@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/public-workspace.ts

@@ -0,0 +1,238 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { pipeline } from 'node:stream/promises'
+import { Buffer } from 'node:buffer'
+import type { ManagedHttpDeps } from './http.ts'
+import type { ManagedBundle } from './db.ts'
+import type { OpenedBlob } from './blob-store.ts'
+import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
+import { sendJson, sendLines, writeResponse } from './http-response.ts'
+import { hashToken } from './crypto.ts'
+import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, teamReportVisibility, teamResponsePart } from './team-reports.ts'
+import { triageWireEntry } from './triage-response.ts'
+import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
+import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
+import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
+import { auditCache, auditedRepos } from './upstream-cache.ts'
+import { serveTeamFeed } from './team-feed.ts'
+import { type ComparedSide, PrettyError, compared, prettyRequest, prettyText } from './pretty-print.ts'
+import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
+import { typeOnlyFiles } from './type-only.ts'
+import { comparisonBody } from './comparison.ts'
+import { sharedTeamApp, withWorkspaceSummary } from './team-app.ts'
+
+function json(res: ServerResponse, status: number, body: unknown): void {
+  sendJson(res, status, body, { 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
+}
+
+// Called before ALL other routing, including OAuth, discovery, static and the
+// combined server fallback. A supplied capability never inherits cookie auth.
+export async function handlePublicWorkspace(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, url: URL): Promise<void> {
+  const token = req.headers['x-deepview-share']
+  if (!deps.config.allowShare || typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/u.test(token)) {
+    json(res, 401, { error: 'invalid-share' }); return
+  }
+  const method = req.method ?? 'GET'
+  if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
+  const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
+  const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|trees|feed|annotations)$/u.exec(url.pathname)
+  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
+  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only|comparison)$/u.exec(url.pathname)
+  if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
+  const tokenHash = hashToken(token)
+  const snapshot = await deps.db.getWorkspaceShare(tokenHash)
+  if (!snapshot) { json(res, 401, { error: 'invalid-share' }); return }
+  const recheck = async () => {
+    const current = deps.config.allowShare && await deps.db.getWorkspaceShare(tokenHash)
+    if (!current || JSON.stringify(current) !== JSON.stringify(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
+  }
+  const send = async (body: unknown) => { await recheck(); json(res, 200, body) }
+  const sendTeam = async () => {
+    const [summaries, workspace] = await Promise.all([bundleSummaries(snapshot.team.bundles, deps.bundleCache), sharedTeamApp(deps.db, deps.reportStore, snapshot)])
+    await send({ user: snapshot.user, team: { ...withWorkspaceSummary(snapshot.team, workspace),
+      bundles: snapshot.team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })),
+    } })
+    await backfillBundleSummaries(snapshot.team.bundles, deps.bundleCache)
+  }
+  const stream = async (stored: OpenedBlob, encoding: string | null, contentType = 'application/json') => {
+    try { await recheck() } catch (error) { stored.stream.destroy(); throw error }
+    res.writeHead(200, { 'content-type': contentType, 'cache-control': 'private, no-store',
+      'x-content-type-options': 'nosniff', ...(encoding ? { 'content-encoding': encoding } : {}),
+      ...(stored.size == null ? {} : { 'content-length': String(stored.size) }),
+    })
+    if (method === 'HEAD') { stored.stream.destroy(); res.end(); return }
+    try { await pipeline(stored.stream, res) } catch { res.destroy() }
+  }
+  if (url.searchParams.has('team') && (url.searchParams.getAll('team').length !== 1 || url.searchParams.get('team') !== snapshot.teamId)) {
+    json(res, 404, { error: 'no-team' }); return
+  }
+  if (shareRoute) {
+    // The short hash is a recognizable link ID, never an access grant. Resolve
+    // with the full token so colliding IDs or slugs cannot broaden its scope.
+    // Existing links used the team ID as their fragment prefix.
