@preventive/triage 1.0.0-alpha.50 → 1.0.0-alpha.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.50",
+  "version": "1.0.0-alpha.52",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -166,6 +166,7 @@
     "server-managed/lockfile-scope.ts",
     "server-managed/npm-manifest.ts",
     "server-managed/npm-packages.ts",
+    "server-managed/npm-patch.ts",
     "server-managed/package-entry-points.ts",
     "server-managed/pretty-print.ts",
     "server-managed/pull-reviews.ts",
@@ -196,6 +197,8 @@
     "server-managed/repository-issues.ts",
     "server-managed/repository-pulse.ts",
     "server-managed/repository-pulls.ts",
+    "server-managed/listed-activity.ts",
+    "server-managed/repository-stamp.ts",
     "server-managed/repository-aliases.ts",
     "server-managed/repository-discovery.ts",
     "server-managed/repository-policy.ts",
@@ -283,6 +286,10 @@
     "common/managed/comments.ts",
     "common/managed/finding-detail.d.ts",
     "common/managed/finding-detail.js",
+    "common/managed/finding-values.d.ts",
+    "common/managed/finding-values.js",
+    "common/managed/lite-name.d.ts",
+    "common/managed/lite-name.js",
     "common/managed/github-agents.ts",
     "common/managed/github-logins.ts",
     "common/managed/npm-packages.d.ts",

package/server-managed/agent-merges.ts

@@ -33,7 +33,7 @@ type Rebase = [sha: string, at: number, subjects: string[], more?: number]
 export function agentMerges(list: PullList, since: number): AgentMerges {
   const merges = new Map<string, number>()
   const [rebases, pulls, pullRebases]: [Rebase[], [string, number, number][], Rebase[]] = [[], [], []]
-  for (const { number, merged } of list.pulls) {
+  for (const { number, merged } of list.rows) {
     if (!merged || merged.at < since) continue
     const { sha, at, subjects, more = 0 } = merged
     const rebase: Rebase | null = subjects ? more > 0 ? [sha, at, subjects, more] : [sha, at, subjects] : null

package/server-managed/app-agents.ts

@@ -16,6 +16,8 @@ export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = Object.entries<
 // and the app agents'.
 export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]
 // What the marks agents leave on commits are read by, as the history keeps
-// them (repository-history.ts commitMarks): bumped as how they are told
-// changes, so that the Agents tab reads again the pages kept by older rules.
+// them (repository-history.ts commitMarks), and branches' tips and the
+// commits the app agents' accounts authored (repository-agents.ts): bumped
+// as how they are told changes, so that the Agents tab reads again those
+// kept by older rules.
 export const AGENT_MARKS_READ = 1

package/server-managed/commit-lockfiles.ts

@@ -12,7 +12,7 @@
 import { createClient } from '@preventive/upstream/github.js'
 import { upstreamGithub } from './github-errors.ts'
 import { GithubApiError } from './github-app.ts'
-import type { LockedPackage } from './locked-packages.ts'
+import { type LockedPackage, patchedIn } from './locked-packages.ts'
 import { type Lru, lru } from './lru.ts'
 import { type GithubAsked, type ListedLockfile, type LockfileStore, eachOf, lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
 
@@ -57,16 +57,19 @@ export async function lockedAt(fullName: string, token: string, sha: string, kep
 }
 
 // The versions those of `read`'s lockfiles `held` holds to lock, each once,
-// and their paths.
+// each patch's file from the repository's root (patchedIn), the first of
+// them that names one there, and their paths.
 export function lockedIn(read: CommitLockfiles, held: (path: string) => boolean = () => true) {
   const packages = new Map<string, LockedPackage>()
   const paths: string[] = []
   for (const lockfile of read.lockfiles.filter(({ path }) => held(path))) {
     paths.push(lockfile.path)
     for (const pkg of lockfile.packages) {
+      const found = patchedIn(lockfile.path, { ...pkg })
       const kept = packages.get(lockedWith(pkg))
-      if (!kept) packages.set(lockedWith(pkg), { ...pkg })
-      else if (kept.dev && !pkg.dev) delete kept.dev
+      if (!kept) { packages.set(lockedWith(pkg), found); continue }
+      if (kept.dev && !pkg.dev) delete kept.dev
+      if (kept.patchPath === undefined && found.patchPath !== undefined) kept.patchPath = found.patchPath
     }
   }
   return { packages: [...packages.values()], paths }

