@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.28

package/server-managed/team-reports.ts

@@ -1,11 +1,12 @@
 // Team content is filtered as one workspace, with separate report envelopes.
-// Only the visibility index is retained in memory for annotations/source reads.
+// Bounded snapshots retain filtered content and visibility for repeated reads.
 import { Buffer } from 'node:buffer'
-import { backfillFindingIds, reportEntries, stampSecurityGroups } from '../report/index.js'
+import { backfillFindingIds, reportEntries, stampSecurityGroups } from '@preventive/report'
 import { managedFindingSourcePaths, readManagedReport } from '../common/managed/report-content.ts'
 import { filterReportData, projectFinding } from '../common/managed/report-filter.ts'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
+import { triageWireEntry } from './triage-response.ts'
 import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 
 type Finding = Record<string, unknown>
@@ -15,6 +16,20 @@ type Visibility = Map<string, ReportVisibility>
 const VISIBILITY_CACHE_MAX_ITEMS = 250_000
 const VISIBILITY_CACHE_MAX_SNAPSHOTS = 32
 const caches = new WeakMap<ManagedDb, Map<string, Visibility>>()
+const REPORT_CACHE_BYTES = 16 * 1024 * 1024
+const reportCaches = new WeakMap<ManagedDb, Map<string, Buffer>>()
+function retainReports(db: ManagedDb, key: string, bytes: Buffer) {
+  if (bytes.length > REPORT_CACHE_BYTES) return
+  let cache = reportCaches.get(db)
+  if (!cache) { cache = new Map(); reportCaches.set(db, cache) }
+  cache.delete(key)
+  let total = bytes.length + [...cache.values()].reduce((sum, value) => sum + value.length, 0)
+  for (const [oldest, value] of cache) {
+    if (total <= REPORT_CACHE_BYTES && cache.size < VISIBILITY_CACHE_MAX_SNAPSHOTS) break
+    cache.delete(oldest); total -= value.length
+  }
+  cache.set(key, bytes)
+}
 function visibilityWeight(visible: Visibility): number {
   return [...visible.values()].reduce((sum, v) => sum + v.ids.size + v.sourcePaths.size, 0)
 }
@@ -61,24 +76,30 @@ function linksOf(data: unknown): string[][] | null {
   if (!record.links.every(ids => Array.isArray(ids) && ids.every(id => typeof id === 'string'))) throw new TeamReportsError(422, 'unreadable-links')
   return record.links
 }
-async function loadTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<{ reports: TeamReport[]; visible: Visibility }> {
+async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<{ body: Buffer; visible: Visibility }> {
   if (snapshot.reports.length > MAX_REPORT_QUERY_COUNT || snapshot.reports.reduce((n, r) => n + r.byteSize, 0) > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
   const reports: TeamReport[] = []
-  let inputBytes = 0
-  // Retain parsed reports for cross-report classification; release raw bytes
-  // after each parse. No unbounded burst of remote reads or duplicate buffers.
-  for (const access of snapshot.reports) {
-    const bytes = await store.get(access.id)
-    if (!bytes) throw new TeamReportsError(503, 'unavailable')
-    inputBytes += bytes.length
-    if (inputBytes > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
-    const parsed = readManagedReport(bytes.toString('utf8'), access.filename)
-    if (!parsed.data) throw new TeamReportsError(422, 'unreadable-report')
-    // Backfill before filtering so links, annotations and the client agree on
-    // IDs even when hiding a component would change the original row shape.
-    await backfillFindingIds(groupsOf(parsed.data).flat())
-    reports.push({ id: access.id, filename: access.filename, data: parsed.data, repo: access.repo })
-  }
+  let inputBytes = 0, next = 0
+  // Bound both remote reads and raw buffers, retaining stable report order for
+  // the cross-report classification that follows. Finish workers on failure.
+  const results = await Promise.allSettled(Array.from({ length: Math.min(4, snapshot.reports.length) }, async () => {
+    while (next < snapshot.reports.length) {
+      const index = next++
+      const access = snapshot.reports[index]!
+
+      const bytes = await store.get(access.id)
+      if (!bytes) throw new TeamReportsError(503, 'unavailable')
+      inputBytes += bytes.length
+      if (inputBytes > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+      const parsed = readManagedReport(bytes.toString('utf8'), access.filename)
+      if (!parsed.data) throw new TeamReportsError(422, 'unreadable-report')
