@preventive/triage 1.0.0-alpha.52 → 1.0.0-alpha.54

package/common/bundle-compare-diff.js

@@ -25,8 +25,12 @@ import { resolutionKey } from './bundle-compare-inputs.js'
 
 // Resolutions compare independently from file bytes: identical files can be
 // wired together differently. Inputs are keyed by importer, specifier,
-// conditions (including import attributes), and platform. Only existing
-// resolutions whose targets changed are reported; additions/removals are omitted.
+// conditions (including import attributes), and platform. Resolutions whose
+// targets changed are reported (`changed`, repointed); one recorded on a side
+// alone (`onlyBase`, `onlyOther`) only where its importer holds the same
+// contents on both sides (`identical`, of its path as the other bundle lays
+// it out), as a file whose code changed gains and drops imports with it.
+// Each row names its target on either side, null on the side without one.
 // `renames` (base path → other path, see renamesOf) names base files as
 // the other bundle does: a renamed importer's resolutions pair with its new
 // path's, reported under it, and a target renamed is the same target.
@@ -34,21 +38,36 @@ import { resolutionKey } from './bundle-compare-inputs.js'
 // the bundles' roots differ, a base target shown as the other bundle would
 // lay it out; a path no file has (an importer the bundle didn't capture, a
 // builtin) may read either as it is or through the root.
-export function computeResolutionDiff(base, other, renames = new Map(), basePaths = new Map(), root = null) {
+export function computeResolutionDiff(base, other, renames = new Map(), basePaths = new Map(), root = null, identical = () => false) {
   const names = path => {
     const known = renames.get(path) ?? basePaths.get(path)
     return known === undefined ? [...new Set([path, through(root, path) ?? path])] : [known]
   }
-  const changed = []
+  const changed = [], onlyBase = [], onlyOther = []
+  const paired = new Set()
   for (const before of base.values()) {
     const after = names(before.parent).map(parent => other.get(resolutionKey(parent, before.specifier, before.conditions, before.platform))).find(Boolean)
-    if (after && !names(before.target).includes(after.target)) {
-      const { target: otherTarget, ...identity } = after
-      changed.push({ ...identity, baseTarget: basePaths.get(before.target) ?? before.target, otherTarget })
+    const baseTarget = basePaths.get(before.target) ?? before.target
+    if (after) {
+      paired.add(after.key)
+      if (!names(before.target).includes(after.target)) {
+        const { target: otherTarget, ...identity } = after
+        changed.push({ ...identity, baseTarget, otherTarget })
+      }
+      continue
     }
+    const parent = names(before.parent).find(identical)
+    if (parent === undefined) continue
+    const { specifier, conditions, platform } = before
+    onlyBase.push({ key: resolutionKey(parent, specifier, conditions, platform), parent, specifier, conditions, platform, baseTarget, otherTarget: null })
+  }
+  for (const after of other.values()) {
+    if (paired.has(after.key) || !identical(after.parent)) continue
+    const { target: otherTarget, ...identity } = after
+    onlyOther.push({ ...identity, baseTarget: null, otherTarget })
   }
-  changed.sort((a, b) => a.key.localeCompare(b.key))
-  return { changed, totalChanges: changed.length }
+  for (const rows of [changed, onlyBase, onlyOther]) rows.sort((a, b) => a.key.localeCompare(b.key))
+  return { changed, onlyBase, onlyOther, totalChanges: changed.length + onlyBase.length + onlyOther.length }
 }
 
 // A file's size, by the measure the Overview and Treemap use: text by the

package/common/bundle-compare-inputs.d.ts

@@ -1,2 +1,3 @@
 import type { BundleDetails } from './bundle-metadata.js'
 export function bundleCompareFiles(details: BundleDetails, scope?: string | null): Map<string, unknown>
+export function bundleCompareSideScopes(base: BundleDetails, other: BundleDetails, scope?: string | null): [string, string]

package/common/bundle-compare-inputs.js

@@ -1,31 +1,107 @@
 import { bundleFilesAsMap } from './bundle-sources.js'
 
