project-athena 0.2.1 → 0.3.0

package/dist/chunk-SJOOXO34.js

@@ -0,0 +1,904 @@
+#!/usr/bin/env node
+import {
+  analyzeProject,
+  loadScanFromDir,
+  persistAnalysisCache
+} from "./chunk-PANVPNYF.js";
+import {
+  ATHENA_VERSION
+} from "./chunk-2R6PXY6Z.js";
+import {
+  LOCAL_CONFIG_FILE
+} from "./chunk-PVCIGUIT.js";
+import {
+  redact
+} from "./chunk-JCGDR4UV.js";
+import {
+  ADAPTERS,
+  applyChanges
+} from "./chunk-2RS6TA3D.js";
+import {
+  mergeDocument,
+  renderBlock
+} from "./chunk-673EPYYH.js";
+import {
+  KNOWLEDGE_DOCS
+} from "./chunk-FQEGEVLY.js";
+import {
+  STATE_SCHEMA_VERSION,
+  athenaDir,
+  backupCorruptedState,
+  buildFileIndex,
+  readState,
+  writeState
+} from "./chunk-2DY4PUR4.js";
+import {
+  exists,
+  readTextIfExists,
+  sha256,
+  writeFileAtomic
+} from "./chunk-IQQBAWSM.js";
+import {
+  ATHENA_DIR
+} from "./chunk-EUPETUWA.js";
+
+// src/core/knowledge/generate.ts
+import path from "path";
+
+// src/core/knowledge/md.ts
+function esc(s) {
+  return s.replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/[<>]/g, (c) => c === "<" ? "&lt;" : "&gt;").replace(/\r?\n/g, " ");
+}
+function code(s) {
+  const clean = s.replace(/\r?\n/g, " ");
+  const ticks = clean.includes("`") ? "``" : "`";
+  return `${ticks}${ticks.length === 2 ? " " : ""}${clean}${ticks.length === 2 ? " " : ""}${ticks}`;
+}
+function evidenceRef(e) {
+  return code(`${e.file}${e.line ? `:${e.line}` : ""}`);
+}
+function evidenceList(evidence, max = 3) {
+  if (!evidence.length) return "\u2014";
+  const shown = evidence.slice(0, max).map(evidenceRef).join(", ");
+  return evidence.length > max ? `${shown} +${evidence.length - max} more` : shown;
+}
+function status(p) {
+  return p.status === "UNKNOWN" ? "UNKNOWN" : `${p.status} \xB7 ${p.confidence}`;
+}
+function table(headers, rows) {
+  if (!rows.length) return "";
+  const head = `| ${headers.join(" | ")} |`;
+  const sep = `| ${headers.map(() => "---").join(" | ")} |`;
+  return [head, sep, ...rows.map((r) => `| ${r.join(" | ")} |`)].join("\n");
+}
+function unknown(what, hint) {
+  return `**${what}:** UNKNOWN${hint ? ` \u2014 ${hint}` : ""}`;
+}
+function notDetected(what) {
+  return `_No ${what} detected._ Status: **UNKNOWN** (absence of detection is not proof of absence).`;
+}
+function bullets(items) {
+  return items.map((i) => `- ${i}`).join("\n");
+}
+function truncatedNote(shown, total, what) {
+  return total > shown ? `
+
+_Showing ${shown} of ${total} ${what}. The full list is in \`.athena/model.json\`._` : "";
+}
+function mermaidLabel(s) {
+  return s.replace(/["`<>{}[\]()|#;]/g, " ").replace(/\s+/g, " ").trim().slice(0, 60) || "node";
+}
+function mermaidId(s) {
+  return `n_${s.replace(/[^A-Za-z0-9]/g, "_")}`.slice(0, 64);
+}
+var LEGEND = [
+  "**Status legend** \u2014 `FACT`: declared or developer-asserted \xB7 `DETECTED`: found by analysis, with evidence \xB7 `INFERRED`: heuristic, verify before relying on it \xB7 `UNKNOWN`: could not be determined."
+].join("\n");
+
+// src/core/knowledge/renderers/project.ts
+function renderProject(m) {
+  const sections = [];
+  const purpose = m.description ? `${esc(m.description)}
+
+_Source: package manifest description (FACT)._` : `${unknown("Project purpose", "no description found in manifests. Describe the project in Developer Notes below.")}`;
+  sections.push({ id: "overview", content: `## Overview
+
+**Name:** ${esc(m.name)}
+
+${purpose}` });
+  const totalBytes = m.languages.reduce((n, l) => n + l.bytes, 0) || 1;
+  const share = (bytes) => {
+    const pct = bytes / totalBytes * 100;
+    return pct < 5 ? "<5%" : `~${Math.round(pct / 5) * 5}%`;
+  };
+  const langRows = m.languages.slice(0, 12).map((l) => [esc(l.name), share(l.bytes)]);
+  sections.push({
+    id: "technologies",
+    content: [
+      "## Technologies",
+      "",
+      "### Languages",
+      "",
+      langRows.length ? table(["Language", "Share of source"], langRows) : notDetected("source languages"),
+      "",
+      "### Frameworks & Libraries",
+      "",
+      m.frameworks.length ? table(["Name", "Category", "Location", "Status", "Evidence"], m.frameworks.map((f) => [esc(f.name), f.category, code(f.root), status(f.provenance), evidenceList(f.provenance.evidence, 2)])) : notDetected("known frameworks"),
+      "",
+      "### Package Managers & Build Tools",
+      "",
+      m.packageManagers.length || m.buildSystems.length ? bullets([...m.packageManagers.map((p) => `Package manager: **${esc(p.name)}** \u2014 ${status(p.provenance)} (${evidenceList(p.provenance.evidence, 2)})`), ...m.buildSystems.map((b) => `Build tool: **${esc(b.name)}** \u2014 ${status(b.provenance)} (${evidenceList(b.provenance.evidence, 2)})`)]) : notDetected("package managers or build tools")
+    ].join("\n")
+  });
+  const ws = m.workspace;
+  const structure = ["## Structure", ""];
+  structure.push(`**Top-level directories:** ${m.topLevelDirs.length ? m.topLevelDirs.map(code).join(", ") : "_none_"}`);
+  if (ws.isMonorepo) {
+    structure.push("", `**Monorepo:** yes${ws.tool ? ` (${esc(ws.tool)})` : ""} \u2014 DETECTED`, "");
+    structure.push(table(["Package", "Path", "Kind", "Ecosystem", "Internal deps"], ws.packages.map((p) => [esc(p.name), code(p.path), p.kind, p.ecosystem, p.internalDependencies.map(esc).join(", ") || "\u2014"])));
+  } else {
+    structure.push("", "**Monorepo:** no workspace configuration detected.");
+  }
+  sections.push({ id: "structure", content: structure.join("\n") });
+  sections.push({
+    id: "entry-points",
+    content: ["## Entry Points", "", m.entryPoints.length ? table(["Path", "Status", "Evidence"], m.entryPoints.map((e) => [code(e.path), status(e.provenance), esc(e.provenance.evidence[0]?.detail ?? evidenceList(e.provenance.evidence))])) : notDetected("entry points")].join("\n")
+  });
+  const cmds = m.commands.slice(0, 40);
+  sections.push({
+    id: "commands",
+    content: ["## Commands", "", cmds.length ? table(["Name", "Command", "Purpose", "Defined in"], cmds.map((c) => [code(c.name), code(c.command.length > 100 ? `${c.command.slice(0, 97)}...` : c.command), c.purpose, code(c.source)])) + truncatedNote(cmds.length, m.commands.length, "commands") : notDetected("scripted commands (package scripts, Makefile, justfile)")].join("\n")
+  });
+  const env = ["## Environment Requirements", ""];
+  const runtimes = m.manifests.map((x) => x.ecosystem).filter((v, i, a) => a.indexOf(v) === i);
+  env.push(`**Ecosystems:** ${runtimes.length ? runtimes.join(", ") : "UNKNOWN"}`);
+  env.push("", `**Environment variables referenced:** ${m.env.vars.length} (names only \u2014 see \`deployment.md\`)`);
+  if (m.env.envFilesPresent.length) env.push("", `**Local env files present (contents never read):** ${m.env.envFilesPresent.map(code).join(", ")}`);
+  env.push("", unknown("Required runtime versions", "not inferred; check manifests/tool-version files"));
+  sections.push({ id: "environment", content: env.join("\n") });
