@preventive/triage 1.0.0-alpha.36 → 1.0.0-alpha.38

package/server-managed/public-workspace.ts

@@ -5,15 +5,19 @@ import type { ManagedHttpDeps } from './http.ts'
 import type { ManagedBundle } from './db.ts'
 import type { OpenedBlob } from './blob-store.ts'
 import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
-import { sendJson, writeResponse } from './http-response.ts'
+import { sendJson, sendLines, writeResponse } from './http-response.ts'
 import { hashToken } from './crypto.ts'
 import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, teamReportVisibility } from './team-reports.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
-import { auditCache } from './upstream-cache.ts'
+import { auditCache, auditedRepos } from './upstream-cache.ts'
 import { serveTeamFeed } from './team-feed.ts'
+import { type ComparedSide, PrettyError, compared, prettyRequest, prettyText } from './pretty-print.ts'
+import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
+import { typeOnlyFiles } from './type-only.ts'
+import { sharedTeamApp } from './team-app.ts'
 
 function json(res: ServerResponse, status: number, body: unknown): void {
   sendJson(res, status, body, { 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
@@ -31,7 +35,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
   const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed|annotations)$/u.exec(url.pathname)
   const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
-  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories)$/u.exec(url.pathname)
+  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
   const tokenHash = hashToken(token)
   const snapshot = await deps.db.getWorkspaceShare(tokenHash)
@@ -42,8 +46,8 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   }
   const send = async (body: unknown) => { await recheck(); json(res, 200, body) }
   const sendTeam = async () => {
-    const summaries = await bundleSummaries(snapshot.team.bundles, deps.bundleCache)
-    await send({ user: snapshot.user, team: { ...snapshot.team,
+    const [summaries, app] = await Promise.all([bundleSummaries(snapshot.team.bundles, deps.bundleCache), sharedTeamApp(deps.db, deps.reportStore, snapshot)])
+    await send({ user: snapshot.user, team: { ...snapshot.team, app,
       bundles: snapshot.team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })),
     } })
     await backfillBundleSummaries(snapshot.team.bundles, deps.bundleCache)
@@ -97,9 +101,63 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const bundle = snapshot.bundles.find(item => item.id === bundleRoute![1])
   if (!bundle) { json(res, 404, { error: 'no-bundle' }); return }
   if (bundleRoute![2] === 'advisories' && !snapshot.permissions.security) { json(res, 403, { error: 'security-access-required' }); return }
+  if (bundleRoute![2] === 'rename-diff' || bundleRoute![2] === 'type-only' || (bundleRoute![2] === 'pretty' && url.searchParams.has('other'))) {
+    if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
+    await serveCompared(res, deps, bundle, snapshot.bundles.find(item => item.id === url.searchParams.get('other')), bundleRoute![2], url, recheck, stream); return
+  }
   await serveBundle(res, deps, bundle, bundleRoute![2]!, url, recheck, stream)
 }
 
