@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-managed/reviewed-dependencies.ts

@@ -0,0 +1,149 @@
+// The reviewed dependencies a host keeps beyond the app, as it registers
+// them before the server is assembled (server.ts registerReviewedDependencies):
+// an async method telling whether a dependency, as a lockfile locks it, is
+// reviewed there (`lookup`), and, optionally, one reading the reviews of
+// dependencies an open pull request's comments make (`parseComments`,
+// pull-comment-reviews.ts), and one formatting one's own dependency reviews
+// as a comment, for a copy button to give (`formatDependencyReviews`,
+// dependency-review-comments.ts). Registered, they replace the commit a repository
+// is reviewed since (pull-dependency-reviews.ts): a version passes by the
+// reviews its teams publish, and those its pull request's comments make, as
+// many as the repository requires, or by `lookup`'s saying so, and is
+// otherwise unreviewed. A patched version (pnpm's patchedDependencies)
+// passes by `lookup`, or reviews its comments make of its patch, alone, the
+// app reviewing no patch yet. Those comments' reviews count for the pull
+// request alone, as it is open: the host's to keep, as it is merged, among
+// those `lookup` tells of.
+//
+// Each version is asked of `lookup` once a request, as many at once as
+// ASK_AT_ONCE, its answer kept in this instance KEPT_MS; one it fails to
+// answer is unreviewed, and counted so (`unasked`).
+import { type Lru, lru } from './lru.ts'
+
+export type ReviewedLockfile = 'npm' | 'pnpm' | 'yarn1'
+// A dependency as a lockfile locks it: npm's always with its integrity (one
+// with none is never reviewed, nor asked of), its shasum where the lockfile
+// has one (Yarn 1's, after a tarball's `#`), and the hash of its patch where
+// it is patched (pnpm's).
+export interface ReviewedDependency {
+  ecosystem: 'npm'
+  lockfile: ReviewedLockfile
+  name: string
+  version: string
+  integrity?: string
+  shasum?: string
+  patchHash?: string
+}
+export type ReviewVerdict = 'accept' | 'accept-with-nits' | 'request-changes' | 'reject'
+// A comment of an open pull request's, as `parseComments` is given it: one
+// on the pull request (`comment`), a review's own (`review`, whatever its
+// state, a comment's alone too), or one on a line of its diff
+// (`review-comment`); by its author's GitHub login; when it was written, and
+// last edited (`editedAt`) where it was.
+export interface ReviewComment {
+  kind: 'comment' | 'review' | 'review-comment'
+  id: string
+  author: string | null
+  body: string
+  state?: string
+  createdAt: string
+  editedAt?: string
+  url: string
+}
+// What `parseComments` reads: the pull request, its comments, and the
+// dependencies: every one the lockfiles its review holds to add that can be
+// reviewed and `lookup` doesn't pass, and the others still wanting reviews.
+export interface ParseCommentsInput { repository: string; number: number; comments: ReviewComment[]; dependencies: ReviewedDependency[] }
+// A review its comments make, by `user` (a GitHub login, one of their
+// authors'), of each of `dependencies`, with its verdict, as of `time` (when
+// it was made, an ISO date or milliseconds; that user's latest comment's
+// where none is told).
+export interface CommentReview {
+  user: string
+  time?: string | number
+  dependencies: { ecosystem?: 'npm'; name: string; version: string; integrity: string; patchHash?: string; status: ReviewVerdict }[]
+}
+// A version a dependency review is of, or compared it with: its package's
+// name, its version and integrity, and its tarball's shasum and its patch's
+// hash where they are known (a lockfile's, pnpm's patched dependencies').
+export interface ReviewedVersion { name: string; version: string; integrity: string; shasum?: string; patchHash?: string }
+// One of one's own published dependency reviews, as `formatDependencyReviews`
+// is given it: the version it is of (`new`) and the one it compared it with
+// (`old`, none where it read its package whole); its verdict (`status`);
