@preventive/triage 1.0.0-alpha.23 → 1.0.0-alpha.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.23",
+  "version": "1.0.0-alpha.26",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT",
   "author": {
@@ -119,7 +119,9 @@
     "server-managed/http.ts",
     "server-managed/import-triage.ts",
     "server-managed/managed-issues.ts",
+    "server-managed/management.ts",
     "server-managed/index.ts",
+    "server-managed/package-entry-points.ts",
     "server-managed/public-workspace.ts",
     "server-managed/repo-path.ts",
     "server-managed/report-migration.ts",
@@ -153,6 +155,7 @@
     "report/index.js",
     "report/src/finding-id.js",
     "report/src/finding.js",
+    "report/src/severity.js",
     "report/src/security.js",
     "report/src/labels.js",
     "report/src/md-structure.js",

package/report/index.js

@@ -82,6 +82,7 @@ import { parseDeepviewMarkdown } from './src/parse-deepview-md.js'
 import { parseMarkdownFindings } from './src/parse-md.js'
 import { parsePioliumFindings } from './src/parse-piolium.js'
 import { deriveFindingId } from './src/finding-id.js'
+import { normalizeFindingSeverity } from './src/severity.js'
 
 // The rest of the surface, so a consumer needs one import: the codex
 // splitter, the id helpers the analyzer shares with the viewer, and the
@@ -193,7 +194,10 @@ export function readReport(content) {
   let jsonError
   try {
     const data = JSON.parse(content)
-    if (reportEntries(data)) return { data, format: 'json', reason: null }
+    if (reportEntries(data)) {
+      for (const finding of flattenFindings(reportEntries(data))) normalizeFindingSeverity(finding)
+      return { data, format: 'json', reason: null }
+    }
     return { data: null, format: null, reason: 'JSON, but not a report: no findings array' }
   } catch (err) {
     jsonError = err
@@ -233,6 +237,8 @@ function flattenFindings(entries) {
 // untouched. Batched via Promise.all — sequential awaits would
 // serialise hundreds of crypto.subtle.digest calls for no reason.
 export async function backfillFindingIds(findings) {
+  // Managed responses may arrive as already-parsed objects.
+  for (const finding of findings) normalizeFindingSeverity(finding)
   const idLess = findings.filter((f) => !f.id)
   if (idLess.length === 0) return
   const derived = await Promise.all(idLess.map(deriveFindingId))

package/report/src/finding-id.js

@@ -71,7 +71,7 @@ export async function deriveFindingId(f) {
 // The choice above as the object that gets hashed. Key order is part of
 // the id — JSON.stringify keeps insertion order — so every shape lists
 // severity and description first.
-function fingerprintOf(f) {
+export function fingerprintOf(f) {
   if (f._idBasis) return f._idBasis
   const { severity, description } = f
   if (f.fileHash) return { severity, description, fileHash: f.fileHash }

package/report/src/finding.js

@@ -8,6 +8,7 @@
 
 import { fenceRanges, inFence } from './md-structure.js'
 import { SOURCE_LABELS } from './labels.js'
+import { canonicalSeverity } from './severity.js'
 
 // Severity ranking — higher = more severe. Two stacks: vulnerabilities
 // (critical → low) over bug-class findings (high_bug → bug), with
@@ -33,6 +34,7 @@ export const SEVERITIES = ['critical', 'high', 'medium', 'low', 'high_bug', 'bug
 // Only a known tier counts: an unrecognised one would sort to rank 0 and
 // render an uncolored badge, so the intrinsic severity stands instead.
 function validCorrected(corrected) {
+  corrected = canonicalSeverity(corrected)
   return corrected != null && corrected in SEVERITY_ORDER ? corrected : null
 }
 
@@ -40,20 +42,20 @@ function validCorrected(corrected) {
 // correction — it IS that report's finding — so no report key is needed;
 // divergence across reports comes from correctedVariants.
 export function effectiveSeverity(f) {
-  return validCorrected(f?.correctedSeverity) ?? f?.severity
+  return validCorrected(f?.correctedSeverity) ?? canonicalSeverity(f?.severity)
 }
 
 // True when the finding carries a valid correction that actually changes
 // the tier — the trigger for the dual badge / reason affordance.
 export function hasSeverityCorrection(f) {
   const c = validCorrected(f?.correctedSeverity)
-  return c != null && c !== f?.severity
+  return c != null && c !== canonicalSeverity(f?.severity)
 }
 
