codetrellis 0.0.0-stage → 0.3.0

package/src/backend/services/review-host/gitlab.js

@@ -0,0 +1,77 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var gitlab_exports = {};
+__export(gitlab_exports, {
+  gitlabApiBase: () => gitlabApiBase,
+  readGitlabBranch: () => readGitlabBranch,
+  summariseMergeRequest: () => summariseMergeRequest,
+  summarisePipeline: () => summarisePipeline
+});
+module.exports = __toCommonJS(gitlab_exports);
+var import_http = require("./http");
+function gitlabApiBase() {
+  return (process.env.CODETRELLIS_GITLAB_API || "https://gitlab.com/api/v4").replace(/\/+$/, "");
+}
+const secs = (iso) => iso ? Math.floor(Date.parse(iso) / 1e3) : null;
+function summarisePipeline(status) {
+  if (!status || status === "skipped") return null;
+  if (status === "success") return "passing";
+  if (status === "failed" || status === "canceled") return "failing";
+  return "pending";
+}
+function summariseMergeRequest(mr, approvals) {
+  if (!mr) return null;
+  const state = mr.state === "merged" ? "merged" : mr.state === "opened" ? "open" : "closed";
+  const open = state === "open";
+  return {
+    number: mr.iid,
+    ref: `!${mr.iid}`,
+    url: mr.web_url,
+    state,
+    at: state === "merged" ? secs(mr.merged_at) : state === "closed" ? secs(mr.closed_at) : null,
+    mergeCommit: state === "merged" ? mr.squash_commit_sha || mr.merge_commit_sha || null : null,
+    checks: open ? summarisePipeline(mr.head_pipeline?.status) : null,
+    approvals: open ? (approvals?.approved_by ?? []).length : 0,
+    changesRequested: open && mr.detailed_merge_status === "requested_changes"
+  };
+}
+async function readGitlabBranch(owner, repo, branch, token) {
+  const parts = [owner, ...repo.split("/")];
+  if (!parts.every((p) => import_http.PART.test(p))) return { ok: false, error: "Not a GitLab project path." };
+  const project = `${gitlabApiBase()}/projects/${encodeURIComponent(parts.join("/"))}`;
+  const get = (path) => (0, import_http.hostGet)("GitLab", `${project}${path}`, token ? { "PRIVATE-TOKEN": token } : {}, { hasToken: !!token });
+  try {
+    const list = await get(`/merge_requests?source_branch=${encodeURIComponent(branch)}&state=all&order_by=updated_at&sort=desc&per_page=5`);
+    const mr = Array.isArray(list) ? list.find((m) => m.source_branch === branch) ?? null : null;
+    if (!mr || mr.state !== "opened") return { ok: true, review: summariseMergeRequest(mr, null) };
+    const [detail, approvals] = await Promise.all([
+      get(`/merge_requests/${mr.iid}`),
+      get(`/merge_requests/${mr.iid}/approvals`)
+    ]);
+    return { ok: true, review: summariseMergeRequest({ ...mr, ...detail }, approvals) };
+  } catch (err) {
+    return { ok: false, error: (0, import_http.unreachable)("GitLab", err) };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  gitlabApiBase,
+  readGitlabBranch,
+  summariseMergeRequest,
+  summarisePipeline
+});

