@davmash/bygone 0.11.0 → 0.11.1

package/out/reviewDependencies.js

@@ -0,0 +1,669 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// packages/strand/src/input.js
+var require_input = __commonJS({
+  "packages/strand/src/input.js"(exports2, module2) {
+    "use strict";
+    var LIMITS = Object.freeze({ maxFiles: 50, maxFileBytes: 1048576, maxBytes: 4194304, maxRecords: 2e4, timeoutMs: 3e4, maxOutputBytes: 16777216 });
+    function inputProblem(before, after, limits) {
+      if (!before || !after || typeof before !== "object" || typeof after !== "object" || Array.isArray(before) || Array.isArray(after)) return "invalid-snapshot-map";
+      if ((/* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])).size > Math.min(limits.maxFiles, LIMITS.maxFiles)) return "file-budget";
+      let bytes = 0;
+      for (const files of [before, after]) for (const value of Object.values(files)) {
+        if (typeof value !== "string") return "invalid-snapshot-text";
+        const size = Buffer.byteLength(value);
+        bytes += size;
+        if (size > Math.min(limits.maxFileBytes, LIMITS.maxFileBytes)) return "file-byte-budget";
+      }
+      return bytes > Math.min(limits.maxBytes, LIMITS.maxBytes) ? "comparison-byte-budget" : null;
+    }
+    function boundedProcessOptions(options, timeoutKey, outputKey, defaultTimeout) {
+      const timeout = options[timeoutKey] === void 0 ? defaultTimeout : options[timeoutKey];
+      const maxBuffer = options[outputKey] === void 0 ? LIMITS.maxOutputBytes : options[outputKey];
+      if (![timeout, maxBuffer].every((value) => Number.isSafeInteger(value) && value > 0)) return null;
+      return { timeout: Math.min(timeout, defaultTimeout), maxBuffer: Math.min(maxBuffer, LIMITS.maxOutputBytes) };
+    }
+    module2.exports = { LIMITS, inputProblem, boundedProcessOptions };
+  }
+});
+
+// packages/strand/src/source-references.js
+var require_source_references = __commonJS({
+  "packages/strand/src/source-references.js"(exports2, module2) {
+    "use strict";
+    var { createHash } = require("node:crypto");
+    var { inputProblem, LIMITS } = require_input();
+    var digest = (text2) => createHash("sha256").update(text2, "utf8").digest("hex");
+    var key = (ref) => JSON.stringify([ref.revision, ref.path, ref.start, ref.end, ref.digest]);
+    function identifier(value) {
+      if (typeof value !== "string" || !value.trim() || value.length > 1e5) {
+        throw new TypeError("Expected bounded nonempty identifier");
+      }
+      return value;
+    }
+    function parseSourceRef4(value) {
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("Expected source reference");
+      const revision = identifier(value.revision), path = identifier(value.path);
+      if (path.startsWith("/") || /^[A-Za-z]:/.test(path) || path.includes("\\") || path.includes("\0") || path.split("/").some((part) => !part || part === "." || part === "..")) {
+        throw new TypeError("Invalid relative source path");
+      }
+      if (!Number.isSafeInteger(value.start) || !Number.isSafeInteger(value.end) || value.start < 0 || value.end <= value.start) {
+        throw new TypeError("Invalid UTF-16 range");
+      }
+      if (typeof value.digest !== "string" || !/^[a-f0-9]{64}$/.test(value.digest)) throw new TypeError("Expected SHA-256");
+      return { revision, path, start: value.start, end: value.end, digest: value.digest };
+    }
+    function checkSnapshot(snapshot) {
+      if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) throw new TypeError("Expected snapshot");
+      identifier(snapshot.revision);
+      const problem = inputProblem(snapshot.files, {}, LIMITS);
+      if (problem) throw new TypeError(problem);
+    }
