@milesroxas/design-hub 0.0.0-stage → 0.1.1

package/core/image.test.ts

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { imageSize } from './image.ts';
+
+test('reads a PNG header', () => {
+  const png = new Uint8Array(33);
+  png.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+  png.set([0, 0, 3, 0x20, 0, 0, 2, 0x58], 16);
+  assert.deepEqual(imageSize(png), { width: 800, height: 600, format: 'png' });
+});
+
+test('reads a JPEG frame header past a segment, a restart marker and a fill byte', () => {
+  const app0 = [0xff, 0xe0, 0x00, 0x04, 0x00, 0x00];
+  const restart = [0xff, 0xd3];
+  const sof0 = [0xff, 0xc0, 0x00, 0x11, 0x08, 0x02, 0x58, 0x03, 0x20, 0x03, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+  const jpg = new Uint8Array([0xff, 0xd8, ...app0, ...restart, 0xff, ...sof0]);
+  assert.deepEqual(imageSize(jpg), { width: 800, height: 600, format: 'jpg' });
+});
+
+test('is null for anything else', () => {
+  assert.equal(imageSize(new TextEncoder().encode('GIF89a........................')), null);
+});

package/core/image.ts

@@ -0,0 +1,37 @@
+// Pixel size from an image's header, without decoding it: PNG from its IHDR
+// chunk, JPEG from its first frame header. The walkthrough compiler sizes
+// figures with it, and the visual match checks TypeSafe's image limits.
+
+export type ImageSize = { width: number; height: number; format: 'png' | 'jpg' };
+
+const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+
+const u16 = (b: Uint8Array, i: number) => (b[i] << 8) | b[i + 1];
+const u32 = (b: Uint8Array, i: number) =>
+  ((b[i] << 24) | (b[i + 1] << 16) | (b[i + 2] << 8) | b[i + 3]) >>> 0;
+
+function pngSize(b: Uint8Array): ImageSize | null {
+  if (b.length < 24 || PNG_SIGNATURE.some((v, i) => b[i] !== v)) return null;
+  return { width: u32(b, 16), height: u32(b, 20), format: 'png' };
+}
+
+// Markers with no length field: start of image, TEM, and the restart markers.
+const standalone = (m: number) => m === 0xd8 || m === 0x01 || (m >= 0xd0 && m <= 0xd7);
+// SOF0 to SOF15 carry the frame size, except DHT (C4), JPG (C8) and DAC (CC).
+const frame = (m: number) => m >= 0xc0 && m <= 0xcf && m !== 0xc4 && m !== 0xc8 && m !== 0xcc;
+
+function jpegSize(b: Uint8Array): ImageSize | null {
+  if (b[0] !== 0xff || b[1] !== 0xd8) return null;
+  let i = 2;
+  while (i + 9 < b.length) {
+    const marker = b[i + 1];
+    // A byte that is not a marker, or 0xFF fill before one, moves on by one.
+    if (b[i] !== 0xff || marker === 0xff) i += 1;
+    else if (standalone(marker)) i += 2;
+    else if (frame(marker)) return { height: u16(b, i + 5), width: u16(b, i + 7), format: 'jpg' };
+    else i += 2 + u16(b, i + 2);
+  }
+  return null;
+}
+
+export const imageSize = (bytes: Uint8Array): ImageSize | null => pngSize(bytes) ?? jpegSize(bytes);