+// What a bundle is compared with `other`, another of the link's bundles, by:
+// one of their JavaScript files diffed with renamed names hidden, or the
+// files that changed between them, or the pairs of those, or those that
+// changed in types alone, a line each.
+function serveCompared(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, part: string, url: URL,
+  recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (part === 'rename-diff' && url.searchParams.has('path')) return serveRenameDiff(res, deps, bundle, other, url, stream)
+  return serveChanges(res, deps, bundle, other, recheck, part === 'pretty' ? compared : part === 'type-only' ? typeOnlyFiles : renamedPairs,
+    part === 'pretty' ? '' : url.searchParams.get('scope') ?? '')
+}
+
+// One of a bundle's JavaScript files diffed with one of `other`, another of
+// the link's bundles (rename-diff.ts).
+async function serveRenameDiff(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, url: URL,
+  stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  const request = renameDiffRequest(url.searchParams)
+  if (!request) { json(res, 400, { error: 'bad-file' }); return }
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  const { prettyCache } = deps
+  if (!prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let diff
+  try {
+    diff = await renameDiffOf(request, async () => [await prettyText(await prettyCache.bundle(bundle, request.base)),
+      await prettyText(await prettyCache.bundle(other, request.other))])
+  } catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await stream(diff, 'br')
+}
+
+// The files that changed between a bundle and `other`, another of the link's
+// bundles, both sides' pretty-printed (pretty-print.ts compared), or the pairs
+// of them its viewer diffs with renamed names hidden (rename-diff.ts
+// renamedPairs), those within a reason `scope` where given, the link checked
+// again before each line.
+async function serveChanges(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, recheck: () => Promise<void>,
+  linesOf: (sides: [ComparedSide, ComparedSide]) => AsyncIterable<unknown>, scope: string) {
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  if (!deps.prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let lines
+  try { lines = linesOf(await deps.prettyCache.bundleSides(bundle, other, scope)) }
+  catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await recheck()
+  await sendLines(res, lines, () => recheck().then(() => true, () => false))
+}
+
 async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, part: string, url: URL,
   recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
   if (part === 'download') {
@@ -107,6 +165,18 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
     if (!stored) { json(res, 503, { error: 'unavailable' }); return }
     await stream(stored, bundle.kind === 'sourcemap' ? 'br' : null, 'application/octet-stream'); return
   }
+  if (part === 'pretty') {
+    const file = prettyRequest(url.searchParams)
+    if (!file) { json(res, 400, { error: 'bad-file' }); return }
+    if (!deps.prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+    let pretty
+    try { pretty = await deps.prettyCache.bundle(bundle, file) }
+    catch (err) {
+      if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+      throw err
+    }
+    await stream(pretty, 'br', 'text/plain; charset=utf-8'); return
+  }
   if (!deps.bundleCache) { json(res, 503, { error: 'unavailable' }); return }
   if (part === 'advisories') {
     if (bundle.kind !== 'stasis') { json(res, 422, { error: 'unsupported-bundle' }); return }
@@ -116,9 +186,10 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
     if (inventory === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
     if (Buffer.byteLength(JSON.stringify(inventory)) > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
     const signal = AbortSignal.timeout(ADVISORIES_TIMEOUT_MS)
+    const repoAdvisories = url.searchParams.get('repoAdvisories') === 'true'
     const result = await fetchBundleAdvisories(inventory.packages, signal, {
-      debug: deps.config.debug, repoAdvisories: url.searchParams.get('repoAdvisories') === 'true', details: url.searchParams.get('details') === 'true',
-      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug),
+      debug: deps.config.debug, repoAdvisories, details: url.searchParams.get('details') === 'true',
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug, auditedRepos(inventory.packages, repoAdvisories)),
     })
     await recheck()
     json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return

package/server-managed/rename-diff-worker.js

@@ -0,0 +1,26 @@
+// Compare's diff with renamed names hidden (rename-diff.ts), worked out off the
+// server's event loop by @preventive/compare's renamedDiffs: the old side given
+// the new side's names, formatted again where that changes its layout alone,
+// diffed with whitespace changes shown and hidden, and the blocks checked to
+// take it to the new side. `{ before, blocks, reason, reads, marks,
+// ignoringWhitespace }`: the old side as diffed, the change blocks, why the
+// old side is as it was where its names could not be given safely, the
+// properties through which either side reads names (a view marks renamed
+// lines rather than hiding them where any are read, as a rename may then
+// change what the code does), and the blocks of the diff of the files as they
+// are that differ in renamed names alone; `ignoringWhitespace` the blocks and
+// those marked with whitespace changes hidden, as diff -b hides them. Blocks
+// that would not take the old side to the new are thrown, and so answer
+// nothing.
+import { parentPort, workerData } from 'node:worker_threads'
+import { renamedDiffs } from '@preventive/compare/names.js'
+
+const { before, after, extension, otherExtension } = workerData
+const diff = await renamedDiffs(before, after, { extension, otherExtension, whitespace: ['none', 'change'] })
+// A check that should never fail did, or a step gave way: told, the file shown with its names.
+for (const warning of diff.warnings) console.warn(`managed: rename diff: ${warning}`)
+const [shown, hidden] = diff.diffs
+const answer = { before: diff.before, blocks: shown.blocks, reason: diff.reason, reads: diff.reads, marks: shown.marks, ignoringWhitespace: { blocks: hidden.blocks, marks: hidden.marks } }
+// Node worker messages have no browser target origin.
+// oxlint-disable-next-line unicorn/require-post-message-target-origin
+parentPort.postMessage(answer)

