@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/npm-packages.ts

@@ -14,6 +14,7 @@ import { Buffer } from 'node:buffer'
 import { createHash } from 'node:crypto'
 import { rm } from 'node:fs/promises'
 import { resolve } from 'node:path'
+import { ArchiveError, type Entry, unpack } from '@preventive/archive/tar.js'
 import { isExactVersion } from '@preventive/upstream/semver.js'
 import { isNpmPackageName, isNpmPackageSpec, npmPackageScope } from '../common/managed/npm-packages.js'
 import type { Role } from '../common/managed/roles.ts'
@@ -33,6 +34,9 @@ const MAX_DOCUMENT_BYTES = 4 * PACKUMENT_BYTES
 // stream holding them is bounded in npm-loads.ts.
 export const MAX_NPM_PACKAGE_BYTES = 64 * 1024 * 1024
 export const MAX_NPM_PACKAGE_FILES = 20_000
+// The entries its tar stream may hold, read before any is counted as a file:
+// a directory's too, as a GitHub tree's tarball has one for each, npm's none.
+export const MAX_NPM_TAR_ENTRIES = 2 * MAX_NPM_PACKAGE_FILES
 // What the files may take as the viewer's JSON. Escaping grows a text up to
 // six times (a control character becomes `\u0001`), so it is counted before
 // anything is serialized.
@@ -277,73 +281,29 @@ export const npmPublishTime = (name: string, version: string): string | null =>
 
 export interface NpmPackageFile { path: string; bytes: Uint8Array }
 
-const textOf = (bytes: Uint8Array, start: number, length: number) => {
-  const field = bytes.subarray(start, start + length)
-  const end = field.indexOf(0)
-  return Buffer.from(end === -1 ? field : field.subarray(0, end)).toString('utf8')
-}
-
-function sizeOf(bytes: Uint8Array, offset: number): number {
-  // GNU base-256 for sizes past the 11 octal digits.
-  if (bytes[offset]! & 0x80) {
-    let size = bytes[offset]! & 0x7f
-    for (let i = 1; i < 12; i++) size = size * 256 + bytes[offset + i]!
-    return size
+// The regular files of a tar stream, by package path: npm drops the first
+// component (`package/`, or whatever the archive used), and a file at the top
+// is not extracted. The stream is read by @preventive/archive, which refuses
+// one malformed, a name or a symlink that would climb out of it -- a symlink
+// past `symlinksAbove` levels above it, none unless given -- and a name
+// repeated as another entry, and gives up past MAX_NPM_TAR_ENTRIES before
+// reading on; a file under another top directory at the same path replaces
+// an earlier one, as extraction would. Directories, links and devices hold no
+// file content and are skipped.
+export function readNpmTar(tar: Uint8Array, { symlinksAbove = 0 }: { symlinksAbove?: number } = {}): NpmPackageFile[] {
+  let entries: Entry[]
+  try { entries = unpack(tar, { maxEntries: MAX_NPM_TAR_ENTRIES, symlinksAbove }) }
+  catch (err) {
+    if (err instanceof ArchiveError) throw err.limited ? new NpmPackageError(413, 'package-too-large') : new NpmPackageError(422, 'bad-tarball')
+    throw err
   }
-  const text = textOf(bytes, offset, 12).trim()
-  return /^[0-7]+$/u.test(text) ? Number.parseInt(text, 8) : Number.NaN
-}
-
-// The path a package's file is installed at: npm drops the first component
-// (`package/`, or whatever the archive used), and a path that would escape the
-// package, or names nothing, is not extracted.
-function packagePath(raw: string): string | null {
-  const parts = raw.split('/').slice(1).filter(part => part !== '' && part !== '.')
-  return parts.length === 0 || parts.includes('..') ? null : parts.join('/')
-}
-
-// A pax header's path. Each record is `<length> <key>=<value>\n`, its length
-// in bytes, so records are walked as bytes and only their values decoded.
-function paxPath(data: Uint8Array): string | null {
-  let path = null
-  let at = 0
-  while (at < data.length) {
-    const space = data.indexOf(0x20, at)
-    const length = Number.parseInt(Buffer.from(data.subarray(at, space)).toString('latin1'), 10)
-    if (space === -1 || !Number.isSafeInteger(length) || length <= 0) break
-    const record = Buffer.from(data.subarray(space + 1, at + length - 1)).toString('utf8')
-    if (record.startsWith('path=')) path = record.slice(5)
-    at += length
-  }
-  return path
-}
-
-// The regular files of a tar stream, by package path, a later entry
-// replacing an earlier one as extraction would. Directories, links and
-// devices hold no file content and are skipped.
-export function readNpmTar(tar: Uint8Array): NpmPackageFile[] {
   const files = new Map<string, Uint8Array>()
   let total = 0
-  let longName: string | null = null
-  let offset = 0
-  while (offset + 512 <= tar.length) {
-    const header = tar.subarray(offset, offset + 512)
-    if (header.every(byte => byte === 0)) break
-    const size = sizeOf(header, 124)
-    const type = String.fromCodePoint(header[156]!)
-    const start = offset + 512
-    if (!Number.isSafeInteger(size) || size < 0 || start + size > tar.length) throw new NpmPackageError(422, 'bad-tarball')
-    const data = tar.subarray(start, start + size)
-    offset = start + Math.ceil(size / 512) * 512
-    if (type === 'x' || type === 'L') { longName = type === 'x' ? paxPath(data) : textOf(data, 0, data.length); continue }
-    if (type === 'g' || type === 'K') continue
-    const prefix = textOf(header, 257, 6) === 'ustar' ? textOf(header, 345, 155) : ''
-    const name = longName ?? (prefix ? `${prefix}/${textOf(header, 0, 100)}` : textOf(header, 0, 100))
-    longName = null
-    if (!['0', '\0', '7'].includes(type)) continue
-    const path = packagePath(name)
-    if (path === null) continue
-    total += size - (files.get(path)?.length ?? 0)
+  for (const { name, type, data } of entries) {
+    const slash = name.indexOf('/')
+    if ((type !== 'file' && type !== 'contiguous-file') || slash === -1) continue
+    const path = name.slice(slash + 1)
+    total += data.length - (files.get(path)?.length ?? 0)
     files.set(path, data)
     if (files.size > MAX_NPM_PACKAGE_FILES || total > MAX_NPM_PACKAGE_BYTES) throw new NpmPackageError(413, 'package-too-large')
   }

