@preventive/triage 1.0.0-alpha.36 → 1.0.0-alpha.38

package/common/managed/permissions.ts

@@ -19,11 +19,7 @@ export const VISIBILITY_PERMISSION_LABELS: Record<VisibilityPermission, string>
 export type TeamUserPermissions = Record<VisibilityPermission, boolean>
 
 // All-off — the default for a fresh membership.
-export const DEFAULT_TEAM_USER_PERMISSIONS: TeamUserPermissions = { dependencies: false, security: false }
-
-export function isVisibilityPermission(x: unknown): x is VisibilityPermission {
-  return typeof x === 'string' && (VISIBILITY_PERMISSIONS as readonly string[]).includes(x)
-}
+const DEFAULT_TEAM_USER_PERMISSIONS: TeamUserPermissions = { dependencies: false, security: false }
 
 // Coerce arbitrary input (a request body) into a full permission set: a key is
 // granted only when explicitly `true`; anything else (absent, non-bool) is off.

package/common/managed/routes.js

@@ -1,6 +1,17 @@
 // Managed client pages only. API paths and E2E share hashes are not routes.
 import { BUNDLE_TABS } from '../bundle-tabs.js'
 import { MAX_FINDING_ID_LENGTH, isLinkableFindingId } from '../finding-id.js'
+import { isNpmPackageName, isNpmPackageSpec } from './npm-packages.js'
+
+// How Compare reviews the changes, past its Overview: `code`, beside the
+// tree of changed files. A link names the mode after the bundle or version
+// compared with; an older one's `diff`, a mode since folded into Code,
+// opens Code.
+const COMPARE_MODES = new Set(['code', 'diff'])
+export const compareModeOf = mode => COMPARE_MODES.has(mode) ? 'code' : 'overview'
+// A route's `compareMode` field, where `mode` is one; none for the Overview.
+export const compareModeField = mode => COMPARE_MODES.has(mode) ? { compareMode: 'code' } : {}
+const compareModeSuffix = mode => COMPARE_MODES.has(mode) ? '/code' : ''
 
 export const MANAGED_PAGES = Object.freeze({
   manage: '/manage',
@@ -8,6 +19,7 @@ export const MANAGED_PAGES = Object.freeze({
   'manage-scans': '/manage/scans',
   'manage-reports': '/manage/report',
   'manage-repos': '/manage/repositories',
+  'manage-repo-risk': '/manage/repositories/risk',
   'admin-users': '/manage/users',
   'manage-teams': '/manage/team',
   'manage-import': '/manage/import',
@@ -25,23 +37,37 @@ function findingPath(id) {
 export function managedRoutePath(route) {
   if (!route) return null
   if (route.view === 'home') return '/'
+  if (route.view === 'reviews') return '/reviews'
+  if (route.view === 'npm') return npmPackagePath(route)
   if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
     return /^[A-Za-z0-9_-]+$/u.test(route.teamSlug ?? '') ? `/team/${route.teamSlug}/${route.view.slice(10)}` : null
   }
   if (route.view === 'bundles') {
     if (!/^[A-Za-z0-9_-]+$/u.test(route.bundleSlug ?? '')
-        || (route.teamSlug != null && !/^[A-Za-z0-9_-]+$/u.test(route.teamSlug))) return null
+        || [route.teamSlug, route.compareSlug].some(slug => slug != null && !/^[A-Za-z0-9_-]+$/u.test(slug))) return null
     const tab = route.bundleTab ?? 'overview'
     if (!BUNDLE_TABS.has(tab)) return null
     const parent = route.teamSlug ? `/team/${route.teamSlug}` : '/manage'
-    return `${parent}/bundle/${route.bundleSlug}${tab === 'overview' ? '' : `/${tab}`}`
+    // Code names its open file by number: 1-based in the bundle's sorted
+    // sources, which its content hash fixes. Never by path from the bundle.
+    // Its marked lines follow in the fragment, as #L42 or #L42-L69.
+    const file = tab === 'code' && isLineNumber(route.file) ? `/${route.file}` : ''
+    const lines = file && isLineNumber(route.line)
+      ? `#L${route.line}${isLineNumber(route.endLine) && route.endLine > route.line ? `-L${route.endLine}` : ''}` : ''
+    // Compare names the bundle compared with by its slug, then its mode
+    // (COMPARE_MODES) past the Overview.
+    const compare = tab === 'compare' && route.compareSlug != null
+      ? `/${route.compareSlug}${compareModeSuffix(route.compareMode)}` : ''
+    return `${parent}/bundle/${route.bundleSlug}${tab === 'overview' ? '' : `/${tab}`}${file}${compare}${lines}`
   }
   if (Object.hasOwn(MANAGED_PAGES, route.view)) {
     const path = MANAGED_PAGES[route.view]
     if (route.view === 'manage-deduplication' && route.linkId) return `${path}?report=${encodeURIComponent(route.linkId)}`
     if (route.view === 'manage-bundles' && Number.isSafeInteger(route.createRepoId) && route.createRepoId > 0) return `${path}?createRepo=${route.createRepoId}`
     if (route.view === 'manage-scans' && route.scanMode === 'link') return `${path}?mode=link`
-    if (route.view === 'manage-scans' && route.bundleId) return `${path}?bundle=${encodeURIComponent(route.bundleId)}`
+    if (route.view === 'manage-scans' && route.bundleId) {
+      return `${path}?bundle=${encodeURIComponent(route.bundleId)}${route.scanMode === 'dependencies' ? '&mode=dependencies' : ''}`
+    }
     return route.view === 'manage-history' && route.actor ? `${path}?actor=${encodeURIComponent(route.actor)}` : path
   }
   if (!['findings', 'files'].includes(route.view) || !route.teamSlug
@@ -55,9 +81,69 @@ export function managedRoutePath(route) {
   return `${team}${report}${route.view === 'files' ? '/files' : ''}`
 }
 