+    if (shareRoute[1] !== tokenHash.slice(0, 8) && shareRoute[1] !== snapshot.teamId) {
+      json(res, 404, { error: 'no-share' }); return
+    }
+    await sendTeam(); return
+  }
+  if (teamRoute) {
+    if (teamRoute[1] !== snapshot.teamId) { json(res, 404, { error: 'no-team' }); return }
+    if (teamRoute[2] === 'feed') {
+      if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
+      await serveTeamFeed(res, deps, snapshot, recheck, { readState: () => deps.db.getWorkspaceShareFeedState(tokenHash) }); return
+    }
+    if (teamRoute[2] === 'annotations') {
+      await send(await loadTeamAnnotations(deps.db, deps.reportStore, snapshot, url.searchParams.get('reportId'))); return
+    }
+    if (teamRoute[2] === 'shared') { await sendTeam(); return }
+    const body = await loadTeamReportsResponse(deps.db, deps.reportStore, snapshot, teamResponsePart(teamRoute[2]!, url))
+    await recheck()
+    res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
+    writeResponse(res, body); return
+  }
+  if (reportRoute) {
+    const id = reportRoute[1]!, part = reportRoute[2]!
+    if (!snapshot.reports.some(report => report.id === id)) { json(res, 404, { error: 'no-report' }); return }
+    const visible = await teamReportVisibility(deps.db, deps.reportStore, snapshot, id)
+    await recheck()
+    if (part === 'sources') { await sources(res, deps, snapshot, id, visible.sourcePaths, recheck, stream); return }
+    if (part === 'comments') { await send({ comments: await deps.db.listComments([...visible.ids]) }); return }
+    const entries = Object.fromEntries((await deps.db.listTriage([...visible.ids])).map(row => [row.findingId, triageWireEntry(row)]))
+    await send({ entries }); return
+  }
+  const bundle = snapshot.bundles.find(item => item.id === bundleRoute![1])
+  if (!bundle) { json(res, 404, { error: 'no-bundle' }); return }
+  if (bundleRoute![2] === 'advisories' && !snapshot.permissions.security) { json(res, 403, { error: 'security-access-required' }); return }
+  if (bundleRoute![2] === 'rename-diff' || bundleRoute![2] === 'type-only' || bundleRoute![2] === 'comparison' || (bundleRoute![2] === 'pretty' && url.searchParams.has('other'))) {
+    if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
+    await serveCompared(res, deps, bundle, snapshot.bundles.find(item => item.id === url.searchParams.get('other')), bundleRoute![2], url, recheck, stream); return
+  }
+  await serveBundle(res, deps, bundle, bundleRoute![2]!, url, recheck, stream)
+}
+
+// What a bundle is compared with `other`, another of the link's bundles, by:
+// their files paired, as one comparison; one of their JavaScript files diffed
+// with renamed names hidden; or the files that changed between them, or the
+// pairs of those, or those that changed in types alone, a line each.
+function serveCompared(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, part: string, url: URL,
+  recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (part === 'comparison') return serveComparison(res, deps, bundle, other, url, stream)
+  if (part === 'rename-diff' && url.searchParams.has('path')) return serveRenameDiff(res, deps, bundle, other, url, stream)
+  return serveChanges(res, deps, bundle, other, recheck, part === 'pretty' ? compared : part === 'type-only' ? typeOnlyFiles : renamedPairs,
+    part === 'pretty' ? '' : url.searchParams.get('scope') ?? '')
+}
+
+// One of a bundle's JavaScript files diffed with one of `other`, another of
+// the link's bundles (rename-diff.ts).
+async function serveRenameDiff(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, url: URL,
+  stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  const request = renameDiffRequest(url.searchParams)
+  if (!request) { json(res, 400, { error: 'bad-file' }); return }
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  const { prettyCache } = deps
+  if (!prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let diff
+  try {
+    diff = await renameDiffOf(request, async () => [await prettyText(await prettyCache.bundle(bundle, request.base)),
+      await prettyText(await prettyCache.bundle(other, request.other))])
+  } catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await stream(diff, 'br')
+}
+
+// A bundle's files paired with `other`'s, another of the link's bundles, as
+// Compare pairs them (comparison.ts), within a reason `scope` where given.