package/server-managed/pretty-print.ts

@@ -250,18 +250,21 @@ export function stalePrettyRemover(npm: CacheStorage): (signal?: AbortSignal) =>
   }
 }
 
+// A bundle's details, from its bytes in `store`: bundles are read one at a
+// time, as reading one decodes all of it.
+function detailsReader(store: BundleStore) {
+  const enqueue = serial()
+  return (record: ManagedBundle) => enqueue(async () => {
+    const details = await readBundleDetails(record, store)
+    if (!details) throw new PrettyError(422, 'bundle-unavailable')
+    return details
+  })
+}
+
 export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage, db: Pick<ManagedDb, 'getBundle'>, store: BundleStore) {
   // Copies being made; readers asking for one meanwhile share it.
   const shared = sharing<Buffer>()
-  // Bundles are read one at a time: reading one decodes all of it.
-  const enqueue = serial()
-  function bundleDetails(record: ManagedBundle) {
-    return enqueue(async () => {
-      const details = await readBundleDetails(record, store)
-      if (!details) throw new PrettyError(422, 'bundle-unavailable')
-      return details
-    })
-  }
+  const bundleDetails = detailsReader(store)
   // A bundle's file pretty-printed from the text `read` reads, and kept in
   // its cache.
   function bundleCopy(record: ManagedBundle, request: PrettyRequest, read: () => Promise<string>): Promise<Buffer> {
@@ -341,6 +344,8 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
         made: async (request, text) => opened(await bundleCopy(record, request, () => Promise.resolve(text))) })
       return [await sideOf(base, 'base'), await sideOf(other, 'other')]
     },
+    // A bundle's details, read in its turn, as Compare pairs them (comparison.ts).
+    bundleDetails,
     async npmSides(base: NpmVersionDocument, other: NpmVersionDocument): Promise<[ComparedSide, ComparedSide]> {
       const sideOf = async (doc: NpmVersionDocument, side: Side): Promise<ComparedSide> => ({ side, ...await sideFiles(await npmFiles(doc)), packageDirs: null,
         kept: request => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request)))),