+// The npm viewer: its lookup page, or a package version's Overview, Code,
+// Compare or Treemap tab, `/npm/<name>[@<version or dist-tag>][/<tab>…]`. Code names
+// its file by number and its lines in the fragment, as a bundle's Code
+// does: `/code/<file>#L4`. Compare names the version compared with, then
+// its mode past the Overview: `/compare/<version>/code` or `/diff`.
+export const NPM_TABS = new Set(['overview', 'code', 'compare', 'review', 'treemap'])
+function npmPackagePath(route) {
+  if (route.packageName == null) return '/npm'
+  const tab = route.bundleTab ?? 'overview'
+  if (!isNpmPackageName(route.packageName) || (route.packageSpec != null && !isNpmPackageSpec(route.packageSpec)) || !NPM_TABS.has(tab)
+      || (route.compareSpec != null && !isNpmPackageSpec(route.compareSpec))) return null
+  if (tab === 'review') {
+    if (route.reviewPackage != null && !isNpmPackageName(route.reviewPackage) || route.reviewSpec != null && !isNpmPackageSpec(route.reviewSpec)) return null
+    const base = route.reviewPackage == null ? '' : `/${route.reviewPackage}${route.reviewSpec == null ? '' : `@${route.reviewSpec}`}`
+    return `/npm/${route.packageName}${route.packageSpec == null ? '' : `@${route.packageSpec}`}/review${base}`
+  }
+  const file = tab === 'code' && isLineNumber(route.file) ? `/${route.file}` : ''
+  const lines = file && isLineNumber(route.line)
+    ? `#L${route.line}${isLineNumber(route.endLine) && route.endLine > route.line ? `-L${route.endLine}` : ''}` : ''
+  const compare = tab === 'compare' && route.compareSpec != null ? `/${route.compareSpec}${compareModeSuffix(route.compareMode)}` : ''
+  return `/npm/${route.packageName}${route.packageSpec == null ? '' : `@${route.packageSpec}`}${tab === 'overview' ? '' : `/${tab}`}${file}${compare}${lines}`
+}
+
+function parseNpmRoute(path, hash) {
+  const review = /^\/npm\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?\/review(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?)?$/u.exec(path)
+  if (review) {
+    if (!isNpmPackageName(review[1]) || review[2] != null && !isNpmPackageSpec(review[2])
+      || review[3] != null && !isNpmPackageName(review[3]) || review[4] != null && !isNpmPackageSpec(review[4])) return null
+    // The full dependency form is canonical; a bare version is a shortcut.
+    const versionOnly = review[3] && /^\d+\.\d+\.\d+(?:[-+].*)?$/u.test(review[3]) && review[4] == null
+    return { view: 'npm', packageName: review[1], packageSpec: review[2] ?? null, bundleTab: 'review',
+      ...(review[3] ? { reviewPackage: versionOnly ? review[1] : review[3], reviewSpec: versionOnly ? review[3] : review[4] ?? null } : {}) }
+  }
+  const match = /^\/npm(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?(?:\/(code|compare|treemap)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u.exec(path)
+  if (!match) return undefined
+  if (match[1] == null) return { view: 'npm' }
+  if (!isNpmPackageName(match[1]) || (match[2] != null && !isNpmPackageSpec(match[2]))) return null
+  const route = { view: 'npm', packageName: match[1], packageSpec: match[2] ?? null, bundleTab: match[3] ?? 'overview' }
+  if (match[4] == null) return route
+  if (route.bundleTab === 'compare') {
+    return isNpmPackageSpec(match[4]) && (match[5] == null || COMPARE_MODES.has(match[5])) ? { ...route, compareSpec: match[4], ...compareModeField(match[5]) } : null
+  }
+  if (route.bundleTab !== 'code') return null
+  const file = Number(match[4])
+  return !match[5] && /^[1-9]\d*$/u.test(match[4]) && Number.isSafeInteger(file) ? { ...route, file, ...codeLines(hash) } : null
+}
+
+function isLineNumber(value) {
+  return Number.isSafeInteger(value) && value > 0
+}
+
+// `#L42` or `#L42-L69`, in either order; anything else marks no lines.
+function codeLines(hash) {
+  const match = /^#L([1-9]\d*)(?:-L([1-9]\d*))?$/u.exec(hash)
+  const [first, last] = match ? [Number(match[1]), Number(match[2] ?? match[1])] : []
+  if (!isLineNumber(first) || !isLineNumber(last)) return {}
+  return first === last ? { line: first } : { line: Math.min(first, last), endLine: Math.max(first, last) }
+}
+
 export function parseManagedRoute(url) {
   const path = url.pathname.replace(/\/$/u, '') || '/'
   if (path === '/' || path === '/index.html') return { view: 'home' }
+  if (path === '/reviews') return { view: 'reviews' }
   const view = Object.keys(MANAGED_PAGES).find(key => MANAGED_PAGES[key] === path)
   if (view) {
     const createRepoId = Number(url.searchParams.get('createRepo'))
@@ -66,14 +152,23 @@ export function parseManagedRoute(url) {
       ...(view === 'manage-bundles' && Number.isSafeInteger(createRepoId) && createRepoId > 0 ? { createRepoId } : {}),
       ...(view === 'manage-history' && url.searchParams.get('actor') ? { actor: url.searchParams.get('actor') } : {}),
       ...(view === 'manage-scans' ? url.searchParams.get('mode') === 'link' ? { scanMode: 'link' }