+    function sourceAt(snapshot, path) {
+      return Object.prototype.hasOwnProperty.call(snapshot.files, path) ? snapshot.files[path] : void 0;
+    }
+    function pinSourceRef2(snapshot, path, start, end) {
+      checkSnapshot(snapshot);
+      const ref = parseSourceRef4({ revision: snapshot.revision, path, start, end, digest: "0".repeat(64) });
+      const text2 = sourceAt(snapshot, ref.path);
+      if (typeof text2 !== "string" || end > text2.length) throw new TypeError("Source is unavailable or range exceeds file");
+      return { ...ref, digest: digest(text2.slice(start, end)) };
+    }
+    function resolveChecked(ref, snapshot) {
+      if (snapshot.revision !== ref.revision) return { status: "broken", reason: "Revision unavailable in this comparison" };
+      const text2 = sourceAt(snapshot, ref.path);
+      if (typeof text2 !== "string" || ref.end > text2.length) return { status: "broken", reason: "Source path or range unavailable" };
+      const slice = text2.slice(ref.start, ref.end);
+      if (digest(slice) !== ref.digest) return { status: "broken", reason: "Source digest mismatch" };
+      return { status: "valid", text: slice };
+    }
+    function resolveSourceRef4(value, snapshot) {
+      const ref = parseSourceRef4(value);
+      checkSnapshot(snapshot);
+      return resolveChecked(ref, snapshot);
+    }
+    function boundedList(value) {
+      if (!Array.isArray(value) || value.length > LIMITS.maxRecords) throw new TypeError("Expected bounded reference array");
+      return value;
+    }
+    function relocateSourceRefs2(values, before, after, pairs) {
+      checkSnapshot(before);
+      checkSnapshot(after);
+      const problem = inputProblem(before.files, after.files, LIMITS);
+      if (problem) throw new TypeError(problem);
+      if (before.revision === after.revision) throw new TypeError("Relocation requires distinct snapshot revisions");
+      const refs = boundedList(values).map(parseSourceRef4);
+      const candidates = boundedList(pairs).map((pair) => {
+        if (!pair || typeof pair !== "object") throw new TypeError("Expected correspondence pair");
+        return { before: parseSourceRef4(pair.before), after: parseSourceRef4(pair.after) };
+      });
+      const destinations = /* @__PURE__ */ new Map(), usedAfter = /* @__PURE__ */ new Set();
+      for (const pair of candidates) {
+        const from = key(pair.before), to = key(pair.after);
+        if (destinations.has(from) || usedAfter.has(to)) throw new TypeError("Duplicate correspondence endpoint");
+        destinations.set(from, pair.after);
+        usedAfter.add(to);
+      }
+      for (const pair of candidates) {
+        if (resolveChecked(pair.before, before).status !== "valid" || resolveChecked(pair.after, after).status !== "valid") {
+          throw new TypeError("Invalid correspondence endpoint");
+        }
+      }
+      return refs.map((ref) => {
+        let destination;
+        if (resolveChecked(ref, before).status === "valid") {
+          destination = sourceAt(before, ref.path) === sourceAt(after, ref.path) ? { ...ref, revision: after.revision } : destinations.get(key(ref));
+        }
+        if (!destination) return { status: "unresolved", before: ref };
+        const status = ref.digest !== destination.digest ? "changed" : ref.path !== destination.path || ref.start !== destination.start ? "relocated" : "unchanged";
+        return { status, before: ref, after: { ...destination } };
+      });
+    }
+    module2.exports = { parseSourceRef: parseSourceRef4, pinSourceRef: pinSourceRef2, resolveSourceRef: resolveSourceRef4, relocateSourceRefs: relocateSourceRefs2 };
+  }
+});
+
+// packages/strand/source-references.js
+var require_source_references2 = __commonJS({
