@maycombhq/atticus 2.0.0-beta.24 → 2.0.0-beta.25

package/dist/{chunk-GJVCBTSO.js → chunk-GLISHJ4G.js}

@@ -118,7 +118,7 @@ import {
   normalizePath,
   slugify,
   urlHostPort
-} from "./chunk-QFDPX6C4.js";
+} from "./chunk-LZFKJ2BR.js";
 import {
   SCHEMA_VERSION,
   keptParse
@@ -239,12 +239,14 @@ var TOKEN_SHAPES = [
   /\bAIza[0-9A-Za-z_-]{35}/g,
   /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
 ];
-function hasSecretShape(text4) {
+function hasSecretShape(text4, o = {}) {
   for (const m of text4.matchAll(URL_CREDENTIALS))
     if (!refersOnly(m[2]))
       return true;
   if (new RegExp(BEARER.source).test(text4))
     return true;
+  if (o.basic !== false && new RegExp(BASIC.source).test(text4))
+    return true;
   return TOKEN_SHAPES.some((re) => new RegExp(re.source).test(text4));
 }
 var placeholder = (v) => PLACEHOLDER.test(v.trim().replace(/^["'`]/, ""));
@@ -366,7 +368,12 @@ var common = {
   id: FactId,
   repo: str(),
   commit: external_exports.string().regex(/^[0-9a-f]{7,64}$/),
-  /** The module in the repo the fact belongs to; the repo itself when left out. */
+  /**
+   * The component the fact belongs to: the component the manifest names (a module only when the
+   * manifest lists modules); the repo's own when left out. Review of beta.25: in a repo whose
+   * manifest lists no modules, one the manifest doesn't name (a folder's) is placed in the repo's
+   * component (`placedComponentOf`), with a note.
+   */
   component: external_exports.string().optional(),
   cite: Cite,
   verified: FactVerified.default("none"),
@@ -566,6 +573,133 @@ function namesOfKey(key3) {
 function looksLikeSecret(key3, value) {
   return value !== void 0 && namesOfKey(key3).some((n) => SECRET_KEY2.test(n)) && !SECRET_SOURCE.test(value) && !NOT_A_SECRET.test(value.trim());
 }
+var tokenLike = (t) => /^[A-Za-z0-9+/=_.~-]{6,}$/.test(t) && /[0-9]/.test(t) && /[A-Za-z]/.test(t) && !/\.[a-z]{2,5}$/i.test(t) && !pathOfNames(t);
+var pathOfNames = (t) => t.startsWith("/") || t.includes("/") && t.split("/").every((s) => s === "" || NAME_LIKE.some((r) => r.test(s)) || identifierName(s) || fileName(s));
+var fileName = (t) => /^[A-Za-z][\w.-]*\.[A-Za-z]{2,5}$/.test(t);
+var NAME_LIKE = [
+  /^[A-Z]+[0-9]{0,3}(?:_(?:[A-Z]+[0-9]{0,3}|[0-9]{1,4}))*$/,
+  /^[a-z]+[0-9]{0,3}(?:[-_.](?:[a-z]+[0-9]{0,3}|[0-9]{1,4}))*$/
+];
+function identifierName(t) {
+  return NAME_LIKE[0].test(t) && (t.includes("_") || !/[0-9]/.test(t)) || NAME_LIKE[1].test(t) && t.split(/[-_.]/).filter((w) => /[a-z]/.test(w)).length >= 2 || /^[A-Za-z][a-z]+[0-9]{0,3}(?:[A-Z][a-z]+[0-9]{0,3}|[A-Z][0-9]{1,3})+$/.test(t);
+}
+var NO_DEFAULT = /^(true|false|yes|no|on|off|none|null)$/i;
+var REFERENCE_SCHEMES = /* @__PURE__ */ new Set([
+  "env",
+  "vault",
+  "secret",
+  "ref",
+  "secretkeyref",
+  "configmapkeyref",
+  "file",
+  "kvm"
+]);
+var PLACEHOLDER_SCHEMES = /* @__PURE__ */ new Set([
+  ...REFERENCE_SCHEMES,
+  "ssm",
+  "sm",
+  "secretsmanager",
+  "aws",
+  "azure",
+  "keyvault",
+  "gcp",
+  "k8s",
+  "cf",
+  "opt",
+  "self",
+  "sys",
+  "param"
+]);
+function literalDefault(t) {
+  for (const m of t.matchAll(/\$\{([^{}:$]*):(-?)([^}$]*)/g)) {
+    const name = m[1].trim();
+    if (!/^[A-Za-z0-9_.-]+$/.test(name) || PLACEHOLDER_SCHEMES.has(name.toLowerCase()))
+      continue;
+    const d = m[3].trim();
+    if (!m[2] && /^[?+]/.test(d))
+      continue;
+    if (d && !NO_DEFAULT.test(d))
+      return true;
+  }
+  return false;
+}
+var VARIABLE_REFERENCE = [
+  /^\$\{\{[^{}]*\}\}$/,
+  /^\$[A-Za-z_][A-Za-z0-9_]*$/,
+  /^\$\{[A-Za-z_][A-Za-z0-9_.-]*\}$/,
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
+  /^#\{[^{}]*\}$/
+];
+var LITERAL_FILE = /^literal:\s*(?:(?:[\w.-]+\/)+[\w.-]+|[\w-][\w.-]*\.[A-Za-z0-9]{1,10}|\.[\w.-]+|[A-Za-z][\w-]*file)$/i;
+function isReference(t) {
+  if (VARIABLE_REFERENCE.some((r) => r.test(t)) && !literalDefault(t))
+    return true;
+  if (LITERAL_FILE.test(t))
+    return true;
+  if (/^basic:/i.test(t))
+    return isReference(t.slice("basic:".length).trim());
+  if (/^(\$\{|\{\{)/.test(t)) {
+    if (literalDefault(t))
+      return false;
+    let rest2 = t;
+    for (let was = ""; was !== rest2; ) {
+      was = rest2;
+      rest2 = rest2.replace(/\$\{[^{}]*\}|\{\{[^{}]*\}\}/g, "");
+    }
+    return rest2.trim() === "";
+  }
+  const m = /^([A-Za-z][A-Za-z0-9-]*):(.+)$/.exec(t);
+  if (!m)
+    return false;
+  const rest = m[2].trim();
+  return REFERENCE_SCHEMES.has(m[1].toLowerCase()) || /[/:]/.test(rest) || identifierName(rest) || /^(\$\{|\{\{)/.test(rest) && isReference(rest);
+}
+var entropy = (t) => {
+  const n = /* @__PURE__ */ new Map();
+  for (const ch of t)
+    n.set(ch, (n.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const c of n.values())
+    h -= c / t.length * Math.log2(c / t.length);
+  return h;
+};
+var credentialStrength = (t) => {
+  const kinds = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter((r) => r.test(t)).length;
+  return t.length >= 16 && kinds >= 2 || t.length >= 8 && kinds >= 3 || t.length >= 12 && entropy(t) >= 3.5;
+};
+function credentialLike(t) {
+  return tokenLike(t) && !NAME_LIKE.some((r) => r.test(t)) && credentialStrength(t);
+}
+function configSecretField(c) {
+  const secretKey = looksLikeSecret(c.key, "x");
+  if (c.value !== void 0 && (looksLikeSecret(c.key, c.value) || hasSecretShape(c.value) || secretKey && literalDefault(c.value)))
+    return "value";
+  const target = c.target?.trim();
+  const own = new Set([c.key, c.env, target, target?.replace(/\.[^.]*$/, "")].filter((x) => !!x).map((x) => x.trim()));
+  const keyText = c.key.toLowerCase();
+  const source = c.source?.trim();
+  const ownName = (t) => own.has(t) || keyText.includes(t.toLowerCase());
+  const secret = (v, isSource) => {
+    const t = v.trim();
+    if (!t)
+      return false;
+    if (hasSecretShape(t))
+      return true;
+    if (secretKey && literalDefault(t))
+      return true;
+    if (isSource)
+      return secretKey && !isReference(t) && !identifierName(t) && // the file it is read from (`config/app.yml`, `src/Creds.java`)
+      !pathOfNames(t) && !fileName(t) && !NOT_A_SECRET.test(t) && !ownName(t) && // where it lives said in words (`the Kubernetes Secret forge-db`)
+      t.split(/\s+/).filter((w) => /^[A-Za-z]{2,}$/.test(w)).length < 2;
+    return looksLikeSecret(c.key, t) && // a credential, or a password by its marks (`Summer2024!`): no name, version or hash has one
+    (credentialLike(t) || /^\S+$/.test(t) && /[A-Za-z]/.test(t) && /[0-9]/.test(t) && /[!#%^&*?]/.test(t)) && !ownName(t) && (!source || !source.includes(t));
+  };
+  if (source !== void 0 && secret(source, true))
+    return "source";
+  if ((c.cite.with ?? []).some((w) => typeof w?.value === "string" && secret(w.value, false)))
+    return "cite.with";
+  return void 0;
+}
 var ConfigFact = external_exports.strictObject({
   kind: external_exports.literal("config"),
   ...common,
@@ -586,7 +720,7 @@ var ConfigFact = external_exports.strictObject({
       path: ["value"],
       message: `"${c.key}" looks like a secret: give its source (env:NAME, vault:path), never its value`
     });
-  } else if (c.value !== void 0 && hasSecretShape(c.value)) {
+  } else if (c.value !== void 0 && hasSecretShape(c.value, { basic: false })) {
     ctx.addIssue({
       code: "custom",
       path: ["value"],
@@ -1183,8 +1317,121 @@ function migrationOf(path) {
 }
 
 // packages/core/dist/facts.js
+var KNOWN_KINDS = new Set(FACT_KINDS);
+function newerFactOf(json, line) {
+  if (!json || typeof json !== "object" || Array.isArray(json))
+    return void 0;
+  const { kind, id } = json;
+  if (typeof kind !== "string" || typeof id !== "string" || KNOWN_KINDS.has(kind))
+    return void 0;
+  return {
+    ...line !== void 0 ? { line } : {},
+    factId: id,
+    kind,
+    message: `fact ${id} is written by a newer Atticus (fact kind ${kind}); install it to read this fact`