package/server-managed/comparison.ts

@@ -1,5 +1,6 @@
 // Compare's comparison of two managed bundles or two versions of an npm
-// package (GET /api/bundles/:id/comparison?other=, GET /api/npm/comparison):
+// package, the one shown as a patch changes it where Review asks
+// (GET /api/bundles/:id/comparison?other=, GET /api/npm/comparison):
 // their files paired, at one path or renamed, with the sizes, resolutions,
 // dependency versions and line counts its Overview and Code read beside them,
 // as common/bundle-comparison.js prepareComparison works them out. The viewer
@@ -14,7 +15,8 @@ import { prepareComparison } from '../common/bundle-comparison.js'
 import type { BundleDetails } from '../common/bundle-metadata.js'
 import type { OpenedBlob } from './blob-store.ts'
 import { encodeBrotli } from './brotli.ts'
-import { type NpmPackageFile, npmFileRows } from './npm-packages.ts'
+import { type NpmPackageFile, type NpmVersionDocument, npmFileRows } from './npm-packages.ts'
+import type { NpmPatch } from './npm-patch.ts'
 
 // A side with no files, as Review compares a package's first version with:
 // one for each comparison, as working one out keeps its line counts on it.
@@ -39,3 +41,12 @@ export async function comparisonBody(base: BundleDetails, other: BundleDetails,
   const body = await encodeBrotli(Buffer.from(json))
   return { size: body.byteLength, stream: Readable.from([body]) }
 }
+
+// A version's `files` as `patch` changes them (npm-patch.ts patchedFiles), as
+// the viewer reads a version's (npm-loads.ts loadNpmPackageBody), with the
+// patch, as sent: `{ name, version, private, integrity, patch, files }`.
+export async function patchedVersionBody(doc: NpmVersionDocument, patch: NpmPatch, files: NpmPackageFile[]): Promise<OpenedBlob> {
+  const json = JSON.stringify({ name: doc.name, version: doc.version, private: doc.private, integrity: doc.dist.integrity, patch, files: npmFileRows(files) })
+  const body = await encodeBrotli(Buffer.from(json))
+  return { size: body.byteLength, stream: Readable.from([body]) }
+}

package/server-managed/db-neon.ts

@@ -1,4 +1,4 @@
-import { DEPENDENCY_REVIEW_COLUMNS, DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS, DEPENDENCY_REVIEW_INDEXES, DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
@@ -39,7 +39,7 @@ const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
 // Whether every version up to the latest is recorded, in one round trip at
 // a cold start: a database with no versions table yet (undefined_table) has
 // none. Outside a transaction, so the failed read aborts nothing.
-const SCHEMA_VERSIONS = 32
+const SCHEMA_VERSIONS = 33
 async function currentSchema(db: PgConnection): Promise<boolean> {
   try {
     const { rows } = await db.query(`SELECT count(*) AS n FROM managed_schema_version WHERE version BETWEEN 1 AND ${SCHEMA_VERSIONS}`)
@@ -192,6 +192,16 @@ async function migrateDependencyReviewShasums(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (32)')
 }
 