 // Every display, count and sort site reads severity through this with the
 // current lens (`state.severityMode`), not off `f.severity`.
 export function displayedSeverity(f, mode) {
-  return mode === 'original' ? f?.severity : effectiveSeverity(f)
+  return mode === 'original' ? canonicalSeverity(f?.severity) : effectiveSeverity(f)
 }
 
 // The per-report map of a deduped survivor, but only where the reports
@@ -61,7 +63,7 @@ export function displayedSeverity(f, mode) {
 export function correctedVariants(f) {
   const byReport = f?._correctedByReport
   if (!byReport) return null
-  const tiers = new Set(Object.values(byReport).map((v) => v?.severity))
+  const tiers = new Set(Object.values(byReport).map((v) => canonicalSeverity(v?.severity)))
   return tiers.size > 1 ? byReport : null
 }
 

package/report/src/labels.js

@@ -3,6 +3,8 @@
 // export dialog, the analyzer dropdown, the page header — so a filter
 // the dialog lists and the header line in the file can't disagree.
 
+import { canonicalSeverity } from './severity.js'
+
 export const SEVERITY_LABELS = {
   critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low',
   high_bug: 'High bug', bug: 'Bug', informational: 'Informational',
@@ -29,5 +31,5 @@ export const SOURCE_LABELS = {
 // invent one, and the reader is better served by the word than by a
 // blank.
 export function severityLabel(severity) {
-  return SEVERITY_LABELS[severity] ?? String(severity ?? '')
+  return SEVERITY_LABELS[canonicalSeverity(severity)] ?? String(severity ?? '')
 }

package/report/src/parse-codex.js

@@ -14,6 +14,8 @@
 // Only the first path in `relevant_paths` becomes `f.file` (some
 // findings list several, as `path1 | path2 | …`); the rest are dropped.
 
+import { normalizeFindingSeverity } from './severity.js'
+
 const REQUIRED_COLUMNS = [
   'finding_url', 'repository', 'title', 'description', 'severity',
   'configured_scan_id', 'relevant_paths',
@@ -143,5 +145,5 @@ function rowToFinding(r) {
   if (r.commit_hash) finding.commitHash = r.commit_hash
   if (r.detected_at) finding.detectedAt = r.detected_at
   if (r.committed_at) finding.committedAt = r.committed_at
-  return finding
+  return normalizeFindingSeverity(finding)
 }

package/report/src/parse-deepsec.js

@@ -30,6 +30,7 @@
 // `## SEVERITY (n)` header appears and the chain moves on.
 
 import { normalizeNewlines, splitHeadingLine } from './md-structure.js'
+import { normalizeFindingSeverity } from './severity.js'
 
 // The `## SEVERITY (n)` header that marks a DeepSec document. Splitting
 // on it with the tier captured interleaves tiers and content:
@@ -50,6 +51,7 @@ function mapSeverity(s) {
     case 'HIGH_BUG': return 'high_bug'
     case 'BUG': return 'bug'
     case 'INFO': case 'INFORMATIONAL': return 'informational'
+    case 'INFORMATIVE': return 'informative'
     default: return 'medium'
   }
 }
@@ -193,5 +195,5 @@ function parseBlock(block, severity) {
     if (fields.reasoning) finding.revalidateVerdict = fields.reasoning.replaceAll('**', '')
   }
   if (fields.slug) finding.slug = fields.slug
-  return finding
+  return normalizeFindingSeverity(finding, severity === 'informative' ? 'medium' : severity)
 }

package/report/src/parse-deepview-md.js

@@ -56,6 +56,7 @@
 import { locationLabel } from './finding.js'
 import { H2_RE, H3_RE, H4_RE, normalizeNewlines, splitByHeading, splitLeading } from './md-structure.js'
 import { applyFact, buildDescription, narrativeSplit, readAnalyzer, readEvidence, readProse, readRepository, splitFacts, splitSections, tierOf } from './parse-deepview-fields.js'
+import { normalizeFindingSeverity } from './severity.js'
 
 const MARKER_RE = /^<!--\s*DeepView findings export\b[^>]*-->/u
 const CASE_RE = /^Case \d+ of \d+(?:\s|$)/u
@@ -136,7 +137,7 @@ function readCase(body, depth, entryTitle, tier) {
   for (const [field, value] of fields) f[field] = value
   const reason = sections.find((s) => s.label.toLowerCase() === 'severity correction')
   if (reason?.body) f.correctedSeverityReason = readProse(reason.body)
-  return { finding: f, analyzer }
+  return { finding: normalizeFindingSeverity(f), analyzer }
 }
 
