@preventive/triage 1.0.0-alpha.42 → 1.0.0-alpha.44

package/common/bundle-compare-diff.js

@@ -353,170 +353,5 @@ export function computeBundleDiff(base, other, pkgOf, layout = treeLayout(base.k
   }
 }
 
-// The Overview's package rows: each package that differs, once, from its
-// sizes (computeBundleDiff's `packages`) and the versions each bundle
-// records for it (`bundlePackageVersions`). A package only one side has is
-// removed or added, with its size and versions there; one both have is
-// changed when its size or its versions moved, with both sides of each —
-// own source and workspace modules carry sizes alone.
-export function comparePackages(packages, baseVersions, otherVersions) {
-  const sizes = new Map()
-  for (const r of packages.onlyBase) sizes.set(r.pkg, { base: r.bytes, other: null })
-  for (const r of packages.onlyOther) sizes.set(r.pkg, { base: null, other: r.bytes })
-  for (const r of packages.changed) sizes.set(r.pkg, { base: r.baseBytes, other: r.otherBytes })
-  for (const r of packages.unchanged ?? []) sizes.set(r.pkg, { base: r.bytes, other: r.bytes })
-  const versionsOf = (map, pkg) => [...map.get(pkg) ?? []].toSorted(compareSemver)
-  const moved = new Set([...packages.onlyBase, ...packages.onlyOther, ...packages.changed].map(r => r.pkg))
-  for (const pkg of new Set([...baseVersions.keys(), ...otherVersions.keys()])) {
-    if (!sameVersions(versionsOf(baseVersions, pkg), versionsOf(otherVersions, pkg))) moved.add(pkg)
-  }
-  const added = [], changed = [], removed = []
-  for (const pkg of moved) {
-    const size = sizes.get(pkg) ?? { base: null, other: null }
-    const after = versionsOf(otherVersions, pkg), before = versionsOf(baseVersions, pkg)
-    const onBase = size.base !== null || before.length > 0
-    const onOther = size.other !== null || after.length > 0
-    if (onBase && !onOther) removed.push({ pkg, bytes: size.base, versions: before })
-    else if (onOther && !onBase) added.push({ pkg, bytes: size.other, versions: after })
-    else {
-      changed.push({
-        pkg, baseBytes: size.base, otherBytes: size.other,
-        delta: size.base !== null && size.other !== null ? size.other - size.base : null,
-        baseVersions: before, otherVersions: after,
-        direction: before.length > 0 && after.length > 0 && !sameVersions(before, after) ? versionDirection(before, after) : null,
-      })
-    }
-  }
-  const byPkg = (a, b) => a.pkg.localeCompare(b.pkg)
-  return { removed: removed.toSorted(byPkg), added: added.toSorted(byPkg), changed: changed.toSorted(byPkg) }
-}
-
-// Split a version into its dotted-numeric core and its prerelease tail,
-// dropping any `+build` metadata (semver ignores it for precedence).
-// `1.2.3-rc.1+sha` → { core: '1.2.3', pre: 'rc.1' }.
-function splitVersion(v) {
-  const s = String(v).trim()
-  const noBuild = s.split('+', 1)[0]
-  const dash = noBuild.indexOf('-')
-  return dash === -1
-    ? { core: noBuild, pre: '' }
-    : { core: noBuild.slice(0, dash), pre: noBuild.slice(dash + 1) }
-}
-
-// Lightweight semver-ish comparison, enough to sort versions ascending
-// and label an update ↑/↓. Compares the dotted-numeric core part by
-// part (a missing part counts as 0); on an equal core a release ranks
-// above a prerelease (`1.0.0` > `1.0.0-rc.1`) and two prereleases
-// compare by their dot identifiers (numeric where both are numeric,
-// else lexical) per the semver precedence rules. NOT a full
-// implementation — a non-numeric core segment falls back to a string
-// compare of the whole version so ordering stays total and stable.
-export function compareSemver(a, b) {
-  if (a === b) return 0
-  const A = splitVersion(a)
-  const B = splitVersion(b)
-  const ap = A.core.split('.')
-  const bp = B.core.split('.')
-  for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
-    const x = Number(ap[i] ?? 0)
-    const y = Number(bp[i] ?? 0)
-    if (Number.isNaN(x) || Number.isNaN(y)) return a < b ? -1 : 1
-    if (x !== y) return x < y ? -1 : 1
-  }
-  if (A.pre === B.pre) return 0
-  // A core with no prerelease is the higher (released) version.
-  if (!A.pre) return 1
-  if (!B.pre) return -1
-  const ai = A.pre.split('.')
-  const bi = B.pre.split('.')
