@graphrefly/stack 0.1.0 → 0.1.2

package/dist/grfs.js

@@ -2980,7 +2980,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve11.call(this, root, ref);
+      let _sch = resolve12.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3007,7 +3007,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve11(root, ref) {
+    function resolve12(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3638,7 +3638,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve11(baseURI, relativeURI, options) {
+    function resolve12(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3896,7 +3896,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve11,
+      resolve: resolve12,
       resolveComponent,
       equal,
       serialize: serialize2,
@@ -8563,8 +8563,9 @@ var require_semver2 = __commonJS({
 });
 
 // packages/cli/dist/cli.js
-import { readFile as readFile7 } from "node:fs/promises";
-import { resolve as resolve10 } from "node:path";
+import { realpathSync } from "node:fs";
+import { readFile as readFile8 } from "node:fs/promises";
+import { resolve as resolve11 } from "node:path";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
 
 // packages/contracts/dist/index.js
@@ -8626,6 +8627,8 @@ function sha256Jcs(value) {
 // packages/contracts/dist/repository-review.js
 var REPOSITORY_CONFIG_SCHEMA = "graphrefly.stack.repository.v1";
 var REPOSITORY_REVIEW_SCHEMA = "graphrefly.stack.review.v1";
+var REPOSITORY_REVIEW_DECISION_SCHEMA = "graphrefly.stack.repository-review-decision.v1";
+var REPOSITORY_REVIEW_BUNDLE_SCHEMA = "graphrefly.stack.repository-review-bundle.v1";
 var SUPPORTED_GRAPHREFLY_RANGE = ">=0.3.0 <0.4.0";
 
 // packages/contracts/dist/index.js
@@ -10149,7 +10152,7 @@ process.stdout.write(JSON.stringify(blueprint));
 // packages/cli/dist/repository-review.js
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { access as access2, mkdir as mkdir5, readFile as readFile6, realpath as realpath3, rm as rm4, symlink } from "node:fs/promises";
+import { access as access2, mkdir as mkdir5, readFile as readFile6, realpath as realpath3, rm as rm4, symlink, writeFile as writeFile5 } from "node:fs/promises";
 import { createRequire as createRequire2 } from "node:module";
 import { basename as basename2, dirname as dirname5, parse, resolve as resolve8, sep as sep4 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
@@ -10283,6 +10286,7 @@ var reviewSchemaPath = runtimeAssetPath("contracts/repository/v1/review.schema.j
 var configName2 = ".graphrefly-stack.json";
 var lockCandidates = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock"];
 var maxReviewCommits = 64;
+var maxEntrypointBytes = 64 * 1024;
 var RepositoryReviewError = class extends Error {
   code;
   constructor(code, message) {
@@ -10365,6 +10369,22 @@ function ensureInside(root, candidate) {
     throw new RepositoryReviewError("ENTRYPOINT_ESCAPE", "Blueprint entrypoint escapes the worktree");
   }
 }
+async function readConfiguredEntrypoint(repository, entrypointPath) {
+  const entrypoint = resolve8(repository, entrypointPath);
+  ensureInside(repository, entrypoint);
+  let canonicalEntrypoint;
+  try {
+    canonicalEntrypoint = await realpath3(entrypoint);
+  } catch {
+    throw new RepositoryReviewError("ENTRYPOINT_MISSING", "Configured Blueprint entrypoint is missing");
+  }
+  ensureInside(repository, canonicalEntrypoint);
+  const source = await readFile6(canonicalEntrypoint);
+  if (source.byteLength > maxEntrypointBytes) {
+    throw new RepositoryReviewError("ENTRYPOINT_TOO_LARGE", `Configured Blueprint entrypoint exceeds ${maxEntrypointBytes} bytes`);
+  }
+  return source;
+}
 function containsAbsolutePath(value) {
   if (typeof value === "string")
     return value.startsWith("/") || /^[A-Za-z]:[\\/]/u.test(value);
@@ -10416,7 +10436,7 @@ async function resolveTargetRuntime(repository) {
     diffGraphBlueprints: graphModule.diffGraphBlueprints
   };
 }
-async function executeBlueprint(repository, revision, entrypointPath, runtime) {
+async function executeBlueprint(repository, revision, entrypointPath, entrypointSource, runtime) {
