@preventive/triage 1.0.0-alpha.48 → 1.0.0-alpha.49

package/out/view.js

@@ -1,4 +1,4 @@
-import"./chunk-R3NZFXVR.js";import{a as e,b as t,e as n,f as r,g as i,i as a}from"./chunk-MOACFRJ4.js";import{$b as o,$c as s,Ab as c,Ac as l,Ba as u,Bb as d,Bc as f,Bd as p,C as m,Cc as h,Cd as g,D as ee,Dc as te,Dd as ne,Ec as re,Ed as ie,Ee as ae,Fc as _,Fd as oe,Fe as se,G as ce,Ge as le,H as ue,He as de,I as fe,Ib as pe,Ie as me,K as he,Kb as ge,Kd as _e,L as v,Ld as ve,Mb as ye,N as be,Nc as xe,Ob as Se,Oc as Ce,P as we,Pb as Te,Q as Ee,Qb as De,R as Oe,Rb as ke,S as Ae,Sb as je,T as y,Tb as Me,Tc as Ne,Ua as Pe,Ub as Fe,Uc as Ie,V as Le,Va as Re,Vb as ze,Vc as Be,Wa as Ve,Wc as He,Xa as Ue,Xb as b,Xc as We,Ya as Ge,Yb as Ke,Yc as qe,Zb as Je,Zc as Ye,_b as Xe,ac as Ze,ad as Qe,bc as $e,bd as et,be as tt,c as nt,cb as rt,cc as x,ce as it,d as S,db as at,dc as ot,de as st,e as ct,eb as C,ec as lt,f as ut,fc as dt,fe as ft,gb as pt,gc as w,ge as mt,gf as ht,h as gt,hb as T,hc as _t,he as vt,hf as yt,i as bt,ia as xt,ib as St,ic as Ct,ie as E,if as wt,ja as Tt,jb as Et,jc as Dt,je as Ot,jf as D,k as kt,ka as At,kc as jt,ke as Mt,kf as Nt,l as Pt,la as Ft,lb as It,lc as Lt,le as Rt,lf as zt,m as Bt,ma as Vt,mb as Ht,mc as Ut,me as O,na as Wt,nc as Gt,nd as Kt,ne as qt,o as Jt,oa as Yt,oc as Xt,oe as Zt,of as Qt,p as $t,pc as en,pe as tn,pf as nn,q as rn,qc as an,qe as on,qf as sn,r as cn,ra as ln,rc as un,rf as dn,s as fn,sc as k,sf as pn,t as mn,tc as A,te as hn,ue as gn,v as _n,vb as vn,ve as yn,w as j,wb as bn,x as M,xb as xn,xc as Sn,y as Cn,yb as wn,yc as Tn,zb as En,zc as Dn}from"./chunk-PENGGKX7.js";import"./chunk-JCIIBLKR.js";import"./chunk-VH4XMZIW.js";import{d as On}from"./chunk-O6M574JI.js";import{D as kn,L as An,N as jn,T as Mn,Y as Nn,_ as N,b as Pn,n as Fn,t as In,u as Ln,v as Rn,x as zn,y as Bn}from"./chunk-6LNQTKAV.js";import{f as Vn,g as Hn}from"./chunk-7VAWINQF.js";import"./chunk-NRPC74AM.js";import"./chunk-7BKKYVWR.js";import{f as P}from"./chunk-7C7DWL7I.js";import"./chunk-PNHBZGDD.js";import"./chunk-VFWMQ3LG.js";import{C as Un,D as Wn,J as Gn,K as Kn,M as qn,S as Jn,V as Yn,W as Xn,Z as Zn,_ as Qn,a as F,b as $n,d as I,e as L,ea as er,f as tr,ga as nr,ia as rr,j as ir,r as ar,s as or,u as sr}from"./chunk-C2AVODGZ.js";import{g as cr}from"./chunk-IO7JTZ6O.js";import"./chunk-WCPJDAYA.js";import"./chunk-IYPY47MC.js";import{a as lr,d as ur}from"./chunk-PWFUOLZK.js";import{a as dr,g as fr,h as pr,n as mr,o as hr,q as gr}from"./chunk-BC2UCLFJ.js";import{B as _r,I as vr,l as yr}from"./chunk-SXV2T5C4.js";import{d as br,i as xr,k as Sr,l as Cr,q as wr,w as Tr}from"./chunk-WFYLMF6Z.js";import"./chunk-C4Z6ZBXV.js";import{a as R,b as Er,c as z,g as B,i as Dr,j as V}from"./chunk-2XUEZHIP.js";import"./chunk-TUII34K2.js";import"./chunk-OOJM4CTU.js";var Or={attach:{title:`Synced triage on report attach`,intro:`have triage from your workspace that disagrees with your local view on`,trailingNote:`Other findings in this report whose chain value didn't conflict were applied automatically; this list only covers disagreements. Pick which side to keep.`,importedSideLabel:`Apply from chain`,applyButton:`Apply`},chain:{title:`Triage conflict from peer update`,intro:`were changed by a peer (or by another tab) in a way that disagrees with your local triage on`,trailingNote:`Other findings whose remote value didn't conflict were applied automatically; this list only covers disagreements. Pick which side to keep for each — a "keep current" pick re-publishes your local value to the chain on your next save.`,importedSideLabel:`Apply from chain`,applyButton:`Apply`}};function kr(){d(async(e,t,n)=>{let r=we(e);try{return await vn(e,r,Or[n]??Or.attach)}catch{let t=e.length;return alert(`${n===`attach`?`A report attach`:`A workspace sync`} had ${t} triage disagreement${t===1?``:`s`} with your local view. Kept your local values because another dialog is open. ${n===`attach`?`Detach and re-attach the report to pick again.`:`Your local values will re-publish to the chain on the next change.`}`),null}})}var Ar=class extends It{static properties={retry:{type:Boolean},_value:{state:!0}};constructor(){super(),this.retry=!1,this._value=``}_finish(e){this._value=``,super._finish(e)}_onCancel=()=>this._finish(null);_onInput=e=>{this._value=e.target.value};_onSubmit=()=>{let e=this._value??``;e&&this._finish(e)};_onKeydown=e=>{e.key===`Enter`&&(e.preventDefault(),this._onSubmit())};render(){let e=(this._value??``).length>0,t=this.retry?`That password didn't match. Try again, or cancel to leave the workspace unsynced for now.`:`This sync server requires a password before it accepts a new workspace. Enter it to create the workspace on the server.`;return z`<dialog @close="${this._onClose}"><header><h3>Sync server password</h3></header><p class="nwd-intro">${t}</p><input type="password" class="nwd-input" placeholder="Password" autocomplete="off" data-1p-ignore="true" data-lpignore="true" data-bwignore="true" data-form-type="other" name="dv-sync-auth" maxlength="4096" .value="${this._value}" @input="${this._onInput}" @keydown="${this._onKeydown}"><footer class="nwd-actions"><span class="nwd-spacer"></span> <button type="button" @click="${this._onCancel}">Cancel</button> <button type="button" class="primary" ?disabled="${!e}" @click="${this._onSubmit}">${this.retry?