@maycombhq/atticus 2.0.0-beta.25 → 2.0.0-beta.27

package/dist/chunk-VC2XHC7P.js

@@ -0,0 +1,424 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  askHosts
+} from "./chunk-OQ7SBQ2Z.js";
+import {
+  driftAfterScan
+} from "./chunk-YSSFS3YC.js";
+import {
+  buildPlanOf,
+  pageChanged,
+  refusalPlanOf
+} from "./chunk-QCRQNYGI.js";
+import {
+  buildAndWrite,
+  buildLines,
+  diffCatalogs,
+  diffIsEmpty,
+  readCatalog,
+  scanEstate,
+  writeRefusedReport
+} from "./chunk-QC6GSNIK.js";
+import {
+  readersSlotPath,
+  serializeReadersSlot,
+  sourcesRelOf,
+  writeReadersSlots
+} from "./chunk-UWBODTY7.js";
+import {
+  loadRepos
+} from "./chunk-X5B7KYPD.js";
+import {
+  catalogDirOf,
+  throwIfCancelled
+} from "./chunk-WJWSB65O.js";
+import {
+  LockHeldError,
+  acquireLock
+} from "./chunk-SMFFUFMN.js";
+
+// packages/cli/dist/scan-commands.js
+import { join } from "node:path";
+function diffLines(d) {
+  if (diffIsEmpty(d))
+    return ["No catalog changes."];
+  const lines = [
+    `${d.added.length} added, ${d.removed.length} removed, ${d.changed.length} changed, ${d.evidenceOnly.length} with new evidence only`,
+    ...d.added.map((r) => `+ ${r.kind}/${r.id}`),
+    ...d.removed.map((r) => `- ${r.kind}/${r.id}`),
+    ...d.changed.map((r) => `~ ${r.kind}/${r.id} (${r.fields.join(", ")})`)
+  ];
+  return lines;
+}
+function unreadMessage(u) {
+  switch (u.why) {
+    case "not-cloned":
+      return "not cloned here; clone it with atticus workspace sync";
+    case "unreadable":
+      return `its clone can't be read (${u.detail ?? "git couldn't read it"}); clone it again with atticus workspace sync`;
+    case "run-failed":
+      return `${(u.runs ?? []).map((r) => `the run of ${r.extractor} failed (${r.error})`).join("; ")}, so its read is short of what that run reads; fix it, then scan again`;
+    case "not-asked":
+      return "left out by --repos";
+  }
+}
+function scanRefusal(scan) {
+  if (scan.observations.some((o) => o.full))
+    return void 0;
+  const unread = scan.unread;
+  const lines = unread.map((u) => `${u.repo}: ${unreadMessage(u)}`);
+  for (const o of scan.observations)
+    if (!o.full && !unread.some((u) => u.repo === o.repo))
+      lines.push(`${o.repo}: ${keptWhy({ reason: o.why, ...o.detail ? { detail: o.detail } : {} })}`);
+  return {
+    reasons: ["nothing-read"],
+    repos: unread.map((u) => ({
+      repo: u.repo,
+      why: u.why,
+      message: unreadMessage(u),
+      ...u.runs ? { runs: u.runs } : {}
+    })),
+    message: [
+      "Nothing written: the scan read no repo in full, so every slot and catalog/generated are as they were:",
+      ...lines.map((l) => `  ${l}`),
+      "Clone the repos (atticus workspace sync) or fix what stopped their read, then scan again."
