@maycombhq/atticus 2.0.0-beta.24 → 2.0.0-beta.26

package/dist/{chunk-HNPKCRCE.js → chunk-RK5P2DWD.js}

@@ -5,16 +5,18 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readOpenApiDocument
-} from "./chunk-5FPAKAGE.js";
+} from "./chunk-I2EWY3MG.js";
 import {
   globToRegExp
-} from "./chunk-IJQHBK76.js";
+} from "./chunk-UFIQ5FWY.js";
 import {
   DECLARED_TOPIC,
   Fact,
   FactId,
   JOINED_BY_AI,
   JOINED_BY_BASE_PATH,
+  JOINED_BY_PATH,
+  JOINED_BY_PATH_OVERLAP,
   JOINED_BY_PERSON,
   JOINED_TO_SHARED_MAP,
   JOIN_GUESS_FLAGS,
@@ -25,6 +27,8 @@ import {
   citedFiles,
   claimOnLines,
   clusterServiceAddress,
+  configSecretField,
+  credentialLike,
   decodeText,
   dependencyLinkId,
   factIdPart,
@@ -41,6 +45,7 @@ import {
   noteProblem,
   partsBuildWord,
   partsNamePath,
+  placedComponentOf,
   plainPathPrefix,
   quoteHoldsSecret,
   quoteMatches,
@@ -49,15 +54,16 @@ import {
   staleCite,
   toCanonicalYaml,
   tokenUnits
-} from "./chunk-GJVCBTSO.js";
+} from "./chunk-6ZDAEUKB.js";
 import {
   DEFAULT_CONVENTIONS,
+  DEFAULT_GATEWAY_BUNDLE_FOLDERS,
   NEVER_CHECKED_STEPS,
   gatewayBundleTest,
   normalizePath,
   notDeviceName,
   underFolders
-} from "./chunk-QFDPX6C4.js";
+} from "./chunk-LZFKJ2BR.js";
 
 // packages/verify/dist/source.js
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
@@ -174,186 +180,870 @@ function tooBigToRead(source, path) {
 }
 
 // packages/verify/dist/build-coords.js
-var POM = /(^|\/)pom\.xml$|\.pom$/i;
+var POM = /(^|\/)([^/]*[-_.])?pom\.xml$|\.pom$/i;
+var GENERATED_POM = /(^|\/)(dependency-reduced-pom\.xml|\.flattened-pom\.xml)$/i;
 var GRADLE_BUILD = /(^|\/)build\.gradle(\.kts)?$/i;
 var GRADLE_SETTINGS = /(^|\/)settings\.gradle(\.kts)?$/i;
-var isPomFile = (p) => POM.test(p.replace(/\\/g, "/"));
-var isGradleFile = (p) => GRADLE_BUILD.test(p.replace(/\\/g, "/")) || GRADLE_SETTINGS.test(p.replace(/\\/g, "/"));
+var VERSION_CATALOG = /(^|\/)gradle\/([\w-]+)\.versions\.toml$/i;
+var slash = (p) => p.replace(/\\/g, "/");
+var isPomFile = (p) => POM.test(slash(p)) && !GENERATED_POM.test(slash(p));
+var isGradleBuildFile = (p) => GRADLE_BUILD.test(slash(p));
+var isGradleSettingsFile = (p) => GRADLE_SETTINGS.test(slash(p));
+var isVersionCatalogFile = (p) => VERSION_CATALOG.test(slash(p));
+var isGradleFile = (p) => isGradleBuildFile(p) || isGradleSettingsFile(p) || isVersionCatalogFile(p);
 var isBuildFile = (p) => isPomFile(p) || isGradleFile(p);
-var TAG = /<(\/?)([A-Za-z_][\w.:-]*)([^>]*?)(\/?)>/g;
+var isPomFileIn = (p, named) => isPomFile(p) || !!named?.has(slash(p)) && !GENERATED_POM.test(slash(p));
+var isBuildFileIn = (p, named) => isBuildFile(p) || isPomFileIn(p, named);
+var COORDINATE = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
+function lineIndex(text) {
+  const starts = [0];
+  for (let i = 0; i < text.length; i++)
+    if (text.charCodeAt(i) === 10)
+      starts.push(i + 1);
+  return (offset) => {
+    let lo = 0;
+    let hi = starts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (starts[mid] <= offset)
+        lo = mid;
+      else
+        hi = mid - 1;
+    }
+    return lo + 1;
+  };
+}
+function xmlTokens(text) {
+  const lineAt = lineIndex(text);
+  const out = [];
+  const pushText = (from, to, value = text.slice(from, to)) => {
+    const lead = value.length - value.trimStart().length;
+    if (value.trim())
+      out.push({ type: "text", value: value.trim(), line: lineAt(from + lead) });
+  };
+  let i = 0;
+  let textFrom = 0;
+  while (i < text.length) {
+    const lt = text.indexOf("<", i);
+    if (lt < 0)
+      break;
+    if (text.startsWith("<!--", lt)) {
+      pushText(textFrom, lt);
+      const end = text.indexOf("-->", lt + 4);
+      i = textFrom = end < 0 ? text.length : end + 3;
+      continue;
+    }
+    if (text.startsWith("<![CDATA[", lt)) {
+      pushText(textFrom, lt);
+      const end = text.indexOf("]]>", lt + 9);
+      const stop = end < 0 ? text.length : end;
+      pushText(lt + 9, stop);
+      i = textFrom = end < 0 ? text.length : end + 3;
+      continue;
+    }
+    if (text.startsWith("<?", lt) || text.startsWith("<!", lt)) {
+      pushText(textFrom, lt);
+      const end = text.indexOf(text.startsWith("<?", lt) ? "?>" : ">", lt + 2);
+      i = textFrom = end < 0 ? text.length : end + (text.startsWith("<?", lt) ? 2 : 1);
+      continue;
+    }
+    const m = /^<(\/?)([A-Za-z_][\w.:-]*)/.exec(text.slice(lt, lt + 200));
+    if (!m) {
+      i = lt + 1;
+      continue;
+    }
+    let j = lt + m[0].length;
+    let quote = "";
+    for (; j < text.length; j++) {
+      const c = text[j];
+      if (quote) {
+        if (c === quote)
+          quote = "";
+      } else if (c === '"' || c === "'")
+        quote = c;
+      else if (c === ">")
+        break;
+    }
+    pushText(textFrom, lt);
+    const close = m[1] === "/";
+    const self = !close && text[j - 1] === "/";
+    out.push({ type: close ? "close" : self ? "self" : "open", name: m[2], line: lineAt(lt) });
+    i = textFrom = j + 1;
+  }
+  pushText(textFrom, text.length);
+  return out;
+}
+var leaf = (frame, name) => frame.leaves.get(name);
 function pomCoordinates(lines) {
-  const out = { dependencies: [] };
+  const held = POMS.get(lines);
+  if (held)
+    return held;
+  const out = readPom(lines);
+  POMS.set(lines, out);
+  return out;
+}
+var POMS = /* @__PURE__ */ new WeakMap();
+function readPom(lines) {
+  const out = { dependencies: [], modules: [], properties: /* @__PURE__ */ new Map() };
+  const text = lines.map((l, i) => {
+    const t = l.endsWith("\r") ? l.slice(0, -1) : l;
+    return i === 0 && t.charCodeAt(0) === 65279 ? t.slice(1) : t;
+  }).join("\n");
   const stack = [];
-  let inComment = false;
   const names = () => stack.map((f) => f.name);
-  lines.forEach((raw, i) => {
-    const n = i + 1;
-    let line = "";
-    let rest = raw;
-    while (rest.length) {
-      if (inComment) {
-        const end = rest.indexOf("-->");
-        if (end < 0)
-          break;
-        rest = rest.slice(end + 3);
-        inComment = false;
+  for (const t of xmlTokens(text)) {
+    const top = stack[stack.length - 1];
+    if (t.type === "text") {
+      if (top && !top.text) {
+        top.text = t.value;
+        top.textLine = t.line;
+      }
+      continue;
+    }
+    if (t.type !== "close") {
+      if (top)
+        top.children = true;
+      if (t.type === "self") {
+        if (t.name === "relativePath" && top?.name === "parent")
+          top.leaves.set("relativePath", { value: "", line: t.line });
         continue;
       }
-      const start = rest.indexOf("<!--");
-      if (start < 0) {
-        line += rest;
-        break;
+      stack.push({ name: t.name, leaves: /* @__PURE__ */ new Map(), children: false, text: "", textLine: t.line });
+      continue;
+    }
+    const at = names().lastIndexOf(t.name);
+    if (at < 0)
+      continue;
+    while (stack.length > at + 1)
+      stack.pop();
+    const done = stack.pop();
+    const parent = stack[stack.length - 1];
+    const value = !done.children && done.text ? { value: done.text, line: done.textLine } : void 0;
+    if (value && parent)
+      parent.leaves.set(done.name, value);
+    const path = [...names(), done.name];
+    if (done.name === "dependency") {
+      const g = leaf(done, "groupId");
+      const a = leaf(done, "artifactId");
+      const v = leaf(done, "version");
+      const s = leaf(done, "scope");
+      out.dependencies.push({
+        ...g ? { group: g } : {},
+        ...a ? { artifact: a } : {},
+        ...v ? { version: v } : {},
+        ...s ? { scope: s } : {},
+        managed: path.includes("dependencyManagement"),
+        plugin: path.includes("plugin") || path.includes("extension")
+      });
+    } else if (done.name === "module" && value && path[0] === "project") {
+      const p = path.join("/");
+      if (p === "project/modules/module" || p === "project/profiles/profile/modules/module")
+        out.modules.push(value);
+    } else if (done.name === "properties" && path.length === 2 && path[0] === "project") {
+      for (const [k, v] of done.leaves)
+        out.properties.set(k, v);
+    } else if (done.name === "parent" && path.length === 2 && path[0] === "project") {
+      if (leaf(done, "groupId"))
+        out.parentGroup = leaf(done, "groupId");
+      if (leaf(done, "artifactId"))
+        out.parentArtifact = leaf(done, "artifactId");
+      if (leaf(done, "version"))
+        out.parentVersion = leaf(done, "version");
+      if (leaf(done, "relativePath"))
+        out.parentRelativePath = leaf(done, "relativePath");
+    } else if (done.name === "project" && path.length === 1) {
+      if (leaf(done, "groupId"))
+        out.group = leaf(done, "groupId");
+      if (leaf(done, "artifactId"))
+        out.artifact = leaf(done, "artifactId");
+      if (leaf(done, "version"))
+        out.version = leaf(done, "version");
+    }
+  }
+  return out;
+}
+var PROPERTY = /^\$\{([^}]+)\}$/;
+function resolvePomValue(at, pom, o = {}, depth = 0) {
+  const m = PROPERTY.exec(at.value.trim());
+  if (!m)
+    return { value: at.value, line: at.line };
+  const key = m[1].trim();
+  const own = {
+    "project.groupId": pom.group ?? pom.parentGroup,
+    "pom.groupId": pom.group ?? pom.parentGroup,
+    groupId: pom.group ?? pom.parentGroup,
+    "project.artifactId": pom.artifact,
+    "pom.artifactId": pom.artifact,
+    artifactId: pom.artifact,
+    "project.version": pom.version ?? pom.parentVersion,
+    "pom.version": pom.version ?? pom.parentVersion,
+    "project.parent.groupId": pom.parentGroup,
+    "parent.groupId": pom.parentGroup,
+    "project.parent.artifactId": pom.parentArtifact,
+    "parent.artifactId": pom.parentArtifact,
+    "project.parent.version": pom.parentVersion,
+    "parent.version": pom.parentVersion
+  };
+  const builtin = Object.hasOwn(own, key);
+  let to;
+  if (builtin) {
+    const b = own[key];
+    if (b)
+      to = { at: b, file: o.file ?? "" };
+  } else {
+    const mine = pom.properties.get(key);
+    if (mine)
+      to = { at: mine, file: o.file ?? "" };
+    else
+      for (const p of o.parents ?? []) {
+        const theirs = p.pom.properties.get(key);
+        if (theirs) {
+          to = { at: theirs, file: p.file };
+          break;
+        }
       }
-      line += rest.slice(0, start);
-      rest = rest.slice(start + 4);
-      inComment = true;
-    }
-    let last = 0;
-    for (const m of line.matchAll(TAG)) {
-      const text = line.slice(last, m.index);
-      last = m.index + m[0].length;
-      const top2 = stack[stack.length - 1];
-      if (top2 && text.trim() && !top2.text) {
-        top2.text = text.trim();
-        top2.textLine = n;
+  }
+  if (!to || to.at === at || depth > 4)
+    return { missing: key };
+  const next = resolvePomValue(to.at, pom, o, depth + 1);
+  if ("missing" in next)
+    return next;
+  const via = [...builtin ? [] : [{ file: to.file, line: to.at.line }], ...next.via ?? []];
+  return { value: next.value, line: at.line, ...via.length ? { via } : {} };
+}
+function pomTarget(dir, rel) {
+  const to = joinDir(dir, rel.trim());
+  if (/\.(xml|pom)$/i.test(rel.trim()))
+    return to;
+  return to ? `${to}/pom.xml` : "pom.xml";
+}
+function pomFilesNamed(files, linesOf2) {
+  const held = NAMED.get(files);
+  if (held)
+    return held;
+  const all2 = new Set(files.map(slash));
+  const out = /* @__PURE__ */ new Set();
+  let next = files.map(slash).filter(isPomFile);
+  for (let round = 0; round < 5 && next.length; round++) {
+    const found = [];
+    for (const f of next) {
+      const lines = linesOf2(f);
+      const rel = lines ? pomCoordinates(lines).parentRelativePath?.value.trim() : void 0;
+      if (!rel)
+        continue;
+      const to = pomTarget(dirOf(f), rel);
+      if (all2.has(to) && !isPomFile(to) && !out.has(to) && !GENERATED_POM.test(to)) {
+        out.add(to);
+        found.push(to);
       }
-      if (m[2].startsWith("?") || m[0].startsWith("<!"))