+async function serveComparison(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, url: URL,
+  stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  const { prettyCache } = deps
+  if (!prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let body
+  try { body = await comparisonBody(await prettyCache.bundleDetails(bundle), await prettyCache.bundleDetails(other), url.searchParams.get('scope') ?? '') }
+  catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await stream(body, 'br')
+}
+
+// The files that changed between a bundle and `other`, another of the link's
+// bundles, both sides' pretty-printed (pretty-print.ts compared), or the pairs
+// of them its viewer diffs with renamed names hidden (rename-diff.ts
+// renamedPairs), those within a reason `scope` where given, the link checked
+// again before each line.
+async function serveChanges(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, recheck: () => Promise<void>,
+  linesOf: (sides: [ComparedSide, ComparedSide]) => AsyncIterable<unknown>, scope: string) {
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  if (!deps.prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let lines
+  try { lines = linesOf(await deps.prettyCache.bundleSides(bundle, other, scope)) }
+  catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await recheck()
+  await sendLines(res, lines, () => recheck().then(() => true, () => false))
+}
+
+async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, part: string, url: URL,
+  recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (part === 'download') {
+    const stored = await deps.bundleStore.open(bundle.id, bundle.kind)
+    if (!stored) { json(res, 503, { error: 'unavailable' }); return }
+    await stream(stored, bundle.kind === 'sourcemap' ? 'br' : null, 'application/octet-stream'); return
+  }
+  if (part === 'pretty') {
+    const file = prettyRequest(url.searchParams)
+    if (!file) { json(res, 400, { error: 'bad-file' }); return }
+    if (!deps.prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+    let pretty
+    try { pretty = await deps.prettyCache.bundle(bundle, file) }
+    catch (err) {
+      if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+      throw err
+    }
+    await stream(pretty, 'br', 'text/plain; charset=utf-8'); return
+  }
+  if (!deps.bundleCache) { json(res, 503, { error: 'unavailable' }); return }
+  if (part === 'advisories') {
+    if (bundle.kind !== 'stasis') { json(res, 422, { error: 'unsupported-bundle' }); return }
+    const inventory = await deps.bundleCache.advisoryInventory(bundle, url.searchParams.get('reason') ?? '')
+    await recheck()
+    if (inventory === null) { json(res, 413, { error: 'payload-too-large' }); return }
+    if (inventory === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
+    if (Buffer.byteLength(JSON.stringify(inventory)) > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
+    const signal = AbortSignal.timeout(ADVISORIES_TIMEOUT_MS)
+    const repoAdvisories = url.searchParams.get('repoAdvisories') === 'true'
+    const result = await fetchBundleAdvisories(inventory.packages, signal, {
+      debug: deps.config.debug, repoAdvisories, details: url.searchParams.get('details') === 'true',
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug, auditedRepos(inventory.packages, repoAdvisories)),
+    })
+    await recheck()
+    json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return
+  }
+  let cached
+  try { cached = await deps.bundleCache.open(bundle, part as 'metadata' | 'contents') }
+  catch { json(res, 422, { error: 'bundle-unavailable' }); return }
+  await stream(cached, 'br')
+}
+
+async function sources(res: ServerResponse, deps: ManagedHttpDeps, snapshot: WorkspaceShareSnapshot,
+  id: string, paths: Set<string>, recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null) => Promise<void>) {
+  const report = await deps.db.getReport(id)