+// whether it read every file (`coverage`, `full`, else `partial`); its final
+// comment; each file's verdict and comment (`files`, of those with either);
+// by whom (`reviewer`, their GitHub login), and when it was published.
+export interface DependencyReviewEntry {
+  ecosystem: 'npm'
+  old: ReviewedVersion | null
+  new: ReviewedVersion
+  status: ReviewVerdict
+  coverage: 'full' | 'partial'
+  comment: string
+  files: { path: string; status: ReviewVerdict | null; comment: string }[]
+  reviewer: string
+  publishedAt: number
+}
+// What `formatDependencyReviews` formats: one's own reviews, never another's,
+// and the pull request whose versions they are of, where its copy asks.
+export interface FormatDependencyReviewsInput { reviews: DependencyReviewEntry[]; pullRequest?: { repository: string; number: number } }
+export interface ReviewedDependencies {
+  lookup(dependency: ReviewedDependency): Promise<boolean>
+  parseComments?(input: ParseCommentsInput): Promise<CommentReview[]>
+  // The comment to copy, none where it is empty, null or undefined.
+  formatDependencyReviews?(input: FormatDependencyReviewsInput): Promise<string | null | undefined>
+}
+
+const ASK_AT_ONCE = 16
+const KEPT_MS = 60_000
+
+let registered: ReviewedDependencies | null = null
+let assembled = false
+// Each lookup's answers, apart.
+const answers = new WeakMap<ReviewedDependencies['lookup'], Lru<{ at: number; reviewed: boolean }>>()
+
+// Registers the host's reviewed dependencies, once, before the server is
+// assembled (init()): a server already assembled keeps what it was given.
+export function registerReviewedDependencies(reviewed: ReviewedDependencies): void {
+  const optional = (method: unknown) => method === undefined || typeof method === 'function'
+  if (typeof reviewed?.lookup !== 'function' || !optional(reviewed.parseComments) || !optional(reviewed.formatDependencyReviews)) {
+    throw new TypeError('registerReviewedDependencies: expected { lookup, parseComments?, formatDependencyReviews? }, async methods')
+  }
+  if (assembled) throw new Error('registerReviewedDependencies: call it before init(), as the server takes them as it is assembled')
+  if (registered) throw new Error('registerReviewedDependencies: reviewed dependencies are registered already')
+  registered = { lookup: reviewed.lookup.bind(reviewed), ...reviewed.parseComments ? { parseComments: reviewed.parseComments.bind(reviewed) } : {},
+    ...reviewed.formatDependencyReviews ? { formatDependencyReviews: reviewed.formatDependencyReviews.bind(reviewed) } : {} }
+}
+
+// The reviewed dependencies registered, as a server takes them once it is
+// assembled; none registers after.
+export function assembledReviewedDependencies(): ReviewedDependencies | null {
+  assembled = true
+  return registered
+}
+
+// Which of `dependencies`, by their keys, `lookup` passes, and how many it
+// failed to answer.
+export async function askReviewed(lookup: ReviewedDependencies['lookup'], dependencies: Map<string, ReviewedDependency>): Promise<{ passed: Set<string>; unasked: number }> {
+  const passed = new Set<string>()
+  let unasked = 0
+  const pending = [...dependencies]
+  const kept = answers.get(lookup) ?? answers.set(lookup, lru(100_000)).get(lookup)!
+  await Promise.all(Array.from({ length: Math.min(ASK_AT_ONCE, pending.length) }, async () => {
+    for (let next = pending.pop(); next; next = pending.pop()) {
+      const [key, dependency] = next
+      const known = kept.get(key)
+      let answer = known && Date.now() - known.at < KEPT_MS ? known.reviewed : null
+      if (answer === null) {
+        try { answer = await lookup({ ...dependency }) === true } catch (error) {
+          unasked++
+          console.warn('reviewed dependencies: failed to answer', `${dependency.name}@${dependency.version}`, error instanceof Error ? error.message : error)
+          continue
+        }
+        kept.set(key, { at: Date.now(), reviewed: answer })
+      }
+      if (answer) passed.add(key)
+    }
+  }))
+  return { passed, unasked }
+}