+    }
+    next = found;
+  }
+  NAMED.set(files, out);
+  return out;
+}
+var NAMED = /* @__PURE__ */ new WeakMap();
+function moduleParentsOf(files, linesOf2) {
+  const held = LISTED.get(files);
+  if (held)
+    return held;
+  const named = pomFilesNamed(files, linesOf2);
+  const out = /* @__PURE__ */ new Map();
+  for (const f of files.map(slash).sort()) {
+    if (!isPomFileIn(f, named))
+      continue;
+    const lines = linesOf2(f);
+    if (!lines)
+      continue;
+    for (const m of pomCoordinates(lines).modules) {
+      const dir = dirOf(pomTarget(dirOf(f), m.value));
+      if (!out.has(dir))
+        out.set(dir, f);
+    }
+  }
+  LISTED.set(files, out);
+  return out;
+}
+var LISTED = /* @__PURE__ */ new WeakMap();
+function pomParents(file, linesOf2, files) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set([slash(file)]);
+  let at = slash(file);
+  let lines = linesOf2(at);
+  for (let n = 0; n < 6 && lines; n++) {
+    const pom = pomCoordinates(lines);
+    if (!pom.parentArtifact)
+      break;
+    const rel = pom.parentRelativePath?.value.trim();
+    if (rel === "")
+      break;
+    const dir = dirOf(at);
+    const candidates = rel ? [pomTarget(dir, rel)] : [
+      ...files ? [moduleParentsOf(files, linesOf2).get(dir)] : [],
+      ...dir ? [pomTarget(dir, "..")] : []
+    ];
+    const want = pom.parentArtifact.value.trim();
+    let found;
+    for (const c of candidates) {
+      if (!c || seen.has(c))
         continue;
-      const close = m[1] === "/";
-      const selfClosing = m[4] === "/";
-      if (!close) {
-        if (top2)
-          top2.children = true;
-        if (selfClosing)
-          continue;
-        stack.push({ name: m[2], leaves: /* @__PURE__ */ new Map(), children: false, text: "", textLine: n });
+      const ls = linesOf2(c);
+      if (!ls)
         continue;
-      }
-      const at = names().lastIndexOf(m[2]);
-      if (at < 0)
+      const theirs = pomCoordinates(ls);
+      const name = theirs.artifact?.value.trim();
+      if (name !== void 0 && !PROPERTY.test(name) && !PROPERTY.test(want) && name !== want)
         continue;
-      while (stack.length > at + 1)
-        stack.pop();
-      const done = stack.pop();
-      const parent = stack[stack.length - 1];
-      if (!done.children && done.text && parent)
-        parent.leaves.set(done.name, { value: done.text, line: done.textLine });
-      const path = [...names(), done.name];
-      if (done.name === "dependency") {
-        out.dependencies.push({
-          ...done.leaves.get("groupId") ? { group: done.leaves.get("groupId") } : {},
-          ...done.leaves.get("artifactId") ? { artifact: done.leaves.get("artifactId") } : {},
-          ...done.leaves.get("version") ? { version: done.leaves.get("version") } : {},
-          ...done.leaves.get("scope") ? { scope: done.leaves.get("scope") } : {},
-          managed: path.includes("dependencyManagement"),
-          plugin: path.includes("plugin") || path.includes("extension")
-        });
-      } else if (done.name === "parent" && path.length === 2 && path[0] === "project") {
-        if (done.leaves.get("groupId"))
-          out.parentGroup = done.leaves.get("groupId");
-        if (done.leaves.get("artifactId"))
-          out.parentArtifact = done.leaves.get("artifactId");
-        if (done.leaves.get("version"))
-          out.parentVersion = done.leaves.get("version");
-      } else if (done.name === "project" && path.length === 1) {
-        if (done.leaves.get("groupId"))
-          out.group = done.leaves.get("groupId");
-        if (done.leaves.get("artifactId"))
-          out.artifact = done.leaves.get("artifactId");
-        if (done.leaves.get("version"))
-          out.version = done.leaves.get("version");
-      }
-    }
-    const top = stack[stack.length - 1];
-    const tail = line.slice(last);
-    if (top && tail.trim() && !top.text) {
-      top.text = tail.trim();
-      top.textLine = n;
+      found = { file: c, pom: theirs };
+      break;
     }
-  });
+    if (!found)
+      break;
+    out.push(found);
+    seen.add(found.file);
+    at = found.file;
+    lines = linesOf2(at);
+  }
   return out;
 }
-var QUOTED = `(['"])([^'"\\s]+)\\`;
-var GRADLE_DEP = new RegExp(`^\\s*([A-Za-z][\\w]*)\\s*\\(?\\s*(?:(platform|enforcedPlatform)\\s*\\(\\s*)?${QUOTED}3`);
-var GRADLE_MAP_DEP = /^\s*([A-Za-z]\w*)\s*\(?\s*group\s*[:=]\s*(['"])([^'"]+)\2\s*,\s*name\s*[:=]\s*(['"])([^'"]+)\4(?:\s*,\s*version\s*[:=]\s*(['"])([^'"]+)\6)?/;
-var NOT_A_CONFIGURATION = /* @__PURE__ */ new Set(["id", "apply", "plugin", "include", "classpath", "group"]);
+var CONFIGURATION = `(?:(["'])([A-Za-z]\\w*)\\1\\s*(?=\\()|([A-Za-z]\\w*))`;
+var GRADLE_DEP = new RegExp(`^\\s*${CONFIGURATION}\\s*\\(?\\s*(?:(platform|enforcedPlatform)\\s*\\(\\s*)?(['"])([^'"\\s]+)\\5`);
+var GRADLE_MAP_DEP = new RegExp(`^\\s*${CONFIGURATION}\\s*\\(?\\s*group\\s*[:=]\\s*(['"])([^'"]+)\\4\\s*,\\s*name\\s*[:=]\\s*(['"])([^'"]+)\\6(?:\\s*,\\s*version\\s*[:=]\\s*(['"])([^'"]+)\\8)?`);
+var NOT_A_CONFIGURATION = /* @__PURE__ */ new Set([
+  "id",
+  "apply",
+  "plugin",
+  "include",
+  "includeBuild",
+  "classpath",
+  "group",
+  "version",
+  "url",
+  "uri",
+  "dependency",
+  "dependencySet",
+  "entry",
+  "mavenBom",
+  "imports",
+  "force",
+  "exclude",
+  "module",
+  "substitute",
+  "because",
+  "strictly",
+  "require",
+  "prefer",
+  "reject",
+  "alias",
+  "from",
+  "maven",
+  "mainClass",
+  "println",
+  "description"
+]);
+var TOOL_CONFIGURATIONS = /* @__PURE__ */ new Set([
+  "checkstyle",
+  "pmd",
+  "spotbugs",
+  "spotbugsPlugins",
+  "spotbugsSlf4j",
+  "jacocoAgent",
+  "jacocoAnt",
+  "detekt",
+  "detektPlugins",
+  "ktlint",
+  "ktlintRuleset",
+  "codenarc",
+  "errorprone",
+  "pitest"
+]);
+function gradleToolConfigurationOn(line) {
+  const c = /^\s*(["']?)([A-Za-z]\w*)\1\s*[\s(]/.exec(line)?.[2];
+  return c && TOOL_CONFIGURATIONS.has(c) ? c : void 0;
+}
+var TEST_CONFIGURATION = /^(test|testFixtures|\w+Test)(Implementation|Api|CompileOnly|RuntimeOnly|Compile|Runtime|AnnotationProcessor|CompileClasspath|RuntimeClasspath)$/;
 function scopeOfConfiguration(c, platform) {
   if (platform)
     return "import";
-  if (/^test/i.test(c))
+  if (TEST_CONFIGURATION.test(c))
     return "test";
-  if (/^(compileOnly|annotationProcessor|kapt|compileOnlyApi)$/i.test(c))
+  if (/^(compileOnly|annotationProcessor|kapt|ksp|compileOnlyApi|providedCompile|providedRuntime)$/.test(c))
     return "provided";
-  if (/^runtimeOnly$/i.test(c))
+  if (/^(runtimeOnly|runtime|developmentOnly|testAndDevelopmentOnly)$/.test(c))
     return "runtime";
   return "compile";
 }
 function gradleDependencyOn(line) {
+  if (gradleToolConfigurationOn(line))
+    return void 0;
   const map = GRADLE_MAP_DEP.exec(line);
-  if (map && !NOT_A_CONFIGURATION.has(map[1]))
+  const mapConf = map ? map[2] ?? map[3] : "";
+  if (map && !NOT_A_CONFIGURATION.has(mapConf)) {
+    if (!COORDINATE.test(map[5]) || !COORDINATE.test(map[7]))
+      return void 0;
     return {
-      configuration: map[1],
-      group: map[3],
-      name: map[5],
-      ...map[7] ? { version: map[7] } : {},
-      scope: scopeOfConfiguration(map[1], false)
+      configuration: mapConf,
+      group: map[5],
+      name: map[7],
+      ...map[9] ? { version: map[9] } : {},
+      scope: scopeOfConfiguration(mapConf, false)
     };
+  }
   const m = GRADLE_DEP.exec(line);
-  if (!m || NOT_A_CONFIGURATION.has(m[1]))
+  const conf = m ? m[2] ?? m[3] : "";
+  if (!m || NOT_A_CONFIGURATION.has(conf))
     return void 0;
-  const parts = m[4].split(":");
-  if (parts.length < 2 || !parts[0] || !parts[1])
+  const parts = m[6].split(":");
+  if (parts.length < 2 || !COORDINATE.test(parts[0]) || !COORDINATE.test(parts[1]))
     return void 0;
   return {
-    configuration: m[1],
+    configuration: conf,
     group: parts[0],
     name: parts[1],
     ...parts[2] ? { version: parts[2] } : {},
-    scope: scopeOfConfiguration(m[1], !!m[2])
+    scope: scopeOfConfiguration(conf, !!m[4])
+  };
+}
+function gradleBlocks(lines) {
+  const held = BLOCKS.get(lines);
+  if (held)
+    return held;
+  const out = readBlocks(lines);
+  BLOCKS.set(lines, out);
+  return out;
+}
+var BLOCKS = /* @__PURE__ */ new WeakMap();
+function readBlocks(lines) {
+  const out = [];
+  const stack = [];
+  let triple = "";
+  let block = false;
+  let previous = "";
+  for (const raw of lines) {
+    out.push([...stack]);
+    let code2 = "";
+    for (let i = 0; i < raw.length; i++) {
+      const c = raw[i];
+      if (block) {
+        if (raw.startsWith("*/", i)) {
+          block = false;
+          i++;
+        }
+        continue;
+      }
+      if (triple) {
+        if (raw.startsWith(triple, i)) {
+          code2 += triple;
+          i += 2;
+          triple = "";
+        }
+        continue;
+      }
+      if (raw.startsWith("//", i))
+        break;
+      if (raw.startsWith("/*", i)) {
+        block = true;
+        i++;
+        continue;
+      }
+      if (raw.startsWith("'''", i) || raw.startsWith('"""', i)) {
+        triple = raw.slice(i, i + 3);
+        code2 += triple;
+        i += 2;
+        continue;
+      }
+      if (c === "'" || c === '"') {
+        let j = i + 1;
+        for (; j < raw.length && raw[j] !== c; j++)
+          if (raw[j] === "\\")
+            j++;
+        code2 += raw.slice(i, j + 1).replace(/[{}]/g, " ");
+        i = j;
+        continue;
+      }
+      if (c === "{") {
+        const before = code2.trim() || previous;
+        const m = /([A-Za-z_][\w.]*)\s*(?:\(\s*([^()]*?)\s*\))?\s*(?:\w+\s*->\s*)?$/.exec(before);
+        const name = m?.[1] ?? "";
+        stack.push(name === "project" && m?.[2] ? `project(${m[2].replace(/['"]/g, "")})` : name);
+        code2 = "";
+        continue;
+      }
+      if (c === "}") {
+        stack.pop();
+        code2 = "";
+        continue;
+      }
+      code2 += c;
+    }
+    if (code2.trim())
+      previous = code2.trim();
+  }
+  return out;
+}
+var PROJECT_BLOCK = (b) => b === "subprojects" || b === "allprojects" || /^project\(:?[^)]*\)$/.test(b);
+var projectOf = (b) => /^project\(:?([^)]*)\)$/.exec(b)?.[1];
+function gradleDependencyAt(lines, line, blocks = gradleBlocks(lines)) {
+  const d = gradleDependencyOn(lines[line - 1] ?? "");
+  if (!d)
+    return void 0;
+  const at = projectDependenciesAt(blocks, line);
+  return "none" in at ? at : { dependency: d, ...at };
+}
+function projectDependenciesAt(blocks, line) {
+  const stack = blocks[line - 1] ?? [];
+  const outer = stack.slice(0, -1);
+  if (stack[stack.length - 1] !== "dependencies" || !outer.every(PROJECT_BLOCK)) {
+    const inside = stack.filter((b) => !PROJECT_BLOCK(b)).join(" { ");
+    return { none: inside ? `${inside} { }` : "no dependencies { } block" };
+  }
+  const proj = outer.map(projectOf).find((x) => x !== void 0);
+  return {
+    ...proj !== void 0 ? { project: proj } : {},
+    ...outer.some((b) => b === "subprojects" || b === "allprojects") ? { all: true } : {}
+  };
+}
+function catalogVersions(lines) {
+  const out = /* @__PURE__ */ new Map();
+  let section = "";
+  lines.forEach((raw, i) => {
+    const l = raw.replace(/\r$/, "");
+    const s = /^\s*\[\s*([^\]]+?)\s*\]\s*(#.*)?$/.exec(l);
+    if (s)
+      return void (section = s[1]);
+    if (section !== "versions")
+      return;
+    const m = /^\s*(["']?)([A-Za-z][\w.-]*)\1\s*=\s*(["'])([^"']+)\3\s*(#.*)?$/.exec(l);
+    if (m)
+      out.set(m[2], { value: m[4], line: i + 1 });
+  });
+  return out;
+}
+var catalogNameOf = (file) => VERSION_CATALOG.exec(slash(file))?.[2];
+var accessorOf = (alias) => alias.replace(/[-_.]+/g, ".");
+function catalogLibraryAt(lines, line) {
+  let section = "";
+  for (let i = 0; i < line && i < lines.length; i++) {
+    const m2 = /^\s*\[\s*([^\]]+?)\s*\]\s*(#.*)?$/.exec((lines[i] ?? "").replace(/\r$/, ""));
+    if (m2)
+      section = m2[1];
+  }
+  if (section !== "libraries")
+    return void 0;
+  const text = (lines[line - 1] ?? "").replace(/\r$/, "");