   const worktreeRoot = resolve8(dirname5(repository), `.graphrefly-stack-review-${basename2(repository)}-${process.pid}`);
   const worktree = resolve8(worktreeRoot, revision.slice(0, 16));
   await mkdir5(worktreeRoot, { recursive: true });
@@ -10429,8 +10449,19 @@ async function executeBlueprint(repository, revision, entrypointPath, runtime) {
     try {
       await access2(entrypoint);
     } catch {
-      throw new RepositoryReviewError("ENTRYPOINT_MISSING", `Blueprint entrypoint is missing at ${revision.slice(0, 12)}`);
+      let canonicalParent;
+      try {
+        canonicalParent = await realpath3(dirname5(entrypoint));
+      } catch {
+        throw new RepositoryReviewError("ENTRYPOINT_MISSING", `Blueprint entrypoint parent is missing at ${revision.slice(0, 12)}`);
+      }
+      ensureInside(canonicalWorktree, canonicalParent);
+      await writeFile5(resolve8(canonicalParent, basename2(entrypoint)), entrypointSource, {
+        flag: "wx"
+      });
     }
+    const canonicalEntrypoint = await realpath3(entrypoint);
+    ensureInside(canonicalWorktree, canonicalEntrypoint);
     const worktreeNodeModules = resolve8(canonicalWorktree, "node_modules");
     await rm4(worktreeNodeModules, { recursive: true, force: true });
     await symlink(runtime.nodeModulesRoot, worktreeNodeModules, "dir");
@@ -10439,7 +10470,7 @@ async function executeBlueprint(repository, revision, entrypointPath, runtime) {
       `--allow-fs-read=${canonicalWorktree}`,
       `--allow-fs-read=${runtime.nodeModulesRoot}`,
       "--disable-warning=ExperimentalWarning",
-      entrypoint
+      canonicalEntrypoint
     ], {
       cwd: canonicalWorktree,
       encoding: "utf8",
@@ -10543,6 +10574,27 @@ async function validateReview(review) {
     throw new RepositoryReviewError("REVIEW_SCHEMA_INVALID", `Repository review failed validation: ${JSON.stringify(validate.errors)}`);
   }
 }
+function reviewHeadLabel(repository, requested, headOid) {
+  try {
+    const symbolic = gitText(repository, ["rev-parse", "--symbolic-full-name", requested]);
+    if (symbolic.startsWith("refs/heads/"))
+      return symbolic.slice("refs/heads/".length);
+  } catch {
+  }
+  try {
+    const branch = gitText(repository, [
+      "for-each-ref",
+      "--format=%(refname:short)",
+      "--points-at",
+      headOid,
+      "refs/heads"
+    ]).split("\n").find(Boolean);
+    if (branch !== void 0)
+      return branch;
+  } catch {
+  }
+  return headOid.slice(0, 12);
+}
 async function createRepositoryReview(options) {
   let repository;
   try {
@@ -10552,6 +10604,7 @@ async function createRepositoryReview(options) {
     throw new RepositoryReviewError("REPOSITORY_INVALID", "Repository must be a local Git worktree");
   }
   const config = await readRepositoryConfig(repository);
+  const entrypointSource = await readConfiguredEntrypoint(repository, config.blueprint.entrypoint);
   const git2 = new SystemGitAdapter();
   let baseOid;
   let headOid;
@@ -10595,7 +10648,7 @@ async function createRepositoryReview(options) {
   await validateDependencyContinuity(repository, allRevisions, runtime.version);
   const evidence = [];
   for (const revision of allRevisions) {
-    const blueprint = await executeBlueprint(repository, revision, config.blueprint.entrypoint, runtime);
+    const blueprint = await executeBlueprint(repository, revision, config.blueprint.entrypoint, entrypointSource, runtime);
     evidence.push({
       oid: revision,
       subject: gitText(repository, ["show", "-s", "--format=%s", revision]),
@@ -10626,6 +10679,7 @@ async function createRepositoryReview(options) {
     source: "generic-repository",
     repository: {
       label: basename2(repository),
+      headLabel: reviewHeadLabel(repository, options.head, headOid),
       graphreflyVersion: runtime.version,
       entrypoint: config.blueprint.entrypoint,
       baseOid,
@@ -10643,7 +10697,172 @@ async function createRepositoryReview(options) {
 import { createReadStream } from "node:fs";
 import { stat as stat4 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { extname, resolve as resolve9, sep as sep5 } from "node:path";