+    ].join("\n")
+  };
+}
+function scanSources(scan, slots) {
+  return scan.observations.map((o) => {
+    const s = slots.find((x) => x.repo === o.repo);
+    const built = scan.build?.sources.find((x) => x.repo === o.repo);
+    return {
+      repo: o.repo,
+      source: built?.source ?? "none",
+      ...built?.commit ? { sourceCommit: built.commit } : {},
+      slot: s?.slot ?? "none",
+      ...s?.commit ? { commit: s.commit } : {},
+      ...s?.reason ? { reason: s.reason } : {},
+      ...s?.detail ? { detail: s.detail } : {},
+      ...o.factsStale ? { factsStale: o.factsStale } : {}
+    };
+  });
+}
+var short = (c) => /^[0-9a-f]{8,}$/.test(c) ? c.slice(0, 7) : c;
+function keptWhy(s) {
+  switch (s.reason) {
+    case "not-cloned":
+      return "it isn't cloned here";
+    case "unreadable":
+      return "its clone can't be read";
+    case "not-asked":
+      return "--repos left it out";
+    case "run-failed":
+      return `a run failed (${s.detail ?? "a reader"})`;
+    case "plugin-refused":
+      return `a plugin that applies to it isn't used (${s.detail ?? "a plugin"})`;
+    case "readers-off":
+      return "the readers are switched off (ATTICUS_HELPERS_OFF=readers)";
+    case "dirty":
+      return "its clone has changes not committed (commit or stash them, then scan again)";
+    case "refused":
+      return "the scan wrote nothing";
+    case "dry-run":
+      return "a dry run writes nothing";
+    default:
+      return "it wasn't read in full";
+  }
+}
+function sourceLines(rel, sources, wrote) {
+  const out = [];
+  if (wrote) {
+    const n = (k) => sources.filter((s) => s.slot === k).length;
+    out.push(`${rel}/readers: ${n("written")} written, ${n("unchanged")} unchanged`);
+    for (const s of sources)
+      if (s.reason && s.reason !== "refused" && s.reason !== "dry-run")
+        out.push(s.slot === "kept-last-good" ? `${s.repo}: its readers slot keeps its last good read${s.commit ? ` (commit ${short(s.commit)})` : ""}: ${keptWhy(s)}.` : `${s.repo}: no readers slot written: ${keptWhy(s)}.`);
+  }
+  for (const s of sources) {
+    const f = s.factsStale;
+    if (!f)
+      continue;
+    const at = `${rel}/facts/${s.repo}.jsonl`;
+    if (f.unusable)
+      out.push(`${s.repo}: its facts snapshot (${at}) ${f.unusable}, so it isn't used; write it again: ${f.command}`);
+    else if (f.notComparable)
+      out.push(`${s.repo}: its facts snapshot (${at}) is of commit ${short(f.commit)}, which can't be compared with ${short(f.head)} here; the snapshot stays as it is; refresh it: ${f.command}`);
+    else {
+      const shown = f.files.slice(0, 5).map((x) => `${x.path} ${x.how}${x.to ? ` to ${x.to}` : ""}: ${x.facts.slice(0, 5).join(", ")}${x.facts.length > 5 ? ` and ${x.facts.length - 5} more` : ""}`);
+      if (f.files.length > 5)
+        shown.push(`${f.files.length - 5} more files`);
+      out.push(`${s.repo}: its facts snapshot (${at}, commit ${short(f.commit)}) is stale at ${short(f.head)}: ${f.facts} ${f.facts === 1 ? "fact cites" : "facts cite"} files changed since (${shown.join("; ")}). The snapshot stays as it is; refresh it: ${f.command}`);
+    }
+  }
+  return out;
+}