+  const devCmds = m.commands.filter((c) => ["dev", "build", "test", "lint", "start"].includes(c.purpose)).slice(0, 8);
+  sections.push({
+    id: "workflow",
+    content: ["## Development Workflow", "", devCmds.length ? `Detected workflow commands:
+
+${bullets(devCmds.map((c) => `${c.purpose}: ${code(c.command)} (${code(c.source)})`))}` : unknown("Development workflow", "no dev/build/test commands detected"), "", "_Branching strategy, review process and release process are not detectable from code \u2014 document them in Developer Notes._"].join("\n")
+  });
+  if (m.warnings.length) {
+    sections.push({ id: "analysis-warnings", content: ["## Analysis Warnings", "", bullets(m.warnings.slice(0, 20).map(esc))].join("\n") });
+  } else {
+    sections.push({ id: "analysis-warnings", content: "## Analysis Warnings\n\nNone." });
+  }
+  return sections;
+}
+
+// src/core/knowledge/renderers/architecture.ts
+function renderArchitecture(m) {
+  const s = [];
+  const fe = m.frameworks.filter((f) => ["frontend", "fullstack", "mobile", "desktop"].includes(f.category));
+  const be = m.frameworks.filter((f) => ["backend", "fullstack"].includes(f.category));
+  const summary = ["## System Overview", ""];
+  const layers = [];
+  if (fe.length) layers.push(`Client/UI layer: ${[...new Set(fe.map((f) => f.name))].map(esc).join(", ")} \u2014 DETECTED`);
+  if (be.length) layers.push(`Server/API layer: ${[...new Set(be.map((f) => f.name))].map(esc).join(", ")} \u2014 DETECTED`);
+  if (m.databases.length) layers.push(`Data layer: ${m.databases.map((d) => esc(d.name)).join(", ")} \u2014 DETECTED`);
+  if (m.caching.length) layers.push(`Caching: ${m.caching.map((d) => esc(d.name)).join(", ")} \u2014 DETECTED`);
+  if (m.queues.length) layers.push(`Async/queues: ${m.queues.map((d) => esc(d.name)).join(", ")} \u2014 DETECTED`);
+  summary.push(layers.length ? bullets(layers) : unknown("Architecture layers", "no known frameworks or data stores detected"));
+  summary.push("", "_Layer membership is based on declared dependencies. How components interact at runtime is not verified by static analysis._");
+  s.push({ id: "overview", content: summary.join("\n") });
+  const ws = m.workspace;
+  if (ws.isMonorepo && ws.packages.length > 1) {
+    const edges = ws.packages.flatMap((p) => p.internalDependencies.map((d) => [p.name, d]));
+    const lines = ["```mermaid", "graph LR"];
+    for (const p of ws.packages) if (p.path !== ".") lines.push(`  ${mermaidId(p.name)}["${mermaidLabel(`${p.name} (${p.kind})`)}"]`);
+    for (const [from, to] of edges) lines.push(`  ${mermaidId(from)} --> ${mermaidId(to)}`);
+    lines.push("```");
+    s.push({
+      id: "modules",
+      content: ["## Workspace Modules & Dependencies", "", `Edges are declared internal dependencies between workspace packages (DETECTED from manifests).`, "", lines.join("\n"), "", edges.length ? "" : "_No internal dependencies declared between packages._"].join("\n").trim()
+    });
+  } else {
+    const dirs = m.topLevelDirs.filter((d) => !d.startsWith("."));
+    s.push({ id: "modules", content: ["## Modules", "", dirs.length ? `Top-level directories: ${dirs.map(code).join(", ")}` : "_Flat project structure._", "", unknown("Module boundaries and responsibilities", "describe them in Developer Notes")].join("\n") });
+  }
+  if (m.containers.services.length) {
+    const lines = ["```mermaid", "graph TD"];
+    for (const svc of m.containers.services) lines.push(`  ${mermaidId(svc.name)}["${mermaidLabel(`${svc.name}${svc.image ? ` \xB7 ${svc.image}` : ""}`)}"]`);
+    for (const svc of m.containers.services) for (const dep of svc.dependsOn) lines.push(`  ${mermaidId(svc.name)} --> ${mermaidId(dep)}`);
+    lines.push("```");
+    s.push({
+      id: "services",
+      content: ["## Service Topology (containers)", "", "From compose files. Arrows are `depends_on` relationships (DETECTED).", "", lines.join("\n"), "", table(["Service", "Image", "Ports", "Depends on", "File"], m.containers.services.map((c) => [esc(c.name), esc(c.image ?? "\u2014"), c.ports.map(esc).join(", ") || "\u2014", c.dependsOn.map(esc).join(", ") || "\u2014", code(c.file)]))].join("\n")
+    });
+  } else {
+    s.push({ id: "services", content: "## Service Topology\n\n_No container orchestration (compose) detected._ Runtime service topology: **UNKNOWN**." });
+  }
+  const flow = ["## Data Flow", ""];
+  if (fe.length && be.length && m.databases.length) {
+    flow.push("```mermaid", "graph LR", '  client["Client / UI"] --> api["API / Server"]', '  api --> data["Data store"]', "```", "", "_INFERRED from the presence of UI, server and data-layer dependencies. Actual request paths are not verified._");
+  } else if (be.length && m.databases.length) {
+    flow.push("```mermaid", "graph LR", '  caller["Caller"] --> api["API / Server"]', '  api --> data["Data store"]', "```", "", "_INFERRED from server and data-layer dependencies._");
+  } else {
+    flow.push(unknown("Data flow", "insufficient evidence to infer a request/data path"));
+  }
+  s.push({ id: "data-flow", content: flow.join("\n") });
+  const external = [...m.auth.filter((a) => a.kind === "provider"), ...m.observability, ...m.infrastructure.filter((i) => i.kind === "hosting")];
+  s.push({
+    id: "external-services",
+    content: ["## External Services", "", external.length ? table(["Service", "Status", "Evidence"], external.map((e) => [esc(e.name), status(e.provenance), evidenceList(e.provenance.evidence, 2)])) : notDetected("external service integrations"), "", "_Only services identifiable from dependencies/config are listed. Third-party APIs called over plain HTTP are not detected in this version._"].join("\n")
+  });
+  s.push({ id: "decisions", content: "## Architectural Decisions\n\n_Athena does not infer architectural decisions. Record them in Developer Notes (or link ADRs) so agents can respect them._" });
+  return s;
+}
+
+// src/core/knowledge/renderers/data.ts
+var MAX_ENTITIES = 60;
+var MAX_ROUTES = 200;
+function renderDatabase(m) {
+  const s = [];
+  s.push({
+    id: "technology",
+    content: ["## Database Technology", "", m.databases.length ? table(["Technology", "Kind", "Status", "Evidence"], m.databases.map((d) => [esc(d.name), d.kind, status(d.provenance), evidenceList(d.provenance.evidence, 2)])) : notDetected("database engines, ORMs or drivers")].join("\n")
+  });
+  const ents = m.dbEntities.slice(0, MAX_ENTITIES);
+  const entityDocs = ents.map((e) => {
+    const fields = e.fields.slice(0, 40).map((f) => `${code(f.name)}${f.type ? ` ${esc(f.type)}` : ""}${f.attributes.length ? ` \u2014 ${f.attributes.map(esc).join(" ")}` : ""}`);
+    const parts = [`### ${esc(e.name)} (${e.kind})`, "", `Defined in ${evidenceList(e.provenance.evidence, 1)} \xB7 ${status(e.provenance)}`];
+    if (fields.length) parts.push("", bullets(fields));
+    if (e.relations.length) parts.push("", `**Relations:** ${e.relations.map(esc).join("; ")}`);