+import { extname, resolve as resolve10, sep as sep6 } from "node:path";
+
+// packages/cli/dist/repository-review-state.js
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir as mkdir6, readdir, readFile as readFile7, realpath as realpath4, rename, writeFile as writeFile6 } from "node:fs/promises";
+import { resolve as resolve9, sep as sep5 } from "node:path";
+var schemaPaths = [
+  "contracts/repository/v1/repository-config.schema.json",
+  "contracts/repository/v1/review.schema.json",
+  "contracts/repository/v1/review-decision-request.schema.json",
+  "contracts/repository/v1/review-decision.schema.json",
+  "contracts/repository/v1/review-bundle.schema.json"
+];
+var RepositoryReviewStateError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "RepositoryReviewStateError";
+  }
+};
+async function validators() {
+  const schemas2 = await Promise.all(schemaPaths.map(async (path) => JSON.parse(await readFile7(runtimeAssetPath(path), "utf8"))));
+  const ajv = createStrictAjv();
+  for (const schema of schemas2)
+    ajv.addSchema(schema);
+  return {
+    request: ajv.getSchema("urn:graphrefly-stack:schema:repository-review-decision-request:v1"),
+    decision: ajv.getSchema("urn:graphrefly-stack:schema:repository-review-decision:v1"),
+    bundle: ajv.getSchema("urn:graphrefly-stack:schema:repository-review-bundle:v1")
+  };
+}
+async function safeDirectory(path, parent) {
+  try {
+    const current = await lstat(path);
+    if (!current.isDirectory() || current.isSymbolicLink()) {
+      throw new RepositoryReviewStateError("REVIEW_STATE_PATH_UNSAFE", "Local review state path must be a real directory");
+    }
+  } catch (error) {
+    if (error instanceof RepositoryReviewStateError)
+      throw error;
+    if (error.code !== "ENOENT")
+      throw error;
+    await mkdir6(path, { recursive: false, mode: 448 });
+  }
+  const canonical = await realpath4(path);
+  if (!canonical.startsWith(`${parent}${sep5}`)) {
+    throw new RepositoryReviewStateError("REVIEW_STATE_PATH_UNSAFE", "Local review state escaped the Git common directory");
+  }
+  return canonical;
+}
+async function repositoryReviewStateRoot(repository) {
+  const commonDirectory = await realpath4(gitText(repository, ["rev-parse", "--path-format=absolute", "--git-common-dir"]));
+  return safeDirectory(resolve9(commonDirectory, "grfs"), commonDirectory);
+}
+async function decisionsDirectory(repository) {
+  const root = await repositoryReviewStateRoot(repository);
+  return safeDirectory(resolve9(root, "reviews"), root);
+}
+function blueprintHashFor(review, commitOid) {
+  const commit = review.commits.find((candidate) => candidate.oid === commitOid);
+  const hash2 = commit?.blueprint.hash;
+  if (typeof hash2 !== "object" || hash2 === null)
+    return void 0;
+  return typeof hash2.value === "string" ? hash2.value : void 0;
+}
+function matchesCurrentReview(review, record) {
+  const commit = review.commits.find((candidate) => candidate.oid === record.target.commitOid);
+  return commit !== void 0 && record.target.baseOid === review.repository.baseOid && record.target.headOid === review.repository.headOid && record.target.parentOid === commit.parentOid && record.target.blueprintHash === blueprintHashFor(review, commit.oid);
+}
+async function readRepositoryReviewDecisions(repository, review) {
+  const directory = await decisionsDirectory(repository);
+  const { decision: validate } = await validators();
+  if (validate === void 0)
+    throw new Error("Repository review decision validator unavailable");
+  const entries = (await readdir(directory, { withFileTypes: true })).filter((entry2) => entry2.isFile() && entry2.name.endsWith(".json")).map((entry2) => entry2.name).sort();
+  const records = [];
+  for (const entry2 of entries) {
+    let value;
+    try {
+      value = JSON.parse(await readFile7(resolve9(directory, entry2), "utf8"));
+    } catch {
+      throw new RepositoryReviewStateError("REVIEW_STATE_INVALID", `Local review record is not valid JSON: ${entry2}`);
+    }
+    if (!validate(value)) {