-// Use the union of named trees. A tree absent from one stasis bundle contains
-// no files there; falling back to all files would invent additions/removals.
-// A bundle that names no trees (a sourcemap) is compared whole under any of
-// them. Unlike a single-bundle graph, retain a scope that includes every file
+// A side's files, and the named trees holding any of them, with those they hold.
+function namedTrees(details) {
+  const files = bundleFilesAsMap(details), trees = new Map()
+  for (const [name, paths] of Object.entries(details?.bundle?.reason ?? {})) {
+    const present = new Set(Array.isArray(paths) ? paths.filter(path => files.has(path)) : [])
+    if (present.size > 0) trees.set(name, present)
+  }
+  return { stasis: details?.kind === 'stasis', files, trees }
+}
+
+// Trees two sides name apart for the same files: a side naming the second of
+// a pair and not the first, the other the first and not the second, has it
+// compared as the first. A static build names the Metro bundle's `bundle:metro`
+// and the rest `bundle`, as a capture names them `metro` and `run`: `bundle` is
+// `run` only where `bundle:metro` is `metro`, on the same side.
+const ALIASES = [['extra', 'add'], ['metro', 'bundle:metro']]
+function aliased(sides) {
+  if (sides.length !== 2) return sides
+  const apart = (name, alias) => sides.find((side, i) => side.trees.has(alias) && !side.trees.has(name)
+    && sides[1 - i].trees.has(name) && !sides[1 - i].trees.has(alias))
+  const renames = sides.map(() => new Map())
+  for (const [name, alias] of ALIASES) {
+    const side = apart(name, alias)
+    if (side) renames[sides.indexOf(side)].set(alias, name)
+  }
+  const built = apart('metro', 'bundle:metro')
+  if (built && apart('run', 'bundle') === built) renames[sides.indexOf(built)].set('bundle', 'run')
+  // `actual`: the name a side gives a tree it is compared as another by.
+  return sides.map((side, i) => renames[i].size === 0 ? side : { ...side,
+    trees: new Map([...side.trees].map(([name, paths]) => [renames[i].get(name) ?? name, paths])),
+    actual: new Map([...renames[i]].map(([alias, name]) => [name, alias])) })
+}
+
+// The one tree of a stasis side naming every file it has (its own selector
+// hidden, as common/bundle-reasons.js hides it), where no other side names it:
+// such a side is compared within that tree under any of the others' trees.
+function soleTree(side, sides) {
+  if (!side.stasis || side.trees.size !== 1) return null
+  const [[name, paths]] = side.trees
+  return paths.size === side.files.size && !sides.some(other => other !== side && other.trees.has(name)) ? name : null
+}
+
+// A side naming no tree, or one alone holding all its files.
+const trivial = side => side.trees.size === 0 || (side.trees.size === 1 && [...side.trees.values()][0].size === side.files.size)
+
+// A tree of each side the other names none of, compared with each other, as
+// one scope: the same whichever side is the base, as a swap keeps it.
+const PAIR = 'reasons:'
+const pairScope = (first, second) => `${PAIR}${JSON.stringify([first, second].toSorted())}`
+function pairOf(scope) {
+  if (!scope.startsWith(PAIR)) return null
+  try {
+    const pair = JSON.parse(scope.slice(PAIR.length))
+    return Array.isArray(pair) && pair.length === 2 && pair.every(name => typeof name === 'string') ? pair : null
+  } catch { return null }
+}
+
+// Use the union of named trees, each as its side is compared (aliased). A tree
+// absent from one stasis bundle contains no files there; falling back to all
+// files would invent additions/removals. A bundle that names no trees (a
+// sourcemap) is compared whole under any of them, as is one whose sole tree
+// holds all its files where the other names none of it (soleTree), its tree
+// left out. Where neither side is trivial and each names a tree the other
+// doesn't, the trees both name are offered, and each of the first side's own
+// paired with each of the second's (pairScope), labelled from the first to the
+// second. Unlike a single-bundle graph, retain a scope that includes every file
 // on one side.
 export function bundleCompareScopes(...details) {
-  const names = new Set()
-  for (const item of details) {
-    const files = bundleFilesAsMap(item)
-    for (const [name, paths] of Object.entries(item?.bundle?.reason ?? {})) {
-      if (Array.isArray(paths) && paths.some(path => files.has(path))) names.add(name)
+  const sides = aliased(details.map(namedTrees))
+  if (sides.length === 2 && !sides.some(trivial)) {
+    const [first, second] = sides.map(side => [...side.trees.keys()].toSorted())
+    const shared = first.filter(name => second.includes(name))
+    const [firstOwn, secondOwn] = [first, second].map(names => names.filter(name => !shared.includes(name)))
+    if (firstOwn.length > 0 && secondOwn.length > 0) {
+      return [...shared.map(name => ({ id: `reason:${name}`, label: name })),
+        ...firstOwn.flatMap(from => secondOwn.map(to => ({ id: pairScope(from, to), label: `${from} → ${to}` })))]
     }
   }
+  const scoped = sides.filter(side => soleTree(side, sides) === null)
+  const names = new Set(scoped.flatMap(side => [...side.trees.keys()]))
   // A scope is only useful as a filter if it changes the files compared on
   // some side. Keep every scope when at least one does, otherwise hide the
   // selector, as single-bundle views do (see common/bundle-reasons.js).
-  const narrows = name => details.some(item => {
-    if (item?.kind !== 'stasis') return false
-    const files = bundleFilesAsMap(item)
-    const paths = item?.bundle?.reason?.[name]
-    return new Set(Array.isArray(paths) ? paths.filter(path => files.has(path)) : []).size < files.size
-  })
+  const narrows = name => scoped.some(side => side.stasis && (side.trees.get(name)?.size ?? 0) < side.files.size)
   if (![...names].some(narrows)) return []
   return [...names].toSorted().map(name => ({ id: `reason:${name}`, label: name }))
 }
 