package/src/backend/services/review-host/host-state.js

@@ -0,0 +1,103 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var host_state_exports = {};
+__export(host_state_exports, {
+  HOST_TTL_MS: () => HOST_TTL_MS,
+  cachedHostRead: () => cachedHostRead,
+  forgetHostReads: () => forgetHostReads,
+  overlayHost: () => overlayHost,
+  refreshHostReads: () => refreshHostReads
+});
+module.exports = __toCommonJS(host_state_exports);
+var import_detect = require("./detect");
+var import_switch = require("./switch");
+var import_github = require("./github");
+var import_gitlab = require("./gitlab");
+var import_bitbucket = require("./bitbucket");
+const READERS = {
+  github: import_github.readGithubBranch,
+  gitlab: import_gitlab.readGitlabBranch,
+  bitbucket: import_bitbucket.readBitbucketBranch
+};
+const HOST_TTL_MS = 12e4;
+const MAX_BRANCHES = 25;
+const CONCURRENCY = 4;
+const cache = /* @__PURE__ */ new Map();
+const inflight = /* @__PURE__ */ new Map();
+const keyOf = (host, branch) => `${host.hostname}/${host.slug}#${branch}`;
+function forgetHostReads() {
+  cache.clear();
+}
+function cachedHostRead(projectRoot, branch) {
+  const active = (0, import_switch.activeReviewHost)(projectRoot);
+  if (!active) return null;
+  return cache.get(keyOf(active.host, branch))?.read ?? null;
+}
+async function refreshHostReads(projectRoot, branches, now = Date.now()) {
+  const active = (0, import_switch.activeReviewHost)(projectRoot);
+  if (!active || !active.host.kind || !active.host.supported) return;
+  const { host, token } = active;
+  const kind = active.host.kind;
+  const read = READERS[kind];
+  const stale = [...new Set(branches)].filter((b) => {
+    const e = cache.get(keyOf(host, b));
+    return !e || now - e.at >= HOST_TTL_MS;
+  }).slice(0, MAX_BRANCHES);
+  let next = 0;
+  const worker = async () => {
+    while (next < stale.length) {
+      const branch = stale[next++];
+      const key = keyOf(host, branch);
+      let p = inflight.get(key);
+      if (!p) {
+        p = read(host.owner, host.repo, branch, token).finally(() => inflight.delete(key));
+        inflight.set(key, p);
+      }
+      cache.set(key, { at: Date.now(), read: { kind, read: await p } });
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(CONCURRENCY, stale.length) }, worker));
+}
+function overlayHost(state, kept) {
+  if (!kept) return state;
+  const { kind, read } = kept;
+  const name = (0, import_detect.hostName)(kind);
+  const source = kind;
+  if (!read.ok) return { ...state, hostNote: read.error };
+  const r = read.review;
+  const request = kind === "gitlab" ? "merge request" : "pull request";
+  if (!r) return { ...state, hostNote: `${name} has no ${request} for this branch.` };
+  const review = { number: r.number, ref: r.ref, url: r.url, checks: r.checks, approvals: r.approvals, changesRequested: r.changesRequested };
+  if (r.state === "merged") {
+    return { ...state, state: "merged", source, how: "pull-request", commit: r.mergeCommit ?? state.commit, at: r.at ?? state.at, review };
+  }
+  if (r.state === "open") {
+    if (state.state === "merged") return { ...state, review, hostNote: `${name} still has ${r.ref} open, but its changes are on ${state.base ?? "the base"}.` };
+    return { ...state, state: "in-review", source, review };
+  }
+  if (state.state === "merged") return { ...state, review, hostNote: `${name} says ${r.ref} was closed without merging; git shows its changes on ${state.base ?? "the base"}.` };
+  return { ...state, state: "closed", source, at: r.at ?? state.at, review };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HOST_TTL_MS,
+  cachedHostRead,
+  forgetHostReads,
+  overlayHost,
+  refreshHostReads
+});

package/src/backend/services/review-host/http.js

@@ -0,0 +1,58 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var http_exports = {};
+__export(http_exports, {
+  HostReadError: () => HostReadError,
+  PART: () => PART,
+  hostGet: () => hostGet,
+  unreachable: () => unreachable
+});
+module.exports = __toCommonJS(http_exports);
+class HostReadError extends Error {
+}
+const TIMEOUT_MS = 8e3;
+async function hostGet(name, url, auth, opts) {
+  const res = await fetch(url, {
+    method: "GET",
+    redirect: "error",
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+    headers: { Accept: "application/json", "User-Agent": "CodeTrellis", ...opts.extraHeaders ?? {}, ...auth }
+  });
+  if (res.ok) return res.json();
+  if (res.status === 401) throw new HostReadError(`${name} refused the token (401). Save a new one in Settings \u2192 Review hosts.`);
+  const limited = res.status === 429 || res.status === 403 && res.headers.get("x-ratelimit-remaining") === "0";
+  if (limited) {
+    const reset = Number(res.headers.get("x-ratelimit-reset") ?? res.headers.get("ratelimit-reset"));
+    const when = reset ? `until ${new Date(reset * 1e3).toISOString().slice(11, 16)} UTC` : "for now";
+    throw new HostReadError(`${name}'s rate limit is used up ${when}${opts.hasToken ? "" : "; a token raises it"}.`);
+  }
+  if (res.status === 404) throw new HostReadError(`${name} has no such repository${opts.hasToken ? " that this token can see" : " (a private one needs a token)"} (404).`);
+  throw new HostReadError(`${name} answered ${res.status}.`);
+}
+function unreachable(name, err) {
+  if (err instanceof HostReadError) return err.message;
+  return err?.name === "TimeoutError" ? `${name} did not answer in time.` : `${name} could not be reached.`;
+}
+const PART = /^[A-Za-z0-9_.-]+$/;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HostReadError,
+  PART,
+  hostGet,
+  unreachable
+});