-        : url.searchParams.get('bundle') ? { bundleId: url.searchParams.get('bundle') } : {} : {}),
+        : url.searchParams.get('bundle') ? { bundleId: url.searchParams.get('bundle'),
+          ...(url.searchParams.get('mode') === 'dependencies' ? { scanMode: 'dependencies' } : {}) } : {} : {}),
     }
   }
-  const bundle = /^(?:\/team\/([A-Za-z0-9_-]+)|\/manage)\/bundle\/([A-Za-z0-9_-]+)(?:\/([a-z]+))?$/u.exec(path)
+  const bundle = /^(?:\/team\/([A-Za-z0-9_-]+)|\/manage)\/bundle\/([A-Za-z0-9_-]+)(?:\/([a-z]+)(?:\/([A-Za-z0-9_-]+)(?:\/([a-z]+))?)?)?$/u.exec(path)
   if (bundle) {
     const bundleTab = bundle[3] ?? 'overview'
-    return BUNDLE_TABS.has(bundleTab) ? { view: 'bundles', teamSlug: bundle[1] ?? null, bundleSlug: bundle[2], bundleTab } : null
+    if (!BUNDLE_TABS.has(bundleTab)) return null
+    const route = { view: 'bundles', teamSlug: bundle[1] ?? null, bundleSlug: bundle[2], bundleTab }
+    if (bundle[4] == null) return route
+    if (bundleTab === 'compare') return bundle[5] == null || COMPARE_MODES.has(bundle[5]) ? { ...route, compareSlug: bundle[4], ...compareModeField(bundle[5]) } : null
+    const file = Number(bundle[4])
+    if (bundleTab !== 'code' || bundle[5] || !/^[1-9]\d*$/u.test(bundle[4]) || !Number.isSafeInteger(file)) return null
+    return { ...route, file, ...codeLines(url.hash) }
   }
+  const npm = parseNpmRoute(path, url.hash)
+  if (npm !== undefined) return npm
   const contentList = /^\/team\/([A-Za-z0-9_-]+)\/(reports|bundles)$/u.exec(path)
   if (contentList) return { view: `workspace-${contentList[2]}`, teamSlug: contentList[1] }
   const match = /^\/team\/([^/]+)(?:\/report\/([^/]+))?(?:\/(files)|\/finding\/([^/]+))?$/u.exec(path)
@@ -97,14 +192,20 @@ export function resolveManagedRoute(route, teams, adminBundles = []) {
     return matches.length === 1 ? { view: route.view, teamId: matches[0].id } : null
   }
   if (route.view === 'bundles') {
-    const { teamSlug, bundleSlug, ...rest } = route
+    const { teamSlug, bundleSlug, compareSlug, compareMode, ...rest } = route
     const matches = teamSlug == null ? [] : teams.filter(team => team.slug === teamSlug)
     if (teamSlug != null && matches.length !== 1) return null
     const team = matches[0]
     const candidates = teamSlug == null ? adminBundles : teams.flatMap(entry => entry.bundles ?? [])
-    const ids = new Set(candidates.filter(bundle => bundle.slug === bundleSlug).map(bundle => bundle.id))
+    const idsOf = slug => new Set(candidates.filter(bundle => bundle.slug === slug).map(bundle => bundle.id))
+    const ids = idsOf(bundleSlug)
     const bundle = (team?.bundles ?? adminBundles).find(entry => entry.slug === bundleSlug)
-    return bundleSlug && bundle && ids.size === 1 ? { ...rest, teamId: team?.id ?? null, bundleId: bundle.id } : null
+    if (!bundleSlug || !bundle || ids.size !== 1) return null
+    // The bundle compared with, by the same rule; one no longer listed drops
+    // out, leaving Compare to pick again.
+    const compared = compareSlug == null ? null : idsOf(compareSlug)
+    const compare = compared?.size === 1 ? { compareId: [...compared][0], ...compareModeField(compareMode) } : {}
+    return { ...rest, teamId: team?.id ?? null, bundleId: bundle.id, ...compare }
   }
   if (!['findings', 'files'].includes(route.view)) return route
   const { teamSlug, reportSlug, ...rest } = route
@@ -125,13 +226,23 @@ export function managedRouteForIds(route, teams, adminBundles = []) {
     return team?.slug && resolveManagedRoute(result, teams) ? result : null
   }
   if (route.view === 'bundles') {
-    const { teamId, bundleId, ...rest } = route
+    const { teamId, bundleId, compareId, compareMode, ...rest } = route
     const team = teams.find(entry => entry.id === teamId)
     if (teamId != null && !team?.slug) return null
     const bundle = (team?.bundles ?? adminBundles).find(entry => entry.id === bundleId)
     if (!bundle?.slug) return null
-    const result = { ...rest, teamSlug: team?.slug ?? null, bundleSlug: bundle.slug }
-    return resolveManagedRoute(result, teams, adminBundles) ? result : null
+    const compared = compareId == null ? null
+      : (teamId == null ? adminBundles : teams.flatMap(entry => entry.bundles ?? [])).find(entry => entry.id === compareId)
+    const result = { ...rest, teamSlug: team?.slug ?? null, bundleSlug: bundle.slug,
+      ...(compared?.slug ? { compareSlug: compared.slug, ...compareModeField(compareMode) } : {}) }
+    const resolved = resolveManagedRoute(result, teams, adminBundles)
+    if (!resolved) return null
+    // A compared bundle whose slug doesn't name it alone leaves the route.
+    if (result.compareSlug != null && resolved.compareId !== compareId) {
+      const { compareSlug: _slug, compareMode: _mode, ...bare } = result
+      return bare
+    }
+    return result
   }
   if (!['findings', 'files'].includes(route.view)) return route
   const { teamId, reportId, ...rest } = route