+// Each side's scope in a comparison within `scope`: within the tree of a pair
+// (pairScope) it names; a side whose sole tree holds all its files, the other
+// naming none of it (soleTree), within that tree; each within the tree it
+// names as it is compared (aliased).
+export function bundleCompareSideScopes(base, other, scope = '') {
+  if (!scope) return ['', '']
+  const pair = pairOf(scope), sides = aliased([base, other].map(namedTrees))
+  const named = scope.startsWith('reason:') ? scope.slice('reason:'.length) : null
+  return sides.map(side => {
+    const name = pair ? pair.find(tree => side.trees.has(tree)) : soleTree(side, sides) ?? named
+    return name == null ? scope : `reason:${side.actual?.get(name) ?? name}`
+  })
+}
+
 export function bundleCompareFiles(details, scope = '') {
   const files = bundleFilesAsMap(details)
   if (!scope || details?.kind !== 'stasis') return files

package/common/bundle-comparison.js

@@ -10,7 +10,7 @@ import { bundlePkgOf } from './bundle-pkg-of.js'
 import { bundlePackageDirs, bundlePackageVersions } from './bundle-sources.js'
 import { bundleFileMeta, computeBundleDiff, computeResolutionDiff } from './bundle-compare-diff.js'
 import { comparePackages, computeVersionUpdates } from './bundle-compare-versions.js'
-import { bundleCompareFiles, bundleCompareResolutions } from './bundle-compare-inputs.js'
+import { bundleCompareFiles, bundleCompareResolutions, bundleCompareSideScopes } from './bundle-compare-inputs.js'
 import { bundleLineCounts } from './bundle-metadata.js'
 