package/src/backend/services/review-host/switch.js

@@ -0,0 +1,120 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var switch_exports = {};
+__export(switch_exports, {
+  ReviewHostError: () => ReviewHostError,
+  activeReviewHost: () => activeReviewHost,
+  checkToken: () => checkToken,
+  forgetReviewHostToken: () => forgetReviewHostToken,
+  getReviewHost: () => getReviewHost,
+  saveReviewHostToken: () => saveReviewHostToken,
+  setReviewHost: () => setReviewHost,
+  tokenKey: () => tokenKey
+});
+module.exports = __toCommonJS(switch_exports);
+var import_database = require("../database");
+var import_persistence = require("../persistence");
+var import_secret_store = require("../secret-store");
+var import_detect = require("./detect");
+class ReviewHostError extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+}
+function rowOf(projectRoot) {
+  const res = (0, import_database.getDb)().exec("SELECT hostname, slug, enabled, changed_at, changed_by FROM review_hosts WHERE project_root = ?", [projectRoot]);
+  const v = res[0]?.values[0];
+  return v ? { hostname: String(v[0]), slug: String(v[1]), enabled: Number(v[2]), changed_at: Number(v[3]), changed_by: String(v[4]) } : null;
+}
+const tokenKey = (hostname) => `review-host:${hostname}`;
+function says(d, enabled, turnedOnFor, tokenSaved) {
+  if (!d) return "No review host: this project has no remote with an owner and a repository. Its state comes from git.";
+  if (!d.kind) return `${d.hostname} has no adapter. State comes from git alone.`;
+  const name = (0, import_detect.hostName)(d.kind);
+  if (!d.supported) return `${name} is recognised; its adapter comes later. State comes from git alone.`;
+  if (turnedOnFor) return `Turned on for ${turnedOnFor}, but the remote now names ${d.hostname}/${d.slug}. Off until you turn it on for this one.`;
+  if (!enabled) return `Off. Nothing is sent to ${name}; state comes from git.`;
+  return tokenSaved ? `On: reads ${d.hostname}/${d.slug} with your token.` : `On: reads ${d.hostname}/${d.slug} without a token, which works for a public repository only.`;
+}
+function getReviewHost(projectRoot, detected = (0, import_detect.detectProjectHost)(projectRoot)) {
+  const row = rowOf(projectRoot);
+  const store = (0, import_secret_store.secretStore)();
+  const sameRepo = !!row && !!detected && row.hostname === detected.hostname && row.slug === detected.slug;
+  const enabled = !!row?.enabled && sameRepo && !!detected?.supported;
+  const turnedOnFor = row?.enabled && !sameRepo ? `${row.hostname}/${row.slug}` : null;
+  const tokenSaved = !!detected && store.has(tokenKey(detected.hostname));
+  return {
+    project: projectRoot,
+    detected,
+    enabled,
+    turnedOnFor,
+    changedAt: row?.changed_at ?? null,
+    changedBy: row?.changed_by ?? null,
+    token: { saved: tokenSaved, kind: store.kind, where: store.where },
+    says: says(detected, enabled, turnedOnFor, tokenSaved)
+  };
+}
+function setReviewHost(projectRoot, enabled, by, detected = (0, import_detect.detectProjectHost)(projectRoot)) {
+  if (enabled) {
+    if (!detected) throw new ReviewHostError(400, "This project has no remote naming a host, so there is nothing to turn on.");
+    if (!detected.supported) throw new ReviewHostError(400, `${detected.kind ? (0, import_detect.hostName)(detected.kind) : detected.hostname} has no adapter yet; its state comes from git.`);
+  }
+  const hostname = detected?.hostname ?? rowOf(projectRoot)?.hostname ?? "";
+  const slug = detected?.slug ?? rowOf(projectRoot)?.slug ?? "";
+  (0, import_database.getDb)().run(
+    `INSERT INTO review_hosts (project_root, hostname, slug, enabled, changed_at, changed_by) VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(project_root) DO UPDATE SET hostname = excluded.hostname, slug = excluded.slug, enabled = excluded.enabled,
+       changed_at = excluded.changed_at, changed_by = excluded.changed_by`,
+    [projectRoot, hostname, slug, enabled ? 1 : 0, Date.now(), by]
+  );
+  (0, import_persistence.markDirty)();
+  return getReviewHost(projectRoot, detected);
+}
+function checkToken(token) {
+  if (typeof token !== "string") throw new ReviewHostError(400, "token must be a string");
+  const t = token.trim();
+  if (t.length < 8 || t.length > 255 || !/^[\x21-\x7e]+$/.test(t)) throw new ReviewHostError(400, "That does not look like a token: expected 8\u2013255 printable characters with no spaces.");
+  return t;
+}
+function saveReviewHostToken(projectRoot, token, detected = (0, import_detect.detectProjectHost)(projectRoot)) {
+  if (!detected?.supported) throw new ReviewHostError(400, "This project's host has no adapter, so a token would not be used.");
+  (0, import_secret_store.secretStore)().set(tokenKey(detected.hostname), checkToken(token));
+  return getReviewHost(projectRoot, detected);
+}
+function forgetReviewHostToken(projectRoot, detected = (0, import_detect.detectProjectHost)(projectRoot)) {
+  if (detected) (0, import_secret_store.secretStore)().delete(tokenKey(detected.hostname));
+  return getReviewHost(projectRoot, detected);
+}
+function activeReviewHost(projectRoot) {
+  const detected = (0, import_detect.detectProjectHost)(projectRoot);
+  if (!getReviewHost(projectRoot, detected).enabled || !detected) return null;
+  return { host: detected, token: (0, import_secret_store.secretStore)().get(tokenKey(detected.hostname)) };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ReviewHostError,
+  activeReviewHost,
+  checkToken,
+  forgetReviewHostToken,
+  getReviewHost,
+  saveReviewHostToken,
+  setReviewHost,
+  tokenKey
+});