+      // Backfill before filtering so links, annotations and the client agree on
+      // IDs even when hiding a component would change the original row shape.
+      await backfillFindingIds(groupsOf(parsed.data).flat())
+      reports[index] = { id: access.id, filename: access.filename, data: parsed.data, repo: access.repo }
+    }
+  }))
+  for (const result of results) if (result.status === 'rejected') throw result.reason
   const edges = new Map<string, Set<string>>()
   const connect = (a: string, b: string) => {
     if (!edges.has(a)) edges.set(a, new Set())
@@ -112,15 +133,41 @@ async function loadTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Team
     if (links) report.data = { source: 'links', findings: [], links: links.map(ids => [...new Set(ids.filter(id => allIds.has(id)))]).filter(ids => ids.length >= 2) }
   }
   let outputBytes = 14
-  for (const report of reports) {
-    outputBytes += Buffer.byteLength(JSON.stringify(report)) + 1
+  const parts = [Buffer.from('{"reports":[')]
+  for (const [index, report] of reports.entries()) {
+    const bytes = Buffer.from(JSON.stringify(report))
+    outputBytes += bytes.length + 1
     if (outputBytes > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+    if (index) parts.push(Buffer.from(','))
+    parts.push(bytes)
   }
+  parts.push(Buffer.from(']}'))
+  const body = Buffer.concat(parts)
   retainVisibility(db, teamSnapshotKey(snapshot), visible)
-  return { reports, visible }
+  retainReports(db, teamSnapshotKey(snapshot), body)
+  return { body, visible }
+}
+const pendingWorkspaces = new WeakMap<ManagedDb, Map<string, ReturnType<typeof buildTeamWorkspace>>>()
+async function loadTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot) {
+  let pending = pendingWorkspaces.get(db)
+  if (!pending) { pending = new Map(); pendingWorkspaces.set(db, pending) }
+  const key = teamSnapshotKey(snapshot)
+  const existing = pending.get(key)
+  if (existing) return existing
+  const job = buildTeamWorkspace(db, store, snapshot)
+  pending.set(key, job)
+  try { return await job } finally { pending.delete(key) }
+}
+// Treat the encoded body as immutable and recheck access before sending it.
+// Warm HTTP reads need neither a parsed copy nor another serialization pass.
+export async function loadTeamReportsResponse(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Buffer> {
+  const cached = reportCaches.get(db)?.get(teamSnapshotKey(snapshot))
+  return cached ?? (await loadTeamWorkspace(db, store, snapshot)).body
 }
 export async function loadTeamReports(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<TeamReport[]> {
-  return (await loadTeamWorkspace(db, store, snapshot)).reports
+  // Object consumers get their own copy, including when sharing a cold load.
+  const body = await loadTeamReportsResponse(db, store, snapshot)
+  return (JSON.parse(body.toString('utf8')) as { reports: TeamReport[] }).reports
 }
 async function teamVisibility(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Visibility> {
   const key = teamSnapshotKey(snapshot)
@@ -154,3 +201,19 @@ export async function teamSourcePaths(db: ManagedDb, store: BlobStore, sessionId
   await recheckTeam(db, sessionId, snapshot)
   return visible.sourcePaths
 }
+
+// Serialize shared annotation bodies once. Reports carry only the annotated
+// finding IDs visible in that report; callers revalidate access before sending.
+export async function loadTeamAnnotations(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot, reportId: string | null = null) {
+  // Restrict annotation reads only after classifying the complete workspace:
+  // links and findings in other reports can affect this report's visibility.
+  const visible = reportId === null ? await teamVisibility(db, store, snapshot)
+    : new Map([[reportId, await teamReportVisibility(db, store, snapshot, reportId)]])
+  const ids = new Set<string>()
+  for (const report of visible.values()) for (const id of report.ids) ids.add(id)
+  const { triage, comments } = await db.getAnnotations([...ids])
+  const entries = Object.fromEntries(triage.map(row => [row.findingId, triageWireEntry(row)]))
+  const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId)])
+  const reports = Object.fromEntries([...visible].map(([id, report]) => [id, [...report.ids].filter(finding => annotated.has(finding))]))
+  return { reports, entries, comments }
+}