package/server-managed/rename-diff.ts

@@ -0,0 +1,270 @@
+// Compare's diff of a JavaScript file minified on both sides with the names a
+// minifier renamed alike hidden (GET /api/bundles/:id/rename-diff, GET
+// /api/npm/rename-diff): both sides pretty-printed, as the pretty-print toggle
+// has them (pretty-print.ts), then diffed by @preventive/compare's
+// renamedDiffs in a worker, off the event loop and two at a time per process,
+// with whitespace changes shown and hidden both. Answered as Brotli-encoded
+// JSON, `{ before, blocks, reason, reads, marks, ignoringWhitespace }`
+// (rename-diff-worker.js), the two files' hashes, `hash` and `otherHash`, and
+// those of the two copies diffed, `prettyHash` and `otherPrettyHash`, which
+// the viewer checks are those it asked about and draws: one file's asked for
+// by both its sides' paths and hashes, or every pair a comparison's viewer
+// diffs so, a line each (renamedPairs). The last few answers are kept in
+// memory by both files' hashes, a private npm version's never, each side read
+// again through the pretty-print cache first, which checks that its source
+// holds a file of that hash. Access is the caller's to check.
+import { Buffer } from 'node:buffer'
+import { Readable } from 'node:stream'
+import { promisify } from 'node:util'
+import { Worker } from 'node:worker_threads'
+import { brotliDecompress } from 'node:zlib'
+import { layoutPackageDirs, treeLayout } from '@preventive/compare'
+import { computeFileHash } from '@preventive/report'
+import { FILE_HASH } from '../common/bundle-metadata.js'
+import { computeBundleDiff } from '../common/bundle-compare-diff.js'
+import { bundlePkgOf } from '../common/bundle-pkg-of.js'
+import { needsPrettyPrint, prettyExtension } from '../common/pretty-print.js'
+import { type ChangeBlock, blocksHold, textLines } from '../common/line-diff.js'
+import type { OpenedBlob } from './blob-store.ts'
+import { encodeBrotli } from './brotli.ts'
+import { type ComparedSide, PrettyError, type PrettyRequest, prettyText } from './pretty-print.ts'
+
+// What a minifier renames: JavaScript, as the viewer offers it for.
+const RENAMABLE = new Set(['js', 'mjs', 'cjs'])
+// Diffs worked out at once per process, each in a worker of its own, and
+// those waiting their turn past them (a Diff view asks for all it shows at
+// once), any more refused.
+const MAX_ACTIVE_DIFFS = 2
+const MAX_WAITING_DIFFS = 16
+// The longest a diff may take, its wait for a worker included, and the most
+// text it is asked of: both sides pretty-printed, which the largest files
+// formatted (MAX_PRETTY_BYTES) stay under.
+const DIFF_TIMEOUT_MS = 60_000
+const MAX_DIFF_CHARS = 64 * 1024 * 1024
+// Answers kept, the one read last last: each holds the old side as diffed.
+// As many as a comparison's viewer may ask for beside the pairs it has come
+// (renamedPairs), so that neither is worked out twice.
+const KEPT_DIFFS = 32
+
+// `blocks` and `marks` with whitespace changes shown, `ignoringWhitespace`'s
+// hidden as diff -b hides them.
+export interface RenameDiff {
+  before: string; blocks: ChangeBlock[]; reason: string | null; reads: string[]; marks: ChangeBlock[]
+  ignoringWhitespace: { blocks: ChangeBlock[]; marks: ChangeBlock[] }
+}
+
+export interface RenameDiffRequest { base: PrettyRequest; other: PrettyRequest }
+
+// The two files a request names, a base's `path` and `hash` and the other
+// side's `otherPath` and `otherHash`, or null where either is no JavaScript
+// file named by its hash.
+export function renameDiffRequest(params: URLSearchParams): RenameDiffRequest | null {
+  const side = (path: string, hash: string): PrettyRequest | null => {
