@intentius/chant 0.124.13 → 0.124.15

package/dist/workspace/runtimes.js

@@ -0,0 +1,76 @@
+/**
+ * The runtimes a member's components can deploy on, for `chant workspace
+ * graph --composites` (#2674): the built-in `local` runtime, and every lexicon
+ * the member's `chant.config.ts` configures whose `opRuntime` hosts
+ * `chant run --components`. That is the list `chant run --components <name>
+ * --on <runtime>` accepts in the member's directory (`../cli/handlers/run.ts`),
+ * so a reader such as hud offers these and never guesses a runtime.
+ *
+ * `local` is the default. A configured default (`run.on`) is read once the
+ * config type has one; until then the command without `--on` runs locally.
+ *
+ * The config is read the way `chant run` reads it, from the member's
+ * directory, in the working tree or in the tree `--at` exported. Reading it
+ * runs the member's `chant.config.ts` and imports the lexicons it lists.
+ */
+import { join } from "node:path";
+import { lexiconNames } from "../lexicon-module.js";
+/** The runtime core provides, which `chant run` uses without `--on`. */
+export const LOCAL_RUNTIME = "local";
+/** Why a member's runtimes list only part of what its config names. Closed: part of the read contract. */
+export const RUNTIME_REASON_CODES = [
+    /** The member's chant.config.ts could not be read, so only local is listed. */
+    "runtimes-config-unreadable",
+    /** A configured lexicon could not be loaded, so it is not listed. */
+    "runtimes-lexicon-unreadable",
+];
+const firstLine = (err) => (err instanceof Error ? err.message : String(err)).split("\n")[0];
+/** Read the runtimes a member's config offers. `dir` is the member's directory on disk. */
+export async function readMemberRuntimes(dir, load) {
+    const reasons = [];
+    let names;
+    let environments;
+    try {
+        const { loadChantConfig } = await import("../config.js");
+        const { config } = await loadChantConfig(dir);
+        names = lexiconNames(config.lexicons ?? []);
+        environments = config.environments ?? [];
+    }
+    catch (err) {
+        return { lexicons: [], default: LOCAL_RUNTIME, reasons: [{ code: "runtimes-config-unreadable", message: `chant.config.ts: ${firstLine(err)}` }], environments: null };
+    }
+    const loader = load ?? (await import("../cli/plugins.js")).loadPlugin;
+    const lexicons = [];
+    for (const name of names) {
+        try {
+            const plugin = await loader(name);
+            if (plugin.opRuntime?.runComponents)
+                lexicons.push(name);
+        }
+        catch (err) {
+            reasons.push({ code: "runtimes-lexicon-unreadable", message: `lexicon "${name}": ${firstLine(err)}` });
+        }
+    }
+    return { lexicons, default: LOCAL_RUNTIME, reasons, environments };
+}
+/** The runtimes one component can deploy on, `local` first, each with its command line. */
+export function componentRuntimes(component, member) {
+    const def = member?.default ?? LOCAL_RUNTIME;
+    const entry = (name, lexicon) => ({
+        name,
+        lexicon,
+        default: name === def,
+        command: `chant run --components ${component}${name === LOCAL_RUNTIME ? "" : ` --on ${name}`}`,
+    });
+    return [entry(LOCAL_RUNTIME, null), ...(member?.lexicons ?? []).filter((l) => l !== LOCAL_RUNTIME).map((l) => entry(l, l))];
+}
+/** Read the runtimes of each member of kind chant, from the tree at `root`. */
+export async function readRuntimesIn(root, members, load) {
+    const out = new Map();
+    for (const m of members) {
+        if (m.kind !== "chant")
+            continue;
+        out.set(m.name, await readMemberRuntimes(m.dir === "." ? root : join(root, ...m.dir.split("/")), load));
+    }
+    return out;
+}

package/dist/workspace/session-kinds.js

@@ -0,0 +1,83 @@
+/**
+ * Finding review-session kinds and the commits a session names (#2693), for
+ * the commands that act on a session by its id: `records review --session`,
+ * `records close` and `records --since <session id>`.
+ *
+ * A session kind is found through the workspace declaration nearest above
+ * the working directory, or named directly. Nothing here writes.