package/server-managed/uploads.ts

@@ -38,8 +38,8 @@ export async function deleteUpload(store: BlobStore, session: string, kind: Uplo
   if (errors.length > 0) throw new AggregateError(errors, 'Upload cleanup failed')
 }
 
-export function putUploadPart(store: BlobStore, session: string, kind: UploadKind, id: string, index: number, bytes: Buffer): Promise<void> {
-  return store.put(partId(session, kind, id, index), bytes)
+export async function putUploadPart(store: BlobStore, session: string, kind: UploadKind, id: string, index: number, bytes: Buffer): Promise<void> {
+  await store.put(partId(session, kind, id, index), bytes)
 }
 
 export async function readUpload(store: BlobStore, req: IncomingMessage, session: string, kind: UploadKind, maxBytes: number): Promise<Buffer> {

package/server-managed/workspace-shares.ts

@@ -31,6 +31,7 @@ export interface ManagedWorkspaceShare extends WorkspaceShareInfo {
   teamName: string
   teamSlug: string
 }
+export type WorkspaceShareFeedState = { grant: string; catalog: number; annotations: number }
 export interface WorkspaceShareStore {
   createWorkspaceShare(sessionId: string, now: number, teamId: string, tokenHash: string, permissions?: TeamUserPermissions): Promise<boolean>
   listWorkspaceShares(sessionId: string, now: number, teamId: string): Promise<WorkspaceShareInfo[] | null>
@@ -38,6 +39,7 @@ export interface WorkspaceShareStore {
   updateWorkspaceShare(sessionId: string, now: number, teamId: string, id: string, permissions: TeamUserPermissions): Promise<boolean>
   revokeWorkspaceShares(sessionId: string, now: number, teamId: string, id?: string): Promise<boolean>
   getWorkspaceShare(tokenHash: string): Promise<WorkspaceShareSnapshot | null>
+  getWorkspaceShareFeedState(tokenHash: string): Promise<WorkspaceShareFeedState | null>
 }
 
 // A share is a capability, never a user session. Its issuer must still manage
@@ -63,11 +65,17 @@ function shareQueries(db: ManagedSql) {
     JOIN managed_user u ON u.id = s.created_by JOIN managed_team t ON t.id = s.team_id
     WHERE ? = 'admin' OR EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = ? AND tu.team_id = s.team_id)
     ORDER BY t.name, t.id, s.created_at DESC, s.token_hash`)
-  const share = db.prepare(`SELECT t.id, t.slug, t.name, s.dependencies, s.security FROM managed_workspace_share s
+  const shareGrant = `FROM managed_workspace_share s
     JOIN managed_user u ON u.id = s.created_by
     JOIN managed_team t ON t.id = s.team_id
     WHERE s.token_hash = ? AND (u.role = 'admin' OR (u.role = 'manage'
-      AND EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = u.id AND tu.team_id = s.team_id)))`)
+      AND EXISTS (SELECT 1 FROM managed_team_user tu WHERE tu.user_id = u.id AND tu.team_id = s.team_id)))`
+  const share = db.prepare(`SELECT t.id, t.slug, t.name, s.dependencies, s.security ${shareGrant}`)
+  // Validate the capability and its issuer every poll; global counters are
+  // internal hints that let unchanged feeds skip rebuilding the full catalog.
+  const feed = db.prepare(`SELECT t.id, s.dependencies, s.security,
+    (SELECT catalog FROM managed_change_revision WHERE id = 1) AS catalog,
+    (SELECT annotations FROM managed_change_revision WHERE id = 1) AS annotations ${shareGrant}`)
   const repositories = db.prepare(`SELECT tr.repo_id AS repoId, sr.full_name AS github, tr.path
     FROM managed_team_repo tr JOIN managed_selected_repo sr ON sr.repo_id = tr.repo_id
     WHERE tr.team_id = ? ORDER BY tr.repo_id, tr.path`)
@@ -85,7 +93,7 @@ function shareQueries(db: ManagedSql) {
     JOIN managed_selected_repo sr ON sr.repo_id = b.repo_id
     WHERE tr.team_id = ? AND (tr.path = '' OR b.repo_directory = tr.path
       OR substr(b.repo_directory, 1, length(tr.path) + 1) = tr.path || '/') ORDER BY b.id`)
-  return { manager, insert, remove, update, list, session, all, share, repositories, reports, bundles }
+  return { manager, insert, remove, update, list, session, all, share, feed, repositories, reports, bundles }
 }
 