`Retry`:`Authenticate`}</button></footer></dialog>`}};customElements.define(`sync-auth-dialog`,Ar);function jr({retry:e=!1}={}){return Ht(`sync-auth-dialog`,{retry:!!e})}function Mr(){c(async({retry:e})=>{try{return await jr({retry:e})}catch(e){return console.warn(`Sync auth dialog failed to open:`,e),null}})}var Nr=`https://triage.space/`,Pr=[{hostname:`deepaudit.dev`,pathPrefix:`/`,supportsSync:!0},{hostname:`chalker.github.io`,pathPrefix:`/deepview/`,supportsSync:!1}];function Fr(){for(let e of Pr)if(location.hostname===e.hostname&&location.pathname.startsWith(e.pathPrefix))return e;return null}var Ir=[`deepview.triage`,`deepview.triage.pending`],Lr=`deepview.repoUrls`;function Rr(){try{for(let e of Ir)if(localStorage.getItem(e))return!0}catch{return!0}try{let e=localStorage.getItem(Lr);if(e){let t=JSON.parse(e);if(t&&typeof t==`object`&&Object.keys(t).length>0)return!0}}catch{return!0}return!1}async function zr(){if(Rr())return!0;let e=[];try{e=await Cn()}catch{return!0}if(e.length>0)return!0;try{if(v().length>0)return!0}catch{return!0}try{return await m()}catch{return!0}}var Br=class extends V{static properties={supportsSync:{attribute:!1}};createRenderRoot(){return this}constructor(){super(),this.supportsSync=!1}firstUpdated(){let e=this.querySelector(`dialog`);e&&e.showModal();let t=this.querySelector(`button.om-stay`);t&&t.focus()}_finish(e){if(this._settled)return;this._settled=!0;let t=this.querySelector(`dialog`);t&&t.close(),this.dispatchEvent(new CustomEvent(`resolve`,{detail:e}))}_onClose=()=>this._finish(!1);_onStay=()=>this._finish(!1);_onMigrate=()=>this._finish(!0);render(){let e=()=>z`<a class="om-link" href="${Nr}" target="_blank" rel="noopener noreferrer">${Nr}</a>`;return z`<dialog class="origin-migration-dialog" @close="${this._onClose}"><header class="om-head"><h3>This deepview build has moved</h3><p><code>${location.host}${location.pathname}</code> has moved to ${e()}.</p></header><section class="om-body"><p>Workspaces and reports don't migrate automatically — they live in this origin's browser storage (OPFS where available, localStorage as a fallback) and have to be re-imported on ${e()}.</p>${this.supportsSync?z`<p>For each workspace, use the <strong>Export workspace</strong> button in the sidebar to download a <code>.gz</code> bundle (workspace + its reports + its triage), then drop that file on ${e()}. Workspaces that had sync configured will pick their triage state back up from the sync server once you re-import them with the same key.</p><p>For triage attached to loose reports (or as a top-up after re-importing workspaces), call <code>DeepView.export()</code> in the browser console — that downloads just the triage entries plus saved repo URLs, no reports or workspaces.</p>`:z`<p>This build has no sync layer. For each workspace, use the <strong>Export workspace</strong> button in the sidebar to download a <code>.gz</code> bundle (workspace + its reports + its triage), then drop that file on ${e()}.</p><p>For triage attached to loose reports, call <code>DeepView.export()</code> in the browser console — that downloads just the triage entries plus saved repo URLs, no reports or workspaces. Reports themselves need to be re-dropped from their original JSON on the new origin.</p>`}</section><footer class="om-actions"><button type="button" class="om-stay" @click="${this._onStay}">Keep editing on ${location.host}</button> <button type="button" class="primary om-go" @click="${this._onMigrate}">Switch to triage.space</button></footer></dialog>`}};customElements.define(`origin-migration-dialog`,Br);function Vr(e){return new Promise(t=>{let n=document.createElement(`origin-migration-dialog`);n.supportsSync=e.supportsSync,n.addEventListener(`resolve`,e=>{n.remove(),t(!!e.detail)}),document.body.append(n)})}async function Hr(){let e=Fr();return e?await zr()?await Vr(e)?(location.assign(Nr),!0):!1:(location.replace(Nr),!0):!1}var H=null,Ur=!1,Wr=null;function Gr(e){if(!e)return`Could not unlock. Try again.`;switch(e.name??``){case`NotAllowedError`:case`AbortError`:return``;case`SecurityError`:return`The site identity does not match the one this passkey was registered for. If you opened DeepView through a different URL (different subdomain, different port), reload via the original URL.`;case`InvalidStateError`:return`The passkey state on this device is inconsistent. Try reloading the page or removing and re-creating the passkey.`;case`NotSupportedError`:return`This browser does not support the WebAuthn PRF extension this site needs. Try a recent Chrome, Safari, or Edge with a platform authenticator.`;case`NetworkError`:return`A network error prevented the passkey from completing. Check your connection and try again.`;case`UnknownError`:return`The authenticator returned an unknown error. Try again, or use a different passkey.`;default:{let t=e.message??String(e);return t.length>200?t.slice(0,197)+`…`:t}}}function Kr(){if(H)return H;H=document.createElement(`div`),H.id=`lock-overlay`,H.setAttribute(`role`,`dialog`),H.setAttribute(`aria-modal`,`true`),H.setAttribute(`aria-label`,`Unlock DeepView`),Dr(z`<div class="lock-overlay-card"><div class="lock-overlay-icon" aria-hidden="true"><svg viewBox="0 0 32 32" width="40" height="40" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="7" y="15" width="18" height="12" rx="1.5"/><path d="M11 15v-4a5 5 0 0 1 10 0v4"/></svg></div><h2 class="lock-overlay-title">DeepView is locked</h2><p class="lock-overlay-body">Your triage data and reports are encrypted with a passkey on this device. Unlock to continue.</p><p class="lock-overlay-error" hidden></p><button type="button" class="lock-overlay-button primary">Unlock with passkey</button><p class="lock-overlay-footer">Lost your passkey? <a href="#" class="lock-overlay-wipe">Wipe local data and start over</a></p></div>`,H);let e=H.querySelector(`button`),t=H.querySelector(`.lock-overlay-error`);return e.addEventListener(`click`,async()=>{if(!Ur&&qr()){Ur=!0,t.hidden=!0,t.textContent=``,e.disabled=!0,e.textContent=`Waiting…`,Wr=new AbortController;try{await bt({signal:Wr.signal})}catch(e){let n=Gr(e);t.textContent=n,t.hidden=!n}finally{Ur=!1,Wr=null,e.disabled=!1,e.textContent=`Unlock with passkey`}}}),H.querySelector(`.lock-overlay-wipe`).addEventListener(`click`,async e=>{if(e.preventDefault(),!Ur&&qr()&&confirm(`Wipe ALL local DeepView data and start over?
