@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/reviewed-dependencies.ts

@@ -0,0 +1,149 @@
+// The reviewed dependencies a host keeps beyond the app, as it registers
+// them before the server is assembled (server.ts registerReviewedDependencies):
+// an async method telling whether a dependency, as a lockfile locks it, is
+// reviewed there (`lookup`), and, optionally, one reading the reviews of
+// dependencies an open pull request's comments make (`parseComments`,
+// pull-comment-reviews.ts), and one formatting one's own dependency reviews
+// as a comment, for a copy button to give (`formatDependencyReviews`,
+// dependency-review-comments.ts). Registered, they replace the commit a repository
+// is reviewed since (pull-dependency-reviews.ts): a version passes by the
+// reviews its teams publish, and those its pull request's comments make, as
+// many as the repository requires, or by `lookup`'s saying so, and is
+// otherwise unreviewed. A patched version (pnpm's patchedDependencies)
+// passes by `lookup`, or reviews its comments make of its patch, alone, the
+// app reviewing no patch yet. Those comments' reviews count for the pull
+// request alone, as it is open: the host's to keep, as it is merged, among
+// those `lookup` tells of.
+//
+// Each version is asked of `lookup` once a request, as many at once as
+// ASK_AT_ONCE, its answer kept in this instance KEPT_MS; one it fails to
+// answer is unreviewed, and counted so (`unasked`).
+import { type Lru, lru } from './lru.ts'
+
+export type ReviewedLockfile = 'npm' | 'pnpm' | 'yarn1'
+// A dependency as a lockfile locks it: npm's always with its integrity (one
+// with none is never reviewed, nor asked of), its shasum where the lockfile
+// has one (Yarn 1's, after a tarball's `#`), and the hash of its patch where
+// it is patched (pnpm's).
+export interface ReviewedDependency {
+  ecosystem: 'npm'
+  lockfile: ReviewedLockfile
+  name: string
+  version: string
+  integrity?: string
+  shasum?: string
+  patchHash?: string
+}
+export type ReviewVerdict = 'accept' | 'accept-with-nits' | 'request-changes' | 'reject'
+// A comment of an open pull request's, as `parseComments` is given it: one
+// on the pull request (`comment`), a review's own (`review`, whatever its
+// state, a comment's alone too), or one on a line of its diff
+// (`review-comment`); by its author's GitHub login; when it was written, and
+// last edited (`editedAt`) where it was.
+export interface ReviewComment {
+  kind: 'comment' | 'review' | 'review-comment'
+  id: string
+  author: string | null
+  body: string
+  state?: string
+  createdAt: string
+  editedAt?: string
+  url: string
+}
+// What `parseComments` reads: the pull request, its comments, and the
+// dependencies: every one the lockfiles its review holds to add that can be
+// reviewed and `lookup` doesn't pass, and the others still wanting reviews.
+export interface ParseCommentsInput { repository: string; number: number; comments: ReviewComment[]; dependencies: ReviewedDependency[] }
+// A review its comments make, by `user` (a GitHub login, one of their
+// authors'), of each of `dependencies`, with its verdict, as of `time` (when
+// it was made, an ISO date or milliseconds; that user's latest comment's
+// where none is told).
+export interface CommentReview {
+  user: string
+  time?: string | number
+  dependencies: { ecosystem?: 'npm'; name: string; version: string; integrity: string; patchHash?: string; status: ReviewVerdict }[]
+}
+// A version a dependency review is of, or compared it with: its package's
+// name, its version and integrity, and its tarball's shasum and its patch's
+// hash where they are known (a lockfile's, pnpm's patched dependencies').
+export interface ReviewedVersion { name: string; version: string; integrity: string; shasum?: string; patchHash?: string }
+// One of one's own published dependency reviews, as `formatDependencyReviews`
+// is given it: the version it is of (`new`) and the one it compared it with
+// (`old`, none where it read its package whole); its verdict (`status`);
+// whether it read every file (`coverage`, `full`, else `partial`); its final
+// comment; each file's verdict and comment (`files`, of those with either);
+// by whom (`reviewer`, their GitHub login), and when it was published.
+export interface DependencyReviewEntry {
+  ecosystem: 'npm'
+  old: ReviewedVersion | null
+  new: ReviewedVersion
+  status: ReviewVerdict
+  coverage: 'full' | 'partial'
+  comment: string
+  files: { path: string; status: ReviewVerdict | null; comment: string }[]
+  reviewer: string
+  publishedAt: number
+}
+// What `formatDependencyReviews` formats: one's own reviews, never another's,
+// and the pull request whose versions they are of, where its copy asks.
+export interface FormatDependencyReviewsInput { reviews: DependencyReviewEntry[]; pullRequest?: { repository: string; number: number } }
+export interface ReviewedDependencies {
+  lookup(dependency: ReviewedDependency): Promise<boolean>
+  parseComments?(input: ParseCommentsInput): Promise<CommentReview[]>
+  // The comment to copy, none where it is empty, null or undefined.
+  formatDependencyReviews?(input: FormatDependencyReviewsInput): Promise<string | null | undefined>
+}
+
+const ASK_AT_ONCE = 16
+const KEPT_MS = 60_000
+
+let registered: ReviewedDependencies | null = null
+let assembled = false
+// Each lookup's answers, apart.
+const answers = new WeakMap<ReviewedDependencies['lookup'], Lru<{ at: number; reviewed: boolean }>>()
+
+// Registers the host's reviewed dependencies, once, before the server is
+// assembled (init()): a server already assembled keeps what it was given.
+export function registerReviewedDependencies(reviewed: ReviewedDependencies): void {
+  const optional = (method: unknown) => method === undefined || typeof method === 'function'
+  if (typeof reviewed?.lookup !== 'function' || !optional(reviewed.parseComments) || !optional(reviewed.formatDependencyReviews)) {
+    throw new TypeError('registerReviewedDependencies: expected { lookup, parseComments?, formatDependencyReviews? }, async methods')
+  }
+  if (assembled) throw new Error('registerReviewedDependencies: call it before init(), as the server takes them as it is assembled')
+  if (registered) throw new Error('registerReviewedDependencies: reviewed dependencies are registered already')
+  registered = { lookup: reviewed.lookup.bind(reviewed), ...reviewed.parseComments ? { parseComments: reviewed.parseComments.bind(reviewed) } : {},
+    ...reviewed.formatDependencyReviews ? { formatDependencyReviews: reviewed.formatDependencyReviews.bind(reviewed) } : {} }
+}
+
+// The reviewed dependencies registered, as a server takes them once it is
+// assembled; none registers after.
+export function assembledReviewedDependencies(): ReviewedDependencies | null {
+  assembled = true
+  return registered
+}
+
+// Which of `dependencies`, by their keys, `lookup` passes, and how many it
+// failed to answer.
+export async function askReviewed(lookup: ReviewedDependencies['lookup'], dependencies: Map<string, ReviewedDependency>): Promise<{ passed: Set<string>; unasked: number }> {
+  const passed = new Set<string>()
+  let unasked = 0
+  const pending = [...dependencies]
+  const kept = answers.get(lookup) ?? answers.set(lookup, lru(100_000)).get(lookup)!
+  await Promise.all(Array.from({ length: Math.min(ASK_AT_ONCE, pending.length) }, async () => {
+    for (let next = pending.pop(); next; next = pending.pop()) {
+      const [key, dependency] = next
+      const known = kept.get(key)
+      let answer = known && Date.now() - known.at < KEPT_MS ? known.reviewed : null
+      if (answer === null) {
+        try { answer = await lookup({ ...dependency }) === true } catch (error) {
+          unasked++
+          console.warn('reviewed dependencies: failed to answer', `${dependency.name}@${dependency.version}`, error instanceof Error ? error.message : error)
+          continue
+        }
+        kept.set(key, { at: Date.now(), reviewed: answer })
+      }
+      if (answer) passed.add(key)
+    }
+  }))
+  return { passed, unasked }
+}