+    if (e.indexes.length) parts.push("", `**Indexes/constraints:** ${e.indexes.map((i) => code(i)).join(", ")}`);
+    return parts.join("\n");
+  });
+  s.push({
+    id: "schema",
+    content: ["## Schema & Entities", "", entityDocs.length ? entityDocs.join("\n\n") + truncatedNote(ents.length, m.dbEntities.length, "entities") : notDetected("schema definitions (Prisma, SQL DDL, Django/SQLAlchemy models, Mongoose models)")].join("\n")
+  });
+  s.push({
+    id: "migrations",
+    content: ["## Migrations", "", m.migrations.length ? table(["Location", "Tool", "Files"], m.migrations.map((x) => [code(x.path), esc(x.tool), String(x.count)])) : notDetected("migration directories"), "", m.commands.filter((c) => c.purpose === "migrate").length ? `Migration commands: ${m.commands.filter((c) => c.purpose === "migrate").map((c) => code(c.command)).join(", ")}` : ""].join("\n").trim()
+  });
+  const tenantCols = m.dbEntities.filter((e) => e.fields.some((f) => /^(tenant|organization|org|workspace|account)_?id$/i.test(f.name)));
+  const iso = ["## Data Ownership & Tenant Isolation", ""];
+  if (tenantCols.length) {
+    iso.push(`Entities with tenant/organization-style key columns (DETECTED column names): ${tenantCols.map((e) => code(e.name)).join(", ")}`, "", unknown("Whether tenant isolation is enforced for all queries", "column presence does not prove enforcement"));
+  } else {
+    iso.push(unknown("Tenancy model", "no tenant/organization key columns detected"));
+  }
+  s.push({ id: "ownership", content: iso.join("\n") });
+  s.push({ id: "constraints", content: "## Important Constraints\n\n_Business-level data constraints are not inferred. Record them in Developer Notes or `rules.md`._" });
+  return s;
+}
+function renderApi(m) {
+  const s = [];
+  const be = m.frameworks.filter((f) => ["backend", "fullstack"].includes(f.category));
+  const styles = [];
+  if (m.routes.length) styles.push(`HTTP routes (${m.routes.length} detected)`);
+  if (m.apiSpecs.some((x) => x.kind === "graphql") || m.frameworks.some((f) => /GraphQL|Apollo/.test(f.name))) styles.push("GraphQL");
+  if (m.apiSpecs.some((x) => x.kind === "grpc") || m.frameworks.some((f) => /gRPC|tonic/.test(f.name))) styles.push("gRPC / Protocol Buffers");
+  if (m.frameworks.some((f) => f.name === "tRPC")) styles.push("tRPC");
+  s.push({
+    id: "architecture",
+    content: ["## API Architecture", "", be.length ? `**Server frameworks:** ${[...new Set(be.map((f) => f.name))].map(esc).join(", ")} (DETECTED)` : unknown("Server framework", "no known backend framework detected"), "", styles.length ? `**API styles:** ${styles.join(", ")}` : unknown("API style")].join("\n")
+  });
+  const routes = m.routes.slice(0, MAX_ROUTES);
+  s.push({
+    id: "endpoints",
+    content: [
+      "## Endpoints",
+      "",
+      routes.length ? `Paths are as written in code. Router prefixes applied elsewhere (mounting, include_router, blueprints) may not be reflected.
+
+${table(["Method", "Path", "Framework", "Location", "Status"], routes.map((r) => [r.method, code(r.path), esc(r.framework), code(`${r.file}${r.line ? `:${r.line}` : ""}`), status(r.provenance)]))}${truncatedNote(routes.length, m.routes.length, "routes")}` : notDetected("HTTP routes")
+    ].join("\n")
+  });
+  s.push({
+    id: "specs",
+    content: ["## API Specifications", "", m.apiSpecs.length ? bullets(m.apiSpecs.slice(0, 30).map((x) => `${x.kind}: ${code(x.path)}`)) : notDetected("OpenAPI, GraphQL or protobuf specifications")].join("\n")
+  });
+  s.push({
+    id: "auth-requirements",
+    content: ["## Authentication & Authorization Requirements", "", unknown("Per-endpoint auth requirements", "static route detection does not determine which middleware/guards apply to each route"), "", "See `auth.md` for detected auth mechanisms."].join("\n")
+  });
+  s.push({
+    id: "errors",
+    content: ["## Request/Response & Error Handling", "", unknown("Request/response schemas", "not extracted in this version"), "", unknown("Error response format", "document the convention in Developer Notes or rules.md")].join("\n")
+  });
+  return s;
+}
+function renderAuth(m) {
+  const s = [];
+  const by = (k) => m.auth.filter((a) => a.kind === k);
+  const row = (a) => [esc(a.name), status(a.provenance), evidenceList(a.provenance.evidence, 3)];
+  s.push({
+    id: "mechanism",
+    content: [
+      "## Authentication Mechanism",
+      "",
+      [...by("library"), ...by("provider")].length ? table(["Library / Provider", "Status", "Evidence"], [...by("library"), ...by("provider")].map(row)) : notDetected("authentication libraries or identity providers"),
+      "",
+      "_A declared auth dependency shows the capability is available, not that every route is protected._"
+    ].join("\n")
+  });
+  s.push({
+    id: "tokens-sessions",
+    content: ["## Sessions & Tokens", "", by("token").length ? table(["Library", "Status", "Evidence"], by("token").map(row)) : notDetected("token (JWT/JWE) libraries"), "", unknown("Session storage, token lifetime and refresh-token strategy", "not determinable from dependencies alone")].join("\n")
+  });
+  const rbac = m.auth.filter((a) => a.kind === "middleware");
+  s.push({
+    id: "authorization",
+    content: ["## Authorization, Roles & Permissions", "", rbac.length ? table(["Signal", "Status", "Evidence"], rbac.map(row)) : notDetected("role/permission definitions or auth middleware"), "", unknown("Authorization model (RBAC/ABAC/ownership checks)", "confirm and document in Developer Notes")].join("\n")
+  });
+  s.push({
+    id: "passwords-mfa",
+    content: ["## Password Handling, OAuth & MFA", "", by("hashing").length ? `**Password hashing libraries:** ${by("hashing").map((h) => `${esc(h.name)} (${evidenceList(h.provenance.evidence, 1)})`).join(", ")} \u2014 DETECTED` : unknown("Password hashing", "no known hashing library detected (may be delegated to a provider)"), "", unknown("OAuth providers & MFA", "not detected in this version")].join("\n")
+  });
+  s.push({
+    id: "assumptions",
+    content: ["## Security Assumptions", "", '_No auth security assumptions are inferred automatically._ Document assumptions (e.g. "all /admin routes require the admin role") in Developer Notes so agents can check changes against them.', "", "> Athena never stores passwords, API keys, tokens or private keys in this file."].join("\n")
+  });
+  return s;
+}
+
+// src/core/knowledge/renderers/security.ts
+function renderSecurity(m, extras = {}) {
+  const s = [];
+  s.push({
+    id: "classification",
+    content: [
+      "## How to Read This Document",
+      "",
+      bullets([
+        "**Detected** \u2014 observed directly in code/config by Athena, with evidence.",
+        "**Verified** \u2014 reported by a dedicated security tool (dependency audits below), or confirmed by a human.",
+        "**Potential** \u2014 pattern that may indicate a problem; requires human review.",
+        "**Unknown** \u2014 not determinable by static analysis."