package/core/jev.test.ts

@@ -0,0 +1,66 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { askJev, choiceOf, noulOf } from './jev.ts';
+
+const request = {
+  model: 'jev-1.14.0',
+  state: { a: 1 },
+  questions: { q: { type: 'noul', instructions: 'Is a 1?' } },
+} as const;
+const reply = (status: number, body: unknown, headers: Record<string, string> = {}) =>
+  (async () => new Response(JSON.stringify(body), { status, headers })) as unknown as typeof fetch;
+
+test('returns the answers and the model that gave them', async () => {
+  const r = await askJev('k', request, {
+    timeoutMs: 1000,
+    fetch: reply(200, { model: 'jev-1.14.0', answers: { q: { type: 'noul', noul: 0.9 } } }),
+  });
+  assert.ok(r.ok);
+  assert.equal(noulOf(r.answers, 'q'), 0.9);
+  assert.equal(r.model, 'jev-1.14.0');
+});
+
+test('fails open on an HTTP error, naming the status and request id', async () => {
+  const r = await askJev('bad', request, {
+    timeoutMs: 1000,
+    fetch: reply(401, { detail: 'nope' }, { 'x-typesafe-request-id': 'req_1' }),
+  });
+  assert.equal(r.ok, false);
+  assert.match(!r.ok ? r.error : '', /^401 \(req_1\)/);
+});
+
+test('fails open on a timeout', async () => {
+  const hang = ((_: unknown, init: RequestInit) =>
+    new Promise((_, reject) =>
+      init.signal?.addEventListener('abort', () => reject(init.signal?.reason)),
+    )) as typeof fetch;
+  const r = await askJev('k', request, { timeoutMs: 20, fetch: hang });
+  assert.deepEqual(r.ok ? null : r.error, 'timeout after 20ms');
+});
+
+test('sends the images header only when there are assets', async () => {
+  let sent: Headers | undefined;
+  const capture = (async (_: unknown, init: RequestInit) => {
+    sent = new Headers(init.headers);
+    return new Response(JSON.stringify({ answers: {} }));
+  }) as typeof fetch;
+  await askJev('k', request, { timeoutMs: 1000, fetch: capture });
+  assert.equal(sent?.get('typesafe-danger-zone-images'), null);
+  await askJev(
+    'k',
+    { ...request, assets: { img: { type: 'image', format: 'png', data_base64: 'AA==' } } },
+    {
+      timeoutMs: 1000,
+      fetch: capture,
+    },
+  );
+  assert.equal(sent?.get('typesafe-danger-zone-images'), 'true');
+});
+
+test('reads answers by type and ignores the wrong type', () => {
+  const answers = {
+    c: { type: 'choice', choice: 'bug', confidence: 0.5, probabilities: { bug: 0.7 } },
+  } as const;
+  assert.equal(choiceOf(answers, 'c')?.choice, 'bug');
+  assert.equal(noulOf(answers, 'c'), null);
+});

package/core/jev.ts

@@ -0,0 +1,77 @@
+// One client for TypeSafe's Jev (System One), on plain fetch, so the same
+// code runs in the scripts and in the Vercel server code with no SDK to
+// install. API: https://docs.typesafe.ai/api/system-one.md
+//
+// It never throws and never retries. Every caller treats a failure the same
+// way, fail open: a check is never the reason the user is blocked, and a
+// retry would only spend the latency budget the caller set.
+
+const JEV_URL = 'https://api.typesafe.ai/v1/systemone';
+
+export type Question =
+  | { type: 'noul'; instructions: string }
+  | { type: 'choice'; instructions: string; criteria: Record<string, string | null> };
+
+export type Answer =
+  | { type: 'noul'; noul: number }
+  | { type: 'choice'; choice: string; confidence: number; probabilities: Record<string, number> };
+
+/** An image the state or a question refers to by its key. Experimental on TypeSafe's side. */
+export type ImageAsset = { type: 'image'; format: 'png' | 'jpg' | 'jpeg'; data_base64: string };
+
+export type JevRequest = {
+  model: string;
+  state: unknown;
+  questions: Record<string, Question>;
+  assets?: Record<string, ImageAsset>;
+};
+
+export type JevResult =
+  | { ok: true; model: string; answers: Record<string, Answer>; ms: number }
+  | { ok: false; error: string; ms: number };
+
+type Options = { timeoutMs: number; fetch?: typeof fetch };
+
+export async function askJev(apiKey: string, request: JevRequest, options: Options): Promise<JevResult> {
+  const started = Date.now();
+  const ms = () => Date.now() - started;
+  const headers: Record<string, string> = {
+    authorization: `Bearer ${apiKey}`,
+    'content-type': 'application/json',
+    accept: 'application/json',
+  };
+  // Images sit behind TypeSafe's "danger zone" header; without it the request is a 400.
+  if (request.assets && Object.keys(request.assets).length) headers['typesafe-danger-zone-images'] = 'true';
+  try {
+    const response = await (options.fetch ?? fetch)(JEV_URL, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(request),
+      signal: AbortSignal.timeout(options.timeoutMs),
+    });
+    if (!response.ok) {
+      const id = response.headers.get('x-typesafe-request-id');
+      const body = (await response.text()).slice(0, 300);
+      return { ok: false, error: `${response.status}${id ? ` (${id})` : ''}: ${body}`, ms: ms() };
+    }
+    const json = (await response.json()) as { model?: string; answers?: Record<string, Answer> };
+    if (!json.answers) return { ok: false, error: 'response had no answers', ms: ms() };
+    return { ok: true, model: json.model ?? request.model, answers: json.answers, ms: ms() };
+  } catch (error) {
+    const name = error instanceof Error ? error.name : '';
+    const error_ = name === 'TimeoutError' ? `timeout after ${options.timeoutMs}ms` : String(error);
+    return { ok: false, error: error_, ms: ms() };
+  }
+}
+
+/** The yes-probability of a Noul answer, or null when it is missing or another type. */
+export const noulOf = (answers: Record<string, Answer>, key: string): number | null => {
+  const a = answers[key];
+  return a?.type === 'noul' && typeof a.noul === 'number' ? a.noul : null;
+};
+
+/** A Choice answer, or null when it is missing or another type. */
+export const choiceOf = (answers: Record<string, Answer>, key: string) => {
+  const a = answers[key];
+  return a?.type === 'choice' ? a : null;
+};