package/server-managed/session.ts

@@ -13,13 +13,15 @@ import { hashToken, randomToken } from './crypto.ts'
 // `cookieName` when cookies are Secure.
 export const STATE_COOKIE = 'dvstate'
 
-// Base names for GitHub issue authorization state (github-issue-oauth.ts) and
-// an administrator's read-only view as another user (view-as.ts).
+// Base names for GitHub issue authorization state (github-issue-oauth.ts),
+// linking another GitHub account (github-link-oauth.ts) and an
+// administrator's read-only view as another user (view-as.ts).
 export const ISSUE_STATE_COOKIE = 'dvissuestate'
+export const LINK_STATE_COOKIE = 'dvlinkstate'
 export const VIEW_COOKIE = 'dvview'
 // The session cookie cannot share a name with these, or one would overwrite
 // or be read as the other.
-export const RESERVED_COOKIES: readonly string[] = [STATE_COOKIE, ISSUE_STATE_COOKIE, VIEW_COOKIE]
+export const RESERVED_COOKIES: readonly string[] = [STATE_COOKIE, ISSUE_STATE_COOKIE, LINK_STATE_COOKIE, VIEW_COOKIE]
 
 // `__Host-`-prefix the base name when cookies are Secure (the prefix mandates
 // Secure + Path=/ + no Domain, which `buildCookie` already emits).
@@ -55,13 +57,15 @@ export function parseCookies(header: string | undefined): Map<string, string> {
 