+import"./chunk-R3NZFXVR.js";import{a as e,b as t,e as n,f as r,g as i,i as a}from"./chunk-ULIF7A7N.js";import{$b as o,$c as s,Ab as c,Ac as l,Ba as u,Bb as d,Bc as f,Bd as p,C as m,Cc as h,Cd as g,D as ee,Dc as te,Dd as ne,Ec as re,Ed as ie,Ee as ae,Fc as _,Fd as oe,Fe as se,G as ce,Ge as le,H as ue,He as de,I as fe,Ib as pe,Ie as me,K as he,Kb as ge,Kd as _e,L as v,Ld as ve,Mb as ye,N as be,Nc as xe,Ob as Se,Oc as Ce,P as we,Pb as Te,Q as Ee,Qb as De,R as Oe,Rb as ke,S as Ae,Sb as je,T as y,Tb as Me,Tc as Ne,Ua as Pe,Ub as Fe,Uc as Ie,V as Le,Va as Re,Vb as ze,Vc as Be,Wa as Ve,Wc as He,Xa as Ue,Xb as b,Xc as We,Ya as Ge,Yb as Ke,Yc as qe,Zb as Je,Zc as Ye,_b as Xe,ac as Ze,ad as Qe,bc as $e,bd as et,be as tt,c as nt,cb as rt,cc as x,ce as it,d as S,db as at,dc as ot,de as st,e as ct,eb as C,ec as lt,f as ut,fc as dt,fe as ft,gb as pt,gc as w,ge as mt,gf as ht,h as gt,hb as T,hc as _t,he as vt,hf as yt,i as bt,ia as xt,ib as St,ic as Ct,ie as E,if as wt,ja as Tt,jb as Et,jc as Dt,je as Ot,jf as D,k as kt,ka as At,kc as jt,ke as Mt,kf as Nt,l as Pt,la as Ft,lb as It,lc as Lt,le as Rt,lf as zt,m as Bt,ma as Vt,mb as Ht,mc as Ut,me as O,na as Wt,nc as Gt,nd as Kt,ne as qt,o as Jt,oa as Yt,oc as Xt,oe as Zt,of as Qt,p as $t,pc as en,pe as tn,pf as nn,q as rn,qc as an,qe as on,qf as sn,r as cn,ra as ln,rc as un,rf as dn,s as fn,sc as k,sf as pn,t as mn,tc as A,te as hn,ue as gn,v as _n,vb as vn,ve as yn,w as j,wb as bn,x as M,xb as xn,xc as Sn,y as Cn,yb as wn,yc as Tn,zb as En,zc as Dn}from"./chunk-JEAUAJVF.js";import"./chunk-JCIIBLKR.js";import"./chunk-VH4XMZIW.js";import{d as On}from"./chunk-O6M574JI.js";import{D as kn,L as An,N as jn,T as Mn,Y as Nn,_ as N,b as Pn,n as Fn,t as In,u as Ln,v as Rn,x as zn,y as Bn}from"./chunk-6LNQTKAV.js";import{f as Vn,g as Hn}from"./chunk-7VAWINQF.js";import"./chunk-NRPC74AM.js";import"./chunk-7BKKYVWR.js";import{f as P}from"./chunk-7C7DWL7I.js";import"./chunk-PNHBZGDD.js";import"./chunk-VFWMQ3LG.js";import{C as Un,D as Wn,J as Gn,K as Kn,M as qn,S as Jn,V as Yn,W as Xn,Z as Zn,_ as Qn,a as F,b as $n,d as I,e as L,ea as er,f as tr,ga as nr,ia as rr,j as ir,r as ar,s as or,u as sr}from"./chunk-C2AVODGZ.js";import{g as cr}from"./chunk-IO7JTZ6O.js";import"./chunk-WCPJDAYA.js";import"./chunk-IYPY47MC.js";import{a as lr,d as ur}from"./chunk-PWFUOLZK.js";import{a as dr,g as fr,h as pr,n as mr,o as hr,q as gr}from"./chunk-BC2UCLFJ.js";import{B as _r,I as vr,l as yr}from"./chunk-SXV2T5C4.js";import{d as br,i as xr,k as Sr,l as Cr,q as wr,w as Tr}from"./chunk-WFYLMF6Z.js";import"./chunk-C4Z6ZBXV.js";import{a as R,b as Er,c as z,g as B,i as Dr,j as V}from"./chunk-2XUEZHIP.js";import"./chunk-TUII34K2.js";import"./chunk-OOJM4CTU.js";var Or={attach:{title:`Synced triage on report attach`,intro:`have triage from your workspace that disagrees with your local view on`,trailingNote:`Other findings in this report whose chain value didn't conflict were applied automatically; this list only covers disagreements. Pick which side to keep.`,importedSideLabel:`Apply from chain`,applyButton:`Apply`},chain:{title:`Triage conflict from peer update`,intro:`were changed by a peer (or by another tab) in a way that disagrees with your local triage on`,trailingNote:`Other findings whose remote value didn't conflict were applied automatically; this list only covers disagreements. Pick which side to keep for each — a "keep current" pick re-publishes your local value to the chain on your next save.`,importedSideLabel:`Apply from chain`,applyButton:`Apply`}};function kr(){d(async(e,t,n)=>{let r=we(e);try{return await vn(e,r,Or[n]??Or.attach)}catch{let t=e.length;return alert(`${n===`attach`?`A report attach`:`A workspace sync`} had ${t} triage disagreement${t===1?``:`s`} with your local view. Kept your local values because another dialog is open. ${n===`attach`?`Detach and re-attach the report to pick again.`:`Your local values will re-publish to the chain on the next change.`}`),null}})}var Ar=class extends It{static properties={retry:{type:Boolean},_value:{state:!0}};constructor(){super(),this.retry=!1,this._value=``}_finish(e){this._value=``,super._finish(e)}_onCancel=()=>this._finish(null);_onInput=e=>{this._value=e.target.value};_onSubmit=()=>{let e=this._value??``;e&&this._finish(e)};_onKeydown=e=>{e.key===`Enter`&&(e.preventDefault(),this._onSubmit())};render(){let e=(this._value??``).length>0,t=this.retry?`That password didn't match. Try again, or cancel to leave the workspace unsynced for now.`:`This sync server requires a password before it accepts a new workspace. Enter it to create the workspace on the server.`;return z`<dialog @close="${this._onClose}"><header><h3>Sync server password</h3></header><p class="nwd-intro">${t}</p><input type="password" class="nwd-input" placeholder="Password" autocomplete="off" data-1p-ignore="true" data-lpignore="true" data-bwignore="true" data-form-type="other" name="dv-sync-auth" maxlength="4096" .value="${this._value}" @input="${this._onInput}" @keydown="${this._onKeydown}"><footer class="nwd-actions"><span class="nwd-spacer"></span> <button type="button" @click="${this._onCancel}">Cancel</button> <button type="button" class="primary" ?disabled="${!e}" @click="${this._onSubmit}">${this.retry?