+ */
+import { execFileSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { WorkspaceReadError } from "./declaration.js";
+import { gitRoot, resolveRevision } from "./record-source.js";
+import { loadRecordKind, RecordReadError, sessionSubjectKinds } from "./records.js";
+import { declaredKindFiles, realpathOr } from "./records-cli.js";
+/** The shape of an id `records --since` looks up as a session before reading it as a revision: `S-0002`, `ws-052`. */
+export const SESSION_ID = /^[A-Za-z][A-Za-z0-9]*-[0-9]+$/;
+/**
+ * Every session kind among `extra` (kind files, resolved against `cwd`) and
+ * the kinds the declaration nearest above `cwd` names, each once, in that
+ * order. A kind that can't be loaded, or a declaration that can't be read,
+ * adds nothing: the read of that kind reports it.
+ */
+export async function findSessionKinds(cwd, extra = []) {
+    const files = [...extra.map((f) => resolve(cwd, f))];
+    try {
+        files.push(...declaredKindFiles(cwd).map((k) => k.file));
+    }
+    catch (err) {
+        if (!(err instanceof WorkspaceReadError))
+            throw err;
+    }
+    const seen = new Set();
+    const out = [];
+    for (const f of files) {
+        const real = realpathOr(f);
+        if (seen.has(real))
+            continue;
+        seen.add(real);
+        try {
+            const loaded = await loadRecordKind(f, cwd);
+            if (loaded.kind.session)
+                out.push(loaded);
+        }
+        catch (err) {
+            if (!(err instanceof RecordReadError))
+                throw err;
+        }
+    }
+    return out;
+}
+/** The session kinds one of whose subject kinds (`session.subjects.kind` or `.kinds`) is the kind file `subjectFile`. */
+export async function sessionKindsFor(subjectFile, cwd) {
+    const target = realpathOr(resolve(cwd, subjectFile));
+    return (await findSessionKinds(cwd)).filter((k) => sessionSubjectKinds(k.kind.session).some((f) => realpathOr(resolve(dirname(k.file), f)) === target));
+}
+/** The full commit id HEAD names in the repository holding `dir`, or null outside git or before the first commit. */
+export function headCommit(dir) {
+    const top = gitRoot(realpathOr(dir));
+    if (!top)
+        return null;
+    try {
+        return resolveRevision(top, "HEAD");
+    }
+    catch (err) {
+        if (err instanceof RecordReadError)
+            return null;
+        throw err;
+    }
+}
+/**
+ * Commit ids from `git log <args> --format=%H -- <path>` in the repository at
+ * `top`, newest first; empty when git knows nothing of the path.
+ */
+export function commitsTouching(top, path, args) {
+    try {
+        return execFileSync("git", ["log", ...args, "--format=%H", "--", path], { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] })
+            .split("\n")
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}

package/dist/workspace/signers.schema.json

@@ -0,0 +1,206 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/signers/v1/signers.schema.json",
+  "title": "chant workspace signers output",
+  "description": "What `chant workspace signers --json` prints (#2553): the signer set's versions along the base revision's first-parent line, oldest first, each signed by a threshold of the one before, and where the chain breaks when it does. A commit is judged by the version in effect where it entered that line. Version 1 of the read contract. Readers ignore fields they do not know; a field is only ever added within a version. The codes are a closed list, each in the one closed list of `reason-codes.ts`.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/result"
+    },
+    {
+      "$ref": "#/$defs/failure"
+    }
+  ],
+  "$defs": {
+    "result": {
+      "type": "object",
+      "description": "The history was read. It exits 1 when `broken` is not null.",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "base",
+        "signersPath",
+        "versions",
+        "broken"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/signers/v1/signers.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string",
+          "description": "The chant version that printed the document."
+        },
+        "base": {
+          "type": "string",
+          "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$",
+          "description": "The full commit id of the base revision the history is read along."
+        },
+        "signersPath": {
+          "type": "string",
+          "description": "The signers file, from the repository root. Its rotation file is `<signersPath>.rotation.json`."