package/core/review/model.ts

@@ -0,0 +1,189 @@
+// The review domain: people who may comment on the deployed prototypes, and
+// the comments they leave, pinned to a prototype, its state and an element.
+// Pure: no I/O, no environment. Every limit and rule lives here once and is
+// enforced by the service, whichever adapter (Vercel, Vite dev, the CLI)
+// calls it.
+
+import { SLUG } from '../feature.ts';
+
+export const ROLES = ['editor', 'reviewer'] as const;
+export type Role = (typeof ROLES)[number];
+
+/** How a comment is triaged: something broken, a design opinion, or the words. */
+export const KINDS = ['bug', 'taste', 'copy'] as const;
+export type Kind = (typeof KINDS)[number];
+
+/** How long an invite link signs its person in before an editor must issue a new one. */
+export const INVITE_DAYS = 14;
+
+export const LIMITS = {
+  name: 80,
+  team: 80,
+  body: 4000,
+  url: 2000,
+  target: 500,
+  dialsChars: 8000,
+  states: 50,
+  stateName: 120,
+} as const;
+
+export type Person = {
+  id: string;
+  name: string;
+  /** The group a person belongs to, shown beside their name: the studio, or the client's company. */
+  team: string;
+  role: Role;
+  createdAt: string;
+  revokedAt: string | null;
+  /** Bumped on revoke and on a new invite, which signs out every session signed with the old one. */
+  epoch: number;
+};
+
+/** A comment's author as it was when they wrote it, so a revoked person's comments still read. */
+export type Author = Pick<Person, 'id' | 'name' | 'team'>;
+
+export type Anchor = {
+  prototype: string;
+  feature: string;
+  /** Path, query and hash when the comment was written: reopening it reopens the state. */
+  url: string;
+  /** Every dial panel's values by panel name, so the state includes what the dials were set to. */
+  dials: Record<string, Record<string, unknown>>;
+  /** A CSS selector for the element the pin sits on, or null for the page as a whole. */
+  target: string | null;
+  /** Where on the target, as fractions of its box. */
+  offset: { x: number; y: number } | null;
+  viewport: { width: number; height: number };
+};
+
+export type Triage = {
+  kind: Kind | null;
+  /** A row of the prototype README's States table. */
+  state: string | null;
+  by: 'jev' | 'person';
+  confidence: number | null;
+};
+
+export type Comment = {
+  id: string;
+  /** The root comment's id; a root's thread is its own id. */
+  thread: string;
+  author: Author;
+  body: string;
+  createdAt: string;
+  editedAt: string | null;
+  /** Roots only. */
+  anchor: Anchor | null;
+  status: 'open' | 'resolved';
+  resolvedBy: Author | null;
+  triage: Triage | null;
+};
+
+export const authorOf = (p: Person): Author => ({ id: p.id, name: p.name, team: p.team });
+export const isRoot = (c: Comment) => c.thread === c.id;
+
+// Every input from outside goes through one of these checks.
+
+export type Checked<T> = { ok: true; value: T } | { ok: false; problems: string[] };
+
+const text = (v: unknown, path: string, max: number, problems: string[]): string => {
+  if (typeof v !== 'string' || !v.trim()) {
+    problems.push(`${path}: required`);
+    return '';
+  }
+  const s = v.trim();
+  if (s.length > max) problems.push(`${path}: ${max} characters at most`);
+  return s;
+};
+
+const fraction = (v: unknown) => typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 1;
+const size = (v: unknown) => typeof v === 'number' && Number.isFinite(v) && v >= 0 && v < 100_000;
+
+export function checkPersonInput(input: unknown): Checked<Pick<Person, 'name' | 'team' | 'role'>> {
+  const i = (input ?? {}) as Record<string, unknown>;
+  const problems: string[] = [];