`Retry`:`Authenticate`}</button></footer></dialog>`}};customElements.define(`sync-auth-dialog`,Ar);function jr({retry:e=!1}={}){return Ht(`sync-auth-dialog`,{retry:!!e})}function Mr(){c(async({retry:e})=>{try{return await jr({retry:e})}catch(e){return console.warn(`Sync auth dialog failed to open:`,e),null}})}var Nr=`https://triage.space/`,Pr=[{hostname:`deepaudit.dev`,pathPrefix:`/`,supportsSync:!0},{hostname:`chalker.github.io`,pathPrefix:`/deepview/`,supportsSync:!1}];function Fr(){for(let e of Pr)if(location.hostname===e.hostname&&location.pathname.startsWith(e.pathPrefix))return e;return null}var Ir=[`deepview.triage`,`deepview.triage.pending`],Lr=`deepview.repoUrls`;function Rr(){try{for(let e of Ir)if(localStorage.getItem(e))return!0}catch{return!0}try{let e=localStorage.getItem(Lr);if(e){let t=JSON.parse(e);if(t&&typeof t==`object`&&Object.keys(t).length>0)return!0}}catch{return!0}return!1}async function zr(){if(Rr())return!0;let e=[];try{e=await Cn()}catch{return!0}if(e.length>0)return!0;try{if(v().length>0)return!0}catch{return!0}try{return await m()}catch{return!0}}var Br=class extends V{static properties={supportsSync:{attribute:!1}};createRenderRoot(){return this}constructor(){super(),this.supportsSync=!1}firstUpdated(){let e=this.querySelector(`dialog`);e&&e.showModal();let t=this.querySelector(`button.om-stay`);t&&t.focus()}_finish(e){if(this._settled)return;this._settled=!0;let t=this.querySelector(`dialog`);t&&t.close(),this.dispatchEvent(new CustomEvent(`resolve`,{detail:e}))}_onClose=()=>this._finish(!1);_onStay=()=>this._finish(!1);_onMigrate=()=>this._finish(!0);render(){let e=()=>z`<a class="om-link" href="${Nr}" target="_blank" rel="noopener noreferrer">${Nr}</a>`;return z`<dialog class="origin-migration-dialog" @close="${this._onClose}"><header class="om-head"><h3>This deepview build has moved</h3><p><code>${location.host}${location.pathname}</code> has moved to ${e()}.</p></header><section class="om-body"><p>Workspaces and reports don't migrate automatically — they live in this origin's browser storage (OPFS where available, localStorage as a fallback) and have to be re-imported on ${e()}.</p>${this.supportsSync?z`<p>For each workspace, use the <strong>Export workspace</strong> button in the sidebar to download a <code>.gz</code> bundle (workspace + its reports + its triage), then drop that file on ${e()}. Workspaces that had sync configured will pick their triage state back up from the sync server once you re-import them with the same key.</p><p>For triage attached to loose reports (or as a top-up after re-importing workspaces), call <code>DeepView.export()</code> in the browser console — that downloads just the triage entries plus saved repo URLs, no reports or workspaces.</p>`:z`<p>This build has no sync layer. For each workspace, use the <strong>Export workspace</strong> button in the sidebar to download a <code>.gz</code> bundle (workspace + its reports + its triage), then drop that file on ${e()}.</p><p>For triage attached to loose reports, call <code>DeepView.export()</code> in the browser console — that downloads just the triage entries plus saved repo URLs, no reports or workspaces. Reports themselves need to be re-dropped from their original JSON on the new origin.</p>`}</section><footer class="om-actions"><button type="button" class="om-stay" @click="${this._onStay}">Keep editing on ${location.host}</button> <button type="button" class="primary om-go" @click="${this._onMigrate}">Switch to triage.space</button></footer></dialog>`}};customElements.define(`origin-migration-dialog`,Br);function Vr(e){return new Promise(t=>{let n=document.createElement(`origin-migration-dialog`);n.supportsSync=e.supportsSync,n.addEventListener(`resolve`,e=>{n.remove(),t(!!e.detail)}),document.body.append(n)})}async function Hr(){let e=Fr();return e?await zr()?await Vr(e)?(location.assign(Nr),!0):!1:(location.replace(Nr),!0):!1}var H=null,Ur=!1,Wr=null;function Gr(e){if(!e)return`Could not unlock. Try again.`;switch(e.name??``){case`NotAllowedError`:case`AbortError`:return``;case`SecurityError`:return`The site identity does not match the one this passkey was registered for. If you opened DeepView through a different URL (different subdomain, different port), reload via the original URL.`;case`InvalidStateError`:return`The passkey state on this device is inconsistent. Try reloading the page or removing and re-creating the passkey.`;case`NotSupportedError`:return`This browser does not support the WebAuthn PRF extension this site needs. Try a recent Chrome, Safari, or Edge with a platform authenticator.`;case`NetworkError`:return`A network error prevented the passkey from completing. Check your connection and try again.`;case`UnknownError`:return`The authenticator returned an unknown error. Try again, or use a different passkey.`;default:{let t=e.message??String(e);return t.length>200?t.slice(0,197)+`…`:t}}}function Kr(){if(H)return H;H=document.createElement(`div`),H.id=`lock-overlay`,H.setAttribute(`role`,`dialog`),H.setAttribute(`aria-modal`,`true`),H.setAttribute(`aria-label`,`Unlock DeepView`),Dr(z`<div class="lock-overlay-card"><div class="lock-overlay-icon" aria-hidden="true"><svg viewBox="0 0 32 32" width="40" height="40" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="7" y="15" width="18" height="12" rx="1.5"/><path d="M11 15v-4a5 5 0 0 1 10 0v4"/></svg></div><h2 class="lock-overlay-title">DeepView is locked</h2><p class="lock-overlay-body">Your triage data and reports are encrypted with a passkey on this device. Unlock to continue.</p><p class="lock-overlay-error" hidden></p><button type="button" class="lock-overlay-button primary">Unlock with passkey</button><p class="lock-overlay-footer">Lost your passkey? <a href="#" class="lock-overlay-wipe">Wipe local data and start over</a></p></div>`,H);let e=H.querySelector(`button`),t=H.querySelector(`.lock-overlay-error`);return e.addEventListener(`click`,async()=>{if(!Ur&&qr()){Ur=!0,t.hidden=!0,t.textContent=``,e.disabled=!0,e.textContent=`Waiting…`,Wr=new AbortController;try{await bt({signal:Wr.signal})}catch(e){let n=Gr(e);t.textContent=n,t.hidden=!n}finally{Ur=!1,Wr=null,e.disabled=!1,e.textContent=`Unlock with passkey`}}}),H.querySelector(`.lock-overlay-wipe`).addEventListener(`click`,async e=>{if(e.preventDefault(),!Ur&&qr()&&confirm(`Wipe ALL local DeepView data and start over?
 