+  };
+}
+var FIELD_NAME = /^[a-z][A-Za-z0-9]*$/;
+var ENUM_VALUE = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/;
+var FIELDS = /* @__PURE__ */ new Map();
+function fieldsOf(kind) {
+  const held = FIELDS.get(kind);
+  if (held)
+    return held;
+  const option = Fact.options.find((o) => o.shape.kind.safeParse(kind).success);
+  const out = [...Object.keys(option?.shape ?? {}), "file", "line", "value", "quote", "with"];
+  FIELDS.set(kind, out);
+  return out;
+}
+function edits(a, b) {
+  if (Math.abs(a.length - b.length) > 2)
+    return 3;
+  const d = [];
+  for (let i = 0; i <= a.length; i++) {
+    d[i] = [i];
+    for (let j = 1; j <= b.length; j++) {
+      if (i === 0) {
+        d[0][j] = j;
+        continue;
+      }
+      let v = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1])
+        v = Math.min(v, d[i - 2][j - 2] + 1);
+      d[i][j] = v;
+    }
+  }
+  return Math.min(d[a.length][b.length], 3);
+}
+var nearFieldOf = (kind, key3) => {
+  if (key3.length <= 3)
+    return false;
+  const k = key3.toLowerCase();
+  return fieldsOf(kind).some((field) => {
+    const f = field.toLowerCase();
+    if (f === k || f[0] !== k[0])
+      return false;
+    const inflected = [`${f}s`, `${f}d`].includes(k) || [`${k}s`, `${k}d`].includes(f);
+    return !inflected && edits(f, k) === 1;
+  });
+};
+var meantValueOf = (v, values) => values.filter((x) => typeof x === "string").map((x) => [x, edits(x, v)]).filter(([, n]) => n <= 2).sort((a, b) => a[1] - b[1])[0]?.[0];
+function sayIssue(json, i) {
+  if (i.code !== "invalid_value")
+    return i;
+  const v = valueAt(json, i.path);
+  if (typeof v !== "string")
+    return i;
+  const kind = json?.kind;
+  if (kind === "dependency" && i.path.length === 1 && i.path[0] === "scope" && v === "system")
+    return { ...i, message: "record a system-scoped dependency as provided" };
+  const meant = ENUM_VALUE.test(v) ? meantValueOf(v, i.values) : void 0;
+  return meant ? { ...i, message: `${i.message} (did you mean "${meant}"?)` } : i;
+}
+var valueAt = (json, path) => {
+  let at3 = json;
+  for (const k of path) {
+    if (!at3 || typeof at3 !== "object")
+      return void 0;
+    at3 = at3[k];
+  }
+  return at3;
+};
+function newerShapeOf(json, issues3, line) {
+  if (!json || typeof json !== "object" || Array.isArray(json) || !issues3.length)
+    return void 0;
+  const { kind, id } = json;
+  if (typeof kind !== "string" || typeof id !== "string" || !KNOWN_KINDS.has(kind))
+    return void 0;
+  const said = [];
+  for (const i of issues3) {
+    const where2 = i.path.map(String).join(".");
+    const near = i.code === "unrecognized_keys" && i.keys.some((k) => nearFieldOf(kind, k));
+    if (i.code === "unrecognized_keys" && !near && i.keys.length && i.keys.every((k) => FIELD_NAME.test(k)))
+      said.push(...i.keys.map((k) => `field ${where2 ? `${where2}.` : ""}${k} is new to the ${kind} fact`));
+    else if (i.code === "invalid_value") {
+      const v = valueAt(json, i.path);
+      if (typeof v !== "string" || !ENUM_VALUE.test(v))
+        return void 0;
+      if (meantValueOf(v, i.values) !== void 0)
+        return void 0;
+      if (kind === "dependency" && where2 === "scope" && v === "system")
+        return void 0;
+      said.push(`${where2} "${v}" is a value this Atticus doesn't know`);
+    } else
+      return void 0;
+  }
+  return {
+    ...line !== void 0 ? { line } : {},
+    factId: id,
+    kind,
+    message: `fact ${id} is written by a newer Atticus (${said.join("; ")}); install it to read this fact`
+  };
+}
 function parseFacts(text4) {
   const trimmed = text4.trim();
+  const facts = [];
+  const issues3 = [];
+  const newer2 = [];
   if (trimmed.startsWith("[")) {
     let json;
     try {
@@ -1192,13 +1439,25 @@ function parseFacts(text4) {
     } catch (e) {
       return { ok: false, issues: [{ code: "not-json", message: e.message }] };
     }
-    const r = FactsFile.safeParse(normalizeFactPaths(json));
-    if (r.success)
-      return { ok: true, facts: r.data };
-    return { ok: false, issues: r.error.issues.map((i) => issueOf(i)) };
+    if (!Array.isArray(json))
+      return { ok: false, issues: [{ code: "invalid_type", message: "(root): not an array" }] };
+    json.forEach((item, i) => {
+      const n = newerFactOf(item);
+      if (n)
+        return void newer2.push(n);
+      const r = Fact.safeParse(normalizeFactPaths(item));
+      if (r.success)
+        facts.push(r.data);
+      else if (newerShapeOf(item, r.error.issues))
+        newer2.push(newerShapeOf(item, r.error.issues));
+      else
+        for (const iss of r.error.issues.map((x) => sayIssue(item, x)))
+          issues3.push({ code: iss.code, message: `${[i, ...iss.path].join(".")}: ${iss.message}` });
+    });
+    if (issues3.length)
+      return { ok: false, issues: issues3 };
+    return { ok: true, facts, ...newer2.length ? { newer: newer2 } : {} };
   }
-  const facts = [];
-  const issues3 = [];
   const lines = trimmed === "" ? [] : trimmed.split(/\r?\n/);
   lines.forEach((raw, i) => {
     const line = i + 1;
@@ -1211,12 +1470,17 @@ function parseFacts(text4) {
       issues3.push({ line, code: "not-json", message: e.message });
       return;
     }
+    const n = newerFactOf(json, line);
+    if (n)
+      return void newer2.push(n);
     const r = Fact.safeParse(normalizeFactPaths(json));
     if (r.success)
       facts.push(r.data);
+    else if (newerShapeOf(json, r.error.issues, line))
+      newer2.push(newerShapeOf(json, r.error.issues, line));
     else
       for (const iss of r.error.issues)
-        issues3.push({ line, ...issueOf(iss) });
+        issues3.push({ line, ...issueOf(sayIssue(json, iss)) });
   });
   const seen = /* @__PURE__ */ new Map();
   facts.forEach((f, i) => {
@@ -1226,11 +1490,60 @@ function parseFacts(text4) {
     else
       seen.set(f.id, i);
   });
-  return issues3.length ? { ok: false, issues: issues3 } : { ok: true, facts };
+  return issues3.length ? { ok: false, issues: issues3 } : { ok: true, facts, ...newer2.length ? { newer: newer2 } : {} };
 }
 function issueOf(i) {
   return { code: i.code, message: `${i.path.join(".") || "(root)"}: ${i.message}` };
 }
+var REDACTED = "<redacted>";
+function redactFactLine(raw) {
+  const text4 = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
+  let json;
+  try {
+    json = JSON.parse(text4);
+  } catch {
+    const out2 = redactSecrets(raw).replace(/"((?:[^"\\]|\\.){6,})"/g, (all, v) => credentialLike(v) || hasSecretShape(v) ? `"${REDACTED}"` : all);
+    const key4 = /"key"\s*:\s*"((?:[^"\\]|\\.)*)"/.exec(out2)?.[1];
+    if (key4 === void 0 || !looksLikeSecret(key4, "x"))
+      return out2;
+    return out2.replace(/("(?:value|source|quote)"\s*:\s*)"(?:[^"\\]|\\.)*("|$)/g, (_, head, end) => `${head}"${REDACTED}${end}`);
+  }
+  if (!json || typeof json !== "object" || Array.isArray(json))
+    return raw;
+  const f = json;
+  const str3 = (v) => typeof v === "string" ? v : void 0;
+  const cite = f.cite && typeof f.cite === "object" && !Array.isArray(f.cite) ? f.cite : {};
+  const withs = Array.isArray(cite.with) ? cite.with : [];
+  const parts = withs.map((w) => w && typeof w === "object" ? str3(w.value) : void 0);
+  const key3 = str3(f.key);
+  const strings = [str3(f.value), str3(f.source), ...parts].filter((x) => !!x);
+  const quote = str3(cite.quote);
+  const quoteHolds = quote !== void 0 && key3 !== void 0 && looksLikeSecret(key3, "x") && quote.split(/[\s"'`:=,;{}()<>[\]]+/).some((w) => credentialLike(w));
+  const secret = key3 !== void 0 && !!configSecretField({
+    key: key3,
+    value: str3(f.value),
+    source: str3(f.source),
+    target: str3(f.target),
+    env: str3(f.env),
+    cite: { with: parts.flatMap((v) => v === void 0 ? [] : [{ value: v }]) }
+  }) || strings.some((s) => hasSecretShape(s)) || quoteHolds || quote !== void 0 && redactSecrets(quote) !== quote;
+  if (!secret)