+      ]),
+      "",
+      "_This document improves security awareness. It is not a security audit and does not certify the absence of vulnerabilities._"
+    ].join("\n")
+  });
+  const surface = [];
+  if (m.routes.length) surface.push(`**Detected:** ${m.routes.length} HTTP route definitions (see \`api.md\`).`);
+  if (m.apiSpecs.length) surface.push(`**Detected:** ${m.apiSpecs.length} API specification files.`);
+  const exposed = m.containers.services.filter((c) => c.ports.length);
+  if (exposed.length) surface.push(`**Detected:** compose services publishing ports: ${exposed.map((c) => `${esc(c.name)} (${c.ports.map(esc).join(", ")})`).join("; ")}.`);
+  const exposedDocker = m.containers.dockerfiles.filter((d) => d.exposedPorts.length);
+  if (exposedDocker.length) surface.push(`**Detected:** Dockerfile EXPOSE: ${exposedDocker.map((d) => `${code(d.path)} \u2192 ${d.exposedPorts.map(esc).join(", ")}`).join("; ")}.`);
+  if (m.frameworks.some((f) => ["frontend", "fullstack", "mobile"].includes(f.category))) surface.push("**Detected:** client-side code exists \u2014 anything bundled into the client is public.");
+  if (m.queues.length) surface.push(`**Detected:** message/queue consumers may process untrusted payloads (${m.queues.map((q) => esc(q.name)).join(", ")}).`);
+  s.push({ id: "attack-surface", content: ["## Attack Surface", "", surface.length ? bullets(surface) : unknown("Attack surface", "no routes, exposed ports or client code detected")].join("\n") });
+  s.push({
+    id: "controls",
+    content: ["## Security Controls (declared)", "", m.security.controls.length ? table(["Control", "Evidence"], m.security.controls.map((c) => [esc(c.name), evidenceList(c.provenance.evidence, 2)])) : notDetected("security middleware or validation libraries"), "", "_Detected as dependencies. Whether they are applied to every relevant code path is **Unknown**._"].join("\n")
+  });
+  const secretRows = m.security.secrets.slice(0, 100).map((f) => [esc(f.type), code(`${f.file}:${f.line}`)]);
+  const secretBody = ["## Secret Management", ""];
+  if (m.security.secrets.length) {
+    secretBody.push(`**Potential:** ${m.security.secrets.length} possible hardcoded secret(s). Values are never recorded. Review each and rotate any real credential.`, "", table(["Type", "Location"], secretRows));
+  } else {
+    secretBody.push("No likely secrets matched Athena's patterns in scanned files. This is **not** proof that no secrets exist (gitignored and oversized files are not scanned).");
+  }
+  if (m.env.envFilesPresent.length) secretBody.push("", `Local env files present: ${m.env.envFilesPresent.map(code).join(", ")}. Athena does not read their contents. Ensure they are gitignored.`);
+  const secretVars = m.env.vars.filter((v) => v.secretLike);
+  if (secretVars.length) secretBody.push("", `Secret-like environment variable names (values configured externally): ${secretVars.slice(0, 30).map((v) => code(v.name)).join(", ")}`);
+  s.push({ id: "secrets", content: secretBody.join("\n") });
+  const risks = [];
+  const hasBackend = m.frameworks.some((f) => ["backend", "fullstack"].includes(f.category));
+  const names = /* @__PURE__ */ new Set([...m.security.controls.map((c) => c.name)]);
+  if (hasBackend && m.routes.length && !m.auth.some((a) => a.kind !== "hashing")) risks.push("**Potential:** routes detected but no authentication library/provider detected. Auth may be custom, external (gateway) or absent \u2014 verify.");
+  if (hasBackend && ![...names].some((n) => /zod|joi|yup|validator|pydantic|validation/i.test(n))) risks.push("**Unknown:** input validation approach \u2014 no schema-validation library detected.");
+  if (m.frameworks.some((f) => ["Express", "Fastify", "Koa", "Hono"].includes(f.name)) && ![...names].some((n) => /helmet/i.test(n))) risks.push("**Potential:** no security-headers middleware (e.g. helmet) detected for the Node HTTP server.");
+  if (hasBackend && ![...names].some((n) => /cors/i.test(n))) risks.push("**Unknown:** CORS policy \u2014 no CORS library detected (may be configured in framework/gateway).");
+  if (m.frameworks.some((f) => ["Express", "Fastify", "Koa"].includes(f.name)) && ![...names].some((n) => /rate-limit/i.test(n))) risks.push("**Unknown:** rate limiting \u2014 no rate-limit middleware detected.");
+  if (m.databases.some((d) => d.kind === "driver") && !m.databases.some((d) => d.kind === "orm")) risks.push("**Potential:** raw database driver without an ORM detected \u2014 review queries for injection (use parameterized queries).");
+  if (m.auth.some((a) => /csurf/.test(a.name)) || names.has("csurf (deprecated)")) risks.push("**Detected:** `csurf` is deprecated; consider a maintained CSRF library.");
+  risks.push("**Unknown:** CSRF protection for cookie-based sessions, SSRF protections for server-side fetches, and output encoding \u2014 not analyzed in this version.");
+  s.push({ id: "risks", content: ["## Risk Areas", "", bullets(risks)].join("\n") });
+  s.push({
+    id: "tooling",
+    content: ["## Security Tooling", "", m.security.tooling.length ? table(["Tool", "Evidence"], dedupe(m.security.tooling).map((t) => [esc(t.name), evidenceList(t.provenance.evidence, 2)])) : notDetected("security tooling (dependency scanning, SAST, secret scanning)")].join("\n")
+  });
+  s.push({ id: "dependencies", content: renderDependencyRisks(m, extras.securityScan ?? null) });
+  s.push({ id: "known-issues", content: "## Known Unresolved Security Issues\n\n_None recorded by Athena._ Track confirmed issues in Developer Notes (without exploit details or secrets)." });
+  return s;
+}
+function renderDependencyRisks(m, scan) {
+  const head = ["## Dependency Risks", ""];
+  const manifests = `Manifests in scope: ${m.manifests.length ? m.manifests.map((x) => code(x.path)).slice(0, 15).join(", ") : "_none_"}`;
+  if (!scan) {
+    return [...head, "No dependency audit has been run. Run `athena security` to audit dependencies with the tools installed for this project.", "", manifests].join("\n");
+  }
+  const lines = [...head, `Last scan: ${scan.scannedAt} (${(scan.durationMs / 1e3).toFixed(1)}s). Findings come from the tools below, not from Athena.`, ""];
+  const ran = scan.tools.filter((t) => t.status === "ok");
+  const missing = scan.tools.filter((t) => t.status !== "ok");
+  const findings = ran.flatMap((t) => t.findings.map((f) => ({ ...f, tool: t.tool, target: t.target })));
+  if (findings.length) {
+    const rows = findings.slice(0, 60).map((f) => [esc(f.package), f.severity.toUpperCase(), esc(f.title.slice(0, 90)), esc(f.id ?? "\u2014"), esc(f.target ? `${f.tool} (${f.target})` : f.tool), f.fixAvailable ? "yes" : "unknown"]);
+    lines.push(`**Detected by tooling:** ${findings.length} vulnerable dependenc${findings.length === 1 ? "y" : "ies"}.`, "", table(["Package", "Severity", "Advisory", "ID", "Tool", "Fix available"], rows));
+    if (findings.length > 60) lines.push("", `_Showing 60 of ${findings.length}. See \`.athena/security-scan.json\`._`);
+    if (findings.some((f) => f.severity === "unrated")) lines.push("", "_UNRATED: the tool reports the vulnerability without a severity (pip-audit, govulncheck). Treat it as unreviewed, not as low._");
+  } else if (ran.length) {
+    lines.push(`**Detected:** no known vulnerable dependencies reported by ${ran.map((t) => esc(t.tool)).join(", ")} at the time of the scan.`);
