@maycombhq/atticus 2.0.0-beta.23 → 2.0.0-beta.25

package/dist/{chunk-CZ2ZS7AT.js → chunk-CGVRLQAY.js}

@@ -5,30 +5,35 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readOpenApiDocument
-} from "./chunk-G6EFXTUO.js";
+} from "./chunk-2VN4TLGI.js";
 import {
   globToRegExp
-} from "./chunk-PQQKZPBU.js";
+} from "./chunk-4U3JLIRC.js";
 import {
   DECLARED_TOPIC,
-  DEFAULT_CONVENTIONS,
   Fact,
   FactId,
   JOINED_BY_AI,
+  JOINED_BY_BASE_PATH,
+  JOINED_BY_PATH,
+  JOINED_BY_PATH_OVERLAP,
   JOINED_BY_PERSON,
   JOINED_TO_SHARED_MAP,
+  JOIN_GUESS_FLAGS,
   JOIN_HOW_FLAGS,
   LINK_EVIDENCE_NOT_GAPS,
   MOCK_FILE,
-  NEVER_CHECKED_STEPS,
   SHARED_MAP_EVIDENCE,
   citedFiles,
   claimOnLines,
   clusterServiceAddress,
+  configSecretField,
+  credentialLike,
   decodeText,
+  dependencyLinkId,
   factIdPart,
   forwardSlashes,
-  gatewayBundleTest,
+  hasSecretShape,
   isBinaryText,
   isLfsPointer,
   isPatternPath,
@@ -36,11 +41,11 @@ import {
   lineNamesClaim,
   linksFor,
   listRepoFilesSync,
-  normalizePath,
-  notDeviceName,
+  looksLikeSecret,
   noteProblem,
   partsBuildWord,
   partsNamePath,
+  placedComponentOf,
   plainPathPrefix,
   quoteHoldsSecret,
   quoteMatches,
@@ -48,9 +53,17 @@ import {
   redactSecrets,
   staleCite,
   toCanonicalYaml,
-  tokenUnits,
+  tokenUnits
+} from "./chunk-GLISHJ4G.js";
+import {
+  DEFAULT_CONVENTIONS,
+  DEFAULT_GATEWAY_BUNDLE_FOLDERS,
+  NEVER_CHECKED_STEPS,
+  gatewayBundleTest,
+  normalizePath,
+  notDeviceName,
   underFolders
-} from "./chunk-FPBUTZI5.js";
+} from "./chunk-LZFKJ2BR.js";
 
 // packages/verify/dist/source.js
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
@@ -166,6 +179,1046 @@ function tooBigToRead(source, path) {
   return n !== void 0 && n > MAX_SOURCE_BYTES;
 }
 
+// packages/verify/dist/build-coords.js
+var POM = /(^|\/)([^/]*[-_.])?pom\.xml$|\.pom$/i;
+var GENERATED_POM = /(^|\/)(dependency-reduced-pom\.xml|\.flattened-pom\.xml)$/i;
+var GRADLE_BUILD = /(^|\/)build\.gradle(\.kts)?$/i;
+var GRADLE_SETTINGS = /(^|\/)settings\.gradle(\.kts)?$/i;
+var VERSION_CATALOG = /(^|\/)gradle\/([\w-]+)\.versions\.toml$/i;
+var slash = (p) => p.replace(/\\/g, "/");
+var isPomFile = (p) => POM.test(slash(p)) && !GENERATED_POM.test(slash(p));
+var isGradleBuildFile = (p) => GRADLE_BUILD.test(slash(p));
+var isGradleSettingsFile = (p) => GRADLE_SETTINGS.test(slash(p));
+var isVersionCatalogFile = (p) => VERSION_CATALOG.test(slash(p));
+var isGradleFile = (p) => isGradleBuildFile(p) || isGradleSettingsFile(p) || isVersionCatalogFile(p);
+var isBuildFile = (p) => isPomFile(p) || isGradleFile(p);
+var isPomFileIn = (p, named) => isPomFile(p) || !!named?.has(slash(p)) && !GENERATED_POM.test(slash(p));
+var isBuildFileIn = (p, named) => isBuildFile(p) || isPomFileIn(p, named);
+var COORDINATE = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
+function lineIndex(text) {
+  const starts = [0];
+  for (let i = 0; i < text.length; i++)
+    if (text.charCodeAt(i) === 10)
+      starts.push(i + 1);
+  return (offset) => {
+    let lo = 0;
+    let hi = starts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (starts[mid] <= offset)
+        lo = mid;
+      else
+        hi = mid - 1;
+    }
+    return lo + 1;
+  };
+}
+function xmlTokens(text) {
+  const lineAt = lineIndex(text);
+  const out = [];
+  const pushText = (from, to, value = text.slice(from, to)) => {
+    const lead = value.length - value.trimStart().length;
+    if (value.trim())
+      out.push({ type: "text", value: value.trim(), line: lineAt(from + lead) });
+  };
+  let i = 0;
+  let textFrom = 0;
+  while (i < text.length) {
+    const lt = text.indexOf("<", i);
+    if (lt < 0)
+      break;
+    if (text.startsWith("<!--", lt)) {
+      pushText(textFrom, lt);
+      const end = text.indexOf("-->", lt + 4);
+      i = textFrom = end < 0 ? text.length : end + 3;
+      continue;
+    }
+    if (text.startsWith("<![CDATA[", lt)) {
+      pushText(textFrom, lt);
+      const end = text.indexOf("]]>", lt + 9);
+      const stop = end < 0 ? text.length : end;
+      pushText(lt + 9, stop);
+      i = textFrom = end < 0 ? text.length : end + 3;
+      continue;
+    }
+    if (text.startsWith("<?", lt) || text.startsWith("<!", lt)) {
+      pushText(textFrom, lt);
+      const end = text.indexOf(text.startsWith("<?", lt) ? "?>" : ">", lt + 2);
+      i = textFrom = end < 0 ? text.length : end + (text.startsWith("<?", lt) ? 2 : 1);
+      continue;
+    }
+    const m = /^<(\/?)([A-Za-z_][\w.:-]*)/.exec(text.slice(lt, lt + 200));
+    if (!m) {
+      i = lt + 1;
+      continue;
+    }
+    let j = lt + m[0].length;
+    let quote = "";
+    for (; j < text.length; j++) {
+      const c = text[j];
+      if (quote) {
+        if (c === quote)
+          quote = "";
+      } else if (c === '"' || c === "'")
+        quote = c;
+      else if (c === ">")
+        break;
+    }
+    pushText(textFrom, lt);
+    const close = m[1] === "/";
+    const self = !close && text[j - 1] === "/";
+    out.push({ type: close ? "close" : self ? "self" : "open", name: m[2], line: lineAt(lt) });
+    i = textFrom = j + 1;
+  }
+  pushText(textFrom, text.length);
+  return out;
+}
+var leaf = (frame, name) => frame.leaves.get(name);
+function pomCoordinates(lines) {
+  const held = POMS.get(lines);
+  if (held)
+    return held;
+  const out = readPom(lines);
+  POMS.set(lines, out);
+  return out;
+}
+var POMS = /* @__PURE__ */ new WeakMap();
+function readPom(lines) {
+  const out = { dependencies: [], modules: [], properties: /* @__PURE__ */ new Map() };
+  const text = lines.map((l, i) => {
+    const t = l.endsWith("\r") ? l.slice(0, -1) : l;
+    return i === 0 && t.charCodeAt(0) === 65279 ? t.slice(1) : t;
+  }).join("\n");
+  const stack = [];
+  const names = () => stack.map((f) => f.name);
+  for (const t of xmlTokens(text)) {
+    const top = stack[stack.length - 1];
+    if (t.type === "text") {
+      if (top && !top.text) {
+        top.text = t.value;
+        top.textLine = t.line;
+      }
+      continue;
+    }
+    if (t.type !== "close") {
+      if (top)
+        top.children = true;
+      if (t.type === "self") {
+        if (t.name === "relativePath" && top?.name === "parent")
+          top.leaves.set("relativePath", { value: "", line: t.line });
+        continue;
+      }
+      stack.push({ name: t.name, leaves: /* @__PURE__ */ new Map(), children: false, text: "", textLine: t.line });
+      continue;
+    }
+    const at = names().lastIndexOf(t.name);
+    if (at < 0)
+      continue;
+    while (stack.length > at + 1)
+      stack.pop();
+    const done = stack.pop();
+    const parent = stack[stack.length - 1];
+    const value = !done.children && done.text ? { value: done.text, line: done.textLine } : void 0;
+    if (value && parent)
+      parent.leaves.set(done.name, value);
+    const path = [...names(), done.name];
+    if (done.name === "dependency") {
+      const g = leaf(done, "groupId");
+      const a = leaf(done, "artifactId");
+      const v = leaf(done, "version");
+      const s = leaf(done, "scope");
+      out.dependencies.push({
+        ...g ? { group: g } : {},
+        ...a ? { artifact: a } : {},
+        ...v ? { version: v } : {},
+        ...s ? { scope: s } : {},
+        managed: path.includes("dependencyManagement"),
+        plugin: path.includes("plugin") || path.includes("extension")
+      });
+    } else if (done.name === "module" && value && path[0] === "project") {
+      const p = path.join("/");
+      if (p === "project/modules/module" || p === "project/profiles/profile/modules/module")
+        out.modules.push(value);
+    } else if (done.name === "properties" && path.length === 2 && path[0] === "project") {
+      for (const [k, v] of done.leaves)
+        out.properties.set(k, v);
+    } else if (done.name === "parent" && path.length === 2 && path[0] === "project") {
+      if (leaf(done, "groupId"))
+        out.parentGroup = leaf(done, "groupId");
+      if (leaf(done, "artifactId"))
+        out.parentArtifact = leaf(done, "artifactId");
+      if (leaf(done, "version"))
+        out.parentVersion = leaf(done, "version");
+      if (leaf(done, "relativePath"))
+        out.parentRelativePath = leaf(done, "relativePath");
+    } else if (done.name === "project" && path.length === 1) {
+      if (leaf(done, "groupId"))
+        out.group = leaf(done, "groupId");
+      if (leaf(done, "artifactId"))
+        out.artifact = leaf(done, "artifactId");
+      if (leaf(done, "version"))
+        out.version = leaf(done, "version");
+    }
+  }
+  return out;
+}
+var PROPERTY = /^\$\{([^}]+)\}$/;
+function resolvePomValue(at, pom, o = {}, depth = 0) {
+  const m = PROPERTY.exec(at.value.trim());
+  if (!m)
+    return { value: at.value, line: at.line };
+  const key = m[1].trim();
+  const own = {
+    "project.groupId": pom.group ?? pom.parentGroup,
+    "pom.groupId": pom.group ?? pom.parentGroup,
+    groupId: pom.group ?? pom.parentGroup,
+    "project.artifactId": pom.artifact,
+    "pom.artifactId": pom.artifact,
+    artifactId: pom.artifact,
+    "project.version": pom.version ?? pom.parentVersion,
+    "pom.version": pom.version ?? pom.parentVersion,
+    "project.parent.groupId": pom.parentGroup,
+    "parent.groupId": pom.parentGroup,
+    "project.parent.artifactId": pom.parentArtifact,
+    "parent.artifactId": pom.parentArtifact,
+    "project.parent.version": pom.parentVersion,
+    "parent.version": pom.parentVersion
+  };
+  const builtin = Object.hasOwn(own, key);
+  let to;
+  if (builtin) {
+    const b = own[key];
+    if (b)
+      to = { at: b, file: o.file ?? "" };
+  } else {
+    const mine = pom.properties.get(key);
+    if (mine)
+      to = { at: mine, file: o.file ?? "" };
+    else
+      for (const p of o.parents ?? []) {
+        const theirs = p.pom.properties.get(key);
+        if (theirs) {
+          to = { at: theirs, file: p.file };
+          break;
+        }
+      }
+  }
+  if (!to || to.at === at || depth > 4)
+    return { missing: key };
+  const next = resolvePomValue(to.at, pom, o, depth + 1);
+  if ("missing" in next)
+    return next;
+  const via = [...builtin ? [] : [{ file: to.file, line: to.at.line }], ...next.via ?? []];
+  return { value: next.value, line: at.line, ...via.length ? { via } : {} };
+}
+function pomTarget(dir, rel) {
+  const to = joinDir(dir, rel.trim());
+  if (/\.(xml|pom)$/i.test(rel.trim()))
+    return to;
+  return to ? `${to}/pom.xml` : "pom.xml";
+}
+function pomFilesNamed(files, linesOf2) {
+  const held = NAMED.get(files);
+  if (held)
+    return held;
+  const all2 = new Set(files.map(slash));
+  const out = /* @__PURE__ */ new Set();
+  let next = files.map(slash).filter(isPomFile);
+  for (let round = 0; round < 5 && next.length; round++) {
+    const found = [];
+    for (const f of next) {
+      const lines = linesOf2(f);
+      const rel = lines ? pomCoordinates(lines).parentRelativePath?.value.trim() : void 0;
+      if (!rel)
+        continue;
+      const to = pomTarget(dirOf(f), rel);
+      if (all2.has(to) && !isPomFile(to) && !out.has(to) && !GENERATED_POM.test(to)) {
+        out.add(to);
+        found.push(to);
+      }
+    }
+    next = found;
+  }
+  NAMED.set(files, out);
+  return out;
+}
+var NAMED = /* @__PURE__ */ new WeakMap();
+function moduleParentsOf(files, linesOf2) {
+  const held = LISTED.get(files);
+  if (held)
+    return held;
+  const named = pomFilesNamed(files, linesOf2);
+  const out = /* @__PURE__ */ new Map();
+  for (const f of files.map(slash).sort()) {
+    if (!isPomFileIn(f, named))
+      continue;
+    const lines = linesOf2(f);
+    if (!lines)
+      continue;
+    for (const m of pomCoordinates(lines).modules) {
+      const dir = dirOf(pomTarget(dirOf(f), m.value));
+      if (!out.has(dir))
+        out.set(dir, f);
+    }
+  }
+  LISTED.set(files, out);
+  return out;
+}
+var LISTED = /* @__PURE__ */ new WeakMap();
+function pomParents(file, linesOf2, files) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set([slash(file)]);
+  let at = slash(file);
+  let lines = linesOf2(at);
+  for (let n = 0; n < 6 && lines; n++) {
+    const pom = pomCoordinates(lines);
+    if (!pom.parentArtifact)
+      break;
+    const rel = pom.parentRelativePath?.value.trim();
+    if (rel === "")
+      break;
+    const dir = dirOf(at);
+    const candidates = rel ? [pomTarget(dir, rel)] : [
+      ...files ? [moduleParentsOf(files, linesOf2).get(dir)] : [],
+      ...dir ? [pomTarget(dir, "..")] : []
+    ];
+    const want = pom.parentArtifact.value.trim();
+    let found;
+    for (const c of candidates) {
+      if (!c || seen.has(c))
+        continue;
+      const ls = linesOf2(c);
+      if (!ls)
+        continue;
+      const theirs = pomCoordinates(ls);
+      const name = theirs.artifact?.value.trim();
+      if (name !== void 0 && !PROPERTY.test(name) && !PROPERTY.test(want) && name !== want)
+        continue;
+      found = { file: c, pom: theirs };
+      break;
+    }
+    if (!found)
+      break;
+    out.push(found);
+    seen.add(found.file);
+    at = found.file;
+    lines = linesOf2(at);
+  }
+  return out;
+}
+var CONFIGURATION = `(?:(["'])([A-Za-z]\\w*)\\1\\s*(?=\\()|([A-Za-z]\\w*))`;
+var GRADLE_DEP = new RegExp(`^\\s*${CONFIGURATION}\\s*\\(?\\s*(?:(platform|enforcedPlatform)\\s*\\(\\s*)?(['"])([^'"\\s]+)\\5`);
+var GRADLE_MAP_DEP = new RegExp(`^\\s*${CONFIGURATION}\\s*\\(?\\s*group\\s*[:=]\\s*(['"])([^'"]+)\\4\\s*,\\s*name\\s*[:=]\\s*(['"])([^'"]+)\\6(?:\\s*,\\s*version\\s*[:=]\\s*(['"])([^'"]+)\\8)?`);
+var NOT_A_CONFIGURATION = /* @__PURE__ */ new Set([
+  "id",
+  "apply",
+  "plugin",
+  "include",
+  "includeBuild",
+  "classpath",
+  "group",
+  "version",
+  "url",
+  "uri",
+  "dependency",
+  "dependencySet",
+  "entry",
+  "mavenBom",
+  "imports",
+  "force",
+  "exclude",
+  "module",
+  "substitute",
+  "because",
+  "strictly",
+  "require",
+  "prefer",
+  "reject",
+  "alias",
+  "from",
+  "maven",
+  "mainClass",
+  "println",
+  "description"
+]);
+var TOOL_CONFIGURATIONS = /* @__PURE__ */ new Set([
+  "checkstyle",
+  "pmd",
+  "spotbugs",
+  "spotbugsPlugins",
+  "spotbugsSlf4j",
+  "jacocoAgent",
+  "jacocoAnt",
+  "detekt",
+  "detektPlugins",
+  "ktlint",
+  "ktlintRuleset",
+  "codenarc",
+  "errorprone",
+  "pitest"
+]);
+function gradleToolConfigurationOn(line) {
+  const c = /^\s*(["']?)([A-Za-z]\w*)\1\s*[\s(]/.exec(line)?.[2];
+  return c && TOOL_CONFIGURATIONS.has(c) ? c : void 0;
+}
+var TEST_CONFIGURATION = /^(test|testFixtures|\w+Test)(Implementation|Api|CompileOnly|RuntimeOnly|Compile|Runtime|AnnotationProcessor|CompileClasspath|RuntimeClasspath)$/;
+function scopeOfConfiguration(c, platform) {
+  if (platform)
+    return "import";
+  if (TEST_CONFIGURATION.test(c))
+    return "test";
+  if (/^(compileOnly|annotationProcessor|kapt|ksp|compileOnlyApi|providedCompile|providedRuntime)$/.test(c))
+    return "provided";
+  if (/^(runtimeOnly|runtime|developmentOnly|testAndDevelopmentOnly)$/.test(c))
+    return "runtime";
+  return "compile";
+}
+function gradleDependencyOn(line) {
+  if (gradleToolConfigurationOn(line))
+    return void 0;
+  const map = GRADLE_MAP_DEP.exec(line);
+  const mapConf = map ? map[2] ?? map[3] : "";
+  if (map && !NOT_A_CONFIGURATION.has(mapConf)) {
+    if (!COORDINATE.test(map[5]) || !COORDINATE.test(map[7]))
+      return void 0;
+    return {
+      configuration: mapConf,
+      group: map[5],