 export function prepareComparison(base, other, scope = null) {
@@ -19,8 +19,10 @@ export function prepareComparison(base, other, scope = null) {
   // images differ, and total less than the Overview does.
   // From the bundle picked to the open one.
   const [from, to] = [base, other]
-  const baseSources = bundleCompareFiles(from, scope)
-  const otherSources = bundleCompareFiles(to, scope)
+  // Each side within its scope (bundleCompareSideScopes).
+  const [baseScope, otherScope] = bundleCompareSideScopes(from, to, scope)
+  const baseSources = bundleCompareFiles(from, baseScope)
+  const otherSources = bundleCompareFiles(to, otherScope)
   // Classify original paths and preserve recorded Stasis package
   // boundaries from either side, as the open one lays its files out
   // where their roots differ. Own source has one identity.
@@ -36,12 +38,17 @@ export function prepareComparison(base, other, scope = null) {
   for (const row of diff.files.onlyBase) row.lines = baseLines.get(row.basePath ?? row.path) ?? 0
   for (const row of diff.files.onlyOther) row.lines = otherLines.get(row.path) ?? 0
   for (const row of diff.files.changed) Object.assign(row, { baseLines: baseLines.get(row.basePath ?? row.path) ?? 0, otherLines: otherLines.get(row.path) ?? 0 })
+  // A file both sides hold with the same contents, renamed or recorded
+  // otherwise or not: an import resolution one side records alone is told
+  // only of these.
+  const differs = new Set([...diff.files.onlyOther, ...diff.files.changed.filter(row => row.modified !== false)].map(row => row.path))
   diff.resolutions = computeResolutionDiff(
-    bundleCompareResolutions(from, scope),
-    bundleCompareResolutions(to, scope),
+    bundleCompareResolutions(from, baseScope),
+    bundleCompareResolutions(to, otherScope),
     new Map(diff.files.changed.filter(row => row.renamedFrom != null).map(row => [row.basePath, row.path])),
     diff.files.basePaths,
     diff.files.root,
+    path => otherSources.has(path) && !differs.has(path),
   )
   // Dependency versions come from the stasis per-module `{ name,
   // version }` metadata, not the path/byte walk above, so they're
@@ -51,8 +58,8 @@ export function prepareComparison(base, other, scope = null) {
   // alone.
   // Keyed by install directory, as the sizes are (`bundlePkgOf`).
   const versionKey = dir => bundlePkgOf('', { packageDir: dir })
-  const baseVersions = bundlePackageVersions(from, scope ? baseSources.keys() : null, versionKey)
-  const otherVersions = bundlePackageVersions(to, scope ? otherSources.keys() : null, versionKey)
+  const baseVersions = bundlePackageVersions(from, baseScope ? baseSources.keys() : null, versionKey)
+  const otherVersions = bundlePackageVersions(to, otherScope ? otherSources.keys() : null, versionKey)
   diff.versionUpdates = computeVersionUpdates(baseVersions, otherVersions)
   diff.packageRows = comparePackages(diff.packages, baseVersions, otherVersions)
   // The reason scope its files are within, for what the server works out of

package/common/default-scan-models.ts

@@ -10,9 +10,12 @@ export function defaultScanModels(provider: string | null = null) {
     'openai/gpt-6-astra-pro',
     'openai/gpt-6.1-sol',
     'openai/gpt-6.1-sol-pro',
+    'openai/gpt-6.1-terra',
+    'openai/gpt-6.1-terra-pro',
     'openai/gpt-6-luna',
     'openai/gpt-6-luna-pro',
     'moonshotai/kimi-k3',
+    'moonshotai/kimi-k3.1-pro',
     'google/gemini-4-argon',
     'google/gemma-4-31b-it',
     'x-ai/grok-4.7',

package/common/dependency-reviews.d.ts

@@ -12,7 +12,7 @@ export function allowedReviewVerdicts(entries: { file: string; status: ReviewVer
 interface ReviewNpmVersion { version: string; private?: boolean; manifest?: Record<string, unknown> }
 export function npmTakenDown(entry: { npm: ReviewNpmVersion }): boolean
 export function npmReviewVerdictLimit(npm: ReviewNpmVersion | null | undefined,
-  advisoryList?: { versions: string[]; advisories: { id?: string; title?: string; severity?: string; cwe?: string[]; affected: number[] }[] } | null,
+  advisoryList?: { versions: string[]; advisories: { id?: string; title?: string; severity?: string; cwe?: string[]; malware?: boolean; affected: number[] }[] } | null,
   socket?: { alerts: { type: string }[] } | null, risk?: { findings: { id: string }[] } | null): ReviewVerdict
 export function needsPackageJsonReview(entries: { file: string; status: ReviewVerdict | null }[], files: string[], nonTextFiles?: string[] | null): boolean
 export function parseReviewNotes(comment: string): { text: string; bullet: boolean }[]

