@haystackeditor/cli 0.25.0 → 0.26.0

package/dist/commands/lockfile-pin.js

@@ -0,0 +1,307 @@
+/**
+ * Adding one dependency to an app's lockfile without moving anything else (rule 13: init must never change what a build
+ * resolves beyond what it adds). Measured on real lockfiles (Rallly's pnpm workspace, and scratch workspaces whose app
+ * locks older versions of packages the CLI also uses):
+ *   - yarn 1, yarn 4 and bun add only the new descriptors and entries; nothing else moves.
+ *   - npm hoists the new tree and replaces hoisted packages the app already locks (ws, yaml, zod moved to the CLI's
+ *     versions); with `--install-strategy=nested` it places the new tree under the dependency and moves nothing.
+ *   - pnpm re-resolves the dependencies of every package the new tree shares with the old one to the newest version in the
+ *     graph (47 entries in Rallly, from @smithy/* to express), and no flag stops it. So init lets pnpm resolve the new
+ *     dependency (`--lockfile-only`), keeps every entry the lockfile had, adds the entries only the new dependency
+ *     reaches (mergePnpmLockfile), and installs exactly that (`pnpm install --frozen-lockfile`, which also proves it).
+ * lockfileDrift checks the result for every format init can read, so a package manager that moves anything else fails the
+ * change (and init restores every file).
+ */
+function unquote(text) {
+    if (text.startsWith('\'') && text.endsWith('\''))
+        return text.slice(1, -1).replace(/''/g, '\'');
+    if (text.startsWith('"') && text.endsWith('"'))
+        return JSON.parse(text);
+    return text;
+}
+/** An entry's key line (`  'name@1.0.0(peer@2)':`, `  name@1.0.0: {}`) as its name. */
+function keyOf(line) {
+    return unquote(line.trim().replace(/: \{\}$/, '').replace(/:$/, ''));
+}
+const ENTRY_SECTIONS = new Set(['importers', 'packages', 'snapshots']);
+/** pnpm-lock.yaml as its top-level sections, the importers, packages and snapshots split into entries kept as written. */
+function parseLock(text) {
+    const sections = [];
+    for (const line of text.replace(/\n$/, '').split('\n')) {
+        if (/^\S/.test(line))
+            sections.push({ header: line, entries: null, raw: [] });
+        else if (sections.length === 0)
+            throw new Error('pnpm-lock.yaml does not start with a section');
+        else
+            sections[sections.length - 1].raw.push(line);
+    }
+    for (const section of sections) {
+        if (!ENTRY_SECTIONS.has(section.header.replace(/:$/, '')))
+            continue;
+        const entries = [];
+        for (const line of section.raw) {
+            if (/^ {2}\S/.test(line))
+                entries.push({ name: keyOf(line), lines: [line] });
+            else if (line.trim() !== '') {
+                if (entries.length === 0)
+                    throw new Error(`pnpm-lock.yaml's ${section.header} has a line outside any entry`);
+                entries[entries.length - 1].lines.push(line);
+            }
+        }
+        section.entries = entries;
+    }
+    return sections;
+}
+function formatLock(sections) {
+    const blocks = sections.map(section => {
+        if (section.entries === null)
+            return [section.header, ...section.raw].join('\n');
+        return [section.header, '', section.entries.map(entry => entry.lines.join('\n')).join('\n\n'), ''].join('\n');
+    });
+    return `${blocks.join('\n').replace(/\n+$/, '')}\n`;
+}
+function section(sections, name) {
+    const found = sections.find(item => item.header === `${name}:`);
+    if (!found?.entries)
+        throw new Error(`pnpm-lock.yaml has no ${name} section`);
+    return found.entries;
+}
+/** A snapshot's edges: `dependencies` (required) and `optionalDependencies`, as snapshot keys. */
+function edges(entry) {
+    const out = [];
+    let field = null;
+    for (const line of entry.lines.slice(1)) {
+        const header = /^ {4}(\w+):$/.exec(line);
+        if (header) {
+            field = header[1];
+            continue;
+        }
+        if (/^ {4}\S/.test(line)) {
+            field = null;
+            continue;
+        }
+        const dependency = /^ {6}(.+?): (.+)$/.exec(line);
+        if (!dependency || (field !== 'dependencies' && field !== 'optionalDependencies'))
+            continue;
+        const name = unquote(dependency[1]);
+        const version = unquote(dependency[2]);
+        if (version.startsWith('link:'))
+            continue;
+        // An alias resolves to another package: its value is that package's own key.