+      name: map[7],
+      ...map[9] ? { version: map[9] } : {},
+      scope: scopeOfConfiguration(mapConf, false)
+    };
+  }
+  const m = GRADLE_DEP.exec(line);
+  const conf = m ? m[2] ?? m[3] : "";
+  if (!m || NOT_A_CONFIGURATION.has(conf))
+    return void 0;
+  const parts = m[6].split(":");
+  if (parts.length < 2 || !COORDINATE.test(parts[0]) || !COORDINATE.test(parts[1]))
+    return void 0;
+  return {
+    configuration: conf,
+    group: parts[0],
+    name: parts[1],
+    ...parts[2] ? { version: parts[2] } : {},
+    scope: scopeOfConfiguration(conf, !!m[4])
+  };
+}
+function gradleBlocks(lines) {
+  const held = BLOCKS.get(lines);
+  if (held)
+    return held;
+  const out = readBlocks(lines);
+  BLOCKS.set(lines, out);
+  return out;
+}
+var BLOCKS = /* @__PURE__ */ new WeakMap();
+function readBlocks(lines) {
+  const out = [];
+  const stack = [];
+  let triple = "";
+  let block = false;
+  let previous = "";
+  for (const raw of lines) {
+    out.push([...stack]);
+    let code2 = "";
+    for (let i = 0; i < raw.length; i++) {
+      const c = raw[i];
+      if (block) {
+        if (raw.startsWith("*/", i)) {
+          block = false;
+          i++;
+        }
+        continue;
+      }
+      if (triple) {
+        if (raw.startsWith(triple, i)) {
+          code2 += triple;
+          i += 2;
+          triple = "";
+        }
+        continue;
+      }
+      if (raw.startsWith("//", i))
+        break;
+      if (raw.startsWith("/*", i)) {
+        block = true;
+        i++;
+        continue;
+      }
+      if (raw.startsWith("'''", i) || raw.startsWith('"""', i)) {
+        triple = raw.slice(i, i + 3);
+        code2 += triple;
+        i += 2;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        let j = i + 1;
+        for (; j < raw.length && raw[j] !== c; j++)
+          if (raw[j] === "\\")
+            j++;
+        code2 += raw.slice(i, j + 1).replace(/[{}]/g, " ");
+        i = j;
+        continue;
+      }
+      if (c === "{") {
+        const before = code2.trim() || previous;
+        const m = /([A-Za-z_][\w.]*)\s*(?:\(\s*([^()]*?)\s*\))?\s*(?:\w+\s*->\s*)?$/.exec(before);
+        const name = m?.[1] ?? "";
+        stack.push(name === "project" && m?.[2] ? `project(${m[2].replace(/['"]/g, "")})` : name);
+        code2 = "";
+        continue;
+      }
+      if (c === "}") {
+        stack.pop();
+        code2 = "";
+        continue;
+      }
+      code2 += c;
+    }
+    if (code2.trim())
+      previous = code2.trim();
+  }
+  return out;
+}
+var PROJECT_BLOCK = (b) => b === "subprojects" || b === "allprojects" || /^project\(:?[^)]*\)$/.test(b);
+var projectOf = (b) => /^project\(:?([^)]*)\)$/.exec(b)?.[1];
+function gradleDependencyAt(lines, line, blocks = gradleBlocks(lines)) {
+  const d = gradleDependencyOn(lines[line - 1] ?? "");
+  if (!d)
+    return void 0;
+  const at = projectDependenciesAt(blocks, line);
+  return "none" in at ? at : { dependency: d, ...at };
+}
+function projectDependenciesAt(blocks, line) {
+  const stack = blocks[line - 1] ?? [];
+  const outer = stack.slice(0, -1);
+  if (stack[stack.length - 1] !== "dependencies" || !outer.every(PROJECT_BLOCK)) {
+    const inside = stack.filter((b) => !PROJECT_BLOCK(b)).join(" { ");
+    return { none: inside ? `${inside} { }` : "no dependencies { } block" };
+  }
+  const proj = outer.map(projectOf).find((x) => x !== void 0);
+  return {
+    ...proj !== void 0 ? { project: proj } : {},
+    ...outer.some((b) => b === "subprojects" || b === "allprojects") ? { all: true } : {}
+  };
+}
+function catalogVersions(lines) {
+  const out = /* @__PURE__ */ new Map();
+  let section = "";
+  lines.forEach((raw, i) => {
+    const l = raw.replace(/\r$/, "");
+    const s = /^\s*\[\s*([^\]]+?)\s*\]\s*(#.*)?$/.exec(l);
+    if (s)
+      return void (section = s[1]);
+    if (section !== "versions")
+      return;
+    const m = /^\s*(["']?)([A-Za-z][\w.-]*)\1\s*=\s*(["'])([^"']+)\3\s*(#.*)?$/.exec(l);
+    if (m)
+      out.set(m[2], { value: m[4], line: i + 1 });
+  });
+  return out;
+}
+var catalogNameOf = (file) => VERSION_CATALOG.exec(slash(file))?.[2];
+var accessorOf = (alias) => alias.replace(/[-_.]+/g, ".");
+function catalogLibraryAt(lines, line) {
+  let section = "";
+  for (let i = 0; i < line && i < lines.length; i++) {
+    const m2 = /^\s*\[\s*([^\]]+?)\s*\]\s*(#.*)?$/.exec((lines[i] ?? "").replace(/\r$/, ""));
+    if (m2)
+      section = m2[1];
+  }
+  if (section !== "libraries")
+    return void 0;
+  const text = (lines[line - 1] ?? "").replace(/\r$/, "");
+  const m = /^\s*(["']?)([A-Za-z][\w.-]*)\1\s*=\s*(.+)$/.exec(text);
+  if (!m)
+    return void 0;
+  const alias = m[2];
+  const body = m[3].replace(/\s+#.*$/, "").trim();
+  const str = (key) => new RegExp(`(?:^|[{,\\s])${key.replace(".", "\\.")}\\s*=\\s*(["'])([^"']+)\\1`).exec(body)?.[2];
+  let group;
+  let name;
+  let version;
+  const whole = /^(["'])([^"']+)\1$/.exec(body);
+  if (whole)
+    [group, name, version] = whole[2].split(":");
+  else if (body.startsWith("{")) {
+    const module = str("module");
+    if (module)
+      [group, name] = module.split(":");
+    else {
+      group = str("group");
+      name = str("name");
+    }
+    version = str("version");
+  }
+  const versionRef = body.startsWith("{") ? str("version.ref") : void 0;
+  if (!group || !name || !COORDINATE.test(group) || !COORDINATE.test(name))
+    return void 0;
+  return {
+    alias,
+    accessor: accessorOf(alias),
+    group,
+    name,
+    ...version ? { version } : {},
+    ...versionRef ? { versionRef } : {}
+  };
+}
+function gradleCatalogUseOn(line) {
+  const m = new RegExp(`^\\s*${CONFIGURATION}\\s*\\(?\\s*(?:(platform|enforcedPlatform)\\s*\\(\\s*)?([A-Za-z]\\w*)\\.([A-Za-z][\\w.]*?)\\s*\\)?\\s*\\)?\\s*(?:\\{.*)?(?:\\/\\/.*)?\\r?$`).exec(line);
+  const conf = m ? m[2] ?? m[3] : "";
+  if (!m || NOT_A_CONFIGURATION.has(conf) || TOOL_CONFIGURATIONS.has(conf))
+    return void 0;
+  if (/^(bundles|plugins|versions)\./.test(m[6]) || m[5] === "project")
+    return void 0;
+  return {
+    configuration: conf,
+    catalog: m[5],
+    accessor: m[6],
+    scope: scopeOfConfiguration(conf, !!m[4])
+  };
+}
+function gradleGroupOn(line) {
+  return /^\s*(?:(?:allprojects|subprojects)\s*\{\s*)?(?:project\.)?group\s*=?\s*(['"])([^'"]+)\1\s*\}?\s*$/.exec(line)?.[2];
+}
+function gradleNameOn(line) {
+  return /^\s*(?:rootProject\.name|archivesBaseName|(?:base\.)?archivesName(?:\.set)?)\s*[=(]?\s*(['"])([^'"]+)\1\s*\)?\s*$/.exec(line)?.[2];
+}
+function gradleProjectsOn(line) {
+  const rename = /^\s*project\s*\(\s*(['"]):?([^'"]+)\1\s*\)\.name\s*=\s*(['"])([^'"]+)\3\s*$/.exec(line);
+  if (rename)
+    return [{ path: rename[2], name: rename[4], renamed: true }];
+  const inc = /^\s*include\s*\(?\s*((?:(['"])[^'"]+\2\s*,?\s*)+)\)?\s*$/.exec(line);
+  if (!inc)
+    return [];
+  return [...inc[1].matchAll(/(['"]):?([^'"]+)\1/g)].map((m) => ({
+    path: m[2],
+    name: m[2].split(":").pop()
+  }));
+}
+function gradleProjects(lines) {
+  const held = PROJECTS.get(lines);
+  if (held)
+    return held;
+  const out = [];
+  let open = "";
+  const names = (text, line) => {
+    for (const m of text.matchAll(/(['"]):?([^'"]+)\1/g))
+      out.push({ path: m[2], name: m[2].split(":").pop(), line });
+  };
+  lines.forEach((raw, i) => {
+    const code2 = raw.replace(/\r$/, "").replace(/\s\/\/.*$|^\s*\/\/.*$/, "");
+    if (open) {
+      names(code2, i + 1);
+      if (open === "paren" ? code2.includes(")") : !/,\s*$/.test(code2))
+        open = "";
+      return;
+    }
+    const rename = gradleProjectsOn(code2);
+    if (rename.length && rename[0].renamed)
+      return void out.push({ ...rename[0], line: i + 1 });
+    const inc = /^\s*include(?!\w)\s*(\(?)\s*(.*)$/.exec(code2);
+    if (!inc)
+      return;
+    names(inc[2], i + 1);
+    if (inc[1] === "(" && !inc[2].includes(")"))
+      open = "paren";
+    else if (inc[1] !== "(" && /,\s*$/.test(inc[2]))
+      open = "comma";
+  });
+  PROJECTS.set(lines, out);
+  return out;
+}
+var PROJECTS = /* @__PURE__ */ new WeakMap();
+function projectDirs(settings) {
+  const dirs = /* @__PURE__ */ new Map();
+  for (const l of settings ?? []) {
+    const m = /^\s*project\s*\(\s*(['"]):?([^'"]+)\1\s*\)\.projectDir\s*=\s*(?:file\s*\(|new\s+File\s*\(\s*(?:settingsDir|rootDir)\s*,)\s*(['"])([^'"]+)\3\s*\)\s*$/.exec(l);
+    if (m)
+      dirs.set(m[2], normDir(m[4]));
+  }
+  return dirs;
+}
+var normDir = (p) => slash(p).replace(/^\.\//, "").replace(/\/(pom\.xml|build\.gradle(\.kts)?)$/i, "").replace(/\/+$/, "");
+var dirOf = (file) => {
+  const f = slash(file);
+  return f.includes("/") ? f.slice(0, f.lastIndexOf("/")) : "";
+};
+var joinDir = (base2, rel) => {
+  const parts = base2 ? base2.split("/") : [];
+  for (const s of normDir(rel).split("/")) {
+    if (!s || s === ".")
+      continue;
+    if (s === "..")
+      parts.pop();
+    else
+      parts.push(s);
+  }
+  return parts.join("/");
+};
+var settingsOf = (linesOf2) => {
+  for (const f of ["settings.gradle", "settings.gradle.kts"]) {
+    const l = linesOf2(f);
+    if (l)
+      return { file: f, lines: l };
+  }
+  return void 0;
+};
+function buildLineOf(f) {
+  if (!isVersionCatalogFile(f.cite.file))
+    return f.cite;
+  return (f.cite.with ?? []).find((p) => isGradleBuildFile(p.file));
+}
+var ENVS = /* @__PURE__ */ new WeakMap();
+function gradleEnvOf(linesOf2) {
+  const held = ENVS.get(linesOf2);
+  if (held)
+    return held;
+  const settings = settingsOf(linesOf2);
+  const env = {
+    ...settings ? { settings } : {},
+    dirs: projectDirs(settings?.lines),
+    projects: settings ? gradleProjects(settings.lines) : []
+  };
+  ENVS.set(linesOf2, env);
+  return env;
+}
+var projectDirOf = (env, project) => env.dirs.get(project) ?? project.replace(/:/g, "/");
+function gradleProjectOf(f, at, linesOf2) {
+  const lines = linesOf2(at.file);
+  if (!lines)
+    return void 0;
+  if (isGradleSettingsFile(at.file)) {
+    const ps = gradleProjects(lines).filter((p) => p.line === at.line);
+    return ps.find((p) => p.name === f.name)?.path ?? (ps.length === 1 ? ps[0].path : void 0);
+  }
+  if (f.kind === "dependency" && isGradleBuildFile(at.file)) {
+    const d = projectDependenciesAt(gradleBlocks(lines), at.line);
+    return "project" in d ? d.project : void 0;
+  }
+  return void 0;
+}
+function isBuildModuleDir(dir, linesOf2) {
+  const want = normDir(dir);
+  const pom = linesOf2("pom.xml");
+  if (pom && pomCoordinates(pom).modules.some((m) => normDir(m.value) === want))
+    return true;
+  for (const f of ["settings.gradle", "settings.gradle.kts"]) {
+    const lines = linesOf2(f);
+    if (!lines)
+      continue;
+    for (const p of gradleProjects(lines))
+      if (normDir(p.path.replace(/^:/, "").replace(/:/g, "/")) === want)
+        return true;
+  }
+  return false;
+}
+function buildModuleOf(f, linesOf2, modules = [], repoComponent) {
+  const listed2 = modules.map((m) => ({ path: normDir(m.path), component: m.component })).filter((m) => m.path).sort((a, b) => b.path.length - a.path.length);
+  const repo = () => repoComponent ? { path: "", component: repoComponent, names: [repoComponent], from: "repo" } : void 0;
+  const of = (dir) => {
+    const m = listed2.find((x) => dir === x.path || dir.startsWith(`${x.path}/`));
+    return m ? { path: m.path, component: m.component, names: [m.component], from: "manifest" } : repo();
+  };
+  const at = buildLineOf(f);
+  if (!at)
+    return repo();
+  if (!listed2.length)
+    return repo();
+  const env = gradleEnvOf(linesOf2);
+  if (f.kind === "dependency" && isGradleBuildFile(at.file) && dirOf(at.file) === "") {
+    const lines = linesOf2(at.file);
+    const stack = lines ? gradleBlocks(lines)[at.line - 1] ?? [] : [];
+    const sub = stack.includes("subprojects");
+    const all2 = stack.includes("allprojects");
+    if ((sub || all2) && !stack.some((b) => projectOf(b) !== void 0)) {
+      const dirs = env.projects.length ? env.projects.filter((p) => !p.renamed).map((p) => projectDirOf(env, p.path)) : listed2.map((m) => m.path);
+      const mods = [...all2 ? [""] : [], ...dirs].flatMap((d) => {
+        const m = of(d);
+        return m ? [m] : [];
+      });
+      const names = [...new Set(mods.map((m) => m.component))].sort();
+      if (names.length === 1)
+        return mods.find((m) => m.component === names[0]);
+      if (names.length > 1)
+        return { path: "", names, from: "manifest", every: true };
+      return repo();
+    }
+  }
+  const project = gradleProjectOf(f, at, linesOf2);
+  return of(project !== void 0 ? projectDirOf(env, project) : dirOf(at.file));
+}
+function buildModuleProblem(f, mod) {
+  if (!mod)
+    return void 0;
+  if (mod.every) {
+    const names = mod.names.join(", ");
+    if (f.component === void 0)
+      return `${f.kind} ${f.id} cites ${f.cite.file}:${f.cite.line}, a dependency every subproject's build takes (components ${names}): write one dependency fact for each, each naming its component`;
+    const c2 = factIdPart(f.component);
+    if (mod.names.some((n) => factIdPart(n) === c2))
+      return void 0;
+    return `${f.kind} ${f.id} names component "${f.component}", and ${f.cite.file}:${f.cite.line} is a dependency of every subproject (components ${names}): name one of them`;
+  }
+  if (f.component === void 0)
+    return void 0;
+  const c = factIdPart(f.component);
+  if (mod.names.some((n) => factIdPart(n) === c))
+    return void 0;
+  if (mod.from === "repo")
+    return `${f.kind} ${f.id} names component "${f.component}", and ${f.cite.file} is a build file of ${mod.component} (repos.manifest.yaml lists no module of the repo there, so it ships as ${mod.component}): a module is a component only when the manifest lists it; name ${mod.component}, or leave component out`;
+  return `${f.kind} ${f.id} names component "${f.component}", and ${f.cite.file} is the build file of module ${mod.component} (${mod.path}/, repos.manifest.yaml's modules): a dependency belongs to the module whose build file declares it; name ${mod.component}, or leave component out`;
+}
+var citedLine = (f, file, line) => f.cite.file === file && f.cite.line === line || (f.cite.with ?? []).some((p) => p.file === file && p.line === line);
+function buildCoordinatesProblem(f, linesOf2, files) {
+  const file = f.cite.file;
+  const label = `${f.kind} ${f.id}`;
+  const lines = linesOf2(file);
+  if (!lines)
+    return void 0;
+  const where = `${file}:${f.cite.line}`;
+  const named = files ? pomFilesNamed(files, linesOf2) : void 0;
+  if (isPomFileIn(file, named))
+    return pomProblem(f, label, where, {
+      file,
+      pom: pomCoordinates(lines),
+      parents: pomParents(file, linesOf2, files)
+    });
+  if (isGradleFile(file))
+    return gradleProblem(f, label, where, lines, linesOf2);
+  return `${label} cites ${file}, which is no build file Atticus reads coordinates from: cite the pom.xml, build.gradle or settings.gradle line that writes them`;
+}
+function pomValue(f, label, file, at, ctx, what) {
+  const r = resolvePomValue(at, ctx.pom, { file: ctx.file, parents: ctx.parents });
+  if ("missing" in r)
+    return {
+      problem: `${label}: ${what} at ${file}:${at.line} is \${${r.missing}}, which no <properties> entry or <parent> of ${file}${ctx.parents.length ? ` or of its parent poms (${ctx.parents.map((p) => p.file).join(", ")})` : ""} sets: Atticus can't say what it resolves to`