package/common/dependency-reviews.js

@@ -47,7 +47,7 @@ export function npmReviewVerdictLimit(npm, advisoryList, socket, risk) {
   const advisories = index < 0 ? [] : advisoryList.advisories.filter(advisory => advisory.affected.includes(index))
   const alerts = npm.private ? [] : socket?.alerts ?? []
   if (risk?.findings?.some(finding => finding.id === 'malware') || npmTakenDown({ npm }) || alerts.some(alert => alert.type === 'malware')
-    || advisories.some(advisory => npmMalwareAdvisory(advisory) || advisory.id?.startsWith('MAL-') || /^Malicious package\b/iu.test(advisory.title ?? ''))) return 'reject'
+    || advisories.some(advisory => advisory.malware === true || npmMalwareAdvisory(advisory) || advisory.id?.startsWith('MAL-') || /^Malicious package\b/iu.test(advisory.title ?? ''))) return 'reject'
   if (advisories.some(advisory => advisory.severity === 'critical') || alerts.some(alert => alert.type === 'criticalCVE')) return 'request-changes'
   return 'accept'
 }

package/common/managed/finding-detail.d.ts

@@ -1,3 +1,5 @@
 export const FINDING_DETAIL_FIELDS: readonly string[]
-export function liteReportData(data: unknown, options?: { fold?: boolean }): unknown
-export function liteWorkspace<T extends { filename: string; data: unknown }>(reports: readonly T[], links: readonly (readonly string[])[]): { reports: T[]; folded: boolean }
+export function liteReportData(data: unknown, options?: { fold?: boolean; shown?: ReadonlySet<string> | null }): unknown
+export function liteWorkspace<T extends { filename: string; data: unknown }>(reports: readonly T[], links: readonly (readonly string[])[], view?: import('./team-app.js').ManagedTeamView): {
+  reports: T[]; folded: false | 'rows' | 'app'; lens: { drop: boolean; detail: boolean; upstream: boolean } | null
+}

package/common/managed/finding-detail.js

@@ -1,5 +1,5 @@
 import { findingTitle, reportEntries, revalidateKindOf } from '@preventive/report'
-import { managedTeamRevalidationConflicted } from './team-app.js'
+import { managedTeamView } from './team-app.js'
 import { liteName } from './lite-name.js'
 