+  const bundle = report?.bundleId ? await deps.db.getBundle(report.bundleId) : null
+  const empty = async () => { await recheck(); res.writeHead(204, { 'cache-control': 'private, no-store' }); res.end() }
+  if (!report || !bundle || !['stasis', 'sourcemap'].includes(bundle.kind ?? '') || bundle.repoId !== report.repoId) { await empty(); return }
+  if (!deps.reportSourcesCache) { json(res, 503, { error: 'unavailable' }); return }
+  let cached
+  try { cached = await deps.reportSourcesCache.open(report, bundle, snapshot.permissions, paths) }
+  catch { await empty(); return }
+  if (!cached) { await empty(); return }
+  const current = await deps.db.getReport(id), currentBundle = await deps.db.getBundle(bundle.id)
+  if (JSON.stringify(current) !== JSON.stringify(report) || JSON.stringify(currentBundle) !== JSON.stringify(bundle)
+      || snapshot.reports.find(item => item.id === id)?.repo.github !== cached.repo.github) {
+    cached.stream.destroy(); throw new TeamReportsError(404, 'workspace-changed')
+  }
+  await stream(cached, 'gzip')
+}

package/server-managed/pull-comment-reviews.ts

@@ -0,0 +1,161 @@
+// The reviews of dependencies an open pull request's comments make, as the
+// host's parser reads them (reviewed-dependencies.ts `parseComments`): its
+// comments, its reviews' own, whatever their state, and those on lines of
+// its diff, read of GitHub's GraphQL API, as many as MAX_COMMENTS, with
+// whether it is open, kept in this instance KEPT_MS; none of one not open;
+// the parser's answer to the same kept PARSED_KEPT_MS.
+// A review counts only where its user is one of their authors and the app's
+// user that account is (by its numeric id, else its login, its linked
+// accounts' too) publishes reviews to a team counting for the repository
+// (`reviewers`): by that user, as their reviews here are, each once among
+// them (pull-dependency-reviews.ts), as of its time, else their latest
+// comment's. They count for the pull request alone, never stored.
+import { createHash } from 'node:crypto'
+import { ACTOR, type GraphAccount, actorOf } from './github-accounts.ts'
+import { type Lru, lru } from './lru.ts'
+import type { CommentReviews } from './pull-dependency-reviews.ts'
+import type { PublishedReview } from './repository-dependency-reviews.ts'
+import { githubGraphql } from './repository-history.ts'
+import type { CommentReview, ParseCommentsInput, ReviewComment, ReviewVerdict, ReviewedDependencies } from './reviewed-dependencies.ts'
+
+const MAX_COMMENTS = 1000
+const KEPT_MS = 60_000
+const PARSED_KEPT_MS = 10 * 60_000
+const VERDICTS = new Set<string>(['accept', 'accept-with-nits', 'request-changes', 'reject'])
+
+// A comment as read: when it was written, and last edited, where it was.
+const COMMENT = `id author { ${ACTOR} } body createdAt lastEditedAt url`
+// Its comments and its reviews, each a page on from its cursor, each only
+// while it has more (`readComments`, `readReviews`).
+const QUERY = `query($owner: String!, $name: String!, $number: Int!, $comments: String, $reviews: String, $readComments: Boolean!, $readReviews: Boolean!) {
+  repository(owner: $owner, name: $name) { pullRequest(number: $number) { state
+    comments(first: 100, after: $comments) @include(if: $readComments) { pageInfo { hasNextPage endCursor } nodes { ${COMMENT} } }
+    reviews(first: 50, after: $reviews) @include(if: $readReviews) { pageInfo { hasNextPage endCursor }
+      nodes { ${COMMENT} state comments(first: 100) { pageInfo { hasNextPage endCursor } nodes { ${COMMENT} } } } }
+  } } }`
+// A review's comments on lines of its diff, a page on from its cursor.
+const REVIEW_COMMENTS = `query($id: ID!, $after: String) { node(id: $id) { ... on PullRequestReview {
+  comments(first: 100, after: $after) { pageInfo { hasNextPage endCursor } nodes { ${COMMENT} } } } } }`
+
+// A comment as read, and its author's account.