+    };
+  const uncited = (r.via ?? []).find((l) => !citedLine(f, l.file, l.line));
+  if (uncited !== void 0)
+    return {
+      problem: `${label}: ${what} at ${file}:${at.line} is ${at.value}, written as "${r.value}" through ${uncited.file}:${uncited.line}; cite that line in cite.with`
+    };
+  return { value: r.value };
+}
+var DEPS = /* @__PURE__ */ new WeakMap();
+function dependencyOnLine(pom, line) {
+  let byLine = DEPS.get(pom);
+  if (!byLine) {
+    byLine = /* @__PURE__ */ new Map();
+    for (const d of pom.dependencies)
+      if (d.artifact && !byLine.has(d.artifact.line))
+        byLine.set(d.artifact.line, d);
+    DEPS.set(pom, byLine);
+  }
+  return byLine.get(line);
+}
+var pomScopeOf = (declared) => declared === void 0 ? "compile" : declared.trim() === "system" ? "provided" : declared.trim();
+function pomProblem(f, label, where, ctx) {
+  const pom = ctx.pom;
+  const line = f.cite.line;
+  const file = f.cite.file;
+  if (f.kind === "artifact") {
+    if (pom.artifact?.line !== line) {
+      const dep2 = dependencyOnLine(pom, line);
+      const what = dep2 ? `a dependency's <artifactId> (${dep2.artifact.value})` : pom.parentArtifact?.line === line ? `the <parent>'s <artifactId> (${pom.parentArtifact.value})` : "not the project's own <artifactId>";
+      return `${label} says ${where} is the coordinates the build publishes, and that line is ${what}${pom.artifact ? `: the project's own is at line ${pom.artifact.line}` : ""}`;
+    }
+    const name2 = pomValue(f, label, file, pom.artifact, ctx, "the project's <artifactId>");
+    if ("problem" in name2)
+      return name2.problem;
+    if (name2.value !== f.name)
+      return `${label} names "${f.name}", and ${where} writes the project's artifactId as "${name2.value}"`;
+    const at = pom.group ?? pom.parentGroup;
+    if (!at)
+      return `${label} names group "${f.group}", and ${file} writes no groupId of the project or its <parent>`;
+    const inherited = pom.group ? "" : " (the <parent>'s, which the project inherits)";
+    const group2 = pomValue(f, label, file, at, ctx, `the group${inherited}`);
+    if ("problem" in group2)
+      return group2.problem;
+    if (group2.value !== f.group)
+      return `${label} names group "${f.group}", and ${file}:${at.line} writes "${group2.value}"${inherited}`;
+    if (!citedLine(f, file, at.line))
+      return `${label}: the group is written at ${file}:${at.line}${pom.group ? "" : " (the <parent>'s)"}; cite that line in cite.with`;
+    return void 0;
+  }
+  const dep = dependencyOnLine(pom, line);
+  if (!dep) {
+    const what = pom.artifact?.line === line ? "the project's own <artifactId>" : pom.parentArtifact?.line === line ? "the <parent>'s <artifactId>" : "no dependency's <artifactId>";
+    return `${label} says ${where} declares a dependency, and that line is ${what}: cite the <artifactId> line of the <dependency> in <dependencies>`;
+  }
+  if (dep.managed)
+    return `${label} cites ${where}, a <dependencyManagement> entry, which only pins a version: cite the dependency where <dependencies> declares it`;
+  if (dep.plugin)
+    return `${label} cites ${where}, a dependency of a build plugin, not of the component: leave it out`;
+  const name = pomValue(f, label, file, dep.artifact, ctx, "the dependency's <artifactId>");
+  if ("problem" in name)
+    return name.problem;
+  if (name.value !== f.name)
+    return `${label} names "${f.name}", and ${where} declares "${name.value}"`;
+  if (!dep.group)
+    return `${label}: the <dependency> at ${where} writes no <groupId>`;
+  const group = pomValue(f, label, file, dep.group, ctx, "the dependency's <groupId>");
+  if ("problem" in group)
+    return group.problem;
+  if (group.value !== f.group)
+    return `${label} names group "${f.group}", and the <dependency> at ${where} writes "${dep.group.value}"${group.value !== dep.group.value ? ` (${group.value})` : ""}`;
+  if (!citedLine(f, file, dep.group.line))
+    return `${label}: the dependency's group is written at ${file}:${dep.group.line}; cite that line in cite.with`;
+  const declared = pomScopeOf(dep.scope?.value);
+  if (declared !== (f.scope ?? "compile"))
+    return `${label} says scope ${f.scope ?? "compile"}, and the <dependency> at ${where} declares ${dep.scope?.value.trim() === "system" ? "system, which is recorded as provided" : declared}${dep.scope ? ` (${file}:${dep.scope.line})` : ""}`;
+  return void 0;
+}
+function gradleProblem(f, label, where, lines, linesOf2) {
+  const text = lines[f.cite.line - 1] ?? "";
+  const file = f.cite.file;
+  if (f.kind === "dependency" && isVersionCatalogFile(file))
+    return catalogProblem(f, label, where, lines, linesOf2);
+  if (f.kind === "dependency") {
+    const at = isGradleBuildFile(file) ? gradleDependencyAt(lines, f.cite.line) : void 0;
+    const tool = gradleToolConfigurationOn(text);
+    if (!at && tool)
+      return `${label} cites ${where}, the ${tool} tool's own configuration: what it names runs the tool, and is no dependency of the component`;
+    if (!at)
+      return `${label} says ${where} declares a dependency, and that line declares none: cite the line in dependencies { } that names it`;
+    if ("none" in at)
+      return `${label} cites ${where}, which is in ${at.none}, not a project's dependencies { }: a version pinned, a constraint or the build's own class path is no dependency of the component`;
+    const d = at.dependency;
+    if (d.group !== f.group || d.name !== f.name)
+      return `${label} names "${f.group}:${f.name}", and ${where} declares "${d.group}:${d.name}"`;
+    if (d.scope !== (f.scope ?? "compile"))
+      return `${label} says scope ${f.scope ?? "compile"}, and ${where} declares it with ${d.configuration} (${d.scope})`;
+    return void 0;
+  }
+  let project;
+  if (isGradleSettingsFile(file)) {
+    const root = gradleNameOn(text);
+    if (root !== void 0) {
+      if (root !== f.name)
+        return `${label} names "${f.name}", and ${where} sets "${root}"`;
+    } else {
+      const all2 = gradleProjects(lines);
+      const ps = all2.filter((x) => x.line === f.cite.line);
+      if (!ps.length)
+        return `${label} says ${where} is the coordinates the build publishes, and that line sets no project name: cite rootProject.name, an include, or a project(':x').name line`;
+      const p = ps.find((x) => x.name === f.name);
+      if (!p)
+        return `${label} names "${f.name}", and ${where} names ${ps.map((x) => `"${x.name}"`).join(", ")}`;
+      const renamed = all2.find((x) => x.renamed && x.path === p.path);
+      if (!p.renamed && renamed)
+        return `${label} names "${f.name}", and ${file}:${renamed.line} names that project "${renamed.name}": cite that line`;
+      project = p.path;
+    }
+  } else {
+    const name = gradleNameOn(text);
+    if (name === void 0)
+      return `${label} says ${where} is the coordinates the build publishes, and that line sets no project name: cite rootProject.name in settings.gradle, or archivesBaseName`;
+    if (name !== f.name)
+      return `${label} names "${f.name}", and ${where} sets "${name}"`;
+    const dir = dirOf(file);
+    if (dir) {
+      const dirs2 = projectDirs(settingsOf(linesOf2)?.lines);
+      project = [...dirs2].find(([, d]) => d === dir)?.[0] ?? dir.replace(/\//g, ":");
+    }
+  }
+  const dirs = projectDirs(settingsOf(linesOf2)?.lines);
+  const ownDir = project === void 0 ? "" : dirs.get(project) ?? project.replace(/:/g, "/");
+  const parts = [{ file, line: f.cite.line }, ...f.cite.with ?? []];
+  const groups = parts.flatMap((p) => {
+    const ls = linesOf2(p.file);
+    const g2 = gradleGroupOn(ls?.[p.line - 1] ?? "");
+    if (g2 === void 0 || !ls || !isGradleBuildFile(p.file))
+      return [];
+    const stack = gradleBlocks(ls)[p.line - 1] ?? [];
+    const pDir = dirOf(p.file);
+    const applies = pDir === ownDir && pDir !== "" ? stack.length === 0 : pDir === "" && (stack.length === 0 ? project === void 0 : stack.length === 1 && (stack[0] === "allprojects" || project !== void 0 && (stack[0] === "subprojects" || projectOf(stack[0]) === project)));
+    return [{ ...p, group: g2, applies }];
+  });
+  const g = groups.find((x) => x.applies);
+  if (!g) {
+    const other = groups[0];
+    if (other)
+      return `${label}: ${other.file}:${other.line} sets the group of another project than ${f.name}; cite the line that sets ${f.name}'s (group = '${f.group}') in cite.with`;
+    return `${label}: no line it cites sets the group; cite the build.gradle line that does (group = '${f.group}') in cite.with`;
+  }
+  if (g.group !== f.group)
+    return `${label} names group "${f.group}", and ${g.file}:${g.line} sets "${g.group}"`;
+  return void 0;
+}
+function catalogProblem(f, label, where, lines, linesOf2) {
+  const lib = catalogLibraryAt(lines, f.cite.line);
+  if (!lib)
+    return `${label} cites ${where}, which is no [libraries] entry of the version catalog: cite the entry that gives its coordinates`;
+  if (lib.group !== f.group || lib.name !== f.name)
+    return `${label} names "${f.group}:${f.name}", and ${where} gives ${lib.alias} as "${lib.group}:${lib.name}"`;
+  if (f.version !== void 0) {
+    const v = lib.version ?? (lib.versionRef ? catalogVersions(lines).get(lib.versionRef)?.value : void 0);
+    if (v !== f.version)
+      return `${label} says version ${f.version}, and ${where} gives ${v === void 0 ? "no version Atticus can read" : `"${v}"`}${lib.versionRef ? ` (version.ref = "${lib.versionRef}")` : ""}`;
+  }
+  const catalog = catalogNameOf(f.cite.file);
+  const use = `${catalog}.${lib.accessor}`;
+  let problem;
+  for (const p of f.cite.with ?? []) {
+    if (!isGradleBuildFile(p.file))
+      continue;
+    const ls = linesOf2(p.file);
+    const u = ls ? gradleCatalogUseOn(ls[p.line - 1] ?? "") : void 0;
+    if (!ls || !u || u.catalog !== catalog || u.accessor !== lib.accessor)
+      continue;
+    const at = projectDependenciesAt(gradleBlocks(ls), p.line);
+    if ("none" in at) {
+      problem ??= `${label}: ${p.file}:${p.line} is in ${at.none}, not a project's dependencies { }: a version pinned, a constraint or the build's own class path is no dependency of the component`;
+      continue;
+    }
+    if (u.scope !== (f.scope ?? "compile")) {
+      problem ??= `${label} says scope ${f.scope ?? "compile"}, and ${p.file}:${p.line} declares it with ${u.configuration} (${u.scope})`;
+      continue;
+    }
+    return void 0;
+  }
+  return problem ?? `${label}: ${where} is the catalog's entry, which only names the library; cite the build line in dependencies { } that declares it (${use}) in cite.with`;
+}
+function buildUnrecorded(files, linesOf2, kept, all2) {
+  const named = all2 ? pomFilesNamed(all2, linesOf2) : void 0;
+  const cited = new Set(kept.filter((f) => f.kind === "artifact" || f.kind === "dependency").map((f) => `${f.cite.file}:${f.cite.line}`));
+  const out = [];
+  const add = (file, line, kind, c) => {
+    if (!cited.has(`${file}:${line}`))
+      out.push({ cite: `${file}:${line}`, kind, coordinates: c });
+  };
+  for (const file of [...files].sort()) {
+    const lines = linesOf2(file);
+    if (!lines)
+      continue;
+    if (isPomFileIn(file, named)) {
+      const pom = pomCoordinates(lines);
+      const parents = pomParents(file, linesOf2, all2);
+      const said = (at) => {
+        if (!at)
+          return "?";
+        const r = resolvePomValue(at, pom, { file, parents });
+        return "value" in r ? r.value : at.value;
+      };
+      if (pom.artifact)
+        add(file, pom.artifact.line, "artifact", `${said(pom.group ?? pom.parentGroup)}:${said(pom.artifact)}`);
+      for (const d of pom.dependencies)
+        if (!d.managed && !d.plugin && d.artifact)
+          add(file, d.artifact.line, "dependency", `${said(d.group)}:${said(d.artifact)}`);
+    } else if (isGradleBuildFile(file)) {
+      const blocks = gradleBlocks(lines);
+      lines.forEach((_, i) => {
+        const at = gradleDependencyAt(lines, i + 1, blocks);
+        if (at && "dependency" in at && at.dependency.scope !== "import")
+          add(file, i + 1, "dependency", `${at.dependency.group}:${at.dependency.name}`);
+      });
+    }
+  }
+  return out;
+}
+
 // packages/verify/dist/frameworks.js
 var FRAMEWORKS = [
   "spring",
@@ -424,6 +1477,7 @@ function rulesOf(c) {
     notProduct: underFolders(c.notProductFolders),
     notRead: notReadTest(c.notReadFolders),
     gatewayBundle: gatewayBundleTest(c.gatewayBundleFolders),
+    gatewayBundleFolders: c.gatewayBundleFolders,
     frameworks: c.frameworks
   };
 }
@@ -581,7 +1635,8 @@ function correctionFor(f, all2) {
   const byCite = corrections.filter((c) => at(c) && c.target.value === f.cite.value);
   const edited = corrections.filter((c) => c.fact === f.id && c.action === "edit");
   const moved = edited.filter((c) => (c.line ?? c.target.line) === f.cite.line);
-  return [...byId, ...byCite, ...moved].sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : 0)[0];
+  const pos = new Map(all2.map((c, i) => [c, i]));
+  return [.../* @__PURE__ */ new Set([...byId, ...byCite, ...moved])].sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : pos.get(b) - pos.get(a))[0];
 }
 function outsidePairingFor(f, all2) {
   const newest = linksFor(f, all2)[0];
@@ -1530,201 +2585,110 @@ function pageRouteMatches(file, lines, exists, path) {
   const route = pageRouteOf(file, lines, exists);
   if (route === void 0)
     return false;
-  const norm = (p) => normalizePath(p.replace(/\{([^}:?]*)[^}]*\}/g, "{$1}")).toLowerCase() || "/";
-  return norm(route) === norm(path);
+  const norm2 = (p) => normalizePath(p.replace(/\{([^}:?]*)[^}]*\}/g, "{$1}")).toLowerCase() || "/";
+  return norm2(route) === norm2(path);
 }
 
-// packages/verify/dist/reachable.js
-var CODE = /\.(java|kt|kts|scala|groovy|cs|vb|fs|py|rb|go|rs|php|swift|ts|tsx|js|mjs|cjs|dart)$/i;
-var MODEL_DIR = /(^|\/)(models?|dtos?|payloads?|schemas?|pojos?|beans|viewmodels?)\//i;
-var MODEL_NAME = /(dto|request|response|payload|model|body)$/i;
-var MODEL_PART = /[._-](dto|model|schema|payload|request|response)\.[^/.]+$/i;
-var MAPS_TABLE = /@Entity\b|@Table\b|@Document\b|\[Table\(|__tablename__|models\.Model\b|@Entity\(|\bgorm\.Model\b/;
-var ROOT_PART = /[._-](controller|resolver|gateway|handlers?|router|routes?|consumer|listener|subscriber|client|publisher|producer|endpoints?)\.[^/.]+$/i;
-var CLIENT_NAME = /(client|gateway|publisher|producer|sender|feign|proxy|connector)$/i;
-var CLIENT_DIR = /(^|\/)(clients?|gateways?|integrations?|publishers?|producers?|outbound)\//i;
-var base = (path) => path.slice(path.lastIndexOf("/") + 1);
-var stem = (path) => {
-  const b = base(path);
-  const dot = b.indexOf(".");
-  return dot > 0 ? b.slice(0, dot) : b;
-};
-function isModelFile(path, text) {
-  if (!CODE.test(path) || readingRank(path) === 5)
-    return false;
-  if (!MODEL_DIR.test(path) && !MODEL_NAME.test(stem(path)) && !MODEL_PART.test(path))
-    return false;
-  return text === void 0 || !MAPS_TABLE.test(text);
-}
-var ENTRY_POINT_NAME = /(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|servlet|webhook|resolver)$/i;
-var ENTRY_POINT_DIR = /(^|\/)(controllers?|routes|routers|handlers|endpoints|listeners|consumers)\//i;
-var ENTRY_POINT_PART = /[._-](controller|resolver|handlers?|router|routes?|consumer|listener|subscriber|endpoints?)\.[^/.]+$/i;
-function isEntryPointFile(path) {