package/server-managed/session.ts

@@ -5,6 +5,7 @@
 //
 // Async throughout — the store (db.ts) is async so a future non-SQLite
 // backend slots in without touching these helpers.
+import { AsyncLocalStorage } from 'node:async_hooks'
 import type { ManagedConfig } from './config.ts'
 import type { ManagedDb, ManagedSession, ManagedUser, StoredUser } from './db.ts'
 import { hashToken, randomToken } from './crypto.ts'
@@ -13,13 +14,15 @@ import { hashToken, randomToken } from './crypto.ts'
 // `cookieName` when cookies are Secure.
 export const STATE_COOKIE = 'dvstate'
 
-// Base names for GitHub issue authorization state (github-issue-oauth.ts) and
-// an administrator's read-only view as another user (view-as.ts).
+// Base names for GitHub issue authorization state (github-issue-oauth.ts),
+// linking another GitHub account (github-link-oauth.ts) and an
+// administrator's read-only view as another user (view-as.ts).
 export const ISSUE_STATE_COOKIE = 'dvissuestate'
+export const LINK_STATE_COOKIE = 'dvlinkstate'
 export const VIEW_COOKIE = 'dvview'
 // The session cookie cannot share a name with these, or one would overwrite
 // or be read as the other.
-export const RESERVED_COOKIES: readonly string[] = [STATE_COOKIE, ISSUE_STATE_COOKIE, VIEW_COOKIE]
+export const RESERVED_COOKIES: readonly string[] = [STATE_COOKIE, ISSUE_STATE_COOKIE, LINK_STATE_COOKIE, VIEW_COOKIE]
 
 // `__Host-`-prefix the base name when cookies are Secure (the prefix mandates
 // Secure + Path=/ + no Domain, which `buildCookie` already emits).
@@ -55,13 +58,15 @@ export function parseCookies(header: string | undefined): Map<string, string> {
 
 // Mint a session for a freshly-authenticated user. Upserts the identity, then
 // stores the session keyed by the cookie token's hash. Returns the cookie to
-// set and the CSRF token (also persisted on the row).
+// set and the CSRF token (also persisted on the row), or null for an account
+// a user linked to theirs, which can neither sign in nor register.
 export async function createSession(
   config: ManagedConfig, db: ManagedDb, user: ManagedUser, now: number,
-): Promise<{ setCookie: string; csrfToken: string; userId: string }> {
+): Promise<{ setCookie: string; csrfToken: string; userId: string } | null> {
   const token = randomToken()
   const csrfToken = randomToken()
   const userId = await db.upsertUser(user, now, config.initialAdminGithubId)
+  if (userId == null) return null
   await db.createSession({ id: hashToken(token), userId, csrfToken, expiresAt: now + config.sessionTtlMs }, now)
   const setCookie = buildCookie(config.sessionCookieName, token, {
     maxAgeS: Math.floor(config.sessionTtlMs / 1000), secure: config.cookieSecure, sameSite: 'Lax',
@@ -69,19 +74,32 @@ export async function createSession(
   return { setCookie, csrfToken, userId }
 }
 
+// A request's sign-in, whose presence its first read to find it records.
+// Every read after it in that request (the rechecks after its reads of
+// storage, GitHub or npm among them) only reads: last_seen_at was written a
+// moment before, by the read that let the request in.
+const requests = new AsyncLocalStorage<{ seen: boolean }>()
+export function runRequestPresence<T>(work: () => T): T {
+  return requests.run({ seen: false }, work)
+}
+
 // Resolve the current session (+ user) from the request's cookies, or null.
 // A view cookie resolves only to that admin's view as another user: a view
 // that has ended never falls back to the admin's own session. `own` skips the
 // view and reads the signed-in session itself.
-export function readSession(
+export async function readSession(
   config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined, now: number, { own = false } = {},
 ): Promise<{ session: ManagedSession; user: StoredUser } | null> {
   const cookies = parseCookies(cookieHeader)
   const token = cookies.get(config.sessionCookieName)
-  if (token == null || token === '') return Promise.resolve(null)
+  if (token == null || token === '') return null
   const view = own ? undefined : cookies.get(cookieName(config, VIEW_COOKIE))
-  if (view != null && view !== '') return db.viewSessionWithUser(hashToken(view), hashToken(token), now)
-  return db.sessionWithUser(hashToken(token), now)
+  const request = requests.getStore(), seen = request?.seen === true
+  const s = view != null && view !== ''
+    ? await (seen ? db.getViewSessionWithUser : db.viewSessionWithUser)(hashToken(view), hashToken(token), now)
+    : await (seen ? db.getSessionWithUser : db.sessionWithUser)(hashToken(token), now)
+  if (s && request) request.seen = true
+  return s
 }
 