+// The patch a dependency review is of, and where it was read, none of
+// those written before; each author's one draft of a comparison held to its
+// patch too.
+async function migrateDependencyReviewPatches(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 33')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_dependency_review ${DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query(DEPENDENCY_REVIEW_INDEXES)
+  await db.query('INSERT INTO managed_schema_version VALUES (33)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -266,7 +276,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
     for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
-      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes, migrateDependencyReviewShasums]) await migrate(db)
+      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes, migrateDependencyReviewShasums, migrateDependencyReviewPatches]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')

package/server-managed/db.ts

@@ -10,7 +10,7 @@ import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
 import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
-import { DEPENDENCY_REVIEW_COLUMNS } from './dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS, DEPENDENCY_REVIEW_INDEXES } from './dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -126,6 +126,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
     for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
     for (const [column, type] of DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_dependency_review', column, type)
+    db.exec(DEPENDENCY_REVIEW_INDEXES)
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')

package/server-managed/dependency-review-comments.ts

@@ -7,7 +7,7 @@
 // only caller of the hook); and is told of none where it answers nothing, or
 // fails, which is logged.
 import type { DependencyReview, DependencyReviewStore } from './dependency-reviews.ts'
-import { type AddedPackage, type PullDependencies, eachOf } from './pull-dependencies.ts'
+import { type PullDependencies, eachOf } from './pull-dependencies.ts'
 import type { PublishedReview, RepoReviewState } from './repository-dependency-reviews.ts'
 import type { DependencyReviewEntry, ReviewedDependencies } from './reviewed-dependencies.ts'
 
@@ -20,13 +20,12 @@ const REVIEWS_AT_ONCE = 200
 
 // `review` as the hook is given it: each version with the integrity and
 // shasum the review keeps of the tarball it read, and the version it is of
-// with the patch `locked`, a pull request's lockfile, locks it with, where it
-// is one's.
-function entryOf(review: DependencyReview, locked?: AddedPackage | undefined): DependencyReviewEntry {
+// with the patch it is of, where it is a patched one's.
+function entryOf(review: DependencyReview): DependencyReviewEntry {
   return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '',
       ...review.baseShasum ? { shasum: review.baseShasum } : {} },
     new: { name: review.package, version: review.version, integrity: review.integrity, ...review.shasum ? { shasum: review.shasum } : {},
-      ...locked?.patchHash ? { patchHash: locked.patchHash } : {} },
+      ...review.patchHash ? { patchHash: review.patchHash } : {} },
     status: review.status!, coverage: review.coverage === 'full' ? 'full' : 'partial', comment: review.comment,
     files: review.entries.filter(entry => entry.status !== null || entry.comment.trim() !== '').map(entry => ({ path: entry.file, status: entry.status, comment: entry.comment })),
     reviewer: review.userLogin, publishedAt: review.publishedAt! }
@@ -38,13 +37,13 @@ const ownPublished = (review: DependencyReview, user: string) => review.user ===
 // What the host formats of `reviews`, of them `user`'s own published ones
 // alone, and the pull request they are of the versions of, where it is
 // one's; none where it formats none of them.
-async function formatOwn(reviewed: ReviewedDependencies | null, user: string, reviews: { review: DependencyReview; locked?: AddedPackage | undefined }[],
+async function formatOwn(reviewed: ReviewedDependencies | null, user: string, reviews: DependencyReview[],
   pullRequest?: { repository: string; number: number }): Promise<string | null> {
   const format = reviewed?.formatDependencyReviews
-  const own = reviews.filter(({ review }) => ownPublished(review, user))
+  const own = reviews.filter(review => ownPublished(review, user))
   if (!format || own.length === 0) return null
   try {
-    const text = await format({ reviews: own.map(({ review, locked }) => entryOf(review, locked)), ...pullRequest ? { pullRequest } : {} })
+    const text = await format({ reviews: own.map(entryOf), ...pullRequest ? { pullRequest } : {} })
     return typeof text === 'string' && text.trim() !== '' && text.length <= MAX_FORMATTED ? text : null
   } catch (error) {
     console.warn('reviewed dependencies: failed to format dependency reviews', error instanceof Error ? error.message : error)
@@ -57,16 +56,15 @@ async function formatOwn(reviewed: ReviewedDependencies | null, user: string, re
 export function withFormatted<T extends DependencyReview>(reviewed: ReviewedDependencies | null, user: string, reviews: T[]): Promise<(T & { formatted?: string })[]> {
   if (!reviewed?.formatDependencyReviews) return Promise.resolve(reviews)
   return eachOf(reviews, FORMAT_AT_ONCE, async review => {
-    const formatted = ownPublished(review, user) ? await formatOwn(reviewed, user, [{ review }]) : null
+    const formatted = ownPublished(review, user) ? await formatOwn(reviewed, user, [review]) : null
     return formatted ? { ...review, formatted } : review
   })
 }
 