 // Mint a session for a freshly-authenticated user. Upserts the identity, then
 // stores the session keyed by the cookie token's hash. Returns the cookie to
-// set and the CSRF token (also persisted on the row).
+// set and the CSRF token (also persisted on the row), or null for an account
+// a user linked to theirs, which can neither sign in nor register.
 export async function createSession(
   config: ManagedConfig, db: ManagedDb, user: ManagedUser, now: number,
-): Promise<{ setCookie: string; csrfToken: string; userId: string }> {
+): Promise<{ setCookie: string; csrfToken: string; userId: string } | null> {
   const token = randomToken()
   const csrfToken = randomToken()
   const userId = await db.upsertUser(user, now, config.initialAdminGithubId)
+  if (userId == null) return null
   await db.createSession({ id: hashToken(token), userId, csrfToken, expiresAt: now + config.sessionTtlMs }, now)
   const setCookie = buildCookie(config.sessionCookieName, token, {
     maxAgeS: Math.floor(config.sessionTtlMs / 1000), secure: config.cookieSecure, sameSite: 'Lax',

package/server-managed/sql.ts

@@ -23,7 +23,7 @@ const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'g
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
-  'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits'])
+  'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits', 'getAvatarKey', 'listUsersByAccount'])
 // Session presence and upload keys change only their own rows.
 const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensureSessionUploadKey'])
 

package/server-managed/storage-stores.ts

@@ -61,6 +61,11 @@ function avatarStore(objects: ObjectStorage, sidecar: boolean): AvatarStore {
       if (split < 0 || split > 100) throw new Error('Invalid cached avatar')
       return { contentType: bytes.subarray(0, split).toString(), bytes: bytes.subarray(split + 1) }
     },
+    async delete(value) {
+      const path = `avatars/${id(value)}`
+      await objects.delete(path)
+      if (sidecar) await objects.delete(`${path}.type`)
+    },
   }
 }
 

package/server-managed/team-app.ts

@@ -4,6 +4,18 @@
 // loads. Results are keyed by the catalog's own content keys: an unchanged
 // catalog reuses them, and every change that can move a result also changes
 // the catalog revision that clients refresh on.
+//
+// The same read names the reports a restricted reader would find nothing in:
+// under -deps or -security the catalog leaves those out of the team's list.
+// Readers with both permissions keep every report, empty or not.
+//
+// A team that is not App also says how many of its reports open in App mode
+// on their own, and its findings for the badge it collapses to. None is as
+// uniform as an App team, and collapses like one. A team mixing App and non-App
+// reports stays expanded, and so does one whose reports each open as App but
+// whose combined workspace does not (contradicting verdicts, say): it has App
+// findings, and only expanded does it show that they fail to combine.
+import { reportEntries } from '@preventive/report'
 import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot, UserTeam } from './db.ts'
@@ -11,12 +23,14 @@ import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
 import { TeamReportsError, loadTeamReportsResponse } from './team-reports.ts'
 
 export type { TeamAppMetadata }
+export interface TeamWorkspaceSummary { app: TeamAppMetadata; empty: readonly string[] }
+const NO_APP: TeamWorkspaceSummary = { app: { appMode: false }, empty: [] }
 
 const CACHE_MAX_ENTRIES = 4096
 // Each workspace build already reads four reports at a time.
 const CLASSIFY_CONCURRENCY = 2
-const caches = new WeakMap<ManagedDb, Map<string, TeamAppMetadata>>()
-const pendingJobs = new WeakMap<ManagedDb, Map<string, Promise<TeamAppMetadata | null>>>()
+const caches = new WeakMap<ManagedDb, Map<string, TeamWorkspaceSummary>>()
+const pendingJobs = new WeakMap<ManagedDb, Map<string, Promise<TeamWorkspaceSummary | null>>>()
 
 // Published reports with their content keys, and the team's own key (access,
 // scopes and links). Equal keys describe the same filtered workspace, whoever
@@ -29,28 +43,40 @@ function published(team: UserTeam) {
   return team.reports.filter(report => report.visible !== false)
 }
 
-function remember(db: ManagedDb, key: string, app: TeamAppMetadata): TeamAppMetadata {
+function remember(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): TeamWorkspaceSummary {
   let cache = caches.get(db)
   if (!cache) { cache = new Map(); caches.set(db, cache) }
   cache.delete(key)
-  cache.set(key, app)
+  cache.set(key, summary)
   for (const oldest of cache.keys()) {
     if (cache.size <= CACHE_MAX_ENTRIES) break
     cache.delete(oldest)
   }
-  return app
+  return summary
+}
+
+function isLinks(data: unknown): boolean {
+  const record = data as { source?: unknown; links?: unknown } | null
+  return record?.source === 'links' && Array.isArray(record.links)
+}
+
+// A links document counts by its links, every other report by its findings.
+function hasContent(data: unknown): boolean {
+  if (isLinks(data)) return (data as { links: unknown[] }).links.length > 0
+  return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
 }
 