+  const m = /^\s*(["']?)([A-Za-z][\w.-]*)\1\s*=\s*(.+)$/.exec(text);
+  if (!m)
+    return void 0;
+  const alias = m[2];
+  const body = m[3].replace(/\s+#.*$/, "").trim();
+  const str = (key) => new RegExp(`(?:^|[{,\\s])${key.replace(".", "\\.")}\\s*=\\s*(["'])([^"']+)\\1`).exec(body)?.[2];
+  let group;
+  let name;
+  let version;
+  const whole = /^(["'])([^"']+)\1$/.exec(body);
+  if (whole)
+    [group, name, version] = whole[2].split(":");
+  else if (body.startsWith("{")) {
+    const module = str("module");
+    if (module)
+      [group, name] = module.split(":");
+    else {
+      group = str("group");
+      name = str("name");
+    }
+    version = str("version");
+  }
+  const versionRef = body.startsWith("{") ? str("version.ref") : void 0;
+  if (!group || !name || !COORDINATE.test(group) || !COORDINATE.test(name))
+    return void 0;
+  return {
+    alias,
+    accessor: accessorOf(alias),
+    group,
+    name,
+    ...version ? { version } : {},
+    ...versionRef ? { versionRef } : {}
+  };
+}
+function gradleCatalogUseOn(line) {
+  const m = new RegExp(`^\\s*${CONFIGURATION}\\s*\\(?\\s*(?:(platform|enforcedPlatform)\\s*\\(\\s*)?([A-Za-z]\\w*)\\.([A-Za-z][\\w.]*?)\\s*\\)?\\s*\\)?\\s*(?:\\{.*)?(?:\\/\\/.*)?\\r?$`).exec(line);
+  const conf = m ? m[2] ?? m[3] : "";
+  if (!m || NOT_A_CONFIGURATION.has(conf) || TOOL_CONFIGURATIONS.has(conf))
+    return void 0;
+  if (/^(bundles|plugins|versions)\./.test(m[6]) || m[5] === "project")
+    return void 0;
+  return {
+    configuration: conf,
+    catalog: m[5],
+    accessor: m[6],
+    scope: scopeOfConfiguration(conf, !!m[4])
   };
 }
 function gradleGroupOn(line) {
-  return /^\s*(?:project\.)?group\s*=?\s*(['"])([^'"]+)\1\s*$/.exec(line)?.[2];
+  return /^\s*(?:(?:allprojects|subprojects)\s*\{\s*)?(?:project\.)?group\s*=?\s*(['"])([^'"]+)\1\s*\}?\s*$/.exec(line)?.[2];
 }
 function gradleNameOn(line) {
   return /^\s*(?:rootProject\.name|archivesBaseName|(?:base\.)?archivesName(?:\.set)?)\s*[=(]?\s*(['"])([^'"]+)\1\s*\)?\s*$/.exec(line)?.[2];
 }
-var PROJECT_GROUP = /^\$\{(project\.|pom\.)?groupId\}$/;
+function gradleProjectsOn(line) {
+  const rename = /^\s*project\s*\(\s*(['"]):?([^'"]+)\1\s*\)\.name\s*=\s*(['"])([^'"]+)\3\s*$/.exec(line);
+  if (rename)
+    return [{ path: rename[2], name: rename[4], renamed: true }];
+  const inc = /^\s*include\s*\(?\s*((?:(['"])[^'"]+\2\s*,?\s*)+)\)?\s*$/.exec(line);
+  if (!inc)
+    return [];
+  return [...inc[1].matchAll(/(['"]):?([^'"]+)\1/g)].map((m) => ({
+    path: m[2],
+    name: m[2].split(":").pop()
+  }));
+}
+function gradleProjects(lines) {
+  const held = PROJECTS.get(lines);
+  if (held)
+    return held;
+  const out = [];
+  let open = "";
+  const names = (text, line) => {
+    for (const m of text.matchAll(/(['"]):?([^'"]+)\1/g))
+      out.push({ path: m[2], name: m[2].split(":").pop(), line });
+  };
+  lines.forEach((raw, i) => {
+    const code2 = raw.replace(/\r$/, "").replace(/\s\/\/.*$|^\s*\/\/.*$/, "");
+    if (open) {
+      names(code2, i + 1);
+      if (open === "paren" ? code2.includes(")") : !/,\s*$/.test(code2))
+        open = "";
+      return;
+    }
+    const rename = gradleProjectsOn(code2);
+    if (rename.length && rename[0].renamed)
+      return void out.push({ ...rename[0], line: i + 1 });
+    const inc = /^\s*include(?!\w)\s*(\(?)\s*(.*)$/.exec(code2);
+    if (!inc)
+      return;
+    names(inc[2], i + 1);
+    if (inc[1] === "(" && !inc[2].includes(")"))
+      open = "paren";
+    else if (inc[1] !== "(" && /,\s*$/.test(inc[2]))
+      open = "comma";
+  });
+  PROJECTS.set(lines, out);
+  return out;
+}
+var PROJECTS = /* @__PURE__ */ new WeakMap();
+function projectDirs(settings) {
+  const dirs = /* @__PURE__ */ new Map();
+  for (const l of settings ?? []) {
+    const m = /^\s*project\s*\(\s*(['"]):?([^'"]+)\1\s*\)\.projectDir\s*=\s*(?:file\s*\(|new\s+File\s*\(\s*(?:settingsDir|rootDir)\s*,)\s*(['"])([^'"]+)\3\s*\)\s*$/.exec(l);
+    if (m)
+      dirs.set(m[2], normDir(m[4]));
+  }
+  return dirs;
+}
+var normDir = (p) => slash(p).replace(/^\.\//, "").replace(/\/(pom\.xml|build\.gradle(\.kts)?)$/i, "").replace(/\/+$/, "");
+var dirOf = (file) => {
+  const f = slash(file);
+  return f.includes("/") ? f.slice(0, f.lastIndexOf("/")) : "";
+};
+var joinDir = (base2, rel) => {
+  const parts = base2 ? base2.split("/") : [];
+  for (const s of normDir(rel).split("/")) {
+    if (!s || s === ".")
+      continue;
+    if (s === "..")
+      parts.pop();
+    else
+      parts.push(s);
+  }
+  return parts.join("/");
+};
+var settingsOf = (linesOf2) => {
+  for (const f of ["settings.gradle", "settings.gradle.kts"]) {
+    const l = linesOf2(f);
+    if (l)
+      return { file: f, lines: l };
+  }
+  return void 0;
+};
+function buildLineOf(f) {
+  if (!isVersionCatalogFile(f.cite.file))
+    return f.cite;
+  return (f.cite.with ?? []).find((p) => isGradleBuildFile(p.file));
+}
+var ENVS = /* @__PURE__ */ new WeakMap();
+function gradleEnvOf(linesOf2) {
+  const held = ENVS.get(linesOf2);
+  if (held)
+    return held;
+  const settings = settingsOf(linesOf2);
+  const env = {
+    ...settings ? { settings } : {},
+    dirs: projectDirs(settings?.lines),
+    projects: settings ? gradleProjects(settings.lines) : []
+  };
+  ENVS.set(linesOf2, env);
+  return env;
+}
+var projectDirOf = (env, project) => env.dirs.get(project) ?? project.replace(/:/g, "/");
+function gradleProjectOf(f, at, linesOf2) {
+  const lines = linesOf2(at.file);
+  if (!lines)
+    return void 0;
+  if (isGradleSettingsFile(at.file)) {
+    const ps = gradleProjects(lines).filter((p) => p.line === at.line);
+    return ps.find((p) => p.name === f.name)?.path ?? (ps.length === 1 ? ps[0].path : void 0);
+  }
+  if (f.kind === "dependency" && isGradleBuildFile(at.file)) {
+    const d = projectDependenciesAt(gradleBlocks(lines), at.line);
+    return "project" in d ? d.project : void 0;
+  }
+  return void 0;
+}
+function isBuildModuleDir(dir, linesOf2) {
+  const want = normDir(dir);
+  const pom = linesOf2("pom.xml");
+  if (pom && pomCoordinates(pom).modules.some((m) => normDir(m.value) === want))
+    return true;
+  for (const f of ["settings.gradle", "settings.gradle.kts"]) {
+    const lines = linesOf2(f);
+    if (!lines)
+      continue;
+    for (const p of gradleProjects(lines))
+      if (normDir(p.path.replace(/^:/, "").replace(/:/g, "/")) === want)
+        return true;
+  }
+  return false;
+}
+function buildModuleOf(f, linesOf2, modules = [], repoComponent) {
+  const listed2 = modules.map((m) => ({ path: normDir(m.path), component: m.component })).filter((m) => m.path).sort((a, b) => b.path.length - a.path.length);
+  const repo = () => repoComponent ? { path: "", component: repoComponent, names: [repoComponent], from: "repo" } : void 0;
+  const of = (dir) => {
+    const m = listed2.find((x) => dir === x.path || dir.startsWith(`${x.path}/`));
+    return m ? { path: m.path, component: m.component, names: [m.component], from: "manifest" } : repo();
+  };
+  const at = buildLineOf(f);
+  if (!at)
+    return repo();
+  if (!listed2.length)
+    return repo();
+  const env = gradleEnvOf(linesOf2);
+  if (f.kind === "dependency" && isGradleBuildFile(at.file) && dirOf(at.file) === "") {
+    const lines = linesOf2(at.file);
+    const stack = lines ? gradleBlocks(lines)[at.line - 1] ?? [] : [];
+    const sub = stack.includes("subprojects");
+    const all2 = stack.includes("allprojects");
+    if ((sub || all2) && !stack.some((b) => projectOf(b) !== void 0)) {
+      const dirs = env.projects.length ? env.projects.filter((p) => !p.renamed).map((p) => projectDirOf(env, p.path)) : listed2.map((m) => m.path);
+      const mods = [...all2 ? [""] : [], ...dirs].flatMap((d) => {
+        const m = of(d);
+        return m ? [m] : [];
+      });
+      const names = [...new Set(mods.map((m) => m.component))].sort();
+      if (names.length === 1)
+        return mods.find((m) => m.component === names[0]);
+      if (names.length > 1)
+        return { path: "", names, from: "manifest", every: true };
+      return repo();
+    }
+  }
+  const project = gradleProjectOf(f, at, linesOf2);
+  return of(project !== void 0 ? projectDirOf(env, project) : dirOf(at.file));
+}
+function buildModuleProblem(f, mod) {
+  if (!mod)
+    return void 0;
+  if (mod.every) {
+    const names = mod.names.join(", ");
+    if (f.component === void 0)
+      return `${f.kind} ${f.id} cites ${f.cite.file}:${f.cite.line}, a dependency every subproject's build takes (components ${names}): write one dependency fact for each, each naming its component`;
+    const c2 = factIdPart(f.component);
+    if (mod.names.some((n) => factIdPart(n) === c2))
+      return void 0;
+    return `${f.kind} ${f.id} names component "${f.component}", and ${f.cite.file}:${f.cite.line} is a dependency of every subproject (components ${names}): name one of them`;
+  }
+  if (f.component === void 0)
+    return void 0;
+  const c = factIdPart(f.component);
+  if (mod.names.some((n) => factIdPart(n) === c))
+    return void 0;
+  if (mod.from === "repo")
+    return `${f.kind} ${f.id} names component "${f.component}", and ${f.cite.file} is a build file of ${mod.component} (repos.manifest.yaml lists no module of the repo there, so it ships as ${mod.component}): a module is a component only when the manifest lists it; name ${mod.component}, or leave component out`;
+  return `${f.kind} ${f.id} names component "${f.component}", and ${f.cite.file} is the build file of module ${mod.component} (${mod.path}/, repos.manifest.yaml's modules): a dependency belongs to the module whose build file declares it; name ${mod.component}, or leave component out`;
+}
 var citedLine = (f, file, line) => f.cite.file === file && f.cite.line === line || (f.cite.with ?? []).some((p) => p.file === file && p.line === line);
-function buildCoordinatesProblem(f, linesOf2) {
+function buildCoordinatesProblem(f, linesOf2, files) {
   const file = f.cite.file;
   const label = `${f.kind} ${f.id}`;
   const lines = linesOf2(file);
   if (!lines)
     return void 0;
   const where = `${file}:${f.cite.line}`;
-  if (isPomFile(file))
-    return pomProblem(f, label, where, pomCoordinates(lines));
+  const named = files ? pomFilesNamed(files, linesOf2) : void 0;
+  if (isPomFileIn(file, named))
+    return pomProblem(f, label, where, {
+      file,
+      pom: pomCoordinates(lines),
+      parents: pomParents(file, linesOf2, files)
+    });
   if (isGradleFile(file))
     return gradleProblem(f, label, where, lines, linesOf2);
   return `${label} cites ${file}, which is no build file Atticus reads coordinates from: cite the pom.xml, build.gradle or settings.gradle line that writes them`;
 }
-function pomProblem(f, label, where, pom) {
+function pomValue(f, label, file, at, ctx, what) {
+  const r = resolvePomValue(at, ctx.pom, { file: ctx.file, parents: ctx.parents });
+  if ("missing" in r)
+    return {
+      problem: `${label}: ${what} at ${file}:${at.line} is \${${r.missing}}, which no <properties> entry or <parent> of ${file}${ctx.parents.length ? ` or of its parent poms (${ctx.parents.map((p) => p.file).join(", ")})` : ""} sets: Atticus can't say what it resolves to`
+    };
+  const uncited = (r.via ?? []).find((l) => !citedLine(f, l.file, l.line));
+  if (uncited !== void 0)
+    return {
+      problem: `${label}: ${what} at ${file}:${at.line} is ${at.value}, written as "${r.value}" through ${uncited.file}:${uncited.line}; cite that line in cite.with`
+    };
+  return { value: r.value };
+}
+var DEPS = /* @__PURE__ */ new WeakMap();
+function dependencyOnLine(pom, line) {
+  let byLine = DEPS.get(pom);
+  if (!byLine) {
+    byLine = /* @__PURE__ */ new Map();
+    for (const d of pom.dependencies)
+      if (d.artifact && !byLine.has(d.artifact.line))
+        byLine.set(d.artifact.line, d);
+    DEPS.set(pom, byLine);
+  }
+  return byLine.get(line);
+}
+var pomScopeOf = (declared) => declared === void 0 ? "compile" : declared.trim() === "system" ? "provided" : declared.trim();
+function pomProblem(f, label, where, ctx) {
