view.rs 92.1%

963 of 1046 lines run, 169 of 341 functions · run #498 on main · run missed
//! Page-ready views of a repository, computed from `oxy-core` alone (hub
//! spec §1.4). Nothing here knows about HTTP or templates; every function
//! takes an open `Repo` and returns plain data.

use super::{RepoError, StateCache};
use oxy_core::hash::{ChangeHash, KeyId};
use oxy_core::objects::{Change, NodeKind};
use oxy_core::repo::{BlameLine, FileDiff, Repo, SignatureStatus};
use oxy_core::state::{FileContent, Snapshot};
use oxy_core::tree::TreeConflict;
use std::collections::{BTreeMap, BTreeSet, HashMap};

type Result<T> = std::result::Result<T, RepoError>;

fn fail(msg: impl Into<String>) -> RepoError {
    RepoError::Oxy(oxy_core::repo::RepoError::Msg(msg.into()))
}

// ------------------------------------------------------------------ refs

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum RefKind {
    Bookmark,
    Tag,
    Change,
}

/// What a `{ref}` path segment resolved to.
#[derive(Clone, Debug)]
pub struct RefTarget {
    /// The name as given (bookmark, tag) or the full hash.
    pub label: String,
    pub kind: RefKind,
    pub heads: Vec<ChangeHash>,
}

/// Most heads a state address or a "before this change" link carries.
pub const MAX_STATE_HEADS: usize = 32;

impl RefTarget {
    /// The label for a ref bar: the name, or `# abc123…` for a change,
    /// with `+N` for the further heads of a state.
    pub fn short_label(&self) -> String {
        match self.kind {
            RefKind::Change => {
                let mut parts = self.label.split('+');
                let first: String = parts.next().unwrap_or("").chars().take(12).collect();
                match parts.count() {
                    0 => first,
                    n => format!("{first} +{n}"),
                }
            }
            _ => self.label.clone(),
        }
    }

    /// The `{ref}` that names this target's state for good: its heads
    /// joined with `+` (hub spec §6.6). None for an empty state.
    pub fn permalink(&self) -> Option<String> {
        state_spec(&self.heads)
    }
}

/// Heads as a state address, sorted so one state has one address.
pub fn state_spec(heads: &[ChangeHash]) -> Option<String> {
    if heads.is_empty() || heads.len() > MAX_STATE_HEADS {
        return None;
    }
    let mut hex: Vec<String> = heads.iter().map(|h| h.to_hex()).collect();
    hex.sort();
    hex.dedup();
    Some(hex.join("+"))
}

/// Resolve a bookmark name, a tag name, a change hash prefix, or a state
/// (full hashes joined with `+`).
pub fn resolve(repo: &Repo, cache: &StateCache, spec: &str) -> Result<RefTarget> {
    if spec.contains('+') {
        let parts: Vec<&str> = spec.split('+').collect();
        if parts.len() > MAX_STATE_HEADS {
            return Err(fail(format!("a state address has at most {MAX_STATE_HEADS} heads")));
        }
        let mut heads = Vec::with_capacity(parts.len());
        for p in parts {
            match ChangeHash::from_hex(p) {
                Some(h) if p.len() == 64 && repo.store().has(&h) => heads.push(h),
                _ => return Err(fail(format!("{p:?} is not a change of this repository"))),
            }
        }
        heads.sort();
        heads.dedup();
        let label = state_spec(&heads).unwrap_or_default();
        return Ok(RefTarget { label, kind: RefKind::Change, heads });
    }
    let view = repo.view()?;
    if let Some(heads) = view.bookmarks.get(spec).map(|st| repo.store().get_state(st).map(|s| s.heads)).transpose()? {
        return Ok(RefTarget { label: spec.into(), kind: RefKind::Bookmark, heads });
    }
    if let Some(heads) = repo.tag_heads(spec)? {
        return Ok(RefTarget { label: spec.into(), kind: RefKind::Tag, heads });
    }
    let hash = resolve_change(repo, cache, spec)?;
    Ok(RefTarget { label: hash.to_hex(), kind: RefKind::Change, heads: vec![hash] })
}

/// A change by full hash or unique hex prefix, searched over every
/// bookmark's state.
pub fn resolve_change(repo: &Repo, cache: &StateCache, spec: &str) -> Result<ChangeHash> {
    let spec = spec.trim_start_matches('#');
    if spec.len() < 4 || !spec.chars().all(|c| c.is_ascii_hexdigit()) {
        return Err(fail(format!("{spec:?} is not a change")));
    }
    if let Some(h) = ChangeHash::from_hex(spec) {
        if repo.store().has(&h) {
            return Ok(h);
        }
    }
    let heads = all_heads(repo)?;
    let loaded = cache.load(repo, &heads)?;
    let matches: Vec<ChangeHash> = loaded.state.changes().map(|(h, _)| *h).filter(|h| h.starts_with_hex(spec)).collect();
    match matches.len() {
        1 => Ok(matches[0]),
        0 => Err(fail(format!("no change matches {spec:?}"))),
        _ => Err(fail(format!("{spec:?} is ambiguous"))),
    }
}

/// The heads of every bookmark, deduplicated.
pub fn all_heads(repo: &Repo) -> Result<Vec<ChangeHash>> {
    let mut set = BTreeSet::new();
    for b in repo.bookmarks()? {
        set.extend(b.heads);
    }
    Ok(set.into_iter().collect())
}

// ---------------------------------------------------------------- authors

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct AuthorView {
    pub name: String,
    pub email: String,
    pub key: String,
    /// True when the key is not an identity the store knows.
    pub unknown: bool,
    /// The hub account the key is linked to, filled by the web layer.
    pub account: Option<String>,
}

pub fn author(repo: &Repo, key: &KeyId, message: &str) -> AuthorView {
    if key.is_zero() {
        // Imported from Git: the trailer carries the author.
        let line = message.lines().rev().find_map(|l| l.strip_prefix("Git-Author: ")).unwrap_or("unknown");
        let (name, email) = match line.split_once('<') {
            Some((n, e)) => (n.trim().to_string(), e.trim_end_matches('>').trim().to_string()),
            None => (line.trim().to_string(), String::new()),
        };
        return AuthorView { name, email, key: String::new(), unknown: true, account: None };
    }
    match repo.store().get_identity(key) {
        Ok(id) => AuthorView { name: id.name, email: id.email, key: key.to_hex(), unknown: false, account: None },
        Err(_) => AuthorView { name: key.short(12), email: String::new(), key: key.to_hex(), unknown: true, account: None },
    }
}

// ---------------------------------------------------------------- changes

#[derive(Clone, Debug, PartialEq, Eq)]
pub enum SigView {
    Unsigned,
    Valid { key: String, name: String, sealed: bool, revoked: bool },
    Invalid(String),
}

impl SigView {
    pub fn glyph(&self) -> &'static str {
        match self {
            SigView::Unsigned => "○",
            SigView::Valid { revoked: true, .. } => "⊘",
            SigView::Valid { sealed: true, .. } => "◈",
            SigView::Valid { .. } => "✔",
            SigView::Invalid(_) => "✘",
        }
    }

    pub fn class(&self) -> &'static str {
        match self {
            SigView::Unsigned => "sig-unsigned",
            SigView::Valid { revoked: true, .. } => "sig-revoked",
            SigView::Valid { .. } => "sig-valid",
            SigView::Invalid(_) => "sig-invalid",
        }
    }

    pub fn title(&self) -> String {
        match self {
            SigView::Unsigned => "unsigned".into(),
            SigView::Valid { name, sealed: true, revoked: false, .. } => format!("sealed by {name}"),
            SigView::Valid { name, revoked: true, .. } => format!("signed by {name}, key revoked"),
            SigView::Valid { name, .. } => format!("signed by {name}"),
            SigView::Invalid(why) => format!("INVALID: {why}"),
        }
    }
}

pub fn signature(repo: &Repo, hash: &ChangeHash) -> SigView {
    match repo.verify_change(hash) {
        Ok(SignatureStatus::Unsigned) => SigView::Unsigned,
        Ok(SignatureStatus::Valid { key, name, sealed, revoked, .. }) => SigView::Valid { key: key.to_hex(), name, sealed, revoked },
        Ok(SignatureStatus::Invalid(why)) => SigView::Invalid(why),
        Err(e) => SigView::Invalid(e.to_string()),
    }
}