+  }
+  if (missing.length) {
+    lines.push("", "**Unknown** \u2014 these ecosystems were not audited:", "", bullets(missing.map((t) => `${esc(t.tool)} (${esc(t.target ?? t.ecosystem)}): ${esc(t.message ?? t.status)}`)));
+  }
+  lines.push("", manifests, "", "_Athena does not maintain its own vulnerability database, and a clean audit is not proof that dependencies are safe._");
+  return lines.join("\n");
+}
+function dedupe(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((i) => seen.has(i.name) ? false : (seen.add(i.name), true));
+}
+
+// src/core/knowledge/renderers/quality.ts
+function renderTesting(m) {
+  const t = m.tests;
+  const s = [];
+  s.push({
+    id: "frameworks",
+    content: ["## Test Frameworks", "", t.frameworks.length ? table(["Framework", "Evidence"], t.frameworks.map((f) => [esc(f.name), evidenceList(f.provenance.evidence, 3)])) : notDetected("test frameworks")].join("\n")
+  });
+  const kinds = [];
+  const names = t.frameworks.map((f) => f.name);
+  if (names.some((n) => /Playwright|Cypress|Detox|integration_test/.test(n))) kinds.push("End-to-end / UI tests: framework DETECTED");
+  if (names.some((n) => /Supertest|Testcontainers|pytest-django|Spring Boot Test/.test(n))) kinds.push("Integration tests: supporting library DETECTED");
+  if (names.some((n) => /Jest|Vitest|Mocha|pytest|go test|cargo test|JUnit|RSpec|PHPUnit|xUnit|NUnit|flutter_test|Minitest|Pest|testify/.test(n))) kinds.push("Unit tests: runner DETECTED");
+  s.push({
+    id: "layout",
+    content: [
+      "## Test Layout",
+      "",
+      `**Test files detected:** ${t.testFileCount}`,
+      "",
+      t.testDirs.length ? `**Test directories:** ${t.testDirs.map(code).join(", ")}` : "_No dedicated test directories detected._",
+      "",
+      kinds.length ? bullets(kinds) : unknown("Unit/integration/E2E split")
+    ].join("\n")
+  });
+  const cmds = m.commands.filter((c) => c.purpose === "test");
+  s.push({ id: "commands", content: ["## Test Commands", "", cmds.length ? table(["Name", "Command", "Defined in"], cmds.slice(0, 20).map((c) => [code(c.name), code(c.command), code(c.source)])) : notDetected("test commands")].join("\n") });
+  s.push({
+    id: "coverage",
+    content: ["## Coverage", "", t.coverageConfigs.length ? `Coverage configuration found in: ${[...new Set(t.coverageConfigs)].map(code).join(", ")}` : notDetected("coverage configuration"), "", unknown("Actual coverage percentage", "Athena does not run tests or read coverage reports in this version")].join("\n")
+  });
+  const gaps = [];
+  if (t.testFileCount === 0 && m.stats.filesScanned > 0) gaps.push("**Detected:** no test files found in the project.");
+  if (t.packagesWithoutTests.length) gaps.push(`**Detected:** workspace packages with source files but no test files: ${t.packagesWithoutTests.map(code).join(", ")}`);
+  if (m.routes.length && !names.some((n) => /Supertest|Playwright|Cypress|pytest|Spring Boot Test|Testcontainers/.test(n))) gaps.push("**Potential:** HTTP routes exist but no API/integration testing library was detected.");
+  s.push({ id: "gaps", content: ["## Missing Coverage (structural)", "", gaps.length ? bullets(gaps) : "_No structural gaps detected._ This does not measure test quality or coverage."].join("\n") });
+  s.push({ id: "critical-areas", content: "## Critical Test Areas\n\n_Not inferred. List business-critical flows (payments, auth, data deletion, migrations) in Developer Notes so agents prioritize tests for them._" });
+  return s;
+}
+function renderDebugging(m) {
+  const s = [];
+  s.push({ id: "known-bugs", content: "## Known Bugs\n\n_None recorded._ Add known bugs and their status in Developer Notes." });
+  const cmds = m.commands.filter((c) => ["dev", "start", "test", "lint"].includes(c.purpose)).slice(0, 15);
+  s.push({ id: "commands", content: ["## Debugging & Diagnostic Commands", "", cmds.length ? table(["Purpose", "Command", "Defined in"], cmds.map((c) => [c.purpose, code(c.command), code(c.source)])) : notDetected("runnable dev/test commands")].join("\n") });
+  s.push({
+    id: "logging",
+    content: ["## Logging & Observability", "", m.observability.length ? table(["Tool", "Evidence"], m.observability.map((o) => [esc(o.name), evidenceList(o.provenance.evidence, 2)])) : notDetected("logging/monitoring libraries"), "", unknown("Log locations and formats", "document where logs are written and how to access them")].join("\n")
+  });
+  const hot = m.git.hotspots;
+  s.push({
+    id: "hotspots",
+    content: ["## Change Hotspots", "", hot.length ? `Directories with the most file changes in the last 180 days (git history), most-changed first. **INFERRED** as areas more likely to contain regressions. Exact counts are omitted to keep this document stable; see \`model.json\`.
+
+${hot.slice(0, 8).map((h, i) => `${i + 1}. ${code(h.path)}`).join("\n")}` : "_Not available (no git history)._"].join("\n")
+  });
+  s.push({ id: "common-errors", content: "## Common Errors & Workarounds\n\n_None recorded._ When an agent or developer resolves a recurring error, record the symptom, cause and fix in Developer Notes." });
+  return s;
+}
+function renderPerformance(m) {
+  const s = [];
+  s.push({ id: "caching", content: ["## Caching", "", m.caching.length ? table(["Technology", "Evidence"], m.caching.map((c) => [esc(c.name), evidenceList(c.provenance.evidence, 2)])) : notDetected("caching libraries or cache services"), "", unknown("Cache strategy and invalidation rules")].join("\n") });
+  s.push({ id: "queues", content: ["## Background Jobs & Queues", "", m.queues.length ? table(["Technology", "Evidence"], m.queues.map((c) => [esc(c.name), evidenceList(c.provenance.evidence, 2)])) : notDetected("queue or background-job systems")].join("\n") });
+  const idx = m.dbEntities.filter((e) => e.indexes.length).length;
+  s.push({
+    id: "database",
+    content: ["## Database Performance", "", m.dbEntities.length ? `${m.dbEntities.length} entities detected; ${idx} with explicit indexes/constraints (see \`database.md\`).` : notDetected("database entities"), "", unknown("Query patterns, N+1 risks and slow queries", "requires runtime data or deeper analysis")].join("\n")
+  });
+  const fe = m.frameworks.filter((f) => ["frontend", "fullstack"].includes(f.category));
+  s.push({ id: "frontend", content: ["## Frontend Performance", "", fe.length ? `Frontend frameworks: ${[...new Set(fe.map((f) => f.name))].map(esc).join(", ")}.` : "_No frontend framework detected._", "", unknown("Bundle size, rendering strategy and Core Web Vitals")].join("\n") });
+  s.push({ id: "bottlenecks", content: "## Known Bottlenecks\n\n_None recorded._ Athena does not invent benchmarks. Record measured bottlenecks (with how they were measured) in Developer Notes." });
+  return s;
+}
+function renderCodeReview(m) {
+  const s = [];
+  const general = [
+    "Change is limited to the stated task; no unrelated files modified.",
+    "Follows every enabled rule in `rules.md`.",
+    "No secrets, credentials or tokens added to code, config, logs or tests.",
+    "New dependencies are justified and actively maintained.",
+    "Breaking changes (API, schema, config) are called out explicitly.",
+    "Athena knowledge synchronized (`athena sync`) if structure, routes, schema or infrastructure changed."
