limn-review 0.1.123

package/dist/db/search.js

@@ -0,0 +1,317 @@
+import { and, desc, eq, inArray, or, sql } from 'drizzle-orm';
+import { db, schema, runTransaction } from './client.js';
+// Cross-repo text search over the local `search_index` (CORE, no AI), scoped to ONE workspace's
+// repos. The match is a PORTABLE case-insensitive SUBSTRING (`lower(col) LIKE pattern ESCAPE '\'`,
+// term lowercased in JS) so the SAME query runs on SQLite (local) and Postgres (cloud) — no dialect
+// fork, no FTS operator. Substring is the right semantics for the user's goal ("pinpoint where
+// certain text exists"). Every query filters on the denormalized `accountId`, so cross-account
+// isolation is a single indexed predicate. A Postgres `pg_trgm` GIN index (see schema.pg.ts) is a
+// drop-in accelerator.
+//
+// ⚠ NOTHING HERE PERSISTS A SCOPE. `search_index` stores `accountId` + `repoId` and the scope is
+// applied at QUERY time from the caller's resolved repo list, so the workspace refactor needs no
+// data migration on this table — unlike the plugin's report caches, which persist a `scope_key`.
+//
+// Case-folding caveat: SQL `lower()` folds ASCII on both dialects, but only Postgres folds non-ASCII
+// (accents, Cyrillic, …) — better-sqlite3 has no ICU. So a lowercase-accented query for
+// upper-accented content ("café" ⇢ "CAFÉ") matches on cloud but not locally. Acceptable: the corpus
+// (code, PR text) is ASCII-dominant, and closing it would need a normalized column + migration for a
+// rare case. ASCII search — the overwhelming majority — is identical on both.
+const { searchIndex, pullRequests, repos, users } = schema;
+const { reviews: reviewsT, reviewComments: rcT, prComments: pcT } = schema;
+const MAX_TERMS = 6;
+const SNIPPET_RADIUS = 90;
+const asDate = (d) => d instanceof Date ? d : new Date(d == null ? 0 : Number(d) * (Number(d) > 1e12 ? 1 : 1000));
+// Collapse whitespace + hard-cap the indexed text (shared with the persist path in upsert.ts). A
+// review/description can be arbitrarily long; the index only needs enough to match + snippet.
+export const SEARCH_TEXT_MAX = 4000;
+export function searchText(...parts) {
+    const joined = parts
+        .map((p) => (p ?? '').trim())
+        .filter((p) => p.length > 0)
+        .join('\n')
+        .replace(/\s+/g, ' ')
+        .trim();
+    return joined.length > SEARCH_TEXT_MAX ? joined.slice(0, SEARCH_TEXT_MAX) : joined;
+}
+// Split a raw query into up to MAX_TERMS lowercased terms; a "quoted phrase" is one term. The
+// terms are ANDed for hits (all must appear) and ORed for people (any name fragment matches).
+function parseTerms(query) {
+    const terms = [];
+    const re = /"([^"]+)"|(\S+)/g;
+    let m;
+    while ((m = re.exec(query)) != null && terms.length < MAX_TERMS) {
+        const t = (m[1] ?? m[2] ?? '').trim().toLowerCase();
+        if (t)
+            terms.push(t);
+    }
+    return terms;
+}
+// A `%term%` LIKE pattern with the LIKE metacharacters (%, _, \) escaped so the term matches
+// literally (paired with `ESCAPE '\'` in likeCol).
+function likePattern(term) {
+    return `%${term.replace(/([\\%_])/g, '\\$1')}%`;
+}
+// `lower(col) LIKE pattern ESCAPE '\'` — the portable substring predicate. `pattern` is bound as a
+// parameter (no injection); the ESCAPE clause is literal SQL identical on both dialects.
+function likeCol(col, pattern) {
+    return sql `lower(${col}) like ${pattern} escape '\\'`;
+}
+// A short excerpt of the matched text, centred on the earliest matched term (so the reader sees WHY
+// it matched). Falls back to the head of the text when only the author matched.