 // Drop the session named by the request's cookie (logout). The caller also

package/server-managed/sql.ts

@@ -19,11 +19,14 @@ export interface ManagedSqlDriver extends ManagedSql {
 // These operations execute exactly one SQL statement. Postgres already gives
 // that statement an atomic snapshot; an explicit BEGIN/COMMIT adds only trips.
 // Lease and cache writes coordinate through their conditional UPSERT/UPDATE alone.
-const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption',
+const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption', 'getTeam', 'getComment',
+  'userCanReadReport', 'userCanReadRepo', 'userCanReadRepoPath', 'userCanReadBundle', 'reportPermissionsFor', 'listComments', 'listManagedIssues',
+  'listTriageHistory', 'listUsers', 'listUserOptions', 'listActivityReports', 'getRepoFullName', 'getSessionWithUser', 'getViewSessionWithUser',
+  'listTriageFixes',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
-  'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
-  'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits'])
+  'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'getFirstUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
+  'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits', 'getAvatarKey', 'listUsersByAccount'])
 // Session presence and upload keys change only their own rows.
 const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensureSessionUploadKey'])
 

package/server-managed/storage-stores.ts

@@ -61,6 +61,11 @@ function avatarStore(objects: ObjectStorage, sidecar: boolean): AvatarStore {
       if (split < 0 || split > 100) throw new Error('Invalid cached avatar')
       return { contentType: bytes.subarray(0, split).toString(), bytes: bytes.subarray(split + 1) }
     },
+    async delete(value) {
+      const path = `avatars/${id(value)}`
+      await objects.delete(path)
+      if (sidecar) await objects.delete(`${path}.type`)
+    },
   }
 }
 

package/server-managed/storage.ts

@@ -15,8 +15,10 @@ import { migrateStorage, reapStorageUploads } from './storage-maintenance.ts'
 // Database-only callers (notably status) must not activate byte encryption.
 export async function openManagedStorageDb(config: ManagedConfig) {
   const options = { triageHistoryLimit: config.triageHistoryLimit, storageEncryptionKey: parseStorageKey(config.storageEncryptionKey) }
-  return config.neonUrl ? openNeonManagedDb(config.neonUrl, options)
-    : (await import('./db.ts')).openSqliteManagedDb(config.dbPath, options)
+  if (!config.neonUrl) return (await import('./db.ts')).openSqliteManagedDb(config.dbPath, options)
+  // Serverless instances hold pooled connections only while an invocation lasts.
+  const attachPool = config.serverless ? (await import('@vercel/functions')).attachDatabasePool : undefined
+  return openNeonManagedDb(config.neonUrl, options, attachPool)
 }
 
 export async function openManagedStorage(config: ManagedConfig) {

package/server-managed/team-app.ts

@@ -8,6 +8,13 @@
 // The same read names the reports a restricted reader would find nothing in:
 // under -deps or -security the catalog leaves those out of the team's list.
 // Readers with both permissions keep every report, empty or not.
+//
+// A team that is not App also says how many of its reports open in App mode
+// on their own, and its findings for the badge it collapses to. None is as
+// uniform as an App team, and collapses like one. A team mixing App and non-App
+// reports stays expanded, and so does one whose reports each open as App but
+// whose combined workspace does not (contradicting verdicts, say): it has App
+// findings, and only expanded does it show that they fail to combine.
 import { reportEntries } from '@preventive/report'
 import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
 import type { BlobStore } from './blob-store.ts'
@@ -48,10 +55,14 @@ function remember(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): Te
   return summary
 }
 