+function saidByRefusal(p, refused) {
+  const r = refused?.repos.find((x) => x.repo === p.repo);
+  if (!r)
+    return false;
+  return p.source === "workspace" || (r.runs ?? []).some((x) => x.extractor === String(p.source ?? ""));
+}
+function scanSummaryLines(report) {
+  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+  const n = (x, one) => `${x} ${one}${x === 1 ? "" : "s"}`;
+  const refusal = report.refused;
+  const problemLines = () => (Array.isArray(report.problems) ? report.problems : []).filter((p) => !saidByRefusal(p ?? {}, refusal)).map((p) => {
+    const x = p ?? {};
+    return `${x.repo ? `${String(x.repo)}: ` : ""}${x.source ? `${String(x.source)}: ` : ""}${String(x.message ?? "")}`;
+  });
+  if (typeof report.branch === "string") {
+    const repos = (Array.isArray(report.repos) ? report.repos : []).map((r) => String(r.id ?? ""));
+    const d = report.diff;
+    return [
+      `Scanned ${report.branch} of ${repos.join(", ")} into ${String(report.folder ?? "")}/generated.`,
+      ...d ? [`${report.branch} against the baseline: ${diffLines(d)[0]}`] : [],
+      ...problemLines()
+    ];
+  }
+  if (!report.stats)
+    return [];
+  const s = report.stats;
+  const out = [
+    `Scanned ${n(num(s.repos), "repo")}: ${n(num(s.records), "record")}, ${n(num(s.interfaces), "interface")} (${num(s.verified)} verified), ${n(num(s.unresolved), "loose end")}.`
+  ];
+  const f = report.files;
+  if (f)
+    out.push(`catalog/generated: ${num(f.written)} written, ${num(f.unchanged)} unchanged, ${num(f.removed)} removed`);
+  for (const note of Array.isArray(report.notes) ? report.notes : [])
+    out.push(`note: ${String(note)}`);
+  out.push(...problemLines());
+  const w = Array.isArray(report.warnings) ? report.warnings.length : 0;
+  if (w)
+    out.push(`${n(w, "warning")}: atticus scan --warnings lists ${w === 1 ? "it" : "them"}`);
+  if (Array.isArray(report.sources))
+    out.push(...sourceLines(typeof report.sourcesDir === "string" ? report.sourcesDir : "catalog/sources", report.sources, report.written === true));
+  if (typeof refusal?.message === "string")
+    out.push(...refusal.message.split("\n"));
+  return out;
+}
+function driftLine(d) {
+  const head = `Drift check for ${d.change} (${d.state})`;
+  if (d.error)
+    return `${head} couldn't run: ${d.error}`;
+  if (d.round === void 0)
+    return `${head}: no drift.`;
+  const what = `${d.open} open finding${d.open === 1 ? "" : "s"}${d.blocking ? ` (${d.blocking} blocking)` : ""}`;
+  return `${head}: ${what} in review/drift/${d.round}${d.unchanged ? ", nothing new" : ""}.`;
+}
+async function scanCommand(root, o, io) {
+  if (o.repos && o.repos.length > 0) {
+    const known = new Set((await loadRepos(root)).map((r) => r.id));
+    const unknown = o.repos.filter((r) => !known.has(r));
+    if (unknown.length > 0) {
+      io.err(`Not in any repos.manifest.yaml: ${unknown.join(", ")}`);
+      return 2;
+    }
+  }
+  let lock;
+  if (!o.dryRun) {
+    try {
+      lock = await acquireLock(root, "scan", "scan");
+    } catch (e) {
+      if (e instanceof LockHeldError) {
+        io.err(e.message);
+        return 1;
+      }
+      throw e;
+    }
+    if (lock.interrupted)
