@maycombhq/atticus 2.0.0-beta.25 → 2.0.0-beta.27

package/dist/{chunk-CGVRLQAY.js → chunk-YIGSUTW2.js}

@@ -5,10 +5,10 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   readOpenApiDocument
-} from "./chunk-2VN4TLGI.js";
+} from "./chunk-XZY4GTCX.js";
 import {
   globToRegExp
-} from "./chunk-4U3JLIRC.js";
+} from "./chunk-3M3MDBOG.js";
 import {
   DECLARED_TOPIC,
   Fact,
@@ -24,37 +24,47 @@ import {
   LINK_EVIDENCE_NOT_GAPS,
   MOCK_FILE,
   SHARED_MAP_EVIDENCE,
+  canaryClaimText,
+  canaryNeedleOf,
   citedFiles,
-  claimOnLines,
   clusterServiceAddress,
   configSecretField,
   credentialLike,
   decodeText,
   dependencyLinkId,
   factIdPart,
+  foldCanary,
   forwardSlashes,
-  hasSecretShape,
   isBinaryText,
   isLfsPointer,
   isPatternPath,
-  isSecretPath,
-  lineNamesClaim,
   linksFor,
   listRepoFilesSync,
   looksLikeSecret,
   noteProblem,
-  partsBuildWord,
-  partsNamePath,
   placedComponentOf,
   plainPathPrefix,
-  quoteHoldsSecret,
-  quoteMatches,
-  quoteNotRequired,
-  redactSecrets,
+  removedBy,
+  seededShuffle,
   staleCite,
   toCanonicalYaml,
   tokenUnits
-} from "./chunk-GLISHJ4G.js";
+} from "./chunk-WJWSB65O.js";
+import {
+  claimOnLines,
+  declaresConventionalRoute,
+  hasSecretShape,
+  isSecretPath,
+  keyIsSecret,
+  lineNamesClaim,
+  partsBuildWord,
+  partsNamePath,
+  pathPieceOnlyInComment,
+  quoteHoldsSecret,
+  quoteMatches,
+  quoteNotRequired,
+  redactSecrets
+} from "./chunk-SMFFUFMN.js";
 import {
   DEFAULT_CONVENTIONS,
   DEFAULT_GATEWAY_BUNDLE_FOLDERS,
@@ -63,7 +73,7 @@ import {
   normalizePath,
   notDeviceName,
   underFolders
-} from "./chunk-LZFKJ2BR.js";
+} from "./chunk-A3LVMCA5.js";
 
 // packages/verify/dist/source.js
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
@@ -174,8 +184,8 @@ function dirSource(root) {
   };
 }
 var MAX_SOURCE_BYTES = 5 * 1024 * 1024;
-function tooBigToRead(source, path) {
-  const n = source.size?.(path);
+function tooBigToRead(source2, path) {
+  const n = source2.size?.(path);
   return n !== void 0 && n > MAX_SOURCE_BYTES;
 }
 
@@ -2335,7 +2345,7 @@ var deviseFor = (file, lines, idx, env) => {
     const m = new RegExp(`\\b${k}:\\s*(?:\\[([^\\]]*)\\]|:(\\w+))`).exec(opts);
     return m ? (m[1] ?? `:${m[2]}`).split(",").map((s) => singularize(s.trim().replace(/^:/, ""))).filter(Boolean) : void 0;
   };
-  const skip = list2("skip") ?? [];
+  const skip2 = list2("skip") ?? [];
   const only = list2("only");
   const names = { registration: "" };
   const pn = /\bpath_names:\s*\{([^}]*)\}/.exec(opts)?.[1] ?? "";
@@ -2357,7 +2367,7 @@ var deviseFor = (file, lines, idx, env) => {
       break;
   }
   const modules = new Set([...call.replace(/\w+:\s*\[[^\]]*\]|\w+:\s*[^,]+/g, "").matchAll(/:(\w+)/g)].map((m) => m[1]));
-  const allowed = (c) => !skip.includes(c) && !skip.includes("all") && (!only || only.includes(c));
+  const allowed = (c) => !skip2.includes(c) && !skip2.includes("all") && (!only || only.includes(c));
   const at = `${prefix}${resource ? `/${resource}` : ""}`;
   const out = [];
   for (const m of DEVISE)
@@ -2616,26 +2626,6 @@ function tokenKeyNear(lines, i) {
     }
   return void 0;
 }
-function keyIsSecret(key) {
-  if (hasSecretShape(key))
-    return true;
-  for (const run of key.match(/[0-9a-f]{24,}|[0-9A-F]{24,}/g) ?? [])
-    if (/\d/.test(run) && /[a-f]/i.test(run))
-      return true;
-  const digitsAndLetters = /\d/.test(key) && /[A-Za-z]/.test(key);
-  if (key.length >= 32 && /^[A-Za-z0-9+/=]+$/.test(key) && digitsAndLetters)
-    return true;
-  if (key.length >= 32 && /^[A-Za-z0-9_-]+$/.test(key) && /\d/.test(key) && /[a-z]/.test(key) && /[A-Z]/.test(key))
-    return true;
-  if (key.length < 16 || !/^[A-Za-z0-9+/=]+$/.test(key) || !/\d/.test(key))
-    return false;
-  const kind = (c) => /\d/.test(c) ? 0 : /[a-z]/.test(c) ? 1 : 2;
-  let switches = 0;
-  for (let i = 1; i < key.length; i++)
-    if (kind(key[i]) !== kind(key[i - 1]))
-      switches++;
-  return switches >= key.length / 2;
-}
 function itemNameAbove(lines, i) {
   const col = /^\s*/.exec(lines[i])[0].length;
   for (let j = i - 1; j >= 0 && i - j <= 6; j--) {
@@ -2690,11 +2680,419 @@ function liveSecretsIn(file, lines) {
   return out;
 }
 
+// packages/verify/dist/comments.js
+var JS = /\.(m?[jt]sx?|c[jt]s|mts)$/i;
+var NESTING = /\.(kt|kts|rs|swift|scala|sc|dart)$/i;
+var TRIPLE_DOUBLE = /\.(java|kt|kts|scala|sc|swift|dart|groovy|gradle|cs|csx)$|(^|\/)Jenkinsfile(\.[\w.-]+)?$/i;
+var TRIPLE_SINGLE = /\.(dart|groovy|gradle)$|(^|\/)Jenkinsfile(\.[\w.-]+)?$/i;
+var RAW_TRIPLE = /\.(kt|kts|scala|sc|cs|csx)$/i;
+function commentLexisOf(file, php) {
+  const triple = [
+    ...php || !TRIPLE_DOUBLE.test(file) ? [] : ['"""'],
+    ...php || !TRIPLE_SINGLE.test(file) ? [] : ["'''"]
+  ];
+  const rust = !php && /\.rs$/i.test(file);
+  return {
+    slashSlash: !/\.css$/i.test(file),
+    hash: php,
+    nest: !php && NESTING.test(file),
+    js: !php && JS.test(file),
+    jsx: !php && /\.[jt]sx$/i.test(file),
+    goRaw: !php && /\.go$/i.test(file),
+    tickIdent: !php && /\.(kt|kts|scala|sc|swift)$/i.test(file),
+    triple,
+    tripleEscapes: !RAW_TRIPLE.test(file),
+    verbatim: !php && /\.(cs|csx)$/i.test(file),
+    rustChar: rust,
+    dartRaw: !php && /\.dart$/i.test(file),
+    // Beta.27 re-review 5: PHP's `'…'` runs across lines too (its escapes, `\\` and `\'`, are read
+    // as any `\` is: the character after one never closes it unless it is a quote escaped)
+    spanQuotes: php ? `"'` : rust ? '"' : "",
+    php,
+    blade: php && /\.blade\.php$/i.test(file)
+  };
+}
+var DOC_STAR_START = /^\s*\*(?![A-Za-z_$[])/;
+var LIVE_PHP_ANNOTATION = /@(?:(?:Route|Method|Get|Post|Put|Patch|Delete|Head|Options|ApiResource)\s*\(|Rest\\\w+|ORM\\\w+)/y;
+var SPACES = /\s*/y;
+var skipSpaces = (l, i) => {
+  SPACES.lastIndex = i;
+  SPACES.test(l);
+  return SPACES.lastIndex;
+};
+function livePhpAnnotation(l) {
+  let i = skipSpaces(l, 0);
+  if (l.startsWith("/**", i))
+    i = skipSpaces(l, i + 3);
+  if (l[i] === "*")
+    i = skipSpaces(l, i + 1);
+  LIVE_PHP_ANNOTATION.lastIndex = i;
+  return LIVE_PHP_ANNOTATION.test(l);
+}
+var HEREDOC_OPEN = /[ \t]*(["']?)([A-Za-z_\x80-\uFFFF][A-Za-z0-9_\x80-\uFFFF]*)\1[ \t\r]*$/y;
+var isLabelChar = (c) => c !== void 0 && c !== "$" && (isWord(c) || c >= "\x80");
+var REGEX_AFTER_WORD = new Set("return typeof instanceof in of new delete void throw case do else yield await".split(" "));
+var REGEX_AFTER = "(,=:[!&|?{};+-*%~^";
+var BRACKETS = "{}(),";
+var isSpace = (c) => c <= " " || c === "\uFEFF" || c === "\xA0";
+var isWord = (c) => c >= "a" && c <= "z" || c >= "A" && c <= "Z" || c >= "0" && c <= "9" || c === "_" || c === "$";
+var PHP_OPEN = /<\?(?:php(?=\s|$)|=|(?=\s|$))/iy;
+function lexCommentLines(lines, lx, codeOut, alone = false) {
+  const out = new Array(lines.length);
+  let mode = lx.php && !alone ? "html" : "code";
+  let depth = 0;
+  let doc = false;
+  let close = "";
+  let escapes = true;
+  let doubled = false;
+  let tripled = false;
+  const frames = [];
+  let prev = "";
+  let prev2 = "";
+  let word = "";
+  let base2 = 0;
+  let prevAt = -2;
+  let pair = false;
+  const sawCode = (c, at) => {
+    if (word && isWord(c) && isWord(prev))
+      word += c;
+    else
+      word = isWord(c) ? c : "";
+    pair = c === prev && at === prevAt + 1;
+    prev2 = prev;
+    prev = c;
+    prevAt = at;
+  };
+  const openString = (to, o) => {
+    mode = o.lines ? "raw" : "str";
+    close = to;
+    escapes = o.escapes;
+    doubled = false;
+    tripled = o.triple === true;
+  };
+  for (let n = 0; n < lines.length; base2 += lines[n].length + 1, n++) {
+    const l = lines[n];
+    const len = l.length;
+    let comment = mode === "block" || mode === "blade";
+    let code2 = false;
+    let docLine = mode === "block" && doc;
+    let synthetic = false;
+    let cont = false;
+    let regexOk = lx.js;
+    if (alone && mode === "code" && DOC_STAR_START.test(l)) {
+      mode = "block";
+      depth = 1;
+      doc = docLine = synthetic = comment = true;
+    }
+    let i = 0;
+    if (mode === "heredoc") {
+      const k = skipSpaces(l, 0);
+      if (l.startsWith(close, k) && !isLabelChar(l[k + close.length])) {
+        mode = "code";
+        prev = '"';
+        word = "";
+        i = k + close.length;
+      } else
+        i = len;
+      code2 = l.trim() !== "";
+    }
+    let seg = mode === "block" || mode === "blade" ? -1 : 0;
+    let cut = len;
+    let text = "";
+    while (i < len) {
+      const c = l[i];
+      if (mode === "html") {
+        PHP_OPEN.lastIndex = i;
+        if (c === "<" && l[i + 1] === "?" && PHP_OPEN.test(l)) {
+          mode = "code";
+          prev = ";";
+          word = "";
+          i = PHP_OPEN.lastIndex;
+        } else if (lx.blade && c === "{" && l.startsWith("{{--", i)) {
+          if (codeOut && seg >= 0)
+            text += `${l.slice(seg, i)} `;
+          seg = -1;
+          comment = true;