+      throw new RepositoryReviewStateError("REVIEW_STATE_INVALID", `Local review record failed validation: ${entry2}`);
+    }
+    const record = value;
+    if (matchesCurrentReview(review, record))
+      records.push(record);
+  }
+  return records.sort((left, right) => left.recordedAt.localeCompare(right.recordedAt));
+}
+async function writeRepositoryReviewDecision(repository, review, input) {
+  const { request: validateRequest, decision: validateDecision } = await validators();
+  if (validateRequest === void 0 || validateDecision === void 0) {
+    throw new Error("Repository review decision validators unavailable");
+  }
+  if (!validateRequest(input)) {
+    throw new RepositoryReviewStateError("REVIEW_DECISION_INVALID", `Review decision request failed validation: ${JSON.stringify(validateRequest.errors)}`);
+  }
+  const request = input;
+  const reviewerLabel = request.reviewerLabel.trim();
+  const summary = request.summary.trim();
+  if (reviewerLabel.length === 0) {
+    throw new RepositoryReviewStateError("REVIEW_DECISION_INVALID", "Reviewer name cannot be blank");
+  }
+  const commit = review.commits.find((candidate) => candidate.oid === request.commitOid);
+  const blueprintHash = blueprintHashFor(review, request.commitOid);
+  if (commit === void 0 || blueprintHash === void 0) {
+    throw new RepositoryReviewStateError("REVIEW_TARGET_STALE", "The selected commit is not part of the current review range");
+  }
+  const record = {
+    schema: REPOSITORY_REVIEW_DECISION_SCHEMA,
+    id: randomUUID(),
+    target: {
+      baseOid: review.repository.baseOid,
+      headOid: review.repository.headOid,
+      parentOid: commit.parentOid,
+      commitOid: commit.oid,
+      blueprintHash
+    },
+    decision: request.decision,
+    reviewerLabel,
+    summary,
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    identityVerified: false
+  };
+  if (!validateDecision(record)) {
+    throw new Error(`Generated review decision failed validation: ${JSON.stringify(validateDecision.errors)}`);
+  }
+  const directory = await decisionsDirectory(repository);
+  const destination = resolve9(directory, `${record.id}.json`);
+  const temporary = resolve9(directory, `.${record.id}.tmp`);
+  await writeFile6(temporary, `${JSON.stringify(record, null, 2)}
+`, {
+    encoding: "utf8",
+    flag: "wx",
+    mode: 384
+  });
+  await rename(temporary, destination);
+  return record;
+}
+async function createRepositoryReviewBundle(repository, review) {
+  const records = await readRepositoryReviewDecisions(repository, review);
+  const bundle = {
+    schema: REPOSITORY_REVIEW_BUNDLE_SCHEMA,
+    repository: {
+      label: review.repository.label,
+      baseOid: review.repository.baseOid,
+      headOid: review.repository.headOid
+    },
+    artifacts: records.map((record) => ({
+      path: `reviews/${record.id}.json`,
+      hash: { algorithm: "sha256", value: sha256Jcs(record) },
+      record
+    }))
+  };
+  const { bundle: validate } = await validators();
+  if (validate === void 0 || !validate(bundle)) {
+    throw new Error(`Generated review bundle failed validation: ${JSON.stringify(validate?.errors)}`);
+  }
+  return bundle;
+}
+
+// packages/cli/dist/review-server.js
 var defaultReviewDist = runtimeReviewDist();
 var contentTypes = {
   ".css": "text/css; charset=utf-8",
@@ -10652,6 +10871,32 @@ var contentTypes = {
   ".json": "application/json; charset=utf-8",
   ".svg": "image/svg+xml"
 };
+async function readJsonBody(request) {
+  const maximumBytes = 32 * 1024;
+  const declaredLength = Number(request.headers["content-length"] ?? "0");
+  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {
+    throw new RepositoryReviewStateError("REVIEW_DECISION_TOO_LARGE", "Review decision request exceeds 32 KiB");
+  }
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += bytes.length;
+    if (size > maximumBytes) {
+      throw new RepositoryReviewStateError("REVIEW_DECISION_TOO_LARGE", "Review decision request exceeds 32 KiB");
+    }
+    chunks.push(bytes);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new RepositoryReviewStateError("REVIEW_DECISION_INVALID", "Review decision request is not valid JSON");