-  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
-    return false;
-  return ENTRY_POINT_NAME.test(stem(path)) || ENTRY_POINT_DIR.test(path) || ENTRY_POINT_PART.test(path);
+// packages/verify/dist/secrets.js
+var CONFIG_FILE = /\.(ya?ml|properties|json|xml|config|env|ini|toml|conf|cfg)$|(^|\/)\.env(\.[^/]*)?$|(^|\/)credentials?$/i;
+var isConfigFile = (path) => CONFIG_FILE.test(path.replace(/\\/g, "/"));
+var PLACEHOLDER = /^(<[^>]*>|\*+|x{3,}|changeme|change-me|secret|password|todo|tbd|none|null|nil|dummy|example|sample|test|redacted|your[-_ ].*)$/i;
+var KEY_VALUE = /^\s*(?:-\s+)?(?:export\s+)?["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*(.*?)\s*,?\s*$/;
+var XML_ELEMENT = /<([A-Za-z_][\w.-]*)>([^<]+)<\/\1>/g;
+var XML_NAMED = /\b(?:key|name)\s*=\s*"([^"]+)"\s+value\s*=\s*"([^"]*)"/g;
+var XML_NAMED_AFTER = /\bvalue\s*=\s*"([^"]*)"\s+(?:key|name)\s*=\s*"([^"]+)"/g;
+var CONNECTION_PAIR = /(?:^|[;"'])\s*([A-Za-z][A-Za-z0-9 _.-]*?)\s*=\s*([^;"'<>\s][^;"'<>]*)/g;
+var TOKEN_VALUE_KEY = /^(value|val)$/i;
+var TOKEN_NAME = /^\s*"(xpath|name|key)"\s*:\s*"([^"]+)"/;
+function isReference(value) {
+  return /^(vault|env|secret|ref|arn|kms|sm|gcp-sm|azure-kv|classpath\*?|file):/i.test(value) || /\$\{|\{\{/.test(value) || /^(~|\.{1,2})?\/[\w.\-/]+$/.test(value) || /^[\w.-]+(\/[\w.-]+)+\.[A-Za-z0-9]{1,10}$/.test(value);
+}
+var unquote = (v) => v.replace(/\s+#.*$/, "").replace(/^["']|["']$/g, "").trim();
+function tokenKeyNear(lines, i) {
+  for (const step of [-1, 1])
+    for (let j = i + step; j >= 0 && j < lines.length && Math.abs(j - i) <= 4; j += step) {
+      const l = lines[j];
+      const m = TOKEN_NAME.exec(l);
+      if (m)
+        return m[2];
+      if (/[{}]/.test(l))
+        break;
+    }
+  return void 0;
 }
-function isRootFile(path) {
-  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+function keyIsSecret(key) {
+  if (hasSecretShape(key))
+    return true;
+  for (const run of key.match(/[0-9a-f]{24,}|[0-9A-F]{24,}/g) ?? [])
+    if (/\d/.test(run) && /[a-f]/i.test(run))
+      return true;
+  const digitsAndLetters = /\d/.test(key) && /[A-Za-z]/.test(key);
+  if (key.length >= 32 && /^[A-Za-z0-9+/=]+$/.test(key) && digitsAndLetters)
+    return true;
+  if (key.length >= 32 && /^[A-Za-z0-9_-]+$/.test(key) && /\d/.test(key) && /[a-z]/.test(key) && /[A-Z]/.test(key))
+    return true;
+  if (key.length < 16 || !/^[A-Za-z0-9+/=]+$/.test(key) || !/\d/.test(key))
     return false;
-  return readingRank(path) === 2 || isEntryPointFile(path) || ROOT_PART.test(path) || CLIENT_NAME.test(stem(path)) || CLIENT_DIR.test(path);
-}
-var DECLARES = /\b(?:class|record|interface|struct|enum|object)\s+([A-Za-z_][A-Za-z0-9_]*)|^\s*(?:export\s+)?(?:declare\s+)?type\s+([A-Za-z_][A-Za-z0-9_]*)/gm;
-var IDENT = /[A-Za-z_][A-Za-z0-9_]*/g;
-function declaredTypes(path, text) {
-  const out = [];
-  const s = stem(path);
-  if (/^[A-Z][A-Za-z0-9_]*$/.test(s))
-    out.push(s);
-  for (const m of text.matchAll(DECLARES)) {
-    const n = m[1] ?? m[2];
-    if (n && !out.includes(n))
-      out.push(n);
-  }
-  return out;
-}
-function identifiers(text) {
-  return [...new Set(text.match(IDENT) ?? [])];
-}
-var NOT_REACHED_WHY = "model classes no entry point, call or field fact reaches (ADR 0169): left out of the read; atticus map <repo> --models all reads them";
-function reachableModels(o) {
-  const texts = /* @__PURE__ */ new Map();
-  const textOf = (p) => {
-    if (!texts.has(p))
-      texts.set(p, o.read(p) ?? "");
-    return texts.get(p);
-  };
-  const ordered = readingOrder(o.paths);
-  const models = ordered.filter((p) => isModelFile(p, textOf(p))).sort();
-  const isModel = new Set(models);
-  const byName = /* @__PURE__ */ new Map();
-  const declared = /* @__PURE__ */ new Map();
-  for (const p of models) {
-    const names = declaredTypes(p, textOf(p));
-    declared.set(p, names);
-    for (const n of names)
-      byName.set(n, [...byName.get(n) ?? [], p]);
-  }
-  const known = new Set(o.paths);
-  const roots = [];
-  const addRoot = (p) => {
-    if (known.has(p) && !isModel.has(p) && !roots.includes(p))
-      roots.push(p);
-  };
-  const facts = o.facts ?? [];
-  const entries = o.from === "entries";
-  const calls2 = new Set(facts.filter((f) => f.kind === "call").map((f) => f.id));
-  for (const f of facts)
-    if (f.kind === "entry" || f.kind === "call" && !entries)
-      for (const p of citedFiles(f))
-        addRoot(p);
-  for (const p of ordered)
-    if (entries ? isEntryPointFile(p) : isRootFile(p))
-      addRoot(p);
-  const reached = /* @__PURE__ */ new Map();
-  const queue = [];
-  const reach = (names, from, own = []) => {
-    for (const n of names) {
-      if (own.includes(n))
-        continue;
-      for (const p of byName.get(n) ?? []) {
-        const r = reached.get(p);
-        if (r) {
-          if (r.from === from && !r.types.includes(n))
-            r.types.push(n);
-          continue;
-        }
-        reached.set(p, { path: p, types: [n], from });
-        queue.push(p);
-      }
-    }
-  };
-  for (const p of roots)
-    reach(identifiers(textOf(p)), p);
-  for (const f of facts) {
-    for (const p of citedFiles(f))
-      if (isModel.has(p) && !reached.has(p)) {
-        reached.set(p, { path: p, types: [...(declared.get(p) ?? []).slice(0, 1)], from: f.id });
-        queue.push(p);
-      }
-    if (f.kind === "field" && !(entries && calls2.has(f.owner)))
-      reach(identifiers([f.type ?? "", f.transform === "message type" ? f.name : ""].join(" ")), f.id);
-  }
-  const rooted = roots.length > 0 || reached.size > 0;
-  if (!rooted)
-    return {
-      rooted,
-      roots,
-      reached: models.map((p) => ({ path: p, types: declared.get(p) ?? [], from: "" })),
-      notReached: [],
-      models: models.length
-    };
-  for (let i = 0; i < queue.length; i++) {
-    const p = queue[i];
-    reach(identifiers(textOf(p)), p, declared.get(p));
+  const kind = (c) => /\d/.test(c) ? 0 : /[a-z]/.test(c) ? 1 : 2;
+  let switches = 0;
+  for (let i = 1; i < key.length; i++)
+    if (kind(key[i]) !== kind(key[i - 1]))
+      switches++;
+  return switches >= key.length / 2;
+}
+function itemNameAbove(lines, i) {
+  const col = /^\s*/.exec(lines[i])[0].length;
+  for (let j = i - 1; j >= 0 && i - j <= 6; j--) {
+    const l = lines[j];
+    if (!l.trim())
+      continue;
+    const lead = /^\s*/.exec(l)[0].length;
+    const item = /^(\s*)-\s+(.*)$/.exec(l);
+    const keyCol = item ? item[1].length + (l.length - item[1].length - item[2].length) : lead;
+    if (keyCol !== col)
+      return void 0;
+    const m = /^(?:\s*-\s+|\s*)(name|key)\s*:\s*["']?([^"'\s#]+)["']?\s*$/.exec(l);
+    if (m)
+      return m[2];
+    if (item)
+      return void 0;
   }
-  return {
-    rooted,
-    roots,
-    reached: queue.map((p) => reached.get(p)),
-    notReached: models.filter((p) => !reached.has(p)),
-    models: models.length
-  };
-}
-
-// packages/verify/dist/method.js
-var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-function wordsOf(line) {
-  return line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
-}
-function methodOnLines(method, lines) {
-  const m = method.toLowerCase();
-  return lines.some((l) => wordsOf(l).includes(m));
+  return void 0;
 }
-var CHAIN_LINES = 8;
-var CONTINUES = /^\s*\??\./;
-function chainOf(file, line) {
-  const at = (n) => file?.[n - 1];
-  const cited = at(line);
-  if (cited === void 0)
+function liveSecretsIn(file, lines) {
+  const shownKey = (key) => keyIsSecret(key) ? "" : key;
+  if (!isConfigFile(file))
     return [];
-  const out = [cited];
-  for (let n = line, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n--) {
-    const above = at(n - 1);
-    if (above === void 0)
-      break;
-    out.push(above);
-  }
-  for (let n = line + 1, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n++)
-    out.push(at(n));
+  const out = [];
+  lines.forEach((text, i) => {
+    if (/^\s*(#|\/\/|;|<!--)/.test(text))
+      return;
+    const pairs = [];
+    const kv = KEY_VALUE.exec(text);
+    if (kv) {
+      const key = TOKEN_VALUE_KEY.test(kv[1]) ? tokenKeyNear(lines, i) ?? (/\.ya?ml$/i.test(file) ? itemNameAbove(lines, i) : void 0) ?? kv[1] : kv[1];
+      pairs.push({ key, value: unquote(kv[2]) });
+    }
+    for (const m of text.matchAll(XML_ELEMENT))
+      pairs.push({ key: m[1], value: m[2].trim() });
+    for (const m of text.matchAll(XML_NAMED))
+      pairs.push({ key: m[1], value: m[2].trim() });
+    for (const m of text.matchAll(XML_NAMED_AFTER))
+      pairs.push({ key: m[2], value: m[1].trim() });
+    if (text.includes(";"))
+      for (const m of text.matchAll(CONNECTION_PAIR))
+        pairs.push({ key: m[1].trim(), value: m[2].trim() });
+    const named = pairs.find(({ key, value }) => value && !PLACEHOLDER.test(value) && // a key with a nested map under it, or an encrypted value (`{cipher}…`), sets nothing here
+    !/^[{[]/.test(value) && !isReference(value) && looksLikeSecret(key, value));
+    if (named) {
+      out.push({ file, line: i + 1, key: shownKey(named.key) });
+      return;
+    }
+    if (hasSecretShape(text))
+      out.push({ file, line: i + 1, key: pairs[0] ? shownKey(pairs[0].key) : "(token)" });
+  });
   return out;
 }
-function methodUnseenOf(f, lines, factOf) {
-  if (f.kind !== "entry" && f.kind !== "call")
-    return void 0;
-  if (!f.method || !HTTP_METHODS.has(f.method.toUpperCase()))
-    return void 0;
-  const at = (file, line) => lines(file)?.[line - 1];
-  const route = f.kind === "call" && f.from ? factOf?.(f.from) : void 0;
-  const forwards = route?.kind === "entry" && route.method?.toUpperCase() === f.method.toUpperCase();
-  const looked = [
-    ...chainOf(lines(f.cite.file), f.cite.line),
-    at(f.cite.file, f.cite.line + 1),
-    ...(f.cite.with ?? []).map((p) => at(p.file, p.line)),
-    ...forwards ? [at(route.cite.file, route.cite.line), at(route.cite.file, route.cite.line + 1)] : []
-  ].filter((l) => l !== void 0);
-  if (methodOnLines(f.method, looked))
-    return void 0;
-  const cite2 = `${f.cite.file}:${f.cite.line}`;
-  const method = f.method.toUpperCase();
-  return {
-    id: f.id,
-    kind: f.kind,
-    method,
-    cite: cite2,
-    message: `${f.id} claims ${method}, which neither ${cite2}, the chain it is in, the next line, a cite.with line nor the route it forwards writes`
-  };
-}
 
 // packages/verify/dist/skipped.js
 function notReadForSkipped(path, rules = DEFAULT_READ_RULES) {
@@ -1745,9 +2709,9 @@ var NOT_TOPIC_FIRST = new Set("com org net io java javax jakarta android android
 var DOTTED_TOPIC = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*){2,}$/;
 var SEPARATED_NAME = /^[A-Za-z][A-Za-z0-9_]*([._:-][A-Za-z0-9_]+)+$/;
 var QUOTED = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
-var KEY_VALUE = /^\s*-?\s*["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*([^\s"'#]+)\s*$/;
+var KEY_VALUE2 = /^\s*-?\s*["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*([^\s"'#]+)\s*$/;
 var ELEMENT_TEXT = /<([A-Za-z][\w:.-]*)[^>]*>([^<\s]+)<\/\1>/g;
-var wordsOf2 = (line) => line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
+var wordsOf = (line) => line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
 var TOPIC_WORDS = /* @__PURE__ */ new Set([
   "topic",
   "topics",
@@ -1761,7 +2725,7 @@ var TOPIC_WORDS = /* @__PURE__ */ new Set([
   "exchanges"
 ]);
 var topicContext = (line) => {
-  const w = wordsOf2(line);
+  const w = wordsOf(line);
   return w.some((x) => TOPIC_WORDS.has(x)) || w.join(" ").includes("routing key");
 };
 var BUILD_KEY_WORDS = new Set("scm git gitlab github bitbucket repository repositories repo registry mirror mirrors nexus artifactory snapshot snapshots distribution maven npm nuget pypi sonar sonarqube jenkins ci".split(" "));
@@ -1772,7 +2736,7 @@ var keysBefore = (prefix) => [
   ...[...prefix.matchAll(/["']?([A-Za-z][\w.-]*)["']?\s*[:=]/g)].map((m) => m[1]),
   ...[...prefix.matchAll(/\b([A-Za-z]\w*)\s*\{/g)].map((m) => m[1])
 ];
-var isBuildUrl = (u, prefix) => /\.git\/?$/i.test(u) || /\bscm:\w+:$/i.test(prefix) || keysBefore(prefix).some((k) => wordsOf2(k).some((w) => BUILD_KEY_WORDS.has(w)));
+var isBuildUrl = (u, prefix) => /\.git\/?$/i.test(u) || /\bscm:\w+:$/i.test(prefix) || keysBefore(prefix).some((k) => wordsOf(k).some((w) => BUILD_KEY_WORDS.has(w)));
 var HEADER_ARG = /header\w*\s*(?:\.\s*\w+\s*)?\(\s*(?:(?:value|name)\s*=\s*)?$/i;
 var isHeaderName = (s, prefix) => /^x-/i.test(s) || HEADER_ARG.test(prefix.replace(/["'`]$/, ""));
 var cleanUrl = (u) => u.replace(/[.:]+$/, "").replace(/^([a-z0-9+.-]+:\/\/)[^/@\s]+@/i, "$1<redacted>@");
@@ -1867,7 +2831,7 @@ function candidatesIn(path, lines) {
       s: m[2],
       before: code2.slice(0, m.index + 1)
     }));
-    const kv = KEY_VALUE.exec(code2);
+    const kv = KEY_VALUE2.exec(code2);
     if (kv)
       strings2.push({ s: kv[2], before: "" });
     for (const m of code2.matchAll(ELEMENT_TEXT))
@@ -1907,102 +2871,747 @@ function indexFacts(facts) {
       Object.values(o).forEach(walk);
     }
   };
-  facts.forEach(walk);
-  const paths = /* @__PURE__ */ new Set();
-  for (const s of strings2) {
-    if (/\s/.test(s))
-      continue;
-    const u = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s);
-    const p = u ? u[1] : s.includes("/") ? s : void 0;
-    if (p && p.length > 1)
-      paths.add(`${normPath(p)}/`);
+  facts.forEach(walk);
+  const paths = /* @__PURE__ */ new Set();
+  for (const s of strings2) {
+    if (/\s/.test(s))
+      continue;
+    const u = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s);
+    const p = u ? u[1] : s.includes("/") ? s : void 0;
+    if (p && p.length > 1)
+      paths.add(`${normPath(p)}/`);
+  }
+  return { at, strings: [...strings2].map((s) => s.toLowerCase()), paths: [...paths] };
+}
+function factsCover(file, c, ix) {
+  if ([c.line - 1, c.line, c.line + 1].some((n) => ix.at.has(`${file}:${n}`)))
+    return true;
+  if (c.kind === "path") {
+    const p = `${normPath(c.value)}/`;
+    return ix.paths.some((f) => f.includes(p));
+  }
+  const v = c.value.toLowerCase().replace(/\/+$/, "");
+  return ix.strings.some((s) => s.includes(v));
+}
+var skippedOf = (file, c) => ({
+  cite: `${file}:${c.line}`,
+  kind: c.kind,
+  value: c.value,
+  text: c.text
+});
+var SPEC_MARK = /^\s*["']?(openapi|swagger)["']?\s*:/m;
+var SPEC_EXT = /\.(ya?ml|json)$/i;
+function specOpsUncoveredIn(file, text, facts) {
+  if (!SPEC_EXT.test(file) || !SPEC_MARK.test(text.slice(0, 4e3)))
+    return void 0;
+  let doc;
+  try {
+    doc = readOpenApiDocument(text);
+  } catch {
+    return void 0;
+  }
+  if (!doc || !doc.operations.length)
+    return void 0;
+  const server = (() => {
+    const s = doc.servers[0];
+    if (!s)
+      return "";
+    const p = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s)?.[1] ?? (s.startsWith("/") ? s : "");
+    return p.replace(/\/+$/, "");
+  })();
+  const entries = facts.filter((f) => f.kind === "entry");
+  const atLines = /* @__PURE__ */ new Set();
+  for (const e of entries)
+    for (const k of indexFacts([e]).at)
+      atLines.add(k);
+  const out = [];
+  for (const op of doc.operations) {
+    const lines = [op.methodLine, op.line].filter((n) => n !== void 0);
+    if (lines.some((n) => [n - 1, n, n + 1].some((x) => atLines.has(`${file}:${x}`))))
+      continue;
+    const method = op.method.toUpperCase();
+    const own = normPath(op.path);
+    const full = normPath(`${server}${op.path}`);