+function makeSnippet(body, terms) {
+    const lower = body.toLowerCase();
+    let idx = -1;
+    for (const t of terms) {
+        const i = lower.indexOf(t);
+        if (i >= 0 && (idx < 0 || i < idx))
+            idx = i;
+    }
+    if (idx < 0) {
+        return body.length > SNIPPET_RADIUS * 2 ? `${body.slice(0, SNIPPET_RADIUS * 2)}…` : body;
+    }
+    const start = Math.max(0, idx - SNIPPET_RADIUS);
+    const end = Math.min(body.length, idx + SNIPPET_RADIUS);
+    return `${start > 0 ? '…' : ''}${body.slice(start, end).trim()}${end < body.length ? '…' : ''}`;
+}
+const toIso = (d) => {
+    if (d == null)
+        return '';
+    const ms = d instanceof Date ? d.getTime() : Number(d) * (Number(d) > 1e12 ? 1 : 1000);
+    return new Date(ms).toISOString();
+};
+export async function searchPrs(accountId, opts) {
+    const query = opts.query.trim();
+    const terms = parseTerms(query);
+    // No terms, or an empty workspace → nothing to match.
+    if (terms.length === 0 || opts.repoIds.length === 0) {
+        return { query, hits: [], people: [], total: 0 };
+    }
+    // Each term must match the body OR the author's login/display name (ANDed across terms).
+    const termMatch = (term) => {
+        const pat = likePattern(term);
+        return or(likeCol(searchIndex.body, pat), likeCol(users.githubLogin, pat), likeCol(users.displayName, pat));
+    };
+    const repoFilter = inArray(searchIndex.repoId, opts.repoIds);
+    const kindFilter = opts.kinds && opts.kinds.length > 0 ? inArray(searchIndex.kind, opts.kinds) : undefined;
+    const where = and(eq(searchIndex.accountId, accountId), repoFilter, kindFilter, ...terms.map(termMatch));
+    const [rows, totalRows, people] = await Promise.all([
+        db
+            .select({
+            kind: searchIndex.kind,
+            prId: searchIndex.prId,
+            refId: searchIndex.refId,
+            threadId: searchIndex.threadId,
+            authorId: searchIndex.authorId,
+            body: searchIndex.body,
+            createdAt: searchIndex.createdAt,
+            prNumber: pullRequests.number,
+            prTitle: pullRequests.title,
+            prState: pullRequests.state,
+            repoId: repos.id,
+            repoOwner: repos.owner,
+            repoName: repos.name,
+            authorLogin: users.githubLogin,
+            authorAvatar: users.avatarUrl,
+        })
+            .from(searchIndex)
+            .innerJoin(pullRequests, eq(searchIndex.prId, pullRequests.id))
+            .innerJoin(repos, eq(searchIndex.repoId, repos.id))
+            .leftJoin(users, eq(searchIndex.authorId, users.id))
+            .where(where)
+            .orderBy(desc(searchIndex.createdAt))
+            .limit(opts.limit)
+            .offset(opts.offset)
+            .execute(),
+        db
+            .select({ n: sql `count(*)` })
+            // Only the users join is needed for the WHERE (author match); pullRequests/repos joins are
+            // display-only, so the count skips them.
+            .from(searchIndex)
+            .leftJoin(users, eq(searchIndex.authorId, users.id))
+            .where(where)
+            .execute(),
+        findPeople(accountId, opts.repoIds, terms),
+    ]);
+    const hits = rows.map((r) => ({
+        kind: r.kind,
+        prId: r.prId,
+        prNumber: r.prNumber,
+        prTitle: r.prTitle,
+        prState: r.prState,
+        repoId: r.repoId,
+        repoFullName: `${r.repoOwner}/${r.repoName}`,
+        refId: r.refId,
+        threadId: r.threadId,
+        authorId: r.authorId,
+        authorLogin: r.authorLogin ?? null,
+        authorAvatarUrl: r.authorAvatar ?? null,
+        snippet: makeSnippet(r.body, terms),
+        createdAt: toIso(r.createdAt),
+    }));
+    return { query, hits, people, total: Number(totalRows[0]?.n ?? 0) };
+}
+// The "People" facet: authors whose login/display name matches ANY term AND who have indexed
+// activity in the searched repos (so the person is real + relevant), ranked by how much they've
+// authored. `repoIds` is the same concrete workspace-bounded list `searchPrs` matched on — the
+// caller has already returned empty for `[]`, so the facet can never widen past the hits.