+  "packages/strand/source-references.js"(exports2, module2) {
+    "use strict";
+    module2.exports = require_source_references();
+  }
+});
+
+// src/reviewDependencies.ts
+var reviewDependencies_exports = {};
+__export(reviewDependencies_exports, {
+  inspectDependencies: () => inspectDependencies
+});
+module.exports = __toCommonJS(reviewDependencies_exports);
+var import_source_references3 = __toESM(require_source_references2());
+
+// src/reviewWorkspace.ts
+var import_child_process = require("child_process");
+var import_util = require("util");
+var import_source_references2 = __toESM(require_source_references2());
+
+// src/requirements.ts
+var import_source_references = __toESM(require_source_references2());
+
+// node_modules/diff/lib/index.mjs
+function Diff() {
+}
+Diff.prototype = {
+  diff: function diff(oldString, newString) {
+    var _options$timeout;
+    var options = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : {};
+    var callback = options.callback;
+    if (typeof options === "function") {
+      callback = options;
+      options = {};
+    }
+    this.options = options;
+    var self = this;
+    function done(value) {
+      if (callback) {
+        setTimeout(function() {
+          callback(void 0, value);
+        }, 0);
+        return true;
+      } else {
+        return value;
+      }
+    }
+    oldString = this.castInput(oldString);
+    newString = this.castInput(newString);
+    oldString = this.removeEmpty(this.tokenize(oldString));
+    newString = this.removeEmpty(this.tokenize(newString));
+    var newLen = newString.length, oldLen = oldString.length;
+    var editLength = 1;
+    var maxEditLength = newLen + oldLen;
+    if (options.maxEditLength) {
+      maxEditLength = Math.min(maxEditLength, options.maxEditLength);
+    }
+    var maxExecutionTime = (_options$timeout = options.timeout) !== null && _options$timeout !== void 0 ? _options$timeout : Infinity;
+    var abortAfterTimestamp = Date.now() + maxExecutionTime;
+    var bestPath = [{
+      oldPos: -1,
+      lastComponent: void 0
+    }];
+    var newPos = this.extractCommon(bestPath[0], newString, oldString, 0);
+    if (bestPath[0].oldPos + 1 >= oldLen && newPos + 1 >= newLen) {
+      return done([{
+        value: this.join(newString),
+        count: newString.length
+      }]);
+    }
+    var minDiagonalToConsider = -Infinity, maxDiagonalToConsider = Infinity;
+    function execEditLength() {
+      for (var diagonalPath = Math.max(minDiagonalToConsider, -editLength); diagonalPath <= Math.min(maxDiagonalToConsider, editLength); diagonalPath += 2) {
+        var basePath = void 0;
+        var removePath = bestPath[diagonalPath - 1], addPath = bestPath[diagonalPath + 1];
+        if (removePath) {
+          bestPath[diagonalPath - 1] = void 0;
+        }
+        var canAdd = false;
+        if (addPath) {
+          var addPathNewPos = addPath.oldPos - diagonalPath;
+          canAdd = addPath && 0 <= addPathNewPos && addPathNewPos < newLen;
+        }
+        var canRemove = removePath && removePath.oldPos + 1 < oldLen;
+        if (!canAdd && !canRemove) {
+          bestPath[diagonalPath] = void 0;
+          continue;
+        }
+        if (!canRemove || canAdd && removePath.oldPos + 1 < addPath.oldPos) {
+          basePath = self.addToPath(addPath, true, void 0, 0);
+        } else {
+          basePath = self.addToPath(removePath, void 0, true, 1);
+        }
+        newPos = self.extractCommon(basePath, newString, oldString, diagonalPath);
+        if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) {
+          return done(buildValues(self, basePath.lastComponent, newString, oldString, self.useLongestToken));