+          mode = "blade";
+          i += 4;
+        } else {
+          if (!isSpace(c))
+            code2 = true;
+          i++;
+        }
+        continue;
+      }
+      if (mode === "blade") {
+        const k = l.indexOf("--}}", i);
+        if (k < 0)
+          i = len;
+        else {
+          mode = "html";
+          i = seg = k + 4;
+        }
+        continue;
+      }
+      if (mode === "block") {
+        if (c === "*" && l[i + 1] === "/") {
+          i += 2;
+          if (--depth === 0) {
+            mode = "code";
+            seg = i;
+          }
+        } else if (lx.nest && c === "/" && l[i + 1] === "*") {
+          depth++;
+          i += 2;
+        } else
+          i++;
+        continue;
+      }
+      if (mode !== "code") {
+        if (!isSpace(c))
+          code2 = true;
+        if (escapes && c === "\\") {
+          if (i === len - 1)
+            cont = true;
+          i += 2;
+        } else if (mode === "tpl") {
+          if (c === "`") {
+            mode = "code";
+            prev = '"';
+            word = "";
+            i++;
+          } else if (c === "$" && l[i + 1] === "{") {
+            frames.push(0);
+            mode = "code";
+            prev = "{";
+            word = "";
+            i += 2;
+          } else
+            i++;
+        } else if (doubled && c === '"' && l[i + 1] === '"')
+          i += 2;
+        else if (c === close[0] && l.startsWith(close, i)) {
+          mode = "code";
+          prev = '"';
+          word = "";
+          i += close.length;
+          if (tripled)
+            while (l[i] === close[0])
+              i++;
+        } else
+          i++;
+        continue;
+      }
+      const d = l[i + 1];
+      if (lx.php && c === "?" && d === ">") {
+        mode = "html";
+        i += 2;
+        continue;
+      }
+      const lineComment = c === "/" && d === "/" && lx.slashSlash || c === "#" && lx.hash && d !== "[";
+      if (lineComment) {
+        comment = true;
+        const k = lx.php ? l.indexOf("?>", i + (c === "#" ? 1 : 2)) : -1;
+        if (k < 0) {
+          cut = i;
+          break;
+        }
+        if (codeOut && seg >= 0)
+          text += `${l.slice(seg, i)} `;
+        mode = "html";
+        i = seg = k + 2;
+        continue;
+      }
+      if (c === "/" && d === "*") {
+        if (codeOut && seg >= 0)
+          text += `${l.slice(seg, i)} `;
+        seg = -1;
+        comment = true;
+        mode = "block";
+        depth = 1;
+        doc = l[i + 2] === "*" && l[i + 3] !== "/";
+        if (doc)
+          docLine = true;
+        i += 2;
+        continue;
+      }
+      if ((lx.rustChar || lx.dartRaw) && !(i > 0 && isWord(l[i - 1]))) {
+        if (lx.rustChar && (c === "r" || (c === "b" || c === "c") && d === "r")) {
+          let j = c === "r" ? i + 1 : i + 2;
+          const h = j;
+          while (l[j] === "#")
+            j++;
+          if (l[j] === '"') {
+            code2 = true;
+            openString(`"${"#".repeat(j - h)}`, { escapes: false, lines: true });
+            i = j + 1;
+            continue;
+          }
+        } else if (lx.dartRaw && c === "r" && (d === "'" || d === '"')) {
+          code2 = true;
+          const t = lx.triple.find((q) => l.startsWith(q, i + 1));
+          if (t)
+            openString(t, { escapes: false, lines: true, triple: true });
+          else
+            openString(d, { escapes: false, lines: false });
+          i += t ? 4 : 2;
+          continue;
+        }
+      }
+      if (lx.php && c === "<" && d === "<" && l[i + 2] === "<") {
+        HEREDOC_OPEN.lastIndex = i + 3;
+        const m = HEREDOC_OPEN.exec(l);
+        if (m) {
+          code2 = true;
+          mode = "heredoc";
+          close = m[2];
+          break;
+        }
+      }
+      if (c === '"' || c === "'" || c === "`") {
+        code2 = true;
+        const t = lx.triple.find((q) => q[0] === c && l.startsWith(q, i));
+        if (t) {
+          openString(t, { escapes: lx.tripleEscapes, lines: true, triple: true });
+          i += 3;
+        } else if (c === "`") {
+          if (lx.js) {
+            mode = "tpl";
+            escapes = true;
+            doubled = false;
+          } else if (lx.php)
+            openString("`", { escapes: true, lines: true });
+          else if (lx.goRaw)
+            openString("`", { escapes: false, lines: true });
+          else if (lx.tickIdent)
+            openString("`", { escapes: false, lines: false });
+          else
+            sawCode(c, base2 + i);
+          i++;
+        } else if (c === '"' && lx.verbatim && (prev === "@" || prev === "$" && prev2 === "@")) {
+          openString('"', { escapes: false, lines: true });
+          doubled = true;
+          i++;
+        } else if (c === "'" && lx.rustChar && d !== "\\" && l[i + 2] !== "'") {
+          sawCode(c, base2 + i);
+          i++;
+        } else {
+          openString(c, { escapes: true, lines: lx.spanQuotes.includes(c) });
+          i++;
+        }
+        continue;
+      }
+      if (c === "/" && regexOk) {
+        const division = prev === "}" && (lx.jsx || d === ">") || pair && (prev === "+" || prev === "-");
+        const after = !division && (REGEX_AFTER.includes(prev) || prev === "" || prev === ">" && prev2 === "=");
+        if (after || isWord(prev) && REGEX_AFTER_WORD.has(word)) {
+          let j = i + 1;
+          let cls = false;
+          for (; j < len; j++) {
+            const ch = l[j];
+            if (ch === "\\")
+              j++;
+            else if (ch === "[")
+              cls = true;
+            else if (ch === "]")
+              cls = false;
+            else if (ch === "/" && !cls)
+              break;
+          }
+          if (j < len) {
+            code2 = true;
+            prev = "a";
+            word = "";
+            i = j + 1;
+            continue;
+          }
+          regexOk = false;
+        }
+      }
+      if (frames.length && c === "{")
+        frames[frames.length - 1]++;
+      else if (frames.length && c === "}") {
+        if (frames[frames.length - 1] === 0) {
+          frames.pop();
+          mode = "tpl";
+          i++;
+          continue;
+        }
+        frames[frames.length - 1]--;
+      }
+      if (!isSpace(c)) {
+        if (!BRACKETS.includes(c))
+          code2 = true;
+        sawCode(c, base2 + i);
+      }
+      i++;
+    }
+    if (mode === "str" && !cont)
+      mode = "code";
+    if (synthetic && mode === "block") {
+      mode = "code";
+      depth = 0;
+    }
+    const live = lx.php && docLine && livePhpAnnotation(l);
+    out[n] = comment && !code2 && !live;
+    if (codeOut)
+      codeOut[n] = live ? l : out[n] ? "" : seg >= 0 ? text + l.slice(seg, cut) : text.trimEnd();
+  }
+  return out;
+}
+
 // packages/verify/dist/skipped.js
 function notReadForSkipped(path, rules = DEFAULT_READ_RULES) {
   return rules.notRead.test(path);
 }
-var isCommentLine = (l) => /^\s*(\/\/|\/\*|\*|<!--|-- |#(?!\s*(region|endregion|if|elif|else|endif|define|undef|pragma|nullable|include|import)\b)(?!!))/.test(l);
+var HASH_EXT = /\.(py|pyi|pyw|pyx|rb|rake|gemspec|ru|sh|bash|zsh|ksh|fish|ya?ml|toml|conf|cfg|ini|properties|env|r|pl|pm|ps1|psm1|coffee|ex|exs|jl|cr|nim|tcl|awk|gql|graphql|cmake|mk|dockerfile|gitignore|dockerignore|editorconfig|gitattributes)$/i;
+var HASH_NAME = /(^|\/)(Dockerfile(\.[\w.-]+)?|Containerfile|Makefile|GNUmakefile|Caddyfile|Gemfile|Rakefile|Podfile|Vagrantfile|Procfile|Brewfile|Fastfile|Appfile|Pipfile|CMakeLists\.txt|requirements[\w.-]*\.(txt|in)|\.env(\.[\w.-]+)?)$/;
+var C_EXT = /\.(m?[jt]sx?|c[jt]s|mts|java|kt|kts|scala|sc|groovy|gradle|cs|csx|go|rs|swift|c|cc|cpp|cxx|c\+\+|h|hh|hpp|hxx|m|mm|dart|proto|scss|less|css|json5|jsonc|zig|sol|hx|fs|fsx)$/i;
+var C_NAME = /(^|\/)Jenkinsfile(\.[\w.-]+)?$/;
+var PHP_EXT = /\.(php|phtml|php[3-8]|phps|phpt|module)$/i;
+var SQL_EXT = /\.(sql|ddl|dml|pgsql|psql|plsql|hql|cql)$/i;
+var XML_EXT = /\.(xml|xaml|axaml|csproj|vbproj|fsproj|props|targets|nuspec|resx|xsd|xslt?|wsdl|plist|svg|config|tld|jspx)$/i;
+function commentStyleOf(file, head) {
+  if (PHP_EXT.test(file))
+    return "php";
+  if (/\.inc$/i.test(file))
+    return head !== void 0 && /<\?php/i.test(head) ? "php" : "c";
+  if (C_EXT.test(file) || C_NAME.test(file))
+    return "c";
+  if (SQL_EXT.test(file))
+    return "sql";
+  if (XML_EXT.test(file))
+    return "xml";
+  if (HASH_EXT.test(file) || HASH_NAME.test(file))
+    return "hash";
+  return "generic";
+}
+var headOf = (lines) => {
+  let h = "";
+  for (let i = 0; i < lines.length && i < 5 && h.length < 512; i++)
+    h += `${lines[i]}
+`;
+  return h;
+};
+var isCommentLine = (l, file, lines) => lineIsComment(l, file, commentStyleOf(file, lines && headOf(lines)));
+function lineIsComment(l, file, style) {
+  if (style === "c" || style === "php")
+    return lexCommentLines([l], commentLexisOf(file, style === "php"), void 0, true)[0];
