@preventive/triage 1.0.0-alpha.41 → 1.0.0-alpha.43

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/common/managed/report-filter.ts +2 -1
  2. package/common/security-links.d.ts +5 -0
  3. package/common/security-links.js +33 -0
  4. package/out/{chunk-TY4RZD3Z.js → chunk-7RU5EDRO.js} +61 -61
  5. package/out/{chunk-XL35ZV6R.js → chunk-A7M4GV7M.js} +1 -1
  6. package/out/{chunk-2AFQKRAM.js → chunk-CLPKNNC7.js} +7 -7
  7. package/out/{chunk-UZAZM2SX.js → chunk-LAAB5SZT.js} +1 -1
  8. package/out/{chunk-KVEUXIEU.js → chunk-NWZ4PVPN.js} +1 -1
  9. package/out/{chunk-QZ3A376W.js → chunk-OSIMGFUF.js} +1 -1
  10. package/out/{chunk-U6OPEXIA.js → chunk-XOCAPDCM.js} +1 -1
  11. package/out/client-managed.js +19 -19
  12. package/out/index.html +3 -3
  13. package/out/view.js +54 -54
  14. package/package.json +9 -3
  15. package/risk/files/runs-code.js +13 -5
  16. package/risk/index.d.ts +26 -0
  17. package/risk/index.js +1 -1
  18. package/risk/npm/assess.js +60 -14
  19. package/risk/npm/combined.js +4 -1
  20. package/risk/npm/compare.js +10 -5
  21. package/risk/npm/dependencies.js +11 -3
  22. package/risk/npm/diff.js +42 -6
  23. package/risk/npm/held.js +5 -2
  24. package/risk/npm/new-dependency.js +42 -12
  25. package/risk/npm/registry.js +122 -21
  26. package/server-managed/http.ts +63 -26
  27. package/server-managed/locked-packages.ts +18 -6
  28. package/server-managed/npm-kept.ts +38 -14
  29. package/server-managed/npm-packages.ts +27 -13
  30. package/server-managed/npm-risk.ts +69 -11
  31. package/server-managed/pretty-print.ts +1 -1
  32. package/server-managed/queue.ts +23 -0
  33. package/server-managed/report-sources.ts +1 -1
  34. package/server-managed/repository-risk-assess.ts +105 -0
  35. package/server-managed/repository-risk-audit.ts +66 -0
  36. package/server-managed/repository-risk.ts +255 -201
  37. package/server-managed/scan-downloads.ts +87 -0
  38. package/server-managed/sql.ts +1 -1
  39. package/server-managed/team-reports.ts +6 -11
  40. package/server-managed/type-only-worker.js +3 -3
  41. package/server-managed/type-only.ts +4 -2
  42. package/server-managed/upstream-cache.ts +16 -0
@@ -1 +1 @@
1
- import{Cd as G,Fa as N,Ja as H,Jd as P,_c as R,ad as v,bd as U,db as I,eb as p,fb as B,h as o,i as f,pa as q,pd as D,q as A,r as C,s as _,x as $}from"./chunk-TY4RZD3Z.js";import{b as M}from"./chunk-CVVJAXVY.js";import{u as x}from"./chunk-RSHMVYNS.js";import{c as b}from"./chunk-4F6JSF57.js";async function V(e,{openManagedReport:n,readTeam:t=G,isCurrent:i=()=>!0}){let c=o.managedSession,r=()=>i()&&f()&&o.managedSession?.id===c?.id&&o.managedSession?.role===c?.role,u=o.managedTeams;if(!r())return null;async function m(a,s){return!r()||(o.currentManagedTeam!==a.id||o.currentManagedReport!==s)&&!await n(a,s)||!r()||o.currentManagedTeam!==a.id||o.currentManagedReport!