 // A finding's detail: what its popup, the views besides the board and an
@@ -8,7 +8,8 @@ import { liteName } from './lite-name.js'
 // and an export tell (write-md-finding.js PLAIN_FIELDS, CODE_FIELDS, but for
 // `priority`, which the board sorts and filters by), and the run meta its
 // card's run line and a report's header read (its `model` and `type`, which
-// the board's filters read, stay). A team's
+// the board's filters read, stay), and the link the report gave its location
+// (`location`), which its card does not draw. A team's
 // reports are first sent without it (server-managed/team-reports.ts), the
 // board drawn from them, and their findings filled in from the whole reports
 // (ui/view/managed-details.js).
@@ -16,7 +17,7 @@ export const FINDING_DETAIL_FIELDS = Object.freeze([
   'description', 'evidence', 'impact', 'reproduction', 'recommendation', 'confidenceReason', 'revalidateVerdict', 'revalidateRecommendation',
   'fileHash', 'exportName', 'methodName',
   'severityReason', 'commitHash', 'auditedCommit', 'detectedAt', 'committedAt', 'dateCreated', 'status', 'branch', 'pocStatus', 'parent', 'slug', 'reportPath',
-  'category', 'discoveredIn', 'effort', 'exportsMode',
+  'category', 'discoveredIn', 'effort', 'exportsMode', 'location',
 ])
 const DETAIL = new Set(FINDING_DETAIL_FIELDS)
 // A finding without its detail. One without a title of its own is named by its
@@ -37,14 +38,20 @@ const isPass = finding => revalidateKindOf(finding) === 'revalidation'
 // App mode shows of an entry holding the revalidation pass's row that row
 // alone (ui/view/group.js foldedTabs): with `fold`, such an entry is sent as
 // the pass's rows, the rows beneath them left for the whole reports
-// (ui/view/managed-details.js).
-export function liteReportData(data, { fold = false } = {}) {
+// (ui/view/managed-details.js). With `shown`, the IDs of the findings one
+// whose App view locks Confirmed shows (common/workspace-app.js
+// workspaceAppRows), those alone are sent.
+export function liteReportData(data, { fold = false, shown = null } = {}) {
   const key = Array.isArray(data?.findings) ? 'findings' : Array.isArray(data?.groups) ? 'groups' : null
   if (!key) return data
+  if (shown) {
+    const kept = entry => (Array.isArray(entry) ? entry : [entry]).filter(finding => shown.has(finding?.id))
+    return { ...data, [key]: data[key].map(kept).filter(entry => entry.length > 0).map(entry => entry.map(liteFinding)) }
+  }
   const entries = data[key].map(entry => {
     if (!Array.isArray(entry)) return liteFinding(entry)
-    const shown = fold && entry.length > 1 && entry.some(isPass) ? entry.filter(isPass) : entry
-    return shown.map(liteFinding)
+    const folded = fold && entry.length > 1 && entry.some(isPass) ? entry.filter(isPass) : entry
+    return folded.map(liteFinding)
   })
   return { ...data, [key]: entries }
 }
@@ -52,12 +59,17 @@ export function liteReportData(data, { fold = false } = {}) {
 const rows = data => (reportEntries(data) ?? []).flat().length
 
 // A team's reports as its board is first sent them (server-managed/team-reports.ts),
-// each `liteReportData`, folded where nothing in the workspace contradicts the
-// revalidation pass, which opens a view of it in App mode
-// (ui/view/render.js configureReportRevalidation); `folded` where that left
-// rows out.
-export function liteWorkspace(reports, links) {
-  const fold = !managedTeamRevalidationConflicted(Object.assign(reports.map(({ filename, data }) => ({ filename, data })), { links }))
-  const lite = reports.map(report => ({ ...report, data: liteReportData(report.data, { fold }) }))
-  return { reports: lite, folded: fold && lite.some((report, index) => rows(report.data) < rows(reports[index].data)) }
+// each `liteReportData`: where the workspace's App view locks Confirmed, only
+// the rows that view shows (`folded: 'app'`); else, where nothing in it
+// contradicts the revalidation pass, which opens a view of it in App mode
+// (ui/view/render.js configureReportRevalidation), its entries folded under
+// their App rows (`folded: 'rows'`). Folded, the `lens` the rows left out
+// tell (team-app.js managedTeamLens). All of it read from `view`, the
+// workspace's (team-app.js managedTeamView), where its builder has one.
+export function liteWorkspace(reports, links, view = managedTeamView(Object.assign(reports.map(({ filename, data }) => ({ filename, data })), { links }))) {
+  const shown = view.rows
+  const fold = shown !== null || !view.conflicted()
+  const lite = reports.map(report => ({ ...report, data: liteReportData(report.data, { fold, shown }) }))
+  if (!fold || !lite.some((report, index) => rows(report.data) < rows(reports[index].data))) return { reports: lite, folded: false, lens: null }
+  return { reports: lite, folded: shown ? 'app' : 'rows', lens: view.lens() }
 }

package/common/managed/team-app.d.ts

@@ -4,3 +4,12 @@ export type TeamAppMetadata = { appMode: true; appFindings: number } | { appMode
 export function managedTeamAppMetadata(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] },
   options?: { countFindings?: boolean }): TeamAppMetadata
 export function managedTeamRevalidationConflicted(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): boolean
+export function managedTeamAppRows(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): Set<string> | null
+export function managedTeamLens(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): { drop: boolean; detail: boolean; upstream: boolean }
+export interface ManagedTeamView {
+  app: TeamAppMetadata
+  rows: Set<string> | null
+  conflicted(): boolean
+  lens(): { drop: boolean; detail: boolean; upstream: boolean }
+}
+export function managedTeamView(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): ManagedTeamView