 function shareInfo<T extends { dependencies: number; security: number }>(row: T) {
@@ -123,6 +131,10 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       const result = await q.remove.run(teamId, id ?? null, id ?? null)
       return id === undefined || result.changes > 0
     },
+    async getWorkspaceShareFeedState(tokenHash) {
+      const row = await q.feed.get(tokenHash) as { id: string; dependencies: number; security: number; catalog: number; annotations: number } | undefined
+      return row ? { grant: JSON.stringify([row.id, row.dependencies, row.security]), catalog: row.catalog, annotations: row.annotations } : null
+    },
     async getWorkspaceShare(tokenHash) {
       const grant = await q.share.get(tokenHash) as { id: string; slug: string; name: string; dependencies: number; security: number } | undefined
       if (!grant) return null

package/report/index.js

@@ -1,260 +0,0 @@
-// The report library — one door to every report format this project
-// reads, and to the one it writes.
-//
-// A "report" is whatever an analyzer wrote: the JSON dump this
-// project's own analyzer emits, or one of the shapes other tools
-// produce — DeepSec and Piolium markdown, Claude Security markdown,
-// Codex CSV — or the markdown document this library itself writes
-// (write-md.js), read back by parse-deepview-md.js. The parsers beside
-// this file each recognise exactly one of those and know nothing about
-// each other; this module is the dispatch over them, so "which formats
-// do we read, and in what order" is answered in one place instead of
-// once per call site.
-//
-//   import { loadFindings, writeMarkdown } from '../report/index.js'
-//   const report = await loadFindings(text)
-//   // → { format, data, findings: [ … with ids ] } | null
-//   const md = writeMarkdown({ title, groups: report.findings.map((f) => [f]) })
-//
-// Three entry points for reading, in rising order of how much they do:
-//
-//   detectFormat  — name the format, parse nothing further
-//   readReport    — the parsed report, or the reason it isn't one
-//   loadFindings  — parsed, flattened, and every finding carrying an id
-//
-// `analyzeReport` is `readReport` for a file list — entry count and
-// producer — `reportEntries` is a report's entry list whichever of the
-// two names it goes under (`findings` or `groups`), for a caller that
-// has to keep the grouping rather than flatten it, and
-// `backfillFindingIds` is the id step on its own, for a caller that
-// has to interleave something with it.
-//
-// And one for writing: `writeMarkdown` takes findings — the parsers'
-// own objects, grouped as the viewer groups them — with whatever the
-// caller knows about the selection and the reader's annotations, and
-// writes the markdown document the Download button saves (write-md.js
-// for the document, write-md-finding.js for one finding, labels.js for
-// the words). Both directions read a finding through finding.js, so
-// what a parser produced and what the writer prints agree on what a
-// finding IS — and the document is itself a report the readers above
-// take (parse-deepview-md.js), so what was written can be loaded
-// again, with the ids and fields it left with.
-//
-// Codex is the one format the content doesn't name: its export is a
-// CSV, and a CSV is a container — one row per finding across several
-// scans — rather than a report. `detectFormat` recognises it by the
-// FILENAME (`.csv`) when given one; the readers are single-report and
-// don't take it. A codex export goes through `parseCodexCsvToScans`,
-// which splits it into one JSON-shaped report per scan, and each of
-// those reads through the readers like any other JSON report.
-//
-// THIS FILE IS THE WHOLE SURFACE. The modules live in `src/` and the
-// package exports one path — `@preventive/report`, this file — so
-// everything a caller may hold is named here, in one list, and
-// everything else is free to move, split or be renamed without
-// breaking anyone. A consumer that wants `fenceRanges` or
-// `findingTitle` imports it from here beside `loadFindings`; there is
-// no second, deeper way in, inside this repo or out of it.
-//
-// That is a deliberate trade against the old shape, where every module
-// was its own entry point. What it costs is the ability to reach past
-// this list; what it buys is that the list IS the contract. Nothing is
-// pulled in that a caller doesn't use: every module here is
-// side-effect-free (`sideEffects: false` in package.json — the whole
-// file is declarations), so a bundler drops what a caller never names,
-// and `ui/view/format.js` still rides its lazily-loaded chunk.
-//
-// This directory is its own package (see package.json beside this
-// file) and imports nothing outside itself: no DOM, no app state, no
-// storage, nothing from the rest of the repo. Text in, data out — and
-// data in, text out. That is what makes it reusable outside the