+    const covered = entries.some((e) => {
+      if (e.method && e.method.toUpperCase() !== method)
+        return false;
+      const p = normPath(e.path);
+      return p === own || p === full || p.endsWith(own) || p.split("/").length > 2 && own.endsWith(p);
+    });
+    if (covered)
+      continue;
+    const opId = op.node?.get?.("operationId");
+    const line = op.methodLine ?? op.line ?? 1;
+    out.push({
+      spec: file,
+      method,
+      path: op.path,
+      ...typeof opId === "string" ? { operationId: opId } : {},
+      cite: `${file}:${line}`,
+      message: `${file}:${line} declares ${method} ${op.path}${typeof opId === "string" ? ` (${opId})` : ""}, which no entry covers`
+    });
+  }
+  return out;
+}
+var REVIEWED_HOLDS_SHOWN = 5;
+function reviewedHoldsOf(r, skipped) {
+  const n = skipped.length;
+  const first = skipped.slice(0, 3).map((s) => `${s.cite} (${s.value})`);
+  return {
+    path: r.path,
+    why: r.why,
+    count: n,
+    skipped: skipped.slice(0, REVIEWED_HOLDS_SHOWN),
+    message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} is reviewed as holding nothing to record, but ${n} ${n === 1 ? "line in it writes" : "lines in it write"} a path, URL or topic: ${first.join(", ")}${n > 3 ? ` and ${n - 3} more` : ""}`
+  };
+}
+
+// packages/verify/dist/settings-path.js
+var SETTINGS_FILE = /\.(ya?ml|properties|json|xml|config|conf|ini|toml|cfg|env)$|(^|\/)\.env(\.[^/]*)?$/i;
+var isSettingsFile = (path) => SETTINGS_FILE.test(path);
+var isYaml = (path) => /\.ya?ml$/i.test(path);
+var DOC_FILE = /\.(md|markdown|mdx|adoc|asciidoc|txt|text|rst|html?|textile|org|rtf|wiki)$/i;
+var isProperties = (path) => /\.properties$/i.test(path);
+var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var YAML_KEY = /^(["']?)([^\s"'#:{}[\],&*!|>][^"'#:]*?)\1\s*:(?:\s+(.*))?$/;
+function yamlLine(text) {
+  if (!text.trim() || /^\s*#/.test(text) || /^\s*(---|\.\.\.)\s*$/.test(text))
+    return void 0;
+  const lead = /^ */.exec(text)[0].length;
+  const dash = /^ *-(\s+|$)/.exec(text);
+  const col = dash ? dash[0].length : lead;
+  const body = text.slice(col);
+  const m = YAML_KEY.exec(body.trimEnd());
+  const rest = m?.[3]?.trim();
+  return {
+    lead,
+    col,
+    item: !!dash,
+    key: m?.[2]?.trim(),
+    // a comment or an anchor after the key sets nothing
+    rest: rest && !/^[#&]/.test(rest) ? rest : void 0
+  };
+}
+function yamlPathAt(lines, line) {
+  const at = yamlLine(lines[line - 1] ?? "");
+  if (!at?.key)
+    return void 0;
+  const path = [at.key];
+  let col = at.item ? at.lead : at.col;
+  let seq = at.item;
+  for (let j = line - 2; j >= 0 && (col > 0 || seq); j--) {
+    const l = lines[j];
+    if (/^\s*(---|\.\.\.)\s*$/.test(l))
+      break;
+    const y = yamlLine(l);
+    if (!y)
+      continue;
+    if (y.item && y.col === col) {
+      col = y.lead;
+      seq = true;
+      continue;
+    }
+    if (seq && !y.item && y.col === col && y.key && !y.rest) {
+      path.unshift(y.key);
+      seq = false;
+      continue;
+    }
+    if (y.col >= col)
+      continue;
+    seq = false;
+    if (!y.key || y.rest)
+      return void 0;
+    path.unshift(y.key);
+    col = y.lead;
+  }
+  if (col > 0)
+    return void 0;
+  return path.flatMap((k) => k.split("."));
+}
+function yamlChildren(lines, line) {
+  const at = yamlLine(lines[line - 1] ?? "");
+  if (!at?.key)
+    return [];
+  const out = [];
+  let childCol;
+  for (let j = line; j < lines.length; j++) {
+    const y = yamlLine(lines[j]);
+    if (!y)
+      continue;
+    if (y.lead <= at.col)
+      break;
+    childCol ??= y.col;
+    if (y.col < childCol)
+      break;
+    if (y.col === childCol && y.key && !y.item)
+      out.push(y.key);
+  }
+  return out;
+}
+function propertiesKeyAt(lines, line) {
+  const l = lines[line - 1] ?? "";
+  if (/^\s*[#!]/.test(l))
+    return void 0;
+  return /^\s*((?:\\.|[^\s=:\\])+)\s*[=:\s]/.exec(l)?.[1];
+}
+var sameSegs = (a, b) => a.length === b.length && a.every((s, i) => s === b[i]);
+var keySegments = (key) => key.trim().split(".").map((s) => s.replace(/\[[^\]]*\]$/, "")).filter(Boolean);
+var fieldNames = (seg) => [
+  seg,
+  seg.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase())
+];
+var CONFIG_PROPS = /@ConfigurationProperties\s*\(\s*(?:(?:prefix|value)\s*=\s*)?"([^"]+)"/;
+function helperBuildsKey(key, cite2, linesOf2) {
+  if (isSettingsFile(cite2.file) || DOC_FILE.test(cite2.file))
+    return false;
+  const segs = keySegments(key);
+  if (segs.length < 2 || segs.join(".") !== key.trim())
+    return false;
+  const last = segs[segs.length - 1];
+  const prefix = segs.slice(0, -1);
+  const line = linesOf2(cite2.file)?.[cite2.line - 1];
+  if (line === void 0)
+    return false;
+  const code2 = isCommentLine(line) ? line : line.replace(/\/\*.*?\*\//g, "").replace(/(^|\s)\/\/.*$/, "");
+  const literals = [];
+  const bare2 = code2.replace(/(["'`])((?:(?!\1)[^\\]|\\.)*)\1/g, (_all, _q, text) => {
+    literals.push(text);
+    return '""';
+  });
+  if (!literals.includes(last) && !new RegExp(`(^|[^A-Za-z0-9_$-])${escape(last)}($|[^A-Za-z0-9_$-])`).test(bare2))
+    return false;
+  const parts = cite2.with ?? [];
+  const files = [...new Set(parts.map((p) => p.file))];
+  return files.some((file) => {
+    const ls = linesOf2(file);
+    if (!ls)
+      return false;
+    const here = parts.filter((p) => p.file === file);
+    if (isYaml(file))
+      return here.some((p) => {
+        const at = yamlPathAt(ls, p.line);
+        if (!at)
+          return false;
+        if (sameSegs(at, segs))
+          return true;
+        return sameSegs(at, prefix) && yamlChildren(ls, p.line).includes(last);
+      });
+    if (isProperties(file))
+      return here.some((p) => propertiesKeyAt(ls, p.line) === segs.join("."));
+    if (isSettingsFile(file))
+      return false;
+    return here.some((p) => {
+      const m = CONFIG_PROPS.exec(ls[p.line - 1] ?? "");
+      if (!m)
+        return false;
+      const pre = m[1].split(".");
+      if (pre.length > prefix.length || !pre.every((s, i) => s === prefix[i]))
+        return false;
+      return prefix.slice(pre.length).every((seg) => here.some((q) => q.line > p.line && q.line <= p.line + 40 && fieldNames(seg).some((n) => new RegExp(`(^|[^A-Za-z0-9_$])${escape(n)}($|[^A-Za-z0-9_$])`).test(ls[q.line - 1] ?? ""))));
+    });
+  });
+}
+var norm = (s) => s.replace(/[‘’‚'"“”„`]/g, "").replace(/\s+/g, " ").trim();
+function yamlScalar(rest) {
+  const t = rest.trim().replace(/^!!?[\w/:.-]*\s+/, "");
+  const q = /^(["'])((?:(?!\1).|\1\1)*)\1/.exec(t);
+  if (q)
+    return q[1] === "'" ? q[2].replace(/''/g, "'") : q[2];
+  return t.replace(/\s+#.*$/, "").trim();
+}
+function propertiesValues(line, key, next = []) {
+  let v = line.slice(line.indexOf(key) + key.length).replace(/^\s*[=:]?\s*/, "");
+  for (let i = 0; /(^|[^\\])(\\\\)*\\$/.test(v) && i < next.length; i++)
+    v = v.slice(0, -1) + next[i].replace(/^\s+/, "");
+  return [v.trim(), decodeProperties(v)];
+}
+function decodeProperties(v) {
+  return v.replace(/\\(u[0-9a-fA-F]{4}|.)/g, (_, c) => c.length === 5 ? String.fromCharCode(parseInt(c.slice(1), 16)) : c === "t" ? "	" : c === "n" ? "\n" : c).trim();
+}
+function jsonValueOn(line) {
+  const m = /"value"\s*:\s*("(?:[^"\\]|\\.)*"|[^,}\]\s]+)/.exec(line);
+  if (!m)
+    return void 0;
+  if (!m[1].startsWith('"'))
+    return m[1];
+  try {
+    return JSON.parse(m[1]);
+  } catch {
+    return m[1].slice(1, -1);
+  }
+}
+function jsonFrames(lines) {
+  const out = [];
+  const stack = [];
+  for (let ln = 0; ln < lines.length; ln++) {
+    const l = lines[ln];
+    for (let i = 0; i < l.length; i++) {
+      const ch = l[i];
+      const top = stack[stack.length - 1];
+      if (ch === '"') {
+        let j = i + 1;
+        let text = "";
+        for (; j < l.length && l[j] !== '"'; j++) {
+          if (l[j] === "\\" && j + 1 < l.length)
+            j++;
+          text += l[j];
+        }
+        const isKey = top?.type === "{" && !top.afterColon && /^\s*:/.test(l.slice(j + 1));
+        if (top?.type === "{") {
+          if (isKey)
+            top.pending = text;
+          else if (top.afterColon && top.pending === "name" && top.name === void 0)
+            top.name = text;
+        }
+        i = j;
+        continue;
+      }
+      if (ch === ":" && top?.type === "{")
+        top.afterColon = true;
+      else if (ch === "," && top?.type === "{") {
+        top.afterColon = false;
+        top.pending = void 0;
+      } else if (ch === "{" || ch === "[") {
+        const under4 = top?.type === "{" ? top.pending : top?.under;
+        stack.push({ type: ch, start: ln + 1, end: lines.length, ...under4 ? { under: under4 } : {} });
+      } else if (ch === "}" || ch === "]") {
+        const f = stack.pop();
+        if (f) {
+          out.push({
+            type: f.type,
+            start: f.start,
+            end: ln + 1,
+            ...f.under ? { under: f.under } : {},
+            ...f.name !== void 0 ? { name: f.name } : {}
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+var noExt = (s) => s.trim().toLowerCase().replace(/\.[^.]*$/, "");
+function enclosingObject(lines, line) {
+  let depth = 0;
+  let start = -1;
+  for (let j = line - 1; j >= 0; j--) {
+    const l = lines[j];
+    for (let k = l.length - 1; k >= 0; k--) {
+      if (l[k] === "}" && j !== line - 1)
+        depth++;
+      if (l[k] === "{") {
+        if (depth === 0) {
+          start = j;
+          break;
+        }
+        depth--;
+      }
+    }
+    if (start >= 0)
+      break;
+  }
+  if (start < 0)
+    return void 0;
+  depth = 0;
+  for (let j = start; j < lines.length; j++) {
+    for (const ch of lines[j]) {
+      if (ch === "{")
+        depth++;
+      if (ch === "}" && --depth === 0)
+        return lines.slice(start, j + 1);
+    }
+  }
+  return void 0;
+}
+function configLineProblem(f, linesOf2, listed2, bundleFolders = DEFAULT_GATEWAY_BUNDLE_FOLDERS) {
+  const lines = linesOf2(f.cite.file);
+  if (!lines)
+    return void 0;
+  const at = lines[f.cite.line - 1] ?? "";
+  const where = `${f.cite.file}:${f.cite.line}`;
+  const segs = keySegments(f.key);
+  const value = f.value === void 0 ? void 0 : norm(f.value);
+  const same = (v) => value !== void 0 && v !== void 0 && norm(v) === value;
+  const has = (l) => value !== void 0 && norm(l).includes(value);
+  if (f.key.trim().startsWith("/") && /(^|\/)config\.json$/i.test(f.cite.file)) {
+    const dir = f.cite.file.replace(/[^/]*$/, "");
+    if (!listed2().some((p) => bundleFolders.some((b) => p.startsWith(`${dir}${b}/`))))
+      return `config ${where} is a config.json beside no gateway bundle (no ${bundleFolders.map((b) => `${dir}${b}/`).join(" or ")}); a token's setting is read only from the bundle's own`;
+    const obj = enclosingObject(lines, f.cite.line);
+    const xpathRe = new RegExp(`"xpath"\\s*:\\s*"${escape(f.key.trim())}"`);
+    if (!obj || !obj.some((l) => xpathRe.test(l)))
+      return `the token at ${where} has no "xpath" of ${f.key}`;
+    if (value !== void 0 && !obj.some((l) => same(jsonValueOn(l))))
+      return `the token at ${where} sets no such value; cite the token whose "value" it is`;
+    const around = jsonFrames(lines).filter((x) => x.type === "{" && x.start <= f.cite.line && x.end >= f.cite.line).sort((a, b) => b.start - a.start);
+    if (f.target !== void 0) {
+      const file = around.find((x) => /^(targets|policies|proxies)$/i.test(x.under ?? ""));
+      if (!file?.name || noExt(file.name) !== noExt(f.target))
+        return `the token at ${where} is ${file?.name ? `${file.name}'s` : "in no file's list"}, not ${f.target}'s; give the target the token's file is named`;
+    }
+    if (f.env !== void 0) {
+      const conf = around.find((x) => /^configurations$/i.test(x.under ?? ""));
+      if (!conf?.name || conf.name.trim() !== f.env.trim())
+        return `the token at ${where} is in ${conf?.name ? `the ${conf.name} configuration` : "no named configuration"}, not ${f.env}; give the env its configuration is named`;
+    }
+    return void 0;
+  }
+  if (isYaml(f.cite.file)) {
+    const y = yamlLine(at);
+    const path = yamlPathAt(lines, f.cite.line);
+    if (y?.key && path && segs.length && keySegments(y.key).at(-1) === segs.at(-1)) {
+      const tail = path.slice(path.length - segs.length);
+      if (path.length < segs.length || !sameSegs(tail, segs))
+        return `${where} sets ${path.join(".")}, not ${f.key}: the key's parents are not the lines above it`;
+      if (value !== void 0 && y.rest && !/^[|>]/.test(y.rest)) {
+        if (!same(yamlScalar(y.rest)))
+          return `${where} sets ${y.key} to something other than the value claimed`;
+        return void 0;
+      }
+    }
+  }
+  if (isProperties(f.cite.file)) {
+    const k = propertiesKeyAt(lines, f.cite.line);
+    if (k && k.split(".").at(-1) === segs.at(-1)) {
+      if (k !== segs.join(".") && !k.endsWith(`.${segs.join(".")}`))
+        return `${where} sets ${k}, not ${f.key}`;
+      if (value !== void 0) {
+        if (!propertiesValues(at, k, lines.slice(f.cite.line)).some(same))
+          return `${where} sets ${k} to something other than the value claimed`;
+        return void 0;
+      }
+    }
+  }
+  if (value === void 0 || value === "")
+    return void 0;
+  const near = [f.cite.line - 1, f.cite.line, f.cite.line + 1].map((n) => lines[n - 1] ?? "");
+  const partLines = (f.cite.with ?? []).map((p) => linesOf2(p.file)?.[p.line - 1] ?? "");
+  if ([...near, ...partLines].some(has))
+    return void 0;
+  const hp = /^([^\s:/]+):(\d{1,5})$/.exec(f.value.trim());
+  if (hp) {
+    const parts = f.cite.with ?? [];
+    const written = (want) => parts.some((p) => {
+      if (p.value.trim() !== want)
+        return false;
+      const l = linesOf2(p.file)?.[p.line - 1] ?? "";
+      return new RegExp(`(^|[^A-Za-z0-9.-])${escape(want)}($|[^A-Za-z0-9.-])`).test(l);
+    });
+    if (written(hp[1]) && written(hp[2]))
+      return void 0;
+  }
+  return `${where} (or the line either side) and its parts don't write the value claimed`;
+}
+
+// packages/verify/dist/reachable.js
+var CODE = /\.(java|kt|kts|scala|groovy|cs|vb|fs|py|rb|go|rs|php|swift|ts|tsx|js|mjs|cjs|dart)$/i;
+var MODEL_DIR = /(^|\/)(models?|dtos?|payloads?|schemas?|pojos?|beans|viewmodels?)\//i;
+var MODEL_NAME = /(dto|request|response|payload|model|body)$/i;
+var MODEL_PART = /[._-](dto|model|schema|payload|request|response)\.[^/.]+$/i;
+var MAPS_TABLE = /@Entity\b|@Table\b|@Document\b|\[Table\(|__tablename__|models\.Model\b|@Entity\(|\bgorm\.Model\b/;
+var ROOT_PART = /[._-](controller|resolver|gateway|handlers?|router|routes?|consumer|listener|subscriber|client|publisher|producer|endpoints?)\.[^/.]+$/i;
+var CLIENT_NAME = /(client|gateway|publisher|producer|sender|feign|proxy|connector)$/i;
+var CLIENT_DIR = /(^|\/)(clients?|gateways?|integrations?|publishers?|producers?|outbound)\//i;
+var base = (path) => path.slice(path.lastIndexOf("/") + 1);
+var stem = (path) => {
+  const b = base(path);
+  const dot = b.indexOf(".");
+  return dot > 0 ? b.slice(0, dot) : b;
+};
+function isModelFile(path, text) {
+  if (!CODE.test(path) || readingRank(path) === 5)
+    return false;
+  if (!MODEL_DIR.test(path) && !MODEL_NAME.test(stem(path)) && !MODEL_PART.test(path))
+    return false;
+  return text === void 0 || !MAPS_TABLE.test(text);
+}
+var ENTRY_POINT_NAME = /(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|servlet|webhook|resolver)$/i;