+    const extension = prettyExtension(path)
+    return extension !== null && RENAMABLE.has(extension) && FILE_HASH.test(hash) ? { path, hash, extension } : null
+  }
+  const base = side(params.get('path') ?? '', params.get('hash') ?? ''), other = side(params.get('otherPath') ?? '', params.get('otherHash') ?? '')
+  return base && other ? { base, other } : null
+}
+
+let activeDiffs = 0
+const waiting: Array<() => void> = []
+const kept = new Map<string, Buffer>()
+const pending = new Map<string, Promise<Buffer>>()
+
+// A worker's turn, waited for behind those running until `deadline`; given
+// up, it goes to the next one waiting.
+async function turn(deadline: number): Promise<void> {
+  if (activeDiffs < MAX_ACTIVE_DIFFS) { activeDiffs++; return }
+  if (waiting.length >= MAX_WAITING_DIFFS) throw new PrettyError(429, 'diff-busy')
+  await new Promise<void>((resolve, reject) => {
+    const next = () => { clearTimeout(timer); resolve() }
+    const timer = setTimeout(() => {
+      waiting.splice(waiting.indexOf(next), 1)
+      reject(new PrettyError(504, 'diff-timeout'))
+    }, deadline - Date.now())
+    waiting.push(next)
+  })
+}
+function done() {
+  const next = waiting.shift()
+  if (next) next()
+  else activeDiffs--
+}
+async function inTurn<T>(deadline: number, work: () => Promise<T>): Promise<T> {
+  await turn(deadline)
+  try { return await work() } finally { done() }
+}
+
+// Whether a worker's answer is one as rename-diff-worker.js gives it, its
+// blocks taking the old side it answered to the new one asked of, whitespace
+// changes shown and hidden: checked again here, apart from the worker, as an
+// answer that is not would hide a change.
+function answers(diff: unknown, original: string, after: string): diff is RenameDiff {
+  const { before, blocks, reason, reads, marks, ignoringWhitespace } = (diff ?? {}) as Partial<RenameDiff>
+  return typeof before === 'string' && (reason === null || typeof reason === 'string') && Array.isArray(reads) && reads.every(read => typeof read === 'string')
+    && blocksHold(before, after, blocks, false) && marksFit(original, after, marks)
+    && blocksHold(before, after, ignoringWhitespace?.blocks, true) && marksFit(original, after, ignoringWhitespace?.marks)
+}
+
+// Whether marked blocks (rename-diff-worker.js) are blocks of the diff of the
+// two files as they are: in order, apart, within both, each as many lines on
+// either side.
+function marksFit(before: string, after: string, marks: unknown): boolean {
+  if (!Array.isArray(marks)) return false
+  const [olds, news] = [textLines(before).length, textLines(after).length]
+  let i = 0, j = 0
+  for (const mark of marks as Partial<ChangeBlock>[]) {
+    const { a0, a1, b0, b1 } = mark ?? {}
+    if (![a0, a1, b0, b1].every(Number.isInteger)) return false
+    const [x0, x1, y0, y1] = [a0, a1, b0, b1] as [number, number, number, number]
+    if (x0 < i || y0 < j || x1 <= x0 || x1 - x0 !== y1 - y0 || x1 > olds || y1 > news) return false
+    i = x1
+    j = y1
+  }
+  return true
+}
+
+// Settled once the worker is gone, so that its turn is given up only then.
+function inWorker(before: string, after: string, { base, other }: RenameDiffRequest, deadline: number): Promise<RenameDiff> {
+  if (before.length + after.length > MAX_DIFF_CHARS) throw new PrettyError(413, 'diff-too-large')
+  let worker: Worker
+  try {
+    worker = new Worker(new URL('./rename-diff-worker.js', import.meta.url), {
+      workerData: { before, after, extension: base.extension, otherExtension: other.extension }, execArgv: [],
+      resourceLimits: { maxOldGenerationSizeMb: 1024 },
+    })
+  } catch (err) {
+    console.warn('managed: a rename diff could not start:', err)