+    return raw;
+  const out = { ...f };
+  if (str3(f.value) !== void 0)
+    out.value = REDACTED;
+  if (str3(f.source) !== void 0)
+    out.source = REDACTED;
+  if (Object.keys(cite).length) {
+    const c = { ...cite };
+    if (c.quote !== void 0)
+      c.quote = REDACTED;
+    if (withs.length)
+      c.with = withs.map((w) => w && typeof w === "object" ? { ...w, value: REDACTED } : REDACTED);
+    out.cite = c;
+  }
+  return JSON.stringify(out);
+}
 function parseFactLine(raw, line, seen) {
   if (raw.trim() === "")
     return {};
@@ -1242,11 +1555,22 @@ function parseFactLine(raw, line, seen) {
     const message = text4.includes("\0") ? "the file is UTF-16 (PowerShell's Out-File writes it): save it as UTF-8, one JSON fact per line" : e.message;
     return { bad: { line, raw, issues: [{ line, code: "not-json", message }] } };
   }
+  const newer2 = newerFactOf(json, line);
+  if (newer2)
+    return { newer: { ...newer2, raw } };
   const r = Fact.safeParse(normalizeFactPaths(json));
-  if (!r.success)
+  if (!r.success) {
+    const shape = newerShapeOf(json, r.error.issues, line);
+    if (shape)
+      return { newer: { ...shape, raw } };
     return {
-      bad: { line, raw, issues: r.error.issues.map((iss) => ({ line, ...issueOf(iss) })) }
+      bad: {
+        line,
+        raw,
+        issues: r.error.issues.map((iss) => ({ line, ...issueOf(sayIssue(json, iss)) }))
+      }
     };
+  }
   if (seen.has(r.data.id))
     return {
       bad: {
@@ -1268,6 +1592,7 @@ function parseFactLine(raw, line, seen) {
 function parseFactsLines(text4) {
   const facts = [];
   const bad = [];
+  const newer2 = [];
   const seen = /* @__PURE__ */ new Set();
   text4.split(/\r?\n/).forEach((raw, i) => {
     const r = parseFactLine(raw, i + 1, seen);
@@ -1275,8 +1600,10 @@ function parseFactsLines(text4) {
       facts.push(r.fact);
     else if (r.bad)
       bad.push(r.bad);
+    else if (r.newer)
+      newer2.push(r.newer);
   });
-  return { facts, bad };
+  return { facts, bad, newer: newer2 };
 }
 function serializeFacts(facts) {
   const sorted2 = [...facts].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
@@ -1288,6 +1615,18 @@ function entryEndpointId(f, component) {
   const name = f.entryType === "event-topic" || f.entryType === "mq-queue" ? `on-${idPart(f.path)}` : idPart(`${f.method ?? ""} ${f.path}`);
   return `${component}.${name}`;
 }
+function placedComponentOf(f, manifest) {
+  if (f.component === void 0 || f.kind === "artifact" || f.kind === "dependency")
+    return;
+  if (manifest.modules?.length || manifest.prototype)
+    return;
+  const c = idPart(f.component);
+  if (c === idPart(manifest.component))
+    return;
+  if (manifest.components.some((x) => idPart(x) === c))
+    return;
+  return manifest.component;
+}
 function callPath(callType, path) {
   if (callType === "grpc" || callType === "soap")
     return path.trim().replace(/^\/+/, "");
@@ -2383,6 +2722,7 @@ var ignoreOption = () => ({
   means: "These aren't real calls: a CI/CD job, a test or a template, not code that runs",
   changes: "The join leaves these calls (ignored by you), no box is drawn for them, and this isn't asked again"
 });
+var IGNORE_REASON_MAX = 300;
 var ignoreText = (reason) => `${IGNORE_PREFIX} ${reason.trim()}`;
 function ignoredAnswer(q2) {
   const a = q2.answer;
@@ -2399,18 +2739,17 @@ function ignoredAnswer(q2) {
   return reason ? { reason } : {};
 }
 var SYSTEM_NAME_MAX = 40;
-var SENTENCE_WORDS = /* @__PURE__ */ new Set([
-  "ignore",
-  "this",
-  "is",
-  "a",
-  "to",
-  "the",
-  "related",
-  "not",
-  "its",
-  "it"
-]);
+var SENTENCE_WORDS = /* @__PURE__ */ new Set(["this", "is", "a", "to", "the", "not", "its", "it"]);
+var sentenceWordsIn = (words) => words.trim().toLowerCase().split(/[\s_'’,;:!?."“”()-]+/).filter((w) => SENTENCE_WORDS.has(w)).length;
+function nameReadsAsSentence(name) {
+  return sentenceWordsIn(name) >= 2;
+}
+function readsAsSentence(words) {
+  const n = words.trim();
+  if (/[,;!?"“”]|\.(?:\s|$)/.test(n))
+    return true;
+  return sentenceWordsIn(n) >= 2;
+}
 function systemNameProblem(name) {
   const n = name.trim();
   if (!n)
@@ -2419,27 +2758,21 @@ function systemNameProblem(name) {
     return `a system's name is at most ${SYSTEM_NAME_MAX} characters (this is ${n.length})`;
   if (!/^[A-Za-z0-9][A-Za-z0-9 -]*$/.test(n))
     return "a system's name is letters, digits, spaces and dashes only";
-  const words = n.toLowerCase().split(/[\s-]+/).filter(Boolean);
-  if (words.length > 4 || words.some((w) => SENTENCE_WORDS.has(w)))
+  if (readsAsSentence(n))
     return "that reads as a sentence, not a system's name";
   return void 0;
 }
-function madeFromWords(id, name) {
-  const words = id.toLowerCase().split(/[-_.]+/).filter(Boolean);
-  if (words.length >= 5)
-    return true;
-  if (words.some((w) => SENTENCE_WORDS.has(w)))
-    return true;
-  const n = name?.trim() ?? "";
-  return /\s/.test(n) && n.length > SYSTEM_NAME_MAX;
-}
-async function namesKnownTarget(root, words) {
-  const { loadOrgPack } = await import("./chunk-RSKMV3VC.js");
+async function knownTargetNames(root, o = {}) {
+  const { loadOrgPack } = await import("./chunk-3D74UADA.js");
   const op = await loadOrgPack(orgPackDirOf(root)).catch(() => void 0);
+  const ids = /* @__PURE__ */ new Set();
   const names = /* @__PURE__ */ new Set();
-  const add = (n) => {
+  const systemNames = /* @__PURE__ */ new Set();
+  const add = (n, isId = true) => {
     if (!n?.trim())
       return;
+    if (isId)
+      ids.add(n.trim().toLowerCase());
     names.add(n.trim().toLowerCase());
     names.add(slugify(n));
   };
@@ -2450,15 +2783,18 @@ async function namesKnownTarget(root, words) {
       for (const m of r.modules ?? [])
         add(m.component);
     }
-    for (const s of p2.profile?.systems ?? [])
-      for (const n of [s.id, s.name, ...s.aliases, ...s.topics ?? []])
+    for (const s of p2.profile?.systems ?? []) {
+      if (o.except?.has(s.id))
+        continue;
+      for (const n of [s.id, ...s.aliases, ...s.topics ?? []])
         add(n);
+      add(s.name, false);
+      if (s.name.trim() && !nameReadsAsSentence(s.name))
+        systemNames.add(s.name.trim().toLowerCase());
+    }
   }
   for (const t of op?.roles?.teams ?? [])
     add(t.id);
-  const want = words.trim().toLowerCase();
-  if (names.has(want) || names.has(slugify(words)))
-    return true;
   const dir = factsDirOf(root);
   for (const f of await readdir2(dir).catch(() => [])) {
     if (!/^[^.][^/]*\.jsonl$/.test(f) || /\.(corrections|reviewed|rejected)\.jsonl$/.test(f))
@@ -2466,10 +2802,21 @@ async function namesKnownTarget(root, words) {
     const text4 = await readFile2(join3(dir, f), "utf8").catch(() => "");
     for (const m of text4.matchAll(/"component"\s*:\s*"([^"]+)"/g))
       add(m[1]);
-    if (names.has(want) || names.has(slugify(words)))
-      return true;
   }
-  return false;
+  return { ids, names, systemNames };
+}
+function namesKnown(known, words) {
+  const want = words.trim().toLowerCase();
+  if (!want)
+    return false;
+  if (known.systemNames?.has(want))
+    return true;
+  if (readsAsSentence(want))
+    return known.ids.has(want);
+  return known.names.has(want) || known.names.has(slugify(words));
+}
+async function namesKnownTarget(root, words, o = {}) {
+  return namesKnown(await knownTargetNames(root, o), words);
 }
 var wordsNameNothing = (words) => `"${words.length > 60 ? `${words.slice(0, 57)}...` : words}" names no repo, component or system Atticus knows, so it isn't made into a box on the map. Pick a repo or system; or choose "An outside system (new)" and type its name (a short name: letters, digits, spaces and dashes, up to ${SYSTEM_NAME_MAX} characters, not a sentence); or choose "${JOIN_IGNORE_LABEL}" if these aren't real calls.`;
 var HOSTS_OUTSIDE_INTERNAL = "An outside system (new): another team's";
@@ -2489,7 +2836,7 @@ function hostOfQuestion(q2) {