-  for (let i = 0; i < Math.max(ai.length, bi.length); i++) {
-    const x = ai[i]
-    const y = bi[i]
-    if (x === undefined) return -1
-    if (y === undefined) return 1
-    if (x === y) continue
-    const xNum = /^\d+$/u.test(x)
-    const yNum = /^\d+$/u.test(y)
-    // Numeric identifiers always rank below non-numeric ones (semver),
-    // and compare numerically against each other.
-    if (xNum && yNum) return Number(x) < Number(y) ? -1 : 1
-    if (xNum !== yNum) return xNum ? -1 : 1
-    return x < y ? -1 : 1
-  }
-  return 0
-}
-
-// True when two ascending-sorted version arrays hold the same members.
-function sameVersions(a, b) {
-  if (a.length !== b.length) return false
-  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false
-  return true
-}
-
-// Direction of a version move, from the versions dropped and the versions
-// taken on: 'up' when everything dropped is older than everything taken
-// on (`1.0.0` → `2.0.0`), or, with only drops or only additions, than the
-// versions kept (`1.0.0, 2.0.0` → `2.0.0` drops the older copy, and a newer
-// copy added beside the old is up too); 'down' the other way round; and
-// 'changed' when the moves fall between (`1.0.0, 1.2.0, 2.0.0` → `1.0.0,
-// 2.0.0`).
-export function versionDirection(baseVersions, otherVersions) {
-  const dropped = baseVersions.filter(v => !otherVersions.includes(v)).toSorted(compareSemver)
-  const taken = otherVersions.filter(v => !baseVersions.includes(v)).toSorted(compareSemver)
-  const kept = baseVersions.filter(v => otherVersions.includes(v)).toSorted(compareSemver)
-  const [from, to] = dropped.length > 0 && taken.length > 0 ? [dropped, taken]
-    : dropped.length > 0 ? [dropped, kept] : [kept, taken]
-  if (from.length === 0 || to.length === 0) return 'changed'
-  // Every version of `a` older than every version of `b`.
-  const before = (a, b) => compareSemver(a.at(-1), b[0]) < 0
-  return before(from, to) ? 'up' : before(to, from) ? 'down' : 'changed'
-}
-
-// Diff two `Map<packageName, Set<version>>` inventories (as
-// `bundlePackageVersions` returns for each bundle) into the dependency
-// version changes between them. Mirrors the file/package diff framing:
-// `base` is the open bundle, `other` the one compared against.
-//
-//   {
-//     updated: [{ pkg, baseVersions: [...], otherVersions: [...],
-//                 direction: 'up' | 'down' | 'changed' }],
-//     added:   [{ pkg, versions: [...] }],   // dependency only in other
-//     removed: [{ pkg, versions: [...] }],   // dependency only in base
-//     totals:  { baseDeps, otherDeps },      // distinct package counts
-//   }
-//
-// `updated` is the headline — a package present on BOTH sides whose set
-// of versions changed (the "what did this bump pull in?" answer);
-// packages whose versions are byte-for-byte the same are dropped.
-// Version arrays are sorted ascending; the three lists are sorted by
-// package name so the dependency list reads alphabetically.
-export function computeVersionUpdates(baseVersions, otherVersions) {
-  const updated = []
-  const added = []
-  const removed = []
-  const names = new Set([...baseVersions.keys(), ...otherVersions.keys()])
-  for (const pkg of names) {
-    const bSet = baseVersions.get(pkg)
-    const oSet = otherVersions.get(pkg)
-    if (bSet && oSet) {
-      const b = [...bSet].toSorted(compareSemver)
-      const o = [...oSet].toSorted(compareSemver)
-      if (sameVersions(b, o)) continue
-      updated.push({ pkg, baseVersions: b, otherVersions: o, direction: versionDirection(b, o) })
-    } else if (bSet) {
-      removed.push({ pkg, versions: [...bSet].toSorted(compareSemver) })
-    } else {
-      added.push({ pkg, versions: [...oSet].toSorted(compareSemver) })
-    }
-  }
-  const byPkg = (a, b) => a.pkg.localeCompare(b.pkg)
-  updated.sort(byPkg)
-  added.sort(byPkg)
-  removed.sort(byPkg)
-  return {
-    updated,
-    added,
-    removed,
-    totals: { baseDeps: baseVersions.size, otherDeps: otherVersions.size },
-  }
-}
+// The versions' part (bundle-compare-versions.js), as one comparison reads it.
+export { comparePackages, compareSemver, computeVersionUpdates, versionDirection } from './bundle-compare-versions.js'