/// Who signed for the author when it was not the author: a delegate, such
/// as an agent, named by its identity, with the delegation that let it
/// (Oxygen's agent workflows doc §6).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct ViaView {
    pub name: String,
    pub email: String,
    pub key: String,
    pub short: String,
    /// The delegation's scope as written, `changes` for an agent.
    pub scope: String,
    pub expires_ms: Option<u64>,
    /// The signing key was revoked, or the delegation is no longer in the
    /// author's identity: the change deserves a second look.
    pub revoked: bool,
}

impl ViaView {
    /// The delegation, as the change page's `via` row says it.
    pub fn delegation(&self) -> String {
        if self.revoked {
            return "delegation revoked".into();
        }
        match self.expires_ms {
            Some(e) => format!("delegate for {}, until {}", self.scope, when_utc(e)),
            None => format!("delegate for {}", self.scope),
        }
    }

    /// What hovering the badge says.
    pub fn title(&self) -> String {
        let until = match self.expires_ms {
            Some(e) => format!(", until {}", when_utc(e)),
            None => String::new(),
        };
        if self.revoked {
            format!("signed by {} as a delegate of the author; that delegation has since been revoked", self.name)
        } else {
            format!("signed by {} as a delegate of the author ({}{until}), key {}", self.name, self.scope, self.short)
        }
    }
}

/// `2026-10-04 20:12Z` for a wall time in milliseconds.
fn when_utc(ms: u64) -> String {
    time::OffsetDateTime::from_unix_timestamp_nanos(ms as i128 * 1_000_000)
        .ok()
        .and_then(|t| t.format(&time::macros::format_description!("[year]-[month]-[day] [hour]:[minute]Z")).ok())
        .unwrap_or_else(|| ms.to_string())
}

/// The delegate that signed `hash` for the author, when one did.
pub fn via(repo: &Repo, author: &KeyId, sig: &SigView) -> Option<ViaView> {
    let SigView::Valid { key, name, revoked, .. } = sig else { return None };
    if author.is_zero() || *key == author.to_hex() {
        return None;
    }
    let signer = KeyId::from_hex(key)?;
    let entry = repo.store().get_identity(author).ok().and_then(|a| a.delegate(&signer).copied());
    let email = repo.store().get_identity(&signer).map(|i| i.email).unwrap_or_default();
    Some(ViaView {
        name: name.clone(),
        email,
        key: key.clone(),
        short: signer.short(12),
        scope: entry.map(|d| d.scope.to_string()).unwrap_or_else(|| "changes".into()),
        expires_ms: entry.and_then(|d| d.expires),
        revoked: *revoked || entry.is_none(),
    })
}

/// One change as history rows and change pages show it.
#[derive(Clone, Debug)]
pub struct ChangeView {
    pub hash: String,
    pub short: String,
    pub title: String,
    pub body: String,
    pub author: AuthorView,
    pub when_ms: u64,
    pub deps: Vec<String>,
    pub head: bool,
    pub resolution: bool,
    pub signature: SigView,
    /// Signed for the author by a delegate (an agent), when it was.
    pub via: Option<ViaView>,
    /// Bookmarks and tags whose state has this change as a head.
    pub labels: Vec<Label>,
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Label {
    pub name: String,
    pub kind: RefKind,
}

pub fn split_message(message: &str) -> (String, String) {
    let mut lines = message.lines();
    let title = lines.next().unwrap_or("").trim().to_string();
    let body = lines.collect::<Vec<_>>().join("\n").trim().to_string();
    (title, body)
}

/// Every bookmark and tag head, for labelling rows.
pub fn head_labels(repo: &Repo) -> Result<HashMap<ChangeHash, Vec<Label>>> {
    let mut out: HashMap<ChangeHash, Vec<Label>> = HashMap::new();
    for b in repo.bookmarks()? {
        for h in b.heads {
            out.entry(h).or_default().push(Label { name: b.name.clone(), kind: RefKind::Bookmark });
        }
    }
    for t in repo.tags()? {
        for h in t.heads {
            out.entry(h).or_default().push(Label { name: t.name.clone(), kind: RefKind::Tag });
        }
    }
    Ok(out)
}

pub fn change_view_pub(
    repo: &Repo,
    hash: &ChangeHash,
    meta: &oxy_core::state::ChangeMeta,
    head: bool,
    labels: &HashMap<ChangeHash, Vec<Label>>,
) -> ChangeView {
    change_view(repo, hash, meta, head, labels)
}

fn change_view(
    repo: &Repo,
    hash: &ChangeHash,
    meta: &oxy_core::state::ChangeMeta,
    head: bool,
    labels: &HashMap<ChangeHash, Vec<Label>>,
) -> ChangeView {
    let (title, body) = split_message(&meta.message);
    let signature = signature(repo, hash);
    let via = via(repo, &meta.author, &signature);
    ChangeView {
        hash: hash.to_hex(),
        short: hash.short(12),
        title,
        body,
        author: author(repo, &meta.author, &meta.message),
        when_ms: meta.hlc.wall_ms,
        deps: meta.deps.iter().map(|d| d.to_hex()).collect(),
        head,
        resolution: meta.kind == oxy_core::objects::ChangeKind::Resolution,
        signature,
        via,
        labels: labels.get(hash).cloned().unwrap_or_default(),
    }
}

// ---------------------------------------------------------------- history

#[derive(Clone, Debug)]
pub struct History {
    pub target: RefTarget,
    pub entries: Vec<ChangeView>,
    pub total: usize,
    pub offset: usize,
    pub has_more: bool,
    pub path: Option<String>,
}

/// A window of the history of a state, newest first.
pub fn history(repo: &Repo, cache: &StateCache, target: RefTarget, path: Option<&str>, offset: usize, limit: usize) -> Result<History> {
    let loaded = cache.load(repo, &target.heads)?;
    let head_set: BTreeSet<ChangeHash> = loaded.state.heads().into_iter().collect();
    let mut entries: Vec<(ChangeHash, oxy_core::state::ChangeMeta)> = match path {
        Some(p) => {
            let Some(node) = loaded.snapshot.files.get(p).map(|f| f.node) else { return Err(fail(format!("{p} is not in that state"))) };
            loaded
                .state
                .changes()
                .filter(|(h, _)| {
                    // The skeleton says which nodes a change touches, without its text.
                    repo.store()
                        .get_change_lazy(h)
                        .map(|(c, _)| c.tree_ops.iter().any(|o| o.node() == node) || c.edits.iter().any(|x| x.node() == node))
                        .unwrap_or(false)
                })
                .map(|(h, m)| (*h, m.clone()))
                .collect()
        }
        None => loaded.state.changes().map(|(h, m)| (*h, m.clone())).collect(),
    };
    entries.sort_by(|a, b| b.1.hlc.cmp(&a.1.hlc).then(b.0.cmp(&a.0)));
    let total = entries.len();
    let labels = head_labels(repo)?;
    let window: Vec<ChangeView> =
        entries.iter().skip(offset).take(limit).map(|(h, m)| change_view(repo, h, m, head_set.contains(h), &labels)).collect();
    Ok(History { target, entries: window, total, offset, has_more: offset + limit < total, path: path.map(String::from) })
}