+  const pom = ctx.pom;
   const line = f.cite.line;
   const file = f.cite.file;
   if (f.kind === "artifact") {
     if (pom.artifact?.line !== line) {
-      const dep2 = pom.dependencies.find((d) => d.artifact?.line === line);
+      const dep2 = dependencyOnLine(pom, line);
       const what = dep2 ? `a dependency's <artifactId> (${dep2.artifact.value})` : pom.parentArtifact?.line === line ? `the <parent>'s <artifactId> (${pom.parentArtifact.value})` : "not the project's own <artifactId>";
       return `${label} says ${where} is the coordinates the build publishes, and that line is ${what}${pom.artifact ? `: the project's own is at line ${pom.artifact.line}` : ""}`;
     }
-    if (pom.artifact.value !== f.name)
-      return `${label} names "${f.name}", and ${where} writes the project's artifactId as "${pom.artifact.value}"`;
-    const group2 = pom.group ?? pom.parentGroup;
-    if (!group2)
+    const name2 = pomValue(f, label, file, pom.artifact, ctx, "the project's <artifactId>");
+    if ("problem" in name2)
+      return name2.problem;
+    if (name2.value !== f.name)
+      return `${label} names "${f.name}", and ${where} writes the project's artifactId as "${name2.value}"`;
+    const at = pom.group ?? pom.parentGroup;
+    if (!at)
       return `${label} names group "${f.group}", and ${file} writes no groupId of the project or its <parent>`;
+    const inherited = pom.group ? "" : " (the <parent>'s, which the project inherits)";
+    const group2 = pomValue(f, label, file, at, ctx, `the group${inherited}`);
+    if ("problem" in group2)
+      return group2.problem;
     if (group2.value !== f.group)
-      return `${label} names group "${f.group}", and ${file}:${group2.line} writes "${group2.value}"${pom.group ? "" : " (the <parent>'s, which the project inherits)"}`;
-    if (!citedLine(f, file, group2.line))
-      return `${label}: the group is written at ${file}:${group2.line}${pom.group ? "" : " (the <parent>'s)"}; cite that line in cite.with`;
+      return `${label} names group "${f.group}", and ${file}:${at.line} writes "${group2.value}"${inherited}`;
+    if (!citedLine(f, file, at.line))
+      return `${label}: the group is written at ${file}:${at.line}${pom.group ? "" : " (the <parent>'s)"}; cite that line in cite.with`;
     return void 0;
   }
-  const dep = pom.dependencies.find((d) => d.artifact?.line === line);
+  const dep = dependencyOnLine(pom, line);
   if (!dep) {
     const what = pom.artifact?.line === line ? "the project's own <artifactId>" : pom.parentArtifact?.line === line ? "the <parent>'s <artifactId>" : "no dependency's <artifactId>";
     return `${label} says ${where} declares a dependency, and that line is ${what}: cite the <artifactId> line of the <dependency> in <dependencies>`;
@@ -362,51 +1052,137 @@ function pomProblem(f, label, where, pom) {
     return `${label} cites ${where}, a <dependencyManagement> entry, which only pins a version: cite the dependency where <dependencies> declares it`;
   if (dep.plugin)
     return `${label} cites ${where}, a dependency of a build plugin, not of the component: leave it out`;
-  if (dep.artifact.value !== f.name)
-    return `${label} names "${f.name}", and ${where} declares "${dep.artifact.value}"`;
+  const name = pomValue(f, label, file, dep.artifact, ctx, "the dependency's <artifactId>");
+  if ("problem" in name)
+    return name.problem;
+  if (name.value !== f.name)
+    return `${label} names "${f.name}", and ${where} declares "${name.value}"`;
   if (!dep.group)
     return `${label}: the <dependency> at ${where} writes no <groupId>`;
-  const ownGroup = pom.group ?? pom.parentGroup;
-  const group = PROJECT_GROUP.test(dep.group.value) ? ownGroup : dep.group;
-  if (!group || group.value !== f.group)
-    return `${label} names group "${f.group}", and the <dependency> at ${where} writes "${dep.group.value}"${group && group !== dep.group ? ` (${group.value})` : ""}`;
+  const group = pomValue(f, label, file, dep.group, ctx, "the dependency's <groupId>");
+  if ("problem" in group)
+    return group.problem;
+  if (group.value !== f.group)
+    return `${label} names group "${f.group}", and the <dependency> at ${where} writes "${dep.group.value}"${group.value !== dep.group.value ? ` (${group.value})` : ""}`;
   if (!citedLine(f, file, dep.group.line))
     return `${label}: the dependency's group is written at ${file}:${dep.group.line}; cite that line in cite.with`;
-  const declared = dep.scope?.value ?? "compile";
+  const declared = pomScopeOf(dep.scope?.value);
   if (declared !== (f.scope ?? "compile"))
-    return `${label} says scope ${f.scope ?? "compile"}, and the <dependency> at ${where} declares ${declared}${dep.scope ? ` (${file}:${dep.scope.line})` : ""}`;
+    return `${label} says scope ${f.scope ?? "compile"}, and the <dependency> at ${where} declares ${dep.scope?.value.trim() === "system" ? "system, which is recorded as provided" : declared}${dep.scope ? ` (${file}:${dep.scope.line})` : ""}`;
   return void 0;
 }
 function gradleProblem(f, label, where, lines, linesOf2) {
   const text = lines[f.cite.line - 1] ?? "";
+  const file = f.cite.file;
+  if (f.kind === "dependency" && isVersionCatalogFile(file))
+    return catalogProblem(f, label, where, lines, linesOf2);
   if (f.kind === "dependency") {
-    const d = gradleDependencyOn(text);
-    if (!d)
+    const at = isGradleBuildFile(file) ? gradleDependencyAt(lines, f.cite.line) : void 0;
+    const tool = gradleToolConfigurationOn(text);
+    if (!at && tool)
+      return `${label} cites ${where}, the ${tool} tool's own configuration: what it names runs the tool, and is no dependency of the component`;
+    if (!at)
       return `${label} says ${where} declares a dependency, and that line declares none: cite the line in dependencies { } that names it`;
+    if ("none" in at)
+      return `${label} cites ${where}, which is in ${at.none}, not a project's dependencies { }: a version pinned, a constraint or the build's own class path is no dependency of the component`;
+    const d = at.dependency;
     if (d.group !== f.group || d.name !== f.name)
       return `${label} names "${f.group}:${f.name}", and ${where} declares "${d.group}:${d.name}"`;
     if (d.scope !== (f.scope ?? "compile"))
       return `${label} says scope ${f.scope ?? "compile"}, and ${where} declares it with ${d.configuration} (${d.scope})`;
     return void 0;
   }
-  const name = gradleNameOn(text);
-  if (name === void 0)
-    return `${label} says ${where} is the coordinates the build publishes, and that line sets no project name: cite rootProject.name in settings.gradle, or archivesBaseName`;
-  if (name !== f.name)
-    return `${label} names "${f.name}", and ${where} sets "${name}"`;
-  const parts = [{ file: f.cite.file, line: f.cite.line }, ...f.cite.with ?? []];
+  let project;
+  if (isGradleSettingsFile(file)) {
+    const root = gradleNameOn(text);
+    if (root !== void 0) {
+      if (root !== f.name)
+        return `${label} names "${f.name}", and ${where} sets "${root}"`;
+    } else {
+      const all2 = gradleProjects(lines);
+      const ps = all2.filter((x) => x.line === f.cite.line);
+      if (!ps.length)
+        return `${label} says ${where} is the coordinates the build publishes, and that line sets no project name: cite rootProject.name, an include, or a project(':x').name line`;
+      const p = ps.find((x) => x.name === f.name);
+      if (!p)
+        return `${label} names "${f.name}", and ${where} names ${ps.map((x) => `"${x.name}"`).join(", ")}`;
+      const renamed = all2.find((x) => x.renamed && x.path === p.path);
+      if (!p.renamed && renamed)
+        return `${label} names "${f.name}", and ${file}:${renamed.line} names that project "${renamed.name}": cite that line`;
+      project = p.path;
+    }
+  } else {
+    const name = gradleNameOn(text);
+    if (name === void 0)
+      return `${label} says ${where} is the coordinates the build publishes, and that line sets no project name: cite rootProject.name in settings.gradle, or archivesBaseName`;
+    if (name !== f.name)
+      return `${label} names "${f.name}", and ${where} sets "${name}"`;
+    const dir = dirOf(file);
+    if (dir) {
+      const dirs2 = projectDirs(settingsOf(linesOf2)?.lines);
+      project = [...dirs2].find(([, d]) => d === dir)?.[0] ?? dir.replace(/\//g, ":");
+    }
+  }
+  const dirs = projectDirs(settingsOf(linesOf2)?.lines);
+  const ownDir = project === void 0 ? "" : dirs.get(project) ?? project.replace(/:/g, "/");
+  const parts = [{ file, line: f.cite.line }, ...f.cite.with ?? []];
   const groups = parts.flatMap((p) => {
-    const g2 = gradleGroupOn(linesOf2(p.file)?.[p.line - 1] ?? "");
-    return g2 === void 0 ? [] : [{ ...p, group: g2 }];
+    const ls = linesOf2(p.file);
+    const g2 = gradleGroupOn(ls?.[p.line - 1] ?? "");
+    if (g2 === void 0 || !ls || !isGradleBuildFile(p.file))
+      return [];
+    const stack = gradleBlocks(ls)[p.line - 1] ?? [];
+    const pDir = dirOf(p.file);
+    const applies = pDir === ownDir && pDir !== "" ? stack.length === 0 : pDir === "" && (stack.length === 0 ? project === void 0 : stack.length === 1 && (stack[0] === "allprojects" || project !== void 0 && (stack[0] === "subprojects" || projectOf(stack[0]) === project)));
+    return [{ ...p, group: g2, applies }];
   });
-  if (!groups.length)
+  const g = groups.find((x) => x.applies);
+  if (!g) {
+    const other = groups[0];
+    if (other)
+      return `${label}: ${other.file}:${other.line} sets the group of another project than ${f.name}; cite the line that sets ${f.name}'s (group = '${f.group}') in cite.with`;
     return `${label}: no line it cites sets the group; cite the build.gradle line that does (group = '${f.group}') in cite.with`;
-  const g = groups[0];
+  }
   if (g.group !== f.group)
     return `${label} names group "${f.group}", and ${g.file}:${g.line} sets "${g.group}"`;
   return void 0;
 }
-function buildUnrecorded(files, linesOf2, kept) {
+function catalogProblem(f, label, where, lines, linesOf2) {
+  const lib = catalogLibraryAt(lines, f.cite.line);
+  if (!lib)
+    return `${label} cites ${where}, which is no [libraries] entry of the version catalog: cite the entry that gives its coordinates`;
+  if (lib.group !== f.group || lib.name !== f.name)
+    return `${label} names "${f.group}:${f.name}", and ${where} gives ${lib.alias} as "${lib.group}:${lib.name}"`;
+  if (f.version !== void 0) {
+    const v = lib.version ?? (lib.versionRef ? catalogVersions(lines).get(lib.versionRef)?.value : void 0);
+    if (v !== f.version)
+      return `${label} says version ${f.version}, and ${where} gives ${v === void 0 ? "no version Atticus can read" : `"${v}"`}${lib.versionRef ? ` (version.ref = "${lib.versionRef}")` : ""}`;
+  }
+  const catalog = catalogNameOf(f.cite.file);
+  const use = `${catalog}.${lib.accessor}`;
+  let problem;
+  for (const p of f.cite.with ?? []) {
+    if (!isGradleBuildFile(p.file))
+      continue;
+    const ls = linesOf2(p.file);
+    const u = ls ? gradleCatalogUseOn(ls[p.line - 1] ?? "") : void 0;
+    if (!ls || !u || u.catalog !== catalog || u.accessor !== lib.accessor)
+      continue;
+    const at = projectDependenciesAt(gradleBlocks(ls), p.line);
+    if ("none" in at) {
+      problem ??= `${label}: ${p.file}:${p.line} is in ${at.none}, not a project's dependencies { }: a version pinned, a constraint or the build's own class path is no dependency of the component`;
+      continue;
+    }
+    if (u.scope !== (f.scope ?? "compile")) {
+      problem ??= `${label} says scope ${f.scope ?? "compile"}, and ${p.file}:${p.line} declares it with ${u.configuration} (${u.scope})`;
+      continue;
+    }
+    return void 0;
+  }
+  return problem ?? `${label}: ${where} is the catalog's entry, which only names the library; cite the build line in dependencies { } that declares it (${use}) in cite.with`;
+}
+function buildUnrecorded(files, linesOf2, kept, all2) {
+  const named = all2 ? pomFilesNamed(all2, linesOf2) : void 0;