+      io.err(`The last scan (started ${lock.interrupted.startedAt}) stopped before it finished; this one brings the catalog up to date.`);
+  }
+  try {
+    if (o.ref) {
+      const { scanBranch } = await import("./chunk-3PWXVBCB.js");
+      return await scanBranch(root, o.ref, {
+        ...o.repos ? { repos: o.repos } : {},
+        ...o.full ? { full: true } : {},
+        ...o.json ? { json: true } : {},
+        ...o.allowRemovals !== void 0 ? { allowRemovals: o.allowRemovals } : {},
+        ...o.discardEdits !== void 0 ? { discardEdits: o.discardEdits } : {},
+        ...o.plan !== void 0 ? { plan: o.plan } : {}
+      }, io);
+    }
+    return await scanLocked(root, o, io);
+  } finally {
+    await lock?.release();
+  }
+}
+async function scanLocked(root, o, io) {
+  const out = join(catalogDirOf(root), "generated");
+  const before = await readCatalog(out, { cacheRoot: root, fresh: true });
+  const started = Date.now();
+  const scan = await scanEstate({
+    root,
+    ...o.repos ? { repos: o.repos } : {},
+    ...o.full ? { cache: null } : {}
+  });
+  throwIfCancelled();
+  const command = `atticus scan${o.repos?.length ? ` --repos ${o.repos.join(",")}` : ""}`;
+  const unreadAll = scanRefusal(scan);
+  if (unreadAll && !o.dryRun)
+    await writeRefusedReport(root, command, {
+      reasons: ["nothing-read"],
+      message: unreadAll.message,
+      unread: unreadAll.repos.map((r) => ({ repo: r.repo, why: r.message }))
+    });
+  const slotWrites = scan.observations.flatMap((x) => x.full ? [{ path: readersSlotPath(root, x.repo), text: serializeReadersSlot(x.slot) }] : []);
+  const planned = await writeReadersSlots(root, scan.observations, { hold: "dry-run" });
+  const built = unreadAll ? void 0 : await buildAndWrite(root, {
+    command,
+    build: scan.build,
+    slots: slotWrites,
+    ...o.dryRun ? { check: true } : {},
+    ...o.allowRemovals !== void 0 ? { allowRemovals: o.allowRemovals } : {},
+    ...o.discardEdits !== void 0 ? { discardEdits: o.discardEdits } : {},
+    // The app's confirm: the list worked out again under the lock (the review of beta.27).
+    ...o.plan !== void 0 && !o.dryRun ? { expect: (listed) => buildPlanOf(listed) === o.plan } : {}
+  });
+  const guardRefused = built && !o.dryRun ? built.guard.refused : void 0;
+  const changed = built?.changed ? pageChanged("what the build would remove or discard") : void 0;
+  const refused = unreadAll ?? (changed && !guardRefused ? { reasons: [], repos: [], message: changed } : void 0) ?? (guardRefused ? {
+    reasons: guardRefused.reasons,
+    repos: [],
+    message: changed ? `${changed}
+${guardRefused.message}` : guardRefused.message,
+    ...guardRefused.removals ? { removals: guardRefused.removals } : {},
+    ...guardRefused.unexplained ? { unexplained: guardRefused.unexplained } : {},
+    ...guardRefused.allowRemovals !== void 0 ? { allowRemovals: guardRefused.allowRemovals } : {},
+    ...guardRefused.edits ? { edits: guardRefused.edits } : {},
+    ...guardRefused.discardEdits !== void 0 ? { discardEdits: guardRefused.discardEdits } : {},
+    plan: refusalPlanOf(guardRefused)
+  } : void 0);
+  const w = built?.write;
