@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.38

package/common/bundle-metadata.js

@@ -4,6 +4,7 @@ import { Bundle } from '@exodus/stasis-core/bundle'
 import { computeFileHash } from '@preventive/report'
 import { utf8ByteLength } from './utf8.js'
 import { bundleFileSizes, bundleSourcesAsMap, bundleUnsizedFiles } from './bundle-sources.js'
+import { bundleSourcemapEdges, parseSourcemap, sourcemapEntries } from './bundle-sourcemap.js'
 
 // Version 2 sizes every file by its bytes, resources included. A version 1
 // index sized by what the source map held when it was written: before the
@@ -13,7 +14,11 @@ import { bundleFileSizes, bundleSourcesAsMap, bundleUnsizedFiles } from './bundl
 // hashes alone and rebuilt on open.
 // Version 3 also retains the bundle's repository and package origin metadata.
 // Version 4 retains dependency repositories as well.
-export const BUNDLE_METADATA_VERSION = 4
+// Version 5 counts lines of code, leaving blank lines out.
+// Version 6 reads a sourcemap whole (bundle-sourcemap.js): an index map's
+// files too, each once, keyed with `sourceRoot` in front, and the edges
+// between them.
+export const BUNDLE_METADATA_VERSION = 6
 const INDEX_VERSION = BUNDLE_METADATA_VERSION
 const hashJobs = new WeakMap()
 const SOURCE_TABS = new Set(['terminal', 'code', 'search', 'compare'])
@@ -22,6 +27,9 @@ export function bundleNeedsSources(tab, sourceFile = null) {
   return Boolean(sourceFile) || SOURCE_TABS.has(tab)
 }
 
+// A file's hash as metadata names it: computeFileHash's sha512 of its text.
+export const FILE_HASH = /^sha512-[A-Za-z0-9+/]{86}==$/u
+
 // Bound outstanding WebCrypto jobs: serial awaits incur one task round-trip
 // per file, while an unbounded Promise.all holds every encoded body at once.
 export function computeBundleFileHashes(details) {
@@ -42,13 +50,34 @@ export function computeBundleFileHashes(details) {
   return job
 }
 
-// Count source lines without charging a trailing newline as an extra line.
+// Count lines of code: lines with anything but whitespace on them, comments
+// included for now, split at \r\n, \r or \n. Each such line is counted at
+// its first non-whitespace character, its rest passed over to the next line
+// break: no match runs a line's length, which past some 9 million characters
+// (a bundled payload's one line, as Shai-Hulud's 10 MB bun_environment.js)
+// overflows the stack a Unicode regular expression backtracks with in a
+// string holding any character past U+00FF.
 // The source map intentionally excludes non-text resources, so a null entry
 // remains the metadata marker for images, fonts, and other binary payloads.
 export function bundleSourceLineCount(content) {
-  if (typeof content !== 'string' || content.length === 0) return 0
-  const breaks = content.match(/\r\n|\r|\n/gu)?.length ?? 0
-  return breaks + (/[\r\n]$/u.test(content) ? 0 : 1)
+  if (typeof content !== 'string') return 0
+  const code = /\S/gu, end = /[\r\n]/gu
+  let lines = 0
+  while (code.test(content)) {
+    lines++
+    end.lastIndex = code.lastIndex
+    if (!end.test(content)) break
+    code.lastIndex = end.lastIndex
+  }
+  return lines
+}
+
+// Each source's lines of code, by path: the index's where `details` has them,
+// else counted once and kept on it. `bundleSourcesAsMap` holds only textual
+// sources: Stasis resources (images, fonts, and other binary payloads) have
+// no lines, so they cannot distort the language shares.
+export function bundleLineCounts(details) {
+  return details.lineCounts ??= new Map([...bundleSourcesAsMap(details)].map(([path, content]) => [path, bundleSourceLineCount(content)]))
 }
 