+interface Authored { comment: ReviewComment; account: { login: string | null; id: number | null } }
+type Page = { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: unknown }
+type Node = { id?: unknown; author?: GraphAccount; body?: unknown; state?: unknown; createdAt?: unknown; lastEditedAt?: unknown; url?: unknown; comments?: Page }
+
+// A pull request's comments as read, and whether it is open.
+interface PullComments { open: boolean; read: Authored[] }
+const comments: Lru<{ at: number } & PullComments> = lru(200)
+const answers: Lru<{ at: number; reviews: CommentReview[] }> = lru(2000)
+
+function authored(node: Node, kind: ReviewComment['kind']): Authored[] {
+  if (typeof node?.id !== 'string' || typeof node.body !== 'string' || typeof node.createdAt !== 'string') return []
+  const account = actorOf(node.author)
+  return [{ account, comment: { kind, id: node.id, author: account.login, body: node.body, ...typeof node.state === 'string' ? { state: node.state } : {},
+    createdAt: node.createdAt, ...typeof node.lastEditedAt === 'string' ? { editedAt: node.lastEditedAt } : {}, url: typeof node.url === 'string' ? node.url : '' } }]
+}
+const nodes = (list: unknown): Node[] => Array.isArray(list) ? list as Node[] : []
+// The cursor a page ends at, where more follow it.
+const next = (page: Page | undefined) => page?.pageInfo?.hasNextPage === true && typeof page.pageInfo.endCursor === 'string' ? page.pageInfo.endCursor : null
+
+// Review `review`'s comments on lines of its diff: the page read with it,
+// then those after it read of GitHub, till as many as `room` are.
+async function inlineComments(review: Node, room: number, token: string, fetchImpl: typeof fetch): Promise<Authored[]> {
+  const read = nodes(review.comments?.nodes).flatMap(inline => authored(inline, 'review-comment'))
+  for (let after = typeof review.id === 'string' ? next(review.comments) : null; after !== null && read.length < room;) {
+    const data = await githubGraphql(REVIEW_COMMENTS, { id: review.id, after }, token, fetchImpl) as { node?: { comments?: Page } | null } | null
+    read.push(...nodes(data?.node?.comments?.nodes).flatMap(inline => authored(inline, 'review-comment')))
+    after = next(data?.node?.comments)
+  }
+  return read
+}
+
+// Pull request `number`'s comments, its reviews' and those on its diff, each
+// review's all of them, and whether it is open, as kept, else read of GitHub
+// a page at a time.
+export async function pullComments(fullName: string, token: string, number: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<PullComments> {
+  const key = `${fullName}\0${number}`
+  const known = comments.get(key)
+  if (known && Date.now() - known.at < KEPT_MS) return known
+  const [owner, name] = fullName.split('/') as [string, string]
+  const read: Authored[] = []
+  let open: boolean | null = null
+  // Each connection read on from its cursor till it has no more, the other
+  // read on without it, never again from its first page.
+  let cursors: { comments: string | null; reviews: string | null } = { comments: null, reviews: null }
+  let reading = { comments: true, reviews: true }
+  while ((reading.comments || reading.reviews) && read.length < MAX_COMMENTS) {
+    const data = await githubGraphql(QUERY, { owner, name, number, ...cursors, readComments: reading.comments, readReviews: reading.reviews }, token, fetchImpl) as
+      { repository?: { pullRequest?: { state?: unknown; comments?: Page; reviews?: Page } | null } | null } | null
+    const pull = data?.repository?.pullRequest
+    if (!pull) break
+    open ??= pull.state === 'OPEN'
+    for (const node of nodes(pull.comments?.nodes)) read.push(...authored(node, 'comment'))
+    for (const node of nodes(pull.reviews?.nodes)) {
+      read.push(...authored(node, 'review'))
+      read.push(...await inlineComments(node, MAX_COMMENTS - read.length, token, fetchImpl))
+    }
+    cursors = { comments: reading.comments ? next(pull.comments) : null, reviews: reading.reviews ? next(pull.reviews) : null }
+    reading = { comments: cursors.comments !== null, reviews: cursors.reviews !== null }
+  }
+  const kept = { open: open === true, read: read.slice(0, MAX_COMMENTS) }
+  comments.set(key, { at: Date.now(), ...kept })
+  return kept
+}
+
+// The parser's reviews of `input`, as kept for the same, else asked.