+        const key = /^(@[^/@]+\/)?[^@(]+@/.test(version) && !/^\d/.test(version) ? version : `${name}@${version}`;
+        out.push({ key, optional: field === 'optionalDependencies' });
+    }
+    return out;
+}
+/** The snapshot key's package (`name@1.0.0(peer@2)` → `name@1.0.0`). */
+function packageKey(key) {
+    const at = key.indexOf('@', 1);
+    const peers = key.indexOf('(', at);
+    return peers === -1 ? key : key.slice(0, peers);
+}
+/** An importer's dependencies by field (`dependencies:`, `devDependencies:`, …), each entry's lines as written. */
+function importerFields(entry) {
+    const fields = [];
+    for (const line of entry.lines.slice(1)) {
+        const header = /^ {4}(\w+):$/.exec(line);
+        if (header) {
+            fields.push({ field: header[1], dependencies: [] });
+            continue;
+        }
+        const current = fields[fields.length - 1];
+        if (!current)
+            throw new Error(`pnpm-lock.yaml's importer ${entry.name} has a line outside any field`);
+        if (/^ {6}\S/.test(line))
+            current.dependencies.push({ field: current.field, name: keyOf(line.slice(4)), lines: [line] });
+        else if (current.dependencies.length > 0)
+            current.dependencies[current.dependencies.length - 1].lines.push(line);
+        else
+            throw new Error(`pnpm-lock.yaml's importer ${entry.name} has an unexpected ${current.field} line`);
+    }
+    return fields;
+}
+const byName = (a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+function versionOf(dependency) {
+    const line = dependency.lines.find(item => /^ {8}version: /.test(item));
+    if (!line)
+        throw new Error(`pnpm-lock.yaml lists ${dependency.name} with no version`);
+    return unquote(line.trim().slice('version: '.length));
+}
+/** Every snapshot key reachable from `roots` (required edges first: `required` holds those reached without an optional edge). */
+function reach(snapshots, roots) {
+    const all = new Set();
+    const required = new Set();
+    const queue = roots.map(root => ({ ...root }));
+    while (queue.length > 0) {
+        const { key, optional } = queue.shift();
+        if (optional ? all.has(key) : required.has(key))
+            continue;
+        const entry = snapshots.get(key);
+        if (!entry)
+            throw new Error(`pnpm-lock.yaml references ${key}, which it does not list`);
+        all.add(key);
+        if (!optional)
+            required.add(key);
+        for (const edge of edges(entry))
+            queue.push({ key: edge.key, optional: optional || edge.optional });
+    }
+    return { all, required };
+}
+function withOptional(entry, optional) {
+    const body = entry.lines.slice(1).filter(line => line !== '    optional: true');
+    const key = entry.lines[0].replace(/: \{\}$/, ':');
+    if (optional)
+        return { name: entry.name, lines: [key, ...body, '    optional: true'] };
+    return { name: entry.name, lines: body.length === 0 ? [`${key.replace(/:$/, '')}: {}`] : [key, ...body] };
+}
+/**
+ * The lockfile `before` plus exactly what pnpm's own resolution (`after`, from `pnpm add --lockfile-only`) adds for
+ * `dependency` in `importer`: its importer entry, the snapshots and packages only it reaches, and the optional flag
+ * removed from snapshots it now requires; an earlier version of it and what only that reached go. Everything else stays as
+ * `before` had it, so shared packages keep their resolutions (each one satisfies its own ranges already).