+  }
+}
+function sendJson(response, status, value) {
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.writeHead(status).end(JSON.stringify(value));
+}
 function safeAssetPath(distDir, requestUrl) {
   let pathname;
   try {
@@ -10660,23 +10905,58 @@ function safeAssetPath(distDir, requestUrl) {
     return null;
   }
   const relative2 = pathname === "/" ? "index.html" : pathname.replace(/^\/+/, "");
-  const candidate = resolve9(distDir, relative2);
-  return candidate === distDir || candidate.startsWith(`${distDir}${sep5}`) ? candidate : null;
+  const candidate = resolve10(distDir, relative2);
+  return candidate === distDir || candidate.startsWith(`${distDir}${sep6}`) ? candidate : null;
 }
 async function startReviewServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 4173;
-  const distDir = resolve9(options.distDir ?? defaultReviewDist);
-  const evidenceBundlePath = options.evidenceBundlePath === void 0 ? void 0 : resolve9(options.evidenceBundlePath);
+  const distDir = resolve10(options.distDir ?? defaultReviewDist);
+  const evidenceBundlePath = options.evidenceBundlePath === void 0 ? void 0 : resolve10(options.evidenceBundlePath);
   const server = createServer(async (request, response) => {
     response.setHeader("Cache-Control", "no-store");
     response.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'");
     response.setHeader("X-Content-Type-Options", "nosniff");
+    const pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+    if (pathname === "/api/review-decisions" && request.method === "POST") {
+      const state = options.repositoryReviewState;
+      if (state === void 0) {
+        response.writeHead(404).end("Local review state unavailable");
+        return;
+      }
+      const expectedOrigin = request.headers.host === void 0 ? void 0 : `http://${request.headers.host}`;
+      if (request.headers.origin !== expectedOrigin || request.headers["x-graphrefly-review"] !== "1") {
+        response.writeHead(403).end("Same-origin review action required");
+        return;
+      }
+      if (!request.headers["content-type"]?.startsWith("application/json")) {
+        response.writeHead(415).end("application/json required");
+        return;
+      }
+      try {
+        const input = await readJsonBody(request);
+        const record = await writeRepositoryReviewDecision(state.repository, state.review, input);
+        sendJson(response, 201, record);
+      } catch (error) {
+        if (error instanceof RepositoryReviewStateError) {
+          sendJson(response, error.code === "REVIEW_TARGET_STALE" ? 409 : 400, {
+            code: error.code,
+            message: error.message
+          });
+        } else {
+          sendJson(response, 500, {
+            code: "REVIEW_STATE_FAILED",
+            message: "Local review state could not be updated"
+          });
+        }
+      }
+      return;
+    }
     if (request.method !== "GET" && request.method !== "HEAD") {
       response.writeHead(405).end("Method not allowed");
       return;
     }
-    if (new URL(request.url ?? "/", "http://localhost").pathname === "/api/review-data") {
+    if (pathname === "/api/review-data") {
       if (options.reviewData === void 0) {
         response.writeHead(404).end("Review data unavailable");
         return;
@@ -10689,7 +10969,47 @@ async function startReviewServer(options = {}) {
         response.end(JSON.stringify(options.reviewData));
       return;
     }
-    if (new URL(request.url ?? "/", "http://localhost").pathname === "/api/evidence-bundle") {
+    if (pathname === "/api/review-decisions") {
+      const state = options.repositoryReviewState;
+      if (state === void 0) {
+        response.writeHead(404).end("Local review state unavailable");
+        return;
+      }
+      try {
+        const records = await readRepositoryReviewDecisions(state.repository, state.review);
+        response.setHeader("Content-Type", "application/json; charset=utf-8");
+        response.writeHead(200);
+        if (request.method === "HEAD")
+          response.end();