+    throw new PrettyError(503, 'unavailable')
+  }
+  return new Promise<RenameDiff>((resolve, reject) => {
+    let diff: RenameDiff | null = null, failure = new PrettyError(422, 'undiffable')
+    const timer = setTimeout(() => { failure = new PrettyError(504, 'diff-timeout'); void worker.terminate() }, deadline - Date.now())
+    worker.once('message', (answer: unknown) => {
+      if (answers(answer, before, after)) diff = answer
+      else console.warn('managed: a rename diff answered what does not take its old side to the new')
+      void worker.terminate()
+    })
+    worker.once('error', err => { console.warn('managed: a rename diff failed:', err) })
+    // Gone: answered, run out of memory, or terminated.
+    worker.once('exit', () => {
+      clearTimeout(timer)
+      if (diff) resolve(diff)
+      else reject(failure)
+    })
+  })
+}
+
+// `work` given until `deadline`: past it, answered 504 and left to finish on its own.
+function byDeadline<T>(work: Promise<T>, deadline: number): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const late = new Promise<never>((_, reject) => { timer = setTimeout(() => { reject(new PrettyError(504, 'diff-timeout')) }, deadline - Date.now()) })
+  return Promise.race([work, late]).finally(() => { clearTimeout(timer) })
+}
+
+// An answer as sent, naming the files asked about and the pretty-printed
+// copies of them it was worked out from.
+async function encoded(diff: RenameDiff, { base, other }: RenameDiffRequest, [before, after]: [string, string]): Promise<Buffer> {
+  const [prettyHash, otherPrettyHash] = await Promise.all([computeFileHash(before), computeFileHash(after)])
+  return encodeBrotli(Buffer.from(JSON.stringify({ ...diff, hash: base.hash, otherHash: other.hash, prettyHash, otherPrettyHash })))
+}
+const opened = (body: Buffer): OpenedBlob => ({ size: body.byteLength, stream: Readable.from([body]) })
+
+// The answer for the two files a request names, Brotli-encoded, `texts`
+// reading both sides pretty-printed (and so checking each is its source's):
+// kept by their hashes where `keep`, readers asking for one meanwhile sharing
+// it. A minute for it, its wait for a worker included.
+export async function renameDiffOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep = true): Promise<OpenedBlob> {
+  return opened(await answerOf(request, texts, keep))
+}
+
+async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean): Promise<Buffer> {
+  // Sides not kept are formatted again for each diff (pretty-print.ts), so
+  // they are read in its turn: the files a Diff view asks for at once wait
+  // here rather than being refused by the formats running. Within its minute
+  // too, its turn not held past it by a version's files still downloading.
+  if (!keep) {
+    const deadline = Date.now() + DIFF_TIMEOUT_MS
+    let sides: [string, string] = ['', '']
+    const diff = await inTurn(deadline, async () => {
+      sides = await byDeadline(texts(), deadline)
+      return inWorker(sides[0], sides[1], request, deadline)
+    })
+    return encoded(diff, request, sides)
+  }
+  const [before, after] = await texts()
+  // A file's type is part of how it is read: the same text as a script and as a module differ.
+  const key = `${request.base.hash}\0${request.base.extension}\0${request.other.hash}\0${request.other.extension}`
+  const found = kept.get(key)
+  if (found) {
+    kept.delete(key)
+    kept.set(key, found)
+    return found
+  }
+  let job = pending.get(key)
+  if (!job) {
+    const deadline = Date.now() + DIFF_TIMEOUT_MS
+    pending.set(key, job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key)))
+  }
+  const body = await job
+  kept.set(key, body)