+ */
+export function mergePnpmLockfile(before, after, importer, dependency) {
+    const old = parseLock(before);
+    const resolved = parseLock(after);
+    if (formatLock(old) !== before)
+        throw new Error('init cannot rewrite this pnpm-lock.yaml exactly as pnpm wrote it');
+    for (const lock of [old, resolved]) {
+        if (lock[0]?.header !== 'lockfileVersion: \'9.0\'')
+            throw new Error(`init merges pnpm lockfile version 9.0, and this one is ${lock[0]?.header ?? 'empty'}`);
+    }
+    const header = (lock) => lock.filter(item => item.entries === null).map(item => [item.header, ...item.raw].join('\n')).join('\n');
+    if (header(old) !== header(resolved))
+        throw new Error('pnpm changed the lockfile\'s settings while adding the dependency');
+    const oldImporter = section(old, 'importers').find(entry => entry.name === importer);
+    const newImporter = section(resolved, 'importers').find(entry => entry.name === importer);
+    if (!oldImporter || !newImporter)
+        throw new Error(`pnpm-lock.yaml has no importer ${importer}`);
+    const added = importerFields(newImporter).flatMap(item => item.dependencies).find(item => item.name === dependency);
+    if (!added)
+        throw new Error(`pnpm did not add ${dependency} to ${importer}`);
+    const earlier = importerFields(oldImporter).flatMap(item => item.dependencies).find(item => item.name === dependency) ?? null;
+    // The importer: as before, with the dependency in the field pnpm put it in (fields in pnpm's order).
+    const oldFields = importerFields(oldImporter);
+    const order = importerFields(newImporter).map(item => item.field);
+    const fields = [...new Set([...order, ...oldFields.map(item => item.field)])].map(field => {
+        const kept = (oldFields.find(item => item.field === field)?.dependencies ?? []).filter(item => item.name !== dependency);
+        return { field, dependencies: field === added.field ? [...kept, added].sort(byName) : kept };
+    }).filter(item => item.dependencies.length > 0);
+    const importerEntry = { name: importer, lines: [oldImporter.lines[0].replace(/: \{\}$/, ':'), ...fields.flatMap(item => [`    ${item.field}:`, ...item.dependencies.flatMap(dep => dep.lines)])] };
+    // The graph: before's snapshots, then pnpm's for keys before did not have.
+    const oldSnapshots = new Map(section(old, 'snapshots').map(entry => [entry.name, entry]));
+    const newSnapshots = new Map(section(resolved, 'snapshots').map(entry => [entry.name, entry]));
+    const merged = new Map(oldSnapshots);
+    const root = `${dependency}@${versionOf(added)}`;
+    // Walk the new dependency's tree through the merged graph, taking pnpm's entries only where before had none.
+    const queue = [root];
+    const seen = new Set();
+    while (queue.length > 0) {
+        const key = queue.shift();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (!merged.has(key)) {
+            const entry = newSnapshots.get(key);
+            if (!entry)
+                throw new Error(`pnpm's resolution references ${key}, which it does not list`);
+            merged.set(key, entry);
+        }
+        for (const edge of edges(merged.get(key)))
+            queue.push(edge.key);
+    }
+    const fieldOf = { dependencies: false, devDependencies: false, optionalDependencies: true };
+    const ours = reach(merged, [{ key: root, optional: fieldOf[added.field] ?? false }]);
+    for (const key of ours.all) {
+        const entry = merged.get(key);
+        const optional = !ours.required.has(key) && (oldSnapshots.has(key) ? entry.lines.includes('    optional: true') : true);
+        merged.set(key, withOptional(entry, optional));
+    }
+    // An earlier version of the dependency: what only it reached goes, as pnpm would prune it.