   return /^Which repo answers on (\S+)\?$/.exec(q2.question.trim())?.[1];
 }
 function joinHostOfQuestion(q2) {
-  return /^Which repo answers on (\S+)\?(?:\s|$)/.exec(q2.question.trim())?.[1];
+  return /^Which repo answers on (\S(?:.*?\S)?)\?(?:\s|$)/.exec(q2.question.trim())?.[1];
 }
 var WHOLE_TOKEN = [
   /^@([A-Za-z_][A-Za-z0-9_.-]*)@$/,
@@ -2509,6 +2856,36 @@ async function platformsOf(root) {
   const names = await readdir2(profiles, { withFileTypes: true }).catch(() => []);
   return names.filter((x) => x.isDirectory()).map((x) => ({ dir: join3(profiles, x.name), platform: x.name })).sort((a, b) => cmpText(a.platform, b.platform));
 }
+var unpadded = (line) => line.replace(/([[{]) +/g, "$1").replace(/ +([\]}])/g, "$1").replace(/[ \t]+#/g, " #").replace(/[ \t]+$/, "");
+function profileText(doc, before) {
+  const was = before === void 0 ? void 0 : lfOnly(before);
+  const out = doc.toString({
+    lineWidth: 0,
+    flowCollectionPadding: was === void 0 ? true : /[[{] \S/.test(was)
+  });
+  if (was === void 0)
+    return out;
+  const kept = /* @__PURE__ */ new Map();
+  for (const l of was.split("\n"))
+    if (!kept.has(unpadded(l)))
+      kept.set(unpadded(l), l);
+  const text4 = out.split("\n").map((l) => kept.get(unpadded(l)) ?? l).join("\n");
+  return was && !was.endsWith("\n") ? text4.replace(/\n+$/, "") : text4;
+}
+var ProfileEditError = class extends Error {
+};
+function aliasesLeftOf(doc) {
+  const anchors = /* @__PURE__ */ new Set();
+  const left = [];
+  (0, import_yaml6.visit)(doc, (_key, node) => {
+    if ((0, import_yaml6.isAlias)(node)) {
+      if (!anchors.has(node.source) && !left.includes(node.source))
+        left.push(node.source);
+    } else if ((0, import_yaml6.isNode)(node) && node.anchor)
+      anchors.add(node.anchor);
+  });
+  return left;
+}
 async function addOutsideSystem(root, repo, host, boundary) {
   const platforms = await platformsOf(root);
   const sys = outsideSystemOf(host);
@@ -2532,10 +2909,10 @@ async function addOutsideSystem(root, repo, host, boundary) {
     const file = join3(dir, "profile.yaml");
     const rel = `${isAdopted(root) ? ".atticus/" : ""}org-pack/profiles/${platform}/profile.yaml`;
     const before = await readFile2(file, "utf8").catch(() => void 0);
-    const doc = (0, import_yaml6.parseDocument)(before ?? `schemaVersion: 1
+    const doc = (0, import_yaml6.parseDocument)(before === void 0 ? `schemaVersion: 1
 platform: ${platform}
 name: ${platform}
-`);
+` : lfOnly(before));
     let systems = doc.get("systems");
     if (!(0, import_yaml6.isSeq)(systems)) {
       doc.set("systems", doc.createNode([]));
@@ -2545,7 +2922,7 @@ name: ${platform}
     const checked = Profile.safeParse(doc.toJS());
     if (!checked.success)
       throw new Error(`${rel} would not be valid: ${checked.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`);
-    await writeFileIfUnchanged(file, before, inEol(doc.toString(), eolOf(before ?? "")));
+    await writeFileIfUnchanged(file, before, inEol(profileText(doc, before), eolOf(before ?? "")));
     return { id: sys.id, profile: rel, added: true };
   }
   throw new Error(`${repo} isn't in any repos.manifest.yaml`);
@@ -2580,7 +2957,7 @@ async function addProfileSystem(root, repo, s, o = {}) {
         else
           node.set("topics", doc.createNode([...had.topics ?? [], ...missing]));
         valid(doc, platform);
-        await writeFileIfUnchanged(file, text4, inEol(doc.toString(), eolOf(text4)));
+        await writeFileIfUnchanged(file, text4, inEol(profileText(doc, text4), eolOf(text4)));
       }
     }
     return {
@@ -2621,12 +2998,13 @@ name: ${platform}
       ...topics.length ? { topics: [...topics] } : {}
     }));
     valid(doc, platform);
-    const after = doc.toString({ lineWidth: 0, flowCollectionPadding: true });
+    const after = profileText(doc, before);
     const changes = changedLines(before ?? "", after);
+    const write2 = { file, before: raw, after: inEol(after, eol) };
     if (o.preview)
-      return { id: s.id, profile: relOf(platform), added: true, changes };
-    await writeFileIfUnchanged(file, raw, inEol(after, eol));
-    return { id: s.id, profile: relOf(platform), added: true, changes };
+      return { id: s.id, profile: relOf(platform), added: true, changes, write: write2 };
+    await writeFileIfUnchanged(file, raw, write2.after);
+    return { id: s.id, profile: relOf(platform), added: true, changes, write: write2 };
   }
   throw new Error(`${repo} isn't in any repos.manifest.yaml`);
 }
@@ -2650,17 +3028,33 @@ async function editProfileSystem(root, id, o = {}) {
         node.set("id", o.rename.id);
         node.set("name", o.rename.name);
       }
-    } else
-      seq.items.splice(at3, 1);
+    } else {
+      const [gone] = seq.items.splice(at3, 1);
+      const lead = gone?.commentBefore;
+      if (lead) {
+        const next = seq.items[at3];
+        if (next)
+          next.commentBefore = next.commentBefore ? `${lead}
+${next.commentBefore}` : lead;
+        else
+          seq.comment = seq.comment ? `${lead}
+${seq.comment}` : lead;
+      }
+    }
+    const left = aliasesLeftOf(doc);
+    if (left.length)
+      throw new ProfileEditError(`${id} holds the YAML anchor ${left.map((a) => `&${a}`).join(", ")} in ${rel}, which other lines use (${left.map((a) => `*${a}`).join(", ")}): Atticus doesn't ${o.rename ? "rename" : "take out"} it, as they would name nothing. Write the value in place of ${left.map((a) => `*${a}`).join(", ")} by hand (or move the anchor to another line), then do this again.`);
     const checked = Profile.safeParse(doc.toJS());
     if (!checked.success)
       throw new Error(`${rel} would not be valid: ${checked.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`);
-    const after = doc.toString({ lineWidth: 0, flowCollectionPadding: true });
+    const after = profileText(doc, raw);
     const changes = changedLines(lfOnly(raw), after);
+    const text4 = inEol(after, eolOf(raw));
+    const out = { profile: rel, changes, file, before: raw, after: text4 };
     if (o.preview)
-      return { profile: rel, changes, written: false };
-    await writeFileIfUnchanged(file, raw, inEol(after, eolOf(raw)));
-    return { profile: rel, changes, written: true };
+      return { ...out, written: false };
+    await writeFileIfUnchanged(file, raw, text4);
+    return { ...out, written: true };
   }
   return void 0;
 }
@@ -2903,22 +3297,39 @@ function urlPathOf(s) {
   const m = s ? /^[a-z][a-z0-9+.-]*:\/\/[^/?#]+(\/[^?#]*)/i.exec(s.trim()) : null;
   return m && m[1] !== "/" ? m[1] : void 0;
 }
+function pathAroundPlaceholder(s) {
+  const t = (s ?? "").trim();
+  const p2 = urlPathOf(t) ?? (() => {
+    const ph = placeholderIn(t);
+    if (!ph || ph.before.trim())
+      return void 0;
+    const after = ph.after.split(/[?#]/, 1)[0] ?? "";
+    return after.startsWith("/") && after !== "/" ? after : void 0;
+  })();
+  return p2 && !placeholderIn(p2) ? p2 : void 0;
+}
 var PUBLIC_TLDS = /* @__PURE__ */ new Set([
   "com",
   "net",
   "org",
   "io",
-  "dev",
-  "app",
-  "cloud",
   "ai",
+  "co",
+  "cloud",
   "biz",
   "info",
-  "co",
   "tech",
+  "xyz",
+  "gov",
+  "edu",
+  "mil",
+  "example"
+]);
+var PUBLIC_TLDS_3 = /* @__PURE__ */ new Set([
+  "dev",
+  "app",
   "online",
   "site",
-  "xyz",
   "pro",
   "services",
   "solutions",
@@ -2932,13 +3343,7 @@ var PUBLIC_TLDS = /* @__PURE__ */ new Set([
   "group",
   "company",
   "network",
-  "software",
-  "api",
-  "gov",
-  "edu",
-  "mil",
-  "int",
-  "example"
+  "software"
 ]);
 var TWO_PART_SUFFIXES = /* @__PURE__ */ new Set([
   "co.uk",
@@ -2995,11 +3400,13 @@ function registrableDomain(host) {
   if (ls.length < 2 || ls.some((l) => !l))
     return void 0;
   const tld = ls.at(-1);
-  if (!PUBLIC_TLDS.has(tld) && !/^[a-z]{2}$/.test(tld))
-    return void 0;
   if (TWO_PART_SUFFIXES.has(ls.slice(-2).join(".")))