+var ENTRY_POINT_DIR = /(^|\/)(controllers?|routes|routers|handlers|endpoints|listeners|consumers)\//i;
+var ENTRY_POINT_PART = /[._-](controller|resolver|handlers?|router|routes?|consumer|listener|subscriber|endpoints?)\.[^/.]+$/i;
+function isEntryPointFile(path) {
+  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+    return false;
+  return ENTRY_POINT_NAME.test(stem(path)) || ENTRY_POINT_DIR.test(path) || ENTRY_POINT_PART.test(path);
+}
+function isRootFile(path) {
+  if (!CODE.test(path) || readingRank(path) === 5 || isModelFile(path))
+    return false;
+  return readingRank(path) === 2 || isEntryPointFile(path) || ROOT_PART.test(path) || CLIENT_NAME.test(stem(path)) || CLIENT_DIR.test(path);
+}
+var DECLARES = /\b(?:class|record|interface|struct|enum|object)\s+([A-Za-z_][A-Za-z0-9_]*)|^\s*(?:export\s+)?(?:declare\s+)?type\s+([A-Za-z_][A-Za-z0-9_]*)/gm;
+var IDENT = /[A-Za-z_][A-Za-z0-9_]*/g;
+function declaredTypes(path, text) {
+  const out = [];
+  const s = stem(path);
+  if (/^[A-Z][A-Za-z0-9_]*$/.test(s))
+    out.push(s);
+  for (const m of text.matchAll(DECLARES)) {
+    const n = m[1] ?? m[2];
+    if (n && !out.includes(n))
+      out.push(n);
+  }
+  return out;
+}
+function identifiers(text) {
+  return [...new Set(text.match(IDENT) ?? [])];
+}
+var NOT_REACHED_WHY = "model classes no entry point, call or field fact reaches (ADR 0169): left out of the read; atticus map <repo> --models all reads them";
+function reachableModels(o) {
+  const texts = /* @__PURE__ */ new Map();
+  const textOf = (p) => {
+    if (!texts.has(p))
+      texts.set(p, o.read(p) ?? "");
+    return texts.get(p);
+  };
+  const ordered = readingOrder(o.paths);
+  const models = ordered.filter((p) => isModelFile(p, textOf(p))).sort();
+  const isModel = new Set(models);
+  const byName = /* @__PURE__ */ new Map();
+  const declared = /* @__PURE__ */ new Map();
+  for (const p of models) {
+    const names = declaredTypes(p, textOf(p));
+    declared.set(p, names);
+    for (const n of names)
+      byName.set(n, [...byName.get(n) ?? [], p]);
+  }
+  const known = new Set(o.paths);
+  const roots = [];
+  const addRoot = (p) => {
+    if (known.has(p) && !isModel.has(p) && !roots.includes(p))
+      roots.push(p);
+  };
+  const facts = o.facts ?? [];
+  const entries = o.from === "entries";
+  const calls2 = new Set(facts.filter((f) => f.kind === "call").map((f) => f.id));
+  for (const f of facts)
+    if (f.kind === "entry" || f.kind === "call" && !entries)
+      for (const p of citedFiles(f))
+        addRoot(p);
+  for (const p of ordered)
+    if (entries ? isEntryPointFile(p) : isRootFile(p))
+      addRoot(p);
+  const reached = /* @__PURE__ */ new Map();
+  const queue = [];
+  const reach = (names, from, own = []) => {
+    for (const n of names) {
+      if (own.includes(n))
+        continue;
+      for (const p of byName.get(n) ?? []) {
+        const r = reached.get(p);
+        if (r) {
+          if (r.from === from && !r.types.includes(n))
+            r.types.push(n);
+          continue;
+        }
+        reached.set(p, { path: p, types: [n], from });
+        queue.push(p);
+      }
+    }
+  };
+  for (const p of roots)
+    reach(identifiers(textOf(p)), p);
+  for (const f of facts) {
+    for (const p of citedFiles(f))
+      if (isModel.has(p) && !reached.has(p)) {
+        reached.set(p, { path: p, types: [...(declared.get(p) ?? []).slice(0, 1)], from: f.id });
+        queue.push(p);
+      }
+    if (f.kind === "field" && !(entries && calls2.has(f.owner)))
+      reach(identifiers([f.type ?? "", f.transform === "message type" ? f.name : ""].join(" ")), f.id);
   }
-  return { at, strings: [...strings2].map((s) => s.toLowerCase()), paths: [...paths] };
+  const rooted = roots.length > 0 || reached.size > 0;
+  if (!rooted)
+    return {
+      rooted,
+      roots,
+      reached: models.map((p) => ({ path: p, types: declared.get(p) ?? [], from: "" })),
+      notReached: [],
+      models: models.length
+    };
+  for (let i = 0; i < queue.length; i++) {
+    const p = queue[i];
+    reach(identifiers(textOf(p)), p, declared.get(p));
+  }
+  return {
+    rooted,
+    roots,
+    reached: queue.map((p) => reached.get(p)),
+    notReached: models.filter((p) => !reached.has(p)),
+    models: models.length
+  };
 }
-function factsCover(file, c, ix) {
-  if ([c.line - 1, c.line, c.line + 1].some((n) => ix.at.has(`${file}:${n}`)))
-    return true;
-  if (c.kind === "path") {
-    const p = `${normPath(c.value)}/`;
-    return ix.paths.some((f) => f.includes(p));
+
+// packages/verify/dist/method.js
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+function wordsOf2(line) {
+  return line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
+}
+function methodOnLines(method, lines) {
+  const m = method.toLowerCase();
+  return lines.some((l) => wordsOf2(l).includes(m));
+}
+var CHAIN_LINES = 8;
+var CONTINUES = /^\s*\??\./;
+function chainOf(file, line) {
+  const at = (n) => file?.[n - 1];
+  const cited = at(line);
+  if (cited === void 0)
+    return [];
+  const out = [cited];
+  for (let n = line, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n--) {
+    const above = at(n - 1);
+    if (above === void 0)
+      break;
+    out.push(above);
   }
-  const v = c.value.toLowerCase().replace(/\/+$/, "");
-  return ix.strings.some((s) => s.includes(v));
+  for (let n = line + 1, k = 0; k < CHAIN_LINES && CONTINUES.test(at(n) ?? ""); k++, n++)
+    out.push(at(n));
+  return out;
 }
-var skippedOf = (file, c) => ({
-  cite: `${file}:${c.line}`,
-  kind: c.kind,
-  value: c.value,
-  text: c.text
-});
-var SPEC_MARK = /^\s*["']?(openapi|swagger)["']?\s*:/m;
-var SPEC_EXT = /\.(ya?ml|json)$/i;
-function specOpsUncoveredIn(file, text, facts) {
-  if (!SPEC_EXT.test(file) || !SPEC_MARK.test(text.slice(0, 4e3)))
+function methodUnseenOf(f, lines, factOf) {
+  if (f.kind !== "entry" && f.kind !== "call")
     return void 0;
-  let doc;
-  try {
-    doc = readOpenApiDocument(text);
-  } catch {
+  if (!f.method || !HTTP_METHODS.has(f.method.toUpperCase()))
     return void 0;
-  }
-  if (!doc || !doc.operations.length)
+  const at = (file, line) => lines(file)?.[line - 1];
+  const route = f.kind === "call" && f.from ? factOf?.(f.from) : void 0;
+  const forwards = route?.kind === "entry" && route.method?.toUpperCase() === f.method.toUpperCase();
+  const looked = [
+    ...chainOf(lines(f.cite.file), f.cite.line),
+    at(f.cite.file, f.cite.line + 1),
+    ...(f.cite.with ?? []).map((p) => at(p.file, p.line)),
+    ...forwards ? [at(route.cite.file, route.cite.line), at(route.cite.file, route.cite.line + 1)] : []
+  ].filter((l) => l !== void 0);
+  if (methodOnLines(f.method, looked))
     return void 0;
-  const server = (() => {
-    const s = doc.servers[0];
-    if (!s)
-      return "";
-    const p = /^[a-z0-9+.-]+:\/\/[^/]+(\/.*)?$/i.exec(s)?.[1] ?? (s.startsWith("/") ? s : "");
-    return p.replace(/\/+$/, "");
-  })();
-  const entries = facts.filter((f) => f.kind === "entry");
-  const atLines = /* @__PURE__ */ new Set();
-  for (const e of entries)
-    for (const k of indexFacts([e]).at)
-      atLines.add(k);
+  const cite2 = `${f.cite.file}:${f.cite.line}`;
+  const method = f.method.toUpperCase();
+  return {
+    id: f.id,
+    kind: f.kind,
+    method,
+    cite: cite2,
+    message: `${f.id} claims ${method}, which neither ${cite2}, the chain it is in, the next line, a cite.with line nor the route it forwards writes`
+  };
+}
+
+// packages/verify/dist/verify.js
+var LINE_KEY_VALUE = /^\s*(?:-\s+)?(?:export\s+)?["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*(.*?)\s*,?\s*$/;
+var LINE_XML = [
+  /<([A-Za-z_][\w.-]*)>([^<]+)<\/\1>/g,
+  /\b(?:key|name)\s*=\s*"([^"]+)"\s+value\s*=\s*"([^"]*)"/g
+];
+var unquoted = (v) => v.replace(/^["'`]|["'`]$/g, "").trim();
+function pairsOf(t) {
   const out = [];
-  for (const op of doc.operations) {
-    const lines = [op.methodLine, op.line].filter((n) => n !== void 0);
-    if (lines.some((n) => [n - 1, n, n + 1].some((x) => atLines.has(`${file}:${x}`))))
-      continue;
-    const method = op.method.toUpperCase();
-    const own = normPath(op.path);
-    const full = normPath(`${server}${op.path}`);
-    const covered = entries.some((e) => {
-      if (e.method && e.method.toUpperCase() !== method)
-        return false;
-      const p = normPath(e.path);
-      return p === own || p === full || p.endsWith(own) || p.split("/").length > 2 && own.endsWith(p);
-    });
-    if (covered)
-      continue;
-    const opId = op.node?.get?.("operationId");
-    const line = op.methodLine ?? op.line ?? 1;
-    out.push({
-      spec: file,
-      method,
-      path: op.path,
-      ...typeof opId === "string" ? { operationId: opId } : {},
-      cite: `${file}:${line}`,
-      message: `${file}:${line} declares ${method} ${op.path}${typeof opId === "string" ? ` (${opId})` : ""}, which no entry covers`
-    });
+  const kv = LINE_KEY_VALUE.exec(t);
+  if (kv)
+    out.push({ key: kv[1], value: unquoted(kv[2]) });
+  for (const re of LINE_XML)
+    for (const m of t.matchAll(re))
+      out.push({ key: m[1], value: unquoted(m[2]) });
+  return out;
+}
+function lineSecrets(line) {
+  const t = line.trim();
+  if (!t)
+    return [];
+  const pairs = pairsOf(t);
+  const words = t.split(/[\s"'`=:,;()<>{}[\]/@]+/).filter((w) => w.length >= 6 && credentialLike(w));
+  const holds = redactSecrets(t) !== t || hasSecretShape(t) || quoteHoldsSecret(t) || words.length > 0 || pairs.some((p) => looksLikeSecret(p.key, "x") || p.value && credentialLike(p.value));
+  if (!holds)
+    return [];
+  const literals = [...t.matchAll(/(["'`])((?:(?!\1).){3,})\1/g)].map((m) => m[2]);
+  return [t, t.slice(0, 200), ...pairs.map((p) => p.value), ...literals, ...words].filter((s) => s.length >= 3);
+}
+function citesIn(x, out = []) {
+  if (Array.isArray(x))
+    for (const v of x)
+      citesIn(v, out);
+  else if (x && typeof x === "object") {
+    const o = x;
+    if (typeof o.file === "string" && typeof o.line === "number")
+      out.push(o);
+    for (const v of Object.values(o))
+      if (v && typeof v === "object")
+        citesIn(v, out);
   }
   return out;
 }
-var REVIEWED_HOLDS_SHOWN = 5;
-function reviewedHoldsOf(r, skipped) {
-  const n = skipped.length;
-  const first = skipped.slice(0, 3).map((s) => `${s.cite} (${s.value})`);
+function quietFact(f, lineAt) {
+  if (f.kind !== "config")
+    return false;
+  if (looksLikeSecret(f.key, "x") || configSecretField(f))
+    return true;
+  if ([f.value, f.source, f.cite.quote, ...(f.cite.with ?? []).map((w) => w.value)].some((t) => t !== void 0 && (hasSecretShape(t) || credentialLike(t) || redactSecrets(t) !== t)))
+    return true;
+  return lineAt !== void 0 && [f.cite, ...f.cite.with ?? []].some((c) => lineSecrets(lineAt(c.file, c.line) ?? "").length);
+}
+function sanitised(f, message, lineAt, quiet) {
+  let out = redactSecrets(message);
+  const texts = /* @__PURE__ */ new Set();
+  for (const c of citesIn(f))
+    for (const n of [c.line - 1, c.line, c.line + 1])
+      for (const s of lineSecrets(lineAt(c.file, n) ?? ""))
+        texts.add(s);
+  for (const t of [...texts].sort((a, b) => b.length - a.length))
+    out = out.split(t).join("<redacted>");
+  out = out.replace(/"([^"]*)"/g, (all2, inner) => lineSecrets(inner).length ? '"<redacted>"' : all2);
+  return quiet ? scrubbed(f, out) : out;
+}
+function shownFact(f, quiet, lineAt) {
+  if (quiet)
+    return withoutSecret(f);
+  const cites = citesIn(f).filter((c) => c.quote !== void 0);
+  const bad = (c) => {
+    const q = c.quote;
+    if (lineSecrets(q).length)
+      return true;
+    return [c.line - 1, c.line, c.line + 1].some((n) => lineSecrets(lineAt(c.file, n) ?? "").some((s) => s !== "" && q.includes(s)));
+  };
+  if (!cites.some(bad))
+    return f;
+  const strip = (x) => {
+    if (Array.isArray(x))
+      return x.map(strip);
+    if (!x || typeof x !== "object")
+      return x;
+    const o = Object.fromEntries(Object.entries(x).map(([k, v]) => [k, strip(v)]));
+    const c = x;
+    if (typeof c.file === "string" && typeof c.line === "number" && typeof c.quote === "string" && bad(c))
+      delete o.quote;
+    return o;
+  };
+  return strip(f);
+}
+function scrubbed(f, message) {
+  if (f.kind !== "config")
+    return message;
+  const names = new Set([f.key, f.target, f.env, f.cite.file, ...(f.cite.with ?? []).map((w) => w.file)].filter((x) => x !== void 0));
+  const texts = [f.value, f.source, f.cite.quote, ...(f.cite.with ?? []).map((w) => w.value)].flatMap((t) => t === void 0 ? [] : [t, t.trim()]).filter((t) => t.length >= 3 && !names.has(t)).sort((a, b) => b.length - a.length);
+  let out = message;
+  for (const t of texts)
+    out = out.split(t).join("<redacted>");
+  return out;
+}
+var asRead = /* @__PURE__ */ new WeakMap();
+function factAsRead(f) {
+  return asRead.get(f) ?? f;
+}
+function withoutSecret(f) {
+  if (f.kind !== "config")
+    return f;
+  const { quote: _q, ...cite2 } = f.cite;
   return {
-    path: r.path,
-    why: r.why,
-    count: n,
-    skipped: skipped.slice(0, REVIEWED_HOLDS_SHOWN),
-    message: `${r.line !== void 0 ? `line ${r.line}: ` : ""}${r.path} is reviewed as holding nothing to record, but ${n} ${n === 1 ? "line in it writes" : "lines in it write"} a path, URL or topic: ${first.join(", ")}${n > 3 ? ` and ${n - 3} more` : ""}`
+    ...f,
+    ...f.value !== void 0 ? { value: "<redacted>" } : {},
+    ...f.source !== void 0 ? { source: "<redacted>" } : {},
+    cite: {
+      ...cite2,
+      ...f.cite.with ? { with: f.cite.with.map((w) => ({ ...w, value: "<redacted>" })) } : {}
+    }
   };
 }
-
-// packages/verify/dist/verify.js
 var FOLLOWED_TYPES = ["event-topic", "mq-queue", "rest", "grpc"];
 function entriesNoFlowFollows(facts, rules = DEFAULT_READ_RULES) {
   const started = new Set(facts.flatMap((f) => f.kind === "flow" ? [f.entry] : []));
@@ -2029,6 +3638,8 @@ var LINES_HELD = 64;
 var SOURCE_EXT = /\.(java|kt|kts|scala|groovy|cs|vb|fs|ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|php|swift|m|mm|c|cc|cpp|h|hpp|sql|graphql|gql|proto|ya?ml|json|xml|properties|toml|ini|conf|tf|tfvars|hcl|bicep|sh|ps1|bat|cmd|gradle|html?|vue|svelte|cshtml|razor|aspx|jsp|ftl|hbs|cob|cbl|cpy|jcl|avsc|wsdl|xsd|csproj|sln|config)$/i;
 var SOURCE_NAME = /(^|\/)(Dockerfile[^/]*|Makefile|Jenkinsfile|Procfile|Containerfile)$/;
 var LOCKFILE = /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|Gemfile\.lock|Cargo\.lock|poetry\.lock|go\.sum|packages\.lock\.json)$/;
+var ENV_FOLDER = /(^|\/)(env|envs|environments?|overlays|stages?)\/[^/]+(?=\/)/gi;
+var testFileOf = (rules, p) => rules.notProduct.test(p.replace(ENV_FOLDER, "$1$2/_"));
 var NOT_PRODUCT = [
   /(\.|_|-)(test|spec|tests|specs)\.[a-z0-9]+$/i,
   /(Test|Tests|IT|Spec)\.(java|kt|scala|groovy|cs|vb)$/,
@@ -2076,12 +3687,16 @@ var repoModule = (exposes) => {
   const m = /^([^/]+)\/([^/]+)$/.exec(exposes.trim());
   return m ? { repo: m[1], module: m[2] } : void 0;
 };
+var PLACEHOLDER_KEY = /^\$\{([A-Za-z_][A-Za-z0-9_.-]*)\}$/;
 var routeOrWord = (v) => v.includes("/") ? { kind: "route", value: v } : { kind: "word", value: v };
 function claimsOf(f) {
   switch (f.kind) {
+    // A call whose path is a setting's placeholder a helper puts together is checked apart
+    // (`helperBuildsKey`): its bare key is never a claim, or a settings line would be a call.