package/common/bundle-compare-versions.js

@@ -0,0 +1,172 @@
+// Dependency versions two bundles record, compared: sorting versions as
+// semver orders them, which way a package moved, and the Overview's package
+// rows from computeBundleDiff's sizes. No @preventive/compare here, so a view
+// that only orders versions loads none of the comparison's pairing.
+
+// The Overview's package rows: each package that differs, once, from its
+// sizes (computeBundleDiff's `packages`) and the versions each bundle
+// records for it (`bundlePackageVersions`). A package only one side has is
+// removed or added, with its size and versions there; one both have is
+// changed when its size or its versions moved, with both sides of each —
+// own source and workspace modules carry sizes alone.
+export function comparePackages(packages, baseVersions, otherVersions) {
+  const sizes = new Map()
+  for (const r of packages.onlyBase) sizes.set(r.pkg, { base: r.bytes, other: null })
+  for (const r of packages.onlyOther) sizes.set(r.pkg, { base: null, other: r.bytes })
+  for (const r of packages.changed) sizes.set(r.pkg, { base: r.baseBytes, other: r.otherBytes })
+  for (const r of packages.unchanged ?? []) sizes.set(r.pkg, { base: r.bytes, other: r.bytes })
+  const versionsOf = (map, pkg) => [...map.get(pkg) ?? []].toSorted(compareSemver)
+  const moved = new Set([...packages.onlyBase, ...packages.onlyOther, ...packages.changed].map(r => r.pkg))
+  for (const pkg of new Set([...baseVersions.keys(), ...otherVersions.keys()])) {
+    if (!sameVersions(versionsOf(baseVersions, pkg), versionsOf(otherVersions, pkg))) moved.add(pkg)
+  }
+  const added = [], changed = [], removed = []
+  for (const pkg of moved) {
+    const size = sizes.get(pkg) ?? { base: null, other: null }
+    const after = versionsOf(otherVersions, pkg), before = versionsOf(baseVersions, pkg)
+    const onBase = size.base !== null || before.length > 0
+    const onOther = size.other !== null || after.length > 0
+    if (onBase && !onOther) removed.push({ pkg, bytes: size.base, versions: before })
+    else if (onOther && !onBase) added.push({ pkg, bytes: size.other, versions: after })
+    else {
+      changed.push({
+        pkg, baseBytes: size.base, otherBytes: size.other,
+        delta: size.base !== null && size.other !== null ? size.other - size.base : null,
+        baseVersions: before, otherVersions: after,
+        direction: before.length > 0 && after.length > 0 && !sameVersions(before, after) ? versionDirection(before, after) : null,
+      })
+    }
+  }
+  const byPkg = (a, b) => a.pkg.localeCompare(b.pkg)
+  return { removed: removed.toSorted(byPkg), added: added.toSorted(byPkg), changed: changed.toSorted(byPkg) }
+}
+
+// Split a version into its dotted-numeric core and its prerelease tail,
+// dropping any `+build` metadata (semver ignores it for precedence).
+// `1.2.3-rc.1+sha` → { core: '1.2.3', pre: 'rc.1' }.
+function splitVersion(v) {
+  const s = String(v).trim()
+  const noBuild = s.split('+', 1)[0]
+  const dash = noBuild.indexOf('-')
+  return dash === -1
+    ? { core: noBuild, pre: '' }
+    : { core: noBuild.slice(0, dash), pre: noBuild.slice(dash + 1) }
+}
+
+// Lightweight semver-ish comparison, enough to sort versions ascending
+// and label an update ↑/↓. Compares the dotted-numeric core part by
+// part (a missing part counts as 0); on an equal core a release ranks
+// above a prerelease (`1.0.0` > `1.0.0-rc.1`) and two prereleases
+// compare by their dot identifiers (numeric where both are numeric,
+// else lexical) per the semver precedence rules. NOT a full
+// implementation — a non-numeric core segment falls back to a string
+// compare of the whole version so ordering stays total and stable.
+export function compareSemver(a, b) {
+  if (a === b) return 0
+  const A = splitVersion(a)
+  const B = splitVersion(b)
+  const ap = A.core.split('.')
+  const bp = B.core.split('.')
+  for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
+    const x = Number(ap[i] ?? 0)
+    const y = Number(bp[i] ?? 0)
+    if (Number.isNaN(x) || Number.isNaN(y)) return a < b ? -1 : 1
+    if (x !== y) return x < y ? -1 : 1
+  }
+  if (A.pre === B.pre) return 0