+async function findPeople(accountId, repoIds, terms) {
+    const nameMatch = or(...terms.map((t) => {
+        const pat = likePattern(t);
+        return or(likeCol(users.githubLogin, pat), likeCol(users.displayName, pat));
+    }));
+    const repoFilter = inArray(searchIndex.repoId, repoIds);
+    const n = sql `count(*)`;
+    const rows = await db
+        .select({
+        id: users.id,
+        login: users.githubLogin,
+        displayName: users.displayName,
+        avatarUrl: users.avatarUrl,
+        n,
+    })
+        .from(searchIndex)
+        .innerJoin(users, eq(searchIndex.authorId, users.id))
+        .where(and(eq(searchIndex.accountId, accountId), repoFilter, nameMatch))
+        .groupBy(users.id, users.githubLogin, users.displayName, users.avatarUrl)
+        .orderBy(desc(n))
+        .limit(10)
+        .execute();
+    return rows.map((r) => ({
+        id: r.id,
+        login: r.login,
+        displayName: r.displayName ?? null,
+        avatarUrl: r.avatarUrl ?? null,
+        matchCount: Number(r.n),
+    }));
+}
+// ---- backfill (startup) ------------------------------------------------------------------------
+// Index PRs that predate the search feature from ALREADY-STORED data (title + review/comment
+// bodies; the description only when pullRequests.body was persisted, i.e. non-lean — lean PRs get
+// their description indexed on the next sync via bodyText). Idempotent: only touches PRs that have
+// no search rows yet, in bounded batches, so a second run after a full pass is a cheap NOT-EXISTS
+// scan. Safe to fire-and-forget at startup.
+export async function backfillSearchIndex(batchSize = 200, maxBatches = 2000) {
+    let indexed = 0;
+    for (let b = 0; b < maxBatches; b++) {
+        const prRows = (await db
+            .select({
+            id: pullRequests.id,
+            accountId: pullRequests.accountId,
+            repoId: pullRequests.repoId,
+            title: pullRequests.title,
+            body: pullRequests.body,
+            authorId: pullRequests.authorId,
+            openedAt: pullRequests.openedAt,
+        })
+            .from(pullRequests)
+            .where(sql `not exists (select 1 from ${searchIndex} where ${searchIndex.prId} = ${pullRequests.id})`)
+            .limit(batchSize)
+            .execute());
+        if (prRows.length === 0)
+            break;
+        const prIds = prRows.map((p) => p.id);
+        const acctOf = new Map(prRows.map((p) => [p.id, p.accountId]));
+        const repoOf = new Map(prRows.map((p) => [p.id, p.repoId]));
+        const [revRows, rcRows, pcRows] = await Promise.all([
+            db
+                .select({ id: reviewsT.id, prId: reviewsT.prId, authorId: reviewsT.authorId, body: reviewsT.body, at: reviewsT.submittedAt })
+                .from(reviewsT)
+                .where(inArray(reviewsT.prId, prIds))
+                .execute(),
+            db
+                .select({ id: rcT.id, prId: rcT.prId, threadId: rcT.threadId, authorId: rcT.authorId, body: rcT.body, at: rcT.createdAt })
+                .from(rcT)
+                .where(inArray(rcT.prId, prIds))
+                .execute(),
+            db
+                .select({ id: pcT.id, prId: pcT.prId, authorId: pcT.authorId, body: pcT.body, at: pcT.createdAt })
+                .from(pcT)
+                .where(inArray(pcT.prId, prIds))
+                .execute(),
+        ]);
+        const rows = [];
+        for (const p of prRows) {
+            const text = searchText(p.title, p.body);
+            if (text)
+                rows.push({
+                    accountId: p.accountId,
+                    repoId: p.repoId,
+                    prId: p.id,
+                    kind: 'pr',
+                    refId: p.id,
+                    threadId: null,
+                    authorId: p.authorId,
+                    body: text,
+                    createdAt: asDate(p.openedAt),
+                });
+        }
+        for (const r of revRows) {
+            const text = searchText(r.body);
+            if (text)
+                rows.push({
+                    accountId: acctOf.get(r.prId),
+                    repoId: repoOf.get(r.prId),
+                    prId: r.prId,
+                    kind: 'review',
+                    refId: r.id,
+                    threadId: null,
+                    authorId: r.authorId,
+                    body: text,
+                    createdAt: asDate(r.at),
+                });
+        }
+        for (const c of rcRows) {
+            const text = searchText(c.body);
+            if (text)
+                rows.push({
+                    accountId: acctOf.get(c.prId),
+                    repoId: repoOf.get(c.prId),
+                    prId: c.prId,
+                    kind: 'review_comment',
+                    refId: c.id,
+                    threadId: c.threadId,
+                    authorId: c.authorId,
+                    body: text,
+                    createdAt: asDate(c.at),
+                });
+        }
+        for (const c of pcRows) {
+            const text = searchText(c.body);
+            if (text)
+                rows.push({
+                    accountId: acctOf.get(c.prId),
+                    repoId: repoOf.get(c.prId),
+                    prId: c.prId,
+                    kind: 'pr_comment',
+                    refId: c.id,
+                    threadId: null,
+                    authorId: c.authorId,
+                    body: text,
+                    createdAt: asDate(c.at),
+                });
+        }
+        // One transaction per batch. A concurrent live persistPr may have populated some of these PRs
+        // (with the richer, lean-safe rows from bodyText) BETWEEN this batch's un-indexed SELECT and
+        // here. Re-check inside the tx and INSERT only for PRs that STILL have no rows — never delete —
+        // so the backfill can neither clobber those fresh rows with its staler snapshot nor duplicate
+        // them. Chunked under SQLite's bound-variable limit.