+    if (earlier && `${dependency}@${versionOf(earlier)}` !== root) {
+        const importers = section(old, 'importers').map(entry => (entry.name === importer ? importerEntry : entry));
+        const roots = importers.flatMap(entry => importerFields(entry).flatMap(item => item.dependencies
+            .map(dep => ({ dep, version: versionOf(dep) })).filter(({ version }) => !version.startsWith('link:'))
+            .map(({ dep, version }) => ({ key: /^(@[^/@]+\/)?[^@(]+@/.test(version) && !/^\d/.test(version) ? version : `${dep.name}@${version}`,
+            optional: fieldOf[dep.field] ?? false }))));
+        const live = reach(merged, roots).all;
+        for (const key of reach(oldSnapshots, [{ key: `${dependency}@${versionOf(earlier)}`, optional: false }]).all)
+            if (!live.has(key))
+                merged.delete(key);
+    }
+    // Packages: before's, less those only the earlier version's snapshots used, plus pnpm's for the new ones.
+    const used = new Set([...merged.keys()].map(packageKey));
+    const dropped = new Set([...oldSnapshots.keys()].filter(key => !merged.has(key)).map(packageKey).filter(name => !used.has(name)));
+    const oldPackages = section(old, 'packages');
+    const listed = new Set(oldPackages.map(entry => entry.name));
+    const newPackages = new Map(section(resolved, 'packages').map(entry => [entry.name, entry]));
+    const packages = oldPackages.filter(entry => !dropped.has(entry.name));
+    for (const name of used) {
+        if (listed.has(name))
+            continue;
+        const entry = newPackages.get(name);
+        if (!entry)
+            throw new Error(`pnpm's resolution lists no package ${name}`);
+        packages.push(entry);
+    }
+    return formatLock(old.map(item => {
+        if (item.header === 'importers:')
+            return { ...item, entries: section(old, 'importers').map(entry => (entry.name === importer ? importerEntry : entry)) };
+        if (item.header === 'packages:')
+            return { ...item, entries: packages.sort(byName) };
+        if (item.header === 'snapshots:')
+            return { ...item, entries: [...merged.values()].sort(byName) };
+        return item;
+    }));
+}
+/** Entries as keys and their content, per format; the importer's own entry under IMPORTER. */
+const IMPORTER = '\u0000importer';
+function entriesOf(format, text, importer) {
+    const out = new Map();
+    if (format === 'pnpm') {
+        for (const item of parseLock(text)) {
+            if (item.entries === null) {
+                out.set(`header ${item.header}`, item.raw.join('\n'));
+                continue;
+            }
+            for (const entry of item.entries) {
+                const name = item.header === 'importers:' && entry.name === importer ? IMPORTER : `${item.header} ${entry.name}`;
+                // The optional flag is the dependency's to clear (it now requires the package): compared without it.
+                out.set(name, entry.lines.filter(line => line !== '    optional: true').join('\n').replace(/: \{\}$/, ':'));
+            }
+        }
+    }
+    else if (format === 'npm') {
+        const packages = JSON.parse(text).packages ?? {};
+        for (const [key, value] of Object.entries(packages))
+            out.set(key === (importer === '.' ? '' : importer) ? IMPORTER : key, JSON.stringify(value));
+    }
+    else if (format === 'yarn') {
+        for (const block of text.split(/\n\s*\n/)) {
+            const lines = block.split('\n').filter(line => line.trim() !== '' && !line.startsWith('#'));
+            if (lines.length === 0 || /^\s/.test(lines[0]))
+                continue;
+            for (const descriptor of lines[0].replace(/:$/, '').split(/,\s*/)) {
+                const name = unquote(descriptor);
+                out.set(/@workspace:/.test(name) && name.endsWith(`@workspace:${importer}`) ? IMPORTER : name, lines.slice(1).join('\n'));
+            }
+        }
+    }
+    else {
+        const parsed = JSON.parse(text.replace(/,(\s*[}\]])/g, '$1'));