+        } else {
+          bestPath[diagonalPath] = basePath;
+          if (basePath.oldPos + 1 >= oldLen) {
+            maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);
+          }
+          if (newPos + 1 >= newLen) {
+            minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);
+          }
+        }
+      }
+      editLength++;
+    }
+    if (callback) {
+      (function exec() {
+        setTimeout(function() {
+          if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) {
+            return callback();
+          }
+          if (!execEditLength()) {
+            exec();
+          }
+        }, 0);
+      })();
+    } else {
+      while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {
+        var ret = execEditLength();
+        if (ret) {
+          return ret;
+        }
+      }
+    }
+  },
+  addToPath: function addToPath(path, added, removed, oldPosInc) {
+    var last = path.lastComponent;
+    if (last && last.added === added && last.removed === removed) {
+      return {
+        oldPos: path.oldPos + oldPosInc,
+        lastComponent: {
+          count: last.count + 1,
+          added,
+          removed,
+          previousComponent: last.previousComponent
+        }
+      };
+    } else {
+      return {
+        oldPos: path.oldPos + oldPosInc,
+        lastComponent: {
+          count: 1,
+          added,
+          removed,
+          previousComponent: last
+        }
+      };
+    }
+  },
+  extractCommon: function extractCommon(basePath, newString, oldString, diagonalPath) {
+    var newLen = newString.length, oldLen = oldString.length, oldPos = basePath.oldPos, newPos = oldPos - diagonalPath, commonCount = 0;
+    while (newPos + 1 < newLen && oldPos + 1 < oldLen && this.equals(newString[newPos + 1], oldString[oldPos + 1])) {
+      newPos++;
+      oldPos++;
+      commonCount++;
+    }
+    if (commonCount) {
+      basePath.lastComponent = {
+        count: commonCount,
+        previousComponent: basePath.lastComponent
+      };
+    }
+    basePath.oldPos = oldPos;
+    return newPos;
+  },
+  equals: function equals(left, right) {
+    if (this.options.comparator) {
+      return this.options.comparator(left, right);
+    } else {
+      return left === right || this.options.ignoreCase && left.toLowerCase() === right.toLowerCase();
+    }
+  },
+  removeEmpty: function removeEmpty(array) {
+    var ret = [];
+    for (var i = 0; i < array.length; i++) {
+      if (array[i]) {
+        ret.push(array[i]);
+      }
+    }
+    return ret;
+  },
+  castInput: function castInput(value) {
+    return value;
+  },
+  tokenize: function tokenize(value) {
+    return value.split("");
+  },
+  join: function join(chars) {
+    return chars.join("");
+  }
+};
+function buildValues(diff2, lastComponent, newString, oldString, useLongestToken) {
+  var components = [];
+  var nextComponent;
+  while (lastComponent) {
+    components.push(lastComponent);
+    nextComponent = lastComponent.previousComponent;
+    delete lastComponent.previousComponent;
+    lastComponent = nextComponent;
+  }
+  components.reverse();
+  var componentPos = 0, componentLen = components.length, newPos = 0, oldPos = 0;
+  for (; componentPos < componentLen; componentPos++) {
+    var component = components[componentPos];
+    if (!component.removed) {
+      if (!component.added && useLongestToken) {
+        var value = newString.slice(newPos, newPos + component.count);
+        value = value.map(function(value2, i) {
+          var oldValue = oldString[oldPos + i];
+          return oldValue.length > value2.length ? oldValue : value2;
+        });
+        component.value = diff2.join(value);
+      } else {