 This deletes your encrypted triage, all reports, and the passkey registration on this device. The data CANNOT be recovered after this — there is no backup.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.48",
+  "version": "1.0.0-alpha.49",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {

package/server-managed/agent-merges.ts

@@ -37,14 +37,18 @@ const timeOf = (value: unknown) => {
 // rebased onto the branch by their last commit there, when merged, and
 // their commits' subjects, the oldest first (agentCommits); when the newest
 // read was last updated, those updated since read again (`through`, null
-// till all are read once); and a read not finished: where it goes on
-// (`after`), when the newest it began with was updated (`from`), the oldest
-// it reads to (`stop`) and how many it has read (`read`). And of every pull
+// till all are read once), and where those read reach back no further than
+// a period needed, when the oldest of them was updated (`reach`), every
+// pull request merged since read (one is updated when merged, or after);
+// and a read not finished: where it goes on (`after`), when the newest it
+// began with was updated (`from`), the oldest it reads to (`stop`), how many
+// it has read (`read`) and when the oldest of them was updated (`to`). And
+// of every pull
 // request merged, an agent's or not, its merge commit and when (`pulls`),
 // and one rebased so (`pullRebases`), for the commits pushed to the branch
 // directly to be told (directCommits).
-export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null
-  next: { after: string; from: number; stop: number; read: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
+export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null; reach?: number
+  next: { after: string; from: number; stop: number; read: number; to?: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
 // A pull request rebased onto the branch: its last commit there, when it was
 // merged, its latest commits' subjects, the oldest first, and how many more
 // it had than those read (`more`).
@@ -86,20 +90,24 @@ const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(h
 // first (a pull request is updated when merged, or after), on from what was
 // `kept`: till one updated before the year, or before the newest read before
 // was, as many queries an answer as MERGED_QUERIES, a read not finished
-// going on from where it was left by the next; one read again whose label
-// no longer names an agent, what it was read to bring forgotten.
+// going on from where it was left by the next, or once those merged since
+// `need` are all read; one read again whose label no longer names an agent,
+// what it was read to bring forgotten.
 export async function agentMerges(fullName: string, token: string, since: number, kept: AgentMerges | null,
-  fetchImpl: typeof fetch = globalThis.fetch): Promise<AgentMerges> {
+  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<AgentMerges> {
   const [owner, name] = fullName.split('/') as [string, string]
   const merges = new Map((kept?.merges ?? []).filter(([, at]) => at >= since))
   const rebases = new Map((kept?.rebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
   const pulls = new Map((kept?.pulls ?? []).filter(([, at]) => at >= since))
   const pullRebases = new Map((kept?.pullRebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
-  const stop = kept?.next?.stop ?? Math.max(since, kept?.through ?? since)
+  // Those read reaching back no further than they needed, and `need`
+  // further: read again from the newest on, as far back as it needs.
+  const further = !kept?.next && kept?.reach !== undefined && kept.reach >= need
+  const stop = kept?.next?.stop ?? (further ? since : Math.max(since, kept?.through ?? since))
   const listed = (map: typeof rebases) => [...map].map(([sha, [at, subjects, more]]): Rebase => more > 0 ? [sha, at, subjects, more] : [sha, at, subjects])
-  const result = (through: number | null, next: AgentMerges['next']): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through, next,
-    pulls: [...pulls], pullRebases: listed(pullRebases) })
-  let { after = null, from = null, read = 0 }: { after?: string | null; from?: number | null; read?: number } = kept?.next ?? {}
+  const result = (through: number | null, next: AgentMerges['next'], reach?: number): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through,
+    ...reach === undefined ? {} : { reach }, next, pulls: [...pulls], pullRebases: listed(pullRebases) })
+  let { after = null, from = null, read = 0, to = null }: { after?: string | null; from?: number | null; read?: number; to?: number | null } = kept?.next ?? {}
   for (let queries = 0; queries < MERGED_QUERIES; queries++) {
     const page = (await githubGraphql(MERGED_QUERY, { owner, name, after }, token, fetchImpl) as MergedPage | null)?.repository?.pullRequests
     let done = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
@@ -108,6 +116,7 @@ export async function agentMerges(fullName: string, token: string, since: number
       if (updated === null) continue
       if (updated < stop) { done = true; break }
       from ??= updated
+      to = updated
       read++
       const [merged, merge] = [timeOf(node?.mergedAt), node?.mergeCommit?.oid]
       if (!node || merged === null || merged < since || typeof merge !== 'string' || !SHA.test(merge)) continue
@@ -131,10 +140,15 @@ export async function agentMerges(fullName: string, token: string, since: number
       for (const oid of brought) merges.set(oid, merged)
       if (subjects) rebases.set(merge, [merged, subjects, more])
     }
-    if (done) return result(from ?? stop, null)
+    // Read as far back as it reads to: the year's start, every one since
+    // read; else as far as those read before reached.
+    if (done) return result(from ?? stop, null, stop > since ? kept?.reach : undefined)
     after = page!.pageInfo!.endCursor as string
+    // Read as far back as `need`: finished, so far back, those updated
+    // since read by the next as ever.
+    if (need > since && to !== null && to < need) return result(Math.max(from ?? stop, kept?.through ?? Number.NEGATIVE_INFINITY), null, to)
   }
-  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read })
+  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read, ...to === null ? {} : { to } }, kept?.reach)
 }
 
 // Whether two reads of the pull requests merged (agentMerges) bring the

package/server-managed/http.ts

@@ -476,20 +476,26 @@ function firstHeader(v: string | string[] | undefined): string | null {
   return null
 }
 
+// A user's avatar, drawn on every tile, comment and review by them: kept by
+// the browser five minutes, then shown as kept for a day while the browser
+// asks again behind it, its image named by its ETag, so that an unchanged one
+// answers with none (304). One changed on another's profile shows within
+// minutes; a user's own change, at once, as their page asks for it again
+// (ui/view/github-users.js refreshAvatar).
+const USER_AVATAR_CACHE = 'private, max-age=300, stale-while-revalidate=86400'
+
 // `key` is the image chosen for `id`; one not cached falls back to `id`'s own.
-// A user's is never kept by the browser, as it changes with their profile.
-async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id, cacheControl = 'no-store'): Promise<void> {
-  sendAvatar(res, await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id)), cacheControl)
+async function serveAvatar(req: IncomingMessage, res: ServerResponse, avatarStore: AvatarStore, id: string, key = id, cacheControl = USER_AVATAR_CACHE): Promise<void> {
+  sendAvatar(req, res, await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id)), cacheControl)
 }
 
-function sendAvatar(res: ServerResponse, avatar: CachedAvatar | null, cacheControl = 'no-store'): void {
+function sendAvatar(req: IncomingMessage, res: ServerResponse, avatar: CachedAvatar | null, cacheControl: string): void {
   if (avatar == null) { sendJson(res, 404, { error: 'no-avatar' }); return }
-  res.writeHead(200, {
-    'content-type': avatar.contentType,
-    'content-length': String(avatar.bytes.length),
-    'x-content-type-options': 'nosniff',
-    'cache-control': cacheControl,
-  })
+  const etag = `"${createHash('sha256').update(`${avatar.contentType}\0`).update(avatar.bytes).digest('base64url').slice(0, 22)}"`
+  const headers = { 'etag': etag, 'cache-control': cacheControl, 'x-content-type-options': 'nosniff' }
+  const asked = req.headers['if-none-match']
+  if (typeof asked === 'string' && asked.split(',').some(tag => ['*', etag, `W/${etag}`].includes(tag.trim()))) { res.writeHead(304, headers); res.end(); return }
+  res.writeHead(200, { ...headers, 'content-type': avatar.contentType, 'content-length': String(avatar.bytes.length) })
   res.end(avatar.bytes)
 }
 
@@ -505,15 +511,15 @@ const AGENT_AVATAR = /^(app|user)-([1-9]\d{0,11})$/u
 // for it alone.
 const AGENT_AVATAR_CACHE = 'private, max-age=86400'
 