 // Null when the team cannot be classified right now: its catalog went stale,
 // the access snapshot is gone, or storage failed. The sidebar then keeps the
-// team expanded, and a later catalog asks again. Oversized and unreadable
-// workspaces never have an App view, so they are remembered as such.
+// team expanded and lists every report, and a later catalog asks again.
+// Oversized and unreadable workspaces never have an App view, so they are
+// remembered as such, hiding nothing.
 async function classify(db: ManagedDb, store: BlobStore, key: string, team: UserTeam,
-  snapshot: () => Promise<TeamReportAccessSnapshot | null>): Promise<TeamAppMetadata | null> {
+  snapshot: () => Promise<TeamReportAccessSnapshot | null>): Promise<TeamWorkspaceSummary | null> {
   const cached = caches.get(db)?.get(key)
   if (cached) return remember(db, key, cached)
   const ids = new Set(published(team).map(report => report.id))
-  if (ids.size === 0) return remember(db, key, { appMode: false })
+  if (ids.size === 0) return remember(db, key, NO_APP)
   let jobs = pendingJobs.get(db)
   if (!jobs) { jobs = new Map(); pendingJobs.set(db, jobs) }
   const existing = jobs.get(key)
@@ -60,11 +86,18 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
     // A catalog read before a concurrent publication names another report set.
     if (!access?.teamId || access.reports.length !== ids.size || access.reports.some(report => !ids.has(report.id))) return null
     const body = JSON.parse((await loadTeamReportsResponse(db, store, access)).toString('utf8')) as {
-      reports: { filename: string; data: unknown }[]; links?: string[][]
+      reports: { id: string; filename: string; data: unknown }[]; links?: string[][]
     }
-    return remember(db, key, managedTeamAppMetadata(Object.assign(body.reports, { links: body.links ?? [] })))
+    const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
+    const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
+    const links = body.links ?? []
+    const app = managedTeamAppMetadata(Object.assign(body.reports, { links }), { countFindings: true })
+    if (app.appMode) return remember(db, key, { app, empty })
+    const appReports = body.reports.filter(report => !isLinks(report.data)
+      && managedTeamAppMetadata(Object.assign([report], { links })).appMode).length
+    return remember(db, key, { app: { ...app, appReports }, empty })
   })().catch((error: unknown) => {
-    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, { appMode: false })
+    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, NO_APP)
     if (!(error instanceof TeamReportsError)) console.warn('managed: team App classification failed:', error)
     return null
   })
@@ -72,10 +105,17 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
   try { return await job } finally { jobs.delete(key) }
 }
 
+// The catalog's view of a classified team: its App classification, and its
+// reports without the ones its restricted reader would find empty.
+export function withWorkspaceSummary<T extends { reports: readonly { id: string }[] }>(team: T, summary: TeamWorkspaceSummary | null | undefined) {
+  const empty = new Set(summary?.empty)
+  return { ...team, app: summary?.app ?? null, reports: team.reports.filter(report => !empty.has(report.id)) }
+}
+
 // Classify a user's catalog, keyed by teamAppKey. `known` carries results from
 // an earlier read of the same request, so only changed teams are classified.
 export async function teamAppStates(db: ManagedDb, store: BlobStore, sessionId: string, teams: readonly UserTeam[],
-  known: ReadonlyMap<string, TeamAppMetadata | null> = new Map()): Promise<Map<string, TeamAppMetadata | null>> {
+  known: ReadonlyMap<string, TeamWorkspaceSummary | null> = new Map()): Promise<Map<string, TeamWorkspaceSummary | null>> {
   const states = new Map(known)
   const missing = [...new Map(teams.map(team => [teamAppKey(team), team])).entries()].filter(([key]) => !states.has(key))
   let next = 0
@@ -89,6 +129,6 @@ export async function teamAppStates(db: ManagedDb, store: BlobStore, sessionId:
 }
 
 // A public link's workspace is its own access snapshot.
-export function sharedTeamApp(db: ManagedDb, store: BlobStore, snapshot: WorkspaceShareSnapshot): Promise<TeamAppMetadata | null> {
+export function sharedTeamApp(db: ManagedDb, store: BlobStore, snapshot: WorkspaceShareSnapshot): Promise<TeamWorkspaceSummary | null> {
   return classify(db, store, JSON.stringify(['share', teamAppKey(snapshot.team)]), snapshot.team, () => Promise.resolve(snapshot))
 }

package/server-managed/workspace-shares.ts

@@ -145,15 +145,18 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       const links = await linkRevision(db)
       const bundleRows = (await q.bundles.all(team.id) as (Omit<ManagedBundle, 'buildConditions'> & { buildConditions: string | null; repoFullName: string })[])
         .map(row => ({ ...row, buildConditions: row.buildConditions == null ? null : JSON.parse(row.buildConditions) as BundleBuildConditions }))
+      const repositories = await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories']
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
         teamId: team.id,
         linkRevision: links,
         permissions,
-        repositories: await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories'],
+        repositories,
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
         team: { ...team, permissions, cacheKey: links,
+          repos: repositories.map(repo => ({ repoId: repo.repoId, fullName: repo.github, path: repo.path || null }))
+            .toSorted((a, b) => a.fullName.localeCompare(b.fullName) || (a.path ?? '').localeCompare(b.path ?? '')),
           reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, visible: true, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions, links]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,

package/server.ts

@@ -2,6 +2,17 @@ import { parseArgs } from 'node:util'
 import type { Server } from 'node:http'
 import { startServer } from './server-common/standalone.ts'
 