==s?null:p(e.id)}if(e.teamId){let a=u.find(s=>s.id===e.teamId);return!a||e.reportId&&!a.reports.some(s=>s.id===e.reportId)?null:m(a,e.reportId??null)}let w=u.flatMap(a=>a.reports.map(s=>({team:a,report:s}))),h=new Set,d=new Map;async function k(a){for(let{team:s,report:l}of a){if(!r())return null;if(h.has(`${s.id}:${l.id}`))continue;h.add(`${s.id}:${l.id}`),d.has(s.id)||d.set(s.id,await t(s.id));let y=d.get(s.id)?.find(S=>S.id===l.id);if(!r())return null;if(y==null)continue;let j=await x(JSON.stringify(y.data),l.filename);if(!r())return null;if(j?.findings.some(S=>S.id===e.id))return m(s,l.id)}return null}if(e.report){let a=await Promise.all(w.map(({report:l})=>b("report",l.filename))),s=await k(w.filter((l,y)=>a[y]===e.report));if(s||!r())return s}if(e.workspace){let a=await Promise.all(u.map(l=>b("workspace",`managed-team:${l.id}`))),s=u[a.indexOf(e.workspace)];if(s){let l=await m(s,null);if(l||!r())return l}}if(!r())return null;let O=u.find(a=>a.id===o.currentManagedTeam);if(O&&(o.currentManagedReport==null||O.reports.some(a=>a.id===o.currentManagedReport))){let a=p(e.id);if(a)return a}return k(w)}async function J(e,n,t,{openReport:i,openManagedReport:c}){if(f()){let r=o.managedTeams.find(u=>u.id===o.currentManagedTeam);if(!t||!r?.reports.some(u=>u.id===t)||(o.currentManagedReport!==t||o.currentWorkspace)&&!await c(r,t)||!f()||o.currentManagedTeam!==r.id||o.currentManagedReport!==t||o.currentWorkspace)return null}else if(t||((o.currentFile!==n||o.currentWorkspace)&&await i(n),f()||o.currentFile!==n||o.currentWorkspace))return null;return p(e)}async function K(e,n){if(f())return V(e,n);let{openReport:t,openWorkspace:i}=n,[c,r]=await Promise.all([C(e.report),A(e.workspace)]);async function u(d){let k=I(d,r?.id);return(o.currentFile!==d||o.currentWorkspace||o.currentReportWorkspace!==k)&&await t(d,void 0,{workspaceId:k}),p(e.id)}if(c){let d=await u(c);if(d)return d}if(r){o.currentWorkspace!==r.id&&await i(r.id);let d=p(e.id);if(d)return d}let m=p(e.id);if(m)return m;let w=o.reports.map(d=>d.fileName).filter(Boolean),h=await _(e.id,{skip:w});return h?await u(h):null}var z="100% 0px",Q=new WeakMap,g=new WeakMap,L=[],E=!1,X=new WeakMap;function Z(e){let n=X.get(e);if(n===void 0){let t=getComputedStyle(e).overflowY;n=t==="auto"||t==="scroll"||t==="overlay",X.set(e,n)}return n}function W(e){let n=e.parentNode;for(;n;){if(n.nodeType===Node.DOCUMENT_FRAGMENT_NODE){n=n.host??null;continue}if(n.nodeType!==Node.ELEMENT_NODE||n===document.documentElement)return null;if(Z(n))return n;n=n.parentNode}return null}function ee(e){for(let n of e)g.get(n.target)?.cb(n.isIntersecting)}function ne(e){let n=e??document,t=Q.get(n);return t||(t=new IntersectionObserver(ee,{root:e,rootMargin:z,threshold:0}),Q.set(n,t)),t}function Se(e,n){let t=g.get(e);t?.io&&t.io.unobserve(e),g.set(e,{cb:n,io:null}),L.push(e),E||(E=!0,queueMicrotask(te))}function te(){E=!1;let e=L;L=[];for(let n of e){let t=g.get(n);!t||t.io||(t.io=ne(W(n)),t.io.observe(n))}}function be(e){let n=g.get(e);n&&(n.io?.unobserve(e),g.delete(e))}var oe=1600,F="link-target",ie="Couldn't find that finding in any of your reports. Import the report it came from, then open the link again.",T=null,re=3,ae=150,se=5;function ce(e){T!