-// Those of `reviews` `user` published of the versions `told` adds, by their
-// ids, with each version as its lockfile locks it: of its version, of an
-// integrity it is locked with and of its patch, whole or compared with a
-// version it was.
-function ownOfPull(told: PullDependencies, reviews: PublishedReview[], user: string): Map<string, AddedPackage> {
+// The ids of those of `reviews` `user` published of the versions `told`
+// adds, as its lockfiles lock each: of its version, of an integrity it is
+// locked with and of its patch, whole or compared with a version it was.
+function ownOfPull(told: PullDependencies, reviews: PublishedReview[], user: string): Set<string> {
   // Theirs by the version they are of, each version probed once.
   const theirs = new Map<string, PublishedReview[]>()
   for (const review of reviews) {
@@ -74,13 +72,13 @@ function ownOfPull(told: PullDependencies, reviews: PublishedReview[], user: str
     const key = `${review.package}@${review.version}`
     theirs.set(key, [...theirs.get(key) ?? [], review])
   }
-  const mine = new Map<string, AddedPackage>()
+  const mine = new Set<string>()
   if (theirs.size === 0) return mine
   for (const pkg of told.lockfiles.flatMap(dir => 'added' in dir ? dir.added : [])) {
     const hashes = new Set((pkg.integrity ?? '').split(/\s+/u).filter(Boolean))
     for (const review of theirs.get(`${pkg.name}@${pkg.version}`) ?? []) {
       if (!hashes.has(review.integrity) || (review.patchHash ?? '') !== (pkg.patchHash ?? '')) continue
-      if (review.basePackage === null || (review.basePackage === pkg.name && (pkg.was ?? []).includes(review.baseVersion ?? ''))) mine.set(review.id!, pkg)
+      if (review.basePackage === null || (review.basePackage === pkg.name && (pkg.was ?? []).includes(review.baseVersion ?? ''))) mine.add(review.id!)
     }
   }
   return mine
@@ -94,7 +92,7 @@ export async function formattedPull(reviewed: ReviewedDependencies | null, db: P
   if (!reviewed?.formatDependencyReviews || !state) return null
   const mine = ownOfPull(told, state.reviews, user)
   if (mine.size === 0) return null
-  const ids = [...mine.keys()], reviews: DependencyReview[] = []
+  const ids = [...mine], reviews: DependencyReview[] = []
   for (let at = 0; at < ids.length; at += REVIEWS_AT_ONCE) reviews.push(...await db.listOwnDependencyReviewsById(user, ids.slice(at, at + REVIEWS_AT_ONCE)))
-  return formatOwn(reviewed, user, reviews.map(review => ({ review, locked: mine.get(review.id) })), pullRequest)
+  return formatOwn(reviewed, user, reviews, pullRequest)
 }

package/server-managed/dependency-reviews.ts

@@ -1,20 +1,27 @@
 import { randomUUID } from 'node:crypto'
 import { ManagedMutationError } from './management.ts'
+import type { PatchSource } from './npm-patch.ts'
 import type { ManagedSql } from './sql.ts'
 import { REVIEW_VERDICTS, type ReviewSummary, type ReviewVerdict, allowedReviewVerdicts, needsPackageJsonReview, summarizeReview } from '../common/dependency-reviews.js'
 