package/server-managed/public-workspace.ts

@@ -17,7 +17,8 @@ import { serveTeamFeed } from './team-feed.ts'
 import { type ComparedSide, PrettyError, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
 import { typeOnlyFiles } from './type-only.ts'
-import { sharedTeamApp } from './team-app.ts'
+import { comparisonBody } from './comparison.ts'
+import { sharedTeamApp, withWorkspaceSummary } from './team-app.ts'
 
 function json(res: ServerResponse, status: number, body: unknown): void {
   sendJson(res, status, body, { 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
@@ -35,7 +36,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
   const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed|annotations)$/u.exec(url.pathname)
   const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
-  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only)$/u.exec(url.pathname)
+  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only|comparison)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
   const tokenHash = hashToken(token)
   const snapshot = await deps.db.getWorkspaceShare(tokenHash)
@@ -46,8 +47,8 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   }
   const send = async (body: unknown) => { await recheck(); json(res, 200, body) }
   const sendTeam = async () => {
-    const [summaries, app] = await Promise.all([bundleSummaries(snapshot.team.bundles, deps.bundleCache), sharedTeamApp(deps.db, deps.reportStore, snapshot)])
-    await send({ user: snapshot.user, team: { ...snapshot.team, app,
+    const [summaries, workspace] = await Promise.all([bundleSummaries(snapshot.team.bundles, deps.bundleCache), sharedTeamApp(deps.db, deps.reportStore, snapshot)])
+    await send({ user: snapshot.user, team: { ...withWorkspaceSummary(snapshot.team, workspace),
       bundles: snapshot.team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })),
     } })
     await backfillBundleSummaries(snapshot.team.bundles, deps.bundleCache)
@@ -101,7 +102,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const bundle = snapshot.bundles.find(item => item.id === bundleRoute![1])
   if (!bundle) { json(res, 404, { error: 'no-bundle' }); return }
   if (bundleRoute![2] === 'advisories' && !snapshot.permissions.security) { json(res, 403, { error: 'security-access-required' }); return }
-  if (bundleRoute![2] === 'rename-diff' || bundleRoute![2] === 'type-only' || (bundleRoute![2] === 'pretty' && url.searchParams.has('other'))) {
+  if (bundleRoute![2] === 'rename-diff' || bundleRoute![2] === 'type-only' || bundleRoute![2] === 'comparison' || (bundleRoute![2] === 'pretty' && url.searchParams.has('other'))) {
     if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
     await serveCompared(res, deps, bundle, snapshot.bundles.find(item => item.id === url.searchParams.get('other')), bundleRoute![2], url, recheck, stream); return
   }
@@ -109,11 +110,12 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
 }
 
 // What a bundle is compared with `other`, another of the link's bundles, by:
-// one of their JavaScript files diffed with renamed names hidden, or the
-// files that changed between them, or the pairs of those, or those that
-// changed in types alone, a line each.
+// their files paired, as one comparison; one of their JavaScript files diffed
+// with renamed names hidden; or the files that changed between them, or the
+// pairs of those, or those that changed in types alone, a line each.
 function serveCompared(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, part: string, url: URL,
   recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (part === 'comparison') return serveComparison(res, deps, bundle, other, url, stream)
   if (part === 'rename-diff' && url.searchParams.has('path')) return serveRenameDiff(res, deps, bundle, other, url, stream)
   return serveChanges(res, deps, bundle, other, recheck, part === 'pretty' ? compared : part === 'type-only' ? typeOnlyFiles : renamedPairs,
     part === 'pretty' ? '' : url.searchParams.get('scope') ?? '')
@@ -139,6 +141,22 @@ async function serveRenameDiff(res: ServerResponse, deps: ManagedHttpDeps, bundl
   await stream(diff, 'br')
 }
 