     return ls.length >= 3 ? ls.slice(-3).join(".") : void 0;
-  return ls.slice(-2).join(".");
+  if (PUBLIC_TLDS.has(tld))
+    return ls.slice(-2).join(".");
+  if ((PUBLIC_TLDS_3.has(tld) || /^[a-z]{2}$/.test(tld)) && ls.length >= 3)
+    return ls.slice(-2).join(".");
+  return void 0;
 }
 var joinPaths = (base, path) => base ? `${base.replace(/\/+$/, "")}/${(path ?? "").replace(/^\/+/, "")}` : path;
 function hostIn(s) {
@@ -3026,46 +3433,48 @@ var TOKEN_FORMS = [
   /@([A-Za-z_][A-Za-z0-9_.-]*)@/,
   /\{\{\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*\}\}/
 ];
+var CAMEL_SIMPLE = /^(headers?|body|in\.(headers?|body)|out\.(headers?|body)|exchangeProperty|exchangeId|camelContext|routeId|messageTimestamp)(\.|$|\[)/;
 function placeholderIn(s) {
   const t = (s ?? "").trim();
   const env = /^env:([A-Za-z_][A-Za-z0-9_.-]*)$/i.exec(t);
   if (env)
     return { name: env[1], before: "", after: "" };
-  const i = t.indexOf("${");
-  if (i < 0) {
-    const found = TOKEN_FORMS.flatMap((re) => {
-      const m = re.exec(t);
-      return m ? [m] : [];
-    }).sort((a, b) => a.index - b.index)[0];
-    if (!found)
-      return void 0;
-    return {
-      name: found[1],
-      before: t.slice(0, found.index),
-      after: t.slice(found.index + found[0].length)
-    };
-  }
-  let depth = 0;
-  let j = i + 2;
-  for (; j < t.length; j++) {
-    if (t[j] === "{")
-      depth++;
-    else if (t[j] === "}") {
-      if (depth === 0)
-        break;
-      depth--;
+  let dollar;
+  for (let i = t.indexOf("${"); i >= 0 && !dollar; i = t.indexOf("${", i + 2)) {
+    let depth = 0;
+    let j = i + 2;
+    for (; j < t.length; j++) {
+      if (t[j] === "{")
+        depth++;
+      else if (t[j] === "}") {
+        if (depth === 0)
+          break;
+        depth--;
+      }
     }
-  }
-  if (j >= t.length)
-    return void 0;
-  const inner = t.slice(i + 2, j);
-  const after = t.slice(j + 1);
-  const colon = inner.indexOf(":");
-  const name = (colon < 0 ? inner : inner.slice(0, colon)).trim();
-  if (!/^[A-Za-z_][A-Za-z0-9_.[\]-]*$/.test(name))
+    if (j >= t.length)
+      break;
+    const inner = t.slice(i + 2, j);
+    const colon = inner.indexOf(":");
+    const name = (colon < 0 ? inner : inner.slice(0, colon)).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_.[\]-]*$/.test(name) || CAMEL_SIMPLE.test(name))
+      continue;
+    const fallback = colon < 0 ? void 0 : inner.slice(colon + 1).trim();
+    dollar = { at: i, end: j + 1, name, ...fallback ? { fallback } : {} };
+  }
+  const token = TOKEN_FORMS.flatMap((re) => {
+    const m = re.exec(t);
+    return m ? [{ at: m.index, end: m.index + m[0].length, name: m[1] }] : [];
+  }).sort((a, b) => a.at - b.at)[0];
+  const first = [dollar, token].filter((x) => !!x).sort((a, b) => a.at - b.at)[0];
+  if (!first)
     return void 0;
-  const fallback = colon < 0 ? void 0 : inner.slice(colon + 1).trim();
-  return { name, ...fallback ? { fallback } : {}, before: t.slice(0, i), after };
+  return {
+    name: first.name,
+    ...first.fallback ? { fallback: first.fallback } : {},
+    before: t.slice(0, first.at),
+    after: t.slice(first.end)
+  };
 }
 var settingNameKey = (name) => name.toUpperCase().replace(/[^A-Z0-9]/g, "");
 function keyRefIn(s) {
@@ -3450,6 +3859,12 @@ function joinFacts(input) {
     };
   };
   const outside = new Set((input.outside ?? []).map(factIdPart));
+  const outsideByHost = (h) => {
+    if (outside.has(factIdPart(h)))
+      return h;
+    const bare = h.replace(/:\d+$/, "");
+    return bare !== h && outside.has(factIdPart(bare)) ? bare : void 0;
+  };
   const joins = [];
   const asks = [];
   const misses = [];
@@ -3737,8 +4152,28 @@ function joinFacts(input) {
     ...b.by.length ? { by: uniqueEnds(b.by) } : {}
   });
   const replacedFor = (call) => {
-    const cited = [call.fact.cite, ...call.fact.cite.with ?? []].map((p2) => (p2.file.split("/").pop() ?? p2.file).toLowerCase());
-    const names = new Set(cited.flatMap((b) => [b, b.replace(/\.[^.]*$/, "")]));
+    const parts = [call.fact.cite, ...call.fact.cite.with ?? []];
+    const urlText = (call.fact.host ?? call.fact.base ?? "").trim();
+    const writing = urlText ? parts.filter((p2) => p2.value.trim() === urlText) : [];
+    const cited = (writing.length ? writing : parts).map((p2) => p2.file);
+    const rootFits = (file, xpath) => {
+      const root = /^\/([A-Za-z]+)/.exec(xpath.trim())?.[1]?.toLowerCase();
+      const folder2 = file.split("/").at(-2)?.toLowerCase();
+      if (folder2 === "targets")
+        return root === "targetendpoint";
+      if (folder2 === "proxies")
+        return root === "proxyendpoint";
+      if (folder2 === "policies")
+        return root !== "targetendpoint" && root !== "proxyendpoint";
+      return true;
+    };
+    const forCited = (target, xpath) => {
+      const t = target.trim().toLowerCase();
+      return cited.some((file) => {
+        const b = (file.split("/").pop() ?? file).toLowerCase();
+        return (b === t || b.replace(/\.[^.]*$/, "") === t) && rootFits(file, xpath);
+      });
+    };
     const home = bundleHomeOf(call.fact.cite.file);
     const homes = home === void 0 ? void 0 : bundleHomesOf(call.repo);
     const ownedBy = (file) => homes.filter((h) => file.startsWith(h)).sort((a, b) => b.length - a.length)[0] ?? (homes.length === 1 ? homes[0] : void 0);
@@ -3747,7 +4182,7 @@ function joinFacts(input) {
       const p2 = v && /^\s*(@[^@\s]+@|\{\{[^}]+\}\})\s*$/.test(v) ? placeholderIn(v) : void 0;
       return p2 ? [p2.name] : [];
     });
-    return (configsByRepo.get(call.repo) ?? []).filter((n) => !!n.fact.target && names.has(n.fact.target.trim().toLowerCase()) && n.fact.key.trim().startsWith("/") && /^[a-z][a-z0-9+.-]*:\/\//i.test((n.fact.value ?? "").trim()) && !!hostIn(n.fact.value) && (home === void 0 || ownedBy(n.fact.cite.file) === home) && (() => {
+    return (configsByRepo.get(call.repo) ?? []).filter((n) => !!n.fact.target && forCited(n.fact.target, n.fact.key) && n.fact.key.trim().startsWith("/") && /^[a-z][a-z0-9+.-]*:\/\//i.test((n.fact.value ?? "").trim()) && !!hostIn(n.fact.value) && (home === void 0 || ownedBy(n.fact.cite.file) === home) && (() => {
       const said = tokenNames(n);
       return !said.length || !!wanted && said.includes(wanted);
     })()).sort((x, y) => cmp(x.fact.id, y.fact.id)).map((n) => ({ value: n.fact.value.trim(), through: [n], guesses: [] }));
@@ -3768,8 +4203,86 @@ function joinFacts(input) {
       return !!d && !known2.has(d);
     }))
       return false;
-    const whole = configs.length ? configs.map((x) => joinPaths(urlPathOf(x.value), call.fact.path)) : [fullPath ?? call.fact.path];
-    return ![...new Set(whole)].some((p2) => !!p2 && serving({ ...call, fact: { ...call.fact, path: p2 } }, () => true, true).length);
+    if (!configs.length) {
+      const p2 = fullPath ?? call.fact.path;
+      return !(p2 && servedSomewhere(call, p2));
+    }
+    const urls = [...new Set(configs.map((x) => x.value))].sort(cmp);
+    if (urls.some((u) => {
+      const p2 = urlPathOf(u);
+      return !!p2 && isOwnBase(call.component, p2);
+    }))
+      return false;
+    const k = `${call.repo}\0${bundleRootOf(call.fact.cite.file) ?? ""}\0${call.fact.host ?? ""}\0${call.fact.base ?? ""}\0${urls.join("\0")}`;
+    let served = targetServed.get(k);
+    if (served === void 0) {
+      const root = bundleRootOf(call.fact.cite.file);
+      served = nodes.some((n) => n.fact.kind === "call" && n.repo === call.repo && n.fact.callType === "rest" && (n.fact.host ?? "") === (call.fact.host ?? "") && (n.fact.base ?? "") === (call.fact.base ?? "") && bundleRootOf(n.fact.cite.file) === root && urls.some((u) => {
+        const p2 = joinPaths(urlPathOf(u), n.fact.path);
+        return !!p2 && servedSomewhere(n, p2);
+      }));
+      targetServed.set(k, served);
+    }
+    return !served;
+  };
+  const targetServed = /* @__PURE__ */ new Map();
+  const genericBase = (segs2) => segs2.every((s) => /^(v\d+(\.\d+)*|api|rest|services)$/i.test(s));
+  const ownBaseSeen = /* @__PURE__ */ new Map();
+  let baseOwners;
+  const ownersOfBases = () => {
+    if (baseOwners)
+      return baseOwners;
+    const seen = /* @__PURE__ */ new Set();
+    baseOwners = [];
+    for (const n of [...entries, ...nodes]) {
+      const k = key3(n.repo, n.component);
+      if (seen.has(k))
+        continue;
+      seen.add(k);
+      baseOwners.push(n);
+    }
+    return baseOwners;
+  };
+  const isOwnBase = (component, p2) => {
+    const segs2 = rawSegs(p2);
+    if (genericBase(segs2))
+      return false;
+    const k = `${component}\0${segs2.join("/").toLowerCase()}`;
+    const was = ownBaseSeen.get(k);
+    if (was !== void 0)
+      return was;
+    const done = /* @__PURE__ */ new Set();
+    let got = false;
+    for (const e of ownersOfBases()) {
+      if (e.component === component)
+        continue;
+      const ek = key3(e.repo, e.component);
+      if (done.has(ek))
+        continue;
+      done.add(ek);
+      if (basesOf(e).some((b) => b.segs.length === segs2.length && startsWithSegs(segs2, b.segs))) {
+        got = true;
+        break;
+      }
+    }
+    ownBaseSeen.set(k, got);
+    return got;
+  };
+  const servedSomewhere = (call, p2) => {
+    if (serving({ ...call, fact: { ...call.fact, path: p2 } }, () => true, true).length)
+      return true;
+    if (call.fact.callType !== "rest")
+      return false;
+    const segs2 = rawSegs(p2);
+    return routeCandidates(p2).some((e) => {
+      if (e.component === call.component || !SERVES.rest.includes(e.fact.entryType) || !sameMethod(call.fact.method, e.fact.method))
+        return false;