   const cited = new Set(kept.filter((f) => f.kind === "artifact" || f.kind === "dependency").map((f) => `${f.cite.file}:${f.cite.line}`));
   const out = [];
   const add = (file, line, kind, c) => {
@@ -417,19 +1193,26 @@ function buildUnrecorded(files, linesOf2, kept) {
     const lines = linesOf2(file);
     if (!lines)
       continue;
-    if (isPomFile(file)) {
+    if (isPomFileIn(file, named)) {
       const pom = pomCoordinates(lines);
-      const group = pom.group ?? pom.parentGroup;
+      const parents = pomParents(file, linesOf2, all2);
+      const said = (at) => {
+        if (!at)
+          return "?";
+        const r = resolvePomValue(at, pom, { file, parents });
+        return "value" in r ? r.value : at.value;
+      };
       if (pom.artifact)
-        add(file, pom.artifact.line, "artifact", `${group?.value ?? "?"}:${pom.artifact.value}`);
+        add(file, pom.artifact.line, "artifact", `${said(pom.group ?? pom.parentGroup)}:${said(pom.artifact)}`);
       for (const d of pom.dependencies)
         if (!d.managed && !d.plugin && d.artifact)
-          add(file, d.artifact.line, "dependency", `${d.group?.value ?? "?"}:${d.artifact.value}`);
-    } else if (GRADLE_BUILD.test(file.replace(/\\/g, "/"))) {
-      lines.forEach((l, i) => {
-        const d = gradleDependencyOn(l);
-        if (d && d.scope !== "import")
-          add(file, i + 1, "dependency", `${d.group}:${d.name}`);
+          add(file, d.artifact.line, "dependency", `${said(d.group)}:${said(d.artifact)}`);
+    } else if (isGradleBuildFile(file)) {
+      const blocks = gradleBlocks(lines);
+      lines.forEach((_, i) => {
+        const at = gradleDependencyAt(lines, i + 1, blocks);
+        if (at && "dependency" in at && at.dependency.scope !== "import")
+          add(file, i + 1, "dependency", `${at.dependency.group}:${at.dependency.name}`);
       });
     }
   }
@@ -694,6 +1477,7 @@ function rulesOf(c) {
     notProduct: underFolders(c.notProductFolders),
     notRead: notReadTest(c.notReadFolders),
     gatewayBundle: gatewayBundleTest(c.gatewayBundleFolders),
+    gatewayBundleFolders: c.gatewayBundleFolders,
     frameworks: c.frameworks
   };
 }
@@ -851,7 +1635,8 @@ function correctionFor(f, all2) {
   const byCite = corrections.filter((c) => at(c) && c.target.value === f.cite.value);
   const edited = corrections.filter((c) => c.fact === f.id && c.action === "edit");
   const moved = edited.filter((c) => (c.line ?? c.target.line) === f.cite.line);
-  return [...byId, ...byCite, ...moved].sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : 0)[0];
+  const pos = new Map(all2.map((c, i) => [c, i]));
+  return [.../* @__PURE__ */ new Set([...byId, ...byCite, ...moved])].sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : pos.get(b) - pos.get(a))[0];
 }
 function outsidePairingFor(f, all2) {
   const newest = linksFor(f, all2)[0];
@@ -1811,6 +2596,7 @@ var PLACEHOLDER = /^(<[^>]*>|\*+|x{3,}|changeme|change-me|secret|password|todo|t
 var KEY_VALUE = /^\s*(?:-\s+)?(?:export\s+)?["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*(.*?)\s*,?\s*$/;
 var XML_ELEMENT = /<([A-Za-z_][\w.-]*)>([^<]+)<\/\1>/g;
 var XML_NAMED = /\b(?:key|name)\s*=\s*"([^"]+)"\s+value\s*=\s*"([^"]*)"/g;
+var XML_NAMED_AFTER = /\bvalue\s*=\s*"([^"]*)"\s+(?:key|name)\s*=\s*"([^"]+)"/g;
 var CONNECTION_PAIR = /(?:^|[;"'])\s*([A-Za-z][A-Za-z0-9 _.-]*?)\s*=\s*([^;"'<>\s][^;"'<>]*)/g;
 var TOKEN_VALUE_KEY = /^(value|val)$/i;
 var TOKEN_NAME = /^\s*"(xpath|name|key)"\s*:\s*"([^"]+)"/;
@@ -1830,7 +2616,47 @@ function tokenKeyNear(lines, i) {
     }
   return void 0;
 }
+function keyIsSecret(key) {
+  if (hasSecretShape(key))
+    return true;
+  for (const run of key.match(/[0-9a-f]{24,}|[0-9A-F]{24,}/g) ?? [])
+    if (/\d/.test(run) && /[a-f]/i.test(run))
+      return true;
+  const digitsAndLetters = /\d/.test(key) && /[A-Za-z]/.test(key);
+  if (key.length >= 32 && /^[A-Za-z0-9+/=]+$/.test(key) && digitsAndLetters)
+    return true;
+  if (key.length >= 32 && /^[A-Za-z0-9_-]+$/.test(key) && /\d/.test(key) && /[a-z]/.test(key) && /[A-Z]/.test(key))
+    return true;
+  if (key.length < 16 || !/^[A-Za-z0-9+/=]+$/.test(key) || !/\d/.test(key))
+    return false;
+  const kind = (c) => /\d/.test(c) ? 0 : /[a-z]/.test(c) ? 1 : 2;
+  let switches = 0;
+  for (let i = 1; i < key.length; i++)
+    if (kind(key[i]) !== kind(key[i - 1]))
+      switches++;
+  return switches >= key.length / 2;
+}
+function itemNameAbove(lines, i) {
+  const col = /^\s*/.exec(lines[i])[0].length;
+  for (let j = i - 1; j >= 0 && i - j <= 6; j--) {
+    const l = lines[j];
+    if (!l.trim())
+      continue;
+    const lead = /^\s*/.exec(l)[0].length;
+    const item = /^(\s*)-\s+(.*)$/.exec(l);
+    const keyCol = item ? item[1].length + (l.length - item[1].length - item[2].length) : lead;
+    if (keyCol !== col)
+      return void 0;
+    const m = /^(?:\s*-\s+|\s*)(name|key)\s*:\s*["']?([^"'\s#]+)["']?\s*$/.exec(l);
+    if (m)
+      return m[2];
+    if (item)
+      return void 0;
+  }
+  return void 0;
+}
 function liveSecretsIn(file, lines) {
+  const shownKey = (key) => keyIsSecret(key) ? "" : key;
   if (!isConfigFile(file))
     return [];
   const out = [];
@@ -1840,24 +2666,26 @@ function liveSecretsIn(file, lines) {
     const pairs = [];
     const kv = KEY_VALUE.exec(text);
     if (kv) {
-      const key = TOKEN_VALUE_KEY.test(kv[1]) ? tokenKeyNear(lines, i) ?? kv[1] : kv[1];
+      const key = TOKEN_VALUE_KEY.test(kv[1]) ? tokenKeyNear(lines, i) ?? (/\.ya?ml$/i.test(file) ? itemNameAbove(lines, i) : void 0) ?? kv[1] : kv[1];
       pairs.push({ key, value: unquote(kv[2]) });
     }
     for (const m of text.matchAll(XML_ELEMENT))
       pairs.push({ key: m[1], value: m[2].trim() });
     for (const m of text.matchAll(XML_NAMED))
       pairs.push({ key: m[1], value: m[2].trim() });
+    for (const m of text.matchAll(XML_NAMED_AFTER))
+      pairs.push({ key: m[2], value: m[1].trim() });
     if (text.includes(";"))
       for (const m of text.matchAll(CONNECTION_PAIR))
         pairs.push({ key: m[1].trim(), value: m[2].trim() });
     const named = pairs.find(({ key, value }) => value && !PLACEHOLDER.test(value) && // a key with a nested map under it, or an encrypted value (`{cipher}…`), sets nothing here
     !/^[{[]/.test(value) && !isReference(value) && looksLikeSecret(key, value));
     if (named) {
-      out.push({ file, line: i + 1, key: named.key });
+      out.push({ file, line: i + 1, key: shownKey(named.key) });
       return;
     }
     if (hasSecretShape(text))
-      out.push({ file, line: i + 1, key: pairs[0]?.key ?? "(token)" });
+      out.push({ file, line: i + 1, key: pairs[0] ? shownKey(pairs[0].key) : "(token)" });
   });
   return out;
 }
@@ -1880,7 +2708,7 @@ var NOT_TOPIC_LAST = new Set("com org net io dev app ai co uk de fr in jp us eu
 var NOT_TOPIC_FIRST = new Set("com org net io java javax jakarta android androidx kotlin kotlinx scala sun microsoft system google apache spring springframework management server logging hibernate jdk www".split(" "));
 var DOTTED_TOPIC = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*){2,}$/;
 var SEPARATED_NAME = /^[A-Za-z][A-Za-z0-9_]*([._:-][A-Za-z0-9_]+)+$/;
-var QUOTED2 = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
+var QUOTED = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
 var KEY_VALUE2 = /^\s*-?\s*["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*([^\s"'#]+)\s*$/;
 var ELEMENT_TEXT = /<([A-Za-z][\w:.-]*)[^>]*>([^<\s]+)<\/\1>/g;
 var wordsOf = (line) => line.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z]+/).filter(Boolean);
@@ -1999,7 +2827,7 @@ function candidatesIn(path, lines) {
         add("url", u);
       urls.push(m[0]);
     }
-    const strings2 = [...code2.matchAll(QUOTED2)].map((m) => ({
+    const strings2 = [...code2.matchAll(QUOTED)].map((m) => ({
       s: m[2],
       before: code2.slice(0, m.index + 1)
     }));
@@ -2142,6 +2970,7 @@ function reviewedHoldsOf(r, skipped) {
 var SETTINGS_FILE = /\.(ya?ml|properties|json|xml|config|conf|ini|toml|cfg|env)$|(^|\/)\.env(\.[^/]*)?$/i;
 var isSettingsFile = (path) => SETTINGS_FILE.test(path);
 var isYaml = (path) => /\.ya?ml$/i.test(path);
+var DOC_FILE = /\.(md|markdown|mdx|adoc|asciidoc|txt|text|rst|html?|textile|org|rtf|wiki)$/i;
 var isProperties = (path) => /\.properties$/i.test(path);
 var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var YAML_KEY = /^(["']?)([^\s"'#:{}[\],&*!|>][^"'#:]*?)\1\s*:(?:\s+(.*))?$/;
@@ -2169,7 +2998,8 @@ function yamlPathAt(lines, line) {
     return void 0;
   const path = [at.key];
   let col = at.item ? at.lead : at.col;
-  for (let j = line - 2; j >= 0 && col > 0; j--) {
+  let seq = at.item;
+  for (let j = line - 2; j >= 0 && (col > 0 || seq); j--) {
     const l = lines[j];
     if (/^\s*(---|\.\.\.)\s*$/.test(l))
       break;
@@ -2178,10 +3008,17 @@ function yamlPathAt(lines, line) {
       continue;
     if (y.item && y.col === col) {
       col = y.lead;
+      seq = true;
+      continue;
+    }
+    if (seq && !y.item && y.col === col && y.key && !y.rest) {
+      path.unshift(y.key);
+      seq = false;
       continue;
     }
     if (y.col >= col)
       continue;
+    seq = false;
     if (!y.key || y.rest)
       return void 0;
     path.unshift(y.key);
@@ -2225,7 +3062,7 @@ var fieldNames = (seg) => [
 ];
 var CONFIG_PROPS = /@ConfigurationProperties\s*\(\s*(?:(?:prefix|value)\s*=\s*)?"([^"]+)"/;
 function helperBuildsKey(key, cite2, linesOf2) {
-  if (isSettingsFile(cite2.file))
+  if (isSettingsFile(cite2.file) || DOC_FILE.test(cite2.file))
     return false;
   const segs = keySegments(key);
   if (segs.length < 2 || segs.join(".") !== key.trim())
@@ -2236,7 +3073,12 @@ function helperBuildsKey(key, cite2, linesOf2) {
   if (line === void 0)
     return false;
   const code2 = isCommentLine(line) ? line : line.replace(/\/\*.*?\*\//g, "").replace(/(^|\s)\/\/.*$/, "");
-  if (!new RegExp(`(^|[^A-Za-z0-9_$-])${escape(last)}($|[^A-Za-z0-9_$-])`).test(code2))
+  const literals = [];
+  const bare2 = code2.replace(/(["'`])((?:(?!\1)[^\\]|\\.)*)\1/g, (_all, _q, text) => {
+    literals.push(text);
+    return '""';
+  });
+  if (!literals.includes(last) && !new RegExp(`(^|[^A-Za-z0-9_$-])${escape(last)}($|[^A-Za-z0-9_$-])`).test(bare2))
     return false;
   const parts = cite2.with ?? [];
   const files = [...new Set(parts.map((p) => p.file))];
@@ -2270,6 +3112,85 @@ function helperBuildsKey(key, cite2, linesOf2) {
   });
 }
 var norm = (s) => s.replace(/[‘’‚'"“”„`]/g, "").replace(/\s+/g, " ").trim();
+function yamlScalar(rest) {
+  const t = rest.trim().replace(/^!!?[\w/:.-]*\s+/, "");
+  const q = /^(["'])((?:(?!\1).|\1\1)*)\1/.exec(t);
+  if (q)
+    return q[1] === "'" ? q[2].replace(/''/g, "'") : q[2];
+  return t.replace(/\s+#.*$/, "").trim();
+}
+function propertiesValues(line, key, next = []) {
+  let v = line.slice(line.indexOf(key) + key.length).replace(/^\s*[=:]?\s*/, "");
+  for (let i = 0; /(^|[^\\])(\\\\)*\\$/.test(v) && i < next.length; i++)
+    v = v.slice(0, -1) + next[i].replace(/^\s+/, "");
+  return [v.trim(), decodeProperties(v)];
+}
+function decodeProperties(v) {
+  return v.replace(/\\(u[0-9a-fA-F]{4}|.)/g, (_, c) => c.length === 5 ? String.fromCharCode(parseInt(c.slice(1), 16)) : c === "t" ? "	" : c === "n" ? "\n" : c).trim();
+}
+function jsonValueOn(line) {
+  const m = /"value"\s*:\s*("(?:[^"\\]|\\.)*"|[^,}\]\s]+)/.exec(line);
+  if (!m)
+    return void 0;
+  if (!m[1].startsWith('"'))
+    return m[1];
+  try {
+    return JSON.parse(m[1]);
+  } catch {
+    return m[1].slice(1, -1);
+  }
+}
+function jsonFrames(lines) {
+  const out = [];
+  const stack = [];
+  for (let ln = 0; ln < lines.length; ln++) {
+    const l = lines[ln];
+    for (let i = 0; i < l.length; i++) {
+      const ch = l[i];
+      const top = stack[stack.length - 1];
+      if (ch === '"') {
+        let j = i + 1;
+        let text = "";
+        for (; j < l.length && l[j] !== '"'; j++) {
+          if (l[j] === "\\" && j + 1 < l.length)
+            j++;
+          text += l[j];