+  ];
+  s.push({ id: "general", content: ["## General Checklist", "", bullets(general.map((g) => `[ ] ${g}`))].join("\n") });
+  const arch = [];
+  if (m.workspace.isMonorepo) arch.push("Cross-package imports go through declared workspace dependencies (no deep relative imports into other packages).");
+  if (m.frameworks.some((f) => ["backend", "fullstack"].includes(f.category))) arch.push("Business logic is not added directly to route handlers/controllers when a service layer exists.");
+  arch.push("New modules follow the existing directory conventions (see `project.md` \u2192 Structure).");
+  s.push({ id: "architecture", content: ["## Architecture", "", bullets(arch.map((a) => `[ ] ${a}`))].join("\n") });
+  const sec = [];
+  if (m.routes.length) sec.push("New/changed endpoints enforce authentication and authorization as required.", "Request input is validated before use.");
+  if (m.databases.length) sec.push("Database access uses parameterized queries / ORM APIs \u2014 no string-built SQL with user input.");
+  if (m.frameworks.some((f) => ["frontend", "fullstack", "mobile"].includes(f.category))) sec.push("No server-only secrets or privileged keys exposed to client bundles.", "User-provided content is not rendered as raw HTML without sanitization.");
+  sec.push("Errors do not leak stack traces, secrets or internal identifiers to clients.");
+  s.push({ id: "security", content: ["## Security", "", bullets(sec.map((x) => `[ ] ${x}`))].join("\n") });
+  const testing = [m.tests.frameworks.length ? `New logic has tests using the project's framework(s): ${m.tests.frameworks.map((f) => esc(f.name)).join(", ")}.` : "Consider adding tests \u2014 no test framework was detected."];
+  const testCmd = m.commands.find((c) => c.purpose === "test");
+  if (testCmd) testing.push(`Tests pass: ${code(testCmd.command)}`);
+  const lintCmd = m.commands.find((c) => c.purpose === "lint");
+  if (lintCmd) testing.push(`Lint/type checks pass: ${code(lintCmd.command)}`);
+  s.push({ id: "testing", content: ["## Testing Expectations", "", bullets(testing.map((x) => `[ ] ${x}`))].join("\n") });
+  const perf = [];
+  if (m.databases.length) perf.push("New queries on large tables use indexes; no N+1 query patterns introduced.");
+  if (m.caching.length) perf.push("Cache invalidation is handled for changed data.");
+  if (m.queues.length) perf.push("Long-running work is offloaded to background jobs where appropriate.");
+  perf.push("No unbounded loops/fetches over user-controlled sizes.");
+  s.push({ id: "performance", content: ["## Performance", "", bullets(perf.map((x) => `[ ] ${x}`))].join("\n") });
+  s.push({ id: "common-mistakes", content: "## Common Mistakes in This Project\n\n_None recorded._ Add recurring review findings in Developer Notes." });
+  return s;
+}
+
+// src/core/knowledge/renderers/deployment.ts
+function renderDeployment(m) {
+  const s = [];
+  const hosting = m.infrastructure.filter((i) => i.kind === "hosting");
+  const iac = m.infrastructure.filter((i) => i.kind === "iac");
+  const k8s = m.infrastructure.filter((i) => i.kind === "kubernetes");
+  const proxy = m.infrastructure.filter((i) => i.kind === "reverse-proxy");
+  s.push({
+    id: "architecture",
+    content: [
+      "## Deployment Architecture",
+      "",
+      hosting.length ? `**Hosting/platform configuration:**
+
+${table(["Platform", "File"], hosting.map((h) => [esc(h.name), code(h.file)]))}` : unknown("Hosting platform", "no platform configuration files detected"),
+      "",
+      iac.length ? `**Infrastructure as code:** ${iac.map((i) => `${esc(i.name)} (${code(i.file)})`).join(", ")}` : "_No infrastructure-as-code detected._",
+      "",
+      k8s.length ? `**Kubernetes resources:** ${k8s.map((i) => `${esc(i.name)} (${code(i.file)})`).join(", ")}` : "",
+      proxy.length ? `**Reverse proxy:** ${proxy.map((i) => `${esc(i.name)} (${code(i.file)})`).join(", ")}` : ""
+    ].filter((l, i, a) => l !== "" || a[i - 1] !== "").join("\n").trim()
+  });
+  const df = m.containers.dockerfiles;
+  s.push({
+    id: "containers",
+    content: ["## Containers", "", df.length ? table(["Dockerfile", "Base images", "Exposed ports"], df.map((d) => [code(d.path), d.baseImages.map(esc).join(", ") || "\u2014", d.exposedPorts.map(esc).join(", ") || "\u2014"])) : notDetected("Dockerfiles"), "", m.containers.services.length ? `Compose services: ${m.containers.services.map((c) => code(c.name)).join(", ")} (see \`architecture.md\`).` : ""].join("\n").trim()
+  });
+  const jobs = m.ci.slice(0, 30);
+  s.push({
+    id: "ci-cd",
+    content: [
+      "## CI/CD",
+      "",
+      jobs.length ? table(["System", "Job", "Key steps", "File"], jobs.map((j) => [esc(j.system), esc(j.name), j.commands.slice(0, 4).map((c) => code(c)).join("<br>") || "\u2014", code(j.file)])) + truncatedNote(jobs.length, m.ci.length, "CI jobs") : notDetected("CI/CD pipelines")
+    ].join("\n")
+  });
+  s.push({ id: "environments", content: ["## Environments", "", unknown("Environment list (dev/staging/production), domains and promotion flow", "not determinable from code \u2014 document them in Developer Notes")].join("\n") });
+  const vars = m.env.vars.slice(0, 80);
+  s.push({
+    id: "env-vars",
+    content: [
+      "## Environment Variables",
+      "",
+      "Names only. **Values are never read or stored by Athena** \u2014 all values are `<configured externally>`.",
+      "",
+      vars.length ? table(["Variable", "Value", "Referenced in"], vars.map((v) => [code(v.name), v.secretLike ? "`<secret>`" : "`<configured externally>`", v.references.slice(0, 2).map(code).join(", ") + (v.references.length > 2 ? ` +${v.references.length - 2}` : "")])) + truncatedNote(vars.length, m.env.vars.length, "variables") : notDetected("environment variable references")
+    ].join("\n")
+  });
+  const deployCmds = m.commands.filter((c) => ["build", "deploy", "migrate", "start"].includes(c.purpose)).slice(0, 15);
+  s.push({
+    id: "commands",
+    content: ["## Build, Release & Migration Commands", "", deployCmds.length ? table(["Purpose", "Command", "Defined in"], deployCmds.map((c) => [c.purpose, code(c.command), code(c.source)])) : notDetected("build/deploy commands"), "", m.migrations.length ? `Migrations: ${m.migrations.map((x) => `${esc(x.tool)} in ${code(x.path)}`).join(", ")}. ${unknown("When migrations run during deploy")}` : ""].join("\n").trim()
+  });
+  s.push({ id: "notes", content: ["## Deployment Safety", "", bullets(["Never commit secrets; configure them in the hosting platform or a secret manager.", "Document rollback procedures in Developer Notes."]), "", `_Evidence for this document comes from ${m.infrastructure.length + m.ci.length + df.length} infrastructure/CI files (${evidenceList(m.infrastructure.flatMap((i) => i.provenance.evidence), 3)})._`].join("\n") });