-// viewer — the analyzer stamps its ids with the same `findingId` the
-// viewer derives them with, so both sides agree on what a finding IS
-// — and `node --test` in this directory runs its suite with nothing
-// else installed — and nothing outside this directory reaches into it,
-// tests included: every test of this library lives in `report/tests/`.
-// Those come through the door like any other caller, except where they
-// exercise an internal this file doesn't export; those name `../src/`,
-// which is what they are testing.
-
-import { parseDeepsecFindings } from './src/parse-deepsec.js'
-import { parseDeepviewMarkdown } from './src/parse-deepview-md.js'
-import { parseMarkdownFindings } from './src/parse-md.js'
-import { parsePioliumFindings } from './src/parse-piolium.js'
-import { deriveFindingId } from './src/finding-id.js'
-import { normalizeFindingSeverity } from './src/severity.js'
-
-// The rest of the surface, so a consumer needs one import: the codex
-// splitter, the id helpers the analyzer shares with the viewer, and the
-// run-meta projection a caller applies to the findings it loads.
-export { parseCodexCsvToScans } from './src/parse-codex.js'
-export { computeFileHash, deriveFindingId, findingId } from './src/finding-id.js'
-export { META_FIELDS, inheritReportMeta, repoDirectory, reportRepoGithub } from './src/meta.js'
-export { stampSecurityGroups } from './src/security.js'
-// The writing side: the document writer, and the label tables it
-// spells the app's enumerations with, for the viewer's surfaces that
-// describe the same things in prose.
-export { writeMarkdown } from './src/write-md.js'
-export { COLOR_LABELS, SEVERITY_LABELS, SOURCE_LABELS, TRIAGE_LABELS, severityLabel } from './src/labels.js'
-
-// Reading a finding: what a finding IS, asked of one. The card, the
-// row, the filters and the writer all ask the same questions of the
-// same object — which tier does this display under, what is its name,
-// where does it sit, what did the pass say about it — and they ask
-// them here, so a parser's output and every surface that renders it
-// can't drift on the answers.
-export {
-  REVALIDATE_KINDS, SEVERITIES, SEVERITY_ORDER, correctedVariants, descriptionSections,
-  displayedSeverity, effectiveSeverity, evidenceNote, findingDisplayName, findingTitle,
-  firstLine, hasSeverityCorrection, isAppFinding, isSecurityFinding, locationLabel, prettyModel, revalidateKindOf,
-  runMetaLine, splitDescription, stripExportMarker, titledDescription,
-} from './src/finding.js'
-
-// The structural-markdown helpers, for a caller rendering the prose a
-// parser handed back: where the fences are (so a `## ` inside a
-// snippet stays in the snippet), and the escapes markdown puts on a
-// name. The viewer's own markdown rendering (ui/view/format.js,
-// export-view-chunks.js) reads the document's shape with these rather
-// than keeping a second, subtly different set.
-export { fenceRanges, inFence, unescapeMd } from './src/md-structure.js'
-export { isHttpUrl } from './src/md-text.js'
-
-// The markdown chain, in dispatch order: tightest guard first. This
-// library's own document opens on a marker line no other format has;
-// DeepSec keys off `## SEVERITY (n)` and Piolium off its `# Security
-// Audit Report` / `## Technical Findings Detail` headings, while
-// parse-md accepts any `# Title` document — so it has to stay last or
-// it would swallow the others. Each returns the standard `{ type,
-// findings, … }` shape, or null when the text isn't its format.
-//
-// `format` is this library's name for the document's producer. For the
-// three foreign markdown formats it matches the `source` marker the
-// parser stamps on what it returns, which is what the viewer reads for
-// its header label. 'deepview-md' is the exception that proves the
-// rule: the document is this library's, but its findings came from
-// whichever producer the document names, and THAT is the `source` it
-// carries back (none for the analyzer's own runs). 'json' has no
-// marker (the analyzer's own dump carries `type` instead).
-const MARKDOWN_FORMATS = [
-  ['deepview-md', parseDeepviewMarkdown],
-  ['deepsec', parseDeepsecFindings],
-  ['piolium', parsePioliumFindings],
-  ['claude-security', parseMarkdownFindings],
-]
-
-// A report's entries: `findings`, or `groups` for a pre-deduplicated
-// dump. Each entry is one finding or a Finding[] group. Null when the
-// document carries neither as an array — which is how a JSON file that
-// isn't a report at all (or a report with a malformed list) is told
-// apart from an empty one.
-//
-// Exported because a report is two shapes and only one of them is
-// called `findings`: a caller reading `data.findings` alone sees an
-// empty report wherever the entries are groups — which is every
-// deduplicated dump, and every export of a view that merged a finding