 function mapObject(value) {
@@ -64,19 +93,23 @@ function mapObject(value) {
 export async function createBundleMetadata(details) {
   const hashes = await computeBundleFileHashes(details)
   const sizes = bundleFileSizes(details)
-  const sourceLines = details.lineCounts ??= new Map([...bundleSourcesAsMap(details)]
-    .map(([path, content]) => [path, bundleSourceLineCount(content)]))
+  const sourceLines = bundleLineCounts(details)
   const result = { version: INDEX_VERSION, integrity: details.integrity, kind: details.kind, size: details.size, codeStats: bundleCodeStats(sourceLines, sizes),
     files: [...sizes].map(([path, size]) => [path, size, hashes.get(path) ?? null, sourceLines.get(path) ?? null]) }
   const unsized = bundleUnsizedFiles(details)
   if (unsized.size > 0) result.unsized = [...unsized]
   if (details.kind === 'sourcemap') {
-    const { version, file, sourceRoot, names, sources = [], sourcesContent = [] } = details.json
-    result.json = { version, file, sourceRoot, sources }
-    // Sourcemaps can repeat a path with different/absent content. Keep the
-    // Overview's positional inventory, alongside the path-keyed graph index.
-    result.sourceSizes = sources.map((_, i) => typeof sourcesContent[i] === 'string' ? utf8ByteLength(sourcesContent[i]) : null)
-    result.namesCount = names?.length ?? null
+    const { version, file, sourceRoot, names } = details.json
+    const entries = sourcemapEntries(details)
+    result.json = { version, file, sourceRoot, sources: entries.map(([path]) => path) }
+    // A map's arrays as written can repeat a path with different/absent
+    // content. Keep the Overview's positional inventory, alongside the
+    // path-keyed graph index.
+    result.sourceSizes = entries.map(([, content]) => typeof content === 'string' ? utf8ByteLength(content) : null)
+    result.namesCount = details.namesCount ?? names?.length ?? null
+    // `[from, to]` or `[from, to, specifier]`, `from` and `to` rows of `files`.
+    const rows = new Map(result.files.map(([path], i) => [path, i]))
+    result.edges = bundleSourcemapEdges(details).map(([from, to, ...specifier]) => [rows.get(from), rows.get(to), ...specifier])
   } else {
     const b = details.bundle
     const bundle = { version: b.version, config: b.config, repo: b.repo, package: b.package, formats: mapObject(b.formats), imports: mapObject(b.imports), reason: b.reason, executable: [...b.executable] }
@@ -109,14 +142,16 @@ export function createBundleSummary(details, metadata) {
   const commit = details.kind === 'stasis' ? bundleCommitHash(details.bundle.repo?.commit) : null
   return { files: files.length, lines,
     codeFiles: files.filter(([path]) => !['resource:base64', 'directory'].includes(formats?.get(path))).length,
-    ...(commit ? { commit } : {}) }
+    ...(commit ? { commit } : {}),
+    // The Stasis format version: 0 for legacy bundles, which record no package versions.
+    ...(details.kind === 'stasis' ? { stasisVersion: details.bundle.version } : {}) }
 }
 
 // `stale` marks an index this version did not write: its hashes still
 // answer report lookups, but an open rebuilds it for current sizes, line
 // counts and origin metadata.
 export function parseBundleMetadata(data, integrity) {
-  if (![1, 2, 3, INDEX_VERSION].includes(data?.version) || data.integrity !== integrity || !['stasis', 'sourcemap'].includes(data.kind)
+  if (![1, 2, 3, 4, 5, INDEX_VERSION].includes(data?.version) || data.integrity !== integrity || !['stasis', 'sourcemap'].includes(data.kind)
       || !Number.isSafeInteger(data.size) || data.size < 0 || !Array.isArray(data.files)) throw new Error('Invalid bundle metadata')
   const stale = data.version !== INDEX_VERSION
   const legacySizes = data.version === 1
@@ -126,7 +161,7 @@ export function parseBundleMetadata(data, integrity) {
     if (!Array.isArray(row) || (row.length !== 4 && !(legacySizes && row.length === 3))) throw new Error('Invalid bundle metadata file')
     const [path, size, hash, lines] = row
     if (typeof path !== 'string' || fileSizes.has(path) || (size !== null && (!Number.isSafeInteger(size) || size < 0))
-        || (hash !== null && (typeof hash !== 'string' || !/^sha512-[A-Za-z0-9+/]{86}==$/u.test(hash)))
+        || (hash !== null && (typeof hash !== 'string' || !FILE_HASH.test(hash)))
         || (size === null && hash !== null) || (legacySizes && size !== null && hash === null)
         || (lines !== undefined && lines !== null && (!Number.isSafeInteger(lines) || lines < 0))) throw new Error('Invalid bundle metadata file')
     fileSizes.set(path, size)
@@ -159,6 +194,8 @@ export function parseBundleMetadata(data, integrity) {
     details.json = data.json
     details.sourceSizes = data.sourceSizes
     details.namesCount = data.namesCount
+    // An index before version 6 has none: the view reads no edges for it.
+    if (data.edges !== undefined) details.edges = parseSourcemapEdges(data.edges, data.files)
   }
   if (data.codeStats === undefined) details.codeStats = bundleCodeStats(lineCounts, fileSizes)
   else {
@@ -172,12 +209,18 @@ export function parseBundleMetadata(data, integrity) {
   return details
 }
 