+function isLinks(data: unknown): boolean {
+  const record = data as { source?: unknown; links?: unknown } | null
+  return record?.source === 'links' && Array.isArray(record.links)
+}
+
 // A links document counts by its links, every other report by its findings.
 function hasContent(data: unknown): boolean {
-  const record = data as { source?: unknown; links?: unknown } | null
-  if (record?.source === 'links' && Array.isArray(record.links)) return record.links.length > 0
+  if (isLinks(data)) return (data as { links: unknown[] }).links.length > 0
   return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
 }
 
@@ -79,7 +90,12 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
     }
     const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
     const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
-    return remember(db, key, { app: managedTeamAppMetadata(Object.assign(body.reports, { links: body.links ?? [] })), empty })
+    const links = body.links ?? []
+    const app = managedTeamAppMetadata(Object.assign(body.reports, { links }), { countFindings: true })
+    if (app.appMode) return remember(db, key, { app, empty })
+    const appReports = body.reports.filter(report => !isLinks(report.data)
+      && managedTeamAppMetadata(Object.assign([report], { links })).appMode).length
+    return remember(db, key, { app: { ...app, appReports }, empty })
   })().catch((error: unknown) => {
     if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, NO_APP)
     if (!(error instanceof TeamReportsError)) console.warn('managed: team App classification failed:', error)

package/server-managed/team-reports.ts

@@ -59,6 +59,13 @@ export class TeamReportsError extends Error {
 export function teamSnapshotKey(snapshot: TeamReportAccessSnapshot): string {
   return JSON.stringify([snapshot.user.id, snapshot.user.role, snapshot.teamId, snapshot.hiddenReportId ?? null, snapshot.reports, snapshot.repositories, snapshot.linkRevision])
 }
+// What a built workspace is kept by: everything its build reads, and nothing
+// of who asked. A user's role and grants decide which reports (and which
+// hidden preview) their snapshot holds and each one's permissions, all of it
+// in the key, so members whose snapshots agree share one build.
+function workspaceKey(snapshot: TeamReportAccessSnapshot): string {
+  return JSON.stringify([snapshot.teamId, snapshot.hiddenReportId ?? null, snapshot.reports, snapshot.repositories, snapshot.linkRevision])
+}
 export async function teamSnapshot(db: ManagedDb, sessionId: string, teamId: string, reportId: string | null = null): Promise<TeamReportAccessSnapshot> {
   const snapshot = await db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, reportId)
   if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
@@ -145,15 +152,15 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   if (outputBytes + suffix.length > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
   parts.push(suffix)
   const body = Buffer.concat(parts)
-  retainVisibility(db, teamSnapshotKey(snapshot), visible)
-  retainReports(db, teamSnapshotKey(snapshot), body)
+  retainVisibility(db, workspaceKey(snapshot), visible)
+  retainReports(db, workspaceKey(snapshot), body)
   return { body, visible }
 }
 const pendingWorkspaces = new WeakMap<ManagedDb, Map<string, ReturnType<typeof buildTeamWorkspace>>>()
 async function loadTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot) {
   let pending = pendingWorkspaces.get(db)
   if (!pending) { pending = new Map(); pendingWorkspaces.set(db, pending) }
-  const key = teamSnapshotKey(snapshot)
+  const key = workspaceKey(snapshot)
   const existing = pending.get(key)
   if (existing) return existing
   const job = buildTeamWorkspace(db, store, snapshot)
@@ -163,7 +170,7 @@ async function loadTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Team
 // Treat the encoded body as immutable and recheck access before sending it.
 // Warm HTTP reads need neither a parsed copy nor another serialization pass.
 export async function loadTeamReportsResponse(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Buffer> {
-  const cached = reportCaches.get(db)?.get(teamSnapshotKey(snapshot))
+  const cached = reportCaches.get(db)?.get(workspaceKey(snapshot))
   return cached ?? (await loadTeamWorkspace(db, store, snapshot)).body
 }
 export async function loadTeamReports(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<TeamReport[]> {
@@ -172,8 +179,7 @@ export async function loadTeamReports(db: ManagedDb, store: BlobStore, snapshot:
   return (JSON.parse(body.toString('utf8')) as { reports: TeamReport[] }).reports
 }
 async function teamVisibility(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Visibility> {
-  const key = teamSnapshotKey(snapshot)
-  let visible = caches.get(db)?.get(key)
+  let visible = caches.get(db)?.get(workspaceKey(snapshot))
   if (!visible) {
     // A large snapshot may deliberately remain uncached, or be evicted by
     // another request. Authorization uses this load's result in either case.
@@ -191,17 +197,23 @@ export async function teamReportVisibility(db: ManagedDb, store: BlobStore, snap
   const visible = await teamVisibility(db, store, snapshot)
   return visible.get(reportId)!
 }
-export async function teamFindingIds(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
+// A report's visibility for the session's current snapshot. A workspace built
+// (or waited for) here outlives that snapshot's read, so the team's access is
+// read again after it; one kept is answered with no read in between, which
+// leaves nothing for another snapshot read to guard.
+async function sessionReportVisibility(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<ReportVisibility> {
   const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
+  const kept = caches.get(db)?.get(workspaceKey(snapshot))?.get(reportId)
+  if (kept) return kept
   const visible = await teamReportVisibility(db, store, snapshot, reportId)
   await recheckTeam(db, sessionId, snapshot)
-  return visible.ids
+  return visible
+}
+export async function teamFindingIds(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
+  return (await sessionReportVisibility(db, store, sessionId, teamId, reportId)).ids
 }
 export async function teamSourcePaths(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
-  const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
-  const visible = await teamReportVisibility(db, store, snapshot, reportId)
-  await recheckTeam(db, sessionId, snapshot)
-  return visible.sourcePaths
+  return (await sessionReportVisibility(db, store, sessionId, teamId, reportId)).sourcePaths
 }
 