+        },
+        "versions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/version"
+          }
+        },
+        "broken": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/broken"
+            }
+          ]
+        }
+      }
+    },
+    "version": {
+      "type": "object",
+      "description": "One version of the signer set, made by one first-parent commit.",
+      "required": [
+        "version",
+        "commit",
+        "digest",
+        "threshold",
+        "principals",
+        "signedBy"
+      ],
+      "properties": {
+        "version": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "1 and up. 0 marks the commit that removed the signers file; nothing is in effect after it."
+        },
+        "commit": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$"
+            }
+          ],
+          "description": "The first-parent commit that made this version."
+        },
+        "digest": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^sha256:[0-9a-f]{64}$"
+            }
+          ],
+          "description": "sha256 of the signers file, line endings normalised. Null for version 0."
+        },
+        "threshold": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "How many distinct signers of this version must sign the next one."
+        },
+        "principals": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The principals the version lists, sorted."
+        },
+        "signedBy": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The principals of the version before whose signatures counted. Empty for the first version."
+        }
+      }
+    },
+    "broken": {
+      "type": "object",
+      "description": "The version that is not a valid rotation of the one before. Nothing verifies against this base.",
+      "required": [
+        "commit",
+        "code",
+        "message"
+      ],
+      "properties": {
+        "commit": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$"
+            }
+          ]
+        },
+        "code": {
+          "enum": [
+            "signers-removed",
+            "rotation-unparseable",
+            "rotation-invalid",
+            "rotation-first-version",
+            "rotation-missing",
+            "rotation-version-skew",
+            "rotation-previous-mismatch",
+            "rotation-threshold-unsatisfiable",
+            "rotation-threshold-not-met"
+          ]
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
+    "failure": {
+      "type": "object",
+      "description": "No history could be read. Exits 1.",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "error"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/signers/v1/signers.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string"
+        },
+        "error": {
+          "type": "object",
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "enum": [
+                "not-a-git-repository",
+                "revision-unknown",
+                "signers-file-missing"
+              ]
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/workspace/source-block.js

@@ -0,0 +1,125 @@
+/**
+ * A record's stored source block (#2708): where a proposal came from.
+ *
+ * chant's provenance (`trust/provenance.ts`) is computed from git: who
+ * committed a record, and with which key. It says nothing about the harness,
+ * model and session a decision was proposed in, or the conversation behind it.
+ * A record kind that declares `source: { field }` opts in to a stored block
+ * holding that, next to whatever else its source field says (a decision's
+ * issue row or workspace member, a work item's finding):
+ *
+ * - `via`: how the record reached the workspace, `cli`, `mcp` or `harvest`;
+ * - `client`: the MCP client's `clientInfo` (`name`, `version`), or the CLI;
+ * - `harness`: the harness's id, such as `claude-code` or `codex`;
+ * - `model`: the model id the harness reports;
+ * - `session`: the harness's session or conversation id, as a string, or as
+ *   `{ id, record }` with the chant session record it was held in (#2697);
+ * - `turns`: the turn range the decision was made in, `{ from, to }`;
+ * - `transcript`: `{ path | uri, sha256 }`, pinning a transcript by hash and
+ *   never copying it, the way evidence pins a file.