package/src/backend/services/review-marks.js

@@ -0,0 +1,72 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var review_marks_exports = {};
+__export(review_marks_exports, {
+  lastMark: () => lastMark,
+  markReviewed: () => markReviewed,
+  sinceLastLook: () => sinceLastLook
+});
+module.exports = __toCommonJS(review_marks_exports);
+var import_node_child_process = require("node:child_process");
+var import_database = require("./database");
+var import_persistence = require("./persistence");
+function markReviewed(projectRoot, m, now = Date.now()) {
+  (0, import_database.getDb)().run(
+    `INSERT OR REPLACE INTO review_marks (project_root, target, reviewer, reviewer_type, base, head_commit, findings, at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    [projectRoot, m.target, m.reviewer, m.reviewerType, m.base, m.commit, JSON.stringify(m.findings), now]
+  );
+  (0, import_persistence.markDirty)();
+  return { ...m, at: now };
+}
+function lastMark(projectRoot, target, reviewer) {
+  const r = (0, import_database.getDb)().exec(
+    "SELECT target, reviewer, reviewer_type, base, head_commit, findings, at FROM review_marks WHERE project_root = ? AND target = ? AND reviewer = ?",
+    [projectRoot, target, reviewer]
+  )[0]?.values[0];
+  if (!r) return null;
+  let findings = [];
+  try {
+    findings = JSON.parse(String(r[5]));
+  } catch {
+    findings = [];
+  }
+  return { target: String(r[0]), reviewer: String(r[1]), reviewerType: String(r[2]), base: String(r[3]), commit: String(r[4]), findings, at: Number(r[6]) };
+}
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+function sinceLastLook(projectRoot, mark, head, findingsNow) {
+  let changed = [];
+  let gone = false;
+  try {
+    changed = (0, import_node_child_process.execFileSync)("git", ["-C", projectRoot, "diff", "--name-only", mark.commit, head, "--"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\n").map((s) => s.trim()).filter(Boolean);
+  } catch {
+    gone = true;
+  }
+  const now = new Set(findingsNow);
+  const then = new Set(mark.findings);
+  const addressed = mark.findings.filter((f) => !now.has(f));
+  const added = findingsNow.filter((f) => !then.has(f));
+  const short = mark.commit.slice(0, 7);
+  const words = gone ? `The commit you looked at, ${short}, is no longer in the history (rewritten since): review the whole change again.` : changed.length === 0 ? `Nothing changed since you looked at ${short}.` : `Since you looked at ${short}: ${plural(changed.length, "file")} changed${addressed.length ? `, ${plural(addressed.length, "finding")} addressed` : ""}${added.length ? `, ${added.length} new` : ""}.`;
+  return { mark, changed, addressed, added, gone, words };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  lastMark,
+  markReviewed,
+  sinceLastLook
+});