+  // A core with no prerelease is the higher (released) version.
+  if (!A.pre) return 1
+  if (!B.pre) return -1
+  const ai = A.pre.split('.')
+  const bi = B.pre.split('.')
+  for (let i = 0; i < Math.max(ai.length, bi.length); i++) {
+    const x = ai[i]
+    const y = bi[i]
+    if (x === undefined) return -1
+    if (y === undefined) return 1
+    if (x === y) continue
+    const xNum = /^\d+$/u.test(x)
+    const yNum = /^\d+$/u.test(y)
+    // Numeric identifiers always rank below non-numeric ones (semver),
+    // and compare numerically against each other.
+    if (xNum && yNum) return Number(x) < Number(y) ? -1 : 1
+    if (xNum !== yNum) return xNum ? -1 : 1
+    return x < y ? -1 : 1
+  }
+  return 0
+}
+
+// True when two ascending-sorted version arrays hold the same members.
+function sameVersions(a, b) {
+  if (a.length !== b.length) return false
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false
+  return true
+}
+
+// Direction of a version move, from the versions dropped and the versions
+// taken on: 'up' when everything dropped is older than everything taken
+// on (`1.0.0` → `2.0.0`), or, with only drops or only additions, than the
+// versions kept (`1.0.0, 2.0.0` → `2.0.0` drops the older copy, and a newer
+// copy added beside the old is up too); 'down' the other way round; and
+// 'changed' when the moves fall between (`1.0.0, 1.2.0, 2.0.0` → `1.0.0,
+// 2.0.0`).
+export function versionDirection(baseVersions, otherVersions) {
+  const dropped = baseVersions.filter(v => !otherVersions.includes(v)).toSorted(compareSemver)
+  const taken = otherVersions.filter(v => !baseVersions.includes(v)).toSorted(compareSemver)
+  const kept = baseVersions.filter(v => otherVersions.includes(v)).toSorted(compareSemver)
+  const [from, to] = dropped.length > 0 && taken.length > 0 ? [dropped, taken]
+    : dropped.length > 0 ? [dropped, kept] : [kept, taken]
+  if (from.length === 0 || to.length === 0) return 'changed'
+  // Every version of `a` older than every version of `b`.
+  const before = (a, b) => compareSemver(a.at(-1), b[0]) < 0
+  return before(from, to) ? 'up' : before(to, from) ? 'down' : 'changed'
+}
+
+// Diff two `Map<packageName, Set<version>>` inventories (as
+// `bundlePackageVersions` returns for each bundle) into the dependency
+// version changes between them. Mirrors the file/package diff framing:
+// `base` is the open bundle, `other` the one compared against.
+//
+//   {
+//     updated: [{ pkg, baseVersions: [...], otherVersions: [...],
+//                 direction: 'up' | 'down' | 'changed' }],
+//     added:   [{ pkg, versions: [...] }],   // dependency only in other
+//     removed: [{ pkg, versions: [...] }],   // dependency only in base
+//     totals:  { baseDeps, otherDeps },      // distinct package counts
+//   }
+//
+// `updated` is the headline — a package present on BOTH sides whose set
+// of versions changed (the "what did this bump pull in?" answer);
+// packages whose versions are byte-for-byte the same are dropped.
+// Version arrays are sorted ascending; the three lists are sorted by
+// package name so the dependency list reads alphabetically.
+export function computeVersionUpdates(baseVersions, otherVersions) {
+  const updated = []
+  const added = []
+  const removed = []
+  const names = new Set([...baseVersions.keys(), ...otherVersions.keys()])
+  for (const pkg of names) {
+    const bSet = baseVersions.get(pkg)
+    const oSet = otherVersions.get(pkg)
+    if (bSet && oSet) {
+      const b = [...bSet].toSorted(compareSemver)
+      const o = [...oSet].toSorted(compareSemver)
+      if (sameVersions(b, o)) continue
+      updated.push({ pkg, baseVersions: b, otherVersions: o, direction: versionDirection(b, o) })
+    } else if (bSet) {
+      removed.push({ pkg, versions: [...bSet].toSorted(compareSemver) })
+    } else {
+      added.push({ pkg, versions: [...oSet].toSorted(compareSemver) })
+    }
+  }
+  const byPkg = (a, b) => a.pkg.localeCompare(b.pkg)
+  updated.sort(byPkg)
+  added.sort(byPkg)
+  removed.sort(byPkg)
+  return {
+    updated,
+    added,
+    removed,
+    totals: { baseDeps: baseVersions.size, otherDeps: otherVersions.size },
+  }
+}