+// A review is of a version, as npm's registry has it, by its integrity; of
+// it as pnpm patches it (`patchHash`, the patch's hash as a lockfile names
+// it), where it is patched; and compared with a version (its base), or none.
 export interface ReviewContext {
-  ecosystem: 'npm'; package: string; version: string; integrity: string
+  ecosystem: 'npm'; package: string; version: string; integrity: string; patchHash: string | null
   basePackage: string | null; baseVersion: string | null; baseIntegrity: string | null
 }
 // The shasums (sha1s, in hex) of the tarballs a review reads, its version's
 // and its base's, where npm tells them: each held, with its integrity, to the
-// tarball its reviewer was shown, as a review is written (http.ts).
-export interface ReviewedTarballs { shasum: string | null; baseShasum: string | null }
+// tarball its reviewer was shown, as a review is written (http.ts); and where
+// its patch was read (`patch`, npm-patch.ts), a patched version's.
+export interface ReviewedTarballs { shasum: string | null; baseShasum: string | null; patch?: PatchSource | null }
 export interface ReviewInput { file: string; comment: string; status: ReviewVerdict | null }
 export interface ReviewEntry extends ReviewInput { id: string; time: number }
 export interface ReviewTeam { id: string; name: string }
-export interface DependencyReview extends ReviewContext, ReviewedTarballs, ReviewSummary {
+export interface DependencyReview extends ReviewContext, Omit<ReviewedTarballs, 'patch'>, ReviewSummary {
+  // Where its patch was read, as it was written last: whence it is read again.
+  patchSource: PatchSource | null
   id: string; user: string | null; userLogin: string; userName: string | null; time: number; revision: number
   publishedAt: number | null; revokedAt: number | null; entries: ReviewEntry[]; teams: ReviewTeam[]; files: string[] | null
   nonTextFiles: string[] | null
@@ -27,7 +34,7 @@ export type ReviewChange = { action: 'save'; reviewId: string | null; revision:
   | { action: 'revoke'; reviewId: string; revision: number }
 export interface DependencyReviewStore {
   listDependencyReviews(context: ReviewContext, user: string, allBases?: boolean): Promise<DependencyReview[]>
-  getLatestOwnDependencyReview(user: string, target: Pick<ReviewContext, 'ecosystem' | 'package' | 'version' | 'integrity'>): Promise<DependencyReview | null>
+  getLatestOwnDependencyReview(user: string, target: Pick<ReviewContext, 'ecosystem' | 'package' | 'version' | 'integrity' | 'patchHash'>): Promise<DependencyReview | null>
   listOwnDependencyReviews(user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null }>
   // `user`'s own reviews of `ids`, none another's.
   listOwnDependencyReviewsById(user: string, ids: string[]): Promise<DependencyReview[]>
@@ -40,14 +47,17 @@ export interface DependencyReviewStore {
   listDependencyReviewEnabledTeams(): Promise<string[]>
   setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
   discardDependencyReview(sessionId: string, reviewId: string, revision: number): Promise<void>
-  // Written with the shasums of the tarballs read (`tarballs`), which a
-  // draft keeps as it is begun, saved and published; none where not told.
+  // Written with the shasums of the tarballs read (`tarballs`), and where its
+  // patch was, which a draft keeps as it is begun, saved and published; none
+  // where not told.
   changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number, tarballs?: ReviewedTarballs): Promise<DependencyReview>
 }
 