+  const marker = style !== "hash" ? COMMENT_OF[style] : /\.ini$/i.test(file) ? INI_COMMENT : /\.properties$/i.test(file) ? PROPERTIES_COMMENT : COMMENT_OF.hash;
+  return marker.test(l) && !(style === "xml" ? XML_THEN_CODE : BLOCK_THEN_CODE).test(l);
+}
+var DIRECTIVE = "(region|endregion|if|elif|else|endif|define|undef|pragma|nullable|include|import)";
+var DOC_STAR = "\\*(?![A-Za-z_$[])";
+var COMMENT_OF = {
+  hash: /^\s*#(?!!)/,
+  c: new RegExp(`^\\s*(\\/\\/|\\/\\*|${DOC_STAR})`),
+  php: new RegExp(`^\\s*(\\/\\/|\\/\\*|${DOC_STAR}|#(?![[!]))`),
+  sql: /^\s*(--|\/\*)/,
+  xml: /^\s*<!--/,
+  generic: new RegExp(`^\\s*(\\/\\/|\\/\\*|\\*|<!--|-- |#(?!\\s*${DIRECTIVE}\\b)(?!!))`)
+};
+var INI_COMMENT = /^\s*[;#]/;
+var PROPERTIES_COMMENT = /^\s*[#!]/;
+var BLOCK_THEN_CODE = /^\s*\/\*.*?\*\/\s*[^\s/]/;
+var XML_THEN_CODE = /^\s*<!--.*?-->\s*\S/;
 var IMPORT_LINE = /^\s*(import|export\s+[^=]*\bfrom\b|from\s+\S+\s+import|package|using|require|#\s*include|@import|@use|use|library)\b/;
 var IMPORT_CALL = /\brequire\s*\(|\bimport\s*\(|\bfrom\s+["'`]/;
 var NAMESPACE_LINE = /\bxmlns(:\w+)?\s*=|schemaLocation\s*=|<!DOCTYPE|^\s*<\?xml/i;
@@ -2765,6 +3163,12 @@ function topicOf(s, context) {
   }
   return void 0;
 }
+function commentLinesOf(file, lines) {
+  const style = commentStyleOf(file, headOf(lines));
+  if (style === "c" || style === "php")
+    return lexCommentLines(lines, commentLexisOf(file, style === "php"));
+  return lines.map((l) => lineIsComment(l, file, style));
+}
 function codeOf(raw, state) {
   let s = raw;
   let out = "";
@@ -2787,12 +3191,16 @@ function codeOf(raw, state) {
 }
 function candidatesIn(path, lines) {
   const out = [];
+  const style = commentStyleOf(path, headOf(lines));
+  const lexed = style === "c" || style === "php" ? [] : void 0;
+  if (lexed)
+    lexCommentLines(lines, commentLexisOf(path, style === "php"), lexed);
   const state = {};
   let xmlDepth = 0;
   let braceDepth = 0;
   lines.forEach((raw, i) => {
-    const wasBlock = state.block !== void 0;
-    let code2 = codeOf(raw, state);
+    const wasBlock = lexed !== void 0 || state.block !== void 0;
+    let code2 = lexed ? lexed[i] : codeOf(raw, state);
     const inBuild = xmlDepth > 0 || braceDepth > 0;
     for (const m of code2.matchAll(BUILD_BLOCK_TAG))
       if (!m[3])
@@ -2803,7 +3211,7 @@ function candidatesIn(path, lines) {
     }
     if (!code2.trim())
       return;
-    if (!wasBlock && isCommentLine(raw))
+    if (!wasBlock && lineIsComment(raw, path, style))
       return;
     if (IMPORT_LINE.test(code2) || IMPORT_CALL.test(code2) || NAMESPACE_LINE.test(code2))
       return;
@@ -3069,10 +3477,11 @@ function helperBuildsKey(key, cite2, linesOf2) {
     return false;
   const last = segs[segs.length - 1];
   const prefix = segs.slice(0, -1);
-  const line = linesOf2(cite2.file)?.[cite2.line - 1];
+  const fileLines = linesOf2(cite2.file);
+  const line = fileLines?.[cite2.line - 1];
   if (line === void 0)
     return false;
-  const code2 = isCommentLine(line) ? line : line.replace(/\/\*.*?\*\//g, "").replace(/(^|\s)\/\/.*$/, "");
+  const code2 = isCommentLine(line, cite2.file, fileLines) ? line : line.replace(/\/\*.*?\*\//g, "").replace(/(^|\s)\/\/.*$/, "");
   const literals = [];
   const bare2 = code2.replace(/(["'`])((?:(?!\1)[^\\]|\\.)*)\1/g, (_all, _q, text) => {
     literals.push(text);
@@ -3256,6 +3665,27 @@ function configLineProblem(f, linesOf2, listed2, bundleFolders = DEFAULT_GATEWAY
     }
     return void 0;
   }
+  if (/(^|\/)config\.json$/i.test(f.cite.file)) {
+    const around = jsonFrames(lines).filter((x) => x.type === "{" && x.start <= f.cite.line && x.end >= f.cite.line).sort((a, b) => b.start - a.start);
+    const token = around[0];
+    const own = token ? lines.slice(token.start - 1, token.end) : [];
+    if (token?.name !== void 0 && /^(policies|targets|proxies)$/i.test(token.under ?? "") && own.some((l) => jsonValueOn(l) !== void 0)) {
+      const dir = f.cite.file.replace(/[^/]*$/, "");
+      if (!listed2().some((p) => bundleFolders.some((b) => p.startsWith(`${dir}${b}/`))))
+        return `config ${where} is a config.json beside no gateway bundle (no ${bundleFolders.map((b) => `${dir}${b}/`).join(" or ")}); a token's setting is read only from the bundle's own`;
+      const bare2 = (s) => s.trim().replace(/^@(.+)@$/, "$1").replace(/^\{\{\s*(.+?)\s*\}\}$/, "$1");
+      if (bare2(token.name) !== bare2(f.key))
+        return `the token at ${where} is named ${token.name}, not ${f.key}; give the key the token's name`;
+      if (value !== void 0 && !own.some((l) => same(jsonValueOn(l))))
+        return `the token at ${where} sets no such value; cite the token whose "value" it is`;
+      if (f.env !== void 0) {
+        const conf = around.find((x) => /^configurations$/i.test(x.under ?? ""));
+        if (!conf?.name || conf.name.trim() !== f.env.trim())
+          return `the token at ${where} is in ${conf?.name ? `the ${conf.name} configuration` : "no named configuration"}, not ${f.env}; give the env its configuration is named`;
+      }
+      return void 0;
+    }
+  }
   if (isYaml(f.cite.file)) {
     const y = yamlLine(at);
     const path = yamlPathAt(lines, f.cite.line);
@@ -3847,9 +4277,26 @@ async function verifyFacts(o) {
       linesCache.delete(linesCache.keys().next().value);
     return lines;
   };
+  const commentCache = /* @__PURE__ */ new WeakMap();
+  const commentFlagsOf = (file, lines) => {
+    let flags = commentCache.get(lines);
+    if (!flags)
+      commentCache.set(lines, flags = commentLinesOf(file, lines));
+    return flags;
+  };
+  const commentAt = (file, lines, n) => commentFlagsOf(file, lines)[n - 1] === true;
+  const codeCache = /* @__PURE__ */ new WeakMap();
+  const codeLinesOf = (file, lines) => {
+    let code2 = codeCache.get(lines);
+    if (!code2) {
+      const flags = commentFlagsOf(file, lines);
+      codeCache.set(lines, code2 = lines.map((l, i) => flags[i] ? "" : l));
+    }
+    return code2;
+  };
   const deriveEnv = { lines: linesOf2, files: listed2 };
   const lineAt = (file, n) => n >= 1 ? linesOf2(file)?.[n - 1] : void 0;
-  const checkCite = (cite2, claims, label, withHint = true, alsoHolds, quiet = false) => {
+  const checkCite = (cite2, claims2, label, withHint = true, alsoHolds, quiet = false, httpRoute = false) => {
     const where = `${cite2.file}:${cite2.line}`;
     if (!insideRepo(cite2.file))
       return {
@@ -3875,6 +4322,7 @@ async function verifyFacts(o) {
     const parts = cite2.with ?? [];
     const near = (ls, n) => ls.slice(Math.max(0, n - 2), n + 1);
     const partLines = [];
+    const partWindows = [];
     for (const [i, p] of parts.entries()) {
       const pl = `${label} part ${i + 1}`;
       if (!insideRepo(p.file))
@@ -3904,32 +4352,59 @@ async function verifyFacts(o) {
           code: "claim-not-on-line",
           message: quiet ? `${pl} is not written at ${p.file}:${p.line} (or the line either side); cite the line that writes it (its text is not repeated here: it may be a secret)` : `${pl} says "${p.value}" is written at ${p.file}:${p.line} (or the line either side), and it isn't`
         };
-      partLines.push(...near(ls, p.line));
+      const partNear = near(ls, p.line);
+      const from = Math.max(0, p.line - 2);
+      const isComment2 = partNear.map((_, i2) => commentAt(p.file, ls, from + i2 + 1));
+      const naming = claims2 && isComment2.some(Boolean) ? partNear.map((l, i2) => ({ l, comment: isComment2[i2] })).filter(({ l }) => lineNamesClaim(l, routeOrWord(p.value)) || lineNamesClaim(l, { kind: "word", value: p.value.replace(/^\/+|\/+$/g, "") }) || partsNamePath([l], p.value)) : [];
+      if (claims2 && naming.length && !/(^|\/)_redirects$/.test(p.file) && naming.every((x) => x.comment))
+        return {
+          code: "claim-in-comment",
+          message: quiet ? `${pl} is written at ${p.file}:${p.line} (or the line either side) only in a comment; cite the code that does it` : `${pl} says "${p.value}", which ${p.file}:${p.line} (or the line either side) writes only in a comment; cite the code that does it`
+        };
+      const kept2 = /(^|\/)_redirects$/.test(p.file) ? partNear : partNear.filter((_, i2) => !isComment2[i2]);
+      partLines.push(...kept2);
+      partWindows.push(kept2.join("\n"));
     }
+    const codeLines = parts.length && !/(^|\/)_redirects$/.test(cite2.file) ? codeLinesOf(cite2.file, lines) : lines;
     let derived;
     const derivedHere = () => derived ??= [
       { file: cite2.file, line: cite2.line },
       ...parts.map((p) => ({ file: p.file, line: p.line }))
     ].flatMap((at) => derivedNamesAt(at.file, linesOf2(at.file) ?? [], at.line, deriveEnv));
-    const holds = (c) => claimOnLines(lines, cite2.line, c) || // a framework that routes by file place (Razor Pages, WebForms, Next.js)