+  const name = text(i.name, 'name', LIMITS.name, problems);
+  const team = text(i.team, 'team', LIMITS.team, problems);
+  const role = i.role ?? 'reviewer';
+  if (!ROLES.includes(role as Role)) problems.push(`role: one of ${ROLES.join(', ')}`);
+  return problems.length ? { ok: false, problems } : { ok: true, value: { name, team, role: role as Role } };
+}
+
+export function checkBody(body: unknown): Checked<string> {
+  const problems: string[] = [];
+  const value = text(body, 'body', LIMITS.body, problems);
+  return problems.length ? { ok: false, problems } : { ok: true, value };
+}
+
+const isSlug = (v: unknown) => typeof v === 'string' && SLUG.test(v);
+const isObject = (v: unknown): v is Record<string, unknown> =>
+  !!v && typeof v === 'object' && !Array.isArray(v);
+
+/** One rule per field: the field, whether a value passes, and what the field must be. */
+const ANCHOR_RULES: [keyof Anchor, (v: unknown) => boolean, string][] = [
+  ['prototype', isSlug, 'a prototype slug'],
+  ['feature', (v) => v === '' || isSlug(v), 'a feature slug or empty'],
+  [
+    'url',
+    (v) => typeof v === 'string' && v.startsWith('/') && v.length <= LIMITS.url,
+    `a path starting with /, ${LIMITS.url} characters at most`,
+  ],
+  [
+    'dials',
+    (v) => isObject(v) && JSON.stringify(v).length <= LIMITS.dialsChars,
+    `an object of panels, ${LIMITS.dialsChars} characters at most`,
+  ],
+  [
+    'target',
+    (v) => v === null || (typeof v === 'string' && v.length <= LIMITS.target),
+    `a selector, ${LIMITS.target} characters at most, or null`,
+  ],
+  [
+    'offset',
+    (v) => v === null || (isObject(v) && fraction(v.x) && fraction(v.y)),
+    'x and y from 0 to 1, or null',
+  ],
+  ['viewport', (v) => isObject(v) && size(v.width) && size(v.height), 'width and height in pixels'],
+];
+
+export function checkAnchor(input: unknown): Checked<Anchor> {
+  const given = isObject(input) ? input : {};
+  // Absent optional fields take their empty form before the rules run.
+  const a: Record<string, unknown> = { dials: {}, target: null, offset: null, ...given };
+  const problems = ANCHOR_RULES.filter(([key, passes]) => !passes(a[key])).map(
+    ([key, , must]) => `anchor.${key}: ${must}`,
+  );
+  if (problems.length) return { ok: false, problems };
+  // Every rule passed, so each field holds its Anchor type.
+  const { prototype, feature, url, dials, target, offset, viewport } = a as unknown as Anchor;
+  return { ok: true, value: { prototype, feature, url, dials, target, offset, viewport } };
+}
+
+/** The README states a client offers for triage: trimmed, capped, de-duplicated. */
+export function checkStates(input: unknown): string[] {
+  if (!Array.isArray(input)) return [];
+  const names = input
+    .filter((s): s is string => typeof s === 'string')
+    .map((s) => s.trim().slice(0, LIMITS.stateName));
+  return [...new Set(names.filter(Boolean))].slice(0, LIMITS.states);
+}
+
+export function checkTriage(
+  input: unknown,
+  states: string[] | null,
+): Checked<Pick<Triage, 'kind' | 'state'>> {
+  const t = (input ?? {}) as Record<string, unknown>;
+  const problems: string[] = [];
+  const kind = t.kind ?? null;
+  if (kind !== null && !KINDS.includes(kind as Kind))
+    problems.push(`triage.kind: one of ${KINDS.join(', ')}, or null`);
+  const state = t.state ?? null;
+  if (
+    state !== null &&
+    (typeof state !== 'string' || state.length > LIMITS.stateName || (states && !states.includes(state)))
+  )
+    problems.push('triage.state: a row of the States table, or null');
+  return problems.length
+    ? { ok: false, problems }
+    : { ok: true, value: { kind: kind as Kind | null, state: state as string | null } };
+}