+ *
+ * Every field is optional, and the block is data about the proposal, not
+ * trust: nothing here raises or lowers a record's standing. The rules are
+ * three. The fields that are present must have these shapes
+ * (`record-schema-invalid` otherwise, beside the kind's own schema). A record
+ * written with `via: "harvest"` must open in the kind's first state, since a
+ * harvest proposes and a person decides (`source-harvest-not-proposed`, a
+ * write refusal). And `records` warns `source-transcript-drift` when the
+ * pinned transcript can be read here and its bytes hash to something else.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { sha256Hex } from "../content-digest.js";
+/** How a record reached the workspace. Closed. */
+export const SOURCE_VIAS = ["cli", "mcp", "harvest"];
+const text = z.string().min(1);
+const sha256 = z.string().regex(/^[0-9a-f]{64}$/, "must be the lowercase hex SHA-256 of the transcript's bytes");
+/** The proposal fields of a source block. Other fields of the block are the kind's, and left to its schema. */
+export const sourceBlockSchema = z.object({
+    via: z.enum(SOURCE_VIAS).optional(),
+    client: z.object({ name: text, version: text.optional(), title: text.optional() }).strict().optional(),
+    harness: text.optional(),
+    model: text.optional(),
+    session: z
+        .union([
+        text,
+        z.null(),
+        z
+            .object({ id: text.optional(), record: text.optional() })
+            .strict()
+            .refine((s) => s.id !== undefined || s.record !== undefined, { message: "names neither the harness's session id nor a chant session record" }),
+    ])
+        .optional(),
+    turns: z
+        .object({ from: z.number().int().min(0), to: z.number().int().min(0) })
+        .strict()
+        .refine((t) => t.to >= t.from, { message: "ends before it starts" })
+        .optional(),
+    transcript: z
+        .union([z.object({ path: text, sha256 }).strict(), z.object({ uri: text, sha256 }).strict()])
+        .optional(),
+});
+/** The source block of `data`, when `field` holds an object. */
+export function sourceBlock(data, field) {
+    const v = data?.[field];
+    return v !== null && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+}
+/** What is wrong with the proposal fields of `block`, as `<path> <message>` lines. Empty when nothing is. */
+export function sourceBlockProblems(block, field) {
+    const parsed = sourceBlockSchema.safeParse(block);
+    if (parsed.success)
+        return [];
+    return parsed.error.issues.map((i) => `/${[field, ...i.path].join("/")} ${i.message}`);
+}
+/**
+ * The file a transcript pin names, when it can be read here: a `path`
+ * (absolute, `~/` from the home directory, or else from the workspace root)
+ * or a `file:` URI. Any other URI is not fetched, so it is never reachable.
+ */
+export function transcriptFile(transcript, workspaceDir) {
+    if (transcript.path !== undefined) {
+        const p = transcript.path;
+        if (p === "~" || p.startsWith("~/"))
+            return join(homedir(), p.slice(1));
+        return isAbsolute(p) ? p : resolve(workspaceDir, p);
+    }
+    if (transcript.uri !== undefined && transcript.uri.startsWith("file:")) {
+        try {
+            return fileURLToPath(transcript.uri);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * The `source-transcript-drift` message for `block`, or undefined: when its
+ * transcript pin is well formed, the file it names can be read here, and its
+ * bytes hash to something other than the pin. A transcript that can't be
+ * read says nothing either way.
+ */
+export function transcriptDrift(block, field, workspaceDir) {
+    const parsed = sourceBlockSchema.shape.transcript.safeParse(block.transcript);
+    if (!parsed.success || parsed.data === undefined)
+        return undefined;
+    const t = parsed.data;
+    const file = transcriptFile(t, workspaceDir);
+    if (file === undefined)
+        return undefined;
+    let bytes;
+    try {
+        bytes = readFileSync(file);
+    }
+    catch {
+        return undefined;
+    }
+    const actual = sha256Hex(bytes);
+    if (actual === t.sha256)
+        return undefined;
+    const named = t.path ?? t.uri;
+    return `${field}.transcript ${named} is pinned at sha256 ${t.sha256.slice(0, 12)}, and the file here hashes to ${actual.slice(0, 12)}: it is not the transcript the record means`;
+}

package/dist/workspace/squash.js

@@ -0,0 +1,177 @@
+/**
+ * Following a squash merge to the pull request's original commits (#3035,
+ * ws-092).
+ *
+ * A squash merge folds a pull request's commits into one new commit, and with
+ * them the trailers and signatures that joined each to its run and its work.
+ * The forge keeps the originals: GitHub and Forgejo both keep a pull
+ * request's head at `refs/pull/<n>/head` on the remote. A read that is asked
+ * to follow squashes (`--follow-squash`) looks for that ref locally, fetches
+ * the missing ones from `origin` in one `git fetch`, and keeps what it
+ * fetched under `refs/chant/pull/<n>/head`, so the next read needs no network.
+ * Without the flag nothing here runs, and a read never touches the network
+ * (studio-032 b: follow only when asked).
+ *
+ * A commit is followed as a squash when its subject ends with `(#<n>)`, as
+ * GitHub and Forgejo write a squash's subject, it has one parent, and the
+ * pull request's head is not already in its history (a merge commit or a
+ * rebase keeps the originals, so there is nothing to follow). Its original
+ * commits are the head's commits that the squash's parent does not have,
+ * oldest first. When the ref can't be read or fetched, the read says so and
+ * keeps its answer without them.