+  const diff = refused ? { added: [], removed: [], changed: [], evidenceOnly: [] } : diffCatalogs(before.records, scan.records);
+  const slots = planned.map((x) => {
+    if (x.reason !== "dry-run")
+      return x;
+    const obs = scan.observations.find((y) => y.repo === x.repo);
+    if (w && obs?.full)
+      return { repo: x.repo, slot: "written", commit: obs.slot.commit };
+    return { ...x, reason: o.dryRun ? "dry-run" : "refused" };
+  });
+  const sources = scanSources(scan, slots);
+  const write = w ? { written: w.written, unchanged: w.unchanged, removed: w.removed } : void 0;
+  const drift = write && !o.noDrift ? await driftAfterScan(root) : [];
+  const hosts = write ? await askHosts(root, scan.records, {
+    command: "atticus scan",
+    ...o.askFrom ? { only: o.askFrom } : {}
+  }) : { raised: [], open: [], lines: [] };
+  const problems = [
+    ...before.problems.map((p) => ({ source: `catalog/generated/${p.file}`, message: p.message })),
+    ...scan.problems
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  const warnings = scan.repos.flatMap((r) => r.warnings.map((w2) => ({ repo: r.repo, ...w2 })).filter((w2) => {
+    const k = `${w2.repo}\0${w2.path ?? ""}\0${w2.message}`;
+    if (seen.has(k))
+      return false;
+    seen.add(k);
+    return true;
+  }));
+  if (o.json) {
+    io.out(JSON.stringify({
+      stats: scan.stats,
+      diff,
+      problems,
+      warnings,
+      coverage: scan.coverage,
+      unmodelled: scan.unmodelled,
+      notes: scan.notes,
+      written: write !== void 0,
+      files: write ?? null,
+      sources,
+      sourcesDir: sourcesRelOf(root),
+      removed: (w?.removals ?? []).map((x) => ({
+        kind: x.kind,
+        id: x.id,
+        repos: x.repos,
+        explainedBy: x.explainedBy,
+        reasons: x.reasons
+      })),
+      retired: scan.build.retired,
+      ...w?.undo !== void 0 ? { undo: w.undo } : {},
+      drift,
+      questions: [...hosts.raised, ...hosts.open].map((q) => q.id),
+      ...refused ? { refused } : {}
+    }, null, 2));
+  } else {
+    const s = scan.stats;
+    io.out(`Scanned ${s.repos} repos in ${((Date.now() - started) / 1e3).toFixed(1)}s (${s.ranRuns} extractor runs, ${s.cachedRuns} from cache)`);
+    io.out(`${s.records} records: ${s.interfaces} interfaces (${s.verified} verified), ${s.unresolved} loose ends`);
+    const joined = scan.coverage.reduce((n, c) => n + c.joined, 0);
+    const found = joined + scan.coverage.reduce((n, c) => n + c.open, 0);
+    const unread = scan.coverage.reduce((n, c) => n + c.unreadFiles, 0);
+    io.out(`Joined ${joined} of ${found} calls, listeners and endpoints found (${found ? Math.round(joined / found * 100) : 100}%)` + (unread ? `; ${unread} file${unread === 1 ? " uses" : "s use"} a client library with nothing read (atticus scan --warnings)` : ""));
+    for (const c of scan.coverage)
+      for (const r of c.redraft)
+        io.out(`Rule ${r.dialect} on ${c.repo} ${r.why === "tests-fail" ? "fails its own tests, so this scan didn't use it" : "read nothing there"}; have your assistant re-draft it: atticus onboard ${c.repo} --name ${r.dialect} (then onboard accept ${r.dialect} --replace)`);