+        else
+          response.end(JSON.stringify(records));
+      } catch {
+        response.writeHead(500).end("Local review state unavailable");
+      }
+      return;
+    }
+    if (pathname === "/api/review-decisions/export") {
+      const state = options.repositoryReviewState;
+      if (state === void 0) {
+        response.writeHead(404).end("Portable review bundle unavailable");
+        return;
+      }
+      try {
+        const bundle = await createRepositoryReviewBundle(state.repository, state.review);
+        response.setHeader("Content-Type", "application/json; charset=utf-8");
+        response.setHeader("Content-Disposition", 'attachment; filename="graphrefly-stack-reviews.json"');
+        response.writeHead(200);
+        if (request.method === "HEAD")
+          response.end();
+        else
+          response.end(`${JSON.stringify(bundle, null, 2)}
+`);
+      } catch {
+        response.writeHead(500).end("Portable review bundle unavailable");
+      }
+      return;
+    }
+    if (pathname === "/api/evidence-bundle") {
       if (evidenceBundlePath === void 0) {
         response.writeHead(404).end("Portable evidence bundle unavailable");
         return;
@@ -10753,11 +11073,11 @@ Usage:
   grfs review [--bundle <path>] [--fixture <runtime-suite.json>] [--host 127.0.0.1] [--port 4173]
   grfs export [--fixture <runtime-suite.json>] [--plan-run <path>] [--replan-run <path>] [--output <path>] --json
 `;
-var defaultFixtureOutput = resolve10(".private/fixtures/refresh-token-rotation-v1");
-var defaultRuntimeSuite = resolve10(defaultFixtureOutput, ".graphrefly-stack/runtime-suite.json");
+var defaultFixtureOutput = resolve11(".private/fixtures/refresh-token-rotation-v1");
+var defaultRuntimeSuite = resolve11(defaultFixtureOutput, ".graphrefly-stack/runtime-suite.json");
 function isWithin(root, candidate) {
-  const normalizedRoot = resolve10(root);
-  const normalizedCandidate = resolve10(candidate);
+  const normalizedRoot = resolve11(root);
+  const normalizedCandidate = resolve11(candidate);
   return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}/`);
 }
 function commandFrom(argv) {
@@ -10806,12 +11126,12 @@ function caseFrom(runtime, caseId) {
   return runtime.cases.find((fixtureCase) => fixtureCase.caseId === caseId);
 }
 async function readJson2(path) {
-  return JSON.parse(await readFile7(path, "utf8"));
+  return JSON.parse(await readFile8(path, "utf8"));
 }
 async function readLiveRun(path, kind) {
   if (path === void 0)
     return void 0;
-  const value = await readJson2(resolve10(path));
+  const value = await readJson2(resolve11(path));
   if (value.schema !== "urn:graphrefly-stack:live-run:v1" || value.kind !== kind || value.mode !== "live" || typeof value.provenance !== "object" || value.provenance === null) {
     throw new Error(`Invalid ${kind} live-run artifact`);
   }
@@ -10925,14 +11245,14 @@ ${help}`);
     }
   }
   if (command === "fixture-create") {
-    const output = resolve10(readOption(argv, "--output") ?? defaultFixtureOutput);
-    if (!isWithin(resolve10(".private"), output)) {
+    const output = resolve11(readOption(argv, "--output") ?? defaultFixtureOutput);
+    if (!isWithin(resolve11(".private"), output)) {
       return failure(command, json, "OUTPUT_OUTSIDE_PRIVATE_ROOT", output, "replay");
     }
     const runtime = await createFlagshipFixture(output, argv.includes("--force"));
     success(command, "replay", {
       repository: runtime.repository,
-      runtimeSuite: resolve10(output, ".graphrefly-stack/runtime-suite.json"),
+      runtimeSuite: resolve11(output, ".graphrefly-stack/runtime-suite.json"),
       refs: runtime.refs
     }, json);
     return 0;
@@ -10983,8 +11303,8 @@ ${help}`);
   }
   if (command === "export") {
     const runtime = await readRuntimeSuite(readOption(argv, "--fixture") ?? defaultRuntimeSuite);
-    const requestedOutput = resolve10(readOption(argv, "--output") ?? resolve10(".private/exports/refresh-token-rotation-v1"));
-    if (!isWithin(resolve10(".private"), requestedOutput) && !isWithin(resolve10("evidence/runs"), requestedOutput)) {