+// A bundle's files paired with `other`'s, another of the link's bundles, as
+// Compare pairs them (comparison.ts), within a reason `scope` where given.
+async function serveComparison(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, url: URL,
+  stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  const { prettyCache } = deps
+  if (!prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let body
+  try { body = await comparisonBody(await prettyCache.bundleDetails(bundle), await prettyCache.bundleDetails(other), url.searchParams.get('scope') ?? '') }
+  catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await stream(body, 'br')
+}
+
 // The files that changed between a bundle and `other`, another of the link's
 // bundles, both sides' pretty-printed (pretty-print.ts compared), or the pairs
 // of them its viewer diffs with renamed names hidden (rename-diff.ts

package/server-managed/pull-comment-reviews.ts

@@ -0,0 +1,161 @@
+// The reviews of dependencies an open pull request's comments make, as the
+// host's parser reads them (reviewed-dependencies.ts `parseComments`): its
+// comments, its reviews' own, whatever their state, and those on lines of
+// its diff, read of GitHub's GraphQL API, as many as MAX_COMMENTS, with
+// whether it is open, kept in this instance KEPT_MS; none of one not open;
+// the parser's answer to the same kept PARSED_KEPT_MS.
+// A review counts only where its user is one of their authors and the app's
+// user that account is (by its numeric id, else its login, its linked
+// accounts' too) publishes reviews to a team counting for the repository
+// (`reviewers`): by that user, as their reviews here are, each once among
+// them (pull-dependency-reviews.ts), as of its time, else their latest
+// comment's. They count for the pull request alone, never stored.
+import { createHash } from 'node:crypto'
+import { ACTOR, type GraphAccount, actorOf } from './github-accounts.ts'
+import { type Lru, lru } from './lru.ts'
+import type { CommentReviews } from './pull-dependency-reviews.ts'
+import type { PublishedReview } from './repository-dependency-reviews.ts'
+import { githubGraphql } from './repository-history.ts'
+import type { CommentReview, ParseCommentsInput, ReviewComment, ReviewVerdict, ReviewedDependencies } from './reviewed-dependencies.ts'
+
+const MAX_COMMENTS = 1000
+const KEPT_MS = 60_000
+const PARSED_KEPT_MS = 10 * 60_000
+const VERDICTS = new Set<string>(['accept', 'accept-with-nits', 'request-changes', 'reject'])
+
+// A comment as read: when it was written, and last edited, where it was.
+const COMMENT = `id author { ${ACTOR} } body createdAt lastEditedAt url`
+// Its comments and its reviews, each a page on from its cursor, each only
+// while it has more (`readComments`, `readReviews`).
+const QUERY = `query($owner: String!, $name: String!, $number: Int!, $comments: String, $reviews: String, $readComments: Boolean!, $readReviews: Boolean!) {
+  repository(owner: $owner, name: $name) { pullRequest(number: $number) { state
+    comments(first: 100, after: $comments) @include(if: $readComments) { pageInfo { hasNextPage endCursor } nodes { ${COMMENT} } }
+    reviews(first: 50, after: $reviews) @include(if: $readReviews) { pageInfo { hasNextPage endCursor }
+      nodes { ${COMMENT} state comments(first: 100) { pageInfo { hasNextPage endCursor } nodes { ${COMMENT} } } } }
+  } } }`
+// A review's comments on lines of its diff, a page on from its cursor.
+const REVIEW_COMMENTS = `query($id: ID!, $after: String) { node(id: $id) { ... on PullRequestReview {
+  comments(first: 100, after: $after) { pageInfo { hasNextPage endCursor } nodes { ${COMMENT} } } } } }`
+
+// A comment as read, and its author's account.
+interface Authored { comment: ReviewComment; account: { login: string | null; id: number | null } }
+type Page = { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: unknown }