package/common/managed/team-app.d.ts

@@ -0,0 +1,2 @@
+export type TeamAppMetadata = { appMode: true; appFindings: number } | { appMode: false }
+export function managedTeamAppMetadata(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): TeamAppMetadata

package/common/managed/team-app.js

@@ -0,0 +1,31 @@
+import { inheritReportMeta, isAppFinding, reportEntries } from '@preventive/report'
+import { collectDuplicates } from '../../client/linked-findings.js'
+import { hasRevalidateStamp } from '../finding-filters.js'
+import { workspaceAppMetadata } from '../workspace-app.js'
+
+// The same classification as local workspaces, using only the complete,
+// server-filtered published workspace: the reports of one team response and
+// its `links`. The managed server classifies each team before sending its
+// catalog, so the sidebar opens a team collapsed to its App findings at once.
+// The server backfills finding IDs before building these envelopes.
+export function managedTeamAppMetadata(workspace) {
+  const duplicates = new Map(), reports = []
+  collectDuplicates(workspace.links ?? [], duplicates)
+  for (const { filename, data } of workspace) {
+    if (data.source === 'links' && Array.isArray(data.links)) {
+      collectDuplicates(data.links, duplicates)
+      continue
+    }
+    const entries = (reportEntries(data) ?? []).map(entry => Array.isArray(entry) ? entry : [entry])
+    const judged = new Set(entries.flat().filter(hasRevalidateStamp).map(f => f.source ?? data.source ?? null))
+    const groups = entries.map(group => group.map(f => {
+      const finding = { ...f, _source: f.source ?? data.source ?? null }
+      inheritReportMeta(finding, data)
+      if (!('isApp' in finding)) finding.isApp = isAppFinding(finding, finding._source)
+      finding._sourcePass = judged.has(finding._source)
+      return finding
+    }))
+    reports.push({ fileName: filename, groups })
+  }
+  return workspaceAppMetadata(reports, id => [...duplicates.get(id) ?? []])
+}

package/common/managed/triage.ts

@@ -10,7 +10,7 @@
 // per-report ignore is a client-local concept keyed by report name.
 export type TriageBucket = 'inprogress' | 'fixed' | 'invalid' | 'deleted' | 'ignored'
 
-export const TRIAGE_BUCKETS: readonly TriageBucket[] = ['inprogress', 'fixed', 'invalid', 'deleted', 'ignored']
+const TRIAGE_BUCKETS: readonly TriageBucket[] = ['inprogress', 'fixed', 'invalid', 'deleted', 'ignored']
 
 // One finding's server-side triage entry (also the write shape — writes
 // replace the whole entry). Absent fields are unset; `flagged` is tri-state:

package/common/managed/upload-seal.ts

@@ -0,0 +1,126 @@
+// Managed uploads cross TLS-terminating proxies (Cloudflare, corporate
+// gateways) that would otherwise read report and bundle bytes in plaintext.
+// The server sends each session an X25519 public key; the browser seals every
+// upload to it with a fresh ephemeral key (X25519 → HKDF-SHA-256 →
+// AES-256-GCM), so the content key itself never crosses the proxy. Text is
+// gzipped before sealing; binary content is sealed as is.
+//
+// Sealed body: version(1) | flags(1) | ephemeral public key(32), then the
+// payload in 1 MiB segments, each sealed under nonce = big-endian segment
+// index with the last byte marking the final segment. The header is the HKDF
+// salt, so altering it changes the key. Segments bound browser memory for
+// large bundles, and their nonces reject reordered, truncated or extended
+// bodies. Every upload derives its own key, so counter nonces never repeat.
+
+import { gunzipBytes } from '../gzip.js'
+import { encodeUtf8 } from '../utf8.js'
+
+// Set (to the format version) on a request whose body is sealed.
+export const UPLOAD_SEAL_HEADER = 'x-upload-encryption'
+const VERSION = 1
+const FLAG_GZIP = 1
+const CURVE = { name: 'X25519' }
+const HEADER_BYTES = 2 + 32
+const TAG_BYTES = 16
+const SEGMENT_BYTES = 1024 * 1024
+const SNIFF_BYTES = 64 * 1024
+const KEY_INFO = 'deepview-managed-upload.v1.content-key'
+
+// The largest sealed body for `maxBytes` of content. Deflate can grow
+// incompressible text slightly (its worst case is about 0.03%).
+export function maxSealedBytes(maxBytes: number): number {
+  const payload = maxBytes + Math.ceil(maxBytes / 1024) + 64
+  return HEADER_BYTES + payload + TAG_BYTES * (Math.floor(payload / SEGMENT_BYTES) + 1)
+}
+
+function nonce(index: number, final: boolean): Uint8Array<ArrayBuffer> {
+  const iv = new Uint8Array(12)
+  new DataView(iv.buffer).setUint32(7, index)
+  iv[11] = final ? 1 : 0
+  return iv
+}
+
+async function contentKey(secret: ArrayBuffer, header: Uint8Array<ArrayBuffer>, usage: KeyUsage): Promise<CryptoKey> {
+  const ikm = await crypto.subtle.importKey('raw', secret, 'HKDF', false, ['deriveKey'])
+  return await crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: header, info: encodeUtf8(KEY_INFO) },
+    ikm, { name: 'AES-GCM', length: 256 }, false, [usage])
+}
+
+// Archives and other binary content would only grow under gzip. A NUL byte or
+// invalid UTF-8 in the first 64 KiB marks content as binary.
+async function isText(blob: Blob): Promise<boolean> {
+  const head = new Uint8Array(await blob.slice(0, SNIFF_BYTES).arrayBuffer())
+  if (head.includes(0)) return false
+  try { new TextDecoder('utf-8', { fatal: true }).decode(head, { stream: true }); return true }
+  catch { return false }
+}
+
+// Seal `blob` to the server's raw public key. Reads the input as a stream;
+// sealed segments are kept as Blobs, which browsers may page to disk. An abort
+// stops reading at the next chunk.
+export async function sealUpload(blob: Blob, publicKey: Uint8Array<ArrayBuffer>, signal?: AbortSignal): Promise<Blob> {
+  const gzip = await isText(blob)
+  const [server, ephemeral] = await Promise.all([
+    crypto.subtle.importKey('raw', publicKey, CURVE, false, []),
+    crypto.subtle.generateKey(CURVE, false, ['deriveBits']) as Promise<CryptoKeyPair>,
+  ])