+      const gatewayRoute = gatewayRepos.has(e.repo) || !!bundleRootOf(e.fact.cite.file);
+      if (gatewayRoute && isPassThrough(e.fact))
+        return false;
+      const least = gatewayRoute ? 400 : 100;
+      return basesOf(e).some((b) => b.segs.length > 0 && b.segs.length < segs2.length && startsWithSegs(segs2, b.segs) && routeScore(toPath(segs2.slice(b.segs.length)), e.fact.path) >= least);
+    });
   };
   const gatewayRepos = new Set(repos.filter((r) => r.gateway).map((r) => r.repo));
   const isForwarding = (c) => c.fact.callType === "rest" && (!!bundleRootOf(c.fact.cite.file) || gatewayRepos.has(c.repo));
@@ -3810,7 +4323,8 @@ function joinFacts(input) {
     const { byFirst, all } = baseRoutesOf();
     const first = segKey(segs2[0]);
     const pool = first === "{}" ? all : [...byFirst.get(first) ?? [], ...byFirst.get("{}") ?? []];
-    const under2 = pool.filter((x) => x.r.component !== c.component && x.base.length < segs2.length && startsWithSegs(segs2, x.base));
+    const ownBundle = bundleRootOf(c.fact.cite.file);
+    const under2 = pool.filter((x) => (x.r.component !== c.component || !!ownBundle && proxyOf(x.r) !== key3(c.repo, ownBundle)) && x.base.length < segs2.length && startsWithSegs(segs2, x.base));
     if (!under2.length)
       return void 0;
     const longest2 = Math.max(...under2.map((x) => x.base.length));
@@ -3897,7 +4411,15 @@ function joinFacts(input) {
       ...throughEnds.length ? { through: throughEnds } : {}
     };
     const host = hostIn(f.host) ?? (used[0] ? hostIn(used[0].value) : void 0) ?? (keyed.length ? void 0 : hostIn(f.base));
-    const fullPath = joinPaths(urlPathOf(f.host) ?? (used[0] ? urlPathOf(used[0].value) : void 0) ?? (keyed.length ? void 0 : urlPathOf(f.base)), f.path);
+    const unresolvedBase = () => {
+      if (host)
+        return void 0;
+      if (!keyed.length)
+        return pathAroundPlaceholder(f.host) ?? pathAroundPlaceholder(f.base);
+      const ps = new Set(keyed.map((t) => pathAroundPlaceholder(t.fact.value ?? t.fact.source)));
+      return ps.size === 1 ? [...ps][0] : void 0;
+    };
+    const fullPath = joinPaths(urlPathOf(f.host) ?? (used[0] ? urlPathOf(used[0].value) : void 0) ?? (keyed.length ? void 0 : urlPathOf(f.base)) ?? unresolvedBase(), f.path);
     const answer = input.targets?.[call.repo]?.[f.id];
     const aiAnswer = answer ? input.aiTargets?.[call.repo]?.[f.id] : void 0;
     const onFile = input.pairs?.[call.repo]?.[f.id];
@@ -4002,10 +4524,10 @@ function joinFacts(input) {
       exposedBy = d.by;
       disputed = d.disputed;
       byServiceName = d.byServiceName;
-    } else if (host && outside.has(factIdPart(host.named ? `${host.host}:${host.named}` : host.host))) {
+    } else if (host && outsideByHost(host.named ? `${host.host}:${host.named}` : host.host)) {
       outsideCalls.push({
         call: end(call),
-        target: host.named ? `${host.host}:${host.named}` : host.host
+        target: outsideByHost(host.named ? `${host.host}:${host.named}` : host.host)
       });
       continue;
     } else if (host && components.has(factIdPart(host.host.split(".")[0]))) {
@@ -4016,11 +4538,11 @@ function joinFacts(input) {
     } else if (f.to && (host || outside.has(factIdPart(f.to)))) {
       outsideCalls.push({ call: end(call), target: f.to });
       continue;
-    } else if (host && isForwarding(call) && (forwardHosts(configs, host).some((h) => outside.has(factIdPart(h))) || outsideOfEstate(call, configs, host, fullPath))) {
+    } else if (host && isForwarding(call) && (forwardHosts(configs, host).some((h) => !!outsideByHost(h)) || outsideOfEstate(call, configs, host, fullPath))) {
       const hosts = forwardHosts(configs, host);
       outsideCalls.push({
         call: end(call),
-        target: hosts.find((h) => outside.has(factIdPart(h))) ?? hosts[0]
+        target: hosts.map(outsideByHost).find((h) => !!h) ?? hosts[0]
       });
       continue;
     } else if (host) {
@@ -4069,6 +4591,11 @@ function joinFacts(input) {
           entry: end(e),
           ...tie,
           how: "base-path",
+          // Beta.25 review: never verified on a guess. A gateway's forwarding call that names no
+          // host goes to its own gateway (a proxy chained to another), so the BasePath is all it
+          // takes; a call whose host nothing resolves may go to any host that serves the path,
+          // so the join is kept as a guess (by its path), shown so and correctable.
+          ...namesHost ? { inferred: { within: "estate" } } : {},
           callType: f.callType,
           ...f.method || e.fact.method ? { method: (f.method ?? e.fact.method).toUpperCase() } : {},
           path: e.fact.path,
@@ -4336,7 +4863,7 @@ function joinFacts(input) {
         writesUnder.set(k, [n]);
     }
   }
-  const fieldsOf2 = (repo, owner) => fieldsByOwner.get(key3(repo, owner)) ?? [];
+  const fieldsOf3 = (repo, owner) => fieldsByOwner.get(key3(repo, owner)) ?? [];
   const sideOf = (f) => f.side ?? "request";
   const fieldEnd = (n) => ({
     repo: n.repo,
@@ -4354,7 +4881,7 @@ function joinFacts(input) {
     const want = fieldNameKey(field.name);
     for (const n of writesUnder.get(key3(repo, entry)) ?? []) {
       const s = n.fact;
-      const col = fieldsOf2(repo, s.id).find((x) => fieldNameKey(x.fact.name) === want);
+      const col = fieldsOf3(repo, s.id).find((x) => fieldNameKey(x.fact.name) === want);
       if (col)
         return { table: tableOf(s), name: col.fact.name, fact: col.fact.id, how: "name" };
       const named = (s.columns ?? []).find((x) => fieldNameKey(x) === want);
@@ -4367,8 +4894,8 @@ function joinFacts(input) {
   const gaps = [];
   for (const j of joins) {
     const callNode = byKey.get(key3(j.call.repo, j.call.fact));
-    const sent = fieldsOf2(j.call.repo, j.call.fact);
-    const took = fieldsOf2(j.entry.repo, j.entry.fact);
+    const sent = fieldsOf3(j.call.repo, j.call.fact);
+    const took = fieldsOf3(j.entry.repo, j.entry.fact);
     const event = j.how === "topic";
     const what2 = event ? callNode.fact.path : [callNode.fact.method?.toUpperCase(), callNode.fact.path].filter(Boolean).join(" ");
     const outward = event ? ["message"] : ["request"];
@@ -4477,7 +5004,7 @@ function joinFlagsOf(j) {
   const overlap = isOverlapJoin(j) ? [JOINED_BY_PATH_OVERLAP] : [];
   const guessed = joinGuessesOf(j);
   if (guessed.length)
-    return [...guessed, ...overlap];
+    return j.how === "base-path" ? [JOINED_BY_BASE_PATH, ...guessed, ...overlap] : [...guessed, ...overlap];
   const HOW = {
     answer: JOINED_BY_ANSWER,
     named: JOINED_BY_NAME,
@@ -4488,20 +5015,29 @@ function joinFlagsOf(j) {
   return [...overlap, ...HOW[j.how] ? [HOW[j.how]] : []];
 }
 var HOW_FLAG_ORDER = [
-  JOINED_BY_PERSON,
-  JOINED_BY_AI,
   JOINED_BY_ANSWER,
   JOINED_BY_NAME,
   JOINED_BY_REPO,
   JOINED_BY_HOST,
-  JOINED_BY_BASE_PATH
+  JOINED_BY_BASE_PATH,
+  JOINED_BY_PERSON,
+  JOINED_BY_AI
 ];
 function sharedLinkFlags(flags, confidence) {
   const all = new Set(flags);
   const guesses = GUESS_ORDER.filter((f) => all.has(f));
   const hows = HOW_FLAG_ORDER.filter((f) => all.has(f));
   const rest = [...all].filter((f) => !guesses.includes(f) && !hows.includes(f)).sort(cmp);
-  return confidence === "verified" ? [...hows, ...guesses, ...rest] : [...guesses, ...hows, ...rest];
+  if (confidence === "verified")
+    return [...hows, ...guesses, ...rest];
+  if (all.has(JOINED_BY_BASE_PATH) && guesses.length === 1 && guesses[0] === JOINED_BY_PATH)
+    return [
+      JOINED_BY_BASE_PATH,
+      ...guesses,
+      ...hows.filter((f) => f !== JOINED_BY_BASE_PATH),
+      ...rest
+    ];
+  return [...guesses, ...hows, ...rest];
 }
 function joinRecords(result, repos) {
   const facts = /* @__PURE__ */ new Map();
@@ -5005,7 +5541,7 @@ function enumValues(type) {
 }
 var HEADER_NAME = /^(x-[a-z0-9-]+|authorization|accept(-[a-z]+)*|content-[a-z]+|if-[a-z-]+|etag|location|cookie|set-cookie|user-agent|cache-control|retry-after|traceparent|tracestate|link)$/i;
 var isHeaderName = (name) => HEADER_NAME.test(name) || /^[A-Z][A-Za-z0-9]*(-[A-Z][A-Za-z0-9]*)+$/.test(name);
-var fieldsOf = (facts, owner) => facts.filter((f) => f.kind === "field" && f.owner === owner && (f.side === "request" || f.side === "response")).map((f) => {
+var fieldsOf2 = (facts, owner) => facts.filter((f) => f.kind === "field" && f.owner === owner && (f.side === "request" || f.side === "response")).map((f) => {
   const values = enumValues(f.type);
   return {
     side: f.side,
@@ -5018,8 +5554,8 @@ var fieldsOf = (facts, owner) => facts.filter((f) => f.kind === "field" && f.own
   };
 }).sort((a, b) => cmp3(a.side, b.side) || cmp3(a.name, b.name) || cmp3(a.at, b.at));
 var needsOf = (facts, call, lands) => {
-  const own = fieldsOf(facts, lands);
-  return [...own, ...fieldsOf(facts, call).filter((f) => !own.some((g) => g.side === f.side))];
+  const own = fieldsOf2(facts, lands);
+  return [...own, ...fieldsOf2(facts, call).filter((f) => !own.some((g) => g.side === f.side))];
 };
 var lower = (v) => v.toLowerCase();
 function enumDifferences(f, t, repo) {
@@ -5301,7 +5837,7 @@ function comparePrototype(input) {
       const repo = j.entry.repo;
       const theirScopes = sorted([...j.scopes ?? [], ...(e.scopes ?? []).map((x) => x.value)]);
       const repoFacts = estate.find((r) => r.repo === repo)?.facts ?? [];
-      const differences = fieldDifferences(mine, fieldsOf(repoFacts, e.id), repo);
+      const differences = fieldDifferences(mine, fieldsOf2(repoFacts, e.id), repo);
       differences.push(...errorDifferences(myErrors, errorsOf(repoFacts, e.id), repo));
       if (theirScopes.length)
         for (const sc of s.lands.scopes ?? []) {