+  if (kept.size > KEPT_DIFFS) kept.delete(kept.keys().next().value!)
+  return body
+}
+
+const decompress = promisify(brotliDecompress)
+
+// What a minifier renames, by its path's extension.
+const renamable = ({ extension }: PrettyRequest) => RENAMABLE.has(extension)
+
+// One of a comparison's pairs of files (renamedPairs), its sides named as a
+// request names them, with its answer as renameDiffOf sends it, or why it has
+// none, as a PrettyError tells it.
+export type RenamedLine = { path: string; hash: string; otherPath: string; otherHash: string } & (Partial<RenameDiff> | { error: string; status: number })
+
+// The files that changed between a comparison's two sides, as its viewer
+// pairs them (ui/view/bundle-comparison.js prepareComparison): at one path as
+// the other side lays them out, or renamed within a package, as the bundles
+// record their packages; every file there, those that can be formatted by
+// their texts and the rest by their hashes. A file the viewer pairs otherwise
+// (its files are its resources too) it asks about alone.
+export function comparedFiles(sides: readonly [ComparedSide, ComparedSide]) {
+  const [olds, news] = sides.map(({ files, hashes }) => {
+    const texts = new Map(files.map(file => [file.path, file.text]))
+    return new Map<string, unknown>([...hashes].map(([path, hash]) => [path, texts.get(path) ?? { format: 'digest', digest: hash }]))
+  }) as [Map<string, unknown>, Map<string, unknown>]
+  const layout = treeLayout(olds.keys(), news.keys())
+  const packageDirs = layoutPackageDirs(sides[0].packageDirs, sides[1].packageDirs, layout)
+  return computeBundleDiff(olds, news, path => bundlePkgOf(path, { packageDir: packageDirs?.get(path) }), layout).files
+}
+
+// The pairs of JavaScript files minified on both sides that changed between a
+// comparison's two sides, paired as its viewer pairs them (comparedFiles),
+// each diffed as renameDiffOf diffs it, from both sides' copies, kept or
+// made, as they are iterated: in path order, one after another, leaving a
+// worker to the files a viewer asks for alone (a pair it reads otherwise, one
+// it shows first).
+export function renamedPairs([base, other]: readonly [ComparedSide, ComparedSide], keep = true): AsyncGenerator<RenamedLine> {
+  const formattable = ({ files }: ComparedSide) => new Map(files.map(file => [file.path, file]))
+  const [olds, news] = [formattable(base), formattable(other)]
+  const pairs = comparedFiles([base, other]).changed.flatMap(({ path, basePath = path }) => {
+    const [from, to] = [olds.get(basePath), news.get(path)]
+    return from && to && from.hash !== to.hash && [from, to].every(file => renamable(file) && needsPrettyPrint(file.path, file.text)) ? [[from, to] as const] : []
+  }).toSorted(([, a], [, b]) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))
+  return (async function* () {
+    for (const [from, to] of pairs) {
+      const request = { base: { path: from.path, hash: from.hash, extension: from.extension }, other: { path: to.path, hash: to.hash, extension: to.extension } }
+      const named = { path: from.path, hash: from.hash, otherPath: to.path, otherHash: to.hash }
+      const copy = async (side: ComparedSide, { text, ...file }: typeof from) => prettyText(await side.kept(file) ?? await side.made(file, text))
+      let body
+      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep) }
+      catch (err) {
+        if (!(err instanceof PrettyError)) throw err
+        yield { ...named, error: err.message, status: err.status }
+        continue
+      }
+      yield { ...JSON.parse((await decompress(body)).toString('utf8')) as Partial<RenameDiff>, ...named }
+    }
+  })()
+}