+function parseSourcemapEdges(rows, files) {
+  if (!Array.isArray(rows)) throw new Error('Invalid sourcemap edges')
+  return rows.map((row) => {
+    if (!Array.isArray(row) || ![2, 3].includes(row.length) || row[0] === row[1] || (row.length === 3 && typeof row[2] !== 'string')
+        || row.slice(0, 2).some((i) => !Number.isSafeInteger(i) || i < 0 || i >= files.length)) throw new Error('Invalid sourcemap edges')
+    return [files[row[0]][0], files[row[1]][0], ...row.slice(2)]
+  })
+}
+
 // HTTP content encoding handles compression before this shared JSON parser.
 export function parseBundleContents(text, { integrity, kind, size }) {
   if (kind === 'stasis') return { integrity, kind, size, bundle: Bundle.parse(text) }
   if (kind !== 'sourcemap') throw new Error('Unsupported bundle format')
-  const json = JSON.parse(text)
-  if (!Array.isArray(json?.sources) || json.sources.some(path => typeof path !== 'string')
-      || (json.sourcesContent !== undefined && (!Array.isArray(json.sourcesContent) || json.sourcesContent.some(content => content !== null && typeof content !== 'string')))) throw new Error('Invalid sourcemap')
-  return { integrity, kind, size, json }
+  return { integrity, kind, size, ...parseSourcemap(text) }
 }

package/common/bundle-pkg-of.d.ts

@@ -0,0 +1 @@
+export function bundlePkgOf(path: string, options?: { packageDir?: string | null | undefined }): string

package/common/bundle-pkg-of.js

@@ -0,0 +1,90 @@
+// Package classifier for bundle paths. Pulled out of
+// `render-bundle.js` (which drags in lit + the source-viewer + a
+// circular `render.js` import, none of which this pure string logic
+// needs) so it's a DOM-free leaf the bundle graph / treemap / compare
+// views — and the test suite — can import on its own, and the server pair a
+// comparison's files as Compare does (server-managed/rename-diff.ts).
+
+// Bucket a bundle source path into a "package":
+//   - files under `node_modules/<pkg>/...` return `<pkg>` (scoped names
+//     included), as do Solidity files under Soldeer's
+//     `dependencies/<pkg>/...`, the one ecosystem installing there;
+//   - own (first-party) source returns the single `__own__` bucket: an
+//     ordinary `dependencies/` folder of anything else is own code.
+//
+// pnpm wraps each install in
+// `node_modules/.pnpm/<name>@<version>/node_modules/<name>/...` —
+// matching the first occurrence would bucket every dep under `.pnpm`,
+// so when we hit that synthetic dir we walk past it to the inner
+// `node_modules/<pkg>` segment that names the actual package.
+//
+// `packageDir` is this path's authoritative stasis package directory
+// (from `bundlePackageDirs` in bundle-sources.js), when one is known.
+// It takes precedence over path heuristics: a module can contain its own
+// `dependencies/` directory without those files becoming new packages.
+// Recorded `node_modules/<pkg>` directories use the bare package name;
+// other named module directories stay separate under their full dir, and
+// `.` identifies own source. Only bundles without this metadata use
+// the path heuristic.
+//
+// The result is the package's identity — what files, sizes and edges are
+// grouped by — so a vendored package keeps its dir here: Cargo's
+// `vendor/log` is not npm's `log`, and one bundle can carry both. It is
+// `pkgLabel` that shows it by name.
+export function bundlePkgOf(path, { packageDir = null } = {}) {
+  if (packageDir) {
+    if (packageDir !== '.') {
+      const npm = packageDir.match(/(?:^|\/)node_modules\/(@[^/]+\/[^/]+|[^/]+)$/u)
+      return npm && npm[1] !== '.pnpm' ? npm[1] : packageDir
+    }
+  } else {
+    const re = /\.sol$/iu.test(path)
+      ? /(?:^|\/)(?:node_modules\/(@[^/]+\/[^/]+|[^/]+)|dependencies\/(@[^/]+\/[^/]+|[^/]+)\/)/gu
+      : /(?:^|\/)node_modules\/(@[^/]+\/[^/]+|[^/]+)/gu
+    let m
+    while ((m = re.exec(path)) !== null) {
+      const name = m[1] ?? m[2]
+      if (name !== '.pnpm') return name
+    }
+  }
+  return '__own__'
+}
+
+// First-party code: own source, and named workspace modules (a recorded
+// package dir outside `node_modules/`, `dependencies/` and `vendor/`).
+// Workspace modules stay separate packages in `bundlePkgOf`, but are
+// own code even when another workspace imports them.
+export function isOwnSourcePath(path, packageDir = null) {
+  return bundlePkgOf(path, { packageDir }) === '__own__'
+    || Boolean(packageDir) && !/(?:^|\/)(?:node_modules|dependencies|vendor)(?:\/|$)/u.test(packageDir)
+}
+
+// Search order for the bundle Code rail and Search tab: own code
+// first, then dependencies, each keeping the order `paths` came in.
+// Matches in the bundle's own code are usually what a search is after,
+// and package code shouldn't push them past the result caps.
+// `packageDirs` is `bundlePackageDirs` output, or null for the path
+// heuristic alone.
+export function ownSourceFirst(paths, packageDirs = null) {
+  const own = []
+  const deps = []
+  for (const path of paths) (isOwnSourcePath(path, packageDirs?.get(path)) ? own : deps).push(path)
+  return [...own, ...deps]
+}
+
+// Display label for a package bucket: `__own__` is the sentinel for
+// own-source (non-dependency) files, spelled out as "Own source" in
+// package lists and tooltips.
+//
+// A vendored package is shown by the path after the (last) `vendor/`,
+// which in each vendoring layout is what the package is called: `cargo
+// vendor` puts a crate at `vendor/<crate>`, Composer a package at
+// `vendor/<vendor>/<pkg>`, Go a module at `vendor/<module path>`. Only
+// the label is shortened; the bucket keeps the dir (see `bundlePkgOf`).
+// Anything but a package key (the graph asks with no package focused)
+// passes through as it came.
+export function pkgLabel(pkg) {
+  if (pkg === '__own__') return 'Own source'
+  if (typeof pkg !== 'string') return pkg
+  return pkg.match(/^(?:.*\/)?vendor\/(.+)$/u)?.[1] ?? pkg
+}