 // An unpublished review belongs only to its author. Publication freezes all
 // entries together and attaches that snapshot to its selected teams. Continuing
 // makes a new review; published entries and their timestamps never change.
+// Each author's one draft of a comparison is held so by
+// DEPENDENCY_REVIEW_INDEXES, once its columns are.
 export const DEPENDENCY_REVIEW_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_dependency_review (
   id TEXT PRIMARY KEY,
@@ -57,13 +67,10 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review (
   base_package TEXT NOT NULL, base_version TEXT NOT NULL, base_integrity TEXT NOT NULL,
   time INTEGER NOT NULL, revision INTEGER NOT NULL, published_at INTEGER, revoked_at INTEGER, files TEXT,
   status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT '',
-  shasum TEXT NOT NULL DEFAULT '', base_shasum TEXT NOT NULL DEFAULT ''
+  shasum TEXT NOT NULL DEFAULT '', base_shasum TEXT NOT NULL DEFAULT '', patch_hash TEXT NOT NULL DEFAULT '', patch_source TEXT
 ) STRICT;
 CREATE INDEX IF NOT EXISTS managed_dependency_review_context_idx
   ON managed_dependency_review(ecosystem, package, version, integrity, base_package, base_version, base_integrity, time);
-CREATE UNIQUE INDEX IF NOT EXISTS managed_dependency_review_unpublished_idx
-  ON managed_dependency_review(user_id, ecosystem, package, version, integrity, base_package, base_version, base_integrity)
-  WHERE published_at IS NULL;
 CREATE INDEX IF NOT EXISTS managed_dependency_review_author_idx ON managed_dependency_review(user_id, time, id);
 CREATE TABLE IF NOT EXISTS managed_dependency_file_review (
   id TEXT PRIMARY KEY, review_id TEXT NOT NULL REFERENCES managed_dependency_review(id) ON DELETE CASCADE,
@@ -79,18 +86,28 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
 CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id);
 `
 // The columns added since the table was, for a database that has it already.
-export const DEPENDENCY_REVIEW_COLUMNS = [['shasum', "TEXT NOT NULL DEFAULT ''"], ['base_shasum', "TEXT NOT NULL DEFAULT ''"]] as const
-const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
-const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ?'
+export const DEPENDENCY_REVIEW_COLUMNS = [['shasum', "TEXT NOT NULL DEFAULT ''"], ['base_shasum', "TEXT NOT NULL DEFAULT ''"],
+  ['patch_hash', "TEXT NOT NULL DEFAULT ''"], ['patch_source', 'TEXT']] as const
+// Each author's one draft of a comparison, its patch's too, made once those
+// columns are: the index held to it before patches were reviewed gone.
+export const DEPENDENCY_REVIEW_INDEXES = `
+DROP INDEX IF EXISTS managed_dependency_review_unpublished_idx;
+CREATE UNIQUE INDEX IF NOT EXISTS managed_dependency_review_draft_idx
+  ON managed_dependency_review(user_id, ecosystem, package, version, integrity, patch_hash, base_package, base_version, base_integrity)
+  WHERE published_at IS NULL;`
+const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.patchHash ?? '', c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
+const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ? AND patch_hash = ?'
 const contextWhere = `${targetWhere} AND base_package = ? AND base_version = ? AND base_integrity = ?`
 // Its author by the login they reviewed as, and by the name the app's user
 // has now (null once they are none, or have none), as the lists show them.
 const columns = `id, user_id AS user, user_login AS userLogin, (SELECT n.name FROM managed_user n WHERE n.id = user_id) AS userName, ecosystem, package, version, integrity,
-  NULLIF(base_package, '') AS basePackage, NULLIF(base_version, '') AS baseVersion, NULLIF(base_integrity, '') AS baseIntegrity,
-  NULLIF(shasum, '') AS shasum, NULLIF(base_shasum, '') AS baseShasum,
+  NULLIF(patch_hash, '') AS patchHash, NULLIF(base_package, '') AS basePackage, NULLIF(base_version, '') AS baseVersion, NULLIF(base_integrity, '') AS baseIntegrity,
+  NULLIF(shasum, '') AS shasum, NULLIF(base_shasum, '') AS baseShasum, patch_source AS patchSource,
   time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
 const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
-const shasums = (tarballs: ReviewedTarballs | undefined) => [tarballs?.shasum ?? '', tarballs?.baseShasum ?? '']
+// What a review keeps of the bytes it read: its tarballs' shasums, and where
+// its patch was.
+const shasums = (tarballs: ReviewedTarballs | undefined) => [tarballs?.shasum ?? '', tarballs?.baseShasum ?? '', tarballs?.patch ? JSON.stringify(tarballs.patch) : null]
 