==null&&clearTimeout(T);for(let n of document.querySelectorAll(`.${F}`))n.classList.remove(F);e.classList.add(F),T=setTimeout(()=>{e.classList.remove(F),T=null},oe)}function ue(e){return new Promise(n=>{let t=null,i=0,c=0,r=()=>{let u=Math.round(e.getBoundingClientRect().top);i=u===t?i+1:0,t=u,i>=re||++c>=ae?n():requestAnimationFrame(r)};requestAnimationFrame(r)})}function de(e){let n=0,t=window.innerHeight,i=W(e);if(i){let c=i.getBoundingClientRect();n=Math.max(n,c.top),t=Math.min(t,c.bottom)}return{top:n,bottom:t}}function le(e){let n=e.getBoundingClientRect();if(n.height===0)return!1;let{top:t,bottom:i}=de(e);if(i<=t)return!1;let c=(t+i)/2;return n.top>=t&&n.bottom<=i||n.top<=c&&n.bottom>=c}async function fe(e){e.scrollIntoView({block:"center",behavior:"smooth"});for(let n=0;n<se;n++){if(await ue(e),!e.isConnected||le(e))return;e.scrollIntoView({block:"center",behavior:"instant"})}}async function pe(e){let n=CSS.escape(e);if(o.viewMode==="table"){let t=M.querySelector("finding-table");if(t){try{await t.updateComplete}catch{}for(let i of t.shadowRoot?.querySelectorAll("finding-row")??[])if(i.group&&q(i.group)===e)return i}}if(o.viewMode==="kanban"){let t=M.querySelector(`.kanban-card[data-gid="${n}"]`);if(t)return t}return M.querySelector(`finding-card[data-gid="${n}"]`)??M.querySelector(`[data-gid="${n}"]`)}async function Y(e,n,t=()=>!0){let i=B(e.group,n),c=H(i);if(c&&N(c)&&queueMicrotask($),D(),await P({revealSelection:!0}),!t())return{ok:!1};let r=await pe(i);return t()?r?(typeof r.ensureRendered=="function"&&await r.ensureRendered(),await fe(r),t()?(ce(r),{ok:!0}):{ok:!1}):{ok:!0}:{ok:!1}}async function $e(e,{openManagedReport:n=v,isCurrent:t=()=>!0}={}){if(!e?.id)return{ok:!1,reason:"This link is missing a finding id."};let i=await K(e,{openReport:R,openWorkspace:U,openManagedReport:n,isCurrent:t});return t()?i?await Y(i,e.id,t):{ok:!1,reason:f()?"Couldn't find that finding in the team reports you can access.":ie}:{ok:!1}}async function qe(e,n,t=null){if(!e||!n)return{ok:!1,reason:"Missing finding id or report name."};let i=await J(e,n,t,{openReport:R,openManagedReport:v});return i?await Y(i,e):{ok:!1,reason:t?`Could not open that finding in "${n}". Open the team and try again.`:`Couldn't find that finding in "${n}". It may have been re-imported since this links file was written.`}}export{Se as a,be as b,$e as c,qe as d};
1