-// reported twice (parse-deepview-md.js writes `groups` for exactly
-// those). `loadFindings` is the answer for a caller that wants the
-// member findings; this is the one for a caller that has to keep the
-// grouping, as the viewer's ingest does.
-export function reportEntries(data) {
-  if (Array.isArray(data?.findings)) return data.findings
-  if (Array.isArray(data?.groups)) return data.groups
-  return null
-}
-
-// Which producer wrote `content` — 'json' / 'deepview-md' / 'deepsec' /
-// 'piolium' / 'claude-security' / 'codex', or null when nothing
-// recognises it.
-//
-// `filename` is optional and decides only codex: a `.csv` is a codex
-// export, and the content is not consulted for it (nothing in a CSV's
-// text says whose it is, and no other format arrives as one). Every
-// other format is named from the content alone, so a `.md` holding a
-// JSON dump is 'json'. Case-insensitive on the extension; strip any
-// download-duplicate suffix (`report (1).csv`) before calling if the
-// name can carry one after the extension.
-export function detectFormat(content, filename) {
-  if (typeof filename === 'string' && /\.csv$/iu.test(filename)) return 'codex'
-  return readReport(content).format
-}
-
-// Parse `content` in whichever format it turns out to be. JSON first —
-// the analyzer's native dump is the common case and the only format
-// with a cheap, total test — then the markdown chain when `JSON.parse`
-// throws. A JSON document counts as a report only when it carries a
-// `findings` (or `groups`) array: anything else that parses is some
-// other JSON file, not an empty report.
-//
-// Returns `{ data, format, reason }`: the parsed report and its
-// format, or `data: null` with `reason` saying why in one sentence —
-// which a caller reporting "this file isn't a report" can show as is.
-// The usual cause is a truncated or malformed JSON dump rather than an
-// unknown format, so the JSON error rides along in that sentence.
-export function readReport(content) {
-  let jsonError
-  try {
-    const data = JSON.parse(content)
-    if (reportEntries(data)) {
-      for (const finding of flattenFindings(reportEntries(data))) normalizeFindingSeverity(finding)
-      return { data, format: 'json', reason: null }
-    }
-    return { data: null, format: null, reason: 'JSON, but not a report: no findings array' }
-  } catch (err) {
-    jsonError = err
-  }
-  for (const [format, parse] of MARKDOWN_FORMATS) {
-    const data = parse(content)
-    if (data) return { data, format, reason: null }
-  }
-  return {
-    data: null,
-    format: null,
-    reason: `Not JSON, and not a recognized markdown format. (JSON error: ${jsonError.message})`,
-  }
-}
-
-// How many entries `content` holds and who produced it, without
-// flattening anything or deriving a single id — what a file list wants
-// for a badge next to a name. `count` is ENTRIES, not findings: an
-// entry is either one finding or a pre-deduplicated group of them, and
-// the entry count is what a user sees as rows.
-export function analyzeReport(content) {
-  const { data } = readReport(content)
-  if (!data) return { count: 0, recognized: false }
-  return { count: reportEntries(data).length, source: data.source, recognized: true }
-}
-
-// Entries → member findings. A group contributes its members; falsy
-// and non-object entries (a malformed list's stray strings and nulls)
-// are dropped rather than handed on as findings.
-function flattenFindings(entries) {
-  return entries.flat().filter((f) => f && typeof f === 'object')
-}
-
-// Fill in `f.id` for any finding that lacks one, deriving it from the
-// same fingerprint the analyzer stamps. Mutates in place. Findings
-// whose id can't be derived (a host without crypto.subtle) are left
-// untouched. Batched via Promise.all — sequential awaits would
-// serialise hundreds of crypto.subtle.digest calls for no reason.
-export async function backfillFindingIds(findings) {
-  // Managed responses may arrive as already-parsed objects.
-  for (const finding of findings) normalizeFindingSeverity(finding)
-  const idLess = findings.filter((f) => !f.id)
-  if (idLess.length === 0) return
-  const derived = await Promise.all(idLess.map(deriveFindingId))
-  idLess.forEach((f, i) => { if (derived[i]) f.id = derived[i] })
-}
-
-// Recognise, flatten, and give every finding an id — the whole read
-// path in one call. Returns `{ format, data, findings }`, or null when
-// nothing recognises the text. The findings are the parser's own
-// objects (not copies), so a caller that means to keep them can, and
-// one projecting run meta onto them has `inheritReportMeta` and `data`
-// to hand.
-export async function loadFindings(content) {
-  const { data, format } = readReport(content)
-  if (!data) return null
-  const findings = flattenFindings(reportEntries(data))
-  await backfillFindingIds(findings)
-  return { format, data, findings }
-}