 // Who reviews dependencies in team `t`, user `u` as the query joins them: an
 // admin, in any team; a member who manages, in theirs; a member who triages,
@@ -136,7 +153,7 @@ async function requireReviewer(db: ManagedSql, user: string) {
   if ((await teams(db, user)).length === 0) throw new ManagedMutationError(403, 'review-access-required')
 }
 
-type ReviewRow = Omit<DependencyReview, 'files' | 'entries' | 'teams' | keyof ReviewSummary> & { files: string | null }
+type ReviewRow = Omit<DependencyReview, 'files' | 'entries' | 'teams' | 'patchSource' | keyof ReviewSummary> & { files: string | null; patchSource: string | null }
 async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
   const reviews = rows as ReviewRow[]
   if (reviews.length === 0) return []
@@ -162,13 +179,14 @@ async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Pro
 }
 // A review as its row, its entries and the teams its reader reads it in
 // tell it: its files' snapshot, its entries a file's each (fileEntries), and
-// what they sum up to.
+// what they sum up to; where its patch was read.
 function expanded(review: ReviewRow, entries: ReviewEntry[], readIn: ReviewTeam[]): DependencyReview {
   const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
   const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
   const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
   const ownEntries = fileEntries(entries)
-  return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles), teams: readIn }
+  return { ...review, patchSource: review.patchSource ? JSON.parse(review.patchSource) as PatchSource : null, files, nonTextFiles, entries: ownEntries,
+    ...summarizeReview(ownEntries, files, nonTextFiles), teams: readIn }
 }
 // Rows gathered into one JSON array value (json_group_array): its text on
 // SQLite, parsed already on Postgres, where none gather as NULL.
@@ -185,7 +203,7 @@ async function publish(db: ManagedSql, current: DependencyReview | undefined, us
     if (!summarizeReview(entries, change.files, change.nonTextFiles).checkedFiles) throw new ManagedMutationError(400, 'no-reviewed-files')
     if (!change.final || !allowedReviewVerdicts(entries.filter(entry => !change.nonTextFiles.includes(entry.file))).includes(change.final.status)) throw new ManagedMutationError(400, 'bad-final-verdict')
     if (needsPackageJsonReview(entries, change.files, change.nonTextFiles)) throw new ManagedMutationError(400, 'package-json-not-reviewed')
-    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, shasum = ?, base_shasum = ?, revision = revision + 1
+    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, shasum = ?, base_shasum = ?, patch_source = ?, revision = revision + 1
       WHERE id = ?`).run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }),
       change.final.status, change.final.comment, ...shasums(tarballs), current.id)
   } else {
@@ -211,7 +229,7 @@ async function listContext(db: ManagedSql, context: ReviewContext, user: string,
     AND (user_id = ? OR (published_at IS NOT NULL AND EXISTS (
       SELECT 1 FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
       WHERE rt.review_id = r.id AND ${reviewsIn(false)})))
-    ORDER BY time, id`).all(...values(context).slice(0, allBases ? 4 : 7), user, user)
+    ORDER BY time, id`).all(...values(context).slice(0, allBases ? 5 : 8), user, user)
   return expandReviews(db, rows, user)
 }
 