package/src/backend/services/review-notes.js

@@ -0,0 +1,169 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var review_notes_exports = {};
+__export(review_notes_exports, {
+  NOTES_REF: () => NOTES_REF,
+  REVIEW_NAMESPACE: () => REVIEW_NAMESPACE,
+  attestationProblem: () => attestationProblem,
+  attestationYaml: () => attestationYaml,
+  devicesAt: () => devicesAt,
+  noteOn: () => noteOn,
+  parseNote: () => parseNote,
+  signedBytes: () => signedBytes,
+  statementBytes: () => statementBytes,
+  verifyReview: () => verifyReview
+});
+module.exports = __toCommonJS(review_notes_exports);
+var import_node_child_process = require("node:child_process");
+var import_yaml = require("yaml");
+var import_signing = require("./task-records/signing");
+const NOTES_REF = "refs/notes/codetrellis-reviews";
+const REVIEW_NAMESPACE = "codetrellis-review";
+const KEYS_DIR = ".codetrellis/keys";
+const MAX_NOTE = 512 * 1024;
+const COMMIT = /^[0-9a-f]{40}$/;
+const shortKey = (fp) => fp.startsWith("SHA256:") ? fp.slice(0, 19) : fp.slice(0, 12);
+const statementBytes = (s) => (0, import_signing.canonicalJson)(s);
+const signedBytes = (bytes) => `${REVIEW_NAMESPACE}
+${bytes}`;
+function attestationYaml(s, signature) {
+  return `---
+# CodeTrellis: a review of this commit, made on a developer's device and signed by its key.
+kind: ${REVIEW_NAMESPACE}
+version: 1
+statement: ${JSON.stringify(statementBytes(s))}
+signature: ${JSON.stringify(signature)}
+`;
+}
+function parseNote(text) {
+  if (Buffer.byteLength(text, "utf8") > MAX_NOTE) return { attestations: [], unreadable: 1 };
+  const out = [];
+  let unreadable = 0;
+  for (const doc of (0, import_yaml.parseAllDocuments)(text)) {
+    if ("errors" in doc && doc.errors.length) {
+      unreadable++;
+      continue;
+    }
+    let raw;
+    try {
+      raw = doc.toJS({ maxAliasCount: 0 });
+    } catch {
+      unreadable++;
+      continue;
+    }
+    if (raw === null || raw === void 0) continue;
+    const r = raw;
+    const signature = (0, import_signing.parseSignature)(r.signature);
+    if (r.kind !== REVIEW_NAMESPACE || r.version !== 1 || typeof r.statement !== "string" || !signature) {
+      unreadable++;
+      continue;
+    }
+    let s;
+    try {
+      s = JSON.parse(r.statement);
+    } catch {
+      unreadable++;
+      continue;
+    }
+    if (s.kind !== REVIEW_NAMESPACE || typeof s.head !== "string" || typeof s.signer !== "string" || !Array.isArray(s.findings)) {
+      unreadable++;
+      continue;
+    }
+    out.push({ statement: s, bytes: r.statement, signature });
+  }
+  return { attestations: out, unreadable };
+}
+const git = (root, args) => {
+  try {
+    return (0, import_node_child_process.execFileSync)("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 8 * 1024 * 1024 });
+  } catch {
+    return null;
+  }
+};
+function noteOn(root, commit) {
+  return git(root, ["notes", `--ref=${NOTES_REF}`, "show", commit]);
+}
+function devicesAt(root, commit) {
+  const devices = /* @__PURE__ */ new Map();
+  for (const line of (git(root, ["ls-tree", "--name-only", commit, `./${KEYS_DIR}/`]) ?? "").split("\n").map((l) => l.trim()).filter(Boolean).slice(0, 500)) {
+    const name = line.split("/").pop();
+    const m = /^([a-f0-9]{8,32})\.yaml$/.exec(name);
+    if (!m) continue;
+    const text = git(root, ["show", `${commit}:./${KEYS_DIR}/${name}`]);