-async function serveAgentAvatar(res: ServerResponse, avatarStore: AvatarStore, avatar: string): Promise<void> {
+async function serveAgentAvatar(req: IncomingMessage, res: ServerResponse, avatarStore: AvatarStore, avatar: string): Promise<void> {
   const [, kind, id] = AGENT_AVATAR.exec(avatar)!
   const key = `00000000-0000-0000-000${kind === 'app' ? 0 : 1}-${id!.padStart(12, '0')}`
   // Read once where it is kept; read again only past fetching it.
   const kept = await avatarStore.get(key)
-  if (kept != null) { sendAvatar(res, kept, AGENT_AVATAR_CACHE); return }
+  if (kept != null) { sendAvatar(req, res, kept, AGENT_AVATAR_CACHE); return }
   await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
     .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
-  await serveAvatar(res, avatarStore, key, key, AGENT_AVATAR_CACHE)
+  await serveAvatar(req, res, avatarStore, key, key, AGENT_AVATAR_CACHE)
 }
 
 const MAX_JSON_BODY_BYTES = 4096
@@ -2639,7 +2645,7 @@ async function handleRepositoryPulse(res: ServerResponse, deps: ManagedHttpDeps,
   await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
     const [period, year] = await Promise.all([
       keptAnswer(deps, `${repoId}\0pulse\0${weeks}`, () => repositoryActivity(fullName, token, weeks)),
-      pulseCommits(deps, repoId, fullName, token),
+      pulseCommits(deps, repoId, fullName, token, weeks),
     ])
     return { value: { weeks, ...period.value, stats: year.stats && periodStats(year.stats, weeks), reading: year.reading, pulls: year.pulls,
       pending: year.pending }, kept: period.kept && year.kept }
@@ -2654,14 +2660,21 @@ async function handleRepositoryPulse(res: ServerResponse, deps: ManagedHttpDeps,
 // read on by the next answer as the year's commits are, and read again as
 // an answer kept is, a label changing whose a pull request is without
 // moving the head, the year counted again where what they bring changed.
-// A year not read whole yet is how many of its commits are (`reading`), or
-// of the pull requests merged (`pulls`), beside the year last counted from
-// an earlier head over the same weeks, where one is kept, so that a head
-// moved on shows the year as it was till it is counted again; one past
+// Read no further back than the period asked (`weeks`) needs, its weeks and
+// as many before them, the rest read only as a longer one asks, its count
+// so said (`from`). A year not read as far as it needs yet is how many of
+// its commits are (`reading`), or of the pull requests merged (`pulls`),
+// beside the year last counted from an earlier head, where one is kept over
+// the same weeks or a few weeks earlier, so that a head moved on, or the
+// rules its commits are read by, shows the year as it was till it is
+// counted again; one past
 // YEAR_COMMITS is GitHub's statistics' (repositoryStats, repositoryLines),
 // kept together as an issue's page is and through GitHub computing them
 // again, `pending` while it first computes them, the year last counted
 // beside it so too.
+// How many weeks behind the year shown a year last counted may be shown
+// while it is counted again: the year as it was, its latest weeks missing.
+const PULSE_LAST_MS = 28 * 24 * 60 * 60_000
 // A day as a pulse's items are narrowed by (YYYY-MM-DD, UTC), when it starts;
 // a GitHub login, as many of them as PULSE_AUTHORS.
 const PULSE_DAY = /^\d{4}-\d{2}-\d{2}$/u
@@ -2693,8 +2706,13 @@ async function handleRepositoryPulseItems(res: ServerResponse, deps: ManagedHttp
   })
 }
 
-async function pulseCommits(deps: ManagedHttpDeps, repoId: number, fullName: string, token: string) {
-  const first = pulseSince(52, Date.now())
+async function pulseCommits(deps: ManagedHttpDeps, repoId: number, fullName: string, token: string, weeks = 52) {
+  const now = Date.now()
+  const first = pulseSince(52, now)
+  // As far back as a period of `weeks` weeks needs the year read whole: its
+  // weeks and as many before them, which it is shown beside; the year's,
+  // all of it.
+  const need = Math.max(first, pulseSince(2 * weeks, now))
   const head = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
   if (!head.value.sha) return { stats: commitStats([], first), reading: null, pulls: null, pending: false, kept: head.kept }
   const store = repositoryReadStore(deps.db, deps.config.debug)
@@ -2703,7 +2721,7 @@ async function pulseCommits(deps: ManagedHttpDeps, repoId: number, fullName: str
   const mergesKey = `${repoId}\0pulse-merges\0${PULSE_YEAR_VERSION}`
   const last = async () => {
     const kept = (await store.read(lastKey))?.value as { first: number; stats: PulseStats } | undefined
-    return kept?.first === first ? kept.stats : null
+    return kept && first - kept.first <= PULSE_LAST_MS ? kept.stats : null
   }
   const sha = head.value.sha
   // What tells whose the year's commits are, kept as read: the agents' pull
@@ -2711,47 +2729,60 @@ async function pulseCommits(deps: ManagedHttpDeps, repoId: number, fullName: str
   // repository (`releases`, release-commits.ts releaseCommits).
   type Attribution = AgentMerges & { releases?: string[] }
   const keptAttribution = async () => ((await store.read(mergesKey))?.value as Attribution | undefined) ?? null
-  const attribution = async (kept: Attribution | null): Promise<Attribution> => {
-    const [merges, releases] = await Promise.all([agentMerges(fullName, token, first, kept), releaseCommits(fullName, token, first, historyChanges(deps, repoId))])
+  const attribution = async (kept: Attribution | null, whole: number): Promise<Attribution> => {
+    const [merges, releases] = await Promise.all([agentMerges(fullName, token, first, kept, globalThis.fetch, whole),
+      releaseCommits(fullName, token, first, historyChanges(deps, repoId))])
     return { ...merges, releases }
   }
+  // Since when every pull request merged is read (agentMerges `reach`, or
+  // a read not finished's `to`): all of them, -∞; none yet, ∞.
+  const readTo = (read: Attribution) => read.next ? read.next.to ?? Number.POSITIVE_INFINITY : read.reach ?? Number.NEGATIVE_INFINITY
   // The year counted from its `commits` as `read` tells whose they are and
   // which were pushed directly, the branch followed through those it was
-  // read on past (`passed`, yearCommits) too; kept by its head and as the
-  // year last counted.
-  const count = async ({ commits, passed }: { commits: HistoryCommit[]; passed: HistoryCommit[] }, read: Attribution) => {
+  // read on past (`passed`, yearCommits) too, whole from when both the
+  // commits and the pull requests merged are read (`from`, none where all
+  // are); kept by its head and as the year last counted.
+  const count = async ({ commits, passed, from }: { commits: HistoryCommit[]; passed: HistoryCommit[]; from: number | null }, read: Attribution) => {
     const walked = [...commits, ...passed]
-    const stats = commitStats(commits, first, agentCommits(read, walked), new Set(read.releases), directCommits(read, walked, sha))
+    const whole = Math.max(from ?? Number.NEGATIVE_INFINITY, readTo(read))
+    const stats = { ...commitStats(commits, first, agentCommits(read, walked), new Set(read.releases), directCommits(read, walked, sha)),
+      ...Number.isFinite(whole) ? { from: whole } : {} }
     await Promise.all([store.write(key, stats, Date.now()), store.write(lastKey, { first, stats }, Date.now())])
     return stats
   }
   // A year kept by its head, what tells whose its commits are read again as
   // an answer kept is (keptAnswer), a label or a tag changing it without
-  // moving the head: counted again from its pages kept where what agents'
-  // pull requests bring, or the releases, changed, or a read of the pull
-  // requests left unfinished is finished; the year as kept answered
-  // meanwhile, and where reading them fails.
+  // moving the head: counted again, as far back as it was, from its pages
+  // kept where what agents' pull requests bring, or the releases, changed,
+  // or the pull requests merged are read further back; the year as kept
+  // answered meanwhile, and where reading them fails.
   const relabelled = async (stats: PulseStats) => {
     const recounted: { stats?: PulseStats } = {}
+    const whole = stats.from ?? first
     await keptAnswer(deps, mergesKey, async () => {
       const kept = await keptAttribution()
-      const read = await attribution(kept)
-      const same = kept && !kept.next && sameMerges(read, kept) && read.releases!.join() === (kept.releases ?? []).join()
-      if (read.next || same) return read
-      const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true))
+      const read = await attribution(kept, whole)
+      const same = kept && sameMerges(read, kept) && read.releases!.join() === (kept.releases ?? []).join() && readTo(kept) <= readTo(read)
+      if (readTo(read) >= whole || same) return read
+      const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true), globalThis.fetch, whole)
       if (year.complete) recounted.stats = await count(year, read)
       return read
     }, () => true).catch((err: unknown) => { console.warn('managed: pulse attribution read failed:', err) })
     return recounted.stats ?? stats
   }
+  // A year kept, read whole as far back as the period needs, as it was;
+  // else its commits and the pull requests merged read on together as far
+  // as it needs, and counted once both are.
   const held = (await store.read(key))?.value as PulseStats | { tooMany: true } | undefined
-  if (held && !('tooMany' in held)) return { stats: await relabelled(held), reading: null, pulls: null, pending: false, kept: head.kept }
-  if (!held) {
-    const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true))
+  if (held && !('tooMany' in held) && (held.from === undefined || held.from < need)) {
+    return { stats: await relabelled(held), reading: null, pulls: null, pending: false, kept: head.kept }
+  }
+  if (!held || !('tooMany' in held)) {
+    const [year, read] = await Promise.all([yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true), globalThis.fetch, need),
+      keptAttribution().then(kept => attribution(kept, need))])
+    await store.write(mergesKey, read, Date.now())
     if (year.complete) {
-      const read = await attribution(await keptAttribution())
-      await store.write(mergesKey, read, Date.now())
-      if (read.next) return { stats: await last(), reading: null, pulls: read.next.read, pending: false, kept: false }
+      if (readTo(read) >= need) return { stats: await last(), reading: null, pulls: read.next?.read ?? 0, pending: false, kept: false }
       return { stats: await count(year, read), reading: null, pulls: null, pending: false, kept: false }
     }
     if (!year.tooMany) return { stats: await last(), reading: year.read, pulls: null, pending: false, kept: false }
@@ -4851,8 +4882,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path.startsWith(AVATAR_PREFIX)) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const id = path.slice(AVATAR_PREFIX.length)
-      if (AGENT_AVATARS.has(id) && AGENT_AVATAR.test(id)) { await serveAgentAvatar(res, avatarStore, id); return }
-      await serveAvatar(res, avatarStore, id, url.searchParams.has('own') ? id : await db.getAvatarKey(id))
+      if (AGENT_AVATARS.has(id) && AGENT_AVATAR.test(id)) { await serveAgentAvatar(req, res, avatarStore, id); return }
+      await serveAvatar(req, res, avatarStore, id, url.searchParams.has('own') ? id : await db.getAvatarKey(id))
       return
     }
     // Admin: list users (admin-only).