+// The reviewed dependencies a host keeps beyond the app, registered before
+// init() (server-managed/reviewed-dependencies.ts): an async method telling
+// whether a dependency, as a lockfile locks it, is reviewed there
+// (`lookup`), and optionally one reading the reviews an open pull request's
+// comments make (`parseComments`), and one formatting one's own dependency
+// reviews as a comment to copy (`formatDependencyReviews`). They replace a
+// repository's commit its dependencies are reviewed since.
+export { registerReviewedDependencies } from './server-managed/reviewed-dependencies.ts'
+export type { CommentReview, DependencyReviewEntry, FormatDependencyReviewsInput, ParseCommentsInput, ReviewComment, ReviewedDependencies, ReviewedDependency,
+  ReviewedLockfile, ReviewedVersion, ReviewVerdict } from './server-managed/reviewed-dependencies.ts'
+
 const modes = ['e2e', 'managed', 'managed-e2e', 'e2e-managed'] as const
 export type ServerMode = typeof modes[number]
 

package/out/chunk-2KBF5TZ7.js

@@ -1,2 +0,0 @@
-var n=`.managed-comment{container:managed-comment / inline-size;white-space:normal}.managed-comment-row{display:grid;grid-template-columns:minmax(0,max-content) minmax(0,1fr) auto;align-items:start;gap:.35rem .65rem;line-height:1.5}.managed-comment-author{grid-column:1;grid-row:1;display:flex;align-items:center;gap:.45rem;min-width:0;max-width:14rem;& strong{overflow:hidden;text-overflow:ellipsis;font-weight:600}}.managed-comment-avatar{position:relative;display:inline-flex;align-items:center;justify-content:center;flex:none;width:1.3rem;height:1.3rem;overflow:hidden;border-radius:50%;background:rgb(from var(--muted) r g b / .15);color:var(--muted);font-size:.65rem;font-weight:600;& img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover}& img[hidden]{display:none}}.managed-comment-body{grid-column:2;grid-row:1;min-width:0;white-space:pre-wrap;overflow-wrap:anywhere;& a{color:var(--accent);text-decoration:none}& a:hover{text-decoration:underline}& a.comment-self-ref{text-decoration:underline dotted;text-underline-offset:2px}& a.comment-self-ref:hover{text-decoration:underline solid}}.managed-comment-time{color:var(--muted);font-size:.7rem;font-weight:400;white-space:nowrap;text-align:right}.managed-comment-meta{grid-column:3;grid-row:1;justify-self:end;display:flex;align-items:center;gap:.5rem;min-height:1.3rem}.managed-comment-actions{display:flex;align-items:center;gap:.15rem}.managed-comment-row:not(:has(.managed-comment-author)){grid-template-columns:minmax(0,1fr) auto;.managed-comment-body{grid-column:1}.managed-comment-meta{grid-column:2}}@container managed-comment (max-width: 28rem){.managed-comment-row:has(.managed-comment-meta){grid-template-columns:minmax(0,max-content) minmax(0,1fr);.managed-comment-meta{grid-column:1 / -1;grid-row:1}.managed-comment-author,.managed-comment-body{grid-row:2}}.managed-comment-row:not(:has(.managed-comment-author)){grid-template-columns:minmax(0,1fr)}.managed-comment-author{max-width:9rem}}
-`;export{n as a};