+        }
+        const isKey = top?.type === "{" && !top.afterColon && /^\s*:/.test(l.slice(j + 1));
+        if (top?.type === "{") {
+          if (isKey)
+            top.pending = text;
+          else if (top.afterColon && top.pending === "name" && top.name === void 0)
+            top.name = text;
+        }
+        i = j;
+        continue;
+      }
+      if (ch === ":" && top?.type === "{")
+        top.afterColon = true;
+      else if (ch === "," && top?.type === "{") {
+        top.afterColon = false;
+        top.pending = void 0;
+      } else if (ch === "{" || ch === "[") {
+        const under4 = top?.type === "{" ? top.pending : top?.under;
+        stack.push({ type: ch, start: ln + 1, end: lines.length, ...under4 ? { under: under4 } : {} });
+      } else if (ch === "}" || ch === "]") {
+        const f = stack.pop();
+        if (f) {
+          out.push({
+            type: f.type,
+            start: f.start,
+            end: ln + 1,
+            ...f.under ? { under: f.under } : {},
+            ...f.name !== void 0 ? { name: f.name } : {}
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+var noExt = (s) => s.trim().toLowerCase().replace(/\.[^.]*$/, "");
 function enclosingObject(lines, line) {
   let depth = 0;
   let start = -1;
@@ -2302,7 +3223,7 @@ function enclosingObject(lines, line) {
   }
   return void 0;
 }
-function configLineProblem(f, linesOf2, listed2) {
+function configLineProblem(f, linesOf2, listed2, bundleFolders = DEFAULT_GATEWAY_BUNDLE_FOLDERS) {
   const lines = linesOf2(f.cite.file);
   if (!lines)
     return void 0;
@@ -2310,17 +3231,29 @@ function configLineProblem(f, linesOf2, listed2) {
   const where = `${f.cite.file}:${f.cite.line}`;
   const segs = keySegments(f.key);
   const value = f.value === void 0 ? void 0 : norm(f.value);
+  const same = (v) => value !== void 0 && v !== void 0 && norm(v) === value;
   const has = (l) => value !== void 0 && norm(l).includes(value);
   if (f.key.trim().startsWith("/") && /(^|\/)config\.json$/i.test(f.cite.file)) {
     const dir = f.cite.file.replace(/[^/]*$/, "");
-    if (!listed2().some((p) => p.startsWith(`${dir}apiproxy/`)))
-      return `config ${where} is a config.json beside no gateway bundle (no ${dir}apiproxy/); a token's setting is read only from the bundle's own`;
+    if (!listed2().some((p) => bundleFolders.some((b) => p.startsWith(`${dir}${b}/`))))
+      return `config ${where} is a config.json beside no gateway bundle (no ${bundleFolders.map((b) => `${dir}${b}/`).join(" or ")}); a token's setting is read only from the bundle's own`;
     const obj = enclosingObject(lines, f.cite.line);
     const xpathRe = new RegExp(`"xpath"\\s*:\\s*"${escape(f.key.trim())}"`);
     if (!obj || !obj.some((l) => xpathRe.test(l)))
       return `the token at ${where} has no "xpath" of ${f.key}`;
-    if (value !== void 0 && !obj.some((l) => /"value"\s*:/.test(l) && has(l)))
+    if (value !== void 0 && !obj.some((l) => same(jsonValueOn(l))))
       return `the token at ${where} sets no such value; cite the token whose "value" it is`;
+    const around = jsonFrames(lines).filter((x) => x.type === "{" && x.start <= f.cite.line && x.end >= f.cite.line).sort((a, b) => b.start - a.start);
+    if (f.target !== void 0) {
+      const file = around.find((x) => /^(targets|policies|proxies)$/i.test(x.under ?? ""));
+      if (!file?.name || noExt(file.name) !== noExt(f.target))
+        return `the token at ${where} is ${file?.name ? `${file.name}'s` : "in no file's list"}, not ${f.target}'s; give the target the token's file is named`;
+    }
+    if (f.env !== void 0) {
+      const conf = around.find((x) => /^configurations$/i.test(x.under ?? ""));
+      if (!conf?.name || conf.name.trim() !== f.env.trim())
+        return `the token at ${where} is in ${conf?.name ? `the ${conf.name} configuration` : "no named configuration"}, not ${f.env}; give the env its configuration is named`;
+    }
     return void 0;
   }
   if (isYaml(f.cite.file)) {
@@ -2331,7 +3264,7 @@ function configLineProblem(f, linesOf2, listed2) {
       if (path.length < segs.length || !sameSegs(tail, segs))
         return `${where} sets ${path.join(".")}, not ${f.key}: the key's parents are not the lines above it`;
       if (value !== void 0 && y.rest && !/^[|>]/.test(y.rest)) {
-        if (!has(y.rest))
+        if (!same(yamlScalar(y.rest)))
           return `${where} sets ${y.key} to something other than the value claimed`;
         return void 0;
       }
@@ -2343,7 +3276,7 @@ function configLineProblem(f, linesOf2, listed2) {
       if (k !== segs.join(".") && !k.endsWith(`.${segs.join(".")}`))
         return `${where} sets ${k}, not ${f.key}`;
       if (value !== void 0) {
-        if (!has(at.slice(at.indexOf(k) + k.length)))
+        if (!propertiesValues(at, k, lines.slice(f.cite.line)).some(same))
           return `${where} sets ${k} to something other than the value claimed`;
         return void 0;
       }
@@ -2353,9 +3286,21 @@ function configLineProblem(f, linesOf2, listed2) {
     return void 0;
   const near = [f.cite.line - 1, f.cite.line, f.cite.line + 1].map((n) => lines[n - 1] ?? "");
   const partLines = (f.cite.with ?? []).map((p) => linesOf2(p.file)?.[p.line - 1] ?? "");
-  if (![...near, ...partLines].some(has))
-    return `${where} (or the line either side) and its parts don't write the value claimed`;
-  return void 0;
+  if ([...near, ...partLines].some(has))
+    return void 0;
+  const hp = /^([^\s:/]+):(\d{1,5})$/.exec(f.value.trim());
+  if (hp) {
+    const parts = f.cite.with ?? [];
+    const written = (want) => parts.some((p) => {
+      if (p.value.trim() !== want)
+        return false;
+      const l = linesOf2(p.file)?.[p.line - 1] ?? "";
+      return new RegExp(`(^|[^A-Za-z0-9.-])${escape(want)}($|[^A-Za-z0-9.-])`).test(l);
+    });
+    if (written(hp[1]) && written(hp[2]))
+      return void 0;
+  }
+  return `${where} (or the line either side) and its parts don't write the value claimed`;
 }
 
 // packages/verify/dist/reachable.js
@@ -2551,6 +3496,122 @@ function methodUnseenOf(f, lines, factOf) {
 }
 
 // packages/verify/dist/verify.js
+var LINE_KEY_VALUE = /^\s*(?:-\s+)?(?:export\s+)?["']?([A-Za-z0-9_.\-[\]]+)["']?\s*[:=]\s*(.*?)\s*,?\s*$/;
+var LINE_XML = [
+  /<([A-Za-z_][\w.-]*)>([^<]+)<\/\1>/g,
+  /\b(?:key|name)\s*=\s*"([^"]+)"\s+value\s*=\s*"([^"]*)"/g
+];
+var unquoted = (v) => v.replace(/^["'`]|["'`]$/g, "").trim();
+function pairsOf(t) {
+  const out = [];
+  const kv = LINE_KEY_VALUE.exec(t);
+  if (kv)
+    out.push({ key: kv[1], value: unquoted(kv[2]) });
+  for (const re of LINE_XML)
+    for (const m of t.matchAll(re))
+      out.push({ key: m[1], value: unquoted(m[2]) });
+  return out;
+}
+function lineSecrets(line) {
+  const t = line.trim();
+  if (!t)
+    return [];
+  const pairs = pairsOf(t);
+  const words = t.split(/[\s"'`=:,;()<>{}[\]/@]+/).filter((w) => w.length >= 6 && credentialLike(w));
+  const holds = redactSecrets(t) !== t || hasSecretShape(t) || quoteHoldsSecret(t) || words.length > 0 || pairs.some((p) => looksLikeSecret(p.key, "x") || p.value && credentialLike(p.value));
+  if (!holds)
+    return [];
+  const literals = [...t.matchAll(/(["'`])((?:(?!\1).){3,})\1/g)].map((m) => m[2]);
+  return [t, t.slice(0, 200), ...pairs.map((p) => p.value), ...literals, ...words].filter((s) => s.length >= 3);
+}
+function citesIn(x, out = []) {
+  if (Array.isArray(x))
+    for (const v of x)
+      citesIn(v, out);
+  else if (x && typeof x === "object") {
+    const o = x;
+    if (typeof o.file === "string" && typeof o.line === "number")
+      out.push(o);
+    for (const v of Object.values(o))
+      if (v && typeof v === "object")
+        citesIn(v, out);
+  }
+  return out;
+}
+function quietFact(f, lineAt) {
+  if (f.kind !== "config")
+    return false;
+  if (looksLikeSecret(f.key, "x") || configSecretField(f))
+    return true;
+  if ([f.value, f.source, f.cite.quote, ...(f.cite.with ?? []).map((w) => w.value)].some((t) => t !== void 0 && (hasSecretShape(t) || credentialLike(t) || redactSecrets(t) !== t)))
+    return true;
+  return lineAt !== void 0 && [f.cite, ...f.cite.with ?? []].some((c) => lineSecrets(lineAt(c.file, c.line) ?? "").length);
+}
+function sanitised(f, message, lineAt, quiet) {
+  let out = redactSecrets(message);
+  const texts = /* @__PURE__ */ new Set();
+  for (const c of citesIn(f))
+    for (const n of [c.line - 1, c.line, c.line + 1])
+      for (const s of lineSecrets(lineAt(c.file, n) ?? ""))
+        texts.add(s);
+  for (const t of [...texts].sort((a, b) => b.length - a.length))
+    out = out.split(t).join("<redacted>");
+  out = out.replace(/"([^"]*)"/g, (all2, inner) => lineSecrets(inner).length ? '"<redacted>"' : all2);
+  return quiet ? scrubbed(f, out) : out;
+}
+function shownFact(f, quiet, lineAt) {
+  if (quiet)
+    return withoutSecret(f);
+  const cites = citesIn(f).filter((c) => c.quote !== void 0);
+  const bad = (c) => {
+    const q = c.quote;
+    if (lineSecrets(q).length)
+      return true;
+    return [c.line - 1, c.line, c.line + 1].some((n) => lineSecrets(lineAt(c.file, n) ?? "").some((s) => s !== "" && q.includes(s)));
+  };
+  if (!cites.some(bad))
+    return f;
+  const strip = (x) => {
+    if (Array.isArray(x))
+      return x.map(strip);
+    if (!x || typeof x !== "object")
+      return x;
+    const o = Object.fromEntries(Object.entries(x).map(([k, v]) => [k, strip(v)]));
+    const c = x;
+    if (typeof c.file === "string" && typeof c.line === "number" && typeof c.quote === "string" && bad(c))
+      delete o.quote;
+    return o;
+  };
+  return strip(f);
+}
+function scrubbed(f, message) {
+  if (f.kind !== "config")
+    return message;
+  const names = new Set([f.key, f.target, f.env, f.cite.file, ...(f.cite.with ?? []).map((w) => w.file)].filter((x) => x !== void 0));
+  const texts = [f.value, f.source, f.cite.quote, ...(f.cite.with ?? []).map((w) => w.value)].flatMap((t) => t === void 0 ? [] : [t, t.trim()]).filter((t) => t.length >= 3 && !names.has(t)).sort((a, b) => b.length - a.length);
+  let out = message;
+  for (const t of texts)
+    out = out.split(t).join("<redacted>");
+  return out;
+}
+var asRead = /* @__PURE__ */ new WeakMap();
+function factAsRead(f) {
+  return asRead.get(f) ?? f;
+}
+function withoutSecret(f) {
+  if (f.kind !== "config")
+    return f;
+  const { quote: _q, ...cite2 } = f.cite;
+  return {
+    ...f,
+    ...f.value !== void 0 ? { value: "<redacted>" } : {},
+    ...f.source !== void 0 ? { source: "<redacted>" } : {},
+    cite: {
+      ...cite2,
+      ...f.cite.with ? { with: f.cite.with.map((w) => ({ ...w, value: "<redacted>" })) } : {}
+    }
+  };
+}
 var FOLLOWED_TYPES = ["event-topic", "mq-queue", "rest", "grpc"];
 function entriesNoFlowFollows(facts, rules = DEFAULT_READ_RULES) {
   const started = new Set(facts.flatMap((f) => f.kind === "flow" ? [f.entry] : []));
@@ -2577,6 +3638,8 @@ var LINES_HELD = 64;
 var SOURCE_EXT = /\.(java|kt|kts|scala|groovy|cs|vb|fs|ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|php|swift|m|mm|c|cc|cpp|h|hpp|sql|graphql|gql|proto|ya?ml|json|xml|properties|toml|ini|conf|tf|tfvars|hcl|bicep|sh|ps1|bat|cmd|gradle|html?|vue|svelte|cshtml|razor|aspx|jsp|ftl|hbs|cob|cbl|cpy|jcl|avsc|wsdl|xsd|csproj|sln|config)$/i;
 var SOURCE_NAME = /(^|\/)(Dockerfile[^/]*|Makefile|Jenkinsfile|Procfile|Containerfile)$/;
 var LOCKFILE = /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|Gemfile\.lock|Cargo\.lock|poetry\.lock|go\.sum|packages\.lock\.json)$/;
+var ENV_FOLDER = /(^|\/)(env|envs|environments?|overlays|stages?)\/[^/]+(?=\/)/gi;
+var testFileOf = (rules, p) => rules.notProduct.test(p.replace(ENV_FOLDER, "$1$2/_"));
 var NOT_PRODUCT = [
   /(\.|_|-)(test|spec|tests|specs)\.[a-z0-9]+$/i,
   /(Test|Tests|IT|Spec)\.(java|kt|scala|groovy|cs|vb)$/,
@@ -2631,8 +3694,9 @@ function claimsOf(f) {
     // A call whose path is a setting's placeholder a helper puts together is checked apart
     // (`helperBuildsKey`): its bare key is never a claim, or a settings line would be a call.