package/report/src/finding-id.js

@@ -1,80 +0,0 @@
-// Finding ids, stamped by the analyzer onto its JSON output and filled
-// in by the viewer for findings that arrive without one. Web Crypto is
-// the common surface — `crypto.subtle` exists in modern Node and in
-// secure browser contexts — so one implementation runs in both.
-//
-// Two reports from the same source give a finding the same id; an edit
-// to its description or its source invalidates it.
-
-import { encodeUtf8 } from './utf8.js'
-
-function toHex(bytes) {
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')
-}
-
-// The file-content hash the JSON output format uses. sha512 because the
-// id below hashes a string that already includes it, so a collision here
-// would propagate into an id collision. Padded base64 with the SRI-style
-// tag. `btoa` rather than `Uint8Array#toBase64`, still flagged in Node.
-export async function computeFileHash(source) {
-  const bytes = typeof source === 'string' ? encodeUtf8(source) : source
-  const digest = new Uint8Array(await crypto.subtle.digest('SHA-512', bytes))
-  return `sha512-${btoa(String.fromCodePoint(...digest))}`
-}
-
-// A fingerprint hashed into a v4-shaped UUID: derived, not random, but
-// the shape lets a downstream tool treat it as an opaque id.
-async function fingerprintToId(fingerprint) {
-  const bytes = encodeUtf8(JSON.stringify(fingerprint))
-  const digest = await crypto.subtle.digest('SHA-256', bytes)
-  const u = new Uint8Array(digest, 0, 16)
-  // version 4: 0100xxxx
-  u[6] = (u[6] & 0x0f) | 0x40
-  // variant 1: 10xxxxxx
-  u[8] = (u[8] & 0x3f) | 0x80
-  const hex = toHex(u)
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`
-}
-
-// Stable per-finding id from the (severity, description, fileHash) triple
-// the analyzer emits. fileHash being undefined is fine — JSON.stringify
-// drops undefined keys, so a finding with no hash keys off the pair and
-// re-runs over the same source yield the same ids.
-export function findingId(severity, description, fileHash) {
-  return fingerprintToId({ severity, description, fileHash })
-}
-
-// An id derived from a finding, on the first discriminator it carries.
-// null when `crypto.subtle` is unavailable (some `file://` setups), so
-// the caller can fall back to a session-local id — the UI still works,
-// without persistent triage on those findings.
-//
-// In order:
-//   - _idBasis  — a FROZEN fingerprint a parser stamped, used verbatim;
-//                 it exists so a change to the rendered description
-//                 can't re-key stored triage (parse-md-id.js).
-//   - fileHash  — as `findingId` above.
-//   - location  — a markdown import's url, also stable.
-//   - file/line — last resort for a JSON finding with neither: not what
-//                 the spec prescribes, but better than collapsing two
-//                 unrelated findings onto one id.
-export async function deriveFindingId(f) {
-  if (typeof crypto?.subtle?.digest !== 'function') return null
-  const fingerprint = fingerprintOf(f)
-  try {
-    return await fingerprintToId(fingerprint)
-  } catch {
-    return null
-  }
-}
-
-// The choice above as the object that gets hashed. Key order is part of
-// the id — JSON.stringify keeps insertion order — so every shape lists
-// severity and description first.
-export function fingerprintOf(f) {
-  if (f._idBasis) return f._idBasis
-  const { severity, description } = f
-  if (f.fileHash) return { severity, description, fileHash: f.fileHash }
-  if (f.location) return { severity, description, location: f.location }
-  return { severity, description, file: f.file, line: f.line }
-}