/// A window of the changes a revset selects (Oxygen's
/// docs/revset_query_language.md §3), newest first, under a budget
/// stricter than the command line's so a query cannot load the server.
/// `target` is the reference the request named, for labels and heads.
pub fn history_revset(repo: &Repo, cache: &StateCache, target: RefTarget, revset: &str, offset: usize, limit: usize) -> Result<History> {
    let loaded = cache.load(repo, &target.heads)?;
    let head_set: BTreeSet<ChangeHash> = loaded.state.heads().into_iter().collect();
    let selected = repo.revset_with_budget(revset, std::time::Duration::from_secs(2))?;
    let total = selected.hashes.len();
    let labels = head_labels(repo)?;
    let window: Vec<ChangeView> = selected
        .hashes
        .iter()
        .skip(offset)
        .take(limit)
        .filter_map(|h| selected.metas.get(h).map(|m| change_view(repo, h, m, head_set.contains(h), &labels)))
        .collect();
    Ok(History { target, entries: window, total, offset, has_more: offset + limit < total, path: None })
}

// ----------------------------------------------------------------- change

#[derive(Clone, Debug)]
pub struct ChangeDetail {
    pub view: ChangeView,
    pub dependents: Vec<ChangeView>,
    pub deps: Vec<ChangeView>,
    pub files: Vec<FileDiff>,
    /// Base content of each modified file, for context lines.
    pub bases: BTreeMap<String, Vec<u8>>,
    pub in_bookmarks: Vec<String>,
    pub in_tags: Vec<String>,
    pub atoms: usize,
    pub tree_ops: usize,
}

pub fn change(repo: &Repo, cache: &StateCache, hash: &ChangeHash) -> Result<ChangeDetail> {
    let c: Change = repo.store().get_change(hash)?;
    let labels = head_labels(repo)?;
    let heads = all_heads(repo)?;
    let loaded = cache.load(repo, &heads)?;
    let state = &loaded.state;
    let is_head = state.heads().contains(hash);
    let meta = oxy_core::state::ChangeMeta::of(&c);
    let view = change_view(repo, hash, &meta, is_head, &labels);
    let deps = c.deps.iter().filter_map(|d| state.get(d).map(|m| change_view(repo, d, m, state.heads().contains(d), &labels))).collect();
    let mut dependents: Vec<ChangeView> = state
        .changes()
        .filter(|(_, m)| m.deps.contains(hash))
        .map(|(h, m)| change_view(repo, h, m, state.heads().contains(h), &labels))
        .collect();
    dependents.sort_by_key(|c| std::cmp::Reverse(c.when_ms));
    let base = cache.load(repo, &c.deps)?;
    let files = crate::render::diff::change_files(&c, &base.state, &base.snapshot);
    let base_snapshot = &base.snapshot;
    let mut bases = BTreeMap::new();
    for f in &files {
        let old = f.from.as_deref().unwrap_or(&f.path);
        if let Some(FileContent::Text { bytes, .. }) = base_snapshot.files.get(old).map(|s| &s.content) {
            bases.insert(f.path.clone(), bytes.clone());
        }
    }
    let mut in_bookmarks = Vec::new();
    for b in repo.bookmarks()? {
        if cache.summary(repo, &b.heads)?.changes.contains(hash) {
            in_bookmarks.push(b.name);
        }
    }
    let mut in_tags = Vec::new();
    for t in repo.tags()? {
        if cache.summary(repo, &t.heads)?.changes.contains(hash) {
            in_tags.push(t.name);
        }
    }
    Ok(ChangeDetail { view, dependents, deps, files, bases, in_bookmarks, in_tags, atoms: c.edits.len(), tree_ops: c.tree_ops.len() })
}

// ------------------------------------------------------------------- tree

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum EntryKind {
    Dir,
    File,
    Symlink,
    Subrepo,
}

#[derive(Clone, Debug)]
pub struct Entry {
    pub name: String,
    pub path: String,
    pub kind: EntryKind,
    pub exec: bool,
    pub size: Option<u64>,
    pub conflicted: bool,
}

#[derive(Clone, Debug)]
pub struct Tree {
    pub target: RefTarget,
    pub path: String,
    pub entries: Vec<Entry>,
    /// `(name, path)` from the root down to this directory.
    pub crumbs: Vec<(String, String)>,
    pub readme: Option<Readme>,
}

#[derive(Clone, Debug)]
pub struct Readme {
    pub path: String,
    pub text: String,
}

pub fn crumbs(path: &str) -> Vec<(String, String)> {
    let mut out = Vec::new();
    let mut so_far = String::new();
    for part in path.split('/').filter(|p| !p.is_empty()) {
        if !so_far.is_empty() {
            so_far.push('/');
        }
        so_far.push_str(part);
        out.push((part.to_string(), so_far.clone()));
    }
    out
}

fn entry_of(path: &str, name: &str, f: &oxy_core::state::FileState) -> Entry {
    let kind = match f.kind {
        NodeKind::Dir => EntryKind::Dir,
        NodeKind::File => EntryKind::File,
        NodeKind::Symlink => EntryKind::Symlink,
        NodeKind::Subrepo => EntryKind::Subrepo,
    };
    let size = match &f.content {
        FileContent::Text { bytes, .. } => Some(bytes.len() as u64),
        _ => None,
    };
    Entry { name: name.to_string(), path: path.to_string(), kind, exec: f.mode.exec, size, conflicted: f.is_conflicted() }
}

/// The entries directly under `dir` (`""` for the root).
pub fn tree(repo: &Repo, cache: &StateCache, target: RefTarget, dir: &str) -> Result<Tree> {
    let loaded = cache.load(repo, &target.heads)?;
    tree_of(repo, target, &loaded.snapshot, dir)
}

pub fn tree_of(_repo: &Repo, target: RefTarget, snapshot: &Snapshot, dir: &str) -> Result<Tree> {
    let dir = dir.trim_matches('/');
    if !dir.is_empty() {
        match snapshot.files.get(dir) {
            Some(f) if f.kind == NodeKind::Dir => {}
            _ => return Err(RepoError::NotFound),
        }
    }
    let prefix = if dir.is_empty() { String::new() } else { format!("{dir}/") };
    let mut entries: Vec<Entry> = snapshot
        .files
        .iter()
        .filter(|(p, _)| p.starts_with(&prefix) && !p[prefix.len()..].contains('/'))
        .map(|(p, f)| entry_of(p, &p[prefix.len()..], f))
        .collect();
    entries.sort_by(|a, b| {
        (a.kind != EntryKind::Dir).cmp(&(b.kind != EntryKind::Dir)).then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
    });
    let readme = entries
        .iter()
        .find(|e| {
            e.kind == EntryKind::File && matches!(e.name.to_lowercase().as_str(), "readme.md" | "readme" | "readme.txt" | "readme.markdown")
        })
        .and_then(|e| match &snapshot.files.get(&e.path)?.content {
            FileContent::Text { bytes, .. } => Some(Readme { path: e.path.clone(), text: String::from_utf8_lossy(bytes).into_owned() }),
            _ => None,
        });
    Ok(Tree { target, path: dir.to_string(), entries, crumbs: crumbs(dir), readme })
}

// ------------------------------------------------------------------- file

#[derive(Clone, Debug)]
pub enum FileBody {
    Text(String),
    Binary,
    TooLarge,
}

/// One row of the file page's tree sidebar (hub spec §6.6).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct SideEntry {
    pub name: String,
    pub path: String,
    pub depth: usize,
    pub dir: bool,
    /// A directory on the way to the file (expanded), or the file itself.
    pub on_path: bool,
    /// A "more" row standing for the rest of a long directory.
    pub more: bool,
}