package/common/bundle-comparison.d.ts

@@ -0,0 +1,8 @@
+import type { Root } from '@preventive/compare'
+import type { BundleDetails } from './bundle-metadata.js'
+// A comparison as Compare and Review read it; `files.basePaths` maps every
+// base file to how it reads as the other side lays its files out.
+export interface Comparison extends Record<string, unknown> {
+  files: Record<string, unknown> & { root: Root | null; basePaths: Map<string, string> }
+}
+export function prepareComparison(base: BundleDetails, other: BundleDetails, scope?: string | null): Comparison

package/common/bundle-comparison.js

@@ -0,0 +1,62 @@
+// One comparison model for Compare and Review: bytes, metadata, resolutions,
+// dependency versions and line counts, its files paired by
+// @preventive/compare (computeBundleDiff, treeLayout). Worked out by the
+// server for two managed bundles or two versions of a package
+// (server-managed/comparison.ts), and by the viewer only for bundles it opened
+// itself, which no server holds (ui/view/bundle-comparison.js): a managed
+// viewer loads none of it.
+import { layoutPackageDirs, treeLayout } from '@preventive/compare'
+import { bundlePkgOf } from './bundle-pkg-of.js'
+import { bundlePackageDirs, bundlePackageVersions } from './bundle-sources.js'
+import { bundleFileMeta, computeBundleDiff, computeResolutionDiff } from './bundle-compare-diff.js'
+import { comparePackages, computeVersionUpdates } from './bundle-compare-versions.js'
+import { bundleCompareFiles, bundleCompareResolutions } from './bundle-compare-inputs.js'
+import { bundleLineCounts } from './bundle-metadata.js'
+
+export function prepareComparison(base, other, scope = null) {
+  // Every file each side mounts, resources included: a diff of
+  // source alone would call two bundles identical when only their
+  // images differ, and total less than the Overview does.
+  // From the bundle picked to the open one.
+  const [from, to] = [base, other]
+  const baseSources = bundleCompareFiles(from, scope)
+  const otherSources = bundleCompareFiles(to, scope)
+  // Classify original paths and preserve recorded Stasis package
+  // boundaries from either side, as the open one lays its files out
+  // where their roots differ. Own source has one identity.
+  const layout = treeLayout(baseSources.keys(), otherSources.keys())
+  const packageDirs = layoutPackageDirs(bundlePackageDirs(from), bundlePackageDirs(to), layout)
+  const pkgOf = (p) => bundlePkgOf(p, { packageDir: packageDirs?.get(p) })
+  const diff = computeBundleDiff(baseSources, otherSources, pkgOf, layout, [bundleFileMeta(from), bundleFileMeta(to)])
+  // Each side's lines of code (bundleLineCounts), on its rows and in
+  // the totals; a file that isn't text has none.
+  const baseLines = bundleLineCounts(from), otherLines = bundleLineCounts(to)
+  const linesOf = (lines, paths) => { let total = 0; for (const path of paths) total += lines.get(path) ?? 0; return total }
+  Object.assign(diff.totals, { baseLines: linesOf(baseLines, baseSources.keys()), otherLines: linesOf(otherLines, otherSources.keys()) })
+  for (const row of diff.files.onlyBase) row.lines = baseLines.get(row.basePath ?? row.path) ?? 0
+  for (const row of diff.files.onlyOther) row.lines = otherLines.get(row.path) ?? 0
+  for (const row of diff.files.changed) Object.assign(row, { baseLines: baseLines.get(row.basePath ?? row.path) ?? 0, otherLines: otherLines.get(row.path) ?? 0 })
+  diff.resolutions = computeResolutionDiff(
+    bundleCompareResolutions(from, scope),
+    bundleCompareResolutions(to, scope),
+    new Map(diff.files.changed.filter(row => row.renamedFrom != null).map(row => [row.basePath, row.path])),
+    diff.files.basePaths,
+    diff.files.root,
+  )
+  // Dependency versions come from the stasis per-module `{ name,
+  // version }` metadata, not the path/byte walk above, so they're
+  // computed alongside and hung off the same memo: the package rows
+  // join them to the sizes, the summary counts them. Empty for
+  // sourcemap / v0 pairs (no version metadata), whose rows carry sizes
+  // alone.
+  // Keyed by install directory, as the sizes are (`bundlePkgOf`).
+  const versionKey = dir => bundlePkgOf('', { packageDir: dir })
+  const baseVersions = bundlePackageVersions(from, scope ? baseSources.keys() : null, versionKey)
+  const otherVersions = bundlePackageVersions(to, scope ? otherSources.keys() : null, versionKey)
+  diff.versionUpdates = computeVersionUpdates(baseVersions, otherVersions)
+  diff.packageRows = comparePackages(diff.packages, baseVersions, otherVersions)
+  // The reason scope its files are within, for what the server works out of
+  // them alike (rename-diff.js, type-only.js).
+  diff.scope = scope ?? ''
+  return diff
+}