package/common/bundle-source-links.js

@@ -1,4 +1,5 @@
 import { bundleFilesAsMap, bundlePackageDirs, bundleSourcesAsMap } from './bundle-sources.js'
+import { bundleSourcemapSpecifiers } from './bundle-sourcemap.js'
 
 const indexes = new WeakMap()
 const manifests = new WeakMap()
@@ -130,6 +131,7 @@ function resolvePackageImport(scope, specifier, sources, index, recorded, direct
 // Merge conditions before linking. When exporting a restricted source set,
 // include only visible parents and replace every unavailable target with null:
 // its path must not leak, and relative fallback must still remain blocked.
+// A sourcemap's are what its edges say each specifier names (bundle-sourcemap.js).
 export function bundleSourceImports(details, sources = bundleSourcesAsMap(details)) {
   const imports = new Map()
   if (details?.kind === 'stasis') {
@@ -146,6 +148,11 @@ export function bundleSourceImports(details, sources = bundleSourcesAsMap(detail
         }
       }
     }
+  } else if (details?.kind === 'sourcemap') {
+    for (const [parent, specifiers] of bundleSourcemapSpecifiers(details)) {
+      if (!sources.has(parent)) continue
+      imports.set(parent, new Map([...specifiers].map(([specifier, target]) => [specifier, sources.has(target) ? target : null])))
+    }
   }
   return imports
 }

package/common/bundle-sourcemap.d.ts

@@ -0,0 +1,10 @@
+import type { SourceMap } from '@preventive/sourcemap'
+import type { Edge } from '@preventive/sourcemap/edges.js'
+import type { BundleDetails } from './bundle-metadata.js'
+export function parseSourcemap(text: string): { json: { version: unknown; file: unknown; sourceRoot: unknown }; map: SourceMap; namesCount: number | null }
+export function sourcemapEntries(details: BundleDetails): [string, string | null][]
+export type SourcemapEdge = [from: string, to: string] | [from: string, to: string, specifier: string]
+export function sourcemapEdges(map: SourceMap, read: (map: SourceMap) => { edges: Edge[] }): SourcemapEdge[]
+export function bundleSourcemapEdges(details: BundleDetails): readonly SourcemapEdge[]
+export function bundleSourcemapImports(details: BundleDetails): Map<string, Set<string>>
+export function bundleSourcemapSpecifiers(details: BundleDetails): Map<string, Map<string, string>>