+  return s;
+}
+
+// src/core/knowledge/rules-seed.ts
+function seedRules(m) {
+  const hasBackend = m.frameworks.some((f) => ["backend", "fullstack"].includes(f.category));
+  const hasFrontend = m.frameworks.some((f) => ["frontend", "fullstack", "mobile"].includes(f.category));
+  const hasDb = m.databases.length > 0;
+  const hasMigrations = m.migrations.length > 0;
+  const hasTests = m.tests.frameworks.length > 0;
+  const tenant = m.dbEntities.some((e) => e.fields.some((f) => /^(tenant|organization|org|workspace|account)_?id$/i.test(f.name)));
+  const out = [
+    "# Athena Project Rules",
+    "",
+    "<!--",
+    "This file is owned by you. Athena creates it once and never regenerates it.",
+    "AI agents configured by Athena are instructed to follow every enabled rule.",
+    "",
+    'Format: one rule per top-level bullet under a "## Section" heading.',
+    'Disable a rule without deleting it by writing "- [disabled] ...".',
+    "Rules marked [disabled] below are SUGGESTIONS based on the detected stack \u2014 enable the ones that apply.",
+    "-->",
+    "",
+    "## AI Agent Rules",
+    "",
+    "- Read the relevant Athena knowledge (see the relevance map in your agent instructions) before making significant changes.",
+    "- Do not modify files unrelated to the task.",
+    "- Do not introduce new dependencies without stating the justification.",
+    "- Explain breaking changes (API, schema, configuration) before implementing them.",
+    "- Never add secrets, credentials or tokens to code, config, tests or logs.",
+    "- Treat statements marked INFERRED or UNKNOWN in Athena knowledge as unverified.",
+    "",
+    "## Security",
+    "",
+    "- Validate all external input at trust boundaries."
+  ];
+  if (hasFrontend) out.push("- Never expose server-side secrets to frontend code or client bundles.");
+  if (hasDb) out.push("- Use parameterized queries or ORM query APIs; never build SQL from user input.");
+  out.push("", "## Architecture", "");
+  out.push(hasBackend ? "- [disabled] Keep business logic out of route handlers/controllers; use the service layer." : "- [disabled] Keep modules focused; do not create circular dependencies.");
+  if (m.workspace.isMonorepo) out.push("- [disabled] Packages may only import other workspace packages through declared dependencies.");
+  if (hasDb) {
+    out.push("", "## Database", "");
+    if (hasMigrations) out.push("- [disabled] All schema changes must go through migrations; never modify production schema manually.");
+    else out.push("- [disabled] Schema changes must be reviewed before applying them to shared environments.");
+    if (tenant) out.push("- [disabled] Every tenant-owned table must include the tenant key, and every query must filter by it.");
+  }
+  if (m.routes.length || hasBackend) {
+    out.push("", "## API", "");
+    out.push("- [disabled] Return consistent error responses across endpoints.");
+    out.push("- [disabled] New endpoints must declare their authentication and authorization requirements.");
+  }
+  out.push("", "## Testing", "");
+  out.push(hasTests ? "- [disabled] New business logic requires tests." : "- [disabled] Add a test framework before adding complex business logic.");
+  out.push("");
+  return out.join("\n");
+}
+
+// src/core/knowledge/generate.ts
+var RENDERERS = {
+  project: renderProject,
+  architecture: renderArchitecture,
+  database: renderDatabase,
+  api: renderApi,
+  auth: renderAuth,
+  security: renderSecurity,
+  testing: renderTesting,
+  debugging: renderDebugging,
+  performance: renderPerformance,
+  "code-review": renderCodeReview,
+  deployment: renderDeployment
+};
+var DEVELOPER_NOTES_HEADING = "## Developer Notes";
+function renderSections(id, model, extras = {}) {
+  const doc = KNOWLEDGE_DOCS.find((d) => d.id === id);
+  const about = {
+    id: "about",
+    content: [
+      `> **Purpose:** ${doc.purpose}`,
+      ">",
+      "> Generated by Athena from repository analysis. Content between `athena:generated` markers is refreshed by `athena analyze`; if you edit inside a marker, Athena keeps your edit and stops refreshing that section (use `--force` to regenerate). Everything outside the markers is yours.",
+      ">",
+      `> ${LEGEND}`
+    ].join("\n")
+  };
+  return [about, ...RENDERERS[id](model, extras)].map((s) => ({ id: s.id, content: redact(s.content) }));
+}
+function composeNewDocument(id, sections) {
+  const doc = KNOWLEDGE_DOCS.find((d) => d.id === id);
+  return [
+    `# ${doc.title}`,
+    "",
+    sections.map((s) => renderBlock(s)).join("\n\n"),
+    "",
+    DEVELOPER_NOTES_HEADING,
+    "",
+    "<!-- Knowledge Athena cannot detect: decisions, conventions, known issues, gotchas. Athena never modifies this section. -->",
+    ""
+  ].join("\n");
+}
+async function planKnowledge(athenaDir2, model, opts = {}) {
+  const plans = [];
+  const extras = { securityScan: await loadScanFromDir(athenaDir2) };
+  const ids = Object.keys(RENDERERS).filter((id) => !opts.only || opts.only.includes(id));
+  for (const id of ids) {
+    const doc = KNOWLEDGE_DOCS.find((d) => d.id === id);
+    const sections = renderSections(id, model, extras);
+    const before = await readTextIfExists(path.join(athenaDir2, doc.file));
+    if (before === null) {
+      plans.push({ id, file: doc.file, status: "created", before, after: composeNewDocument(id, sections), blocks: sections.map((s) => s.id), changedBlocks: sections.map((s) => s.id), preservedModified: [] });
+      continue;
+    }
+    const merged = mergeDocument(before, sections, { force: opts.force, previouslyKnown: opts.previousBlocks?.[id], insertBefore: DEVELOPER_NOTES_HEADING });
+    plans.push({
+      id,
+      file: doc.file,
+      status: merged.changed ? "updated" : "unchanged",
+      before,
+      after: merged.text,
+      blocks: sections.map((s) => s.id),
+      changedBlocks: [...merged.updated, ...merged.added],
+      preservedModified: merged.preservedModified
+    });
+  }
+  return plans;
+}
+async function writePlannedKnowledge(athenaDir2, plans) {
+  const reports = [];
+  for (const p of plans) {
+    if (p.status !== "unchanged") await writeFileAtomic(path.join(athenaDir2, p.file), p.after);
+    reports.push({ id: p.id, file: p.file, status: p.status, blocks: p.blocks, preservedModified: p.preservedModified, contentHash: sha256(p.after).slice(0, 16) });
+  }
+  return reports;
+}
+async function writeKnowledge(athenaDir2, model, opts = {}) {
+  return writePlannedKnowledge(athenaDir2, await planKnowledge(athenaDir2, model, opts));
+}
+async function ensureRules(athenaDir2, model) {
+  const file = path.join(athenaDir2, "rules.md");
+  const existing = await readTextIfExists(file);