+ */
+import { execFileSync } from "node:child_process";
+/** Where a read keeps the pull request heads it fetched. */
+export const PULL_CACHE_PREFIX = "refs/chant/pull/";
+/** The remote a squash's pull request ref is fetched from. */
+export const SQUASH_REMOTE = "origin";
+/** How long one fetch of pull request refs may take. */
+const FETCH_TIMEOUT_MS = 60000;
+function git(top, args, opts = {}) {
+    try {
+        return execFileSync("git", args, {
+            cwd: top,
+            encoding: "utf-8",
+            input: opts.input,
+            timeout: opts.timeout,
+            stdio: [opts.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+            maxBuffer: 256 * 1024 * 1024,
+            // A fetch must never wait on a credential prompt.
+            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The pull request number a squash's subject ends with, `(#<n>)`, or null. */
+export function pullRequestOf(subject) {
+    const m = subject.match(/\(#([0-9]+)\)\s*$/);
+    return m ? Number(m[1]) : null;
+}
+/**
+ * The forge a remote URL points at: `github` for github.com and GitHub
+ * Enterprise hosts named for it, `forgejo` for codeberg.org and hosts named
+ * forgejo or gitea. Null for any other, which is still read at
+ * `refs/pull/<n>/head`, the ref both keep.
+ */
+export function forgeOf(url) {
+    if (!url)
+        return null;
+    const host = (url.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]*@)?([^/:]+)/i)?.[1] ?? url.match(/^(?:[^@/]*@)?([^/:]+):/)?.[1] ?? "").toLowerCase();
+    if (host === "github.com" || host.endsWith(".github.com") || /(^|[.-])github([.-]|$)/.test(host))
+        return "github";
+    if (host === "codeberg.org" || /(^|[.-])(forgejo|gitea)([.-]|$)/.test(host))
+        return "forgejo";
+    return null;
+}
+/** The pull request ref a forge keeps for `n`. GitHub and Forgejo keep the same one. */
+export function pullRef(_forge, n) {
+    return `refs/pull/${n}/head`;
+}
+const commitOf = (top, rev) => git(top, ["rev-parse", "--verify", "--quiet", `${rev}^{commit}`])?.trim() || undefined;
+/** The local ref holding pull request `n`'s head: chant's cache, the forge's own ref, or a `refs/remotes/<remote>/pr/<n>` mirror. */
+function localPullRef(top, forge, n) {
+    for (const ref of [`${PULL_CACHE_PREFIX}${n}/head`, pullRef(forge, n), `refs/remotes/${SQUASH_REMOTE}/pr/${n}`]) {
+        const head = commitOf(top, ref);
+        if (head)
+            return { ref, head };
+    }
+    return undefined;
+}
+/** Fetch each pull request's head into chant's cache, all in one fetch and then one by one if that fails. The numbers fetched. */
+function fetchPullRefs(top, forge, numbers) {
+    const spec = (n) => `+${pullRef(forge, n)}:${PULL_CACHE_PREFIX}${n}/head`;
+    const fetchRefs = (ns) => git(top, ["fetch", "--no-tags", "--quiet", "--no-write-fetch-head", SQUASH_REMOTE, ...ns.map(spec)], { timeout: FETCH_TIMEOUT_MS }) !== undefined;
+    if (numbers.length === 0)
+        return new Set();
+    if (fetchRefs(numbers))
+        return new Set(numbers);
+    // One missing ref fails the whole fetch; the others may still be there.
+    return new Set(numbers.length === 1 ? [] : numbers.filter((n) => fetchRefs([n])));
+}
+/**
+ * Follow each squash commit among `commits` to its pull request's original
+ * commits (#3035). A commit that is not a squash (no `(#<n>)` subject, a
+ * merge, or a head already in its history) is left out of the result. With
+ * `fetchMissing`, a pull request ref missing locally is fetched from `origin`;
+ * without it, only refs already present are read.