+    const toOnboard = scan.coverage.filter((c) => c.needsOnboarding);
+    if (toOnboard.length)
+      io.out(`Read nothing from ${toOnboard.length === 1 ? "1 repo" : `${toOnboard.length} repos`} whose files no reader knows: ${toOnboard.map((c) => `${c.repo} (${c.unreadConfig.length} file${c.unreadConfig.length === 1 ? "" : "s"})`).join(", ")}. Have your assistant draft a dialect: atticus onboard ${toOnboard[0].repo}`);
+    for (const f of scan.unmodelled)
+      io.out(`House framework ${f.framework} is imported by ${f.repos.length} repos and no framework model covers it: ${f.repos.join(", ")}. Onboard it: atticus onboard framework ${f.name} --from <its source, JAR or package> --users ${f.repos.join(",")}`);
+    const idle = /* @__PURE__ */ new Map();
+    for (const c of scan.coverage)
+      for (const r of c.redraftFrameworks)
+        idle.set(r.framework, [...idle.get(r.framework) ?? [], c.repo]);
+    for (const [framework, repos] of idle)
+      io.out(`Framework model ${framework} read nothing in ${repos.join(", ")}, which import${repos.length === 1 ? "s" : ""} it; the framework may have changed. Have your assistant re-draft it: atticus onboard framework ${framework} --from <its source, JAR or package> --users ${repos.join(",")} (then onboard accept framework ${framework} --replace)`);
+    if (!refused)
+      for (const l of diffLines(diff))
+        io.out(l);
+    if (built && w)
+      for (const l of buildLines(root, built))
+        io.out(l);
+    else if (!refused)
+      io.out("Dry run: nothing written.");
+    for (const l of sourceLines(sourcesRelOf(root), sources, write !== void 0))
+      io.out(l);
+    for (const d of drift)
+      io.out(driftLine(d));
+    for (const l of hosts.lines)
+      io.out(l);
+    for (const n of scan.notes)
+      io.out(`note: ${n}`);
+    if (o.warnings)
+      for (const w2 of warnings)
+        io.out(`warning: ${w2.repo}: ${w2.path ? `${w2.path}: ` : ""}${w2.message}`);
+    else if (warnings.length)
+      io.out(`${warnings.length} warning${warnings.length === 1 ? "" : "s"}: atticus scan --warnings lists ${warnings.length === 1 ? "it" : "them"}`);
+    for (const p of problems.filter((x) => !saidByRefusal(x, refused)))
+      io.err(`${"repo" in p && p.repo ? `${p.repo}: ` : ""}${p.source}: ${p.message}`);
+    if (refused)
+      for (const l of refused.message.split("\n"))
+        io.err(l);
+  }
+  return problems.length > 0 || refused ? 1 : 0;
+}
+async function catalogDiff(a, b, json, io) {
+  const [x, y] = await Promise.all([readCatalog(a), readCatalog(b)]);
+  for (const p of [...x.problems, ...y.problems])
+    io.err(`${p.file}: ${p.message}`);
+  const d = diffCatalogs(x.records, y.records);
+  if (json)
+    io.out(JSON.stringify(d, null, 2));
+  else
+    for (const l of diffLines(d))
+      io.out(l);
+  return diffIsEmpty(d) && x.problems.length + y.problems.length === 0 ? 0 : 1;
+}
+
+export {
+  diffLines,
+  scanRefusal,
+  scanSources,
+  sourceLines,
+  scanSummaryLines,
+  scanCommand,
+  catalogDiff
+};

package/dist/{chunk-MM5OAVSW.js → chunk-VCYE4MUD.js}

@@ -17,36 +17,37 @@ import {
   rulesTryCommand,
   scopeFile,
   tryDiff
-} from "./chunk-K373N5U6.js";