package/core/review/policy.ts

@@ -0,0 +1,26 @@
+// Who may do what. Editors run the review: they invite and revoke people,
+// resolve any thread and correct triage. Reviewers comment, reply, and edit
+// or delete what they wrote, and resolve threads they started. A revoked
+// person, or a visitor with only the shared password, may do nothing here.
+import type { Comment, Person } from './model.ts';
+
+export type Action = 'read' | 'comment' | 'edit' | 'delete' | 'resolve' | 'triage' | 'people';
+
+export function can(actor: Person | null, action: Action, subject?: Comment): boolean {
+  if (!actor || actor.revokedAt) return false;
+  const editor = actor.role === 'editor';
+  const own = subject?.author.id === actor.id;
+  switch (action) {
+    case 'read':
+    case 'comment':
+      return true;
+    case 'edit':
+      return own;
+    case 'delete':
+    case 'resolve':
+      return own || editor;
+    case 'triage':
+    case 'people':
+      return editor;
+  }
+}

package/core/review/service.test.ts

@@ -0,0 +1,163 @@
+import assert from 'node:assert/strict';
+import { beforeEach, test } from 'node:test';
+import type { Anchor, Person } from './model.ts';
+import { createReview, type Review, ReviewError } from './service.ts';
+import { memoryKV } from './store.ts';
+
+const anchor: Anchor = {
+  prototype: 'sample-list',
+  feature: 'sample',
+  url: '/sample-list/#/items',
+  dials: { Review: { fixtures: 'empty' } },
+  target: 'main > ul > li:nth-child(2)',
+  offset: { x: 0.5, y: 0.25 },
+  viewport: { width: 1440, height: 900 },
+};
+
+let clock = 0;
+let review: Review;
+let editor: Person;
+let reviewer: Person;
+let reviewerToken: string;
+
+const rejects = (p: Promise<unknown>, code: string) =>
+  assert.rejects(p, (e: unknown) => e instanceof ReviewError && e.code === code);
+
+beforeEach(async () => {
+  clock = Date.parse('2030-01-01T00:00:00Z');
+  review = createReview(memoryKV(), {
+    now: () => {
+      clock += 1000;
+      return new Date(clock);
+    },
+  });
+  const root = {
+    id: 'cli',
+    name: 'CLI',
+    team: 'Studio',
+    role: 'editor',
+    createdAt: '',
+    revokedAt: null,
+    epoch: 0,
+  } as Person;
+  editor = (await review.invite(root, { name: 'Ed', team: 'Studio', role: 'editor' })).person;
+  const r = await review.invite(editor, { name: 'Rae', team: 'Acme' });
+  reviewer = r.person;
+  reviewerToken = r.token;
+});
+
+test('an invite signs its person in until it is reissued or revoked', async () => {
+  assert.equal((await review.acceptInvite(reviewerToken))?.id, reviewer.id);
+  const { token } = await review.reissue(editor, reviewer.id);
+  assert.equal(await review.acceptInvite(reviewerToken), null);
+  assert.equal((await review.acceptInvite(token))?.epoch, 1);
+  await review.revoke(editor, reviewer.id);
+  assert.equal(await review.acceptInvite(token), null);
+});
+
+test('a reissue or revoke ends every session signed with the old epoch', async () => {
+  assert.ok(await review.sessionPerson(reviewer.id, 0));
+  await review.reissue(editor, reviewer.id);
+  assert.equal(await review.sessionPerson(reviewer.id, 0), null);
+  assert.ok(await review.sessionPerson(reviewer.id, 1));
+  await review.revoke(editor, reviewer.id);
+  assert.equal(await review.sessionPerson(reviewer.id, 2), null);
+});
+
+test('an invite expires', async () => {
+  clock += 15 * 86_400_000;
+  assert.equal(await review.acceptInvite(reviewerToken), null);
+});
+
+test('only editors manage people, and nobody revokes themselves', async () => {
+  await rejects(review.invite(reviewer, { name: 'X', team: 'Acme' }), 'forbidden');
+  await rejects(review.listPeople(null), 'unauthorized');