+        await runTransaction(async (tx) => {
+            const already = (await tx
+                .select({ prId: searchIndex.prId })
+                .from(searchIndex)
+                .where(inArray(searchIndex.prId, prIds))
+                .execute());
+            const populated = new Set(already.map((r) => r.prId));
+            const fresh = rows.filter((r) => !populated.has(r.prId));
+            for (let i = 0; i < fresh.length; i += 100) {
+                await tx.insert(searchIndex).values(fresh.slice(i, i + 100)).execute();
+            }
+        });
+        indexed += prRows.length;
+        if (prRows.length < batchSize)
+            break; // last partial batch
+    }
+    return indexed;
+}
+//# sourceMappingURL=search.js.map

package/dist/db/security-alerts.js

@@ -0,0 +1,218 @@
+// ── LIVE AUTOMATION SECURITY ALERTS, DERIVED ON READ (CORE, deterministic, no AI) ──────────────
+//
+// The Dependencies tab's second source of `security` cards: a security TOOL's own comment on a PR
+// naming a KNOWN ADVISORY (a CVE / GHSA / … id) — Socket's "Critical CVE" report, a Dependency
+// Review failure, an AI reviewer's own thread finding. Nothing is stored: every read re-derives the
+// alert from the comment rows the sync already persists (comment and review bodies are ALWAYS
+// persisted), so an alert clears itself by STATE — the tool's latest comment stops naming one, or
+// the review thread is resolved / likely addressed — with no tombstone to forget.
+//
+// The rules are the detector's (sync/security-detect.ts `evaluateSecurityAlerts`); this file only
+// reads the candidate rows. ⚠ The SQL pre-filter is built straight from `SECURITY_ALERT_PREFILTER`
+// and may be LOOSER than the evaluator, never stricter: a tool's "all clear" (Socket's "All alerts
+// resolved") names no advisory, and it must still reach the evaluator, because it is the latest row
+// that decides. SQLite's case-blind `LIKE` and an `_` in a literal both widen it; the evaluator
+// re-applies every literal exact-case, so both dialects alert on the same rows.
+//
+// ⚠ COMMENTS AND REVIEWS ARE NARROWED TO THE TOOLS' OWN ACCOUNTS, and are still exactly as loose:
+// on those two surfaces an author-gated rule reads only its own tool's login, an author-free rule
+// (Frogbot, Checkmarx — they post through github-actions or a person's token) reads anyone's row
+// that carries its marker, and the `reviewer` fallback never reads them at all. THREADS are not
+// narrowed: that fallback reads every automated root carrying any literal, which on Postgres (a
+// case-sensitive `LIKE`) no narrower SQL can promise to keep. COST, measured on a copy of the dev DB
+// over Erxes' 83 active PRs, whose 5.2 MB of text is 99.8% automation's own (CodeRabbit and co.):
+// all 18 literals over every comment and review took ~65 ms of a ~400 ms fold; the narrowed reads
+// take ~10 ms. Threads stay at ~60 ms.