+        component.value = diff2.join(newString.slice(newPos, newPos + component.count));
+      }
+      newPos += component.count;
+      if (!component.added) {
+        oldPos += component.count;
+      }
+    } else {
+      component.value = diff2.join(oldString.slice(oldPos, oldPos + component.count));
+      oldPos += component.count;
+      if (componentPos && components[componentPos - 1].added) {
+        var tmp = components[componentPos - 1];
+        components[componentPos - 1] = components[componentPos];
+        components[componentPos] = tmp;
+      }
+    }
+  }
+  var finalComponent = components[componentLen - 1];
+  if (componentLen > 1 && typeof finalComponent.value === "string" && (finalComponent.added || finalComponent.removed) && diff2.equals("", finalComponent.value)) {
+    components[componentLen - 2].value += finalComponent.value;
+    components.pop();
+  }
+  return components;
+}
+var characterDiff = new Diff();
+var extendedWordChars = /^[A-Za-z\xC0-\u02C6\u02C8-\u02D7\u02DE-\u02FF\u1E00-\u1EFF]+$/;
+var reWhitespace = /\S/;
+var wordDiff = new Diff();
+wordDiff.equals = function(left, right) {
+  if (this.options.ignoreCase) {
+    left = left.toLowerCase();
+    right = right.toLowerCase();
+  }
+  return left === right || this.options.ignoreWhitespace && !reWhitespace.test(left) && !reWhitespace.test(right);
+};
+wordDiff.tokenize = function(value) {
+  var tokens = value.split(/([^\S\r\n]+|[()[\]{}'"\r\n]|\b)/);
+  for (var i = 0; i < tokens.length - 1; i++) {
+    if (!tokens[i + 1] && tokens[i + 2] && extendedWordChars.test(tokens[i]) && extendedWordChars.test(tokens[i + 2])) {
+      tokens[i] += tokens[i + 2];
+      tokens.splice(i + 1, 2);
+      i--;
+    }
+  }
+  return tokens;
+};
+var lineDiff = new Diff();
+lineDiff.tokenize = function(value) {
+  if (this.options.stripTrailingCr) {
+    value = value.replace(/\r\n/g, "\n");
+  }
+  var retLines = [], linesAndNewlines = value.split(/(\n|\r\n)/);
+  if (!linesAndNewlines[linesAndNewlines.length - 1]) {
+    linesAndNewlines.pop();
+  }
+  for (var i = 0; i < linesAndNewlines.length; i++) {
+    var line = linesAndNewlines[i];
+    if (i % 2 && !this.options.newlineIsToken) {
+      retLines[retLines.length - 1] += line;
+    } else {
+      if (this.options.ignoreWhitespace) {
+        line = line.trim();
+      }
+      retLines.push(line);
+    }
+  }
+  return retLines;
+};
+var sentenceDiff = new Diff();
+sentenceDiff.tokenize = function(value) {
+  return value.split(/(\S.+?[.!?])(?=\s+|$)/);
+};
+var cssDiff = new Diff();
+cssDiff.tokenize = function(value) {
+  return value.split(/([{}:;,]|\s+)/);
+};
+function _typeof(obj) {
+  "@babel/helpers - typeof";
+  if (typeof Symbol === "function" && typeof Symbol.iterator === "symbol") {
+    _typeof = function(obj2) {
+      return typeof obj2;
+    };
+  } else {
+    _typeof = function(obj2) {
+      return obj2 && typeof Symbol === "function" && obj2.constructor === Symbol && obj2 !== Symbol.prototype ? "symbol" : typeof obj2;
+    };
+  }
+  return _typeof(obj);
+}
+var objectPrototypeToString = Object.prototype.toString;
+var jsonDiff = new Diff();
+jsonDiff.useLongestToken = true;
+jsonDiff.tokenize = lineDiff.tokenize;
+jsonDiff.castInput = function(value) {
+  var _this$options = this.options, undefinedReplacement = _this$options.undefinedReplacement, _this$options$stringi = _this$options.stringifyReplacer, stringifyReplacer = _this$options$stringi === void 0 ? function(k, v) {
+    return typeof v === "undefined" ? undefinedReplacement : v;
+  } : _this$options$stringi;
+  return typeof value === "string" ? value : JSON.stringify(canonicalize(value, null, null, stringifyReplacer), stringifyReplacer, "  ");
+};