package/server-managed/pull-comment-reviews.ts

@@ -132,7 +132,7 @@ function counted(answer: CommentReview[], read: Authored[], reviewers: Map<strin
       const { name, version, integrity, patchHash, status } = dependency ?? {}
       if (typeof name !== 'string' || typeof version !== 'string' || typeof integrity !== 'string' || !VERDICTS.has(status)) return []
       return integrity.split(/\s+/u).filter(Boolean).map(hash => ({ package: name, version, integrity: hash, ...typeof patchHash === 'string' && patchHash ? { patchHash } : {},
-        basePackage: null, baseVersion: null, reviewer, status: status as ReviewVerdict, full: true, time }))
+        basePackage: null, baseVersion: null, reviewer, login: review.user as string, status: status as ReviewVerdict, full: true, time }))
     })
   })
 }

package/server-managed/pull-dependency-reviews.ts

@@ -107,7 +107,9 @@ const ACCEPTING = new Set(['accept', 'accept-with-nits'])
 // review of theirs, whole or compared with one of `bases` of its package
 // (any, for `any`); and how many review it in its pull request's comments
 // alone (`commented`), which count for it alone: whose reviews passing it,
-// else whose latest, are its comments'.
+// else whose latest, are its comments'. Each reviewer too (`reviewers`), by
+// their login, their latest verdict, whether they pass it, and whether that
+// verdict is its comments' (`comment`), which counts for it alone.
 function stancesOf(pkg: LockedPackage, reviews: ReviewsOf, bases: string[] | 'any') {
   const hashes = hashesOf(pkg)
   const by = new Map<string, PublishedReview[]>()
@@ -118,17 +120,21 @@ function stancesOf(pkg: LockedPackage, reviews: ReviewsOf, bases: string[] | 'an
   const qualifies = (review: PublishedReview) => review.full && ACCEPTING.has(review.status)
     && (review.basePackage === null || (review.basePackage === pkg.name && (bases === 'any' || bases.includes(review.baseVersion ?? ''))))
   let commented = 0, passing = 0, rejected = false
+  const reviewers: Reviewer[] = []
   for (const theirs of by.values()) {
     const latest = theirs.reduce((one, other) => other.time > one.time ? other : one)
+    const passes = ACCEPTING.has(latest.status) && theirs.some(qualifies)
     // In its comments alone where those telling where they stand are: those
     // passing it, where they pass it, else their latest.
-    const telling = ACCEPTING.has(latest.status) && theirs.some(qualifies) ? theirs.filter(qualifies) : [latest]
-    if (telling.every(review => review.comment)) commented++
+    const comment = (passes ? theirs.filter(qualifies) : [latest]).every(review => review.comment)
+    if (comment) commented++
     if (latest.status === 'reject') rejected = true
-    else if (ACCEPTING.has(latest.status) && theirs.some(qualifies)) passing++
+    else if (passes) passing++
+    reviewers.push({ login: latest.login, status: latest.status, ...passes ? { passes: true as const } : {}, ...latest.comment ? { comment: true as const } : {} })
   }
-  return { passing, rejected, commented }
+  return { passing, rejected, commented, reviewers }
 }
+type Reviewer = { login: string; status: PublishedReview['status']; passes?: true; comment?: true }
 
 // A version as the client is told it: what its reviews are held to left
 // out, but whether it is patched.
@@ -148,7 +154,8 @@ function askedOf(pkg: LockedPackage): [string, ReviewedDependency] {
 