+        for (const [key, value] of Object.entries(parsed.workspaces ?? {}))
+            out.set(key === (importer === '.' ? '' : importer) ? IMPORTER : `workspace ${key}`, JSON.stringify(value));
+        for (const [key, value] of Object.entries(parsed.packages ?? {}))
+            out.set(`package ${key}`, JSON.stringify(value));
+    }
+    return out;
+}
+/** The entries both lockfiles list whose content adding `dependency` to `importer` changed, other than the importer's own
+ * and the dependency's own: what that must never touch. (An entry only an earlier version of the dependency used may go;
+ * a moved resolution always shows in the entries that reference it.) */
+export function lockfileDrift(format, before, after, importer, dependency) {
+    const a = entriesOf(format, before, importer);
+    const b = entriesOf(format, after, importer);
+    return [...a.entries()].filter(([key, value]) => key !== IMPORTER && !key.includes(dependency) && b.has(key) && b.get(key) !== value)
+        .map(([key]) => key);
+}

package/dist/commands/verify-onboarding.js

@@ -103,6 +103,12 @@ export function parseOnboardingStatus(value, expected) {
     if (!Array.isArray(value.services) || !value.services.every(service => isRecord(service) && typeof service.id === 'string'
         && SERVICE_ENGINES.includes(service.engine)))
         invalid('its services');
+    const review = value.review;
+    if (!(review === null || (isRecord(review) && (review.verdict === 'accept'
+        || (review.verdict === 'skipped' && typeof review.reason === 'string' && review.reason.length > 0)))))
+        invalid('its review');
+    if (value.state !== 'ready' && review !== null)
+        invalid('its review');
     if (value.block !== null)
         parseOnboardingBlock(value.block);
     const checkpoint = value.checkpoint;
@@ -311,8 +317,18 @@ export function formatOnboarding(status) {
     const outside = [...status.standIns, ...status.unsetProviders, ...standInGapNotes(status.standInGaps)];
     if (outside.length)
         lines.push('', ...outside.map(note => chalk.yellow(`Note: ${safe(note)}`)));
+    const unreviewed = reviewNotes(status.review);
+    if (unreviewed.length)
+        lines.push('', ...unreviewed.map(note => chalk.yellow(`Note: ${safe(note)}`)));
     return lines.join('\n');
 }
+/** Rule 17 (amendment 32): an onboarding the independent review skipped, as the sentence every result shows; none otherwise. */
+export function reviewNotes(review) {
+    if (review?.verdict !== 'skipped')
+        return [];
+    return [`This onboarding was NOT reviewed: the independent review that checks the setup did not cheat is turned off for this `
+            + `team (${review.reason}).`];
+}
 /** Rule 15(g), amendment 3: a stand-in gap as the sentence every result shows. */
 export function standInGapNotes(gaps) {
     return gaps.map(gap => `A stand-in could not serve ${gap} while onboarding signed in and did the workflow; the crawl may meet it too.`);

package/dist/commands/verify.js

@@ -31,7 +31,7 @@ import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSi
 import { GATEWAY_TIMEOUT_MS, gatewayFetch } from './case-batch.js';
 import { CRAWL_BRIEF_MAX_FUNCTIONS, CRAWL_BRIEF_MAX_GROUPS, CRAWL_BRIEF_MAX_PRODUCTION_ROWS, CRAWL_BUDGET_MAX_MS, CRAWL_BUDGET_MIN_MS, CRAWL_MAX_FINDINGS, CRAWL_MAX_FINDING_STEPS, CRAWL_MAX_IDEAS, CRAWL_MAX_STAND_IN_LINES, CRAWL_MAX_STAND_IN_ROWS, CRAWL_MAX_TEXT_CHARS, CRAWL_WAIT_MAX_MS, CRAWL_POOLS, } from './crawl-contract.js';
 import { captureCheckout, crawlUnavailableText, EXPLICIT_WALL_MS, normalModeFailure, postPrecomputeCapture, } from './verify-precompute.js';
-import { formatOnboarding, onboardingExitCode, readOnboardingStatus, reportOnboardingState, standInGapNotes, waitForOnboarding } from './verify-onboarding.js';
+import { formatOnboarding, onboardingExitCode, readOnboardingStatus, reportOnboardingState, reviewNotes, standInGapNotes, waitForOnboarding, } from './verify-onboarding.js';