+jsonDiff.equals = function(left, right) {
+  return Diff.prototype.equals.call(jsonDiff, left.replace(/,([\r\n])/g, "$1"), right.replace(/,([\r\n])/g, "$1"));
+};
+function canonicalize(obj, stack, replacementStack, replacer, key) {
+  stack = stack || [];
+  replacementStack = replacementStack || [];
+  if (replacer) {
+    obj = replacer(key, obj);
+  }
+  var i;
+  for (i = 0; i < stack.length; i += 1) {
+    if (stack[i] === obj) {
+      return replacementStack[i];
+    }
+  }
+  var canonicalizedObj;
+  if ("[object Array]" === objectPrototypeToString.call(obj)) {
+    stack.push(obj);
+    canonicalizedObj = new Array(obj.length);
+    replacementStack.push(canonicalizedObj);
+    for (i = 0; i < obj.length; i += 1) {
+      canonicalizedObj[i] = canonicalize(obj[i], stack, replacementStack, replacer, key);
+    }
+    stack.pop();
+    replacementStack.pop();
+    return canonicalizedObj;
+  }
+  if (obj && obj.toJSON) {
+    obj = obj.toJSON();
+  }
+  if (_typeof(obj) === "object" && obj !== null) {
+    stack.push(obj);
+    canonicalizedObj = {};
+    replacementStack.push(canonicalizedObj);
+    var sortedKeys = [], _key;
+    for (_key in obj) {
+      if (obj.hasOwnProperty(_key)) {
+        sortedKeys.push(_key);
+      }
+    }
+    sortedKeys.sort();
+    for (i = 0; i < sortedKeys.length; i += 1) {
+      _key = sortedKeys[i];
+      canonicalizedObj[_key] = canonicalize(obj[_key], stack, replacementStack, replacer, _key);
+    }
+    stack.pop();
+    replacementStack.pop();
+  } else {
+    canonicalizedObj = obj;
+  }
+  return canonicalizedObj;
+}
+var arrayDiff = new Diff();
+arrayDiff.tokenize = function(value) {
+  return value.slice();
+};
+arrayDiff.join = arrayDiff.removeEmpty = function(value) {
+  return value;
+};
+
+// src/changeCorrespondence.ts
+var MAX_BYTES = 16 * 1024 * 1024;
+var MAX_SOURCE_BYTES = 8 * 1024 * 1024;
+
+// src/reviewWorkspace.ts
+var MAX_BYTES2 = 16 * 1024 * 1024;
+function git(root, args, deadline) {
+  const remaining = deadline === void 0 ? 1e4 : deadline - Date.now();
+  if (remaining <= 0) throw new Error("Dependency source validation time budget exhausted");
+  return (0, import_child_process.execFileSync)("git", ["--no-replace-objects", "-C", root, ...args], { timeout: Math.min(1e4, remaining), maxBuffer: MAX_BYTES2, stdio: ["ignore", "pipe", "pipe"] });
+}
+function commitOid(root, revision, deadline) {
+  const oid = git(root, ["rev-parse", "--verify", "--end-of-options", `${revision}^{commit}`], deadline).toString().trim();
+  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(oid)) throw new Error("Expected a Git commit");
+  return oid;
+}
+function readPinnedFile(root, revision, file, deadline) {
+  (0, import_source_references2.parseSourceRef)({ revision, path: file, start: 0, end: 1, digest: "0".repeat(64) });
+  if (commitOid(root, revision, deadline) !== revision) throw new Error("Evidence requires a full immutable commit ID");
+  const entry = git(root, ["ls-tree", "-z", revision, "--", `:(literal)${file}`], deadline).toString();
+  if (!entry) return void 0;
+  const match = /^(100644|100755) blob ([a-f0-9]+)\t([^\0]+)\0$/.exec(entry);
+  if (!match || match[3] !== file) throw new Error(`Evidence is not a regular file: ${file}`);
+  const bytes = git(root, ["cat-file", "blob", match[2]], deadline);
+  if (bytes.length > 1024 * 1024 || bytes.includes(0)) throw new Error(`Evidence requires text up to 1 MiB: ${file}`);
+  return { text: new import_util.TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes), blob: match[2] };
+}
+
+// src/reviewDependencies.ts
+var object = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid dependency evidence object");
+  return value;
+};
+var text = (value) => {