package/common/bundle-sourcemap.js

@@ -0,0 +1,100 @@
+// A sourcemap bundle as @preventive/sourcemap reads it: plain or indexed,
+// each file once, with the edges between its files, which the graph draws
+// and Code links follow by the specifier of each import. A file keeps the key
+// it had before the package read it, the spelling the map lists it under
+// (`sourceRoot` in front), so Code links, hashes and reports that name one
+// still find it.
+//
+// Edges take a parser for most maps. The client goes without one: it reads
+// them with edges-lite.js, which knows Metro's maps alone. The server reads
+// every map's with oxc-parser (server-managed/bundle-cache.ts) and keeps
+// them in the bundle's metadata, which a client takes over its own.
+import { readSourceMap } from '@preventive/sourcemap'
+import { bundleEdges as metroEdges } from '@preventive/sourcemap/edges-lite.js'
+
+// The map as read, and what the Overview shows of the JSON: its header,
+// and how many names it maps. The JSON itself is not kept, its mappings
+// read and its sources the map's files.
+export function parseSourcemap(text) {
+  // The `)]}'` line that guards a map against being run, which readSourceMap
+  // skips in text it parses itself.
+  const json = JSON.parse(text.replace(/^\)\]\}'[^\n]*\n/u, ''))
+  const map = readSourceMap(json)
+  const namesCount = json.sections
+    ? json.sections.reduce((count, section) => count + (section.map.names?.length ?? 0), 0)
+    : json.names?.length ?? null
+  return { json: { version: json.version, file: json.file, sourceRoot: json.sourceRoot }, map, namesCount }
+}
+
+// The map's files as `[key, content or null]`, in its order. Details with
+// no map read (the npm viewer's, a map's arrays as written) list what their
+// `sources` does, a repeated path repeated.
+export function sourcemapEntries(details) {
+  if (details.map) return details.map.files.flatMap((file) => file.source === null ? [] : [[file.source, file.content]])
+  const contents = details.json?.sourcesContent ?? []
+  return (details.json?.sources ?? []).map((path, i) => [path, contents[i] ?? null])
+}
+
+// `read`'s edges between files of the map, as rows by key: `[from, to]`,
+// and `[from, to, specifier]` for an import its specifier names. An edge to
+// no file of it (a package left out, a builtin) leads nowhere here, and one
+// to its own file is none, which metadata refuses to hold.
+export function sourcemapEdges(map, read) {
+  const rows = new Map()
+  for (const { from, to, specifier } of read(map).edges) {
+    if (from.source === null || to?.source == null || to.source === from.source) continue
+    const row = typeof specifier === 'string' ? [from.source, to.source, specifier] : [from.source, to.source]
+    rows.set(row.join('\0'), row)
+  }
+  return [...rows.values()]
+}
+
+// edges-lite.js throws for a map that is not Metro's, or one with no
+// sourcesContent to read: one with no edges the client can tell.
+function liteEdges(map) {
+  try { return metroEdges(map) } catch { return { edges: [] } }
+}
+
+const NO_EDGES = Object.freeze([])
+
+// The edges a view reads: those the metadata carries, else what the client
+// reads of its own map. None without a map.
+export function bundleSourcemapEdges(details) {
+  if (details?.edges) return details.edges
+  if (!details?.map) return NO_EDGES
+  details.edges = sourcemapEdges(details.map, liteEdges)
+  return details.edges
+}
+
+const importsCache = new WeakMap()
+const specifiersCache = new WeakMap()
+
+// The graph's: `Map<from, Set<to>>`.
+export function bundleSourcemapImports(details) {
+  const rows = bundleSourcemapEdges(details)
+  if (!importsCache.has(rows)) {
+    const imports = new Map()
+    for (const [from, to] of rows) {
+      if (!imports.has(from)) imports.set(from, new Set())
+      imports.get(from).add(to)
+    }
+    importsCache.set(rows, imports)
+  }
+  return importsCache.get(rows)
+}
+
+// Code links': the file each import's specifier names, `Map<from,
+// Map<specifier, to>>`.
+export function bundleSourcemapSpecifiers(details) {
+  const rows = bundleSourcemapEdges(details)
+  if (!specifiersCache.has(rows)) {
+    const specifiers = new Map()
+    for (const [from, to, specifier] of rows) {
+      if (specifier === undefined) continue
+      if (!specifiers.has(from)) specifiers.set(from, new Map())
+      specifiers.get(from).set(specifier, to)
+    }
+    specifiersCache.set(rows, specifiers)
+  }
+  return specifiersCache.get(rows)
+}