package/common/managed/report-filter.ts

@@ -3,6 +3,7 @@
 // access is per finding: App, own source, and the own-source organizations stay.
 import { inheritReportMeta, isAppFinding, reportRepoGithub, stampSecurityGroups } from '@preventive/report'
 import { readManagedReport } from './report-content.ts'
+import { revalidationLinks, securityLinks } from '../security-links.js'
 
 export interface ViewerPermissions {
   dependencies: boolean
@@ -80,7 +81,7 @@ export function filterReportData(data: unknown, perms: ViewerPermissions, repo?:
     entry, members: (Array.isArray(entry) ? entry : [entry]).map(original => ({ original, finding: projectFinding(original, report) })),
   }))
   const groups = entries.map(({ members }) => members.flatMap(({ finding }) => finding ? [finding] : []))
-  if (!perms.security) stampSecurityGroups(groups)
+  if (!perms.security) stampSecurityGroups(groups, { linkedIds: securityLinks(revalidationLinks(groups.flat())).linkedIds })
   const githubOrgs = new Set<string>(), npmScopes = new Set<string>()
   const addOrgs = (finding: Finding) => {
     const github = githubOrg(finding), npm = npmScope(finding)

package/common/managed/routes.js

@@ -82,11 +82,11 @@ export function managedRoutePath(route) {
 }
 
 // The npm viewer: its lookup page, or a package version's Overview, Code,
-// Compare or Treemap tab, `/npm/<name>[@<version or dist-tag>][/<tab>…]`. Code names
+// Search, Compare or Treemap tab, `/npm/<name>[@<version or dist-tag>][/<tab>…]`. Code names
 // its file by number and its lines in the fragment, as a bundle's Code
 // does: `/code/<file>#L4`. Compare names the version compared with, then
 // its mode past the Overview: `/compare/<version>/code` or `/diff`.
-export const NPM_TABS = new Set(['overview', 'code', 'compare', 'review', 'treemap'])
+export const NPM_TABS = new Set(['overview', 'code', 'search', 'compare', 'review', 'treemap'])
 function npmPackagePath(route) {
   if (route.packageName == null) return '/npm'
   const tab = route.bundleTab ?? 'overview'
@@ -114,7 +114,7 @@ function parseNpmRoute(path, hash) {
     return { view: 'npm', packageName: review[1], packageSpec: review[2] ?? null, bundleTab: 'review',
       ...(review[3] ? { reviewPackage: versionOnly ? review[1] : review[3], reviewSpec: versionOnly ? review[3] : review[4] ?? null } : {}) }
   }
-  const match = /^\/npm(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?(?:\/(code|compare|treemap)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u.exec(path)
+  const match = /^\/npm(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?(?:\/(code|search|compare|treemap)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u.exec(path)
   if (!match) return undefined
   if (match[1] == null) return { view: 'npm' }
   if (!isNpmPackageName(match[1]) || (match[2] != null && !isNpmPackageSpec(match[2]))) return null