-import "./chunk-ROVOAF2O.js";
-import "./chunk-QE444DZ2.js";
-import "./chunk-6WYOJCB4.js";
-import "./chunk-7F4GZ7U2.js";
+} from "./chunk-HVPS2YCW.js";
+import "./chunk-KMYB2XO7.js";
+import "./chunk-IXNMGPF7.js";
+import "./chunk-CLM5Z3R5.js";
+import "./chunk-GZILYRGC.js";
+import "./chunk-SFCFL7Y5.js";
 import "./chunk-EHXDB3SA.js";
-import "./chunk-USH4VU5D.js";
-import "./chunk-CNF7D3A7.js";
-import "./chunk-HHZEXF7V.js";
-import "./chunk-5WZV37WS.js";
-import "./chunk-DBVQEPZB.js";
-import "./chunk-XP5DF5MC.js";
-import "./chunk-G5P7F6RQ.js";
-import "./chunk-H7GAPNGQ.js";
-import "./chunk-YRKAJ42V.js";
-import "./chunk-CGVRLQAY.js";
-import "./chunk-RL7PETU6.js";
-import "./chunk-PGKCRK77.js";
-import "./chunk-M6HI36T3.js";
-import "./chunk-2VN4TLGI.js";
-import "./chunk-4U3JLIRC.js";
-import "./chunk-MXPKXCGP.js";
-import "./chunk-QQD25YNF.js";
-import "./chunk-QA4O2GGC.js";
-import "./chunk-WS7KBKP4.js";
-import "./chunk-GLISHJ4G.js";
-import "./chunk-G3ZFEHCX.js";
-import "./chunk-LZFKJ2BR.js";
-import "./chunk-CTJHEG6A.js";
+import "./chunk-OUGTAOGA.js";
+import "./chunk-YAPVAYZN.js";
+import "./chunk-FKAUBC4Y.js";
+import "./chunk-VVLWEM2Y.js";
+import "./chunk-QPAANKUR.js";
+import "./chunk-FADIWOA5.js";
+import "./chunk-G33UIUG3.js";
+import "./chunk-QC6GSNIK.js";
+import "./chunk-YIGSUTW2.js";
+import "./chunk-N5DLB74D.js";
+import "./chunk-UWBODTY7.js";
+import "./chunk-X5B7KYPD.js";
+import "./chunk-IPSZDVLI.js";
+import "./chunk-2MRYL45Z.js";
+import "./chunk-ELJ5Q4J2.js";
+import "./chunk-XZY4GTCX.js";
+import "./chunk-3M3MDBOG.js";
+import "./chunk-T2MN24LZ.js";
+import "./chunk-WJWSB65O.js";
+import "./chunk-SMFFUFMN.js";
+import "./chunk-A3LVMCA5.js";
+import "./chunk-NWMFVPEP.js";
 import "./chunk-BQGDB6ZL.js";
+import "./chunk-R4TUWD4C.js";
 import "./chunk-TV45EUGM.js";
 export {
   READS_AS_RULE,

package/dist/{chunk-AGAFNUYZ.js → chunk-VN2VJ6BV.js}

@@ -5,25 +5,24 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   contractCheckOf
-} from "./chunk-WA644MUQ.js";
+} from "./chunk-FM3EEDS2.js";
 import {
   HttpError,
   badRequest,
   conflict,
   notFound
-} from "./chunk-QSKY7FE3.js";
+} from "./chunk-Y2TVTI4P.js";
 import {
   readCatalog
-} from "./chunk-YRKAJ42V.js";
+} from "./chunk-QC6GSNIK.js";
 import {
   frameworkFacts,
-  frameworkGaps,
-  keyIsSecret
-} from "./chunk-CGVRLQAY.js";
+  frameworkGaps
+} from "./chunk-YIGSUTW2.js";
 import {
   baseClonePath,
   loadRepos
-} from "./chunk-WS7KBKP4.js";
+} from "./chunk-X5B7KYPD.js";
 import {
   ProfileEditError,
   QuestionError,
@@ -39,13 +38,14 @@ import {
   listQuestions,
   parseAuditFile,
   parseFacts
-} from "./chunk-GLISHJ4G.js";
+} from "./chunk-WJWSB65O.js";
 import {
-  FileChangedError
-} from "./chunk-G3ZFEHCX.js";
+  FileChangedError,
+  keyIsSecret
+} from "./chunk-SMFFUFMN.js";
 import {
   keptParse
-} from "./chunk-CTJHEG6A.js";
+} from "./chunk-NWMFVPEP.js";
 import {
   require_dist
 } from "./chunk-BQGDB6ZL.js";
@@ -385,7 +385,7 @@ async function trustView(root) {
     });
   }
   const contracts = await contractCheckOf(root).then((c) => c.result.counts.compared ? c.result.counts : void 0, () => void 0);