package/common/managed/team-app.js

@@ -1,7 +1,8 @@
-import { inheritReportMeta, isAppFinding, reportEntries } from '@preventive/report'
+import { inheritReportMeta, isAppFinding, reportEntries, revalidateKindOf } from '@preventive/report'
 import { collectDuplicates } from '../../client/linked-findings.js'
+import { dependencyDirectory, isDependencyFile } from '../../client/dependency-paths.js'
 import { hasRevalidateStamp } from '../finding-filters.js'
-import { workspaceAppMetadata } from '../workspace-app.js'
+import { workspaceApp, workspaceAppMetadata, workspaceAppRows } from '../workspace-app.js'
 import { mergeReportGroups } from '../workspace-groups.js'
 
 // The same classification as local workspaces, using only the complete,
@@ -22,11 +23,63 @@ export function managedTeamRevalidationConflicted(workspace) {
   return mergeReportGroups(viewReports(workspace).reports).conflicts.size > 0
 }
 
+// The IDs of the findings the workspace's basic App view can show
+// (common/workspace-app.js workspaceAppRows), or null.
+export function managedTeamAppRows(workspace) {
+  const { reports, duplicates } = viewReports(workspace)
+  return workspaceAppRows(reports, id => [...duplicates.get(id) ?? []])
+}
+
+// What a view of the whole workspace offers beside the App view
+// (ui/view/render.js), told by all its rows: whether the revalidation layer
+// can come off (`drop`), whether its detail stop has rows to unfold
+// (`detail`), and whether an upstream lens has ground (`upstream`).
+export function managedTeamLens(workspace) {
+  const { reports } = viewReports(workspace)
+  return lensOf(reports, mergeReportGroups(reports).groups)
+}
+
+// One reading of a team's published workspace for all that is asked of it as
+// its reports are built (server-managed/team-reports.ts), each worked out of
+// the same rows: its classification (managedTeamAppMetadata, its findings
+// counted, and of a team not App, how many of its reports open in App mode on
+// their own), the rows its App view shows (managedTeamAppRows), and, asked
+// only where wanted, whether copies contradict the pass
+// (managedTeamRevalidationConflicted) and what its rows offer the toolbar
+// (managedTeamLens).
+export function managedTeamView(workspace) {
+  const { reports, duplicates, linked } = viewReports(workspace)
+  const { metadata, rows } = workspaceApp(reports, id => [...duplicates.get(id) ?? []], { countFindings: true })
+  // Each report alone, with the links the workspace has, not its link reports'.
+  const alone = id => [...linked.get(id) ?? []]
+  const app = metadata.appMode ? metadata : { ...metadata, appReports: reports.filter(report => workspaceAppMetadata([report], alone).appMode).length }
+  let merged = null
+  const plain = () => merged ??= mergeReportGroups(reports)
+  return { app, rows, conflicted: () => plain().conflicts.size > 0, lens: () => lensOf(reports, plain().groups) }
+}
+
+const RULED_OUT = new Set(['refuted', 'unreachable'])
+
+function lensOf(reports, groups) {
+  const rows = reports.flatMap(report => report.groups.flat())
+  const directory = dependencyDirectory(reports)
+  const detail = groups.some(group => {
+    const kinds = group.map(revalidateKindOf)
+    return kinds.includes('partial') || kinds.includes('revalidation') && kinds.some(kind => kind !== 'revalidation' && !RULED_OUT.has(kind))
+  })
+  return {
+    drop: rows.some(hasRevalidateStamp),
+    detail,
+    upstream: rows.some(f => f.isUpstream === true || f.isApp === false && !('isUpstream' in f) && isDependencyFile(f.file, directory)),
+  }
+}
+
 // The workspace's reports as a view holds them (ui/view/ingest.js), with the
-// duplicates its links name.
+// duplicates its links name, and those its own `links` name alone (`linked`).
 function viewReports(workspace) {
-  const duplicates = new Map(), reports = []
+  const duplicates = new Map(), linked = new Map(), reports = []
   collectDuplicates(workspace.links ?? [], duplicates)
+  collectDuplicates(workspace.links ?? [], linked)
   for (const { filename, data } of workspace) {
     if (data.source === 'links' && Array.isArray(data.links)) {
       collectDuplicates(data.links, duplicates)
@@ -41,7 +94,7 @@ function viewReports(workspace) {
       finding._sourcePass = judged.has(finding._source)
       return finding
     }))
-    reports.push({ fileName: filename, groups })
+    reports.push({ fileName: filename, groups, treeDependencies: data.treeDependencies ?? null })
   }
-  return { reports, duplicates }
+  return { reports, duplicates, linked }
 }