+  const header = new Uint8Array(HEADER_BYTES)
+  header[0] = VERSION
+  header[1] = gzip ? FLAG_GZIP : 0
+  header.set(new Uint8Array(await crypto.subtle.exportKey('raw', ephemeral.publicKey)), 2)
+  const key = await contentKey(await crypto.subtle.deriveBits({ name: 'X25519', public: server }, ephemeral.privateKey, 256), header, 'encrypt')
+  const parts = [new Blob([header])], segment = new Uint8Array(SEGMENT_BYTES)
+  let filled = 0, index = 0
+  const seal = async (final: boolean) => {
+    parts.push(new Blob([await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce(index++, final) }, key, segment.subarray(0, filled))]))
+    filled = 0
+  }
+  const stream: ReadableStream<Uint8Array> = gzip ? blob.stream().pipeThrough(new CompressionStream('gzip')) : blob.stream()
+  const reader = stream.getReader()
+  try {
+    for (let read = await reader.read(); !read.done; read = await reader.read()) {
+      signal?.throwIfAborted()
+      for (let offset = 0; offset < read.value.length;) {
+        // A full segment is final only if the input ends with it.
+        if (filled === SEGMENT_BYTES) await seal(false)
+        const length = Math.min(SEGMENT_BYTES - filled, read.value.length - offset)
+        segment.set(read.value.subarray(offset, offset + length), filled)
+        filled += length
+        offset += length
+      }
+    }
+  } catch (err) {
+    await reader.cancel(err).catch(() => {})
+    throw err
+  }
+  await seal(true)
+  return new Blob(parts)
+}
+
+// Open a sealed body with the session's private JWK. Throws 'too-large' when
+// the content exceeds `maxBytes`, else 'bad-upload' for any invalid body.
+export async function openUpload(sealed: Uint8Array<ArrayBuffer>, privateKey: JsonWebKey, maxBytes: number): Promise<Uint8Array<ArrayBuffer>> {
+  // Every segment but the last is full, so the layout follows from the length.
+  const rest = sealed.length - HEADER_BYTES
+  const count = Math.ceil(rest / (SEGMENT_BYTES + TAG_BYTES))
+  const last = rest - (count - 1) * (SEGMENT_BYTES + TAG_BYTES)
+  if (rest < TAG_BYTES || last < TAG_BYTES || sealed[0] !== VERSION || (sealed[1]! & ~FLAG_GZIP) !== 0) throw new Error('bad-upload')
+  const gzip = sealed[1] === FLAG_GZIP, plain = new Uint8Array(rest - count * TAG_BYTES)
+  if (!gzip && plain.length > maxBytes) throw new Error('too-large')
+  try {
+    const header = sealed.slice(0, HEADER_BYTES)
+    const [key, peer] = await Promise.all([
+      crypto.subtle.importKey('jwk', privateKey, CURVE, false, ['deriveBits']),
+      crypto.subtle.importKey('raw', header.slice(2), CURVE, false, []),
+    ])
+    const content = await contentKey(await crypto.subtle.deriveBits({ name: 'X25519', public: peer }, key, 256), header, 'decrypt')
+    for (let index = 0; index < count; index++) {
+      const start = HEADER_BYTES + index * (SEGMENT_BYTES + TAG_BYTES)
+      const segment = sealed.subarray(start, Math.min(start + SEGMENT_BYTES + TAG_BYTES, sealed.length))
+      plain.set(new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce(index, index === count - 1) }, content, segment)), index * SEGMENT_BYTES)
+    }
+  } catch (err) { throw new Error('bad-upload', { cause: err }) }
+  if (!gzip) return plain
+  try { return await gunzipBytes(plain, { maxBytes }) }
+  catch (err) { throw new Error(err instanceof RangeError ? 'too-large' : 'bad-upload', { cause: err }) }
+}