     case "entry":
-    case "call":
       return [routeOrWord(f.path)];
+    case "call":
+      return f.path.trim() === "/" && /^[a-z][a-z0-9+.-]*:\/\/[^/\s?#]+\/?$/i.test(f.cite.value.trim()) ? [routeOrWord(f.path), { kind: "word", value: f.cite.value.trim() }] : [routeOrWord(f.path)];
     case "store":
       return [
         { kind: "word", value: f.name },
@@ -2117,6 +3732,14 @@ function claimsOf(f) {
     // ADR 0180: the signal the type rests on, as written on its line.
     case "component":
       return [{ kind: "word", value: f.cite.value }];
+    // ADR 0192: the coordinates as the build file writes them on the line (the name, or a
+    // Gradle line's whole `group:name:version`); `buildCoordinatesProblem` reads the rest.
+    case "artifact":
+    case "dependency":
+      return [
+        { kind: "word", value: f.cite.value },
+        { kind: "word", value: f.name }
+      ];
   }
 }
 var sameCommit = (a, b) => a.startsWith(b) || b.startsWith(a);
@@ -2225,7 +3848,8 @@ async function verifyFacts(o) {
     return lines;
   };
   const deriveEnv = { lines: linesOf2, files: listed2 };
-  const checkCite = (cite2, claims, label, withHint = true, alsoHolds) => {
+  const lineAt = (file, n) => n >= 1 ? linesOf2(file)?.[n - 1] : void 0;
+  const checkCite = (cite2, claims, label, withHint = true, alsoHolds, quiet = false) => {
     const where = `${cite2.file}:${cite2.line}`;
     if (!insideRepo(cite2.file))
       return {
@@ -2278,7 +3902,7 @@ async function verifyFacts(o) {
       !partsNamePath(near(ls, p.line), p.value))
         return {
           code: "claim-not-on-line",
-          message: `${pl} says "${p.value}" is written at ${p.file}:${p.line} (or the line either side), and it isn't`
+          message: quiet ? `${pl} is not written at ${p.file}:${p.line} (or the line either side); cite the line that writes it (its text is not repeated here: it may be a secret)` : `${pl} says "${p.value}" is written at ${p.file}:${p.line} (or the line either side), and it isn't`
         };
       partLines.push(...near(ls, p.line));
     }
@@ -2295,6 +3919,11 @@ async function verifyFacts(o) {
         code: "claim-not-on-line",
         message: `${label} claims ${claims.map((c) => `"${c.value}"`).join(" or ")}, which ${where} (or the line either side)${parts.length ? " and its parts" : ""} does not name${parts.length || !withHint ? "" : "; if it is put together from other lines (a base URL, a prefix, a context path), cite them in cite.with"}`
       };
+    if (claims && parts.length && isCommentLine(lines[cite2.line - 1] ?? "") && !/(^|\/)_redirects$/.test(cite2.file))
+      return {
+        code: "claim-in-comment",
+        message: `${label} cites ${where}, which is a comment; cite the code that does it`
+      };
     if (claims && !parts.length) {
       const naming = [cite2.line - 1, cite2.line, cite2.line + 1].map((n) => lines[n - 1]).filter((l) => l !== void 0 && claims.some((c) => lineNamesClaim(l, c)));
       if (naming.length && !/(^|\/)_redirects$/.test(cite2.file) && naming.every(isCommentLine))
@@ -2309,7 +3938,7 @@ async function verifyFacts(o) {
       if (!near2.some((l) => quoteMatches(l, cite2.quote)))
         return {
           code: "quote-mismatch",
-          message: `${label} quotes "${cite2.quote}", but ${where} reads "${line.trim().slice(0, 200)}"`
+          message: quiet ? `${label}'s quote is not what ${where} (or the line either side) reads; neither is repeated here, as either may hold a secret` : `${label} quotes "${cite2.quote}", but ${where} reads "${line.trim().slice(0, 200)}"`
         };
     }
     return void 0;
@@ -2328,6 +3957,8 @@ async function verifyFacts(o) {
   };
   const estate = o.estate ? new Set(o.estate.components.map(factIdPart)) : void 0;
   const serves2 = facts.some((f) => f.kind === "entry");
+  const moduleOf = /* @__PURE__ */ new Map();
+  const placedFrom = /* @__PURE__ */ new Map();
   const repoComponents = new Map(Object.entries(o.estate?.repoComponents ?? {}).map(([r, cs]) => [factIdPart(r), new Set(cs.map(factIdPart))]));
   for (const f of facts) {
     const label = `${f.kind} ${f.id}`;
@@ -2342,7 +3973,21 @@ async function verifyFacts(o) {
         problem(f, "wrong-commit", `${label} was read at ${f.commit}, not at ${o.commit}; read it again`);
       continue;
     }
-    add(f, checkCite(f.cite, claimsOf(f), label, true, f.kind === "entry" || f.kind === "call" ? (ls, n) => apigeePassThrough({ kind: f.kind, forwards: f.kind === "call" && !!f.from }, f.cite.file, ls, n, f.path) : void 0));
+    add(f, checkCite(f.cite, claimsOf(f), label, true, f.kind === "entry" || f.kind === "call" ? (ls, n) => apigeePassThrough({ kind: f.kind, forwards: f.kind === "call" && !!f.from }, f.cite.file, ls, n, f.path) || // A path written as a setting's placeholder that no line writes whole (ADR 0172,
+    // beta.24): a helper puts the key together (a `@ConfigurationProperties` prefix, a
+    // map field, the name passed to a lookup). The cited line is code naming the key's
+    // last segment, and one file among the parts proves the rest of the key nests so.
+    f.kind === "call" && PLACEHOLDER_KEY.test(f.path.trim()) && helperBuildsKey(PLACEHOLDER_KEY.exec(f.path.trim())[1], f.cite, linesOf2) : void 0, quietFact(f, lineAt)));
+    if (f.kind === "config" && !found.has(f.id)) {
+      const bad = configLineProblem(f, linesOf2, listed2, rules.gatewayBundleFolders);
+      if (bad)
+        problem(f, "claim-not-on-line", `${label}: ${bad}`);
+    }
+    if (f.kind === "config") {
+      const field = configSecretField(f);
+      if (field)
+        problem(f, "secret-value", `${label}: "${f.key}" carries a secret in its ${field}; cite the line that names the setting and give its source (env:NAME, vault:path), never its value`);
+    }
     if (f.kind === "entry" && f.authCite)
       add(f, checkCite({ ...f.authCite }, [{ kind: "word", value: f.authCite.value }], `${label} authCite${f.auth ? ` (auth ${f.auth})` : ""}`, false));
     if (f.kind === "entry" && f.authCite && f.auth) {
@@ -2433,6 +4078,32 @@ async function verifyFacts(o) {
       if (f.version !== void 0)
         add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
     }
+    const own = o.estate?.repoComponent?.[f.repo];
+    if (own !== void 0 && o.estate) {
+      const to = placedComponentOf(f, {
+        component: own,
+        modules: o.estate.modules?.[f.repo],
+        components: o.estate.components,
+        prototype: o.estate.prototypes?.includes(f.repo)
+      });
+      const top = f.cite?.file?.split("/")[0];
+      if (to !== void 0 && top !== void 0 && isBuildModuleDir(top, linesOf2)) {
+        moduleOf.set(f.id, to);
+        placedFrom.set(f.id, f.component);
+      }
+    }
+    if ((f.kind === "artifact" || f.kind === "dependency") && !found.has(f.id)) {
+      const mod = buildModuleOf(f, linesOf2, o.estate?.modules?.[f.repo] ?? [], o.estate?.repoComponent?.[f.repo]);
+      const bad = buildCoordinatesProblem(f, linesOf2, listed2()) ?? buildModuleProblem(f, mod);
+      if (bad)
+        problem(f, "build-coordinates", bad);
+      else {
+        if (mod?.from === "manifest" && mod.component && f.component === void 0)
+          moduleOf.set(f.id, mod.component);
+        if (f.version !== void 0 && !isVersionCatalogFile(f.cite.file))
+          add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
+      }
+    }
     if (f.kind === "flow") {
       f.steps.forEach((s, i) => add(f, checkCite(s.cite, stepClaims(s.kind, s.cite.value), `${label} step ${i + 1}`)));
       f.errors.forEach((e, i) => add(f, checkCite(e.cite, [routeOrWord(e.cite.value)], `${label} error ${i + 1}`)));
@@ -2478,11 +4149,17 @@ async function verifyFacts(o) {
   }
   const rejected = /* @__PURE__ */ new Map();
   for (const f of facts) {
-    const ps = found.get(f.id);
+    let ps = found.get(f.id);
     if (!ps?.length)
       continue;
-    rejected.set(f.id, ps.length === 1 ? { fact: f, ...ps[0] } : {
-      fact: f,
+    const isOther = other.has(f.id);
+    const quiet = ps.some((p) => p.code === "secret-value") || quietFact(f, isOther ? void 0 : lineAt);
+    ps = ps.map((p) => ({ ...p, message: sanitised(f, p.message, lineAt, quiet) }));
+    const shown = isOther ? f.kind === "config" && configSecretField(f) || citesIn(f).some((c) => c.quote && lineSecrets(c.quote).length) ? withoutSecret(f) : f : shownFact(f, quiet, lineAt);
+    if (isOther && shown !== f)
+      asRead.set(shown, f);
+    rejected.set(f.id, ps.length === 1 ? { fact: shown, ...ps[0] } : {
+      fact: shown,
       code: ps[0].code,
       message: ps.map((p, i) => `(${i + 1}) ${p.message}`).join(" "),
       problems: ps
@@ -2495,10 +4172,11 @@ async function verifyFacts(o) {
         continue;
       const r = refsOf(f).find((x) => rejected.has(x.id));
       if (r) {
+        const quiet = quietFact(f, lineAt);
         rejected.set(f.id, {
-          fact: f,
+          fact: shownFact(f, quiet, lineAt),
           code: "ref-rejected",
-          message: `${f.kind} ${f.id} names ${r.field} "${r.id}", which was rejected (${rejected.get(r.id).code})`
+          message: sanitised(f, `${f.kind} ${f.id} names ${r.field} "${r.id}", which was rejected (${rejected.get(r.id).code})`, lineAt, quiet)
         });
         changed = true;
       }
@@ -2532,7 +4210,13 @@ async function verifyFacts(o) {
   const accepted = facts.filter((f) => !rejected.has(f.id)).map((f) => {
     o.room?.();
     const verified = f.by === "person" && f.verified !== "none" ? f.verified : "line";
-    const base2 = { ...f, verified, cite: fixQuote(f.cite) };
+    const module = moduleOf.get(f.id);
+    const base2 = {
+      ...f,
+      ...module !== void 0 ? { component: module } : {},
+      verified,
+      cite: fixQuote(f.cite)
+    };
     if (base2.kind === "entry" && base2.auth !== void 0 && !base2.authCite && f.by !== "person")
       authUncited.push({
         id: base2.id,
@@ -2553,17 +4237,41 @@ async function verifyFacts(o) {
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
   const sources = [];
   const excluded = [];
+  const secrets = [];
   for (const p of o.source.list()) {
     o.room?.();
-    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
+    if (isSecretPath(p)) {
+      if (insideRepo(p) && isConfigFile(p) && !testFileOf(rules, p) && !tooBigToRead(o.source, p)) {
+        const text = o.source.read(p);
+        const ls2 = text === void 0 ? void 0 : text.replace(/\r\n?/g, "\n").split("\n");
+        if (ls2 && !binaryLines(ls2))
+          secrets.push(...liveSecretsIn(p, ls2));
+      }
+      continue;
+    }
+    const scanOnly = () => {
+      if (!insideRepo(p) || !isConfigFile(p) || LOCKFILE.test(p) || testFileOf(rules, p) || tooBigToRead(o.source, p))
+        return;
+      const ls2 = readLines(p);
+      if (ls2 && !binaryLines(ls2))
+        secrets.push(...liveSecretsIn(p, ls2));
+    };
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p)) {
+      scanOnly();
       continue;
+    }
     const ls = readLines(p) ?? [""];
-    if (!isSourceFile(p, ls[0] ?? "", ls, rules))
+    if (!isSourceFile(p, ls[0] ?? "", ls, rules)) {
+      if (isConfigFile(p) && !LOCKFILE.test(p) && !testFileOf(rules, p) && !binaryLines(ls))
+        secrets.push(...liveSecretsIn(p, ls));
       continue;
+    }
     if (excludeRes.some((re) => re.test(p)))
       excluded.push(p);
-    else
+    else {
       sources.push(p);
+      secrets.push(...liveSecretsIn(p, ls));
+    }
   }
   const touched = new Set(o.routed ?? []);
   for (const f of accepted)
@@ -2664,6 +4372,14 @@ async function verifyFacts(o) {
     const held = files.flatMap(skippedIn);
     return held.length ? [reviewedHoldsOf(entry, held)] : [];
   });
+  const namedPoms = [...touched].some((p) => isBuildFile(p)) ? pomFilesNamed(listed2(), linesOf2) : void 0;
+  const placed = accepted.filter((f) => placedFrom.has(f.id)).map((f) => ({
+    id: f.id,
+    named: placedFrom.get(f.id),
+    component: f.component,
+    cite: `${f.cite.file}:${f.cite.line}`
+  })).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  const unrecorded = buildUnrecorded([...touched].filter((p) => isBuildFileIn(p, namedPoms) && insideRepo(p) && !isSecretPath(p)), (p) => linesOf2(p), accepted, listed2());
   return {
     accepted,
     // a rejected fact goes back as it was read, at its own commit, even one that was carried
@@ -2677,6 +4393,7 @@ async function verifyFacts(o) {
       ratio
     },
     redacted,
+    secrets: secrets.sort((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line),
     quotesDropped,
     carried: accepted.flatMap((f) => carriedFrom.has(f.id) ? [{ id: f.id, from: carriedFrom.get(f.id) }] : []),
     corrections: { applied: corrected.applied, stale: corrected.stale },
@@ -2689,12 +4406,14 @@ async function verifyFacts(o) {
     skipped,
     reviewedHolds,
     specOpsUncovered,
-    frameworkGaps: frameworkGaps(accepted, rules.frameworks)
+    frameworkGaps: frameworkGaps(accepted, rules.frameworks),
+    ...unrecorded.length ? { buildUnrecorded: unrecorded } : {},
+    ...placed.length ? { componentsPlaced: placed } : {}
   };
 }
 
 // packages/verify/dist/batches.js
-var BUILD = /(^|\/)(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|go\.mod|Cargo\.toml|pyproject\.toml|setup\.py|requirements[^/]*\.txt|Gemfile|[^/]+\.gemspec|composer\.json|[^/]+\.(csproj|sln|tf|tfvars|bicep|hcl)|Dockerfile[^/]*|Containerfile|Jenkinsfile|Makefile|Procfile|(docker-)?compose[^/]*\.ya?ml|Chart\.yaml|values[^/]*\.ya?ml|azure-pipelines[^/]*\.ya?ml|\.gitlab-ci\.yml|bitbucket-pipelines\.yml|serverless\.ya?ml|template\.ya?ml|manifest\.ya?ml)$/;