+  if (existing !== null) return { id: "rules", file: "rules.md", status: "unchanged", blocks: [], preservedModified: [], contentHash: sha256(existing).slice(0, 16) };
+  const text = seedRules(model);
+  await writeFileAtomic(file, text);
+  return { id: "rules", file: "rules.md", status: "created", blocks: [], preservedModified: [], contentHash: sha256(text).slice(0, 16) };
+}
+
+// src/services/pipeline.ts
+import { promises as fs } from "fs";
+import path2 from "path";
+import crypto from "crypto";
+var ATHENA_GITIGNORE = [
+  "# Local analysis cache \u2014 safe to delete, regenerated by `athena analyze`.",
+  "# Commit the *.md knowledge files so your team and Git history share them.",
+  "state.json",
+  "model.json",
+  "graph.json",
+  "security-scan.json",
+  "ai-suggestions.md",
+  ".backup/",
+  ".server.json",
+  ".sync-ignore.json",
+  ".agent-events.jsonl",
+  ".agent-events.1.jsonl",
+  ".agent-events.rotate.lock",
+  "cache/",
+  "# Machine-local settings and secrets (never commit).",
+  "local.json",
+  ""
+].join("\n");
+var GITIGNORE_ENTRIES = ["state.json", "model.json", "graph.json", "security-scan.json", "ai-suggestions.md", ".backup/", ".server.json", ".sync-ignore.json", ".agent-events.jsonl", ".agent-events.1.jsonl", ".agent-events.rotate.lock", "cache/", "local.json"];
+async function ensureGitignoreEntries(file) {
+  const existing = await readTextIfExists(file);
+  if (existing === null) {
+    await writeFileAtomic(file, ATHENA_GITIGNORE);
+    return;
+  }
+  const lines = existing.split(/\r?\n/);
+  const missing = GITIGNORE_ENTRIES.filter((e) => !lines.includes(e));
+  if (!missing.length) return;
+  await writeFileAtomic(file, `${existing.replace(/\s*$/, "")}
+${missing.join("\n")}
+`);
+}
+async function indexWithIntegrations(root, files, written) {
+  const index = buildFileIndex(files);
+  for (const rel of written) {
+    try {
+      const abs = path2.join(root, rel);
+      const [st, buf] = await Promise.all([fs.stat(abs), fs.readFile(abs)]);
+      index[rel] = { h: sha256(buf), s: st.size, m: Math.floor(st.mtimeMs) };
+    } catch {
+    }
+  }
+  return index;
+}
+function composeState(input) {
+  const { prevState, analysis, docs } = input;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const documents = {};
+  for (const d of docs) {
+    const before = prevState?.documents[d.id];
+    documents[d.id] = {
+      file: d.file,
+      blocks: d.blocks,
+      lastGeneratedAt: now,
+      lastChangedAt: d.status === "unchanged" && before ? before.lastChangedAt : now,
+      contentHash: d.contentHash,
+      preservedModified: d.preservedModified
+    };
+  }
+  return {
+    schemaVersion: STATE_SCHEMA_VERSION,
+    athenaVersion: ATHENA_VERSION,
+    projectName: analysis.model.name,
+    createdAt: prevState?.createdAt ?? now,
+    analyzedAt: now,
+    analysisDurationMs: analysis.durationMs,
+    git: { isRepo: analysis.model.git.isRepo, head: analysis.model.git.head, branch: analysis.model.git.branch },
+    fileIndex: input.fileIndex,
+    documents,
+    detectors: analysis.detectorVersions,
+    agents: input.agents,
+    warnings: analysis.model.warnings
+  };
+}
+async function autoSelectAdapters(root) {
+  const selected = [];
+  for (const a of ADAPTERS) {
+    if (a.id === "agents-md" || (await a.detectPresence(root)).detectedInProject) selected.push(a);
+  }
+  return selected;
+}
+async function runPipeline(opts) {
+  const root = opts.root;
+  const finalDir = athenaDir(root);
+  const notes = [];
+  const prev = await readState(finalDir);
+  if (prev.kind === "corrupted" && !opts.dryRun) {
+    const backup = await backupCorruptedState(finalDir);
+    notes.push(`state.json was corrupted (${prev.reason}); ${backup ? `moved to ${path2.relative(root, backup)}` : "it will be replaced"} and rebuilt.`);
+  }
+  const prevState = prev.kind === "ok" ? prev.state : null;
+  const fresh = !await exists(finalDir);
+  const salt = fresh && !opts.dryRun ? crypto.randomBytes(32).toString("hex") : void 0;
+  opts.onStage?.("analyze");
+  const analysis = await analyzeProject(root, { signal: opts.signal, onStage: (s) => opts.onStage?.(s), fingerprintSalt: salt });
+  opts.signal?.throwIfAborted();
+  const adapters = opts.agents ?? (prevState ? ADAPTERS.filter((a) => prevState.agents[a.id]?.configured) : await autoSelectAdapters(root));
+  if (opts.dryRun) {
+    const agentChanges2 = [];
+    for (const adapter of adapters) agentChanges2.push({ adapter, changes: await adapter.plan({ root, projectName: analysis.model.name }) });
+    return { analysis, docs: [], agentChanges: agentChanges2, state: null, notes };
+  }
+  const workDir = fresh ? path2.join(root, `${ATHENA_DIR}.tmp-${crypto.randomBytes(4).toString("hex")}`) : finalDir;
+  let docs;
+  try {
+    opts.onStage?.("write");
+    await fs.mkdir(workDir, { recursive: true });
+    const previousBlocks = prevState ? Object.fromEntries(Object.entries(prevState.documents).map(([k, v]) => [k, v.blocks])) : void 0;
+    docs = await writeKnowledge(workDir, analysis.model, { force: opts.force, previousBlocks });
+    docs.push(await ensureRules(workDir, analysis.model));
+    await writeFileAtomic(path2.join(workDir, "model.json"), `${JSON.stringify(analysis.model, null, 2)}
+`);
+    await ensureGitignoreEntries(path2.join(workDir, ".gitignore"));
+    if (salt) await writeFileAtomic(path2.join(workDir, LOCAL_CONFIG_FILE), `${JSON.stringify({ salt }, null, 2)}
+`);
+    opts.signal?.throwIfAborted();
+    if (fresh) await fs.rename(workDir, finalDir);
+  } catch (err) {
+    if (fresh) await fs.rm(workDir, { recursive: true, force: true }).catch(() => {
+    });
+    throw err;
+  }
+  await persistAnalysisCache(analysis, finalDir);
+  opts.onStage?.("agents");
+  const agentChanges = [];
+  const agentsState = { ...prevState?.agents ?? {} };
+  for (const adapter of adapters) {
+    try {
+      const planned = await adapter.plan({ root, projectName: analysis.model.name });
+      await applyChanges(root, planned);
+      agentChanges.push({ adapter, changes: planned });
+      agentsState[adapter.id] = { configured: true, files: planned.map((p) => p.path), configuredAt: (/* @__PURE__ */ new Date()).toISOString() };
+    } catch (err) {
+      notes.push(`${adapter.displayName} integration not configured: ${err.message}`);
+    }
+  }
+  const state = composeState({
+    prevState,
+    analysis,
+    docs,
+    agents: agentsState,
+    fileIndex: await indexWithIntegrations(root, analysis.files, agentChanges.flatMap((a) => a.changes.map((c) => c.path)))
+  });
+  await writeState(finalDir, state);
+  return { analysis, docs, agentChanges, state, notes };
+}
+
+export {
+  planKnowledge,
+  writePlannedKnowledge,
+  ensureRules,
+  indexWithIntegrations,
+  composeState,
+  runPipeline
+};
+//# sourceMappingURL=chunk-SJOOXO34.js.map