package/common/pretty-print.d.ts

@@ -0,0 +1,5 @@
+// Type declarations for `common/pretty-print.js`, for `.ts` callers.
+
+export const MAX_PRETTY_BYTES: number
+export function prettyExtension(path: string): string | null
+export function needsPrettyPrint(path: string, text: string, read?: () => { category: string }): boolean

package/common/pretty-print.js

@@ -0,0 +1,24 @@
+// Minified files pretty-printed by the server (server-managed/pretty-print.ts)
+// for the viewer (ui/view/pretty-source.js).
+import { npmFileReadability } from '../risk/files/readability.js'
+import { utf8ByteLength } from './utf8.js'
+
+// The extensions formatted, each parsed as the language it names.
+const PRETTY_EXTENSIONS = new Set(['js', 'mjs', 'cjs', 'jsx', 'ts', 'mts', 'cts', 'tsx', 'css', 'json'])
+
+// The largest file formatted, in UTF-8 bytes: formatting holds a syntax tree
+// a hundred times the file's size.
+export const MAX_PRETTY_BYTES = 4 * 1024 * 1024
+
+// The extension a path is formatted as, or null for one that isn't.
+export function prettyExtension(path) {
+  const extension = /\.([a-z]+)$/iu.exec(path)?.[1]?.toLowerCase()
+  return PRETTY_EXTENSIONS.has(extension) ? extension : null
+}
+
+// Whether a file's text is pretty-printed: in a language formatted, no larger
+// than formatted, and minified, as risk reads it, `read` reading that where
+// the reader keeps it.
+export function needsPrettyPrint(path, text, read = () => npmFileReadability(path, text)) {
+  return prettyExtension(path) !== null && utf8ByteLength(text) <= MAX_PRETTY_BYTES && read().category === 'minified'
+}

package/common/revalidation-conflicts.js

@@ -0,0 +1,48 @@
+import { REVALIDATE_KINDS, revalidateKindOf } from '@preventive/report'
+
+// Keep only the pass's fields, before gap-filling changes the survivor.
+// In particular, a verdict borrowed from report B must never be attributed
+// to an unstamped copy from report A when report C later contradicts it.
+function fieldsOf(finding) {
+  return Object.fromEntries(Object.entries(finding).filter(([key, value]) =>
+    key.startsWith('revalidate') && value != null))
+}
+
+export function recordRevalidationCopies(survivor, duplicate, reportName) {
+  const fields = fieldsOf(duplicate)
+  if (!survivor._revalidationCopies) {
+    const own = fieldsOf(survivor)
+    if (Object.keys(own).length === 0 && Object.keys(fields).length === 0) return []
+    survivor._revalidationCopies = Object.keys(own).length > 0
+      ? [{ reportName: survivor._reportName ?? '', fields: own }]
+      : []
+  }
+  if (Object.keys(fields).length > 0) survivor._revalidationCopies.push({ reportName, fields })
+  return survivor._revalidationCopies
+}
+
+// Same comparisons as mergeDuplicateFields: missing values are gaps, stamps
+// are normalized, and prose ignores surrounding whitespace. Group agreeing
+// reports together, retaining every distinct answer rather than just a pair.
+export function revalidationDifferences(copies) {
+  const byField = new Map()
+  const knownKinds = new Set(REVALIDATE_KINDS)
+  for (const { reportName, fields } of copies) {
+    for (const [key, value] of Object.entries(fields)) {
+      if (value == null) continue
+      const normalized = key === 'revalidate'
+        ? revalidateKindOf(fields) || String(value).trim().toLowerCase()
+        : String(value).trim()
+      if (key === 'revalidate' && !normalized) continue
+      if (key === 'revalidate' && !knownKinds.has(normalized)) continue
+      if (!byField.has(key)) byField.set(key, new Map())
+      const variants = byField.get(key)
+      if (!variants.has(normalized)) variants.set(normalized, new Set())
+      variants.get(normalized).add(reportName)
+    }
+  }
+  return [...byField].filter(([, variants]) => variants.size > 1).map(([field, variants]) => ({
+    field,
+    variants: [...variants].map(([value, reports]) => ({ value, reports: [...reports] })),
+  }))
+}