+type Node = { id?: unknown; author?: GraphAccount; body?: unknown; state?: unknown; createdAt?: unknown; lastEditedAt?: unknown; url?: unknown; comments?: Page }
+
+// A pull request's comments as read, and whether it is open.
+interface PullComments { open: boolean; read: Authored[] }
+const comments: Lru<{ at: number } & PullComments> = lru(200)
+const answers: Lru<{ at: number; reviews: CommentReview[] }> = lru(2000)
+
+function authored(node: Node, kind: ReviewComment['kind']): Authored[] {
+  if (typeof node?.id !== 'string' || typeof node.body !== 'string' || typeof node.createdAt !== 'string') return []
+  const account = actorOf(node.author)
+  return [{ account, comment: { kind, id: node.id, author: account.login, body: node.body, ...typeof node.state === 'string' ? { state: node.state } : {},
+    createdAt: node.createdAt, ...typeof node.lastEditedAt === 'string' ? { editedAt: node.lastEditedAt } : {}, url: typeof node.url === 'string' ? node.url : '' } }]
+}
+const nodes = (list: unknown): Node[] => Array.isArray(list) ? list as Node[] : []
+// The cursor a page ends at, where more follow it.
+const next = (page: Page | undefined) => page?.pageInfo?.hasNextPage === true && typeof page.pageInfo.endCursor === 'string' ? page.pageInfo.endCursor : null
+
+// Review `review`'s comments on lines of its diff: the page read with it,
+// then those after it read of GitHub, till as many as `room` are.
+async function inlineComments(review: Node, room: number, token: string, fetchImpl: typeof fetch): Promise<Authored[]> {
+  const read = nodes(review.comments?.nodes).flatMap(inline => authored(inline, 'review-comment'))
+  for (let after = typeof review.id === 'string' ? next(review.comments) : null; after !== null && read.length < room;) {
+    const data = await githubGraphql(REVIEW_COMMENTS, { id: review.id, after }, token, fetchImpl) as { node?: { comments?: Page } | null } | null
+    read.push(...nodes(data?.node?.comments?.nodes).flatMap(inline => authored(inline, 'review-comment')))
+    after = next(data?.node?.comments)
+  }
+  return read
+}
+
+// Pull request `number`'s comments, its reviews' and those on its diff, each
+// review's all of them, and whether it is open, as kept, else read of GitHub
+// a page at a time.
+export async function pullComments(fullName: string, token: string, number: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<PullComments> {
+  const key = `${fullName}\0${number}`
+  const known = comments.get(key)
+  if (known && Date.now() - known.at < KEPT_MS) return known
+  const [owner, name] = fullName.split('/') as [string, string]
+  const read: Authored[] = []
+  let open: boolean | null = null
+  // Each connection read on from its cursor till it has no more, the other
+  // read on without it, never again from its first page.
+  let cursors: { comments: string | null; reviews: string | null } = { comments: null, reviews: null }
+  let reading = { comments: true, reviews: true }
+  while ((reading.comments || reading.reviews) && read.length < MAX_COMMENTS) {
+    const data = await githubGraphql(QUERY, { owner, name, number, ...cursors, readComments: reading.comments, readReviews: reading.reviews }, token, fetchImpl) as
+      { repository?: { pullRequest?: { state?: unknown; comments?: Page; reviews?: Page } | null } | null } | null
+    const pull = data?.repository?.pullRequest
+    if (!pull) break
+    open ??= pull.state === 'OPEN'
+    for (const node of nodes(pull.comments?.nodes)) read.push(...authored(node, 'comment'))
+    for (const node of nodes(pull.reviews?.nodes)) {
+      read.push(...authored(node, 'review'))
+      read.push(...await inlineComments(node, MAX_COMMENTS - read.length, token, fetchImpl))
+    }
+    cursors = { comments: reading.comments ? next(pull.comments) : null, reviews: reading.reviews ? next(pull.reviews) : null }
+    reading = { comments: cursors.comments !== null, reviews: cursors.reviews !== null }