+    const requestedOutput = resolve11(readOption(argv, "--output") ?? resolve11(".private/exports/refresh-token-rotation-v1"));
+    if (!isWithin(resolve11(".private"), requestedOutput) && !isWithin(resolve11("evidence/runs"), requestedOutput)) {
       return failure(command, json, "OUTPUT_OUTSIDE_EVIDENCE_ROOT", requestedOutput);
     }
     const liveRuns = {
@@ -11006,6 +11326,7 @@ ${help}`);
   }
   let reviewData;
   let evidenceBundlePath;
+  let repositoryReviewState;
   const repository = readOption(argv, "--repo");
   const base = readOption(argv, "--base");
   const head = readOption(argv, "--head");
@@ -11019,7 +11340,9 @@ ${help}`);
       return failure(command, json, "REVIEW_SOURCE_CONFLICT", "Generic repository review cannot be mixed with fixture or bundle input");
     }
     try {
-      reviewData = await createRepositoryReview({ repository, base, head });
+      const repositoryReview = await createRepositoryReview({ repository, base, head });
+      reviewData = repositoryReview;
+      repositoryReviewState = { repository: resolve11(repository), review: repositoryReview };
     } catch (error) {
       if (error instanceof RepositoryReviewError) {
         return failure(command, json, error.code, error.message);
@@ -11070,7 +11393,8 @@ ${help}`);
     host,
     port,
     reviewData,
-    evidenceBundlePath
+    evidenceBundlePath,
+    repositoryReviewState
   });
   process.stderr.write(`GraphReFly Stack review shell (${CORE_ARCHITECTURE.version}) listening at ${running.url}
 `);
@@ -11079,7 +11403,11 @@ ${help}`);
   process.once("SIGTERM", close);
   return 0;
 }
-var entry = process.argv[1] ? pathToFileURL3(process.argv[1]).href : "";
+var entry = "";
+try {
+  entry = process.argv[1] ? pathToFileURL3(realpathSync(process.argv[1])).href : "";
+} catch {
+}
 if (import.meta.url === entry) {
   runCli().then((code) => {
     process.exitCode = code;

package/dist/review/assets/{abnfDiagram-VRR7QNED-5JVeQ-ZW.js → abnfDiagram-VRR7QNED-DxGYeLns.js}

@@ -1 +1 @@
-import{m as e}from"./src-BMa7vLb8.js";import{n as t}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./chunk-WYO6CB5R-C36byBU-.js";import"./index-CqjR4YYp.js";import{m as n,t as r}from"./mermaid-parser.core-BJLV4lM2.js";import{n as i,r as a,t as o}from"./chunk-MOJQB5TN-BshP08Ez.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";var c=n().RailroadAbnf.parser.LangiumParser,l=t(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=t(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=t(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=t(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=t(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=t(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=t(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:t(t=>{o.clear(),e.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(t);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new r(n);let i=n.value;e.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),e.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e}from"./src-BMa7vLb8.js";import{n as t}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import"./chunk-WYO6CB5R-C36byBU-.js";import"./index-CUaeHlgA.js";import{m as n,t as r}from"./mermaid-parser.core-BJLV4lM2.js";import{n as i,r as a,t as o}from"./chunk-MOJQB5TN-Ct40HB9X.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";var c=n().RailroadAbnf.parser.LangiumParser,l=t(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=t(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=t(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=t(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=t(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=t(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=t(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:t(t=>{o.clear(),e.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(t);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new r(n);let i=n.value;e.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),e.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};