 // Serialize shared annotation bodies once. Reports carry only the annotated

package/server-managed/upstream-cache.ts

@@ -26,6 +26,9 @@ export interface UpstreamCacheStore {
   getUpstreamCacheEntry(key: string): Promise<string | null>
   // Key → value for those of `keys` that are kept.
   getUpstreamCacheEntries(keys: string[]): Promise<Map<string, string>>
+  // Those of `first` that are kept; where none is, those of `then`, in the
+  // same statement (`first` whether they are `first`'s).
+  getFirstUpstreamCacheEntries(first: string[], then: string[]): Promise<{ first: boolean; entries: Map<string, string> }>
   setUpstreamCacheEntry(key: string, value: string, cachedAt: number): Promise<void>
   // Each of `entries` (key, value), as setUpstreamCacheEntry keeps one, in one
   // statement: the last of a key given twice.
@@ -38,6 +41,10 @@ export interface UpstreamCacheStore {
 export function upstreamCacheMethods(db: ManagedSql): UpstreamCacheStore {
   const get = db.prepare('SELECT value FROM managed_upstream_cache WHERE cache_key = ?')
   const getMany = db.prepare('SELECT cache_key, value FROM managed_upstream_cache WHERE cache_key IN (SELECT value FROM json_each(?))')
+  const getFirst = db.prepare(`WITH found AS (SELECT cache_key, value FROM managed_upstream_cache WHERE cache_key IN (SELECT value FROM json_each(?)))
+    SELECT cache_key, value, 1 AS in_first FROM found
+    UNION ALL SELECT cache_key, value, 0 AS in_first FROM managed_upstream_cache
+      WHERE cache_key IN (SELECT value FROM json_each(?)) AND NOT EXISTS (SELECT 1 FROM found)`)
   // A slower concurrent audit cannot replace a newer listing with an older one.
   const set = db.prepare(`INSERT INTO managed_upstream_cache (cache_key, value, cached_at) VALUES (?, ?, ?)
     ON CONFLICT (cache_key) DO UPDATE SET value = excluded.value, cached_at = excluded.cached_at
@@ -55,6 +62,11 @@ export function upstreamCacheMethods(db: ManagedSql): UpstreamCacheStore {
       const rows = await getMany.all(JSON.stringify(keys)) as { cache_key: string; value: string }[]
       return new Map(rows.map(row => [row.cache_key, row.value]))
     },
+    async getFirstUpstreamCacheEntries(first, then) {
+      if (first.length === 0 && then.length === 0) return { first: false, entries: new Map() }
+      const rows = await getFirst.all(JSON.stringify(first), JSON.stringify(then)) as { cache_key: string; value: string; in_first: number }[]
+      return { first: rows.some(row => Number(row.in_first) === 1), entries: new Map(rows.map(row => [row.cache_key, row.value])) }
+    },
     async setUpstreamCacheEntry(key, value, cachedAt) {
       await set.run(key, value, cachedAt)
     },