-    c.kind === "route" && pageRouteMatches(cite2.file, lines, (p) => linesOf2(p) !== void 0, c.value) || parts.length > 0 && (c.kind === "route" ? partsNamePath([...near(lines, cite2.line), ...partLines], c.value) : partLines.some((l) => lineNamesClaim(l, c)) || // a word put together from parts (`namespace:task`, a key a helper prefixes)
-    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines, cite2.line))) || o.derivedNames !== false && derivedHolds(c, derivedHere(), partLines, partsNamePath) || alsoHolds !== void 0 && alsoHolds(lines, cite2.line);
-    if (claims && !claims.some(holds))
+    const conventional = declaresConventionalRoute([
+      ...parts.map((p) => p.value),
+      ...partWindows,
+      near(codeLines, cite2.line).join("\n")
+    ]);
+    const onlyInComment = (c) => httpRoute && parts.length > 0 && c.kind === "route" && codeLines !== lines && !conventional && pathPieceOnlyInComment(near(lines, cite2.line), (_, i) => commentAt(cite2.file, lines, Math.max(0, cite2.line - 2) + i + 1), partLines, c.value) !== void 0;
+    const holdsOn = (lines2) => (c) => claimOnLines(lines2, cite2.line, c) || // a framework that routes by file place (Razor Pages, WebForms, Next.js)
+    c.kind === "route" && pageRouteMatches(cite2.file, lines2, (p) => linesOf2(p) !== void 0, c.value) || parts.length > 0 && (c.kind === "route" ? partsNamePath([...near(lines2, cite2.line), ...partLines], c.value) && !onlyInComment(c) : partLines.some((l) => lineNamesClaim(l, c)) || // a word put together from parts (`namespace:task`, a key a helper prefixes)
+    c.kind === "word" && partsBuildWord(c.value, parts.map((p) => p.value), near(lines2, cite2.line))) || o.derivedNames !== false && derivedHolds(c, derivedHere(), partLines, partsNamePath) || alsoHolds !== void 0 && alsoHolds(lines2, cite2.line);
+    if (claims2 && !claims2.some(holdsOn(codeLines))) {
+      if (codeLines !== lines && (claims2.some(holdsOn(lines)) || claims2.some(onlyInComment)))
+        return {
+          code: "claim-in-comment",
+          message: `${label} claims ${claims2.map((c) => `"${c.value}"`).join(" or ")}, which ${where} (or the line either side) and its parts write only in a comment; cite the code that does it`
+        };
       return {
         code: "claim-not-on-line",
-        message: `${label} claims ${claims.map((c) => `"${c.value}"`).join(" or ")}, which ${where} (or the line either side)${parts.length ? " and its parts" : ""} does not name${parts.length || !withHint ? "" : "; if it is put together from other lines (a base URL, a prefix, a context path), cite them in cite.with"}`
+        message: `${label} claims ${claims2.map((c) => `"${c.value}"`).join(" or ")}, which ${where} (or the line either side)${parts.length ? " and its parts" : ""} does not name${parts.length || !withHint ? "" : "; if it is put together from other lines (a base URL, a prefix, a context path), cite them in cite.with"}`
       };
-    if (claims && parts.length && isCommentLine(lines[cite2.line - 1] ?? "") && !/(^|\/)_redirects$/.test(cite2.file))
+    }
+    if (claims2 && parts.length && commentAt(cite2.file, lines, cite2.line) && !/(^|\/)_redirects$/.test(cite2.file))
       return {
         code: "claim-in-comment",
         message: `${label} cites ${where}, which is a comment; cite the code that does it`
       };
-    if (claims && !parts.length) {
-      const naming = [cite2.line - 1, cite2.line, cite2.line + 1].map((n) => lines[n - 1]).filter((l) => l !== void 0 && claims.some((c) => lineNamesClaim(l, c)));
-      if (naming.length && !/(^|\/)_redirects$/.test(cite2.file) && naming.every(isCommentLine))
+    if (claims2 && !parts.length) {
+      const naming = [cite2.line - 1, cite2.line, cite2.line + 1].filter((n) => {
+        const l = lines[n - 1];
+        return l !== void 0 && claims2.some((c) => lineNamesClaim(l, c));
+      });
+      if (naming.length && !/(^|\/)_redirects$/.test(cite2.file) && naming.every((n) => commentAt(cite2.file, lines, n)))
         return {
           code: "claim-in-comment",
-          message: `${label} claims ${claims.map((c) => `"${c.value}"`).join(" or ")}, which ${where} writes only in a comment; cite the code that does it`
+          message: `${label} claims ${claims2.map((c) => `"${c.value}"`).join(" or ")}, which ${where} writes only in a comment; cite the code that does it`
         };
     }
     const line = lines[cite2.line - 1] ?? "";
@@ -3977,7 +4452,7 @@ async function verifyFacts(o) {
     // beta.24): a helper puts the key together (a `@ConfigurationProperties` prefix, a
     // map field, the name passed to a lookup). The cited line is code naming the key's
     // last segment, and one file among the parts proves the rest of the key nests so.
-    f.kind === "call" && PLACEHOLDER_KEY.test(f.path.trim()) && helperBuildsKey(PLACEHOLDER_KEY.exec(f.path.trim())[1], f.cite, linesOf2) : void 0, quietFact(f, lineAt)));
+    f.kind === "call" && PLACEHOLDER_KEY.test(f.path.trim()) && helperBuildsKey(PLACEHOLDER_KEY.exec(f.path.trim())[1], f.cite, linesOf2) : void 0, quietFact(f, lineAt), f.kind === "entry" && f.entryType === "rest" || f.kind === "call" && f.callType === "rest"));
     if (f.kind === "config" && !found.has(f.id)) {
       const bad = configLineProblem(f, linesOf2, listed2, rules.gatewayBundleFolders);
       if (bad)
@@ -4548,9 +5023,9 @@ function numberedSlice(text, s) {
   return linesOf(text).slice(s.from - 1, s.to).map((l, i) => `${s.from + i}| ${shownLine(l)}`).join("\n");
 }
 var header = (s) => `${s.path} lines ${s.from}-${s.to} of ${s.of} (numbered as in the file)`;
-function sliceText(source, s) {
+function sliceText(source2, s) {
   return `${header(s)}
-${numberedSlice(source.read(s.path) ?? "", s)}`;
+${numberedSlice(source2.read(s.path) ?? "", s)}`;
 }
 var tokensOf = (units) => Math.ceil(units / 4);
 var wrapUnits = (path) => tokenUnits(`<atticus-data id="1-file-0000" kind="code" origin="${path}#L0000000-0000000">
@@ -4558,7 +5033,7 @@ var wrapUnits = (path) => tokenUnits(`<atticus-data id="1-file-0000" kind="code"
 </atticus-data>
 
 `);
-function planBatches(source, o) {
+function planBatches(source2, o) {
   const room = Math.max(1, o.room);
   const rules = readRulesOf(o.conventions);
   const excludeRes = (o.exclude ?? []).map(globToRegExp);
@@ -4567,10 +5042,10 @@ function planBatches(source, o) {
   const notReached = [];
   const paths = [];
   const texts = /* @__PURE__ */ new Map();
-  for (const p of source.list()) {
-    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(source, p))
+  for (const p of source2.list()) {
+    if (!isSourceFile(p, "", void 0, rules) || tooBigToRead(source2, p))
       continue;
-    const text = source.read(p);
+    const text = source2.read(p);
     if (text === void 0)
       continue;
     const ls = linesOf(text);
@@ -6036,11 +6511,11 @@ function toDrawio(view, o = {}) {
     y += Math.max(...row.map((b) => b.h)) + GAP;
   }
   for (const e of view.edges) {
-    const source = cellOf.get(e.from);
+    const source2 = cellOf.get(e.from);
     const target = cellOf.get(e.to);
-    if (!source || !target)
+    if (!source2 || !target)
       continue;
-    cells.push(`        <mxCell id="${attr(`edge.${e.id}`)}" value="${attr(e.label)}" style="${attr(edgeStyle(e))}" edge="1" parent="1" source="${attr(source)}" target="${attr(target)}">
+    cells.push(`        <mxCell id="${attr(`edge.${e.id}`)}" value="${attr(e.label)}" style="${attr(edgeStyle(e))}" edge="1" parent="1" source="${attr(source2)}" target="${attr(target)}">
           <mxGeometry relative="1" as="geometry"/>
         </mxCell>`);
   }
@@ -6086,7 +6561,7 @@ function shapeLibrary() {
   return `<mxlibrary>${JSON.stringify(entries)}</mxlibrary>
 `;
 }
-function viewFromDiagram(diagram, source) {
+function viewFromDiagram(diagram, source2) {
   const multi = new Set(diagram.nodes.map((n) => n.page)).size > 1;
   const key = (page, cell) => multi ? `${page}:${cell}` : cell;
   const nodes = diagram.nodes.map((n) => ({
@@ -6111,7 +6586,7 @@ function viewFromDiagram(diagram, source) {
       ...e.legend ? { legend: e.legend } : {}
     });
   }
-  return { type: "diagram", title: "Diagram view", source, groups: [], nodes, edges };
+  return { type: "diagram", title: "Diagram view", source: source2, groups: [], nodes, edges };
 }
 
 // packages/diagrams/dist/hierarchy.js
@@ -6536,18 +7011,24 @@ function buildEstate(records2, o = {}) {
     }
   });
   const partNode = (ref) => components.has(ref) ? `component:${ref}` : systems.has(ref) ? `system:${ref}` : unknown(ref);
+  const withRepo = new Set(repoSystem.values());
+  const hasRepo = (id) => withRepo.has(id) || (systemRecords.get(id)?.repos.length ?? 0) > 0;
+  const outsideSystem = (id) => !hasRepo(id) && systemRecords.get(id)?.boundary === "vendor";
   for (const c of components.values()) {
     const gaps = [];
     let parent;
+    const outsideOne = !c.repo && outsideSystem(c.system);
     if (c.repo)
       parent = repoNode(c.repo);
     else {
-      gaps.push("no-repo");
+      if (!outsideOne)
+        gaps.push("no-repo");