+ import{Cd as G,Fa as N,Ja as H,Jd as P,_c as R,ad as v,bd as U,db as I,eb as p,fb as B,h as o,i as f,pa as q,pd as D,q as A,r as C,s as _,x as $}from"./chunk-7RU5EDRO.js";import{b as M}from"./chunk-CVVJAXVY.js";import{u as x}from"./chunk-RSHMVYNS.js";import{c as b}from"./chunk-4F6JSF57.js";async function V(e,{openManagedReport:n,readTeam:t=G,isCurrent:i=()=>!0}){let c=o.managedSession,r=()=>i()&&f()&&o.managedSession?.id===c?.id&&o.managedSession?.role===c?.role,u=o.managedTeams;if(!r())return null;async function m(a,s){return!r()||(o.currentManagedTeam!==a.id||o.currentManagedReport!==s)&&!await n(a,s)||!r()||o.currentManagedTeam!==a.id||o.currentManagedReport!==s?null:p(e.id)}if(e.teamId){let a=u.find(s=>s.id===e.teamId);return!a||e.reportId&&!a.reports.some(s=>s.id===e.reportId)?null:m(a,e.reportId??null)}let w=u.flatMap(a=>a.reports.map(s=>({team:a,report:s}))),h=new Set,d=new Map;async function k(a){for(let{team:s,report:l}of a){if(!r())return null;if(h.has(`${s.id}:${l.id}`))continue;h.add(`${s.id}:${l.id}`),d.has(s.id)||d.set(s.id,await t(s.id));let y=d.get(s.id)?.find(S=>S.id===l.id);if(!r())return null;if(y==null)continue;let j=await x(JSON.stringify(y.data),l.filename);if(!r())return null;if(j?.findings.some(S=>S.id===e.id))return m(s,l.id)}return null}if(e.report){let a=await Promise.all(w.map(({report:l})=>b("report",l.filename))),s=await k(w.filter((l,y)=>a[y]===e.report));if(s||!r())return s}if(e.workspace){let a=await Promise.all(u.map(l=>b("workspace",`managed-team:${l.id}`))),s=u[a.indexOf(e.workspace)];if(s){let l=await m(s,null);if(l||!r())return l}}if(!r())return null;let O=u.find(a=>a.id===o.currentManagedTeam);if(O&&(o.currentManagedReport==null||O.reports.some(a=>a.id===o.currentManagedReport))){let a=p(e.id);if(a)return a}return k(w)}async function J(e,n,t,{openReport:i,openManagedReport:c}){if(f()){let r=o.managedTeams.find(u=>u.id===o.currentManagedTeam);if(!t||!r?.reports.some(u=>u.id===t)||(o.currentManagedReport!==t||o.currentWorkspace)&&!await c(r,t)||!f()||o.currentManagedTeam!==r.id||o.currentManagedReport!==t||o.currentWorkspace)return null}else if(t||((o.currentFile!==n||o.currentWorkspace)&&await i(n),f()||o.currentFile!==n||o.currentWorkspace))return null;return p(e)}async function K(e,n){if(f())return V(e,n);let{openReport:t,openWorkspace:i}=n,[c,r]=await Promise.all([C(e.report),A(e.workspace)]);async function u(d){let k=I(d,r?.id);return(o.currentFile!==d||o.currentWorkspace||o.currentReportWorkspace!==k)&&await t(d,void 0,{workspaceId:k}),p(e.id)}if(c){let d=await u(c);if(d)return d}if(r){o.currentWorkspace!==r.id&&await i(r.id);let d=p(e.id);if(d)return d}let m=p(e.id);if(m)return m;let w=o.reports.map(d=>d.fileName).filter(Boolean),h=await _(e.id,{skip:w});return h?await u(h):null}var z="100% 0px",Q=new WeakMap,g=new WeakMap,L=[],E=!1,X=new WeakMap;function Z(e){let n=X.get(e);if(n===void 0){let t=getComputedStyle(e).overflowY;n=t==="auto"||t==="scroll"||t==="overlay",X.set(e,n)}return n}function W(e){let n=e.parentNode;for(;n;){if(n.nodeType===Node.DOCUMENT_FRAGMENT_NODE){n=n.host??null;continue}if(n.nodeType!