+  await rejects(review.revoke(editor, editor.id), 'invalid');
+  assert.deepEqual(
+    (await review.listPeople(editor)).map((p) => p.name),
+    ['Rae', 'Ed'],
+  );
+});
+
+test('a comment, its replies, resolving and deleting the thread', async () => {
+  const root = await review.add(reviewer, { body: '  Row height jumps on empty  ', anchor });
+  assert.equal(root.body, 'Row height jumps on empty');
+  await review.reply(editor, { prototype: 'sample-list', thread: root.id, body: 'Fixed in v2' });
+  assert.equal((await review.listComments(reviewer, 'sample-list')).length, 2);
+  const done = await review.resolve(reviewer, { prototype: 'sample-list', id: root.id, resolved: true });
+  assert.equal(done.resolvedBy?.id, reviewer.id);
+  assert.deepEqual((await review.remove(reviewer, { prototype: 'sample-list', id: root.id })).length, 2);
+  assert.deepEqual(await review.listComments(editor, 'sample-list'), []);
+});
+
+test('people edit only their own words; editors resolve and triage anything', async () => {
+  const c = await review.add(reviewer, { body: 'Typo in header', anchor });
+  await rejects(review.edit(editor, { prototype: 'sample-list', id: c.id, body: 'x' }), 'forbidden');
+  const other = (await review.invite(editor, { name: 'Oz', team: 'Acme' })).person;
+  await rejects(review.resolve(other, { prototype: 'sample-list', id: c.id, resolved: true }), 'forbidden');
+  await rejects(
+    review.retriage(reviewer, { prototype: 'sample-list', id: c.id, triage: { kind: 'copy' } }),
+    'forbidden',
+  );
+  const t = await review.retriage(editor, {
+    prototype: 'sample-list',
+    id: c.id,
+    triage: { kind: 'copy', state: 'Empty' },
+    states: ['Real list', 'Empty'],
+  });
+  assert.deepEqual(t.triage, { kind: 'copy', state: 'Empty', by: 'person', confidence: null });
+  await rejects(
+    review.retriage(editor, {
+      prototype: 'sample-list',
+      id: c.id,
+      triage: { state: 'Nope' },
+      states: ['Empty'],
+    }),
+    'invalid',
+  );
+});
+
+test('a revoked person and a password-only visitor can do nothing', async () => {
+  const gone = await review.revoke(editor, reviewer.id);
+  await rejects(review.add(gone, { body: 'x', anchor }), 'forbidden');
+  await rejects(review.add(null, { body: 'x', anchor }), 'unauthorized');
+});
+
+test('bad input names every problem', async () => {
+  await assert.rejects(
+    review.add(reviewer, { body: '', anchor: { ...anchor, url: 'x', offset: { x: 2, y: 0 } } }),
+    (e: unknown) => {
+      assert.ok(e instanceof ReviewError);
+      assert.deepEqual(
+        e.problems.map((p) => p.split(':')[0]),
+        ['body', 'anchor.url', 'anchor.offset'],
+      );
+      return true;
+    },
+  );
+});
+
+test('triage runs on add, and a failing triager never loses the comment', async () => {
+  const seen: string[][] = [];
+  const triaged = createReview(memoryKV(), {
+    triage: async ({ states }) => {
+      seen.push(states);
+      return { kind: 'bug', state: states[0] ?? null, by: 'jev', confidence: 0.9 };
+    },
+  });
+  const c = await triaged.add(reviewer, {
+    body: 'Broken',
+    anchor,
+    states: ['Empty', 'Empty', ' Real list '],
+  });
+  assert.deepEqual(seen, [['Empty', 'Real list']]);
+  assert.equal(c.triage?.kind, 'bug');
+  const failing = createReview(memoryKV(), { triage: async () => Promise.reject(new Error('down')) });
+  assert.equal((await failing.add(reviewer, { body: 'Still saved', anchor })).triage, null);
+});
+
+test('locate finds a comment by id alone', async () => {
+  const c = await review.add(reviewer, { body: 'Here', anchor });
+  assert.equal((await review.locate(c.id))?.prototype, 'sample-list');
+  assert.equal(await review.locate('nope'), null);
+});