       parent = systems.has(c.system) ? `system:${c.system}` : "estate";
     }
     if (!systems.has(c.system))
       gaps.push("no-system");
-    add(fromRecord(c, `component:${c.id}`, "component", c.id, parent, { type: c.type, runtime: c.runtime, repo: c.repo, path: c.path }, gaps));
+    const node = fromRecord(c, `component:${c.id}`, "component", c.id, parent, { type: c.type, runtime: c.runtime, repo: c.repo, path: c.path }, gaps);
+    add(outsideOne ? { ...node, gaps: node.gaps.filter((g) => g !== "inferred") } : node);
   }
   const endpointNode = /* @__PURE__ */ new Map();
   const topicByPath = /* @__PURE__ */ new Map();
@@ -6635,10 +7116,10 @@ function buildEstate(records2, o = {}) {
     const ev = evidenceOf(i.evidence);
     const gaps = [...recordGaps(i), ...i.conflicts.length ? ["conflicts"] : []];
     const target = i.endpoint ? endpointNode.get(i.endpoint) : void 0;
-    const join2 = joinOf(i);
+    const join3 = joinOf(i);
     if (target?.startsWith("topic:")) {
-      atoms.push({ from, to: target, type: "publishes", evidence: ev, gaps, join: join2 });
-      atoms.push({ from: to, to: target, type: "subscribes", evidence: ev, gaps, join: join2 });
+      atoms.push({ from, to: target, type: "publishes", evidence: ev, gaps, join: join3 });
+      atoms.push({ from: to, to: target, type: "subscribes", evidence: ev, gaps, join: join3 });
       continue;
     }
     if (!i.endpoint && (i.via === "event-bus" || i.via === "mq") && i.normalizedPath) {
@@ -6652,16 +7133,16 @@ function buildEstate(records2, o = {}) {
         if (outside.has(homeRef) || b === "vendor" || b === "outside")
           owner.properties.ownerOutside = true;
       }
-      if (join2.shared)
-        owner.properties = { ...owner.properties, owner: join2.shared.team, ownerOutside: true };
+      if (join3.shared)
+        owner.properties = { ...owner.properties, owner: join3.shared.team, ownerOutside: true };
       if (i.flags?.includes(DECLARED_TOPIC)) {
         owner.properties = { ...owner.properties, declared: true };
         owner.gaps = [.../* @__PURE__ */ new Set([...owner.gaps, DECLARED_TOPIC])];
         owner.evidence = mergeEvidence(owner.evidence, evidenceOf(i.evidence.filter((e) => e.source === "manual")));
       }
-      atoms.push({ from, to: t, type: "publishes", evidence: ev, gaps, join: join2 });
+      atoms.push({ from, to: t, type: "publishes", evidence: ev, gaps, join: join3 });
       if (to.startsWith("component:"))
-        atoms.push({ from: to, to: t, type: "subscribes", evidence: ev, gaps, join: join2 });
+        atoms.push({ from: to, to: t, type: "subscribes", evidence: ev, gaps, join: join3 });
       continue;
     }
     let caller = from;
@@ -6693,7 +7174,7 @@ function buildEstate(records2, o = {}) {
       via: i.via,
       evidence: ev,
       gaps: [...gaps, ...i.endpoint && !target ? ["no-endpoint"] : []],
-      join: join2
+      join: join3
     });
   }
   for (const u of all(records2, "Unresolved")) {
@@ -6724,14 +7205,14 @@ function buildEstate(records2, o = {}) {
   for (const l of o.dependsOn ?? []) {
     if (!components.has(l.from.component) || !components.has(l.to.component))
       continue;
-    const join2 = dependencyJoin(l);
+    const join3 = dependencyJoin(l);
     atoms.push({
       from: `component:${l.from.component}`,
       to: `component:${l.to.component}`,
       type: "depends-on",
-      evidence: mergeEvidence(join2.caller.slice(0, 1), join2.callee.slice(0, 1)),
+      evidence: mergeEvidence(join3.caller.slice(0, 1), join3.callee.slice(0, 1)),
       gaps: [],
-      join: join2
+      join: join3
     });
   }
   for (const t of tables) {
@@ -6924,9 +7405,9 @@ function reduceUses(edges) {
   const out = /* @__PURE__ */ new Map();
   for (const e of uses)
     out.set(e.from, [...out.get(e.from) ?? [], e.to]);
-  const reachesWithout = (from, to, skip) => {
+  const reachesWithout = (from, to, skip2) => {
     const seen = /* @__PURE__ */ new Set();
-    const stack = (out.get(from) ?? []).filter((n) => !(from === skip.from && n === skip.to));
+    const stack = (out.get(from) ?? []).filter((n) => !(from === skip2.from && n === skip2.to));
     while (stack.length) {
       const n = stack.pop();
       if (n === to)
@@ -7694,9 +8175,9 @@ function rereadPlan(o) {
     unknown: [...unknown].sort()
   };
 }
-function onlyFiles(source, paths) {
+function onlyFiles(source2, paths) {
   const keep = new Set(paths);
-  return { list: () => source.list().filter((p) => keep.has(p)), read: (p) => source.read(p) };
+  return { list: () => source2.list().filter((p) => keep.has(p)), read: (p) => source2.read(p) };
 }
 
 // packages/verify/dist/slips.js
@@ -7845,6 +8326,759 @@ function repairFormSlips(facts, bad, onFile = []) {
   return { facts: kept, bad: still, slips };
 }
 
+// packages/verify/dist/canary.js
+var CANARY_DEFAULT_REMOVALS = 3;
+var WORDS = [
+  "amber",
+  "aspen",
+  "basalt",
+  "birch",
+  "bramble",
+  "cedar",
+  "cobalt",
+  "coral",
+  "cypress",
+  "dune",
+  "ember",
+  "fennel",
+  "fjord",
+  "garnet",
+  "glacier",
+  "hazel",
+  "heron",
+  "indigo",
+  "juniper",
+  "kelp",
+  "kestrel",
+  "larch",
+  "lumen",
+  "maple",
+  "marlin",
+  "meadow",
+  "nimbus",
+  "nutmeg",
+  "onyx",
+  "orchid",
+  "pebble",
+  "plover",
+  "quartz",
+  "quill",
+  "raven",
+  "reed",
+  "saffron",
+  "sorrel",
+  "spruce",
+  "tamarack",
+  "thistle",
+  "tundra",
+  "umber",
+  "vale",
+  "willow",
+  "wren",
+  "yarrow",
+  "zephyr"
+];
+var SPRING = /\borg\.springframework\b/;
+var SPRING_APP = /@SpringBootApplication\b/;
+var TEST_PATH = /(^|\/)(tests?|__tests__|spec|e2e|fixtures?)\//i;
+var TEST_FILE = /(\.(test|spec)\.[cm]?[jt]sx?$|_test\.py$|^test_.*\.py$|Test\.java$|Tests\.java$)/;
+var NODE_SOURCE = /\.(ts|tsx|js|jsx|mjs)$/;
+var NOT_NODE_SOURCE = /(\.d\.ts$|\.config\.[cm]?[jt]s$|\.min\.js$)/;
+var NEVER_COPIED = [
+  // registries, hosts, databases, clouds and vaults (second review of ADR 0196: the rest of them)
+  /(^|\/)[._]?(npmrc|pypirc|netrc|git-credentials|htpasswd|envrc|pgpass|my\.cnf|s3cfg|boto|vault-token|dockercfg|yarnrc|terraformrc|bowerrc)$/i,
+  /(^|\/)\.yarnrc\.yml$/i,
+  /(^|\/)kubeconfig([._-][^/]*)?$/i,
+  /(^|\/)\.kube\/config$/i,
+  /(^|\/)\.docker\/config\.json$/i,
+  /(^|\/)\.ssh\//i,
+  /(^|\/)\.config\/gh\/hosts\.ya?ml$/i,
+  /(^|\/)\.cargo\/credentials(\.toml)?$/i,
+  /(^|\/)\.gradle\/gradle\.properties$/i,
+  /(^|\/)credentials\.tfrc\.json$/i,
+  /(^|\/)settings-security\.xml$/i,
+  /(^|\/)wallet\.dat$/i,
+  /\.env$/i,
+  /(^|\/)\.env\.[^/]+$/i,
+  /(^|\/|[-_.])secrets?\.(ya?ml|json)$/i,
+  /(^|\/)local\.settings\.json$/i,
+  /(^|\/)appsettings\.[^/]*secrets?[^/]*\.json$/i,
+  /(^|\/)auth\.json$/i,
+  /(^|\/)service[-_]?account[^/]*\.json$/i,
+  /(^|\/)[^/]*sa[-_]key[^/]*\.json$/i,
+  /(^|\/)[^/]*[-_]key\.json$/i,
+  /(^|\/)firebase-adminsdk[^/]*\.json$/i,
+  /(^|\/)client_secret[^/]*\.json$/i,
+  /\.tfvars(\.json)?$/i,
+  /\.tfstate([.][^/]*)?$/i,
+  /\.(p8|p12|pfx|kdbx|keystore|jks|pem|key|ppk|keytab|asc|gpg|ovpn)$/i
+];
+var BACKUP = /(\.(bak|old|orig|backup|save|swp|tmp)|~)$/i;
+function canaryNeverCopied(path) {
+  if (isSecretPath(path))
+    return true;
+  let p = path.replace(/\\/g, "/").split("/").map((x) => x.replace(/:.*$/, "").replace(/[. ]+$/, "")).join("/");
+  for (; ; ) {
+    if (NEVER_COPIED.some((re) => re.test(p)))
+      return true;
+    const q = p.replace(BACKUP, "");
+    if (q === p)
+      return false;
+    if (isSecretPath(q))
+      return true;
+    p = q;
+  }
+}
+var CANARY_SECRET_PREFIX = 64 * 1024;
+function canaryHoldsSecret(prefix) {
+  return /-----BEGIN [A-Z ]*PRIVATE KEY( BLOCK)?-----/.test(prefix) || /\baws_secret_access_key\s*[=:]/i.test(prefix) || /"private_key"\s*:/.test(prefix) || /_authToken\s*=/.test(prefix);
+}
+var dirOf3 = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "";
+var baseOf = (p) => p.slice(p.lastIndexOf("/") + 1);
+var join2 = (dir, name) => dir ? `${dir}/${name}` : name;
+var source = (p) => !TEST_PATH.test(p) && !TEST_FILE.test(baseOf(p));
+function hostOf2(file, text, re) {
+  const m = re.exec(text);
+  if (!m)
+    return void 0;
+  return { file, v: m[1], line: text.slice(0, m.index).split("\n").length, call: m[2] };
+}
+var NODE_APP = /^(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::\s*[\w$.<>[\], ]+?\s*)?=\s*(express\s*\.\s*Router|express|Router)\s*\(\s*(?:\{[^(){}]*\}\s*)?\)/m;
+var PY_APP = /^([A-Za-z_]\w*)\s*(?::\s*[\w.[\], ]+?\s*)?=\s*(APIRouter|FastAPI|Flask|Blueprint)\s*\(/m;
+var PY_FACTORY = /^\s+[A-Za-z_]\w*\s*(?::[^=\n]+)?=\s*(Flask|FastAPI)\s*\(/m;
+var within = (dir, of) => of === "" || dir === of || dir.startsWith(`${of}/`);
+function buildFilesOf(files, file, isBuild) {
+  const at = dirOf3(file);
+  return files.filter((f) => {
+    if (!isBuild(f))
+      return false;
+    const home = /(^|\/)requirements\/[^/]+$/.test(f) ? dirOf3(dirOf3(f)) : dirOf3(f);
+    return within(at, home);
+  });