==Node.ELEMENT_NODE||n===document.documentElement)return null;if(Z(n))return n;n=n.parentNode}return null}function ee(e){for(let n of e)g.get(n.target)?.cb(n.isIntersecting)}function ne(e){let n=e??document,t=Q.get(n);return t||(t=new IntersectionObserver(ee,{root:e,rootMargin:z,threshold:0}),Q.set(n,t)),t}function Se(e,n){let t=g.get(e);t?.io&&t.io.unobserve(e),g.set(e,{cb:n,io:null}),L.push(e),E||(E=!0,queueMicrotask(te))}function te(){E=!1;let e=L;L=[];for(let n of e){let t=g.get(n);!t||t.io||(t.io=ne(W(n)),t.io.observe(n))}}function be(e){let n=g.get(e);n&&(n.io?.unobserve(e),g.delete(e))}var oe=1600,F="link-target",ie="Couldn't find that finding in any of your reports. Import the report it came from, then open the link again.",T=null,re=3,ae=150,se=5;function ce(e){T!==null&&clearTimeout(T);for(let n of document.querySelectorAll(`.${F}`))n.classList.remove(F);e.classList.add(F),T=setTimeout(()=>{e.classList.remove(F),T=null},oe)}function ue(e){return new Promise(n=>{let t=null,i=0,c=0,r=()=>{let u=Math.round(e.getBoundingClientRect().top);i=u===t?i+1:0,t=u,i>=re||++c>=ae?n():requestAnimationFrame(r)};requestAnimationFrame(r)})}function de(e){let n=0,t=window.innerHeight,i=W(e);if(i){let c=i.getBoundingClientRect();n=Math.max(n,c.top),t=Math.min(t,c.bottom)}return{top:n,bottom:t}}function le(e){let n=e.getBoundingClientRect();if(n.height===0)return!1;let{top:t,bottom:i}=de(e);if(i<=t)return!1;let c=(t+i)/2;return n.top>=t&&n.bottom<=i||n.top<=c&&n.bottom>=c}async function fe(e){e.scrollIntoView({block:"center",behavior:"smooth"});for(let n=0;n<se;n++){if(await ue(e),!e.isConnected||le(e))return;e.scrollIntoView({block:"center",behavior:"instant"})}}async function pe(e){let n=CSS.escape(e);if(o.viewMode==="table"){let t=M.querySelector("finding-table");if(t){try{await t.updateComplete}catch{}for(let i of t.shadowRoot?.querySelectorAll("finding-row")??[])if(i.group&&q(i.group)===e)return i}}if(o.viewMode==="kanban"){let t=M.querySelector(`.kanban-card[data-gid="${n}"]`);if(t)return t}return M.querySelector(`finding-card[data-gid="${n}"]`)??M.querySelector(`[data-gid="${n}"]`)}async function Y(e,n,t=()=>!0){let i=B(e.group,n),c=H(i);if(c&&N(c)&&queueMicrotask($),D(),await P({revealSelection:!0}),!t())return{ok:!1};let r=await pe(i);return t()?r?(typeof r.ensureRendered=="function"&&await r.ensureRendered(),await fe(r),t()?(ce(r),{ok:!0}):{ok:!1}):{ok:!0}:{ok:!1}}async function $e(e,{openManagedReport:n=v,isCurrent:t=()=>!0}={}){if(!e?.id)return{ok:!1,reason:"This link is missing a finding id."};let i=await K(e,{openReport:R,openWorkspace:U,openManagedReport:n,isCurrent:t});return t()?i?await Y(i,e.id,t):{ok:!1,reason:f()?"Couldn't find that finding in the team reports you can access.":ie}:{ok:!1}}async function qe(e,n,t=null){if(!e||!n)return{ok:!1,reason:"Missing finding id or report name."};let i=await J(e,n,t,{openReport:R,openManagedReport:v});return i?await Y(i,e):{ok:!1,reason:t?`Could not open that finding in "${n}". Open the team and try again.`:`Couldn't find that finding in "${n}". It may have been re-imported since this links file was written.`}}export{Se as a,be as b,$e as c,qe as d};