package/common/security-links.d.ts

@@ -0,0 +1,5 @@
+export function securityLinks(links?: Iterable<readonly string[]>): {
+  add(ids: readonly string[]): void
+  linkedIds(id: string): Iterable<string>
+}
+export function revalidationLinks(findings: Iterable<unknown>): string[][]

package/common/security-links.js

@@ -0,0 +1,33 @@
+// Links as stampSecurityGroups reads them, shared by the managed server's
+// permission filter and the view's security lens. A star per link is enough
+// for transitive propagation, without a quadratic expansion for large links.
+// `add` extends the lookup while a stamp is running: rows the finding index
+// returns can carry links of their own.
+export function securityLinks(links = []) {
+  const edges = new Map()
+  const connect = (a, b) => {
+    if (!edges.has(a)) edges.set(a, new Set())
+    edges.get(a).add(b)
+  }
+  const add = (ids) => {
+    for (const id of ids.slice(1)) { connect(ids[0], id); connect(id, ids[0]) }
+  }
+  for (const ids of links) add(ids)
+  return { add, linkedIds: (id) => edges.get(id) ?? [] }
+}
+
+// An App finding can name the source findings it revalidated only by ID, in
+// another row or report. The App view counts those as represented by it, so
+// they are one issue for security too: hiding one side alone would leave the
+// App answer to a hidden security finding, or a source row without its App row.
+// Only App findings: the view ignores inputs on any other finding
+// (finding-filters.js confirmedCoverage, revalidation-input-groups.js).
+export function revalidationLinks(findings) {
+  const links = []
+  for (const finding of findings) {
+    const inputs = finding?.revalidateInputs
+    if (finding?.isApp !== true || typeof finding.id !== 'string' || !Array.isArray(inputs)) continue
+    links.push([finding.id, ...inputs.filter((id) => typeof id === 'string' && id !== '')])
+  }
+  return links
+}

package/common/server-info.ts

@@ -20,6 +20,14 @@ export interface ManagedServerInfo {
   allowShare?: boolean
 }
 
+// GET /api/auth/session's answer. A managed server's GET /api/config also
+// carries it as `session`, null when signed out, so a client can skip asking.
+export interface ManagedSessionInfo {
+  user: { id: string; login: string; name: string | null; role: string }
+  csrfToken: string
+  viewer?: { id: string; login: string; name: string | null }
+}
+
 // The `server-info` frame payload (the `type` discriminant is added at the
 // send site). `managed` is null on e2e-only deployments.
 export interface ServerInfo {

package/common/workspace-app.js

@@ -9,13 +9,26 @@ function appTabs(group) {
   return app.length > 0 ? app : group
 }
 
+// Findings imported from another analyzer are App findings by construction,
+// and Confirmed counts one its report holds no pass for as shown. A set of
+// nothing but those is already its own App view, with no pass to fold anything
+// under. The Confirmed lock asks for a pass as well (it has no outcome control
+// to offer without one), so this is asked on its own: a team whose permissions
+// leave only other analyzers' findings opens as App, as it does unrestricted.
+// Such a view opens with no outcome filter, but keeps the confidence range of
+// imports that score themselves (DeepSec's do).
+function onlyUnjudgedImports(groups) {
+  const visible = groups.map(appTabs).filter((g) => g.length > 0)
+  return visible.length > 0 && visible.every((g) => g.every((f) => f.isApp && f._source && !f._sourcePass && revalidateKindOf(f) === ''))
+}
+
 // Evaluate the entire workspace, independent of triage, filters, or the lens
 // left active by another report. Use the same merge and link rules as the view.
 export function workspaceAppMetadata(reports, duplicatesOf = () => []) {
   const { groups, conflicts } = mergeReportGroups(reports, { hideRuledOut: true })
   if (conflicts.size > 0) return { appMode: false }
   const linked = mergeLinkedWorkspaceGroups(groups, duplicatesOf, appTabs)
-  if (!canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' })) return { appMode: false }
+  if (!onlyUnjudgedImports(linked) && !canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' })) return { appMode: false }
   return {
     appMode: true,
     appFindings: linked.filter((group) => appTabs(group).some((f) => f.isApp)).length,