package/common/bundle-sources.d.ts

@@ -1,5 +1,7 @@
 import type { BundleDetails } from './bundle-metadata.js'
 export function bundleSourcesAsMap(details: BundleDetails): Map<string, string>
+export function bundleSourceLines(content: string): number
+export function bundleSourceOrder(sources: Map<string, string>): { paths: string[]; numbers: Map<string, number> }
 export function bundleFilesAsMap(details: BundleDetails): Map<string, string | { format: 'base64'; data: string }>
 export function bundlePackageDirs(details: BundleDetails): Map<string, string> | null
-export function bundlePackageVersions(details: BundleDetails, paths?: Iterable<string> | null): Map<string, Set<string>>
+export function bundlePackageVersions(details: BundleDetails, paths?: Iterable<string> | null, keyOf?: (dir: string, info: { name: string; version: string }) => string): Map<string, Set<string>>

package/common/bundle-sources.js

@@ -1,10 +1,9 @@
 // Shared helper: given a parsed bundle `details`, return a
 // Map<file, content-string> of its source files. Stasis bundles
 // expose sources via `@exodus/stasis-core`'s `Bundle.sources` getter
-// (flat Map<projectRelPath, content> from `.modules`); sourcemaps
-// split them across parallel `sources` / `sourcesContent` arrays on
-// the raw .map JSON. Sourcemap sources whose `sourcesContent[i]` was
-// omitted are skipped.
+// (flat Map<projectRelPath, content> from `.modules`); sourcemaps list
+// their files as bundle-sourcemap.js reads them. Sourcemap sources whose
+// `sourcesContent[i]` was omitted are skipped.
 //
 // What a stasis bundle records is not all source: `Bundle.formats`
 // marks each entry, and three of those formats are files only in the
@@ -28,6 +27,7 @@
 // a new bundle kind or field handled here is visible to both.
 
 import { Bundle } from '@exodus/stasis-core/bundle'
+import { sourcemapEntries } from './bundle-sourcemap.js'
 import { utf8ByteLength } from './utf8.js'
 
 const sourcesCache = new WeakMap()
@@ -57,17 +57,35 @@ export function bundleSourcesAsMap(details) {
       result.set(file, content)
     }
   } else if (details.kind === 'sourcemap') {
-    if (!details.json) return result
-    const srcs = details.json.sources ?? []
-    const contents = details.json.sourcesContent ?? []
-    for (let i = 0; i < srcs.length; i++) {
-      if (typeof contents[i] === 'string') result.set(srcs[i], contents[i])
+    for (const [path, content] of sourcemapEntries(details)) {
+      if (typeof content === 'string') result.set(path, content)
     }
   }
   if (key) sourcesCache.set(key, result)
   return result
 }
 
+// A source's lines as the viewer numbers them: one more than its newlines.
+export function bundleSourceLines(content) {
+  let lines = 1
+  for (let at = content.indexOf('\n'); at !== -1; at = content.indexOf('\n', at + 1)) lines++
+  return lines
+}
+
+// A bundle's sources in path order, and each one's number in it from 1: how a
+// managed Code link names a file. The content hash that names a bundle fixes
+// its sources, so the numbers stay put.
+const sourceOrders = new WeakMap()
+export function bundleSourceOrder(sources) {
+  let order = sourceOrders.get(sources)
+  if (!order) {
+    const paths = [...sources.keys()].toSorted()
+    order = { paths, numbers: new Map(paths.map((path, index) => [path, index + 1])) }
+    sourceOrders.set(sources, order)
+  }
+  return order
+}
+
 // Every file the bundle carries, for a reader that wants the filesystem
 // rather than the source: what `bundleSourcesAsMap` returns, plus the
 // resources it leaves out, each in the form that is true to it.
@@ -97,6 +115,10 @@ export function bundleFilesAsMap(details) {
   const key = details?.bundle ?? details?.json
   if (key && filesCache.has(key)) return filesCache.get(key)
   const files = new Map(bundleSourcesAsMap(details))
+  // An npm package's files that are not text (view/npm-package.js) carry
+  // their size and digest alone: enough for Compare to tell a changed one
+  // from an unchanged one, as `{ format: 'digest', size, digest }`.
+  for (const [path, file] of details?.npmBinaries ?? []) files.set(path, { format: 'digest', ...file })
   if (details?.kind === 'stasis' && details.bundle) {
     const formats = details.bundle.formats
     for (const [file, content] of details.bundle.sources) {
@@ -139,6 +161,7 @@ function base64ByteLength(text) {
 // bundles' files by this, so its totals are the Overview's.
 export function bundleFileByteLength(content) {
   if (typeof content === 'string') return utf8ByteLength(content)
+  if (content?.format === 'digest') return content.size
   return content?.format === 'base64' ? base64ByteLength(content.data) : null
 }
 