+var BUILD = /(^|\/)(pom\.xml|[^/]+[-_.]pom\.xml|[^/]+\.pom|gradle\/[\w-]+\.versions\.toml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|go\.mod|Cargo\.toml|pyproject\.toml|setup\.py|requirements[^/]*\.txt|Gemfile|[^/]+\.gemspec|composer\.json|[^/]+\.(csproj|sln|tf|tfvars|bicep|hcl)|Dockerfile[^/]*|Containerfile|Jenkinsfile|Makefile|Procfile|(docker-)?compose[^/]*\.ya?ml|Chart\.yaml|values[^/]*\.ya?ml|azure-pipelines[^/]*\.ya?ml|\.gitlab-ci\.yml|bitbucket-pipelines\.yml|serverless\.ya?ml|template\.ya?ml|manifest\.ya?ml)$/;
 var DEPLOY_DIR = /(^|\/)(\.github\/workflows|\.circleci|k8s|kubernetes|helm|charts|deploy|deployment|deployments|manifests|infra|terraform|pipelines?)\//;
 var CONFIG = /(^|\/)((application|bootstrap)[^/]*\.(ya?ml|properties)|appsettings[^/]*\.json|[^/]+\.(properties|conf|ini|toml)|web\.config|config\/[^/]+\.(ya?ml|json))$/;
 var ENTRY_NAME = /(^|[._-])(main|app|application|server|program|startup|index|lambda|handler|function|cli)$|(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|api|job|scheduler|worker|webhook|servlet|page|screen|view)$/i;
@@ -2953,7 +4672,7 @@ var BUILD_FILE = /^(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|pack
 var AGGREGATOR = /^(pom\.xml|settings\.gradle(\.kts)?|package\.json|pnpm-workspace\.yaml|lerna\.json|Cargo\.toml|go\.work)$/;
 var byPath = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var nameOf = (path) => path.slice(path.lastIndexOf("/") + 1);
-var dirOf = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+var dirOf2 = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
 var under = (path, dir) => !dir || path.startsWith(`${dir}/`);
 var quoted = (s) => [...s.matchAll(/["']([^"'\n]+)["']/g)].map((m) => m[1]);
 var clean = (m) => m.trim().replace(/^\.\//, "").replace(/\/pom\.xml$/, "").replace(/\/+$/, "");
@@ -2967,7 +4686,7 @@ function json(text) {
 var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
 function buildModules(path, text) {
   const name = nameOf(path);
-  const dir = dirOf(path);
+  const dir = dirOf2(path);
   let found = [];
   if (name === "pom.xml")
     found = [...text.matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)].map((m) => m[1]);
@@ -3023,11 +4742,11 @@ function packageRoots(paths, inits, read) {
   let readCount = 0;
   for (const p of paths) {
     if (/\.py$/i.test(p)) {
-      let d = dirOf(p);
+      let d = dirOf2(p);
       let top;
       while (d && inits.has(d)) {
         top = d;
-        d = dirOf(d);
+        d = dirOf2(d);
       }
       if (top)
         roots.add(nameOf(top).toLowerCase());
@@ -3046,7 +4765,7 @@ function vendoredProjects(all2, read) {
   const licenses = /* @__PURE__ */ new Map();
   const builds = /* @__PURE__ */ new Map();
   for (const p of files) {
-    const d = dirOf(p);
+    const d = dirOf2(p);
     if (LICENSE_FILE.test(nameOf(p)) && !licenses.has(d))
       licenses.set(d, p);
     if (BUILD_FILE.test(nameOf(p)))
@@ -3057,7 +4776,7 @@ function vendoredProjects(all2, read) {
     for (const p of files)
       if (AGGREGATOR.test(nameOf(p)))
         for (const m of buildModules(p, read(p) ?? ""))
-          modules.push({ from: dirOf(p), re: globToRegExp(m) });
+          modules.push({ from: dirOf2(p), re: globToRegExp(m) });
   }
   const included = (dir) => modules.some((m) => m.from !== dir && under(dir, m.from) && m.re.test(dir));
   const nested = [];
@@ -3077,7 +4796,7 @@ function vendoredProjects(all2, read) {
   }
   const out = [...nested];
   if (copied.length) {
-    const inits = new Set(files.filter((p) => nameOf(p) === "__init__.py").map(dirOf));
+    const inits = new Set(files.filter((p) => nameOf(p) === "__init__.py").map(dirOf2));
     const apart = [...copied, ...nested.map((n) => n.dir)];
     const text = read ?? (() => void 0);
     const mine = packageRoots(files.filter((p) => !apart.some((d) => under(p, d))), inits, text);
@@ -3238,11 +4957,11 @@ function unitsOf(dir, fs, room) {
   const children = /* @__PURE__ */ new Map();
   for (const f of fs) {
     const rest = f.path.slice(prefix.length);
-    const slash = rest.indexOf("/");
-    if (slash < 0)
+    const slash2 = rest.indexOf("/");
+    if (slash2 < 0)
       direct.push(f);
     else {
-      const child = prefix + rest.slice(0, slash);
+      const child = prefix + rest.slice(0, slash2);
       children.set(child, [...children.get(child) ?? [], f]);
     }
   }
@@ -3259,11 +4978,11 @@ function groupUnits(dir, fs, room, holds) {
   const children = /* @__PURE__ */ new Map();
   for (const f of fs) {
     const rest = f.path.slice(prefix.length);
-    const slash = rest.indexOf("/");
-    if (slash < 0)
+    const slash2 = rest.indexOf("/");
+    if (slash2 < 0)
       direct.push(f);
     else {
-      const child = prefix + rest.slice(0, slash);
+      const child = prefix + rest.slice(0, slash2);
       children.set(child, [...children.get(child) ?? [], f]);
     }
   }
@@ -3891,7 +5610,8 @@ function lineLegend(marks) {
   }
   return "modify";
 }
-function changeView(records2, change, flows, known = []) {
+function changeView(records2, change, flows, known = [], retired = []) {
+  const gone = new Set(retired);
   const c = new Catalog(records2);
   const inSpecs = new Set(known);
   const isKnown = (id) => c.components.has(id) || c.isSystem(id) || inSpecs.has(id);
@@ -3928,6 +5648,9 @@ function changeView(records2, change, flows, known = []) {
       }
     }
   }
+  for (const id of gone)
+    if (comps.has(id))
+      legends.set(id, "retire");
   const withMark = (id) => {
     const l = legends.get(id);
     return l ? { legend: l } : {};
@@ -4446,8 +6169,25 @@ var LENS_KINDS = {
   infrastructure: /* @__PURE__ */ new Set(["estate", "system", "repo", "component", "deployment", "environment"])
 };
 var LENS_EDGES = {
-  architecture: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes", "uses", "reads", "writes"]),
-  repo: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes", "uses", "reads", "writes", "references"]),
+  architecture: /* @__PURE__ */ new Set([
+    "calls",
+    "publishes",
+    "subscribes",
+    "uses",
+    "depends-on",
+    "reads",
+    "writes"
+  ]),
+  repo: /* @__PURE__ */ new Set([
+    "calls",
+    "publishes",
+    "subscribes",
+    "uses",
+    "depends-on",
+    "reads",
+    "writes",
+    "references"
+  ]),
   data: /* @__PURE__ */ new Set(["reads", "writes", "references"]),
   integration: /* @__PURE__ */ new Set(["calls", "publishes", "subscribes"]),
   infrastructure: /* @__PURE__ */ new Set(["deployed-to"])
@@ -4510,30 +6250,71 @@ var HOW_OF_FLAG = {
   "joined-by-name": "named",
   "joined-by-repo": "repo",
   "joined-by-host": "host",
+  // beta.24: a call whose host nothing resolves, by the one proxy BasePath its path starts with.
+  [JOINED_BY_BASE_PATH]: "base-path",
   "declared-caller": "declared",
   // ADR 0162 §6 (F8): a topic or queue the profile names as an outside system's: a person's word.
   [DECLARED_TOPIC]: "declared",
   // ADR 0160 (O3): answered by an entry of another team's shared map.
   [JOINED_TO_SHARED_MAP]: "shared"
 };
+var NOT_VERIFYING_FLAGS = /* @__PURE__ */ new Set([
+  ...JOIN_GUESS_FLAGS,
+  JOINED_BY_PERSON,
+  JOINED_BY_AI,
+  JOINED_BY_PATH_OVERLAP
+]);
+var ALSO_OF_FLAG = {
+  ...HOW_OF_FLAG,
+  [JOINED_BY_PATH_OVERLAP]: "path"
+};
 function joinHow(i) {
-  for (const f of i.flags ?? [])
+  const flags = i.flags ?? [];
+  const topic = i.via === "event-bus" || i.via === "mq";
+  if (i.confidence === "verified") {
+    for (const f of flags)
+      if (HOW_OF_FLAG[f] && !NOT_VERIFYING_FLAGS.has(f))
+        return HOW_OF_FLAG[f];
+    if (topic)
+      return "topic";
+  }
+  for (const f of flags)
     if (HOW_OF_FLAG[f])
       return HOW_OF_FLAG[f];
-  if (i.via === "event-bus" || i.via === "mq")
+  if (topic)
     return "topic";
   return "unknown";
 }
+var GUESS_HOWS = new Set([...NOT_VERIFYING_FLAGS].map((f) => HOW_OF_FLAG[f]).filter(Boolean));
+function alsoOf(i, how) {
+  if (i.confidence !== "verified" || GUESS_HOWS.has(how))
+    return [];
+  const flags = i.flags ?? [];
+  const byBase = how !== "base-path" && flags.includes(JOINED_BY_BASE_PATH);
+  return [
+    ...new Set(flags.flatMap((f) => {
+      const also = byBase && f === JOINED_BY_PATH ? "base-path" : ALSO_OF_FLAG[f];
+      return NOT_VERIFYING_FLAGS.has(f) && also && also !== how ? [also] : [];
+    }))
+  ];
+}
 function joinOf(i) {
   const side = (s) => evidenceOf(i.evidence.filter((e) => e.side === s));
   const sided = /* @__PURE__ */ new Set(["caller", "callee", "gateway"]);
+  const how = joinHow(i);
+  const also = alsoOf(i, how);
   return {
     interface: i.id,
     from: i.from,
     to: i.to,
-    how: joinHow(i),
+    how,
     gateway: i.via === "gateway",
-    verified: i.confidence === "verified",
+    // A link is verified when one of its calls is (ADR 0135 section 5): its how is that call's,
+    // and the guesses its other calls rest on are `also`, never the reason. One with no how but
+    // a guess has no call that wasn't guessed to show, so it is never shown verified beside the
+    // guess's words (beta.24).
+    verified: i.confidence === "verified" && !GUESS_HOWS.has(how),
+    ...also.length ? { also } : {},
     ...i.method ? { method: i.method } : {},
     ...i.normalizedPath ? { path: i.normalizedPath } : {},
     caller: side("caller"),
@@ -4565,12 +6346,12 @@ function sharedOf(i) {
     }
   };
 }
-function mergeJoins(a, b) {
+function mergeJoins(a, b, cap = MAX_JOINS) {
   const by = new Map(a.map((j) => [j.interface, j]));
   for (const j of b)
     if (!by.has(j.interface))
       by.set(j.interface, j);
-  return [...by.values()].sort((x, y) => x.interface < y.interface ? -1 : x.interface > y.interface ? 1 : 0).slice(0, MAX_JOINS);
+  return [...by.values()].sort((x, y) => x.interface < y.interface ? -1 : x.interface > y.interface ? 1 : 0).slice(0, cap);
 }
 var props = (o) => {
   const out = {};
@@ -4586,7 +6367,50 @@ var props = (o) => {
   return out;
 };
 var all = (rs, k) => rs.filter((r) => r.kind === k).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-function buildEstate(records2) {
+function dependencyJoin(l) {
+  const lines = (end) => end.lines.map((at) => ({ source: "code", repo: end.repo, at }));
+  const facts = l.facts?.length ? l.facts : [l.from];
+  const caller = [];
+  for (const f of facts)
+    for (const e of lines(f))
+      if (!caller.some((x) => x.repo === e.repo && x.at === e.at))
+        caller.push(e);
+  const callee = [];
+  for (const p of l.published?.length ? l.published : [l.to])
+    for (const e of lines(p))
+      if (!callee.some((x) => x.repo === e.repo && x.at === e.at))
+        callee.push(e);
+  return {
+    interface: dependencyLinkId(l),
+    from: l.from.component,
+    to: l.to.component,
+    how: "coordinates",
+    gateway: false,
+    // code at both ends, each claim checked on its line, and nobody had to guess
+    verified: true,
+    caller,
+    callee,
+    hops: [],
+    other: [],
+    dependency: {
+      group: l.group,
+      name: l.name,
+      ...l.version ? { version: l.version } : {},
+      ...l.scope ? { scope: l.scope } : {},
+      facts: facts.map((f) => ({
+        repo: f.repo,
+        fact: f.fact,
+        at: f.at,
+        lines: f.lines,
+        ...f.group !== void 0 ? { group: f.group } : {},
+        ...f.name !== void 0 ? { name: f.name } : {},
+        ...f.version !== void 0 ? { version: f.version } : {},
+        ...f.scope !== void 0 ? { scope: f.scope } : {}
+      }))
+    }
+  };
+}
+function buildEstate(records2, o = {}) {
   const nodes = /* @__PURE__ */ new Map();
   const atoms = [];
   const add = (n) => {
@@ -4897,6 +6721,19 @@ function buildEstate(records2) {
         evidence: evidenceOf(c.evidence),
         gaps: recordGaps(c)
       });
+  for (const l of o.dependsOn ?? []) {
+    if (!components.has(l.from.component) || !components.has(l.to.component))
+      continue;
+    const join2 = dependencyJoin(l);
+    atoms.push({
+      from: `component:${l.from.component}`,
+      to: `component:${l.to.component}`,
+      type: "depends-on",
+      evidence: mergeEvidence(join2.caller.slice(0, 1), join2.callee.slice(0, 1)),
+      gaps: [],
+      join: join2
+    });
+  }
   for (const t of tables) {
     const ev = evidenceOf(t.evidence);
     const part = (ref) => {
@@ -5049,7 +6886,7 @@ function need(est, lens, id) {
   if (!est.visible.get(lens).has(id))
     throw new NoSuchNode(`There is no node ${id} in the ${lens} lens.`);
 }
-function merge(mapped) {
+function merge(mapped, cap = MAX_JOINS) {
   const by = /* @__PURE__ */ new Map();
   for (const { from, to, atom } of mapped) {
     const id = `${atom.type}:${from}>${to}`;
@@ -5071,7 +6908,7 @@ function merge(mapped) {
       continue;
     }
     if (atom.join)
-      e.joins = mergeJoins(e.joins ?? [], [atom.join]);
+      e.joins = mergeJoins(e.joins ?? [], [atom.join], cap);
     e.count++;
     if (atom.sync && e.sync !== atom.sync)
       e.sync = "mixed";
@@ -5160,7 +6997,7 @@ function nodeView(est, id, o) {
       continue;
     mapped.push({ from, to, atom });
   }
-  let edges = merge(mapped);
+  let edges = merge(mapped, o.everyJoin ? Infinity : MAX_JOINS);
   let hidden = 0;
   if (!o.all)
     ({ edges, hidden } = reduceUses(edges));
@@ -5205,7 +7042,7 @@ function focusView(est, id, o) {
     node: toNode(est, lens, id),
     path: ancestors(est, id).map((n) => toNode(est, lens, n)),
     neighbours: [...near].sort().map((n) => toNode(est, lens, n)),
-    edges: merge(ends.filter((e) => set.has(e.from) && set.has(e.to)))
+    edges: merge(ends.filter((e) => set.has(e.from) && set.has(e.to)), o.everyJoin ? Infinity : MAX_JOINS)
   };
 }
 
@@ -6096,6 +7933,7 @@ function houseImportsUntaught(source, o) {
 export {
   insideRepo,
   dirSource,
+  isBuildFile,
   correctionFor,
   outsidePairingFor,
   correctedFact,
@@ -6106,6 +7944,7 @@ export {
   frameworkGaps,
   frameworksToLearn,
   readRulesOf,
+  keyIsSecret,
   lineRangeOf,
   parseReviewed,
   readingRank,
@@ -6118,6 +7957,7 @@ export {
   isEntryPointFile,
   NOT_REACHED_WHY,
   reachableModels,
+  factAsRead,
   sameCommit,
   staleMessage,
   verifyFacts,