,
   TARGETS_MAX_SUGGESTED,
   TARGETS_ANOTHER,
   TARGETS_NO_EVIDENCE,
@@ -5728,10 +5952,6 @@ export {
   estateFlow,
   flattenEstateFlow,
   fieldLineage,
-  lineSetsPort,
-  unknownHosts,
-  gatewayHostFix,
-  hostQuestionDrafts,
   parseLinkReference,
   measureLinks,
   estateJoinOf,