package/out/chunk-35VE6CDH.js

@@ -1,2 +0,0 @@
-import{a as n}from"./chunk-DIJJNTRH.js";import{c as t,g as i}from"./chunk-2XUEZHIP.js";import{c as d,l as s,m}from"./chunk-V5O7M2YT.js";var c=[["manage","Overview"],["manage-bundles","Bundles"],["manage-scans","Scans"],["manage-reports","Reports"],["manage-deduplication","Deduplication","admin"],["manage-repos","Repositories","admin"],["admin-users","Users","admin"],["manage-teams","Teams","admin"],["manage-import","Import","admin"],["manage-links","Links"],["manage-history","History"]];function h(e,r,l=!1){return t`<header class="manage-header"><nav class="manage-nav" aria-label="Management pages">${c.filter(([a,,o])=>(o==null||o===r)&&(a!=="manage-links"||l)).map(([a,o])=>t`<button type="button" aria-current="${e===a?"page":i}" @click="${()=>{document.dispatchEvent(new CustomEvent("managed-admin-navigate",{detail:{view:a},bubbles:!0,composed:!0}))}}">${o}</button>`)}</nav></header>`}function v(e){if(e==="bundle")return n(d);if(e==="report"||e==="preview")return n(m);if(e==="scan")return n(s);let r={users:"M10.75 4.75a2.75 2.75 0 1 1-5.5 0 2.75 2.75 0 0 1 5.5 0ZM3 14v-1.5A3.5 3.5 0 0 1 6.5 9h3a3.5 3.5 0 0 1 3.5 3.5V14",team:"M8.5 5a2.5 2.5 0 1 1-5 0 2.5 2.5 0 0 1 5 0ZM1.5 14v-1.5A3.5 3.5 0 0 1 5 9h2a3.5 3.5 0 0 1 3.5 3.5V14M11 2.75a2.5 2.5 0 0 1 0 4.5m1 2a3 3 0 0 1 2.5 3V14",repo:"M3 12.5V3a1.5 1.5 0 0 1 1.5-1.5H13v13H4.5a1.5 1.5 0 0 1 0-3H13M7 1.5v6l2-1.5 2 1.5v-6",history:"M2 5a6.25 6.25 0 1 1-.25 5M1.5 1.5V5H5M8 4.5V8l3 1.5",arrow:"M3 8h10M9 4l4 4-4 4",show:"M1 8s2.5-4.5 7-4.5S15 8 15 8s-2.5 4.5-7 4.5S1 8 1 8Zm9 0a2 2 0 1 0-4 0 2 2 0 0 0 4 0",hide:"m2 2 12 12M6 3.75A8 8 0 0 1 8 3.5c4.5 0 7 4.5 7 4.5a12 12 0 0 1-2 2.5M3.5 5A13 13 0 0 0 1 8s2.5 4.5 7 4.5a8 8 0 0 0 3-.6",download:"M8 2v8M5 7l3 3 3-3M2 11v3h12v-3",upload:"M8 11V2m-3 3 3-3 3 3M2 10v4h12v-4"};return t`<svg class="${e==="repo"?"repo-icon":i}" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="${r[e]??r.repo}"></path></svg>`}var w=`:host{display:flex;flex-direction:column;position:relative;padding:0 clamp(1rem,3vw,3rem) 3rem;color:var(--text);container-type:inline-size;font-family:var(--sans, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif);font-size:.875rem;line-height:1.5;--panel:color-mix(in srgb, var(--bg) 50%, var(--surface));--panel-hover:color-mix(in srgb, var(--text) 3%, var(--panel))}*,*:before,*:after{box-sizing:border-box}button,summary,select,label,legend,h1,h2,h3,.section-heading,.ui-hint,.page-intro>.intro,.count,.result-count,.repository-count,.breadcrumb-separator,.list-head,.report-list-head,.history-head,.bundle-group-head,.drop-copy,.local-import-copy,.location-field>span,.empty:not(.error,[role=alert]),.msg:not(.error,[role=alert]),.local-import-message:not(.error,[role=status]),.data-empty,.revision-empty{cursor:default;user-select:none;-webkit-user-select:none}input:not([type=checkbox],[type=radio]),textarea,[contenteditable],pre,code,.mono{cursor:text;user-select:text;-webkit-user-select:text}.wrap{width:100%;max-width:76rem;margin:0 auto;flex:1;min-height:0;overflow-y:auto;overscroll-behavior:none;scrollbar-gutter:stable}.manage-header{position:sticky;top:0;z-index:2}.wrap:has(>.manage-list){display:flex;flex-direction:column;overflow:hidden;scrollbar-gutter:auto}.wrap:has(>.manage-list)>:not(.manage-list){flex:none}.manage-list{position:relative;flex:1;min-height:0;overflow:auto;overscroll-behavior:contain;scrollbar-gutter:stable}.manage-nav button{flex:0 0 auto;position:relative;min-height:3.7rem;padding:.9rem 0;border:0;border-radius:0;color:var(--muted);background:none;font-size:.8rem;font-weight:500;white-space:nowrap}.manage-nav button:hover,.manage-nav button[aria-current=page]{color:var(--text)}.manage-nav button[aria-current=page]:after{content:"";position:absolute;bottom:.6rem;inset-inline:0;height:2px;background:var(--accent);border-radius:var(--ui-radius, 2px)}.manage-nav button:focus-visible{outline-offset:-3px}.head{display:flex;align-items:center;flex-wrap:wrap;gap:.7rem;margin:0 0 .5rem}h1,.head h1{margin:0;font-size:1.9rem;font-weight:600;letter-spacing:-.045em;line-height:1.2}.count{display:inline-flex;align-items:center;justify-content:center;min-width:1.6rem;padding:.12rem .5rem;border:1px solid var(--border);border-radius:6px;color:var(--muted);background:var(--surface);font-size:.73rem;font-weight:500;font-variant-numeric:tabular-nums}button,input,select{font:inherit}button,select,input[type=checkbox]{cursor:default}button,a,input,select{-webkit-app-region:no-drag}button,a{transition:background .15s,color .15s,border-color .15s}button:focus-visible,a:focus-visible,input:focus-visible,select:focus-visible{outline:2px solid var(--accent);outline-offset:3px}button:disabled,select:disabled{opacity:.45}input:not([type=checkbox]),select{min-width:0;min-height:2.25rem;padding:.45rem .65rem;border:1px solid var(--border);border-radius:var(--ui-radius, 