+  if (typeof value !== "string" || !value.length || value.length > 1e4) throw new Error("Invalid dependency evidence text");
+  return value;
+};
+var list = (value) => {
+  if (!Array.isArray(value) || value.length > 2e4) throw new Error("Invalid dependency evidence list");
+  return value;
+};
+function inspectDependencies(root, review, input) {
+  const data = object(input), range = object(data.range);
+  if (data.version !== 1 || range.baseOid !== review.base || range.headOid !== review.head || typeof range.dirtyWorkingTreeExcluded !== "boolean") throw new Error("Dependency report does not match pinned review");
+  const limits = object(data.limits), producer = object(data.producer);
+  if (producer.name !== "bygone") throw new Error("Unsupported dependency producer");
+  text(producer.typescript);
+  for (const [key, maximum] of Object.entries({ maxFiles: 2e3, maxFileBytes: 1024 * 1024, maxBytes: 16 * 1024 * 1024, maxRecords: 2e4, timeoutMs: 3e4 })) {
+    if (!Number.isSafeInteger(limits[key]) || Number(limits[key]) < 1 || Number(limits[key]) > maximum) throw new Error("Invalid dependency limits");
+  }
+  const deadline = Date.now() + Number(limits.timeoutMs);
+  const checkTime = () => {
+    if (Date.now() >= deadline) throw new Error("Dependency source validation time budget exhausted");
+  };
+  const limitations = list(data.assumptions).map(text);
+  limitations.push(
+    "Syntactic module evidence only. Unchanged edges do not prove unchanged imported bindings, behavior, or call relationships.",
+    "Dirty buffers are excluded. TypeScript syntax/options and malformed package metadata may limit resolution; absent diagnostics do not prove complete analysis."
+  );
+  const links = [];
+  const changes = object(data.changes), consumers = object(data.unchangedConsumers);
+  const identity = (value) => {
+    const edge = object(value), s = object(edge.source);
+    return JSON.stringify([s.revision, s.oid, s.blobOid, s.file, s.start, s.end, s.digest, edge.kind, edge.relationship, edge.phase, edge.loading, edge.specifier, edge.target, edge.resolution]);
+  };
+  const cache = /* @__PURE__ */ new Map();
+  let totalBytes = 0;
+  for (const side of ["base", "head"]) {
+    checkTime();
+    const sourceFiles = /* @__PURE__ */ new Set();
+    let sourceBytes = 0;
+    const snapshot = object(data[side]), oid = side === "base" ? review.base : review.head;
+    if (snapshot.oid !== oid) throw new Error("Dependency snapshot revision mismatch");
+    const coverage = object(snapshot.coverage);
+    if (typeof coverage.indexComplete !== "boolean") throw new Error("Invalid dependency coverage");
+    for (const key of ["candidateFiles", "indexedFiles", "omittedFiles", "readBytes", "unresolvedEdges", "omittedDiagnostics"]) {
+      if (!Number.isSafeInteger(coverage[key]) || Number(coverage[key]) < 0) throw new Error("Invalid dependency coverage");
+    }
+    limitations.push(`${side}: ${coverage.indexedFiles}/${coverage.candidateFiles} files indexed; ${coverage.omittedFiles} omitted; ${coverage.unresolvedEdges} unresolved edges; ${coverage.omittedDiagnostics} omitted diagnostics; index ${coverage.indexComplete ? "complete within limits" : "partial"}.`);
+    for (const diagnostic of list(snapshot.diagnostics)) {
+      const d = object(diagnostic);
+      limitations.push(`${side}: ${text(d.code)}: ${text(d.message)}`);
+    }
+    const inventory = list(snapshot.edges), initialization = list(snapshot.initialization);