@@ -163,7 +186,7 @@ export function bundleFileSizes(details) {
   if (key && sizesCache.has(key)) return sizesCache.get(key)
   const sizes = new Map()
   const files = bundleFilesAsMap(details)
-  const paths = details?.kind === 'stasis' ? details.bundle?.sources.keys() : details?.json?.sources
+  const paths = details?.kind === 'stasis' ? details.bundle?.sources.keys() : details && sourcemapEntries(details).map(([path]) => path)
   for (const path of paths ?? []) sizes.set(path, bundleFileByteLength(files.get(path)))
   if (key) sizesCache.set(key, sizes)
   return sizes
@@ -202,22 +225,23 @@ export function bundleFileKinds(details) {
   const kinds = new Map()
   for (const [path, size] of sizes) {
     if (size === null && !unsized.has(path)) continue
-    kinds.set(path, Bundle.isResourceFormat(formats?.get(path)) ? 'resource' : 'source')
+    // An npm package's file that is not text is a resource too: no source to view.
+    kinds.set(path, Bundle.isResourceFormat(formats?.get(path)) || details?.npmBinaries?.has(path) ? 'resource' : 'source')
   }
   kindsCache.set(sizes, kinds)
   return kinds
 }
 
-// `bundleFileSizes` narrowed to source: a resource's size is nulled, as a
-// directory capture's already is. The import graph draws this, and stays
-// source-only: an image or a font imports nothing and carries no finding.
+// Source paths and their recorded byte sizes. Keep null for a source whose
+// body is missing, but omit resources and directory captures entirely so
+// graph consumers can distinguish unknown source bytes from non-source.
 export function bundleSourceSizes(details) {
   const sizes = bundleFileSizes(details)
   const formats = details?.kind === 'stasis' ? details.bundle?.formats : null
   if (!formats || formats.size === 0) return sizes
   if (sourceSizesCache.has(sizes)) return sourceSizesCache.get(sizes)
   const result = new Map()
-  for (const [path, size] of sizes) result.set(path, Bundle.isResourceFormat(formats.get(path)) ? null : size)
+  for (const [path, size] of sizes) if (!Bundle.isResourceFormat(formats.get(path))) result.set(path, size)
   sourceSizesCache.set(sizes, result)
   return result
 }
@@ -264,8 +288,11 @@ export function bundlePackageDirs(details) {
 // Shared by the Advisories tab (a bulk registry lookup keyed on these
 // pairs) and the Compare slide (the dependency version-update diff).
 // Returns an empty Map for sourcemaps and v0 stasis bundles — neither
-// carries per-module version metadata.
-export function bundlePackageVersions(details, paths = null) {
+// carries per-module version metadata. `keyOf(dir, info)` names each
+// entry, the recorded name by default; Compare keys by install directory,
+// as its sizes are, so an npm alias (`node_modules/alias` recording
+// `actual-package`) joins its own sizes.
+export function bundlePackageVersions(details, paths = null, keyOf = (_dir, info) => info.name) {
   const versions = new Map()
   if (details?.kind !== 'stasis' || !details.bundle?.modules) return versions
   const packageDirs = paths === null ? null : bundlePackageDirs(details)
@@ -274,8 +301,9 @@ export function bundlePackageVersions(details, paths = null) {
     if (selectedDirs && !selectedDirs.has(dir)) continue
     if (!dir.includes('node_modules')) continue
     if (!info?.name || typeof info.version !== 'string' || !info.version) continue
-    let set = versions.get(info.name)
-    if (!set) { set = new Set(); versions.set(info.name, set) }
+    const key = keyOf(dir, info)
+    let set = versions.get(key)
+    if (!set) { set = new Set(); versions.set(key, set) }
     set.add(info.version)
   }
   return versions

package/common/code-language.js

@@ -39,7 +39,19 @@ const FORMAT_TO_LANG = {
   'podfile-lock': 'yaml', xml: 'markup',
 }
 