     case "entry":
-    case "call":
       return [routeOrWord(f.path)];
+    case "call":
+      return f.path.trim() === "/" && /^[a-z][a-z0-9+.-]*:\/\/[^/\s?#]+\/?$/i.test(f.cite.value.trim()) ? [routeOrWord(f.path), { kind: "word", value: f.cite.value.trim() }] : [routeOrWord(f.path)];
     case "store":
       return [
         { kind: "word", value: f.name },
@@ -2784,7 +3848,8 @@ async function verifyFacts(o) {
     return lines;
   };
   const deriveEnv = { lines: linesOf2, files: listed2 };
-  const checkCite = (cite2, claims, label, withHint = true, alsoHolds) => {
+  const lineAt = (file, n) => n >= 1 ? linesOf2(file)?.[n - 1] : void 0;
+  const checkCite = (cite2, claims, label, withHint = true, alsoHolds, quiet = false) => {
     const where = `${cite2.file}:${cite2.line}`;
     if (!insideRepo(cite2.file))
       return {
@@ -2837,7 +3902,7 @@ async function verifyFacts(o) {
       !partsNamePath(near(ls, p.line), p.value))
         return {
           code: "claim-not-on-line",
-          message: `${pl} says "${p.value}" is written at ${p.file}:${p.line} (or the line either side), and it isn't`
+          message: quiet ? `${pl} is not written at ${p.file}:${p.line} (or the line either side); cite the line that writes it (its text is not repeated here: it may be a secret)` : `${pl} says "${p.value}" is written at ${p.file}:${p.line} (or the line either side), and it isn't`
         };
       partLines.push(...near(ls, p.line));
     }
@@ -2873,7 +3938,7 @@ async function verifyFacts(o) {
       if (!near2.some((l) => quoteMatches(l, cite2.quote)))
         return {
           code: "quote-mismatch",
-          message: `${label} quotes "${cite2.quote}", but ${where} reads "${line.trim().slice(0, 200)}"`
+          message: quiet ? `${label}'s quote is not what ${where} (or the line either side) reads; neither is repeated here, as either may hold a secret` : `${label} quotes "${cite2.quote}", but ${where} reads "${line.trim().slice(0, 200)}"`
         };
     }
     return void 0;
@@ -2892,6 +3957,8 @@ async function verifyFacts(o) {
   };
   const estate = o.estate ? new Set(o.estate.components.map(factIdPart)) : void 0;
   const serves2 = facts.some((f) => f.kind === "entry");
+  const moduleOf = /* @__PURE__ */ new Map();
+  const placedFrom = /* @__PURE__ */ new Map();
   const repoComponents = new Map(Object.entries(o.estate?.repoComponents ?? {}).map(([r, cs]) => [factIdPart(r), new Set(cs.map(factIdPart))]));
   for (const f of facts) {
     const label = `${f.kind} ${f.id}`;
@@ -2910,12 +3977,17 @@ async function verifyFacts(o) {
     // beta.24): a helper puts the key together (a `@ConfigurationProperties` prefix, a
     // map field, the name passed to a lookup). The cited line is code naming the key's
     // last segment, and one file among the parts proves the rest of the key nests so.
-    f.kind === "call" && PLACEHOLDER_KEY.test(f.path.trim()) && helperBuildsKey(PLACEHOLDER_KEY.exec(f.path.trim())[1], f.cite, linesOf2) : void 0));
+    f.kind === "call" && PLACEHOLDER_KEY.test(f.path.trim()) && helperBuildsKey(PLACEHOLDER_KEY.exec(f.path.trim())[1], f.cite, linesOf2) : void 0, quietFact(f, lineAt)));
     if (f.kind === "config" && !found.has(f.id)) {
-      const bad = configLineProblem(f, linesOf2, listed2);
+      const bad = configLineProblem(f, linesOf2, listed2, rules.gatewayBundleFolders);
       if (bad)
         problem(f, "claim-not-on-line", `${label}: ${bad}`);
     }
+    if (f.kind === "config") {
+      const field = configSecretField(f);
+      if (field)
+        problem(f, "secret-value", `${label}: "${f.key}" carries a secret in its ${field}; cite the line that names the setting and give its source (env:NAME, vault:path), never its value`);
+    }
     if (f.kind === "entry" && f.authCite)
       add(f, checkCite({ ...f.authCite }, [{ kind: "word", value: f.authCite.value }], `${label} authCite${f.auth ? ` (auth ${f.auth})` : ""}`, false));
     if (f.kind === "entry" && f.authCite && f.auth) {
@@ -3006,12 +4078,31 @@ async function verifyFacts(o) {
       if (f.version !== void 0)
         add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
     }
+    const own = o.estate?.repoComponent?.[f.repo];
+    if (own !== void 0 && o.estate) {
+      const to = placedComponentOf(f, {
+        component: own,
+        modules: o.estate.modules?.[f.repo],
+        components: o.estate.components,
+        prototype: o.estate.prototypes?.includes(f.repo)
+      });
+      const top = f.cite?.file?.split("/")[0];
+      if (to !== void 0 && top !== void 0 && isBuildModuleDir(top, linesOf2)) {
+        moduleOf.set(f.id, to);
+        placedFrom.set(f.id, f.component);
+      }
+    }
     if ((f.kind === "artifact" || f.kind === "dependency") && !found.has(f.id)) {
-      const bad = buildCoordinatesProblem(f, linesOf2);
+      const mod = buildModuleOf(f, linesOf2, o.estate?.modules?.[f.repo] ?? [], o.estate?.repoComponent?.[f.repo]);
+      const bad = buildCoordinatesProblem(f, linesOf2, listed2()) ?? buildModuleProblem(f, mod);
       if (bad)
         problem(f, "build-coordinates", bad);
-      else if (f.version !== void 0)
-        add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
+      else {
+        if (mod?.from === "manifest" && mod.component && f.component === void 0)
+          moduleOf.set(f.id, mod.component);
+        if (f.version !== void 0 && !isVersionCatalogFile(f.cite.file))
+          add(f, checkCite(f.cite, [{ kind: "word", value: f.version }], `${label} version`, false));
+      }
     }
     if (f.kind === "flow") {
       f.steps.forEach((s, i) => add(f, checkCite(s.cite, stepClaims(s.kind, s.cite.value), `${label} step ${i + 1}`)));
@@ -3058,11 +4149,17 @@ async function verifyFacts(o) {
   }
   const rejected = /* @__PURE__ */ new Map();
   for (const f of facts) {
-    const ps = found.get(f.id);
+    let ps = found.get(f.id);
     if (!ps?.length)
       continue;
-    rejected.set(f.id, ps.length === 1 ? { fact: f, ...ps[0] } : {
-      fact: f,
+    const isOther = other.has(f.id);
+    const quiet = ps.some((p) => p.code === "secret-value") || quietFact(f, isOther ? void 0 : lineAt);
+    ps = ps.map((p) => ({ ...p, message: sanitised(f, p.message, lineAt, quiet) }));
+    const shown = isOther ? f.kind === "config" && configSecretField(f) || citesIn(f).some((c) => c.quote && lineSecrets(c.quote).length) ? withoutSecret(f) : f : shownFact(f, quiet, lineAt);
+    if (isOther && shown !== f)
+      asRead.set(shown, f);
+    rejected.set(f.id, ps.length === 1 ? { fact: shown, ...ps[0] } : {
+      fact: shown,
       code: ps[0].code,
       message: ps.map((p, i) => `(${i + 1}) ${p.message}`).join(" "),
       problems: ps
@@ -3075,10 +4172,11 @@ async function verifyFacts(o) {
         continue;
       const r = refsOf(f).find((x) => rejected.has(x.id));
       if (r) {
+        const quiet = quietFact(f, lineAt);
         rejected.set(f.id, {
-          fact: f,
+          fact: shownFact(f, quiet, lineAt),
           code: "ref-rejected",
-          message: `${f.kind} ${f.id} names ${r.field} "${r.id}", which was rejected (${rejected.get(r.id).code})`
+          message: sanitised(f, `${f.kind} ${f.id} names ${r.field} "${r.id}", which was rejected (${rejected.get(r.id).code})`, lineAt, quiet)
         });
         changed = true;
       }
@@ -3112,7 +4210,13 @@ async function verifyFacts(o) {
   const accepted = facts.filter((f) => !rejected.has(f.id)).map((f) => {
     o.room?.();
     const verified = f.by === "person" && f.verified !== "none" ? f.verified : "line";
-    const base2 = { ...f, verified, cite: fixQuote(f.cite) };
+    const module = moduleOf.get(f.id);
+    const base2 = {
+      ...f,
+      ...module !== void 0 ? { component: module } : {},
+      verified,
+      cite: fixQuote(f.cite)
+    };
     if (base2.kind === "entry" && base2.auth !== void 0 && !base2.authCite && f.by !== "person")
       authUncited.push({
         id: base2.id,
@@ -3137,7 +4241,7 @@ async function verifyFacts(o) {
   for (const p of o.source.list()) {
     o.room?.();
     if (isSecretPath(p)) {
-      if (insideRepo(p) && isConfigFile(p) && !rules.notProduct.test(p) && !tooBigToRead(o.source, p)) {
+      if (insideRepo(p) && isConfigFile(p) && !testFileOf(rules, p) && !tooBigToRead(o.source, p)) {
         const text = o.source.read(p);
         const ls2 = text === void 0 ? void 0 : text.replace(/\r\n?/g, "\n").split("\n");
         if (ls2 && !binaryLines(ls2))
@@ -3145,11 +4249,23 @@ async function verifyFacts(o) {
       }
       continue;
     }
-    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p))
+    const scanOnly = () => {
+      if (!insideRepo(p) || !isConfigFile(p) || LOCKFILE.test(p) || testFileOf(rules, p) || tooBigToRead(o.source, p))
+        return;
+      const ls2 = readLines(p);
+      if (ls2 && !binaryLines(ls2))
+        secrets.push(...liveSecretsIn(p, ls2));
+    };
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(o.source, p)) {
+      scanOnly();
       continue;
+    }
     const ls = readLines(p) ?? [""];
-    if (!isSourceFile(p, ls[0] ?? "", ls, rules))
+    if (!isSourceFile(p, ls[0] ?? "", ls, rules)) {
+      if (isConfigFile(p) && !LOCKFILE.test(p) && !testFileOf(rules, p) && !binaryLines(ls))
+        secrets.push(...liveSecretsIn(p, ls));
       continue;
+    }
     if (excludeRes.some((re) => re.test(p)))
       excluded.push(p);
     else {
@@ -3256,7 +4372,14 @@ async function verifyFacts(o) {
     const held = files.flatMap(skippedIn);
     return held.length ? [reviewedHoldsOf(entry, held)] : [];
   });
-  const unrecorded = buildUnrecorded([...touched].filter((p) => isBuildFile(p) && insideRepo(p) && !isSecretPath(p)), (p) => linesOf2(p), accepted);
+  const namedPoms = [...touched].some((p) => isBuildFile(p)) ? pomFilesNamed(listed2(), linesOf2) : void 0;
+  const placed = accepted.filter((f) => placedFrom.has(f.id)).map((f) => ({
+    id: f.id,
+    named: placedFrom.get(f.id),
+    component: f.component,
+    cite: `${f.cite.file}:${f.cite.line}`
+  })).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  const unrecorded = buildUnrecorded([...touched].filter((p) => isBuildFileIn(p, namedPoms) && insideRepo(p) && !isSecretPath(p)), (p) => linesOf2(p), accepted, listed2());