+}
+var GRADLE_BUILD2 = /(^|\/)(pom\.xml|build\.gradle(\.kts)?)$/;
+var CONVENTION = /(^|\/)(buildSrc|build-logic)\/.*\.gradle(\.kts)?$/;
+var CATALOG = /(^|\/)gradle\/([^/]+)\.versions\.toml$/;
+var dashed = (s) => s.replace(/[._]/g, "-");
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function springBuildText(src, files, file) {
+  const parts = buildFilesOf(files, file, (f) => GRADLE_BUILD2.test(f) && !CONVENTION.test(f)).map((f) => src.read(f) ?? "");
+  const conventions = files.filter((f) => CONVENTION.test(f)).map((f) => ({ id: baseOf(f).replace(/\.gradle(\.kts)?$/, ""), text: src.read(f) ?? "" }));
+  const applied = /* @__PURE__ */ new Set();
+  for (let more = true; more; ) {
+    more = false;
+    const all2 = parts.join("\n");
+    for (const c of conventions)
+      if (!applied.has(c.id) && new RegExp(`["'\`]${escapeRe(c.id)}["'\`]`).test(all2)) {
+        applied.add(c.id);
+        parts.push(c.text);
+        more = true;
+      }
+  }
+  let text = dashed(parts.join("\n"));
+  for (const f of files.filter((x) => CATALOG.test(x))) {
+    const name = dashed(CATALOG.exec(f)[2]);
+    for (const l of (src.read(f) ?? "").split("\n")) {
+      const m = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(?:\{[^}]*?\bmodule\s*=\s*"[^":]+:([^":]+)"|\{[^}]*?\bname\s*=\s*"([^"]+)"|"[^":]+:([^":]+)(?::[^"]*)?")/.exec(l);
+      const artifact = m && (m[2] ?? m[3] ?? m[4]);
+      if (!artifact)
+        continue;
+      if (new RegExp(`\\b${escapeRe(`${name}-${dashed(m[1])}`)}(?![A-Za-z0-9-])`).test(text))
+        text += `
+${artifact}`;
+    }
+  }
+  return text;
+}
+var SPRING_WEB = /spring-boot-starter-web\b|spring-boot-starter-webflux|spring-webmvc|spring-webflux|spring-web\b/;
+var SPRING_KAFKA = /\bspring-kafka\b|\bspring-cloud-stream-binder-kafka\b|\bspring-cloud-starter-stream-kafka\b/;
+var NODE_SERVERS = ["express", "fastify", "koa", "@hapi/hapi", "@nestjs/core", "hono", "next"];
+var BROWSER_LIBS = [
+  "react",
+  "react-dom",
+  "vue",
+  "svelte",
+  "@angular/core",
+  "preact",
+  "solid-js",
+  "vite",
+  "@vitejs/plugin-react",
+  "webpack",
+  "parcel"
+];
+function packageOf(files, file) {
+  const all2 = new Set(files);
+  for (let d = dirOf3(file); ; d = dirOf3(d)) {
+    if (all2.has(join2(d, "package.json")))
+      return join2(d, "package.json");
+    if (d === "")
+      return void 0;
+  }
+}
+function nodePackages(src, files) {
+  const out = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    try {
+      const j = JSON.parse(src.read(f) ?? "");
+      for (const k of [
+        "dependencies",
+        "devDependencies",
+        "peerDependencies",
+        "optionalDependencies"
+      ]) {
+        const d = j[k];
+        if (d && typeof d === "object")
+          for (const n of Object.keys(d))
+            out.add(n);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+var skip = (what, reason) => what.map((w) => ({ what: w, reason }));
+function canaryStacks(src, seed) {
+  const files = src.list();
+  const pick = (list2, what) => seededShuffle(list2.map((id) => ({ id })), `${seed}:${what}`)[0]?.id;
+  const out = [];
+  const springFiles = files.filter((f) => f.endsWith(".java") && source(f) && SPRING.test(src.read(f) ?? ""));
+  if (springFiles.length) {
+    const app = pick(springFiles.filter((f) => SPRING_APP.test(src.read(f) ?? "")), "spring-app");
+    const spring = app ?? pick(springFiles, "spring");
+    const pkg = /^\s*package\s+([\w.]+)\s*;/m.exec(src.read(spring) ?? "")?.[1];
+    const module = buildFilesOf(files, spring, (f) => GRADLE_BUILD2.test(f) && !CONVENTION.test(f)).map(dirOf3).sort((a, b) => b.length - a.length)[0];
+    const configs = files.filter((f) => /(^|\/)application\.(ya?ml|properties)$/.test(f) && source(f)).sort((a, b) => a.length - b.length || (a < b ? -1 : 1));
+    const config2 = configs.find((f) => module !== void 0 && within(dirOf3(f), module)) ?? (module === void 0 || module === "" ? configs[0] : void 0);
+    const build = springBuildText(src, files, spring);
+    const web = SPRING_WEB.test(build);
+    const kafka = SPRING_KAFKA.test(build);
+    const can = /* @__PURE__ */ new Set();
+    const skipped = [];
+    if (!app)
+      skipped.push(...skip(["entry", "call", "topic-in", "topic-out"], "no @SpringBootApplication class, so no scan would find a new class"));
+    else {
+      if (web)
+        can.add("entry").add("call");
+      else
+        skipped.push(...skip(["entry", "call"], "the app's module's build files declare no Spring web library (spring-web)"));
+      if (kafka)
+        can.add("topic-in").add("topic-out");
+      else
+        skipped.push(...skip(["topic-in", "topic-out"], "the app's module's build files declare no Kafka client (spring-kafka, or Spring Cloud Stream's Kafka binder)"));
+    }
+    if (config2 || can.has("entry"))
+      can.add("config");
+    else
+      skipped.push(...skip(["config"], "no application config file, and no web class to read a key in"));
+    out.push({
+      stack: "spring",
+      dir: dirOf3(spring),
+      ...pkg ? { pkg } : {},
+      ...config2 ? { config: config2 } : {},
+      can,
+      skipped
+    });
+  }
+  if (files.some((f) => baseOf(f) === "package.json")) {
+    const nodeFiles = files.filter((f) => NODE_SOURCE.test(f) && !NOT_NODE_SOURCE.test(f) && source(f));
+    const ext = nodeFiles.some((f) => /\.tsx?$/.test(f)) ? "ts" : "js";
+    const pkgsCache = /* @__PURE__ */ new Map();
+    const pkgsOf = (f) => {
+      const p = packageOf(files, f) ?? "";
+      if (!pkgsCache.has(p))
+        pkgsCache.set(p, nodePackages(src, p ? [p] : []));
+      return pkgsCache.get(p);
+    };
+    const app = pick(nodeFiles.filter((f) => pkgsOf(f).has("express") && NODE_APP.test(src.read(f) ?? "")), "node-app");
+    const under4 = nodeFiles.filter((f) => /(^|\/)src\//.test(f));
+    const node = app ?? pick(under4.length ? under4 : nodeFiles, "node");
+    if (node) {
+      const pkgs = pkgsOf(node);
+      const text = app ? src.read(app) ?? "" : "";
+      const cjs = !/^\s*(import|export)\s/m.test(text) && /\brequire\(/.test(text);
+      const browser = !NODE_SERVERS.some((s) => pkgs.has(s)) && BROWSER_LIBS.some((s) => pkgs.has(s));
+      const can = /* @__PURE__ */ new Set(["call"]);
+      const skipped = [];
+      if (browser)
+        skipped.push(...skip(["config"], "a browser app (its package declares no server) has no process.env"));
+      else
+        can.add("config");
+      if (app)
+        can.add("entry");
+      else
+        skipped.push(...skip(["entry"], pkgs.has("express") ? "no express app or router made at a module's top level to serve a route on" : "its package declares no server (express): a browser app serves no route"));
+      if (pkgs.has("kafkajs") && !browser)
+        can.add("topic-in").add("topic-out");
+      else
+        skipped.push(...skip(["topic-in", "topic-out"], "its package declares no Kafka client (kafkajs)"));
+      const h = app ? hostOf2(app, text, NODE_APP) : void 0;
+      out.push({
+        stack: "node",
+        dir: dirOf3(node),
+        ext,
+        ...h ? { host: { file: h.file, v: h.v, line: h.line, ...cjs ? { cjs } : {} } } : {},
+        ...browser ? { browser } : {},
+        can,
+        skipped
+      });
+    }
+  }
+  const pyFiles = files.filter((f) => f.endsWith(".py") && source(f) && baseOf(f) !== "__init__.py");
+  const pyText = (f) => src.read(f) ?? "";
+  const PY_BUILD = /(^|\/)(pyproject\.toml|setup\.py|setup\.cfg|Pipfile|requirements[^/]*\.(txt|in)|requirements\/[^/]+\.(txt|in))$/;
+  const declaresIn = (f) => {
+    const text = buildFilesOf(files, f, (p) => PY_BUILD.test(p)).map(pyText).join("\n");
+    return (name) => new RegExp(`(^|[^A-Za-z0-9_.-])${name}([^A-Za-z0-9_.-]|$)`, "im").test(text);
+  };
+  const allPy = files.filter((f) => f.endsWith(".py") && source(f));
+  const registered = (v, call) => call !== "Blueprint" && call !== "APIRouter" ? true : allPy.some((f) => new RegExp(`\\b${call === "Blueprint" ? "register_blueprint" : "include_router"}\\s*\\(\\s*(?:[A-Za-z_]\\w*\\.)?${v}\\b`).test(pyText(f)));
+  const served = (f) => {
+    const m = PY_APP.exec(pyText(f));
+    if (!m || !registered(m[1], m[2]))
+      return false;
+    return m[2] === "Flask" || m[2] === "Blueprint" ? declaresIn(f)("flask") : declaresIn(f)("fastapi");
+  };
+  const pyApp = pick(pyFiles.filter((f) => PY_APP.test(pyText(f)) && served(f)), "python-app");
+  const py = pyApp ?? pick(pyFiles, "python");
+  if (py) {
+    const declares = declaresIn(py);
+    const h = pyApp ? hostOf2(pyApp, pyText(pyApp), PY_APP) : void 0;
+    const http = declares("httpx") ? "httpx" : declares("requests") ? "requests" : void 0;
+    const can = /* @__PURE__ */ new Set(["config"]);
+    const skipped = [];
+    if (h)
+      can.add("entry");
+    else