 // The producer and the run for the whole report: from the Analyzer facts

package/report/src/parse-md.js

@@ -30,9 +30,10 @@
 // carry anything mandatory.
 
 import { frozenIdBasis } from './parse-md-id.js'
+import { normalizeFindingSeverity } from './severity.js'
 import { LIST_MARKER_RE, findMdLink, normalizeNewlines, splitHeadingLine, unescapeMd } from './md-structure.js'
 
-const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'high_bug', 'bug', 'informational'])
+const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'high_bug', 'bug', 'informational', 'informative'])
 
 export function parseMarkdownFindings(content) {
   const text = normalizeNewlines(content).trim()
@@ -115,7 +116,7 @@ function parseBlock(block) {
   const idBasis = frozenIdBasis(block)
   if (idBasis) finding._idBasis = idBasis
 
-  return finding
+  return normalizeFindingSeverity(finding)
 }
 
 // The sections half (before the first `---`) and the metadata half

package/report/src/parse-piolium-rows.js

@@ -5,8 +5,9 @@
 
 import { cellValue, parseCodeRef, stripBold, tableObjects } from './md-structure.js'
 import { frozenIdBasis } from './parse-piolium-id.js'
+import { normalizeFindingSeverity } from './severity.js'
 import {
-  idCell, leadingId, leadingLink, mapSeverity, severityFromId, slugTitle,
+  idCell, leadingId, leadingLink, mapSeverity, resolveSeverity, severityFromId, slugTitle,
 } from './parse-piolium-tokens.js'
 
 // Normalize a table-row object to the shared row shape used by the
@@ -33,10 +34,7 @@ export function indexRowOf(obj) {
 // namespaced to read as an opaque token rather than a URL. A Location
 // column, where a table has one, is parsed like any code reference.
 export function fromIndexRow(row, sevFallback = '') {
-  const severity = mapSeverity(row.severity)
-    || sevFallback
-    || severityFromId(row.id)
-    || 'medium'
+  const { severity, identitySeverity } = resolveSeverity(mapSeverity(row.severity), sevFallback, severityFromId(row.id))
   const { file, line, locationLink } = parseCodeRef(row.location || '')
   const finding = {
     file: file || 'unknown',
@@ -49,12 +47,12 @@ export function fromIndexRow(row, sevFallback = '') {
   // The fingerprint reads the same reference its own way — see
   // parse-piolium-id.js.
   finding._idBasis = frozenIdBasis({
-    severity, description: finding.description, ref: row.location || '', id: row.id,
+    severity: identitySeverity, description: finding.description, ref: row.location || '', id: row.id,
   })
   if (row.pocStatus) finding.pocStatus = row.pocStatus
   if (row.status) finding.status = row.status
   if (row.parent) finding.parent = row.parent
-  return finding
+  return normalizeFindingSeverity(finding)
 }
 
 // Findings rendered as a list: the mode outline asks for "links to
@@ -92,10 +90,7 @@ export function listFindings(body, sev, index) {
     }
 
     const row = index.get(id)
-    const severity = mapSeverity(row?.severity)
-      || sev
-      || severityFromId(id)
-      || 'medium'
+    const { severity, identitySeverity } = resolveSeverity(mapSeverity(row?.severity), sev, severityFromId(id))
     const finding = { file: 'unknown', line: '?', severity, description: stripBold(title) }
     if (id) finding.location = `piolium:${id}`
     else if (link) finding.location = link
@@ -103,7 +98,7 @@ export function listFindings(body, sev, index) {
     if (row?.pocStatus) finding.pocStatus = row.pocStatus
     if (row?.status) finding.status = row.status
     if (row?.parent) finding.parent = row.parent
-    out.push({ id, finding })
+    out.push({ id, finding: normalizeFindingSeverity(finding, identitySeverity) })
   }
   return out
 }

package/report/src/parse-piolium-tokens.js

@@ -23,10 +23,20 @@ export function mapSeverity(s) {
     case 'MEDIUM': return 'medium'
     case 'LOW': return 'low'
     case 'INFO': case 'INFORMATIONAL': return 'informational'
+    case 'INFORMATIVE': return 'informative'
     default: return ''
   }
 }
 