+import { and, asc, eq, inArray, like, ne, or, sql } from 'drizzle-orm';
+import { normalizeBotLogin } from '../shared/index.js';
+import { db, schema } from './client.js';
+import { evaluateSecurityAlerts, SECURITY_ALERT_PREFILTER, SECURITY_ALERT_RULES, } from '../sync/security-detect.js';
+const { prComments, reviews, reviewComments, reviewThreads, users } = schema;
+/** Each AUTHOR-FREE rule's marker (`author: null`): a `SECURITY_ALERT_PREFILTER` literal that every
+ *  body the rule `identifies` contains, so a person's row carrying it still reaches the evaluator.
+ *  pending-deps.test.ts holds this to the rules. */
+export const AUTHOR_FREE_ALERT_MARKERS = {
+    frogbot: 'Frogbot',
+    checkmarx: 'Checkmarx One',
+};
+/** `body LIKE '%s1%' OR body LIKE '%s2%' OR …` over the given literals. */
+function anyLike(body, literals) {
+    return or(...literals.map((s) => like(body, `%${s}%`)));
+}
+/** The rows of a COMMENT or REVIEW surface that may reach the evaluator — every row a rule reading
+ *  that surface could use. `null` = no rule reads it from anyone here: skip the read.
+ *  `toolIds` = the automated authors whose login an author-gated rule on this surface names. */
+function surfaceCandidates(surface, authorId, body, toolIds) {
+    const parts = [];
+    if (toolIds.length > 0) {
+        parts.push(and(inArray(authorId, [...toolIds]), anyLike(body, SECURITY_ALERT_PREFILTER)));
+    }
+    for (const rule of SECURITY_ALERT_RULES) {
+        if (rule.author !== null || !rule.surfaces.includes(surface))
+            continue;
+        const marker = AUTHOR_FREE_ALERT_MARKERS[rule.source];
+        // An author-free rule with no marker here reads the whole pre-filter, from anyone.
+        parts.push(marker != null ? like(body, `%${marker}%`) : anyLike(body, SECURITY_ALERT_PREFILTER));
+    }
+    return parts.length > 0 ? or(...parts) : null;
+}
+/**
+ * Live automation ALERTS naming a known advisory, for the given open PRs. DB-only, no GitHub call.
+ * Every live alert per PR, newest first, uncapped here — the card builder slices what it shows and
+ * carries the full count beside it.
+ *
+ * ⚠ TENANCY: `pr_comments` / `reviews` / `review_comments` carry no account_id. Every read here is
+ * keyed by `pr_id IN (prIds)`, and the ONLY caller passes the fold's account-scoped `openPrIds`.
+ * Never export a variant that takes ids from a request.
+ */
+export async function deriveSecurityAlerts(prIds, automatedIds, kindOf) {
+    if (prIds.length === 0)
+        return new Map();
+    const ids = [...prIds];
+    const threadBody = sql `coalesce(${reviewComments.body}, ${reviewComments.excerpt})`;
+    // The tools' own accounts among the automated authors. `users` is GLOBAL — read by id only.
+    const automatedLogins = automatedIds.size > 0
+        ? await db
+            .select({ id: users.id, login: users.githubLogin })
+            .from(users)
+            .where(inArray(users.id, [...automatedIds]))
+            .execute()
+        : [];
+    const toolIdsFor = (surface) => automatedLogins
+        .filter((u) => SECURITY_ALERT_RULES.some((r) => r.author !== null && r.surfaces.includes(surface) && r.author(normalizeBotLogin(u.login))))
+        .map((u) => u.id);
+    const commentWhere = surfaceCandidates('comment', prComments.authorId, prComments.body, toolIdsFor('comment'));
+    const reviewWhere = surfaceCandidates('review', reviews.authorId, reviews.body, toolIdsFor('review'));
+    const [commentRows, reviewRows, threadRows] = await Promise.all([
+        commentWhere == null
+            ? []
+            : db
+                .select({
+                id: prComments.id,
+                prId: prComments.prId,
+                authorId: prComments.authorId,
+                body: prComments.body,
+                createdAt: prComments.createdAt,
+            })
+                .from(prComments)
+                .where(and(inArray(prComments.prId, ids), commentWhere))
+                .execute(),
+        reviewWhere == null
+            ? []
+            : db
+                .select({
+                id: reviews.id,
+                prId: reviews.prId,
+                authorId: reviews.authorId,
+                body: reviews.body,
+                createdAt: reviews.submittedAt,
+            })
+                .from(reviews)
+                // A 'pending' review is an unsubmitted draft — it has said nothing yet.