@@ -6026,9 +6562,23 @@ function endOf(repo, component, f) {
   }
   return { repo, fact: f.id, component, at: at3, lines };
 }
+var dirOf = (file) => {
+  const f = file.replace(/\\/g, "/");
+  return f.includes("/") ? f.slice(0, f.lastIndexOf("/")) : "";
+};
+var normDir = (p2) => p2.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+function buildComponentOf(r, f) {
+  if (f.component)
+    return f.component;
+  const catalog = /(^|\/)gradle\/[\w-]+\.versions\.toml$/i.test(f.cite.file.replace(/\\/g, "/"));
+  const build = catalog ? (f.cite.with ?? []).find((p2) => /(^|[/\\])build\.gradle(\.kts)?$/i.test(p2.file))?.file : f.cite.file;
+  const dir = dirOf(build ?? f.cite.file);
+  const mod = [...r.moduleDirs ?? []].map((m) => ({ ...m, path: normDir(m.path) })).filter((m) => m.path && (dir === m.path || dir.startsWith(`${m.path}/`))).sort((a, b) => b.path.length - a.path.length)[0];
+  return mod?.component ?? r.component ?? r.repo;
+}
 function joinDependencies(input) {
   const repos = [...input.repos].sort((x, y) => cmp6(x.repo, y.repo));
-  const componentOf = (r, f) => factIdPart(f.component ?? r.component ?? r.repo);
+  const componentOf = (r, f) => factIdPart(buildComponentOf(r, f));
   const byId = (x, y) => cmp6(x.id, y.id);
   const published = /* @__PURE__ */ new Map();
   for (const r of repos)
@@ -6059,7 +6609,7 @@ function joinDependencies(input) {
     });
   }
   const links = [];
-  const seen = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Map();
   let outside = 0;
   let test = 0;
   for (const r of repos)
@@ -6083,19 +6633,36 @@ function joinDependencies(input) {
       const lib = to[0];
       if (from.repo === lib.repo && from.component === lib.component)
         continue;
-      const key3 = `${from.repo}\0${from.component}\0${lib.repo}\0${lib.component}\0${coordinates(f)}`;
-      if (seen.has(key3))
-        continue;
-      seen.add(key3);
       const pub = facts.get(`${lib.repo}\0${lib.fact}`);
-      links.push({
+      const fact = {
+        ...from,
+        group: pub.group,
+        name: pub.name,
+        ...f.version ? { version: f.version } : {},
+        ...f.scope && f.scope !== "compile" ? { scope: f.scope } : {}
+      };
+      const key3 = `${from.repo}\0${from.component}\0${lib.repo}\0${lib.component}`;
+      const twin = seen.get(key3);
+      if (twin) {
+        twin.facts.push(fact);
+        if (twin.scope !== fact.scope)
+          delete twin.scope;
+        if (!twin.published.some((p2) => p2.repo === lib.repo && p2.fact === lib.fact))
+          twin.published.push(lib);
+        continue;
+      }
+      const link = {
         from,
+        facts: [fact],
         to: lib,
+        published: [lib],
         group: pub.group,
         name: pub.name,
         ...f.scope && f.scope !== "compile" ? { scope: f.scope } : {},
         ...f.version ? { version: f.version } : {}
-      });
+      };
+      seen.set(key3, link);
+      links.push(link);
     }
   links.sort((a, b) => cmp6(a.from.component, b.from.component) || cmp6(a.to.component, b.to.component) || cmp6(a.from.repo, b.from.repo) || cmp6(a.from.fact, b.from.fact));
   return { links, ambiguous, outside, test };
@@ -8673,6 +9240,7 @@ __export(api_exports, {
   KnowledgeScanView: () => KnowledgeScanView,
   KnowledgeSource: () => KnowledgeSource,
   KnowledgeSourceList: () => KnowledgeSourceList,
+  LINK_CORRECTIONS_MAX: () => LINK_CORRECTIONS_MAX,
   LINK_HOWS: () => LINK_HOWS,
   LayoutPosition: () => LayoutPosition,
   LineChangeView: () => LineChangeView,
@@ -8842,7 +9410,7 @@ __export(api_exports, {
   WorkItemSyncResult: () => WorkItemSyncResult,
   openApiDocument: () => openApiDocument
 });
-var API_VERSION = "3.10.0";
+var API_VERSION = "3.11.0";
 var DEFAULT_PORT = 4321;
 var NextStep = external_exports.object({ step: external_exports.literal("sync"), repos: external_exports.array(external_exports.string()) });
 var Problem = external_exports.object({
@@ -8855,7 +9423,12 @@ var Problem = external_exports.object({
   /** For 403s on gated actions: who can act, e.g. "Needs an architect: R. Patel". */
   needs: external_exports.object({ role: external_exports.string(), names: external_exports.array(external_exports.string()) }).optional(),
   /** 3.9.0: what the app offers next, e.g. Sync the repos with no base clone here. */
-  next: NextStep.optional()
+  next: NextStep.optional(),
+  /**
+   * 3.11.0 (beta.25): for a 500 that wrote only part of what was asked, the files left written
+   * (each in the metarepo, or in `repo`'s working copy), so the app reads them again.
+   */
+  written: external_exports.array(external_exports.object({ repo: external_exports.string().optional(), file: external_exports.string() })).optional()
 });
 var Kind = external_exports.enum(RECORD_KINDS);
 var CatalogRecord2 = external_exports.union(RECORD_KINDS.map((k) => RECORD_SCHEMAS[k]));
@@ -9011,7 +9584,8 @@ var HierJoin = external_exports.object({
   run: external_exports.string().optional(),
   /**
    * 3.10.0 (ADR 0192): on a `depends-on` edge's join (`how: coordinates`), the coordinates the
-   * dependency names and the library publishes, and its scope when not compile. `interface` is
+   * dependency names and the library publishes, and its scope when not compile (review of
+   * beta.25: on a link of several facts, only when every one has it). `interface` is
    * then the link's own id (`depends-on:<repo>/<component>><repo>/<component>`, no Interface
    * record), `caller` the dependency's lines in the depending build file, `callee` the lines that
    * publish the coordinates. Left out on a call's join.
@@ -9020,7 +9594,24 @@ var HierJoin = external_exports.object({
     group: external_exports.string(),
     name: external_exports.string(),
     version: external_exports.string().optional(),
-    scope: external_exports.string().optional()
+    scope: external_exports.string().optional(),
+    /**
+     * 3.11.0: every dependency fact the link rests on, the first (`caller`'s first line) first:
+     * its repo, its id, its cited line (`file:line`) and every line it rests on, and the
+     * coordinates it names (`group`, `name`, its `version` and `scope` when said): a link is
+     * one per pair of components, so it holds every coordinate one builds on of the other's
+     * (`group` and `name` above are the first's).
+     */
+    facts: external_exports.array(external_exports.object({
+      repo: external_exports.string(),
+      fact: external_exports.string(),
+      at: external_exports.string(),
+      lines: external_exports.array(external_exports.string()),
+      group: external_exports.string().optional(),
+      name: external_exports.string().optional(),
+      version: external_exports.string().optional(),
+      scope: external_exports.string().optional()
+    })).optional()
   }).optional()
 });
 var HierEdge = external_exports.object({
@@ -9625,7 +10216,12 @@ var AnswerBoxRequest = external_exports.strictObject({
   id: external_exports.string().trim().min(1).max(200),
   /** For rename: the repo or system it is, or a new outside system's name. */
   name: external_exports.string().trim().min(1).max(200).optional(),
-  preview: external_exports.literal(true).optional()
+  preview: external_exports.literal(true).optional(),
+  /**
+   * 3.11.0 (beta.25): the preview's `stamp`. A write with it is refused (409, nothing written)
+   * when a file the fix writes changed since that preview.
+   */
+  stamp: external_exports.string().trim().min(1).max(100).optional()
 });
 var AnswerBoxResult = external_exports.object({
   id: external_exports.string(),
@@ -9638,7 +10234,12 @@ var AnswerBoxResult = external_exports.object({
     changes: external_exports.array(external_exports.object({ was: external_exports.string().optional(), now: external_exports.string().optional() }))
   }).optional(),
   /** The repos whose answers changed: Apply (verify --write) puts them on the map. */
-  repos: external_exports.array(external_exports.string())
+  repos: external_exports.array(external_exports.string()),
+  /**
+   * 3.11.0 (beta.25): what the files the fix writes held when it was worked out, to send back
+   * with the write (`stamp`), so the write is the one previewed.
+   */
+  stamp: external_exports.string().optional()
 });
 var FreshState = external_exports.enum([
   /** Facts cite files that changed, or source files changed: read again. */
@@ -9842,6 +10443,7 @@ var FactCorrectionResult = external_exports.object({
   /** 2.42.0 (ADR 0149): the line appended to the file, exactly as written. */
   line: external_exports.string().optional()
 });
+var LINK_CORRECTIONS_MAX = 5e3;
 var LinkCorrectionsRequest = external_exports.strictObject({
   items: external_exports.array(external_exports.strictObject({
     repo: external_exports.string().min(1),
@@ -9849,7 +10451,7 @@ var LinkCorrectionsRequest = external_exports.strictObject({
     action: external_exports.enum(["wrong", "edit"]),
     set: external_exports.record(external_exports.string().min(1), external_exports.string()).optional(),
     reason: external_exports.string().trim().min(1).max(500).optional()
-  })).min(1).max(200),
+  })).min(1).max(LINK_CORRECTIONS_MAX),
   reason: external_exports.string().trim().min(1).max(500).optional()
 });
 var LinkCorrectionsResult = external_exports.object({
@@ -9865,8 +10467,9 @@ var LinkCorrectionsResult = external_exports.object({
   /** The commands that apply them, one per repo. */
   verify: external_exports.array(external_exports.string()),
   /**
-   * Review of beta.24: the items left out because the newest correction on file for that fact
-   * says the same already (asked again, nothing is written twice).