/// Entries listed per directory in the sidebar before a "more" row.
const SIDEBAR_PER_DIR: usize = 200;

/// The tree down to `path`: each directory on the way expanded, in tree
/// order (directories first, then case-insensitive names).
pub fn sidebar(snapshot: &Snapshot, path: &str) -> Vec<SideEntry> {
    sidebar_in(&snapshot.files, |f| f.kind == NodeKind::Dir, path)
}

/// `sidebar` over any path map, given which values are directories.
pub fn sidebar_in<V>(files: &BTreeMap<String, V>, is_dir: impl Fn(&V) -> bool + Copy, path: &str) -> Vec<SideEntry> {
    let mut out = Vec::new();
    sidebar_dir(files, is_dir, "", path, 0, &mut out);
    out
}

fn sidebar_dir<V>(
    files: &BTreeMap<String, V>,
    is_dir: impl Fn(&V) -> bool + Copy,
    dir: &str,
    target: &str,
    depth: usize,
    out: &mut Vec<SideEntry>,
) {
    let prefix = if dir.is_empty() { String::new() } else { format!("{dir}/") };
    let mut children: Vec<(&str, bool)> = files
        .range(prefix.clone()..)
        .take_while(|(p, _)| p.starts_with(&prefix))
        .filter(|(p, _)| !p[prefix.len()..].contains('/'))
        .map(|(p, f)| (p.as_str(), is_dir(f)))
        .collect();
    children.sort_by(|a, b| (!a.1).cmp(&!b.1).then_with(|| a.0.to_lowercase().cmp(&b.0.to_lowercase())));
    let total = children.len();
    for (i, (p, dir_entry)) in children.into_iter().enumerate() {
        let on_path = target == p || target.starts_with(&format!("{p}/"));
        // Past the limit, keep only the entry on the way to the file.
        if i >= SIDEBAR_PER_DIR && !on_path {
            continue;
        }
        out.push(SideEntry { name: p[prefix.len()..].to_string(), path: p.to_string(), depth, dir: dir_entry, on_path, more: false });
        if dir_entry && on_path && p != target {
            sidebar_dir(files, is_dir, p, target, depth + 1, out);
        }
    }
    if total > SIDEBAR_PER_DIR {
        out.push(SideEntry {
            name: format!("{} more", total - SIDEBAR_PER_DIR),
            path: dir.to_string(),
            depth,
            dir: true,
            on_path: false,
            more: true,
        });
    }
}

#[derive(Clone, Debug)]
pub struct FileView {
    pub target: RefTarget,
    pub path: String,
    pub name: String,
    pub crumbs: Vec<(String, String)>,
    pub kind: EntryKind,
    pub exec: bool,
    pub size: u64,
    pub body: FileBody,
    pub conflicted: bool,
    /// Raw bytes, for the `?plain=1` response and images.
    pub bytes: Vec<u8>,
    pub last_change: Option<ChangeView>,
    pub sidebar: Vec<SideEntry>,
}

pub fn file(repo: &Repo, cache: &StateCache, target: RefTarget, path: &str, render_limit: u64) -> Result<FileView> {
    let loaded = cache.load(repo, &target.heads)?;
    let snapshot = &loaded.snapshot;
    let path = path.trim_matches('/');
    let Some(f) = snapshot.files.get(path) else { return Err(RepoError::NotFound) };
    let (kind, bytes) = match (&f.kind, &f.content) {
        (NodeKind::Dir, _) => return Err(RepoError::NotFound),
        (NodeKind::Symlink, FileContent::Text { bytes, .. }) => (EntryKind::Symlink, bytes.clone()),
        (NodeKind::Subrepo, FileContent::Text { bytes, .. }) => (EntryKind::Subrepo, bytes.clone()),
        (_, FileContent::Text { bytes, .. }) => (EntryKind::File, bytes.clone()),
        (_, FileContent::Opaque { blobs }) => {
            let bytes = match blobs.first() {
                Some(b) => repo.read_blob(b)?,
                None => Vec::new(),
            };
            (EntryKind::File, bytes)
        }
        (_, FileContent::Dir) => return Err(RepoError::NotFound),
    };
    let size = bytes.len() as u64;
    let body = if size > render_limit {
        FileBody::TooLarge
    } else if is_binary(&bytes) {
        FileBody::Binary
    } else {
        FileBody::Text(String::from_utf8_lossy(&bytes).into_owned())
    };
    let labels = head_labels(repo)?;
    let last_change = last_change_of(repo, &loaded.state, &target.heads, path)
        .and_then(|h| loaded.state.get(&h).map(|meta| change_view(repo, &h, meta, loaded.state.heads().contains(&h), &labels)));
    let name = path.rsplit('/').next().unwrap_or(path).to_string();
    Ok(FileView {
        target,
        path: path.to_string(),
        name,
        crumbs: crumbs(path),
        kind,
        exec: f.mode.exec,
        size,
        body,
        conflicted: f.is_conflicted(),
        bytes,
        last_change,
        sidebar: sidebar(snapshot, path),
    })
}

/// A file's name and bytes, and nothing else (for raw responses).
pub fn raw(repo: &Repo, cache: &StateCache, target: &RefTarget, path: &str) -> Result<(String, Vec<u8>)> {
    let loaded = cache.load(repo, &target.heads)?;
    let path = path.trim_matches('/');
    let Some(f) = loaded.snapshot.files.get(path) else { return Err(RepoError::NotFound) };
    let bytes = match (&f.kind, &f.content) {
        (NodeKind::Dir, _) | (_, FileContent::Dir) => return Err(RepoError::NotFound),
        (_, FileContent::Text { bytes, .. }) => bytes.clone(),
        (_, FileContent::Opaque { blobs }) => match blobs.first() {
            Some(b) => repo.read_blob(b)?,
            None => Vec::new(),
        },
    };
    Ok((path.rsplit('/').next().unwrap_or(path).to_string(), bytes))
}

/// Facts about a path in a state never change, so they are cached by the
/// state's heads and the path (hub spec §16.3).
fn state_path_key(tag: &[u8], heads: &[ChangeHash], path: &str) -> [u8; 32] {
    let mut sorted: Vec<&ChangeHash> = heads.iter().collect();
    sorted.sort();
    let joined: Vec<u8> = sorted.iter().flat_map(|h| h.to_hex().into_bytes()).collect();
    crate::render::cache::key(&[tag, &joined, path.as_bytes()])
}

struct Last(Option<ChangeHash>);

impl crate::render::cache::Weigh for Last {
    fn weight(&self) -> usize {
        64
    }
}

/// The newest change touching `path` in the state, from a cache of 4 MiB.
pub fn last_change_of(repo: &Repo, state: &oxy_core::state::State, heads: &[ChangeHash], path: &str) -> Option<ChangeHash> {
    static C: std::sync::OnceLock<crate::render::cache::Lru<Last>> = std::sync::OnceLock::new();
    let cache = C.get_or_init(|| crate::render::cache::Lru::new(4 << 20));
    let key = state_path_key(b"last1", heads, path);
    cache.get_or(key, || Last(repo.log_for_path_of(state, path, Some(1)).ok().and_then(|l| l.into_iter().next()).map(|e| e.hash))).0
}

struct BlameLines(Vec<BlameLine>);

impl crate::render::cache::Weigh for BlameLines {
    fn weight(&self) -> usize {
        self.0.iter().map(|l| l.text.len() + l.author.len() + 128).sum::<usize>() + 32
    }
}