+// Keep the pre-alias fallback for the ID fingerprint, while displaying the
+// newly recognized tier. Inputs are ordered from strongest to weakest source.
+export function resolveSeverity(...tiers) {
+  return {
+    severity: tiers.find(Boolean) || 'medium',
+    identitySeverity: tiers.find(tier => tier && tier !== 'informative') || 'medium',
+  }
+}
+
 // Final-report ids are severity-prefixed and sequential — `C1`, `H2`,
 // `H-001` in lite consolidation — so the prefix is a second source for
 // the tier. Only that exact scheme counts: a bare leading letter would
@@ -42,7 +52,7 @@ export function severityFromId(id) {
 // findings. Anchored to the whole heading, so "High memory usage in
 // parser" is never mistaken for one.
 export function severityGroupOf(heading) {
-  const m = /^(critical|high|medium|low|informational|info)(?:[ -](?:severity|risk))?(?:[ -]findings?)?(?:\s*\(\d+\))?$/iu
+  const m = /^(critical|high|medium|low|informational|informative|info)(?:[ -](?:severity|risk))?(?:[ -]findings?)?(?:\s*\(\d+\))?$/iu
     .exec((heading || '').trim())
   return m ? mapSeverity(m[1]) : ''
 }
@@ -51,7 +61,7 @@ export function severityGroupOf(heading) {
 // `High: remaining` — for sections recognized by their CONTENT rather
 // than the anchored severityGroupOf shape.
 export function headerSeverity(header) {
-  const m = /^(critical|high|medium|low|informational|info)\b/iu.exec((header || '').trim())
+  const m = /^(critical|high|medium|low|informational|informative|info)\b/iu.exec((header || '').trim())
   return m ? mapSeverity(m[1]) : ''
 }
 

package/report/src/parse-piolium.js

@@ -64,11 +64,12 @@
 
 import { H2_RE, H3_RE, H4_RE, normalizeNewlines, parseCodeRef, parseLabelledFields, splitByHeading, splitLeading, tableObjects } from './md-structure.js'
 import { frozenIdBasis } from './parse-piolium-id.js'
+import { normalizeFindingSeverity } from './severity.js'
 import { fromIndexRow, indexRowOf, listFindings, variantFindings } from './parse-piolium-rows.js'
 import {
   CODE_REF_FIELDS, codeRefOf, headerSeverity, idCell, idFromToken,
   isVariantsHeading, mapSeverity, parseHeading, preambleMeta,
-  severityFromId, severityGroupOf,
+  resolveSeverity, severityFromId, severityGroupOf,
 } from './parse-piolium-tokens.js'
 
 
@@ -295,11 +296,9 @@ function parseBlock(heading, body, index, groupSeverity = '') {
   // Precedence: the block's own bullet, the index row, the enclosing
   // group, the id's prefix, then medium — where an unrecognized tier
   // stays visible rather than dropping out.
-  const severity = mapSeverity(fields.severity)
-    || mapSeverity(row?.severity)
-    || groupSeverity
-    || severityFromId(id)
-    || 'medium'
+  const { severity, identitySeverity } = resolveSeverity(
+    mapSeverity(fields.severity), mapSeverity(row?.severity), groupSeverity, severityFromId(id),
+  )
 
   const ref = parseCodeRef(codeRefOf(fields))
   // A `**Line:**` / `**Lines:**` bullet supplies the line when the
@@ -332,7 +331,7 @@ function parseBlock(heading, body, index, groupSeverity = '') {
   // not. finding-id.js prefers `_idBasis` when deriving the uuid; read
   // that module's header before touching either side.
   finding._idBasis = frozenIdBasis({
-    severity, description: finding.description, ref: codeRefOf(fields), lineBullet, id,
+    severity: identitySeverity, description: finding.description, ref: codeRefOf(fields), lineBullet, id,
   })
   // Auxiliary provenance, kept as plain strings so an export can cite
   // the audit's own artifacts — as parse-md.js keeps branch / status.
@@ -344,7 +343,7 @@ function parseBlock(heading, body, index, groupSeverity = '') {
   const parent = row?.parent || (variantOf ? idCell(variantOf[1]) : '')
   if (parent) finding.parent = parent
 
-  return { id, finding }
+  return { id, finding: normalizeFindingSeverity(finding) }
 }
 