+  }
+  const kept = { open: open === true, read: read.slice(0, MAX_COMMENTS) }
+  comments.set(key, { at: Date.now(), ...kept })
+  return kept
+}
+
+// The parser's reviews of `input`, as kept for the same, else asked.
+async function parsed(parse: NonNullable<ReviewedDependencies['parseComments']>, input: ParseCommentsInput): Promise<CommentReview[]> {
+  const key = createHash('sha256').update(JSON.stringify(input)).digest('base64url')
+  const known = answers.get(key)
+  if (known && Date.now() - known.at < PARSED_KEPT_MS) return known.reviews
+  const reviews = await parse(structuredClone(input))
+  if (!Array.isArray(reviews)) throw new TypeError('parseComments answered with no list')
+  answers.set(key, { at: Date.now(), reviews })
+  return reviews
+}
+
+const when = (time: unknown) => typeof time === 'number' ? time : typeof time === 'string' ? Date.parse(time) : Number.NaN
+// The reviews `answer` makes that count, by the users `reviewers` names,
+// each dependency's of each hash its integrity names, as of the time it
+// tells, else its user's latest comment's, as last written or edited.
+function counted(answer: CommentReview[], read: Authored[], reviewers: Map<string, string>): PublishedReview[] {
+  const latest = new Map<string, number>()
+  for (const { comment } of read) {
+    const login = comment.author?.toLowerCase()
+    if (login) latest.set(login, Math.max(latest.get(login) ?? 0, when(comment.createdAt) || 0, when(comment.editedAt) || 0))
+  }
+  return answer.flatMap(review => {
+    const login = typeof review?.user === 'string' ? review.user.toLowerCase() : ''
+    const reviewer = reviewers.get(login)
+    if (!reviewer || !latest.has(login) || !Array.isArray(review.dependencies)) return []
+    const time = Number.isFinite(when(review.time)) ? when(review.time) : latest.get(login)!
+    return review.dependencies.flatMap(dependency => {
+      const { name, version, integrity, patchHash, status } = dependency ?? {}
+      if (typeof name !== 'string' || typeof version !== 'string' || typeof integrity !== 'string' || !VERDICTS.has(status)) return []
+      return integrity.split(/\s+/u).filter(Boolean).map(hash => ({ package: name, version, integrity: hash, ...typeof patchHash === 'string' && patchHash ? { patchHash } : {},
+        basePackage: null, baseVersion: null, reviewer, status: status as ReviewVerdict, full: true, time }))
+    })
+  })
+}
+
+// The reviews pull request `number`'s comments make, as the host's parser
+// reads them, of the versions still wanting one, none where it isn't open
+// (the parser then not asked); `reviewers` the app's users
+// the accounts are, by their logins in lower case, of those whose reviews
+// count for the repository.
+export function commentReviews({ fullName, number, token, parse, reviewers, fetchImpl = globalThis.fetch }: {
+  fullName: string; number: number; token: string; parse: NonNullable<ReviewedDependencies['parseComments']>
+  reviewers: (accounts: { login: string; githubId: number | null }[]) => Promise<Map<string, string>>; fetchImpl?: typeof fetch
+}): CommentReviews {
+  return async wanting => {
+    try {
+      const { open, read } = await pullComments(fullName, token, number, fetchImpl)
+      if (!open) return { reviews: [], failed: false }
+      const accounts = new Map(read.flatMap(({ account }) => account.login ? [[account.login.toLowerCase(), { login: account.login, githubId: account.id }]] : []))
+      const answer = await parsed(parse, { repository: fullName, number, comments: read.map(({ comment }) => comment), dependencies: wanting })
+      return { reviews: counted(answer, read, await reviewers([...accounts.values()])), failed: false }
+    } catch (error) {
+      console.warn('reviewed dependencies: comments of', `${fullName}#${number}`, 'not read:', error instanceof Error ? error.message : error)
+      return { reviews: [], failed: true }
+    }
+  }
+}