/// `Repo::blame_in`, cached by state and path (64 MiB).
fn blame_cached(repo: &Repo, cache_state: &StateCache, heads: &[ChangeHash], path: &str) -> Result<Vec<BlameLine>> {
    static C: std::sync::OnceLock<crate::render::cache::Lru<BlameLines>> = std::sync::OnceLock::new();
    let cache = C.get_or_init(|| crate::render::cache::Lru::new(64 << 20));
    let key = state_path_key(b"blame1", heads, path);
    let mut failure = None;
    let lines = cache.get_or(key, || {
        match cache_state
            .load(repo, heads)
            .map_err(|e| oxy_core::repo::RepoError::Msg(e.to_string()))
            .and_then(|loaded| repo.blame_of(&loaded.state, &loaded.snapshot.tree, path))
        {
            Ok(l) => BlameLines(l),
            Err(e) => {
                failure = Some(e);
                BlameLines(Vec::new())
            }
        }
    });
    if let Some(e) = failure {
        return Err(RepoError::Oxy(e));
    }
    Ok(lines.0.clone())
}

pub fn is_binary(bytes: &[u8]) -> bool {
    let head = &bytes[..bytes.len().min(8192)];
    head.contains(&0)
        || std::str::from_utf8(head).is_err()
            && head.iter().filter(|b| **b < 0x20 && !matches!(**b, b'\n' | b'\r' | b'\t')).count() > head.len() / 20
}

/// Last change per entry of a directory, for tree rows (fetched lazily).
/// A directory's last change is the newest change touching anything
/// beneath it, as GitHub shows it.
pub fn last_changes(repo: &Repo, cache: &StateCache, heads: &[ChangeHash], paths: &[String]) -> Result<Vec<(String, ChangeView)>> {
    let labels = head_labels(repo)?;
    let loaded = cache.load(repo, heads)?;
    let state = &loaded.state;
    let snapshot = &loaded.snapshot;
    // Newest change touching each node, from one pass over the log.
    let mut newest: HashMap<oxy_core::ids::NodeId, (ChangeHash, u64)> = HashMap::new();
    for e in repo.log_of(state) {
        let Ok((c, _)) = repo.store().get_change_lazy(&e.hash) else { continue };
        let when = e.change.hlc.wall_ms;
        for node in c.tree_ops.iter().map(|o| o.node()).chain(c.edits.iter().map(|x| x.node())) {
            newest.entry(node).or_insert((e.hash, when));
        }
    }
    let mut out = Vec::new();
    for p in paths {
        let Some(f) = snapshot.files.get(p) else { continue };
        let best = if f.kind == NodeKind::Dir {
            let prefix = format!("{p}/");
            snapshot
                .files
                .iter()
                .filter(|(q, _)| q.starts_with(&prefix))
                .filter_map(|(_, g)| newest.get(&g.node))
                .chain(newest.get(&f.node))
                .max_by_key(|(_, when)| *when)
                .copied()
        } else {
            newest.get(&f.node).copied()
        };
        if let Some((hash, _)) = best {
            if let Some(m) = state.get(&hash) {
                out.push((p.clone(), change_view(repo, &hash, m, state.heads().contains(&hash), &labels)));
            }
        }
    }
    Ok(out)
}

// ------------------------------------------------------------------ blame

#[derive(Clone, Debug)]
pub struct Blame {
    pub file: FileView,
    pub lines: Vec<BlameLine>,
    /// For each blamed change, the state address of its dependencies:
    /// the state its author built on (None without dependencies).
    pub before: HashMap<ChangeHash, Option<String>>,
}

pub fn blame(repo: &Repo, cache: &StateCache, target: RefTarget, path: &str, render_limit: u64) -> Result<Blame> {
    let heads = target.heads.clone();
    let file = file(repo, cache, target, path, render_limit)?;
    let lines = blame_cached(repo, cache, &heads, path)?;
    let mut before = HashMap::new();
    for l in &lines {
        before.entry(l.hash).or_insert_with(|| repo.store().get_change_meta(&l.hash).ok().and_then(|c| state_spec(&c.deps)));
    }
    Ok(Blame { file, lines, before })
}

// -------------------------------------------------------------- overview

#[derive(Clone, Debug)]
pub struct BookmarkView {
    pub name: String,
    pub heads: Vec<String>,
    pub changes: usize,
    pub default: bool,
    pub conflicted: bool,
    pub latest_ms: u64,
}

#[derive(Clone, Debug)]
pub struct TagView {
    pub name: String,
    pub heads: Vec<String>,
    pub message: String,
    pub signer: Option<String>,
}

/// A tag withdrawn here (#301): the state it named, why, by whom and when.
#[derive(Clone, Debug)]
pub struct WithdrawnView {
    pub name: String,
    pub heads: Vec<String>,
    pub reason: String,
    pub signer: Option<String>,
    pub when_ms: i64,
}

#[derive(Clone, Debug)]
pub struct Overview {
    pub tree: Tree,
    pub changes: usize,
    pub heads: usize,
    pub bookmarks: Vec<BookmarkView>,
    pub tags: Vec<TagView>,
    pub latest: Option<ChangeView>,
    pub conflicted: bool,
    pub license: Option<String>,
    pub policy: PolicyBadge,
    pub contributors: Vec<Contributor>,
    pub languages: Vec<LanguageShare>,
}

impl Overview {
    /// The sidebar's bookmarks (#152): the default first, then the most
    /// recently moved, ten in all.
    pub fn recent_bookmarks(&self) -> Vec<&BookmarkView> {
        let mut list: Vec<&BookmarkView> = self.bookmarks.iter().collect();
        list.sort_by(|a, b| b.default.cmp(&a.default).then(b.latest_ms.cmp(&a.latest_ms)).then_with(|| a.name.cmp(&b.name)));
        list.truncate(10);
        list
    }
}

/// Someone who authored changes in a state (hub spec §6.4).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Contributor {
    pub name: String,
    /// The identity key (hex), empty for authors imported from Git.
    pub key: String,
    pub changes: usize,
    /// The hub account the key is linked to, filled by the web layer.
    pub account: Option<String>,
    /// Of `changes`, how many a delegate signed for this author, by the
    /// delegate's name (an agent's work stays the author's, and is shown).
    pub via: Vec<(String, usize)>,
    /// The hub's own delegate key, filled by the web layer (#152).
    pub hub: bool,
}

/// One language's share of a state's code, by bytes.
#[derive(Clone, Debug, PartialEq)]
pub struct LanguageShare {
    pub name: String,
    pub bytes: u64,
    pub percent: f64,
    pub colour: String,
}

/// Authors of the changes of a state, most changes first. A change a
/// delegate signed counts for its author, and the delegate is named under
/// them: the signing key is read, not verified (the change rows do that).
pub fn contributors(repo: &Repo, state: &oxy_core::state::State) -> Vec<Contributor> {
    let mut by: HashMap<String, Contributor> = HashMap::new();
    let mut names: HashMap<KeyId, String> = HashMap::new();
    for (hash, meta) in state.changes() {
        let a = author(repo, &meta.author, &meta.message);
        let id = if a.key.is_empty() { format!("git:{}", a.email.to_lowercase()) } else { a.key.clone() };
        // Unsigned changes with no Git author carry no name at all.
        let name =
            if a.key.is_empty() && a.email.is_empty() && a.name == "unknown" { "Unattributed changes".to_string() } else { a.name.clone() };
        let entry = by.entry(id).or_insert_with(|| Contributor {
            name,
            key: a.key.clone(),
            changes: 0,
            account: None,
            via: Vec::new(),
            hub: false,
        });
        entry.changes += 1;
        if !meta.author.is_zero() {
            let signer = repo.store().signatures(hash).ok().and_then(|s| s.first().map(|s| s.key)).filter(|k| *k != meta.author);
            if let Some(k) = signer {
                let who =
                    names.entry(k).or_insert_with(|| repo.store().get_identity(&k).map(|i| i.name).unwrap_or_else(|_| k.short(12))).clone();
                match entry.via.iter_mut().find(|(n, _)| *n == who) {
                    Some((_, n)) => *n += 1,
                    None => entry.via.push((who, 1)),
                }
            }
        }
    }
    let mut out: Vec<Contributor> = by.into_values().collect();
    for c in &mut out {
        c.via.sort_by(|a, b| b.1.cmp(&a.1).then(a.0.cmp(&b.0)));
    }
    out.sort_by(|a, b| b.changes.cmp(&a.changes).then(a.name.cmp(&b.name)));
    out
}