+      skipped.push(...skip(["entry"], files.some((f) => f.endsWith(".py") && PY_FACTORY.test(pyText(f))) ? "the app is made inside a function (an app factory), and no module-level router or blueprint is registered on it to serve a route on" : "no app or router the build files' web framework makes to serve a route on"));
+    if (http)
+      can.add("call");
+    else
+      skipped.push(...skip(["call"], "the build files declare no HTTP client (httpx, requests)"));
+    if (declares("kafka-python"))
+      can.add("topic-in").add("topic-out");
+    else
+      skipped.push(...skip(["topic-in", "topic-out"], "the build files declare no Kafka client (kafka-python)"));
+    out.push({
+      stack: "python",
+      dir: dirOf3(py),
+      ...h ? {
+        host: {
+          file: h.file,
+          v: h.v,
+          line: h.line,
+          ...h.call === "Flask" || h.call === "Blueprint" ? { flask: true } : {}
+        }
+      } : {},
+      ...http ? { http } : {},
+      can,
+      skipped
+    });
+  }
+  return out;
+}
+var pascal = (w) => w[0].toUpperCase() + w.slice(1);
+function claims(n, stack) {
+  const key = stack === "spring" ? `${n.config[0]}.${n.config[1]}-url` : `${n.config[0]}_${n.config[1]}_url`.toUpperCase();
+  return {
+    entry: { claim: `entry GET /${n.entry.join("-")}/{id}`, needle: n.entry.join("-") },
+    call: { claim: `call GET /${n.call.join("-")}/{id}`, needle: n.call.join("-") },
+    "topic-in": {
+      claim: `entry topic ${n.topicIn.join(".")}.updated`,
+      needle: foldCanary(`${n.topicIn.join(".")}.updated`)
+    },
+    "topic-out": {
+      claim: `call topic ${n.topicOut.join(".")}.viewed`,
+      needle: foldCanary(`${n.topicOut.join(".")}.viewed`)
+    },
+    config: { claim: `config ${key}`, needle: foldCanary(key) }
+  };
+}
+function springPlanting(h, n, taken) {
+  const name = `${pascal(n.entry[0])}${pascal(n.entry[1])}`;
+  const key = `${n.config[0]}.${n.config[1]}-url`;
+  const head = h.pkg ? [`package ${h.pkg};`, ""] : [];
+  const resource = [
+    ...head,
+    "import org.springframework.beans.factory.annotation.Value;",
+    "import org.springframework.web.bind.annotation.GetMapping;",
+    "import org.springframework.web.bind.annotation.PathVariable;",
+    "import org.springframework.web.bind.annotation.RestController;",
+    "import org.springframework.web.client.RestTemplate;",
+    "",
+    "@RestController",
+    `public class ${name}Resource {`,
+    "  private final RestTemplate http = new RestTemplate();",
+    "",
+    // with a default, so an app whose config file doesn't set the key still starts
+    h.config ? `  @Value("\${${key}:}")` : { text: `  @Value("\${${key}:}")`, what: "config" },
+    "  private String baseUrl;",
+    "",
+    { text: `  @GetMapping("/${n.entry.join("-")}/{id}")`, what: "entry" },
+    "  public String find(@PathVariable String id) {",
+    {
+      text: `    return http.getForObject(baseUrl + "/${n.call.join("-")}/{id}", String.class, id);`,
+      what: "call"
+    },
+    "  }",
+    "}",
+    ""
+  ];
+  const events = [
+    ...head,
+    "import org.springframework.kafka.annotation.KafkaListener;",
+    "import org.springframework.kafka.core.KafkaTemplate;",
+    "import org.springframework.stereotype.Component;",
+    "",
+    "@Component",
+    `public class ${name}Events {`,
+    "  private final KafkaTemplate<String, String> kafka;",
+    "",
+    `  public ${name}Events(KafkaTemplate<String, String> kafka) {`,
+    "    this.kafka = kafka;",
+    "  }",
+    "",
+    { text: `  @KafkaListener(topics = "${n.topicIn.join(".")}.updated")`, what: "topic-in" },
+    "  public void onUpdated(String id) {",
+    { text: `    kafka.send("${n.topicOut.join(".")}.viewed", id);`, what: "topic-out" },
+    "  }",
+    "}",
+    ""
+  ];
+  const out = {
+    files: [
+      ...h.can.has("entry") ? [{ path: free(join2(h.dir, `${name}Resource.java`), taken), lines: resource }] : [],
+      ...h.can.has("topic-in") ? [{ path: free(join2(h.dir, `${name}Events.java`), taken), lines: events }] : []
+    ]
+  };
+  if (h.config && h.can.has("config"))
+    out.append = {
+      path: h.config,
+      lines: h.config.endsWith(".properties") ? [{ text: `${key}=https://${n.config.join("-")}.example`, what: "config" }] : [
+        `${n.config[0]}:`,
+        { text: `  ${n.config[1]}-url: https://${n.config.join("-")}.example`, what: "config" }
+      ]
+    };
+  return out;
+}
+var camel = (w) => `${w[0]}${pascal(w[1])}`;
+var snake = (w) => w.join("_");
+function nodePlanting(h, n, taken) {
+  const env = `${n.config[0]}_${n.config[1]}_URL`.toUpperCase();
+  const at = h.host;
+  const kafkaOn = h.can.has("topic-in");
+  const kafka = `${camel(n.entry)}Kafka`;
+  const producer = `${camel(n.topicOut)}Events`;
+  const consumer = `${camel(n.topicIn)}Updates`;
+  const url = `${camel(n.config)}Url`;
+  const kafkaLines = kafkaOn ? [`const ${kafka} = () => new Kafka({ brokers: [] });`] : [];
+  const pad = at ? "    " : "  ";
+  const send = kafkaOn ? [
+    `${pad}const ${producer} = ${kafka}().producer();`,
+    `${pad}await ${producer}.connect();`,
+    {
+      text: `${pad}await ${producer}.send({ topic: "${n.topicOut.join(".")}.viewed", messages: [{ value: ${at ? "req.params.id" : "id"} }] });`,
+      what: "topic-out"
+    },
+    `${pad}await ${producer}.disconnect();`
+  ] : [];
+  const subscribe = kafkaOn ? [
+    "",
+    `async function ${consumer}() {`,
+    `  const consumer = ${kafka}().consumer({ groupId: "${n.topicIn.join("-")}" });`,
+    "  await consumer.connect();",
+    {
+      text: `  await consumer.subscribe({ topic: "${n.topicIn.join(".")}.updated" });`,
+      what: "topic-in"
+    },
+    "}",
+    `${consumer}().catch(() => undefined);`
+  ] : [];
+  const kafkaImport = kafkaOn ? [at?.cjs ? 'const { Kafka } = require("kafkajs");' : 'import { Kafka } from "kafkajs";'] : [];
+  const config2 = h.can.has("config") ? [{ text: `const ${url} = process.env.${env} ?? "";`, what: "config" }] : [];
+  const base2 = h.can.has("config") ? `\${${url}}` : "";
+  if (at) {
+    const body = [
+      ...kafkaLines,
+      ...config2,
+      "",
+      { text: `${at.v}.get("/${n.entry.join("-")}/:id", async (req, res) => {`, what: "entry" },
+      "  try {",
+      {
+        text: `    const r = await fetch(\`${base2}/${n.call.join("-")}/\${req.params.id}\`);`,
+        what: "call"
+      },
+      ...send,
+      "    res.json(await r.json());",
+      "  } catch {",
+      "    res.status(502).end();",
+      "  }",
+      "});",
+      ...subscribe
+    ];
+    return {
+      files: [],
+      append: { path: at.file, lines: ["", ...kafkaImport, ...kafkaOn ? [""] : [], ...body] }
+    };
+  }
+  const id = h.ext === "ts" ? "id: string" : "id";
+  return {
+    files: [
+      {
+        path: free(join2(h.dir, `${n.entry.join("-")}.${h.ext ?? "js"}`), taken),
+        lines: [
+          ...kafkaImport,
+          ...kafkaOn ? [""] : [],
+          ...kafkaLines,
+          ...config2,
+          ...kafkaLines.length || config2.length ? [""] : [],
+          `export async function ${camel(n.entry)}(${id}) {`,
+          {
+            text: `  const r = await fetch(\`${base2}/${n.call.join("-")}/\${id}\`);`,
+            what: "call"
+          },
+          ...send,
+          "  return r.json();",
+          "}",
+          ...subscribe,
+          ""
+        ]
+      }
+    ]
+  };
+}
+function pythonPlanting(h, n, taken) {
+  const env = `${n.config[0]}_${n.config[1]}_URL`.toUpperCase();
+  const at = h.host;
+  const kafkaOn = h.can.has("topic-in");
+  const url = `${snake(n.config)}_url`;
+  const producer = `${snake(n.topicOut)}_events`;
+  const param = at?.flask ? "<item_id>" : "{item_id}";
+  const work = [
+    ...h.http ? [
+      {
+        text: `    body = ${h.http}.get(f"{${url}}/${n.call.join("-")}/{item_id}").json()`,
+        what: "call"
+      }
+    ] : [],
+    // the producer made where it sends (second review of ADR 0196: one made at import would
+    // fail the import with no broker), so a failure is the route's own, answered 500
+    ...kafkaOn ? [
+      {
+        text: `    ${producer}().send("${n.topicOut.join(".")}.viewed", item_id.encode())`,
+        what: "topic-out"
+      }
+    ] : []
+  ];
+  const fn = at || work.length ? [
+    "",
+    "",
+    ...at ? [{ text: `@${at.v}.get("/${n.entry.join("-")}/${param}")`, what: "entry" }] : [],
+    `def ${snake(n.entry)}(item_id: str):`,
+    ...work,
+    h.http ? "    return body" : '    return {"id": item_id}'
+  ] : [];
+  const body = [
+    { text: `${url} = os.environ.get("${env}", "")`, what: "config" },
+    ...kafkaOn ? ["", "", `def ${producer}():`, "    return KafkaProducer()"] : [],
+    ...fn,
+    ...kafkaOn ? [
+      "",
+      "",
+      `def ${snake(n.topicIn)}_updates():`,
+      {
+        text: `    return KafkaConsumer("${n.topicIn.join(".")}.updated")`,
+        what: "topic-in"
+      }
+    ] : []
+  ];
+  const imports = [
+    "import os",
+    ...h.http ? ["", `import ${h.http}`] : [],