package/server-managed/workspace-shares.ts

@@ -145,15 +145,18 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       const links = await linkRevision(db)
       const bundleRows = (await q.bundles.all(team.id) as (Omit<ManagedBundle, 'buildConditions'> & { buildConditions: string | null; repoFullName: string })[])
         .map(row => ({ ...row, buildConditions: row.buildConditions == null ? null : JSON.parse(row.buildConditions) as BundleBuildConditions }))
+      const repositories = await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories']
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
         teamId: team.id,
         linkRevision: links,
         permissions,
-        repositories: await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories'],
+        repositories,
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
         team: { ...team, permissions, cacheKey: links,
+          repos: repositories.map(repo => ({ repoId: repo.repoId, fullName: repo.github, path: repo.path || null }))
+            .toSorted((a, b) => a.fullName.localeCompare(b.fullName) || (a.path ?? '').localeCompare(b.path ?? '')),
           reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, visible: true, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions, links]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,

package/server.ts

@@ -2,6 +2,17 @@ import { parseArgs } from 'node:util'
 import type { Server } from 'node:http'
 import { startServer } from './server-common/standalone.ts'
 
+// The reviewed dependencies a host keeps beyond the app, registered before
+// init() (server-managed/reviewed-dependencies.ts): an async method telling
+// whether a dependency, as a lockfile locks it, is reviewed there
+// (`lookup`), and optionally one reading the reviews an open pull request's
+// comments make (`parseComments`), and one formatting one's own dependency
+// reviews as a comment to copy (`formatDependencyReviews`). They replace a
+// repository's commit its dependencies are reviewed since.
+export { registerReviewedDependencies } from './server-managed/reviewed-dependencies.ts'
+export type { CommentReview, DependencyReviewEntry, FormatDependencyReviewsInput, ParseCommentsInput, ReviewComment, ReviewedDependencies, ReviewedDependency,
+  ReviewedLockfile, ReviewedVersion, ReviewVerdict } from './server-managed/reviewed-dependencies.ts'
+
 const modes = ['e2e', 'managed', 'managed-e2e', 'e2e-managed'] as const
 export type ServerMode = typeof modes[number]
 
@@ -10,20 +21,29 @@ function parseMode(mode: string): ServerMode {
   throw new Error(`Unknown mode: ${mode}. Expected ${modes.join(', ')}.`)
 }
 
+export type InitOptions = {
+  mode?: ServerMode
+  // False serves only the API: `out/` is never read, nor its UI served, for
+  // hosts that serve the UI themselves.
+  ui?: boolean
+}
+
 // Assemble the selected server without binding a port. Hosts can reuse its
-// request/upgrade listeners or call listen() themselves.
-export async function init(mode: ServerMode = 'e2e'): Promise<Server> {
+// request/upgrade listeners or call listen() themselves. `init(mode)` is
+// `init({ mode })`.
+export async function init(options: ServerMode | InitOptions = {}): Promise<Server> {
+  const { mode = 'e2e', ui = true }: InitOptions = typeof options === 'string' ? { mode: options } : options
   const selected = parseMode(mode)
   if (selected === 'e2e') {
     const { createE2eApp } = await import('./server-e2e/app.ts')
-    return (await createE2eApp()).httpServer
+    return (await createE2eApp(undefined, { ui })).httpServer
   }
   if (selected === 'managed') {
     const managed = await import('./server-managed/index.ts')
-    return managed.init()
+    return managed.init(undefined, { ui })
   }
   const combined = await import('./server-managed/combined.ts')
-  return combined.init(selected === 'managed-e2e' ? 'managed+e2e' : 'e2e+managed')
+  return combined.init(selected === 'managed-e2e' ? 'managed+e2e' : 'e2e+managed', { ui })
 }
 
 export async function start(): Promise<void> {