+    if (!text) continue;
+    const parsed = (0, import_signing.parseKeyIntroduction)(text, m[1]);
+    if ("key" in parsed) devices.set(parsed.key.fingerprint, parsed.key.publicKey);
+  }
+  return devices;
+}
+function attestationProblem(a, commit, devices) {
+  if (a.statement.head !== commit) return `it is signed as a review of ${a.statement.head.slice(0, 7)}, not of the commit it is on`;
+  if (a.signature.how !== "device") return "it is not signed by a device key";
+  if (a.signature.key !== a.statement.signer) return "it names one signer and is signed by another";
+  const pub = devices.get(a.signature.key);
+  if (!pub) return `its key (${shortKey(a.signature.key)}) is not one the base branch lists under ${KEYS_DIR}/`;
+  if (!(0, import_signing.verifyWithDevice)(pub, signedBytes(a.bytes), a.signature.value)) return "its signature does not verify: it was changed after it was signed, or forged";
+  return null;
+}
+function verifyReview(root, head, baseCommit) {
+  if (!COMMIT.test(head) || !COMMIT.test(baseCommit)) return { state: "none", head, review: null, refused: [], words: "The head or the base is not a commit here." };
+  const devices = devicesAt(root, baseCommit);
+  const held = (commit) => {
+    const text = noteOn(root, commit);
+    if (!text) return { ok: null, refused: [] };
+    const { attestations, unreadable } = parseNote(text);
+    const refused = [];
+    let ok = null;
+    for (const a of attestations) {
+      const why = attestationProblem(a, commit, devices);
+      if (why) refused.push({ agent: a.statement.agent, why });
+      else if (!ok || a.statement.at > ok.statement.at) ok = a;
+    }
+    for (let i = 0; i < unreadable; i++) refused.push({ agent: "unknown", why: "it could not be read as a signed review" });
+    return { ok, refused };
+  };
+  const now = held(head);
+  const short = head.slice(0, 7);
+  if (now.ok) {
+    const s = now.ok.statement;
+    return { state: "verified", head, review: s, refused: now.refused, words: `\u2713 ${s.agent}'s review of ${short}, signed on a device the base trusts (${shortKey(s.signer)}): ${s.findings.length} finding${s.findings.length === 1 ? "" : "s"}.` };
+  }
+  const earlier = (git(root, ["rev-list", "--first-parent", `${baseCommit}..${head}`]) ?? "").split("\n").map((l) => l.trim()).filter((c) => COMMIT.test(c) && c !== head).slice(0, 200);
+  for (const c of earlier) {
+    const e = held(c);
+    if (e.ok) {
+      const s = e.ok.statement;
+      return { state: "stale", head, review: s, refused: now.refused, words: `\u26A0 The latest review is ${s.agent}'s of ${c.slice(0, 7)}, before the last push: it does not count for ${short}. Review the head again.` };
+    }
+  }
+  if (now.refused.length) return { state: "refused", head, review: null, refused: now.refused, words: `\u2717 The review on ${short} is refused: ${now.refused.map((r) => `${r.agent}'s, because ${r.why}`).join("; ")}.` };
+  return { state: "none", head, review: null, refused: [], words: `No review on ${short}: review it on your device (codetrellis review, or your agent through get_review_bundle) and push the notes (codetrellis review publish).` };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NOTES_REF,
+  REVIEW_NAMESPACE,
+  attestationProblem,
+  attestationYaml,
+  devicesAt,
+  noteOn,
+  parseNote,
+  signedBytes,
+  statementBytes,
+  verifyReview
+});