+    if (inventory.length + initialization.length > Number(limits.maxRecords) || Number(coverage.indexedFiles) > Number(limits.maxFiles) || Number(coverage.readBytes) > Number(limits.maxBytes) || Number(coverage.indexedFiles) + Number(coverage.omittedFiles) !== Number(coverage.candidateFiles) || Number(coverage.unresolvedEdges) !== inventory.filter((value) => object(value).resolution !== "resolved").length || coverage.indexComplete && Number(coverage.omittedFiles) > 0) throw new Error("Dependency coverage exceeds declared limits");
+    const inventoryKeys = new Set(inventory.map(identity));
+    const changed = list(changes[side === "base" ? "removed" : "added"]);
+    const unchanged = list(consumers[side]);
+    for (const edge of [...changed, ...unchanged]) if (!inventoryKeys.has(identity(edge))) throw new Error("Dependency summary references unknown inventory evidence");
+    const changedKeys = new Set(changed.map(identity)), consumerKeys = new Set(unchanged.map(identity));
+    for (const value of [...inventory, ...initialization]) {
+      checkTime();
+      const edge = object(value), source = object(edge.source);
+      if (edge.evidence !== "syntactic" || source.revision !== side || source.oid !== oid) throw new Error("Invalid dependency source provenance");
+      const ref = (0, import_source_references3.parseSourceRef)({ revision: oid, path: source.file, start: source.start, end: source.end, digest: source.digest });
+      const key = `${oid}:${ref.path}`;
+      if (!cache.has(key)) {
+        const file2 = readPinnedFile(root, oid, ref.path, deadline);
+        totalBytes += file2 ? Buffer.byteLength(file2.text) : 0;
+        if (totalBytes > 2 * Number(limits.maxBytes)) throw new Error("Dependency sources exceed declared combined snapshot limits");
+        cache.set(key, file2);
+      }
+      const file = cache.get(key);
+      checkTime();
+      if (!file || file.blob !== source.blobOid) throw new Error("Dependency blob mismatch");
+      if (!sourceFiles.has(ref.path)) {
+        sourceFiles.add(ref.path);
+        const bytes = Buffer.byteLength(file.text);
+        sourceBytes += bytes;
+        if (bytes > Number(limits.maxFileBytes) || sourceFiles.size > Number(limits.maxFiles) || sourceBytes > Number(limits.maxBytes) || sourceFiles.size > Number(coverage.indexedFiles) || sourceBytes > Number(coverage.readBytes)) throw new Error("Dependency sources exceed declared limits or coverage");
+      }
+      if ((0, import_source_references3.resolveSourceRef)(ref, { revision: oid, files: { [ref.path]: file.text } }).status !== "valid") throw new Error("Dependency source digest mismatch");
+      const keyInInventory = identity(value);
+      const category = changedKeys.has(keyInInventory) ? `reported ${side === "base" ? "removed" : "added"} edge` : consumerKeys.has(keyInInventory) ? "direct unchanged consumer" : initialization.includes(value) ? "initialization site" : void 0;
+      if (!category) continue;
+      const relationship = typeof edge.relationship === "string" ? edge.relationship : String(edge.kind ?? "dependency");
+      const destination = typeof edge.target === "string" ? edge.target : typeof edge.specifier === "string" ? edge.specifier : "(computed target)";
+      const detail = initialization.includes(value) ? `${relationship} ${ref.path}` : `${ref.path} \u2014 ${relationship} ${JSON.stringify(edge.specifier ?? "(computed)")} \u2192 ${destination}`;
+      links.push({
+        title: `${side}: ${category} \xB7 ${detail}`,
+        ref,
+        phase: typeof edge.phase === "string" ? edge.phase : "unspecified",
+        loading: typeof edge.loading === "string" ? edge.loading : "unspecified",
+        resolution: typeof edge.resolution === "string" ? edge.resolution : "initialization site"
+      });
+    }
+  }
+  checkTime();
+  return { links, limitations };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  inspectDependencies
+});
+//# sourceMappingURL=reviewDependencies.js.map