-  const { answerBoxesOf } = await import("./chunk-EPXYFJTY.js");
+  const { answerBoxesOf } = await import("./chunk-AKZTCZ6F.js");
   const answerBoxes = await answerBoxesOf(root).catch(() => []);
   return {
     factsDir: factsRel,
@@ -455,8 +455,12 @@ function uiTrustRoutes(r, ctx) {
   return r.add("GET", "/api/trust", async () => ({
     status: 200,
     body: await keptAnswer(ctx.root, "trust", () => trustView(ctx.root), () => checkoutsStamp(ctx.root))
-  })).add("POST", "/api/trust/answer-boxes/ignore", ({ body }) => answerBoxRoute(ctx, body, false)).add("POST", "/api/trust/answer-boxes/rename", ({ body }) => answerBoxRoute(ctx, body, true)).add("GET", "/api/trust/fresh", async () => {
-    const { estateFreshness } = await import("./chunk-7YSMZEO3.js");
+  })).add("POST", "/api/trust/answer-boxes/ignore", ({ body }) => answerBoxRoute(ctx, body, false)).add("POST", "/api/trust/answer-boxes/rename", ({ body }) => answerBoxRoute(ctx, body, true)).add("GET", "/api/trust/canaries", async () => {
+    const { canaryView } = await import("./chunk-HPNYSY5M.js");
+    const body = await canaryView(ctx.root);
+    return { status: 200, body };
+  }).add("GET", "/api/trust/fresh", async () => {
+    const { estateFreshness } = await import("./chunk-7YWS47SE.js");
     const v = await estateFreshness(ctx.root);
     const body = {
       ...v,
@@ -474,7 +478,7 @@ async function answerBoxRoute(ctx, body, rename) {
   const b = api_exports.AnswerBoxRequest.safeParse(body ?? {});
   if (!b.success || rename && !b.data.name)
     throw badRequest(rename ? "Say which box and its real name: { id, name, preview }." : "Say which box: { id, preview }.");
-  const { AnswerBoxError, ignoreAnswerBox, renameAnswerBox } = await import("./chunk-EPXYFJTY.js");
+  const { AnswerBoxError, ignoreAnswerBox, renameAnswerBox } = await import("./chunk-AKZTCZ6F.js");
   const o = {
     by: ctx.user,
     at: (/* @__PURE__ */ new Date()).toISOString(),

package/dist/{chunk-DBVQEPZB.js → chunk-VVLWEM2Y.js}

@@ -5,25 +5,25 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readReviewed
-} from "./chunk-XP5DF5MC.js";
+} from "./chunk-QPAANKUR.js";
 import {
   lineRangeOf
-} from "./chunk-CGVRLQAY.js";
+} from "./chunk-YIGSUTW2.js";
 import {
   globToRegExp
-} from "./chunk-4U3JLIRC.js";
+} from "./chunk-3M3MDBOG.js";
 import {
   citedFiles,
   factsDirOf,
   factsRelOf,
   parseFacts
-} from "./chunk-GLISHJ4G.js";
+} from "./chunk-WJWSB65O.js";
 import {
   writeFileAtomic
-} from "./chunk-G3ZFEHCX.js";
+} from "./chunk-SMFFUFMN.js";
 import {
   external_exports
-} from "./chunk-LZFKJ2BR.js";
+} from "./chunk-A3LVMCA5.js";
 import {
   require_dist
 } from "./chunk-BQGDB6ZL.js";

package/dist/{chunk-F56DNMDD.js → chunk-VWCNMDMZ.js}

@@ -9,11 +9,11 @@ import {
   reExecForMemory,
   roomGuard,
   streamFacts
-} from "./chunk-DJ4C5ELF.js";
-import "./chunk-GLISHJ4G.js";
-import "./chunk-G3ZFEHCX.js";
-import "./chunk-LZFKJ2BR.js";
-import "./chunk-CTJHEG6A.js";
+} from "./chunk-3PBIZBWN.js";
+import "./chunk-WJWSB65O.js";
+import "./chunk-SMFFUFMN.js";
+import "./chunk-A3LVMCA5.js";
+import "./chunk-NWMFVPEP.js";
 import "./chunk-BQGDB6ZL.js";
 import "./chunk-TV45EUGM.js";
 export {