7px);background:var(--bg);color:var(--text);font-size:.8rem}input::placeholder{color:var(--muted)}input[type=checkbox]{accent-color:var(--accent)}.btn,.drop-browse{display:inline-flex;align-items:center;justify-content:center;gap:.45rem;min-height:2.25rem;height:auto;padding:.45rem .8rem;border:1px solid var(--border);border-radius:var(--ui-radius, 7px);background:var(--surface);color:var(--text);font-size:.8rem;font-weight:500;text-decoration:none;white-space:nowrap}.btn:hover:not(:disabled),.drop-browse:hover:not(:disabled){background:var(--surface-active);border-color:var(--muted)}.btn.primary,.drop-browse{color:var(--bg);background:var(--accent);border-color:var(--accent)}.btn.primary:hover:not(:disabled),.drop-browse:hover:not(:disabled){background:var(--accent);filter:brightness(1.08)}.btn svg,.icon-btn svg{width:1rem;height:1rem}.icon-btn{width:2rem;height:2rem}.avatar{color:var(--accent);background:color-mix(in srgb,var(--accent) 12%,var(--bg));border:1px solid color-mix(in srgb,var(--accent) 16%,var(--border))}.breadcrumb{display:flex;align-items:center;flex-basis:100%;gap:.4rem;margin-bottom:.8rem}.breadcrumb-manage{padding:.1rem 0;border:0;background:transparent;color:var(--muted);font-size:.78rem}.breadcrumb-manage:hover{color:var(--text)}.breadcrumb-separator{color:var(--muted)}.msg{margin:1rem 0;padding:1.1rem 1.25rem;border:1px solid var(--border);border-radius:var(--ui-radius, 9px);color:var(--muted);font-size:.85rem}.msg.error{color:var(--critical);border-color:color-mix(in srgb,var(--critical) 35%,var(--border))}.empty{padding:3.5rem 1.5rem;border:1px dashed var(--border);border-radius:var(--ui-radius, 10px);color:var(--muted);text-align:center}.empty strong{display:block;margin-bottom:.4rem;color:var(--text);font-size:.95rem;font-weight:500}.empty p{margin:0;font-size:.85rem}.sr-only{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%);white-space:nowrap}@container (max-width: 35rem){.drop-copy>span{display:none}.manage-nav{gap:1.2rem;margin-bottom:1.75rem}.manage-nav button{min-height:3.25rem}h1,.head h1{font-size:1.65rem}.intro{margin-bottom:1.5rem}}@media(prefers-reduced-motion:reduce){button,a{transition:none}}.collection-toolbar input{flex:1;max-width:26rem;min-width:10rem}.collection-toolbar select{min-width:10rem}.result-count{text-align:right;white-space:nowrap;margin-left:auto;color:var(--muted);font-size:.75rem;font-variant-numeric:tabular-nums}@container (max-width: 35rem){.collection-toolbar input{flex-basis:100%;max-width:none}}.manage-nav{display:flex;gap:1.35rem;align-items:stretch;overflow-x:auto;scrollbar-width:thin;border-bottom:1px solid var(--border);margin-bottom:1.5rem;padding:0 .1rem}.wrap>:not(.manage-header),.manage-nav{-webkit-app-region:no-drag;app-region:no-drag}@media(display-mode:window-controls-overlay){.manage-header{display:flow-root}.manage-header:before{content:"";float:right;width:var(--wco-right-toolbar, 0px);height:var(--wco-titlebar-height)}.manage-nav{width:max-content;max-width:100%;border-bottom:0}.manage-nav button{min-height:var(--wco-titlebar-height);padding-block:.35rem}.manage-nav button[aria-current=page]:after{bottom:0}}.intro{margin:0 0 1.25rem;max-width:46rem;color:var(--muted);font-size:.875rem;line-height:1.65}.collection-toolbar{display:flex;align-items:center;flex-wrap:wrap;gap:.75rem;margin-bottom:.85rem}.page-intro{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:.5rem 1rem;margin-bottom:1.25rem}.page-intro .intro{margin:0}.page-intro>.btn{margin-block:calc(-.45rem - 1px)}a{cursor:default}.loading-rows{border:1px solid var(--border);border-radius:var(--ui-radius, 10px);overflow:hidden}.loading-row{display:grid;align-content:center;gap:.6rem;min-height:4.25rem;padding:.85rem 1rem}.loading-row+.loading-row{border-top:1px solid var(--border)}.loading-row span{width:40%;height:.65rem;border-radius:3px;background:color-mix(in srgb,var(--muted) 15%,transparent)}.loading-row span+span{width:65%;height:.5rem}.drop-card{display:flex;align-items:center;gap:.75rem;margin-bottom:1rem;padding:.7rem .85rem;border:1px dashed color-mix(in srgb,var(--muted) 35%,var(--border));border-radius:var(--ui-radius, 8px);background:var(--panel)}.drop-icon{display:grid;place-items:center;flex-shrink:0;width:1.8rem;height:1.8rem;color:var(--muted)}.drop-icon svg{width:1.1rem;height:1.1rem}.drop-copy{min-width:0;display:flex;align-items:baseline;flex-wrap:wrap;gap:.2rem .6rem}.drop-copy strong{font-size:.8rem;font-weight:500}.drop-copy>span{color:var(--muted);font-size:.75rem}.drop-browse{min-width:7rem;margin-left:auto;flex-shrink:0}.content-hidden .filename,.content-hidden .report-name,.content-hidden .report-uploader{color:var(--muted)}.status{display:inline-flex;align-items:center;gap:.3rem;width:fit-content;padding:.1rem .4rem;border:1px solid var(--border);border-radius:5px;color:var(--muted);font-size:.65rem}.status:before{content:"";width:.25rem;height:.25rem;border-radius:50%;background:currentcolor}.status.visible{color:var(--green);border-color:rgb(from var(--green) r g b / .2);background:rgb(from var(--green) r g b / .06)}
-`;export{h as a,v as b,w as c};