package/common/workspace-app.js

@@ -1,5 +1,5 @@
 import { revalidateKindOf } from '@preventive/report'
-import { canLockConfirmed } from './finding-filters.js'
+import { activeRevalidateKinds, canLockConfirmed } from './finding-filters.js'
 import { mergeReportGroups } from './workspace-groups.js'
 import { mergeLinkedWorkspaceGroups } from './linked-workspace-groups.js'
 
@@ -27,13 +27,45 @@ function onlyUnjudgedImports(groups) {
 // `countFindings` has a workspace that is not App count its rows too, after
 // the same merging, for a caller that shows it collapsed (managed teams).
 export function workspaceAppMetadata(reports, duplicatesOf = () => [], { countFindings = false } = {}) {
-  const { groups, conflicts } = mergeReportGroups(reports, { hideRuledOut: true })
-  const linked = mergeLinkedWorkspaceGroups(groups, duplicatesOf, appTabs)
-  const notApp = countFindings ? { appMode: false, findings: linked.length } : { appMode: false }
-  if (conflicts.size > 0) return notApp
-  if (!onlyUnjudgedImports(linked) && !canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' })) return notApp
+  return metadataOf(appView(reports, duplicatesOf), countFindings)
+}
+
+// The IDs of the findings a workspace's basic App view can show: of each row
+// its locked Confirmed shows (ui/view/filters.js filterRevalidateKind), the
+// App tabs, the rest folded under them; none the pass ruled out. Null where it
+// has no such view, or one with no outcome to lock, which shows every row.
+export function workspaceAppRows(reports, duplicatesOf = () => []) {
+  return rowsOf(appView(reports, duplicatesOf))
+}
+
+// Both, of one merge of its rows.
+export function workspaceApp(reports, duplicatesOf = () => [], { countFindings = false } = {}) {
+  const view = appView(reports, duplicatesOf)
+  return { metadata: metadataOf(view, countFindings), rows: rowsOf(view) }
+}
+
+function metadataOf({ linked, app }, countFindings) {
+  if (!app) return countFindings ? { appMode: false, findings: linked.length } : { appMode: false }
   return {
     appMode: true,
     appFindings: linked.filter((group) => appTabs(group).some((f) => f.isApp)).length,
   }
 }
+
+function rowsOf({ linked, app }) {
+  if (!app || onlyUnjudgedImports(linked)) return null
+  const kinds = activeRevalidateKinds('confirmed', '')
+  const confirmed = (f) => kinds.includes(revalidateKindOf(f) || (f._source && !f._sourcePass ? 'revalidation' : ''))
+  const ids = new Set()
+  for (const group of linked) if (group.some(confirmed)) for (const f of appTabs(group)) ids.add(f.id)
+  return ids
+}
+
+// A workspace's rows as its basic App view merges them, and whether it has one.
+function appView(reports, duplicatesOf) {
+  const { groups, conflicts } = mergeReportGroups(reports, { hideRuledOut: true })
+  const linked = mergeLinkedWorkspaceGroups(groups, duplicatesOf, appTabs)
+  const app = conflicts.size === 0
+    && (onlyUnjudgedImports(linked) || canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' }))
+  return { linked, app }
+}