+async function parsed(parse: NonNullable<ReviewedDependencies['parseComments']>, input: ParseCommentsInput): Promise<CommentReview[]> {
+  const key = createHash('sha256').update(JSON.stringify(input)).digest('base64url')
+  const known = answers.get(key)
+  if (known && Date.now() - known.at < PARSED_KEPT_MS) return known.reviews
+  const reviews = await parse(structuredClone(input))
+  if (!Array.isArray(reviews)) throw new TypeError('parseComments answered with no list')
+  answers.set(key, { at: Date.now(), reviews })
+  return reviews
+}
+
+const when = (time: unknown) => typeof time === 'number' ? time : typeof time === 'string' ? Date.parse(time) : Number.NaN
+// The reviews `answer` makes that count, by the users `reviewers` names,
+// each dependency's of each hash its integrity names, as of the time it
+// tells, else its user's latest comment's, as last written or edited.
+function counted(answer: CommentReview[], read: Authored[], reviewers: Map<string, string>): PublishedReview[] {
+  const latest = new Map<string, number>()
+  for (const { comment } of read) {
+    const login = comment.author?.toLowerCase()
+    if (login) latest.set(login, Math.max(latest.get(login) ?? 0, when(comment.createdAt) || 0, when(comment.editedAt) || 0))
+  }
+  return answer.flatMap(review => {
+    const login = typeof review?.user === 'string' ? review.user.toLowerCase() : ''
+    const reviewer = reviewers.get(login)
+    if (!reviewer || !latest.has(login) || !Array.isArray(review.dependencies)) return []
+    const time = Number.isFinite(when(review.time)) ? when(review.time) : latest.get(login)!
+    return review.dependencies.flatMap(dependency => {
+      const { name, version, integrity, patchHash, status } = dependency ?? {}
+      if (typeof name !== 'string' || typeof version !== 'string' || typeof integrity !== 'string' || !VERDICTS.has(status)) return []
+      return integrity.split(/\s+/u).filter(Boolean).map(hash => ({ package: name, version, integrity: hash, ...typeof patchHash === 'string' && patchHash ? { patchHash } : {},
+        basePackage: null, baseVersion: null, reviewer, login: review.user as string, status: status as ReviewVerdict, full: true, time }))
+    })
+  })
+}
+
+// The reviews pull request `number`'s comments make, as the host's parser
+// reads them, of the versions still wanting one, none where it isn't open
+// (the parser then not asked); `reviewers` the app's users
+// the accounts are, by their logins in lower case, of those whose reviews
+// count for the repository.
+export function commentReviews({ fullName, number, token, parse, reviewers, fetchImpl = globalThis.fetch }: {
+  fullName: string; number: number; token: string; parse: NonNullable<ReviewedDependencies['parseComments']>
+  reviewers: (accounts: { login: string; githubId: number | null }[]) => Promise<Map<string, string>>; fetchImpl?: typeof fetch
+}): CommentReviews {
+  return async wanting => {
+    try {
+      const { open, read } = await pullComments(fullName, token, number, fetchImpl)
+      if (!open) return { reviews: [], failed: false }
+      const accounts = new Map(read.flatMap(({ account }) => account.login ? [[account.login.toLowerCase(), { login: account.login, githubId: account.id }]] : []))
+      const answer = await parsed(parse, { repository: fullName, number, comments: read.map(({ comment }) => comment), dependencies: wanting })
+      return { reviews: counted(answer, read, await reviewers([...accounts.values()])), failed: false }
+    } catch (error) {
+      console.warn('reviewed dependencies: comments of', `${fullName}#${number}`, 'not read:', error instanceof Error ? error.message : error)
+      return { reviews: [], failed: true }
+    }
+  }
+}