 import { formatCapture, readPreVerifyCapture } from './capture-brief.js';
 const CRAWLS_PATH = '/api/agent/cloud-verifier/crawls';
 /** A held read (waitAfter): the service's hold, then the time any read gets. */
@@ -555,6 +555,52 @@ export function formatCrawl(view) {
     }
     return lines.join('\n');
 }
+export function verifyReport(view) {
+    const status = reportedStatus(view);
+    const published = results(view);
+    const error = published?.error ?? view.error;
+    const explored = published !== null && view.clocks.crawlStartedAt !== null;
+    const findings = explored ? VERDICTS.flatMap(verdict => published.findings.filter(finding => finding.verdict === verdict)) : [];
+    const ideaWords = { covered: 'tried', blocked: 'could not try', unfinished: 'not finished' };
+    return {
+        runId: view.runId,
+        repository: view.repository,
+        title: view.changeTitle,
+        baseCommit: view.baseCommit,
+        workCommit: view.workCommit,
+        status,
+        headline: headline(view),
+        bugs: published?.bugs ?? view.totals.bugs,
+        findings: findings.map(finding => ({
+            id: finding.id,
+            verdict: finding.verdict,
+            why: finding.why,
+            start: finding.start,
+            steps: finding.steps,
+            outsideServices: finding.standIns && (finding.standIns.old.length > 0 || finding.standIns.new.length > 0)
+                ? { withoutChange: finding.standIns.old, withChange: finding.standIns.new }
+                : null,
+        })),
+        spots: explored ? published.reach.spots.map(spot => ({
+            file: spot.file,
+            line: spot.line,
+            reached: spot.furthest === null ? 'never reached' : SPOT_WORDS[spot.furthest],
+            reachedBy: spot.reachedBy && { start: spot.reachedBy.start, steps: spot.reachedBy.steps, page: spot.reachedBy.page },
+            findingIds: spot.findingIds,
+        })) : [],
+        ideas: explored && published.ideas !== undefined
+            ? published.ideas.map(idea => ({ text: idea.text, result: ideaWords[idea.state], reason: idea.reason, findingIds: idea.findingIds }))
+            : null,
+        neverRan: explored ? {
+            files: published.reach.unreachedChangedFiles,
+            functions: published.reach.blast === null ? null : { ran: published.reach.blast.ran, total: published.reach.blast.functions },
+        } : null,
+        notFinishedInTime: explored ? published.notFinishedInTime : 0,
+        outsideServiceGaps: explored ? published.standIns?.gaps ?? [] : [],
+        error: error ? { code: error.code, message: error.message } : null,
+        machinesNotProvenShutDown: TERMINAL.has(view.status) ? view.totals.cleanupUnproven : 0,
+    };
+}
 /** Case-batch status conventions: 0 finished (or answered: amendment 9, its work
  * is done and only its shutdown remains), or still running with --no-wait;
  * 2 ended without finishing (incomplete, cancelled) or finished with cleanup
@@ -791,9 +837,9 @@ function checkedLine(change) {
 }
 /** Prints the onboarding (and nothing else) as the command's answer: `--json`
  * carries OnboardingStatusV1. A block exits 3: its ask says what to do. */
-function finishWithOnboarding(status, json, change) {
-    if (json)
-        process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding: status, crawl: null }), null, 2)}\n`);
+function finishWithOnboarding(status, options, change) {
+    if (options.json || options.raw)
+        printVerifyJson(options, change, status, null);
     else
         console.log(formatOnboarding(status));
     process.exitCode = onboardingExitCode(status);
@@ -997,7 +1043,7 @@ export async function preVerifyCommand(options) {
     if (options.wait !== false && briefOf(view) === null && !TERMINAL.has(reportedStatus(view)))
         view = await waitForBrief(view, identity, auth.token);
     const brief = briefOf(view);
-    // CAPTURE-V1 rule 7b: the routes the change touches, with their share of captured sessions; null without capture set up.