package/server-managed/report-sources.ts

@@ -29,7 +29,7 @@ function formatDirectory(bundleId: string, sha256: string, name: string) {
 }
 function sourceCacheFilename(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
   const key = createHash('sha256').update(JSON.stringify([
-    'finding-access-v8', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
+    'finding-access-v9', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
   ])).digest('hex')
   return `${formatDirectory(bundle.id, report.sha256, report.filename)}/${key}.json.gz`
 }
@@ -70,11 +70,21 @@ function encodeSources(integrity: string, details: BundleDetails, selection: Ret
   return compress(Buffer.from(JSON.stringify({ integrity, ...selection, imports, formats, packageDirs })), { level: 6 })
 }
 
+type SourcemapEdges = (bundle: ManagedBundle) => Promise<BundleDetails['edges']>
+
+// A sourcemap's imports follow the edges its metadata keeps (the bundle
+// cache's `sourcemapEdges`), read with the parser, else what edges-lite.js reads.
+async function lendSourcemapEdges(details: BundleDetails, bundle: ManagedBundle, sourcemapEdges?: SourcemapEdges) {
+  if (details.kind !== 'sourcemap' || !sourcemapEdges) return
+  const edges = await sourcemapEdges(bundle).catch(() => undefined)
+  if (edges) details.edges = edges
+}
+
 // Immutable report hashes share a derivative across duplicate uploads. Bundle
 // identity and visibility are part of the key: a broader viewer's sources must
 // never populate a restricted response. Group derivatives by hash and filename
 // format so each format's permissions can be removed after its last deletion.
-export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, reports: BlobStore, bundles: BundleStore) {
+export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, reports: BlobStore, bundles: BundleStore, sourcemapEdges?: SourcemapEdges) {
   const pending = new Map<string, { reportId: string; job: Promise<boolean> }>()
   let queue = Promise.resolve()
   function enqueue<T>(work: () => Promise<T>): Promise<T> {
@@ -98,6 +108,7 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
     }
     const details = await readBundleDetails(bundle, bundles)
     if (!details) return false
+    await lendSourcemapEdges(details, bundle, sourcemapEdges)
     const selection = selectSources(sourcePaths, bundleSourcesAsMap(details))
     const body = await encodeSources(bundle.integrity, details, selection)
     // A duplicate with the same hash AND format can use these parsed bytes.

package/server-managed/repository-browser.ts

@@ -3,6 +3,9 @@ import type { SelectedRepo } from './db.ts'
 import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
 import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
 import { readSolidityEntryPoints } from './solidity-entry-points.ts'
+import { parseGithubCommit } from './bundle-commits.ts'
+
+const REFS_PAGE = 100
 
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
@@ -102,12 +105,18 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
     readToken: () => token,
     async refs() {
       // Suggestions are bounded; the input also accepts any branch or tag name.
-      const results = await Promise.all(['branches', 'tags'].map(async kind => {
-        const data = await read(`/${kind}?per_page=100`)
+      const list = async (kind: string) => {
+        const data = await read(`/${kind}?per_page=${REFS_PAGE}`)
         if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
-        return data.flatMap(item => typeof item?.name === 'string' ? [item.name] : [])
-      }))
-      return { defaultBranch, branches: results[0], tags: results[1] }
+        return data
+      }
+      const [branches, tags] = await Promise.all([list('branches'), list('tags')])
+      const names = (items: { name?: unknown }[]) => items.flatMap(item => typeof item?.name === 'string' ? [item.name] : [])
+      // Each tag's commit, for the tag cache. A full page may leave tags
+      // out; only a shorter one lists every tag.
+      const tagCommits = tags.flatMap(item => typeof item?.name === 'string' && item.name && typeof item.commit?.sha === 'string'
+        && /^[a-f\d]{40}$/u.test(item.commit.sha) ? [{ name: item.name, sha: item.commit.sha }] : [])
+      return { defaultBranch, branches: names(branches), tags: names(tags), tagCommits, tagsComplete: tags.length < REFS_PAGE }
     },
     async commit(ref: string) {
       if (/^[a-f\d]{40}$/iu.test(ref)) return ref
@@ -115,6 +124,11 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       if (typeof data?.sha !== 'string' || !/^[a-f\d]{40}$/iu.test(data.sha)) throw new GithubApiError(502, 'github-malformed')
       return data.sha
     },
+    // The first commit a listing from `sha` returns is that commit, without
+    // the files GET /commits/:sha adds.
+    async commitDetails(sha: string) {
+      return /^[a-f\d]{40}$/u.test(sha) ? parseGithubCommit(sha, await read(`/commits?sha=${sha}&per_page=1`)) : null
+    },
     async directory(path: string, commit: string) {
       const data = await read(`/contents/${path.split('/').map(encodeURIComponent).join('/')}?ref=${encodeURIComponent(commit)}`)
       if (!Array.isArray(data)) throw new GithubApiError(400, 'not-a-directory')