-export function langForPath(path, format) {
+// Whether a text is a JSON object by its ends: `{` first and `}` last,
+// whitespace aside. Read from both ends, never the whole of a large file.
+function objectText(content) {
+  if (typeof content !== 'string') return false
+  let end = content.length - 1, start = 0
+  while (start < end && /\s/u.test(content[start])) start++
+  while (end > start && /\s/u.test(content[end])) end--
+  return start < end && content[start] === '{' && content[end] === '}'
+}
+
+// `content`, where the caller has it, settles what the name alone cannot: a
+// `.map` file is a source map, JSON, when its text is an object.
+export function langForPath(path, format, content) {
   if (typeof format === 'string' && FORMAT_TO_LANG[format]) return FORMAT_TO_LANG[format]
   if (typeof path !== 'string') return null
   // Only the filename can contribute an extension. A dotted directory such
@@ -47,5 +59,7 @@ export function langForPath(path, format) {
   const basename = path.slice(path.lastIndexOf('/') + 1)
   const dot = basename.lastIndexOf('.')
   if (dot <= 0) return null
-  return EXT_TO_LANG[basename.slice(dot + 1).toLowerCase()] ?? null
+  const ext = basename.slice(dot + 1).toLowerCase()
+  if (ext === 'map') return objectText(content) ? 'json' : null
+  return EXT_TO_LANG[ext] ?? null
 }

package/common/default-scan-models.ts

@@ -5,7 +5,7 @@ export function defaultScanModels(provider: string | null = null) {
     'anthropic/claude-opus-5.5',
     'anthropic/claude-fable-5.1',
     'anthropic/claude-sonnet-5.5',
-    'anthropic/claude-haiku-4.5',
+    'anthropic/claude-haiku-5.5',
     'openai/gpt-6-astra',
     'openai/gpt-6-astra-pro',
     'openai/gpt-6.1-sol',
@@ -20,6 +20,7 @@ export function defaultScanModels(provider: string | null = null) {
     'qwen/qwen3.8-max',
     'deepseek/deepseek-v4.1-flash',
     'deepseek/deepseek-v4-pro',
+    'mistralai/mistral-large-4-0',
   ]
   // OpenRouter routes all listed providers. Direct-provider credentials only
   // expose that provider's models; no selection leaves the catalogue intact.

package/common/dependency-reviews.d.ts

@@ -0,0 +1,23 @@
+export type ReviewVerdict = 'accept' | 'accept-with-nits' | 'request-changes' | 'reject'
+export interface ReviewSummary {
+  coverage: 'full' | 'partial' | null
+  checkedFiles: number | null
+  totalFiles: number | null
+  verdictLimit: ReviewVerdict
+}
+export const REVIEW_VERDICTS: Record<ReviewVerdict, string>
+export function isReviewableFile(before: unknown, after: unknown): boolean
+export function summarizeReview(entries: { file: string; status: ReviewVerdict | null }[], files: string[] | null, nonTextFiles?: string[] | null): ReviewSummary
+export function allowedReviewVerdicts(entries: { file: string; status: ReviewVerdict | null }[], limit?: ReviewVerdict): ReviewVerdict[]
+interface ReviewNpmVersion { version: string; private?: boolean; manifest?: Record<string, unknown> }
+export function npmTakenDown(entry: { npm: ReviewNpmVersion }): boolean
+export function npmReviewVerdictLimit(npm: ReviewNpmVersion | null | undefined,
+  advisoryList?: { versions: string[]; advisories: { id?: string; title?: string; severity?: string; cwe?: string[]; affected: number[] }[] } | null,
+  socket?: { alerts: { type: string }[] } | null, risk?: { findings: { id: string }[] } | null): ReviewVerdict
+export function needsPackageJsonReview(entries: { file: string; status: ReviewVerdict | null }[], files: string[], nonTextFiles?: string[] | null): boolean
+export function parseReviewNotes(comment: string): { text: string; bullet: boolean }[]
+export function auditMarkdown(review: ReviewSummary & {
+  package: string; version: string; integrity: string; basePackage: string | null; baseVersion: string | null
+  publishedAt: number | null; revokedAt: number | null; entries: { file: string; comment: string }[]
+  status: ReviewVerdict | null; comment: string
+}): string | null