+ */
+export function followSquashes(top, commits, opts) {
+    const out = new Map();
+    const candidates = commits.map((c) => ({ sha: c.sha, n: pullRequestOf(c.subject) })).filter((c) => c.n !== null);
+    if (candidates.length === 0)
+        return out;
+    const parents = new Map();
+    for (const line of (git(top, ["log", "--no-walk=unsorted", "--stdin", "--format=%H %P"], { input: `${candidates.map((c) => c.sha).join("\n")}\n` }) ?? "").split("\n")) {
+        const [sha, ...ps] = line.trim().split(/\s+/);
+        if (sha)
+            parents.set(sha, ps);
+    }
+    const squashes = candidates.filter((c) => parents.get(c.sha)?.length === 1);
+    if (squashes.length === 0)
+        return out;
+    const url = git(top, ["config", "--get", `remote.${SQUASH_REMOTE}.url`])?.trim() || null;
+    const forge = forgeOf(url);
+    const local = new Map();
+    for (const n of new Set(squashes.map((c) => c.n))) {
+        const hit = localPullRef(top, forge, n);
+        if (hit)
+            local.set(n, hit);
+    }
+    const missing = [...new Set(squashes.map((c) => c.n))].filter((n) => !local.has(n));
+    const fetched = opts.fetchMissing && url ? fetchPullRefs(top, forge, missing) : new Set();
+    for (const n of fetched) {
+        const head = commitOf(top, `${PULL_CACHE_PREFIX}${n}/head`);
+        if (head)
+            local.set(n, { ref: `${PULL_CACHE_PREFIX}${n}/head`, head });
+    }
+    for (const c of squashes) {
+        const hit = local.get(c.n);
+        const base = { sha: c.sha, pullRequest: c.n, forge, ref: null, head: null, fetched: false, followed: false, commits: [], problem: null };
+        if (!hit) {
+            const problem = !opts.fetchMissing
+                ? `${pullRef(forge, c.n)} is not in this clone`
+                : !url
+                    ? `there is no ${SQUASH_REMOTE} remote to fetch ${pullRef(forge, c.n)} from`
+                    : `${pullRef(forge, c.n)} could not be fetched from ${SQUASH_REMOTE}: the forge has no such ref, or it can't be reached`;
+            out.set(c.sha, { ...base, problem });
+            continue;
+        }
+        // A head already in the commit's history was merged or rebased, not squashed: nothing to follow.
+        if (git(top, ["merge-base", "--is-ancestor", hit.head, c.sha]) !== undefined)
+            continue;
+        const parent = parents.get(c.sha)[0];
+        const list = git(top, ["rev-list", "--reverse", "--no-merges", hit.head, `^${parent}`]);
+        if (list === undefined) {
+            out.set(c.sha, { ...base, ref: hit.ref, head: hit.head, fetched: fetched.has(c.n), problem: `the commits of ${hit.ref} could not be listed` });
+            continue;
+        }
+        const originals = list.split("\n").map((s) => s.trim()).filter(Boolean);
+        out.set(c.sha, { ...base, ref: hit.ref, head: hit.head, fetched: fetched.has(c.n), followed: true, commits: originals });
+    }
+    return out;
+}
+/**
+ * For the lines of `path` in a squash commit: which original commit last wrote
+ * each, by `git blame` at the pull request's head, when the file there is the
+ * same as in the squash (#3035). Undefined when it is not, since the lines
+ * then don't correspond one to one.
+ */
+export function squashLineOrigins(top, squash, head, path, originals) {
+    const a = git(top, ["rev-parse", "--verify", "--quiet", `${squash}:${path}`])?.trim();
+    const b = git(top, ["rev-parse", "--verify", "--quiet", `${head}:${path}`])?.trim();
+    if (!a || a !== b)
+        return undefined;
+    const out = git(top, ["blame", "--porcelain", head, "--", path]);
+    if (out === undefined)
+        return undefined;
+    const lines = new Map();
+    // Every line has a header, `<sha> <line in that commit> <line now>`, with a count after it on a group's first.
+    for (const l of out.split("\n")) {
+        const m = l.match(/^([0-9a-f]{40,64}) \d+ (\d+)(?: \d+)?$/);
+        if (m && originals.has(m[1]))
+            lines.set(Number(m[2]), m[1]);
+    }
+    return lines;
+}