 // A version's review, and whether it wants one (`wants`), neither passing
 // nor needing none, as only one that can be reviewed may.
-type Review = { unsupported: Unsupported } | { baseline: true } | { reviewed: true } | { reviews: number; rejected?: true; commented?: number } | Record<string, never>
+type Review = { unsupported: Unsupported } | { baseline: true } | { reviewed: true } | { reviews: number; rejected?: true; commented?: number; reviewers?: Reviewer[] }
+  | Record<string, never>
 interface Judged { review: Review; wants: boolean }
 type Judge = (pkg: LockedPackage, bases: string[] | 'any') => Judged
 interface Context { state: RepoReviewState; reviews: ReviewsOf; baseline: Set<string> | null }
@@ -157,8 +164,8 @@ function judge(pkg: LockedPackage, bases: string[] | 'any', { state, reviews, ba
   if (as === 'skip') return { review: {}, wants: false }
   if (as !== 'version') return { review: { unsupported: as }, wants: false }
   if (baselineKeys(pkg).some(key => baseline?.has(key))) return { review: { baseline: true }, wants: false }
-  const { passing, rejected, commented } = stancesOf(pkg, reviews, bases)
-  const told = { reviews: passing, ...commented > 0 ? { commented } : {} }
+  const { passing, rejected, commented, reviewers } = stancesOf(pkg, reviews, bases)
+  const told = { reviews: passing, ...commented > 0 ? { commented } : {}, ...reviewers.length > 0 ? { reviewers } : {} }
   if (rejected) return { review: { ...told, rejected: true }, wants: true }
   return { review: told, wants: passing < state.required }
 }

package/server-managed/repository-dependency-reviews.ts

@@ -25,13 +25,14 @@ export interface RepoDependencyReview { enabled: boolean; required: number; sinc
 // A review published of the version it is of: its package, version and
 // npm's integrity of it, the patch it is of (none here, the app reviewing no
 // patch yet), the version it was compared with (none for a whole package's),
-// who wrote it (`reviewer`, their id, else their login then), its verdict,
-// whether it checked every file (`full`), and when it was published.
+// who wrote it (`reviewer`, their id, else their login then), their login
+// as it was then (`login`), its verdict, whether it checked every file
+// (`full`), and when it was published.
 // One made in a pull request's comments (`comment`) counts for it alone;
 // one published here has its `id`.
 export interface PublishedReview {
   id?: string; package: string; version: string; integrity: string; patchHash?: string; basePackage: string | null; baseVersion: string | null
-  reviewer: string; status: ReviewVerdict; full: boolean; time: number; comment?: true
+  reviewer: string; login: string; status: ReviewVerdict; full: boolean; time: number; comment?: true
 }
 // A repository's review in effect for a reader: its settings, whether they
 // publish reviews to one of the teams that count (`canReview`), and the
@@ -105,7 +106,7 @@ async function publishedReviews(db: ManagedSql, repoId: number, versions: Review
       const nonText = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
       const full = summarizeReview(entries.get(row.id) ?? [], files, nonText).coverage === 'full'
       found.push({ id: row.id, package: row.package, version: row.version, integrity: row.integrity, basePackage: row.basePackage, baseVersion: row.baseVersion,
-        reviewer: row.userId ?? `login:${row.userLogin.toLowerCase()}`, status: row.status, full, time: Number(row.publishedAt) })
+        reviewer: row.userId ?? `login:${row.userLogin.toLowerCase()}`, login: row.userLogin, status: row.status, full, time: Number(row.publishedAt) })
     }
   }
   return found

package/server-managed/repository-pulse.ts

@@ -76,18 +76,21 @@ export interface PulseCommit { sha: string; at: number; subject: string; login:
 // each commit's own time zone, and, counted from its commits, each period's
 // (`punches`, by its weeks); `lines` false where GitHub counts none, null
 // while it is counting them; counted from its commits, the latest pushed to
-// the branch directly (`directCommits`, as many as DIRECT_LISTED).
+// the branch directly (`directCommits`, as many as DIRECT_LISTED); and,
+// counted from its commits read no further back than a period needed, when
+// from it is counted whole (`from`), absent for the year whole.
 export interface PulseStats { weeks: PulseWeek[]; contributors: PulseContributor[]; punch: number[][]; punches?: Record<number, number[][]>; lines: boolean | null
-  directCommits?: PulseCommit[] }
+  directCommits?: PulseCommit[]; from?: number }
 // The lines added and removed a week, and each contributor's, as GitHub's
 // statistics count them, `lines` false where it counts none.
 export interface PulseLines { weeks: [number, number, number][]; contributors: { login: string; weeks: [number, number, number][] }[]; lines: boolean }
 // The days (`from`, `to`, both days, UTC; `to` none, on) and the authors (GitHub
 // logins, any of them) a period's pull requests and issues are narrowed to.
 export interface PulseNarrowing { from: number; to: number | null; authors: string[] }
-// The year's commits read so far: all of them (`commits`), else how many
-// (`read`), and whether past YEAR_COMMITS (`tooMany`).
-export type YearCommits = { complete: true; commits: HistoryCommit[]; passed: HistoryCommit[] } | { complete: false; read: number; tooMany: boolean }
+// The year's commits read so far: all of them, or as far back as asked
+// (`commits`, `from`), else how many (`read`), and whether past
+// YEAR_COMMITS (`tooMany`).
+export type YearCommits = { complete: true; commits: HistoryCommit[]; passed: HistoryCommit[]; from: number | null } | { complete: false; read: number; tooMany: boolean }
 
 const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
 const timeOf = (value: unknown) => {
@@ -204,17 +207,28 @@ export async function defaultHead(fullName: string, token: string, fetchImpl: ty
 // YEAR_QUERIES, the rest left for the next to ask (`complete` false, how
 // many are `read`); more than YEAR_COMMITS, too many (`tooMany`). Read
 // whole, those it was read on past besides (`passed`): undated, or dated
-// before it, a clock behind, the branch's commits since beneath them.
+// before it, a clock behind, the branch's commits since beneath them. Read
+// no further than `need` asks, those since it read whole (`complete`, `from`
+// the newest of those read whose parents are not, every commit after it
+// read; null, the year read whole).
 export async function yearCommits(fullName: string, token: string, head: string, since: number, pages: HistoryPages,
-  fetchImpl: typeof fetch = globalThis.fetch): Promise<YearCommits> {
+  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<YearCommits> {
   const found = new Map<string, HistoryCommit>()
   const tried = new Set<string>()
   const within = (commit: HistoryCommit) => commit.committedAt === null || commit.committedAt >= since - YEAR_SKEW_MS
   const dated = (commit: HistoryCommit) => commit.committedAt !== null && commit.committedAt >= since
   const read = () => [...found.values()].filter(dated).length
+  const passed = () => [...found.values()].filter(commit => !dated(commit) && within(commit))
   let queries = 0
   let starts = [head]
   while (starts.length > 0) {
+    // Those not read yet, the head before any, else the parents of those
+    // read, no later than the newest of them (but for a clock behind): read
+    // whole after it.
+    const unread = new Set(starts)
+    const from = found.size === 0 ? Number.POSITIVE_INFINITY : Math.max(Number.NEGATIVE_INFINITY, ...[...found.values()]
+      .filter(commit => commit.parents.some(sha => unread.has(sha))).map(commit => commit.committedAt ?? Number.POSITIVE_INFINITY))
+    if (need > since && from < need) return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from }
     if (queries >= YEAR_QUERIES) return { complete: false, read: read(), tooMany: false }
     const batch = starts.slice(0, YEAR_STARTS)
     for (const sha of batch) tried.add(sha)
@@ -224,7 +238,7 @@ export async function yearCommits(fullName: string, token: string, head: string,
     if (read() > YEAR_COMMITS) return { complete: false, read: read(), tooMany: true }
     starts = [...new Set([...found.values()].filter(within).flatMap(commit => commit.parents))].filter(sha => !found.has(sha) && !tried.has(sha))
   }
-  return { complete: true, commits: [...found.values()].filter(dated), passed: [...found.values()].filter(commit => !dated(commit) && within(commit)) }
+  return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from: null }
 }
 
 // Whether an author is a GitHub App's bot: by its login (`<app>[bot]`, as a