   return {
     accepted,
     // a rejected fact goes back as it was read, at its own commit, even one that was carried
@@ -3284,12 +4407,13 @@ async function verifyFacts(o) {
     reviewedHolds,
     specOpsUncovered,
     frameworkGaps: frameworkGaps(accepted, rules.frameworks),
-    ...unrecorded.length ? { buildUnrecorded: unrecorded } : {}
+    ...unrecorded.length ? { buildUnrecorded: unrecorded } : {},
+    ...placed.length ? { componentsPlaced: placed } : {}
   };
 }
 
 // packages/verify/dist/batches.js
-var BUILD = /(^|\/)(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|go\.mod|Cargo\.toml|pyproject\.toml|setup\.py|requirements[^/]*\.txt|Gemfile|[^/]+\.gemspec|composer\.json|[^/]+\.(csproj|sln|tf|tfvars|bicep|hcl)|Dockerfile[^/]*|Containerfile|Jenkinsfile|Makefile|Procfile|(docker-)?compose[^/]*\.ya?ml|Chart\.yaml|values[^/]*\.ya?ml|azure-pipelines[^/]*\.ya?ml|\.gitlab-ci\.yml|bitbucket-pipelines\.yml|serverless\.ya?ml|template\.ya?ml|manifest\.ya?ml)$/;
+var BUILD = /(^|\/)(pom\.xml|[^/]+[-_.]pom\.xml|[^/]+\.pom|gradle\/[\w-]+\.versions\.toml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|package\.json|go\.mod|Cargo\.toml|pyproject\.toml|setup\.py|requirements[^/]*\.txt|Gemfile|[^/]+\.gemspec|composer\.json|[^/]+\.(csproj|sln|tf|tfvars|bicep|hcl)|Dockerfile[^/]*|Containerfile|Jenkinsfile|Makefile|Procfile|(docker-)?compose[^/]*\.ya?ml|Chart\.yaml|values[^/]*\.ya?ml|azure-pipelines[^/]*\.ya?ml|\.gitlab-ci\.yml|bitbucket-pipelines\.yml|serverless\.ya?ml|template\.ya?ml|manifest\.ya?ml)$/;
 var DEPLOY_DIR = /(^|\/)(\.github\/workflows|\.circleci|k8s|kubernetes|helm|charts|deploy|deployment|deployments|manifests|infra|terraform|pipelines?)\//;
 var CONFIG = /(^|\/)((application|bootstrap)[^/]*\.(ya?ml|properties)|appsettings[^/]*\.json|[^/]+\.(properties|conf|ini|toml)|web\.config|config\/[^/]+\.(ya?ml|json))$/;
 var ENTRY_NAME = /(^|[._-])(main|app|application|server|program|startup|index|lambda|handler|function|cli)$|(controller|resource|router|routes?|handlers?|listener|consumer|subscriber|endpoints?|api|job|scheduler|worker|webhook|servlet|page|screen|view)$/i;
@@ -3548,7 +4672,7 @@ var BUILD_FILE = /^(pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|pack
 var AGGREGATOR = /^(pom\.xml|settings\.gradle(\.kts)?|package\.json|pnpm-workspace\.yaml|lerna\.json|Cargo\.toml|go\.work)$/;
 var byPath = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var nameOf = (path) => path.slice(path.lastIndexOf("/") + 1);
-var dirOf = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
+var dirOf2 = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : "";
 var under = (path, dir) => !dir || path.startsWith(`${dir}/`);
 var quoted = (s) => [...s.matchAll(/["']([^"'\n]+)["']/g)].map((m) => m[1]);
 var clean = (m) => m.trim().replace(/^\.\//, "").replace(/\/pom\.xml$/, "").replace(/\/+$/, "");
@@ -3562,7 +4686,7 @@ function json(text) {
 var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
 function buildModules(path, text) {
   const name = nameOf(path);
-  const dir = dirOf(path);
+  const dir = dirOf2(path);
   let found = [];
   if (name === "pom.xml")
     found = [...text.matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)].map((m) => m[1]);
@@ -3618,11 +4742,11 @@ function packageRoots(paths, inits, read) {
   let readCount = 0;
   for (const p of paths) {
     if (/\.py$/i.test(p)) {
-      let d = dirOf(p);
+      let d = dirOf2(p);
       let top;
       while (d && inits.has(d)) {
         top = d;
-        d = dirOf(d);
+        d = dirOf2(d);
       }
       if (top)
         roots.add(nameOf(top).toLowerCase());
@@ -3641,7 +4765,7 @@ function vendoredProjects(all2, read) {
   const licenses = /* @__PURE__ */ new Map();
   const builds = /* @__PURE__ */ new Map();
   for (const p of files) {
-    const d = dirOf(p);
+    const d = dirOf2(p);
     if (LICENSE_FILE.test(nameOf(p)) && !licenses.has(d))
       licenses.set(d, p);
     if (BUILD_FILE.test(nameOf(p)))
@@ -3652,7 +4776,7 @@ function vendoredProjects(all2, read) {
     for (const p of files)
       if (AGGREGATOR.test(nameOf(p)))
         for (const m of buildModules(p, read(p) ?? ""))
-          modules.push({ from: dirOf(p), re: globToRegExp(m) });
+          modules.push({ from: dirOf2(p), re: globToRegExp(m) });
   }
   const included = (dir) => modules.some((m) => m.from !== dir && under(dir, m.from) && m.re.test(dir));
   const nested = [];
@@ -3672,7 +4796,7 @@ function vendoredProjects(all2, read) {
   }
   const out = [...nested];
   if (copied.length) {
-    const inits = new Set(files.filter((p) => nameOf(p) === "__init__.py").map(dirOf));
+    const inits = new Set(files.filter((p) => nameOf(p) === "__init__.py").map(dirOf2));
     const apart = [...copied, ...nested.map((n) => n.dir)];
     const text = read ?? (() => void 0);
     const mine = packageRoots(files.filter((p) => !apart.some((d) => under(p, d))), inits, text);
@@ -3833,11 +4957,11 @@ function unitsOf(dir, fs, room) {
   const children = /* @__PURE__ */ new Map();
   for (const f of fs) {
     const rest = f.path.slice(prefix.length);
-    const slash = rest.indexOf("/");
-    if (slash < 0)
+    const slash2 = rest.indexOf("/");
+    if (slash2 < 0)
       direct.push(f);
     else {
-      const child = prefix + rest.slice(0, slash);
+      const child = prefix + rest.slice(0, slash2);
       children.set(child, [...children.get(child) ?? [], f]);
     }
   }
@@ -3854,11 +4978,11 @@ function groupUnits(dir, fs, room, holds) {
   const children = /* @__PURE__ */ new Map();
   for (const f of fs) {
     const rest = f.path.slice(prefix.length);
-    const slash = rest.indexOf("/");
-    if (slash < 0)
+    const slash2 = rest.indexOf("/");
+    if (slash2 < 0)
       direct.push(f);
     else {
-      const child = prefix + rest.slice(0, slash);
+      const child = prefix + rest.slice(0, slash2);
       children.set(child, [...children.get(child) ?? [], f]);
     }
   }
@@ -4486,7 +5610,8 @@ function lineLegend(marks) {
   }
   return "modify";
 }
-function changeView(records2, change, flows, known = []) {
+function changeView(records2, change, flows, known = [], retired = []) {
+  const gone = new Set(retired);
   const c = new Catalog(records2);
   const inSpecs = new Set(known);
   const isKnown = (id) => c.components.has(id) || c.isSystem(id) || inSpecs.has(id);
@@ -4523,6 +5648,9 @@ function changeView(records2, change, flows, known = []) {
       }
     }
   }
+  for (const id of gone)
+    if (comps.has(id))
+      legends.set(id, "retire");
   const withMark = (id) => {
     const l = legends.get(id);
     return l ? { legend: l } : {};
@@ -5130,13 +6258,22 @@ var HOW_OF_FLAG = {
   // ADR 0160 (O3): answered by an entry of another team's shared map.
   [JOINED_TO_SHARED_MAP]: "shared"
 };
-var GUESS_FLAGS = new Set(JOIN_GUESS_FLAGS);
+var NOT_VERIFYING_FLAGS = /* @__PURE__ */ new Set([
+  ...JOIN_GUESS_FLAGS,
+  JOINED_BY_PERSON,
+  JOINED_BY_AI,
+  JOINED_BY_PATH_OVERLAP
+]);
+var ALSO_OF_FLAG = {
+  ...HOW_OF_FLAG,
+  [JOINED_BY_PATH_OVERLAP]: "path"
+};
 function joinHow(i) {
   const flags = i.flags ?? [];
   const topic = i.via === "event-bus" || i.via === "mq";
   if (i.confidence === "verified") {
     for (const f of flags)
-      if (HOW_OF_FLAG[f] && !GUESS_FLAGS.has(f))
+      if (HOW_OF_FLAG[f] && !NOT_VERIFYING_FLAGS.has(f))
         return HOW_OF_FLAG[f];
     if (topic)
       return "topic";
@@ -5148,12 +6285,17 @@ function joinHow(i) {
     return "topic";
   return "unknown";
 }
-var GUESS_HOWS = new Set(JOIN_GUESS_FLAGS.map((f) => HOW_OF_FLAG[f]).filter(Boolean));
+var GUESS_HOWS = new Set([...NOT_VERIFYING_FLAGS].map((f) => HOW_OF_FLAG[f]).filter(Boolean));
 function alsoOf(i, how) {
   if (i.confidence !== "verified" || GUESS_HOWS.has(how))
     return [];
+  const flags = i.flags ?? [];
+  const byBase = how !== "base-path" && flags.includes(JOINED_BY_BASE_PATH);
   return [
-    ...new Set((i.flags ?? []).flatMap((f) => GUESS_FLAGS.has(f) && HOW_OF_FLAG[f] ? [HOW_OF_FLAG[f]] : []))
+    ...new Set(flags.flatMap((f) => {
+      const also = byBase && f === JOINED_BY_PATH ? "base-path" : ALSO_OF_FLAG[f];
+      return NOT_VERIFYING_FLAGS.has(f) && also && also !== how ? [also] : [];
+    }))
   ];
 }
 function joinOf(i) {
@@ -5227,6 +6369,17 @@ var props = (o) => {
 var all = (rs, k) => rs.filter((r) => r.kind === k).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
 function dependencyJoin(l) {
   const lines = (end) => end.lines.map((at) => ({ source: "code", repo: end.repo, at }));
+  const facts = l.facts?.length ? l.facts : [l.from];
+  const caller = [];
+  for (const f of facts)
+    for (const e of lines(f))
+      if (!caller.some((x) => x.repo === e.repo && x.at === e.at))
+        caller.push(e);
+  const callee = [];
+  for (const p of l.published?.length ? l.published : [l.to])
+    for (const e of lines(p))
+      if (!callee.some((x) => x.repo === e.repo && x.at === e.at))
+        callee.push(e);
   return {
     interface: dependencyLinkId(l),
     from: l.from.component,
@@ -5235,15 +6388,25 @@ function dependencyJoin(l) {
     gateway: false,
     // code at both ends, each claim checked on its line, and nobody had to guess
     verified: true,
-    caller: lines(l.from),
-    callee: lines(l.to),
+    caller,
+    callee,
     hops: [],
     other: [],
     dependency: {
       group: l.group,
       name: l.name,
       ...l.version ? { version: l.version } : {},
-      ...l.scope ? { scope: l.scope } : {}
+      ...l.scope ? { scope: l.scope } : {},
+      facts: facts.map((f) => ({
+        repo: f.repo,
+        fact: f.fact,
+        at: f.at,
+        lines: f.lines,
+        ...f.group !== void 0 ? { group: f.group } : {},
+        ...f.name !== void 0 ? { name: f.name } : {},
+        ...f.version !== void 0 ? { version: f.version } : {},
+        ...f.scope !== void 0 ? { scope: f.scope } : {}
+      }))
     }
   };
 }
@@ -6781,6 +7944,7 @@ export {
   frameworkGaps,
   frameworksToLearn,
   readRulesOf,
+  keyIsSecret,
   lineRangeOf,
   parseReviewed,
   readingRank,
@@ -6793,6 +7957,7 @@ export {
   isEntryPointFile,
   NOT_REACHED_WHY,
   reachableModels,
+  factAsRead,
   sameCommit,
   staleMessage,
   verifyFacts,