+                .where(and(inArray(reviews.prId, ids), ne(reviews.state, 'pending'), reviewWhere))
+                .execute(),
+        db
+            .select({
+            id: reviewComments.id,
+            prId: reviewComments.prId,
+            authorId: reviewComments.authorId,
+            body: threadBody,
+            createdAt: reviewComments.createdAt,
+            threadId: reviewComments.threadId,
+            isResolved: reviewThreads.isResolved,
+            derivedState: reviewThreads.derivedState,
+        })
+            .from(reviewComments)
+            .innerJoin(reviewThreads, eq(reviewThreads.id, reviewComments.threadId))
+            .where(and(inArray(reviewComments.prId, ids), anyLike(threadBody, SECURITY_ALERT_PREFILTER)))
+            .execute(),
+    ]);
+    // WHICH candidate is its thread's ROOT — the earliest (created_at, id) of the WHOLE thread, not
+    // of the candidates (a reply can pass the pre-filter while the root does not). One extra read over
+    // the candidate threads, on `rc_thread_idx`; no correlated subquery, so it stays portable.
+    const threadIds = [...new Set(threadRows.map((r) => r.threadId))];
+    const rootIdOf = new Map();
+    if (threadIds.length > 0) {
+        const all = await db
+            .select({ id: reviewComments.id, threadId: reviewComments.threadId })
+            .from(reviewComments)
+            .where(inArray(reviewComments.threadId, threadIds))
+            .orderBy(asc(reviewComments.createdAt), asc(reviewComments.id))
+            .execute();
+        // Ordered (created_at, id), so the first row seen per thread is its root.
+        for (const r of all)
+            if (!rootIdOf.has(r.threadId))
+                rootIdOf.set(r.threadId, r.id);
+    }
+    // Logins, for the rules that name their tool's account. `users` is GLOBAL — read by id only.
+    const authorIds = [
+        ...new Set([...commentRows, ...reviewRows, ...threadRows]
+            .map((r) => r.authorId)
+            .filter((id) => id != null)),
+    ];
+    const loginOf = new Map();
+    if (authorIds.length > 0) {
+        for (const u of await db
+            .select({ id: users.id, login: users.githubLogin })
+            .from(users)
+            .where(inArray(users.id, authorIds))
+            .execute())
+            loginOf.set(u.id, u.login);
+    }
+    const login = (id) => (id != null ? loginOf.get(id) ?? null : null);
+    const rows = [
+        ...commentRows.map((r) => ({
+            surface: 'comment',
+            rowId: r.id,
+            prId: r.prId,
+            authorId: r.authorId,
+            authorLogin: login(r.authorId),
+            body: r.body ?? '',
+            createdAt: r.createdAt,
+            threadId: null,
+            isRoot: false,
+            threadResolved: false,
+            threadState: null,
+        })),
+        ...reviewRows.map((r) => ({
+            surface: 'review',
+            rowId: r.id,
+            prId: r.prId,
+            authorId: r.authorId,
+            authorLogin: login(r.authorId),
+            body: r.body ?? '',
+            createdAt: r.createdAt,
+            threadId: null,
+            isRoot: false,
+            threadResolved: false,
+            threadState: null,
+        })),
+        ...threadRows.map((r) => ({
+            surface: 'thread',
+            rowId: r.id,
+            prId: r.prId,
+            authorId: r.authorId,
+            authorLogin: login(r.authorId),
+            body: r.body ?? '',
+            createdAt: r.createdAt,
+            threadId: r.threadId,
+            isRoot: rootIdOf.get(r.threadId) === r.id,
+            threadResolved: r.isResolved,
+            threadState: r.derivedState,
+        })),
+    ];
+    const out = new Map();
+    for (const [prId, alerts] of evaluateSecurityAlerts(rows, automatedIds)) {
+        out.set(prId, alerts.map((a) => ({
+            source: a.source,
+            authorId: a.authorId,
+            vendorKind: kindOf.get(a.authorId) ?? null,
+            surface: a.surface,
+            threadId: a.threadId,
+            advisoryIds: a.advisoryIds,
+            at: a.at.toISOString(),
+        })));
+    }
+    return out;
+}
+//# sourceMappingURL=security-alerts.js.map