+    ...kafkaOn ? ["from kafka import KafkaConsumer, KafkaProducer"] : []
+  ];
+  if (at)
+    return {
+      files: [],
+      append: { path: at.file, lines: ["", "", ...imports, "", ...body] }
+    };
+  return {
+    files: [
+      {
+        path: free(join2(h.dir, `${snake(n.entry)}.py`), taken),
+        lines: [...imports, "", ...body, ""]
+      }
+    ]
+  };
+}
+function free(path, taken) {
+  let p = path;
+  for (let i = 2; taken.has(p); i++)
+    p = path.replace(/(\.[^./]+)$/, `${i}$1`);
+  taken.add(p);
+  return p;
+}
+var KIND_OF = {
+  entry: "entry",
+  call: "call",
+  "topic-in": "entry",
+  "topic-out": "call",
+  config: "config"
+};
+function commentFor(path) {
+  if (/\.(java|kt|kts|groovy|scala|ts|tsx|js|jsx|mjs|cjs|go|cs|gradle)$/.test(path))
+    return "//";
+  if (/\.(py|ya?ml|properties)$/.test(path))
+    return "#";
+  return void 0;
+}
+var COMMENTED = /^\s*(\/\/|#|\/\*|\*|<!--|--)/;
+function balanced(line) {
+  const n = (c) => line.split(c).length - 1;
+  return n("(") === n(")") && n("[") === n("]") && n("{") === n("}");
+}
+function removable(f, line) {
+  if (line === void 0 || !line.trim())
+    return false;
+  if (!line.toLowerCase().includes(f.cite.value.toLowerCase()))
+    return false;
+  if (COMMENTED.test(line) || !balanced(line))
+    return false;
+  if (/\.ya?ml$/.test(f.cite.file))
+    return /^\s*(-\s+)?[^#:\s][^:]*:\s+[^\s|>#]/.test(line);
+  if (f.cite.file.endsWith(".properties"))
+    return /[=:]/.test(line);
+  return true;
+}
+function planCanary(o) {
+  const files = o.source.list();
+  const taken = new Set(files);
+  const texts = /* @__PURE__ */ new Map();
+  const linesOf2 = (p) => {
+    if (!texts.has(p))
+      texts.set(p, (o.source.read(p) ?? "").split("\n"));
+    return texts.get(p);
+  };
+  const stacks = canaryStacks(o.source, o.seed);
+  const hostLine = (f) => stacks.some((h) => h.host?.file === f.cite.file && h.host.line === f.cite.line);
+  const kept = o.facts.filter((f) => f.verified !== "none" && f.by !== "person" && (f.kind === "entry" || f.kind === "call" || f.kind === "config"));
+  const near = (a, b) => a.id !== b.id && removedBy({
+    id: `remove:${a.id}`,
+    fact: a.id,
+    kind: a.kind,
+    file: a.cite.file,
+    line: a.cite.line,
+    claim: a.kind,
+    value: a.cite.value || "-",
+    needle: canaryNeedleOf(a),
+    how: "commented"
+  }, b) === "near";
+  const claimCount = /* @__PURE__ */ new Map();
+  for (const f of o.facts) {
+    const k = `${f.kind}\0${canaryNeedleOf(f)}`;
+    claimCount.set(k, (claimCount.get(k) ?? 0) + 1);
+  }
+  const candidates = kept.filter((f) => claimCount.get(`${f.kind}\0${canaryNeedleOf(f)}`) === 1 && !hostLine(f) && taken.has(f.cite.file) && !canaryNeverCopied(f.cite.file) && commentFor(f.cite.file) !== void 0 && !o.facts.some((g) => near(f, g)) && removable(f, linesOf2(f.cite.file)[f.cite.line - 1]?.replace(/\r$/, "")));
+  const byKind = ["entry", "call", "config"].map((k) => seededShuffle(candidates.filter((f) => f.kind === k), `${o.seed}:remove:${k}`));
+  const order = seededShuffle(byKind.map((l, i) => ({ id: String(i), l })), `${o.seed}:remove`).map((x) => x.l);
+  const want = Math.max(0, Math.floor(o.removals ?? CANARY_DEFAULT_REMOVALS));
+  const chosen = [];
+  for (let round = 0; chosen.length < want && order.some((l) => l.length > round); round++)
+    for (const l of order) {
+      const f = l[round];
+      if (!f || chosen.length >= want)
+        continue;
+      if (chosen.some((c) => c.cite.file === f.cite.file && c.cite.line === f.cite.line))
+        continue;
+      chosen.push(f);
+    }
+  const changed = /* @__PURE__ */ new Set();
+  const removed = chosen.map((f) => {
+    const lines = linesOf2(f.cite.file);
+    const line = lines[f.cite.line - 1];
+    const indent = /^\s*/.exec(line)[0];
+    lines[f.cite.line - 1] = `${indent}${commentFor(f.cite.file)} ${line.slice(indent.length)}`;
+    changed.add(f.cite.file);
+    return {
+      id: `remove:${f.id}`,
+      fact: f.id,
+      kind: f.kind,
+      file: f.cite.file,
+      line: f.cite.line,
+      claim: `${f.kind} ${canaryClaimOf(f)}`,
+      value: f.cite.value,
+      needle: canaryNeedleOf(f),
+      how: "commented"
+    };
+  }).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  const used = new Set(o.facts.flatMap((f) => `${canaryClaimText(f)} ${foldCanary(f.cite.file)}`.split(/[\s-]+/)));
+  const words = seededShuffle(WORDS.filter((w) => !used.has(w)).map((id) => ({ id })), `${o.seed}:words`).map((w) => w.id);
+  const planted = [];
+  const skipped = [];
+  const writes = {};
+  stacks.forEach((h) => {
+    skipped.push(...h.skipped.map((x) => ({ stack: h.stack, ...x })));
+    if (!h.can.size)
+      return;
+    const w = words.splice(0, 10);
+    if (w.length < 10)
+      return;
+    const names = {
+      entry: [w[0], w[1]],
+      call: [w[2], w[3]],
+      topicIn: [w[4], w[5]],
+      topicOut: [w[6], w[7]],
+      config: [w[8], w[9]]
+    };
+    const said = claims(names, h.stack);
+    const p = h.stack === "spring" ? springPlanting(h, names, taken) : h.stack === "node" ? nodePlanting(h, names, taken) : pythonPlanting(h, names, taken);
+    const place = (path, lines, from) => lines.forEach((l, i) => {
+      if (typeof l === "string")
+        return;
+      planted.push({
+        id: "",
+        kind: KIND_OF[l.what],
+        what: l.what,
+        stack: h.stack,
+        file: path,
+        line: from + i + 1,
+        ...said[l.what]
+      });
+    });
+    for (const f of p.files) {
+      place(f.path, f.lines, 0);
+      writes[f.path] = f.lines.map((l) => typeof l === "string" ? l : l.text).join("\n");
+    }
+    if (p.append) {
+      const lines = linesOf2(p.append.path);
+      if (lines.length && lines[lines.length - 1] !== "")
+        lines.push("");
+      const eol = lines.some((l) => l.endsWith("\r")) ? "\r" : "";
+      const from = lines.length - 1;
+      lines.splice(from, 1, ...p.append.lines.map((l) => (typeof l === "string" ? l : l.text) + eol), "");
+      place(p.append.path, p.append.lines, from);
+      changed.add(p.append.path);
+    }
+  });
+  planted.forEach((p, i) => p.id = `plant:${i + 1}`);
+  for (const path of changed)
+    writes[path] = linesOf2(path).join("\n");
+  return {
+    stacks: stacks.filter((s) => planted.some((p) => p.stack === s.stack)).map((s) => s.stack),
+    planted,
+    removed,
+    skipped,
+    writes
+  };
+}
+function canaryClaimOf(f) {
+  const x = f;
+  if (f.kind === "entry" || f.kind === "call")
+    return [x.method?.toUpperCase(), x.path].filter(Boolean).join(" ") || f.cite.value;
+  if (f.kind === "config")
+    return x.key ?? f.cite.value;
+  return f.cite.value;
+}
+
 // packages/verify/dist/house-imports.js
 var CODE2 = /\.(java|kt|kts|scala|groovy|cs|vb|fs|ts|tsx|js|jsx|mjs|cjs|vue|svelte|py|go|rb|php|swift)$/i;
 var IMPORTS = [
@@ -7873,7 +9107,7 @@ function modulesOf(line, go) {
 }
 var lower = (s) => s.toLowerCase();
 var under3 = (module, pkg) => module === pkg || module.startsWith(pkg) && (/[./]$/.test(pkg) || /[./]/.test(module[pkg.length] ?? ""));
-function packageOf(module, prefix) {
+function packageOf2(module, prefix) {
   let i = prefix.length;
   while (i < module.length && /[./]/.test(module[i]))
     i++;
@@ -7887,16 +9121,16 @@ function nameOf2(pkg) {
     parts.shift();
   return parts.join("-") || "house-framework";
 }
-function houseImportsUntaught(source, o) {
+function houseImportsUntaught(source2, o) {
   if (!o.prefixes.length)
     return [];
   const rules = o.rules ?? DEFAULT_READ_RULES;
   const prefixes = o.prefixes.map(lower);
   const taught = o.taught.map(lower);
   const found = /* @__PURE__ */ new Map();
-  const paths = source.list().filter((p) => CODE2.test(p) && !rules.notRead.test(p) && !(o.exclude ?? []).some((re) => re.test(p)) && isSourceFile(p, "", void 0, rules)).sort();
+  const paths = source2.list().filter((p) => CODE2.test(p) && !rules.notRead.test(p) && !(o.exclude ?? []).some((re) => re.test(p)) && isSourceFile(p, "", void 0, rules)).sort();
   for (const p of paths) {
-    const text = source.read(p);
+    const text = source2.read(p);
     if (text === void 0)
       continue;
     const lines = text.split(/\r?\n/);
@@ -7911,7 +9145,7 @@ function houseImportsUntaught(source, o) {
           continue;
         if (taught.some((t) => under3(ml, t)))
           continue;
-        const pkg = packageOf(m, prefix);
+        const pkg = packageOf2(m, prefix);
         const f = found.get(pkg) ?? { files: /* @__PURE__ */ new Set(), first: `${p}:${i + 1}` };
         f.files.add(p);
         found.set(pkg, f);
@@ -7944,7 +9178,6 @@ export {
   frameworkGaps,
   frameworksToLearn,
   readRulesOf,
-  keyIsSecret,
   lineRangeOf,
   parseReviewed,
   readingRank,
@@ -7986,5 +9219,9 @@ export {
   rereadPlan,
   onlyFiles,
   repairFormSlips,
-  houseImportsUntaught
+  houseImportsUntaught,
+  canaryNeverCopied,
+  CANARY_SECRET_PREFIX,
+  canaryHoldsSecret,
+  planCanary
 };