+   * Review of beta.24: the items left out because the correction on file that the fact meets
+   * now says the same already (asked again, nothing is written twice; 3.11.0: one for a line the
+   * fact has left meets nothing).
    */
   skipped: external_exports.array(external_exports.object({ repo: external_exports.string(), fact: external_exports.string() })).optional()
 });
@@ -11509,7 +12112,7 @@ var AnswerQuestionRequest = external_exports.strictObject({
    * text and target; `reason` is kept as the answer's words (`Ignore: <reason>`).
    */
   ignore: external_exports.literal(true).optional(),
-  reason: external_exports.string().trim().min(1).max(300).optional()
+  reason: external_exports.string().trim().min(1).max(IGNORE_REASON_MAX).optional()
 });
 var AnsweredQuestion = external_exports.object({
   question: Question,
@@ -13164,10 +13767,12 @@ var OPS = {
       summary: "Every call merged into one edge of a view (a node's, or a focus), not only the first 20 the view lists (review of beta.24)",
       tag: "views",
       params: [
-        q("edge", str2, "The edge's id, as the view gives it (required)"),
-        q("node", str2, "The node whose view has the edge (or focus)"),
-        q("focus", str2, "The node whose focus view has the edge (or node)"),
-        q("lens", { type: "string", enum: [...GRAPH_LENSES] }, "The view's lens")
+        { ...q("edge", str2, "The edge's id, as the view gives it"), required: true },
+        q("node", str2, "The node whose view has the edge: one of node or focus is required"),
+        q("focus", str2, "The node whose focus view has the edge: one of node or focus is required"),
+        q("lens", { type: "string", enum: [...GRAPH_LENSES] }, "The view's lens"),
+        q("depth", { type: "string", enum: ["1", "2", "3"] }, "With node: the view's depth, as GET /api/graph/node/{id} takes it (3.11.0)"),
+        q("all", { type: "string", enum: ["1"] }, "With node: every box, as GET /api/graph/node/{id} takes it (3.11.0)")
       ],
       ok: { status: 200, schema: "GraphEdgeCallsView", description: "OK" },
       errors: [400, 404, 422]
@@ -13570,21 +14175,21 @@ var OPS = {
   "/api/trust/answer-boxes/ignore": {
     post: {
       id: "ignoreAnswerBox",
-      summary: "A box an answer's words made (beta.24 review), put right as 'it was ignore this': each answer that names it becomes Ignore (the join leaves its calls) and the system leaves its profile. preview writes nothing; the write is local, for Propose for review",
+      summary: "A box an answer's words made (beta.24 review), put right as 'it was ignore this': each answer that names it becomes Ignore (the join leaves its calls) and the system leaves its profile. preview writes nothing; the write (with the preview's stamp) writes all or none, only over the files previewed, local, for Propose for review",
       tag: "workspace",
       body: AnswerBoxRequest,
       ok: { status: 200, schema: "AnswerBoxResult", description: "Previewed or written" },
-      errors: [400, 404, 409, 422]
+      errors: [400, 404, 409, 422, 500]
     }
   },
   "/api/trust/answer-boxes/rename": {
     post: {
       id: "renameAnswerBox",
-      summary: "A box an answer's words made (beta.24 review), renamed to a real system: a repo or system Atticus knows, or a new outside system's short name; the answers that name it name that instead. preview writes nothing; the write is local, for Propose for review",
+      summary: "A box an answer's words made (beta.24 review), renamed to a real system: a repo or system Atticus knows, or a new outside system's short name; the answers that name it name that instead. preview writes nothing; the write (with the preview's stamp) writes all or none, only over the files previewed, local, for Propose for review",
       tag: "workspace",
       body: AnswerBoxRequest,
       ok: { status: 200, schema: "AnswerBoxResult", description: "Previewed or written" },
-      errors: [400, 404, 409, 422]
+      errors: [400, 404, 409, 422, 500]
     }
   },
   "/api/trust/fresh": {
@@ -13619,11 +14224,11 @@ var OPS = {
   "/api/links/corrections": {
     post: {
       id: "correctLinkCalls",
-      summary: "This whole arrow is wrong (beta.24): one correction of every call on a link, each in its caller repo's facts/<repo>.corrections.jsonl (several lines in one write per repo), every item checked before any is written. Returns each file, the git command that commits them all and the verify command per repo",
+      summary: "This whole arrow is wrong (beta.24): one correction of every call on a link, or (beta.25) of every dependency fact a depends-on link rests on, each in its repo's facts/<repo>.corrections.jsonl (several lines in one write per repo), every item checked before any is written, all or none. Returns each file, the git command that commits them all and the verify command per repo",
       tag: "workspace",
       body: LinkCorrectionsRequest,
       ok: { status: 200, schema: "LinkCorrectionsResult", description: "Recorded" },
-      errors: [400, 404, 422, 500]
+      errors: [400, 404, 409, 413, 422, 500]
     }
   },
   "/api/facts/{repo}/preview": {
@@ -15453,7 +16058,7 @@ var ERROR_TEXT = {
   409: "Conflict: the file changed since you read it, or the state doesn't allow this",
   413: "Too large: the upload is over the limit the problem names",
   422: "Atticus refused: the problem carries the command's own words (ADR 0043)",
-  500: "Written only in part: the problem names exactly what was written"
+  500: "Not done: the problem says what was written all the same (`written`), most often nothing"
 };
 function openApiDocument() {
   const reg = external_exports.registry();
@@ -16507,7 +17112,7 @@ function referenceFields(kind) {
 }
 function recordReferences(record) {
   const out = [];
-  const visit = (value, parts, field) => {
+  const visit2 = (value, parts, field) => {
     if (value === void 0 || value === null)
       return;
     if (parts.length === 0) {
@@ -16520,12 +17125,12 @@ function recordReferences(record) {
       const v = value[head.slice(0, -2)];
       if (Array.isArray(v))
         for (const item of v)
-          visit(item, rest, field);
+          visit2(item, rest, field);
     } else
-      visit(value[head], rest, field);
+      visit2(value[head], rest, field);
   };
   for (const field of PATHS.get(record.kind) ?? []) {
-    visit(record, field.split("."), field);
+    visit2(record, field.split("."), field);
   }
   return out;
 }
@@ -17228,7 +17833,7 @@ function listRepoFilesSync(root, o = {}) {
   go("", [], []);
   return out;
 }
-async function walkRepo(root, visit, o = {}) {
+async function walkRepo(root, visit2, o = {}) {
   const max = o.max ?? Number.POSITIVE_INFINITY;
   let files = 0;
   let cut = false;
@@ -17256,7 +17861,7 @@ async function walkRepo(root, visit, o = {}) {
           return false;
         }
         files++;
-        if (await visit(path) === false)
+        if (await visit2(path) === false)
           return false;
       }
     }
@@ -18630,6 +19235,9 @@ async function answerQuestion(root, id, a) {
   const text4 = a.text?.trim() || void 0;
   if (a.option === void 0 === (text4 === void 0))
     throw new QuestionError("bad-answer", "Give an option or your own words, one of the two.");
+  const ignoreWhy = text4 && JOIN_STEPS.has(q2.askedBy.step) ? ignoredAnswer({ options: q2.options, answer: { text: text4, by: a.by } })?.reason : void 0;
+  if (ignoreWhy && ignoreWhy.length > IGNORE_REASON_MAX)
+    throw new QuestionError("bad-answer", `An Ignore's reason is at most ${IGNORE_REASON_MAX} characters (this is ${ignoreWhy.length}): say it in fewer words.`);
   if (a.option !== void 0 && (!Number.isInteger(a.option) || a.option < 1 || a.option > q2.options.length))
     throw new QuestionError("bad-answer", q2.options.length ? `There is no option ${a.option}: pick 1 to ${q2.options.length}.` : `There is no option ${a.option}: this question has no options, so answer in your own words.`);
   const pickerLabel = a.option !== void 0 ? q2.options[a.option - 1]?.label : void 0;
@@ -18821,9 +19429,12 @@ async function repoReadOf(root, repo) {
   let facts = [];
   if (raw !== void 0 && raw.trim()) {
     const parsed = parseFacts(raw);
-    if (parsed.ok)
+    if (parsed.ok) {
       facts = parsed.facts;
-    else
+      const newer2 = parsed.newer ?? [];
+      if (newer2.length)
+        why.push(`${plural(newer2.length, "fact")} ${newer2.length === 1 ? "is" : "are"} written by a newer Atticus (fact kind ${[...new Set(newer2.map((n) => n.kind))].sort().join(", ")}); install it to read ${newer2.length === 1 ? "it" : "them"}`);
+    } else
       why.push(`its facts file doesn't read as facts`);
   }
   let report;
@@ -20206,6 +20817,8 @@ export {
   FACTS_SCHEMA_VERSION,
   SETTING_KINDS,
   looksLikeSecret,
+  credentialLike,
+  configSecretField,
   ConfigFact,
   FrameworkFact,
   TERM_ROLES,
@@ -20240,12 +20853,16 @@ export {
   toCanonicalYaml,
   deserializeRecord,
   migrationOf,
+  newerFactOf,
+  newerShapeOf,
   parseFacts,
+  redactFactLine,
   parseFactLine,
   parseFactsLines,
   serializeFacts,
   factIdPart,
   entryEndpointId,
+  placedComponentOf,
   callPath,
   catalogAuth,
   projectFacts,
@@ -20317,11 +20934,15 @@ export {
   JOIN_IGNORE_LABEL,
   IGNORE_PREFIX,
   ignoreOption,
+  IGNORE_REASON_MAX,
   ignoreText,
   ignoredAnswer,
   SYSTEM_NAME_MAX,
+  nameReadsAsSentence,
+  readsAsSentence,
   systemNameProblem,
-  madeFromWords,
+  knownTargetNames,
+  namesKnown,
   namesKnownTarget,
   wordsNameNothing,
   HOSTS_OUTSIDE_INTERNAL,
@@ -20332,6 +20953,8 @@ export {
   hostOfQuestion,
   joinHostOfQuestion,
   outsideSystemOfJoinHost,
+  profileText,
+  ProfileEditError,
   addOutsideSystem,
   addProfileSystem,
   editProfileSystem,