/// The language of a path for the languages bar: an extension table for
/// what syntect lacks, then syntect; `None` for prose, data, lock files and
/// vendored or generated paths, which Linguist leaves out too.
pub fn language_of(path: &str) -> Option<&'static str> {
    let lower = path.to_ascii_lowercase();
    let name = lower.rsplit('/').next().unwrap_or(&lower);
    let skip_dirs = ["vendor/", "node_modules/", "target/", "dist/", "third_party/", ".git/"];
    if skip_dirs.iter().any(|d| lower.starts_with(d) || lower.contains(&format!("/{d}"))) {
        return None;
    }
    if name.ends_with(".lock")
        || name == "package-lock.json"
        || name.ends_with(".min.js")
        || name.ends_with(".min.css")
        || name.ends_with(".d.ts")
    {
        return None;
    }
    let ext = name.rsplit_once('.').map(|(_, e)| e).unwrap_or("");
    let by_ext = match ext {
        "s" | "asm" | "a65" | "a80" | "z80" | "inc" | "65s" => Some("Assembly"),
        "toml" => Some("TOML"),
        "ts" | "tsx" | "mts" | "cts" => Some("TypeScript"),
        "kdl" => Some("KDL"),
        "sh" | "bash" | "zsh" => Some("Shell"),
        "h" => Some("C"),
        "hpp" | "hh" | "cc" | "cxx" => Some("C++"),
        "vue" => Some("Vue"),
        "svelte" => Some("Svelte"),
        "zig" => Some("Zig"),
        "nix" => Some("Nix"),
        "md" | "markdown" | "txt" | "rst" | "adoc" | "json" | "csv" | "svg" | "xml" => return None,
        _ => None,
    };
    if by_ext.is_some() {
        return by_ext;
    }
    let lang = crate::render::highlight::language(path)?;
    Some(match lang {
        "Bourne Again Shell (bash)" | "Shell-Unix-Generic" => "Shell",
        "Plain Text" | "Markdown" | "MultiMarkdown" | "JSON" | "Git Ignore" | "Git Attributes" | "Git Config" => return None,
        l => l,
    })
}

/// Linguist's colours for common languages; a stable colour otherwise.
pub fn language_colour(name: &str) -> String {
    let known = match name {
        "Rust" => "#dea584",
        "Python" => "#3572a5",
        "Shell" => "#89e051",
        "Makefile" => "#427819",
        "C" => "#555555",
        "C++" => "#f34b7d",
        "C#" => "#178600",
        "Assembly" => "#6e4c13",
        "JavaScript" => "#f1e05a",
        "TypeScript" => "#3178c6",
        "HTML" => "#e34c26",
        "CSS" => "#663399",
        "Go" => "#00add8",
        "Java" => "#b07219",
        "TOML" => "#9c4221",
        "YAML" => "#cb171e",
        "SQL" => "#e38c00",
        "Lua" => "#000080",
        "Ruby" => "#701516",
        "PHP" => "#4f5d95",
        "Haskell" => "#5e5086",
        "KDL" => "#ffb3b3",
        "Dockerfile" => "#384d54",
        "Vue" => "#41b883",
        "Zig" => "#ec915c",
        "Nix" => "#7e7eff",
        _ => "",
    };
    if !known.is_empty() {
        return known.to_string();
    }
    let h = blake3::hash(name.as_bytes());
    let b = h.as_bytes();
    format!("#{:02x}{:02x}{:02x}", 64 + b[0] / 2, 64 + b[1] / 2, 64 + b[2] / 2)
}

/// Languages of a state's files by bytes, largest first; under 1% folds into "Other".
pub fn languages(snapshot: &Snapshot) -> Vec<LanguageShare> {
    let mut by: HashMap<&'static str, u64> = HashMap::new();
    for (path, f) in &snapshot.files {
        if let FileContent::Text { bytes, .. } = &f.content {
            if let Some(l) = language_of(path) {
                *by.entry(l).or_default() += bytes.len() as u64;
            }
        }
    }
    let total: u64 = by.values().sum();
    if total == 0 {
        return vec![];
    }
    let mut list: Vec<(&str, u64)> = by.into_iter().collect();
    list.sort_by(|a, b| b.1.cmp(&a.1).then(a.0.cmp(b.0)));
    let mut out: Vec<LanguageShare> = Vec::new();
    let mut other = 0u64;
    for (name, bytes) in list {
        if (bytes as f64) * 100.0 / (total as f64) < 1.0 || out.len() >= 8 {
            other += bytes;
        } else {
            out.push(LanguageShare {
                name: name.to_string(),
                bytes,
                percent: bytes as f64 * 100.0 / total as f64,
                colour: language_colour(name),
            });
        }
    }
    if other > 0 {
        out.push(LanguageShare {
            name: "Other".into(),
            bytes: other,
            percent: other as f64 * 100.0 / total as f64,
            colour: "#8592ad".into(),
        });
    }
    out
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum PolicyBadge {
    None,
    Active,
    Expired,
}

pub fn bookmarks(repo: &Repo, cache: &StateCache, default: &str) -> Result<Vec<BookmarkView>> {
    let list = repo.bookmarks()?;
    let briefs = cache.briefs(repo, &list.iter().map(|b| b.heads.clone()).collect::<Vec<_>>())?;
    let mut out = Vec::new();
    for (b, s) in list.iter().zip(briefs) {
        out.push(BookmarkView {
            name: b.name.clone(),
            heads: b.heads.iter().map(|h| h.to_hex()).collect(),
            changes: s.changes,
            default: b.name == default,
            conflicted: s.conflicted,
            latest_ms: s.latest_ms,
        });
    }
    out.sort_by(|a, b| b.default.cmp(&a.default).then_with(|| a.name.cmp(&b.name)));
    Ok(out)
}

pub fn tags(repo: &Repo) -> Result<Vec<TagView>> {
    let mut out: Vec<TagView> = repo
        .tags()?
        .into_iter()
        .map(|t| TagView { name: t.name, heads: t.heads.iter().map(|h| h.to_hex()).collect(), message: t.message, signer: t.signer })
        .collect();
    out.sort_by(|a, b| b.name.cmp(&a.name));
    Ok(out)
}

/// The tags withdrawn here, newest first.
pub fn withdrawn_tags(repo: &Repo) -> Result<Vec<WithdrawnView>> {
    let mut out: Vec<WithdrawnView> = repo
        .remote_refs()?
        .withdrawn
        .into_iter()
        .filter_map(|t| {
            let sa = t.attestation?;
            let oxy_core::attest::AttestBody::Untag { reason, .. } = &sa.attest.body else { return None };
            Some(WithdrawnView {
                name: t.name,
                heads: t.heads.iter().map(|h| h.to_hex()).collect(),
                reason: reason.clone(),
                signer: sa.sigs.first().and_then(|s| repo.store().get_identity(&s.key).ok()).map(|i| i.name),
                when_ms: sa.attest.hlc.wall_ms as i64,
            })
        })
        .collect();
    out.sort_by_key(|w| std::cmp::Reverse(w.when_ms));
    Ok(out)
}

pub fn policy_badge(repo: &Repo) -> PolicyBadge {
    match repo.current_policy() {
        Ok(Some((_, sp))) => {
            if sp.policy.expires != 0 && (sp.policy.expires as i64) < crate::db::now_ms() {
                PolicyBadge::Expired
            } else {
                PolicyBadge::Active
            }
        }
        _ => PolicyBadge::None,
    }
}