package/out/chunk-3BZ7JERB.js

@@ -1 +0,0 @@
-function n(t){return typeof t=="string"&&/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(t)?t:null}export{n as a};

package/out/chunk-4F6JSF57.js

@@ -1,3 +0,0 @@
-import{b as w,c as f,j as m,l as k}from"./chunk-WZDTZE64.js";import{a as h}from"./chunk-TUII34K2.js";var x=3,y=4,H=/^[\w-]{4}$/u,_=/^[\w-]{8}$/u,u="AAAA",R={report:`deepview/finding-link/report/v1
-`,workspace:`deepview/finding-link/workspace/v1
-`},p=new Map;function $(t,e){return`${t}\0${e}`}function I(t){return typeof t=="string"&&H.test(t)}async function T(t,e){let n=R[t];if(!n||typeof e!="string"||!e)return null;let i=$(t,e),o=p.get(i);if(o!==void 0)return o;let r;try{let s=await crypto.subtle.digest("SHA-256",h(n+e));r=new Uint8Array(s).slice(0,x).toBase64({alphabet:"base64url",omitPadding:!0})}catch{return null}return p.set(i,r),r}function E(t,e){return typeof e!="string"||!e?null:p.get($(t,e))??null}function N(t,e){let n=[];for(let[i,o]of[["report",t],["workspace",e]]){if(o==null||o===""){n.push(u);continue}if(!I(o))throw new TypeError(`encodeFindingRef: ${i} must be a link hint token, not a name`);n.push(o)}return n.every(i=>i===u)?null:n[0]===u?`w${n[1]}`:n.join("")}function b(t){let e=[t.slice(0,y),t.slice(y)].map(n=>n===u?null:n);return{report:e[0],workspace:e[1]}}function a({id:t,report:e,workspace:n}={}){if(!f(t))throw new TypeError("encodeFindingRef: a persistent finding id is required");let i=[`finding=${encodeURIComponent(t)}`],o=N(e,n);return o&&i.push(`v=${o}`),i.join("&")}function O(t,e){let n=a(t);return typeof location>"u"?`${e??""}#${n}`:`${location.origin}${e??location.pathname}#${n}`}function A(t){let e=typeof t=="string"?t:typeof location>"u"?"":location.hash;if(!e)return null;let n=e.replace(/^#/u,"");if(!n)return null;let i={id:null,report:null,workspace:null};for(let o of n.split("&")){let r=o.indexOf("=");if(r<0)continue;let s=o.slice(0,r),c=o.slice(r+1);if(!c)continue;if(s==="v"){if(c.length===5&&c[0]==="w"&&I(c.slice(1))){let g=c.slice(1);Object.assign(i,{report:null,workspace:g===u?null:g});continue}if(!_.test(c))continue;Object.assign(i,b(c));continue}if(s!=="finding"||c.length>w*3)continue;let d;try{d=decodeURIComponent(c)}catch{continue}f(d)&&(i.id=d)}return i.id?i:null}function U(t,{managed:e=!1}={}){if(typeof location>"u")return null;let n;try{n=new URL(t)}catch{return null}if(n.href!==t||n.protocol!==location.protocol||n.host!==location.host||n.username||n.password)return null;let i=k(n);if(i?.finding)return{id:i.finding.id,fragment:a(i.finding),path:m(i)};if(e&&i?.view!=="home"&&!/\/(?:index|view)\.html$/u.test(n.pathname))return null;let o=A(n.hash);if(!o)return null;let r=a(o);return{id:o.id,fragment:r,path:`/#${r}`}}function l(t,e){if(typeof t!="string")return!1;let n=t.replaceAll("\\","/");return n.startsWith(`${e}/`)||n.includes(`/${e}/`)}function C(t){let e=!1;for(let n of t){for(let i of n.groups??[])for(let o of i){if(l(o.file,"node_modules"))return"node_modules";l(o.file,"vendor")&&(e=!0)}for(let i of Object.keys(n.tree??{})){if(l(i,"node_modules"))return"node_modules";l(i,"vendor")&&(e=!0)}}return e?"vendor":"dependencies"}export{l as a,C as b,T as c,E as d,a as e,O as f,A as g,U as h};

package/out/chunk-4XCDFGDP.js

@@ -1,10 +0,0 @@
-import{d as o}from"./chunk-XYFXXB2G.js";import{b as s,c as i}from"./chunk-C4Z6ZBXV.js";import{g as r}from"./chunk-2XUEZHIP.js";var u=s(class extends i{constructor(){super(...arguments),this.key=r}render(t,e){return this.key=t,e}update(t,[e,m]){return e!==this.key&&(o(t),this.key=e),m}});export{u as a};
-/*! Bundled license information:
-
-lit-html/directives/keyed.js:
-  (**
-   * @license
-   * Copyright 2021 Google LLC
-   * SPDX-License-Identifier: BSD-3-Clause
-   *)
-*/