@@ -277,8 +295,8 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
     listTeamDependencyReviews: (teamId, user, before) => listTeam(db, teamId, user, before),
     async getLatestOwnDependencyReview(user, target) {
       const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
-        WHERE user_id = ? AND ecosystem = ? AND package = ? AND version = ? AND integrity = ? ORDER BY time DESC, id DESC LIMIT 1`)
-        .get(user, target.ecosystem, target.package, target.version, target.integrity)
+        WHERE user_id = ? AND ${targetWhere} ORDER BY time DESC, id DESC LIMIT 1`)
+        .get(user, target.ecosystem, target.package, target.version, target.integrity, target.patchHash ?? '')
       return row ? (await expandReviews(db, [row], user))[0]! : null
     },
     async discardDependencyReview(sessionId, reviewId, revision) {
@@ -312,8 +330,8 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         if (await unpublished()) return conflict()
         const next = randomUUID()
         await db.prepare(`INSERT INTO managed_dependency_review
-          (id, user_id, user_login, ecosystem, package, version, integrity, base_package, base_version, base_integrity, shasum, base_shasum, time, revision)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), ...shasums(tarballs), now)
+          (id, user_id, user_login, ecosystem, package, version, integrity, patch_hash, base_package, base_version, base_integrity, shasum, base_shasum, patch_source, time, revision)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), ...shasums(tarballs), now)
         return next
       }
       if (change.action === 'start') {
@@ -336,7 +354,7 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
       } else {
         if (current?.publishedAt != null) return conflict()
         if (change.entry.status === null && !change.entryId) throw new ManagedMutationError(400, 'bad-review')
-        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, shasum = ?, base_shasum = ?, revision = revision + 1 WHERE id = ?').run(now, ...shasums(tarballs), id)
+        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, shasum = ?, base_shasum = ?, patch_source = ?, revision = revision + 1 WHERE id = ?').run(now, ...shasums(tarballs), id)
         else { if (change.entryId) return conflict(); id = await create() }
         await saveFile(db, id, change.entry, change.entryId, now)
       }

package/server-managed/github-app.ts

@@ -6,16 +6,13 @@ import { Buffer } from 'node:buffer'
 import { createHash, createSign } from 'node:crypto'
 import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
-import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
-import { onTokenRejected, shareGithubRead, tokenRejected } from './github-requests.ts'
-import { timed } from './request-timing.ts'
+import { GithubApiError, upstreamGithub } from './github-errors.ts'
+import { USER_AGENT, githubJson, onTokenRejected } from './github-requests.ts'
 
 export { GithubApiError } from './github-errors.ts'
-export { onTokenRejected } from './github-requests.ts'
+export { githubJson, onTokenRejected } from './github-requests.ts'
 
 const GITHUB_API = 'https://api.github.com'
-const API_VERSION = '2022-11-28'
-const USER_AGENT = 'deepview-triage'
 const PER_PAGE = 100
 const INSTALLATION_TOKEN_TTL_MS = 5 * 60_000
 const INSTALLATION_TOKEN_EXPIRY_MARGIN_MS = 60_000
@@ -69,42 +66,6 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
   return [...byName.values()].toSorted((a, b) => a.fullName.localeCompare(b.fullName))
 }
 
-// One GitHub API call returning parsed JSON, optionally Bearer-authed by a
-// user token, App JWT, or installation token, `body` sent as JSON (a GraphQL
-// query's, given longer to answer). Network / non-2xx / malformed fold into a
-// GithubApiError (401 passes through for the caller to handle). Identical GETs
-// share an outstanding read through its body. POSTs only opt in for read-only
-// GraphQL queries (repository-history.ts), never for mutations or token mints.
-export function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
-  readOnly = method === 'GET'): Promise<unknown> {
-  if (readOnly) return shareGithubRead(fetchImpl, JSON.stringify([url, token, method, body]), () => githubJson(url, token, fetchImpl, method, body, false))
-  // Each call told in its request's Server-Timing (request-timing.ts).
-  return timed('gh', async () => {
-    let res: Response
-    const started = Date.now()
-    try {
-      res = await fetchImpl(url, {
-        method,
-        signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
-        redirect: 'error',
-        headers: {
-          ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
-          ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
-        },
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-      })
-    } catch (error) { throw githubUnreachable(error, started) }
-    if (res.status === 401 && token) tokenRejected(token, fetchImpl)
-    if (!res.ok) await throwGithubResponseError(res)
-    // The answer's body is read within the same timeout: one not read whole is
-    // GitHub not reached, as one not answered is; only one that isn't JSON is
-    // malformed.
-    try { return await res.json() } catch (error) {
-      throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
-    }
-  })
-}
-
 // Validate one repo object into a ConnectedRepo (or null to skip), tagging it
 // with the installation it was reached through (null for the user-token path). A
 // missing numeric id or full name → skip (can't key/locate it). Archived repos