/// The overview of `shown` (a bookmark or tag; the default bookmark
/// unless the viewer chose another, oxygenhub#191).
pub fn overview(repo: &Repo, cache: &StateCache, default_bookmark: &str, shown: &str) -> Result<Overview> {
    let target = match resolve(repo, cache, shown) {
        Ok(t) => t,
        Err(_) => RefTarget { label: shown.into(), kind: RefKind::Bookmark, heads: vec![] },
    };
    let heads = target.heads.len();
    // One load of the default state serves the counts, the latest change
    // and the tree (hub spec §16.3).
    let loaded = cache.load(repo, &target.heads)?;
    let state = &loaded.state;
    let snapshot = &loaded.snapshot;
    let changes = state.len();
    let conflicted = snapshot.is_conflicted();
    let labels = head_labels(repo)?;
    let latest = state
        .changes()
        .max_by(|(ha, a), (hb, b)| a.hlc.cmp(&b.hlc).then(ha.cmp(hb)))
        .map(|(h, m)| change_view(repo, h, m, state.heads().contains(h), &labels));
    let tree = tree_of(repo, target, snapshot, "")?;
    let license = tree
        .entries
        .iter()
        .find(|e| matches!(e.name.to_lowercase().as_str(), "license" | "license.md" | "license.txt" | "licence" | "copying"))
        .map(|e| e.path.clone());
    Ok(Overview {
        tree,
        changes,
        heads,
        bookmarks: bookmarks(repo, cache, default_bookmark)?,
        tags: tags(repo)?,
        latest,
        conflicted,
        license,
        policy: policy_badge(repo),
        contributors: contributors(repo, state),
        languages: languages(snapshot),
    })
}

// -------------------------------------------------------------- compare

#[derive(Clone, Debug)]
pub struct Compare {
    pub base: RefTarget,
    pub head: RefTarget,
    /// Changes in `head`'s state not in `base`'s.
    pub added: Vec<ChangeView>,
    /// Changes in `base`'s state not in `head`'s.
    pub missing: usize,
    pub files: Vec<FileDiff>,
    pub bases: BTreeMap<String, Vec<u8>>,
}

pub fn compare(repo: &Repo, cache: &StateCache, base: RefTarget, head: RefTarget) -> Result<Compare> {
    let base_loaded = cache.load(repo, &base.heads)?;
    let head_loaded = cache.load(repo, &head.heads)?;
    let base_state = &base_loaded.state;
    let head_state = &head_loaded.state;
    let labels = head_labels(repo)?;
    let mut added: Vec<ChangeView> = head_state
        .changes()
        .filter(|(h, _)| !base_state.contains(h))
        .map(|(h, m)| change_view(repo, h, m, head_state.heads().contains(h), &labels))
        .collect();
    added.sort_by_key(|c| std::cmp::Reverse(c.when_ms));
    let missing = base_state.changes().filter(|(h, _)| !head_state.contains(h)).count();
    let (files, bases) = crate::render::diff::snapshot_diff(&base_loaded.snapshot, &head_loaded.snapshot);
    Ok(Compare { base, head, added, missing, files, bases })
}

// ------------------------------------------------------------ conflicts

#[derive(Clone, Debug)]
pub struct ConflictView {
    pub bookmark: String,
    pub path: String,
    pub kind: String,
    /// The file rendered with `oxy` conflict markers, when a text file.
    pub marked: Option<String>,
    pub contributors: Vec<ChangeView>,
}

pub fn conflicts(repo: &Repo, cache: &StateCache) -> Result<Vec<ConflictView>> {
    let list = repo.bookmarks()?;
    let briefs = cache.briefs(repo, &list.iter().map(|b| b.heads.clone()).collect::<Vec<_>>())?;
    let mut out = Vec::new();
    for (b, brief) in list.iter().zip(briefs) {
        // Only a conflicted state is loaded whole.
        if !brief.conflicted {
            continue;
        }
        let loaded = cache.load(repo, &b.heads)?;
        out.extend(conflicts_in(repo, &loaded, &b.name));
    }
    Ok(out)
}

/// The conflicts of one loaded state, labelled with `bookmark`.
pub fn conflicts_in(repo: &Repo, loaded: &super::cache::Loaded, bookmark: &str) -> Vec<ConflictView> {
    let labels = head_labels(repo).unwrap_or_default();
    let mut out = Vec::new();
    {
        let b_name = bookmark.to_string();
        let state = &loaded.state;
        let snapshot = &loaded.snapshot;
        for c in &snapshot.tree.conflicts {
            let (path, kind) = describe_tree_conflict(snapshot, c);
            out.push(ConflictView { bookmark: b_name.clone(), path, kind, marked: None, contributors: vec![] });
        }
        for (path, f) in &snapshot.files {
            if !f.is_conflicted() {
                continue;
            }
            let (kind, marked, contributors) = match &f.content {
                FileContent::Text { .. } => {
                    let (bytes, _) = state.render_file(&f.node);
                    let regions = state.conflict_regions(&f.node);
                    let contributors: Vec<ChangeView> = regions
                        .contributors
                        .iter()
                        .filter_map(|h| state.get(h).map(|m| change_view(repo, h, m, state.heads().contains(h), &labels)))
                        .collect();
                    ("lines".to_string(), Some(String::from_utf8_lossy(&bytes).into_owned()), contributors)
                }
                FileContent::Opaque { blobs } => (format!("replace ({} candidates)", blobs.len()), None, vec![]),
                FileContent::Dir => continue,
            };
            out.push(ConflictView { bookmark: b_name.clone(), path: path.clone(), kind, marked, contributors });
        }
    }
    out
}

fn describe_tree_conflict(snapshot: &Snapshot, c: &TreeConflict) -> (String, String) {
    let by_node = snapshot.tree.by_node();
    let path_of = |n: &oxy_core::ids::NodeId| by_node.get(n).map(|e| e.path.clone()).unwrap_or_else(|| n.short(8));
    match c {
        TreeConflict::Name { name, nodes, parent } => {
            let path = if parent.is_root() { name.clone() } else { format!("{}/{name}", path_of(parent)) };
            (path, format!("name: {} entries want this name", nodes.len()))
        }
        TreeConflict::MultiPlacement { node, placements } => (path_of(node), format!("placement: {} places", placements.len())),
        TreeConflict::Orphan { node, .. } => (path_of(node), "orphan: parent directory was removed".into()),
        TreeConflict::Cycle { node } => (path_of(node), "cycle: directory moved into itself".into()),
        other => (String::new(), format!("{other:?}")),
    }
}

// ------------------------------------------------------------------ trust

#[derive(Clone, Debug)]
pub struct KeyView {
    pub key: String,
    pub short: String,
    pub name: String,
    pub email: String,
}

#[derive(Clone, Debug)]
pub struct RuleView {
    pub pattern: String,
    pub keys: Vec<KeyView>,
    pub threshold: u32,
    pub require: String,
    pub allow_conflicts: bool,
}

#[derive(Clone, Debug)]
pub struct PolicyView {
    pub serial: u64,
    pub expires_ms: u64,
    pub expired: bool,
    pub roots: Vec<KeyView>,
    pub root_threshold: u32,
    pub rules: Vec<RuleView>,
    pub revoked: Vec<KeyView>,
    pub signatures: usize,
    pub history: usize,
}