package/common/revalidation-input-groups.js

@@ -0,0 +1,56 @@
+// Recover source-level row boundaries before hiding the App layer. App
+// deduplication alone does not make the underlying code findings equivalent.
+// Only split when every source ID is accounted for and every referenced input
+// exists in this row. Missing input lists are empty, not missing evidence for
+// an otherwise complete partition. Original findings and rows stay untouched.
+export function splitRevalidationInputs(group, appFindings = null) {
+  const app = appFindings ?? group.filter((f) => f.isApp)
+  const source = group.filter((f) => !f.isApp)
+  if (app.length === 0 || source.length === 0) return [group]
+  // A surviving App finding means this is not a pure non-App projection;
+  // never move it into a source-only partition.
+  if (appFindings && group.some((f) => f.isApp)) return [group]
+  if (source.some((f) => typeof f.id !== 'string' || !f.id)) return [group]
+
+  const sourceIds = new Set(source.map((f) => f.id))
+  const inputsByApp = new Map()
+  const covered = new Set()
+  for (const f of app) {
+    const inputs = f.revalidateInputs === undefined ? [] : f.revalidateInputs
+    if (!Array.isArray(inputs)) return [group]
+    for (const id of inputs) {
+      if (!sourceIds.has(id)) return [group]
+      covered.add(id)
+    }
+    inputsByApp.set(f, inputs)
+  }
+  if (covered.size !== sourceIds.size) return [group]
+
+  const parent = new Map([...sourceIds].map((id) => [id, id]))
+  const find = (id) => {
+    let root = id
+    while (parent.get(root) !== root) root = parent.get(root)
+    while (parent.get(id) !== root) {
+      const next = parent.get(id)
+      parent.set(id, root)
+      id = next
+    }
+    return root
+  }
+  for (const inputs of inputsByApp.values()) {
+    if (inputs.length === 0) continue
+    const root = find(inputs[0])
+    for (const id of inputs) parent.set(find(id), root)
+  }
+
+  const components = new Map()
+  for (const f of group) {
+    const inputs = inputsByApp.get(f)
+    // Keep an App finding with its inputs until the caller projects the lens.
+    // App findings without inputs stand alone; hiding them then drops the row.
+    const key = inputs ? inputs.length > 0 ? find(inputs[0]) : f : find(f.id)
+    if (!components.has(key)) components.set(key, [])
+    components.get(key).push(f)
+  }
+  return components.size === 1 ? [group] : [...components.values()]
+}

package/common/workspace-app.js

@@ -0,0 +1,23 @@
+import { revalidateKindOf } from '@preventive/report'
+import { canLockConfirmed } from './finding-filters.js'
+import { mergeReportGroups } from './workspace-groups.js'
+import { mergeLinkedWorkspaceGroups } from './linked-workspace-groups.js'
+
+function appTabs(group) {
+  if (group.linkedTabs) return group.linkedTabs
+  const app = group.filter((f) => revalidateKindOf(f) === 'revalidation')
+  return app.length > 0 ? app : group
+}
+
+// Evaluate the entire workspace, independent of triage, filters, or the lens
+// left active by another report. Use the same merge and link rules as the view.
+export function workspaceAppMetadata(reports, duplicatesOf = () => []) {
+  const { groups, conflicts } = mergeReportGroups(reports, { hideRuledOut: true })
+  if (conflicts.size > 0) return { appMode: false }
+  const linked = mergeLinkedWorkspaceGroups(groups, duplicatesOf, appTabs)
+  if (!canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' })) return { appMode: false }
+  return {
+    appMode: true,
+    appFindings: linked.filter((group) => appTabs(group).some((f) => f.isApp)).length,
+  }
+}