+    // CAPTURE-V1 rule 7b: the routes the change touches, with their share of captured sessions, per app; null without capture set up.
     const captured = await readPreVerifyCapture(findGitRoot(), identity.repository, auth.token, [...new Set([...(brief?.functions.map(fn => fn.file) ?? []), ...change.files])], new Date());
     if (options.json)
         finish(onboarding, view, captured);
@@ -1014,13 +1060,22 @@ export async function preVerifyCommand(options) {
                 : view.status === 'completed' ? 'It was checked before briefs existed and is not run again: change anything in the checkout and run `haystack pre-verify` again.'
                     : 'Run `haystack pre-verify` again to prepare it again.'));
     if (!options.json && captured !== null)
-        console.log(`\n${formatCapture(captured)}`);
+        for (const section of captured)
+            console.log(`\n${formatCapture(section)}`);
     if (brief === null && TERMINAL.has(reportedStatus(view)))
         process.exitCode = 2;
 }
+/** verify's one JSON document: the report (`--json`) or the service's whole record (`--raw`). */
+function printVerifyJson(options, change, onboarding, view) {
+    const document = options.raw
+        ? withSchema('verify-raw', { change, onboarding, crawl: view })
+        : withSchema('verify', { change, onboarding, crawl: view === null ? null : verifyReport(view) });
+    process.stdout.write(`${JSON.stringify(document, null, 2)}\n`);
+}
 export async function verifyCommand(options) {
+    const json = options.json || options.raw;
     // In --json mode stdout carries the one document; every other line goes to stderr.
-    const note = (line) => { if (options.json)
+    const note = (line) => { if (json)
         console.error(line);
     else
         console.log(line); };
@@ -1030,8 +1085,8 @@ export async function verifyCommand(options) {
     const change = checkedChange(request.baseCommit, request.workCommit);
     if (!request.crawl) {
         note(`Nothing to verify: this checkout has no changes against ${request.baseCommit.slice(0, 12)}.`);
-        if (options.json)
-            process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding: null, crawl: null }), null, 2)}\n`);
+        if (json)
+            printVerifyJson(options, change, null, null);
         return;
     }
     note(checkedLine(change));
@@ -1065,7 +1120,7 @@ export async function verifyCommand(options) {
                 reportOnboardingState(onboarding);
             }
             if (onboarding.state !== 'ready') {
-                finishWithOnboarding(onboarding, options.json, change);
+                finishWithOnboarding(onboarding, options, change);
                 return;
             }
             // Ready: the service admitted the waiting crawl when the record published; this
@@ -1075,8 +1130,8 @@ export async function verifyCommand(options) {
             note(submitted.line);
         }
         if (submitted.runId === null) {
-            if (options.json)
-                process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding, crawl: null }), null, 2)}\n`);
+            if (json)
+                printVerifyJson(options, change, onboarding, null);
             process.exitCode = 1;
             return;
         }
@@ -1089,12 +1144,12 @@ export async function verifyCommand(options) {
     if (options.wait !== false && !TERMINAL.has(reportedStatus(view))) {
         view = await waitForCrawl(view, identity, auth.token);
     }
-    if (options.json)
-        process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding, crawl: view }), null, 2)}\n`);
+    if (json)
+        printVerifyJson(options, change, onboarding, view);
     else {
         console.log(formatCrawl(view));
         const notes = [...(onboarding?.dataAbsences ?? []), ...(onboarding?.versionChoices ?? []), ...(onboarding?.standIns ?? []),
-            ...(onboarding?.unsetProviders ?? []), ...standInGapNotes(onboarding?.standInGaps ?? [])];
+            ...(onboarding?.unsetProviders ?? []), ...standInGapNotes(onboarding?.standInGaps ?? []), ...reviewNotes(onboarding?.review ?? null)];
         if (notes.length)
             console.log(['', ...notes.map(note => `Note: ${safe(note)}`)].join('\n'));
     }