#[derive(Clone, Debug, Default)]
pub struct Verification {
    pub total: usize,
    pub signed: usize,
    pub sealed: usize,
    pub unsigned: usize,
    pub revoked: usize,
    pub invalid: Vec<(String, String)>,
}

#[derive(Clone, Debug)]
pub struct Trust {
    pub policy: Option<PolicyView>,
    pub verification: Verification,
    pub hub_key: String,
    pub hub_delegated_by: Vec<KeyView>,
}

fn key_view(repo: &Repo, ids: &[oxy_core::identity::Identity], key: &KeyId) -> KeyView {
    let found = ids.iter().find(|i| i.hash() == *key).cloned().or_else(|| repo.store().get_identity(key).ok());
    match found {
        Some(i) => KeyView { key: key.to_hex(), short: key.short(12), name: i.name, email: i.email },
        None => KeyView { key: key.to_hex(), short: key.short(12), name: String::new(), email: String::new() },
    }
}

pub fn verification(repo: &Repo, cache: &StateCache) -> Result<Verification> {
    let heads = all_heads(repo)?;
    let loaded = cache.load(repo, &heads)?;
    let state = &loaded.state;
    let mut v = Verification::default();
    for (h, _) in state.changes() {
        v.total += 1;
        match signature(repo, h) {
            SigView::Unsigned => v.unsigned += 1,
            SigView::Valid { sealed, revoked, .. } => {
                if revoked {
                    v.revoked += 1;
                }
                if sealed {
                    v.sealed += 1
                } else {
                    v.signed += 1
                }
            }
            SigView::Invalid(why) => v.invalid.push((h.to_hex(), why)),
        }
    }
    Ok(v)
}

pub fn trust(repo: &Repo, cache: &StateCache, hub_key: &KeyId) -> Result<Trust> {
    let policy = match repo.current_policy()? {
        Some((_, sp)) => {
            let p = &sp.policy;
            let ids = &p.identities;
            let require = |r: &oxy_core::policy::Require| match r {
                oxy_core::policy::Require::Signed => "signed",
                oxy_core::policy::Require::Sealed => "sealed",
                oxy_core::policy::Require::Any => "any",
            };
            Some(PolicyView {
                serial: p.serial,
                expires_ms: p.expires,
                expired: p.expires != 0 && (p.expires as i64) < crate::db::now_ms(),
                roots: p.roots.iter().map(|k| key_view(repo, ids, k)).collect(),
                root_threshold: p.root_threshold,
                rules: p
                    .rules
                    .iter()
                    .map(|r| RuleView {
                        pattern: r.pattern.clone(),
                        keys: r.keys.iter().map(|k| key_view(repo, ids, k)).collect(),
                        threshold: r.threshold,
                        require: require(&r.require).into(),
                        allow_conflicts: r.allow_conflicts,
                    })
                    .collect(),
                revoked: p.revoked.iter().map(|k| key_view(repo, ids, k)).collect(),
                signatures: sp.sigs.len(),
                history: repo.policy_history().map(|h| h.len()).unwrap_or(0),
            })
        }
        None => None,
    };
    // Who has delegated to the hub: every identity in the policy or store
    // that lists the hub key.
    let mut delegated = Vec::new();
    if let Some(p) = repo.current_policy()?.map(|(_, sp)| sp.policy) {
        for i in &p.identities {
            if i.delegate(hub_key).is_some() {
                delegated.push(KeyView { key: i.hash().to_hex(), short: i.hash().short(12), name: i.name.clone(), email: i.email.clone() });
            }
        }
    }
    Ok(Trust { policy, verification: verification(repo, cache)?, hub_key: hub_key.to_hex(), hub_delegated_by: delegated })
}

#[cfg(test)]
mod language_tests {
    use super::*;

    #[test]
    fn languages_are_detected_and_prose_is_left_out() {
        assert_eq!(language_of("src/main.rs"), Some("Rust"));
        assert_eq!(language_of("boot/start.s"), Some("Assembly"));
        assert_eq!(language_of("build.sh"), Some("Shell"));
        assert_eq!(language_of("Makefile"), Some("Makefile"));
        assert_eq!(language_of("Cargo.toml"), Some("TOML"));
        assert_eq!(language_of("README.md"), None);
        assert_eq!(language_of("Cargo.lock"), None);
        assert_eq!(language_of("web/node_modules/x/index.js"), None);
        assert_eq!(language_of("vendor/lib.c"), None);
        assert_eq!(language_colour("Rust"), "#dea584");
        assert_eq!(language_colour("Befunge"), language_colour("Befunge"), "stable");
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn tree(paths: &[&str]) -> BTreeMap<String, bool> {
        let mut m = BTreeMap::new();
        for p in paths {
            let mut end = 0;
            let parts: Vec<&str> = p.split('/').collect();
            for (i, part) in parts.iter().enumerate() {
                end += part.len();
                m.insert(p[..end].to_string(), i + 1 < parts.len());
                end += 1;
            }
        }
        m
    }

    #[test]
    fn sidebar_expands_the_path_only() {
        let files = tree(&["README.md", "src/main.rs", "src/lib/a.rs", "src/lib/b.rs", "docs/guide.md", "Zeta.txt"]);
        let rows: Vec<(String, usize, bool, bool)> =
            sidebar_in(&files, |d| *d, "src/lib/b.rs").into_iter().map(|e| (e.path, e.depth, e.dir, e.on_path)).collect();
        let want = [
            ("docs", 0, true, false),
            ("src", 0, true, true),
            ("src/lib", 1, true, true),
            ("src/lib/a.rs", 2, false, false),
            ("src/lib/b.rs", 2, false, true),
            ("src/main.rs", 1, false, false),
            ("README.md", 0, false, false),
            ("Zeta.txt", 0, false, false),
        ];
        assert_eq!(rows, want.iter().map(|(p, d, dir, on)| (p.to_string(), *d, *dir, *on)).collect::<Vec<_>>());
    }

    #[test]
    fn sidebar_cuts_long_directories_but_keeps_the_file() {
        let names: Vec<String> = (0..250).map(|i| format!("big/f{i:03}.txt")).collect();
        let refs: Vec<&str> = names.iter().map(String::as_str).collect();
        let files = tree(&refs);
        let rows = sidebar_in(&files, |d| *d, "big/f240.txt");
        let listed: Vec<&SideEntry> = rows.iter().filter(|e| e.depth == 1 && !e.more).collect();
        assert_eq!(listed.len(), SIDEBAR_PER_DIR + 1, "the limit plus the file itself");
        assert!(listed.last().unwrap().on_path);
        let more = rows.iter().find(|e| e.more).unwrap();
        assert_eq!((more.name.as_str(), more.path.as_str()), ("50 more", "big"));
    }

    #[test]
    fn state_addresses_are_sorted_and_bounded() {
        let a = ChangeHash::from_hex(&"a".repeat(64)).unwrap();
        let b = ChangeHash::from_hex(&"b".repeat(64)).unwrap();
        assert_eq!(state_spec(&[b, a, b]).unwrap(), format!("{}+{}", "a".repeat(64), "b".repeat(64)));
        assert_eq!(state_spec(&[]), None);
        assert_eq!(state_spec(&vec![a; MAX_STATE_HEADS + 1]), None);
        let t = RefTarget { label: state_spec(&[a, b]).unwrap(), kind: RefKind::Change, heads: vec![a, b] };
        assert_eq!(t.short_label(), format!("{} +1", "a".repeat(12)));
        assert_eq!(RefTarget { label: "main".into(), kind: RefKind::Bookmark, heads: vec![a] }.short_label(), "main");
    }
}
`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet
Coverage / crates/hub/src/repos/view.rs 92.1%

Keyboard