 // The `## ` sections, keyed case-folded. A repeated header CONCATENATES

package/report/src/severity.js

@@ -0,0 +1,18 @@
+import { fingerprintOf } from './finding-id.js'
+
+// Informative is an input spelling of the existing Informational tier.
+export function canonicalSeverity(value) {
+  return typeof value === 'string' && value.trim().toLowerCase() === 'informative' ? 'informational' : value
+}
+
+// Normalize presentation without re-keying stored triage. Markdown parsers
+// can supply the severity their previous fallback used for the fingerprint.
+export function normalizeFindingSeverity(finding, identitySeverity = finding.severity) {
+  const severity = canonicalSeverity(finding.severity)
+  if (severity !== finding.severity) {
+    if (!finding.id && !finding._idBasis) finding._idBasis = fingerprintOf({ ...finding, severity: identitySeverity })
+    finding.severity = severity
+  }
+  if (finding.correctedSeverity !== undefined) finding.correctedSeverity = canonicalSeverity(finding.correctedSeverity)
+  return finding
+}

package/server-common/vercel-blob.ts

@@ -17,6 +17,7 @@ import type { Buffer } from 'node:buffer'
 
 type VercelBlobBody = Readable | Buffer | string | Blob | ArrayBuffer | ReadableStream<Uint8Array>
 export type VercelBlobSdk = {
+  BlobNotFoundError: new () => Error
   put: (
     pathname: string,
     body: VercelBlobBody,
@@ -83,24 +84,12 @@ export type VercelBlobSdk = {
 }
 
 // Recognise "blob is gone" errors uniformly across read/write/delete
-// paths so callers can treat them as success (delete) or
-// not-found (read). The SDK exposes BlobNotFoundError as a class with
-// `.name === 'BlobNotFoundError'`; checking the name string avoids
-// importing the class at the top level (which would force the optional
-// peer dep to resolve).
-//
-// Class-name check ONLY — the SDK's internal mapper turns every API
-// `not_found` into BlobNotFoundError-by-name, so a bare-404 transport
-// leak doesn't reach here. A broader `/does not exist|\b404\b/` match
-// is DANGEROUS: it also matches BlobStoreNotFoundError's "This store
-// does not exist.", so a config fault (revoked token, deleted store)
-// would silently surface as every-blob-missing across reads/unlinks,
-// masking the fatal misconfiguration. The tight name check lets
-// BlobStoreNotFoundError / other classes propagate as real exceptions.
-export function isNotFound(err: unknown): boolean {
-  if (err == null || typeof err !== 'object') return false
-  const name = (err as { name?: unknown }).name
-  return typeof name === 'string' && name === 'BlobNotFoundError'
+// paths so callers can treat them as success (delete) or not-found (read).
+// SDK error subclasses retain `.name === 'Error'`; identify the missing-blob
+// class from the same lazily loaded SDK instance that performs the request.
+// Store/configuration failures must propagate, never masquerade as cache misses.
+export function isNotFound(err: unknown, sdk: Pick<VercelBlobSdk, 'BlobNotFoundError'>): boolean {
+  return err instanceof sdk.BlobNotFoundError
 }
 
 export async function loadVercelBlobSdk(): Promise<VercelBlobSdk> {

package/server-e2e/config.ts

@@ -54,6 +54,10 @@ Environment:
   DEEPVIEW_SCAN_SERVER       optional HTTP(S) scan-service URL; advertised
                              in /api/config and allowed by the UI CSP.
                              Unset by default (no external scan service).
+  GITHUB_NEW_ISSUE_LABELS    optional comma-separated labels for the client's
+                             prefilled GitHub issue form, in addition to
+                             deepview and security (for security findings).
+                             Advertised in /api/config and sync connections.
   DB_PATH                    sqlite file (default: server-e2e/data/data.db);
                              ignored when an e2e database URL is set
   DATABASE_URL               shared Neon Postgres URL for enabled modes.

package/server-e2e/objstore/blob-vercel.ts

@@ -195,7 +195,7 @@ function buildStatStaging(sdk: VercelBlobSdk, token: string): BlobBackend['statS
       const h = await sdk.head(stagingBlobPath(tag, stagingId), { token })
       return h.size
     } catch (err) {
-      if (isNotFound(err)) return null
+      if (isNotFound(err, sdk)) return null
       throw err
     }
   }
@@ -266,7 +266,7 @@ function buildOpenLiveReader(sdk: VercelBlobSdk, token: string): BlobBackend['op
       // same condition (blob-fs.ts maps ENOENT → `unavailable`), telling
       // the client the resource is gone for good when it should refetch.
       // See server-e2e/README.md's GET status table.
-      if (isNotFound(err)) return { ok: false, reason: 'unavailable', detail: 'vercel-get-not-found' }
+      if (isNotFound(err, sdk)) return { ok: false, reason: 'unavailable', detail: 'vercel-get-not-found' }
       throw err
     }
     // SDK returned null (no blob) — same "bytes missing for a live row"
@@ -297,7 +297,7 @@ function buildOpenLiveReader(sdk: VercelBlobSdk, token: string): BlobBackend['op
         // Blob vanished between get() and the head() size fallback (a
         // racing reaper GC) — still the "live row present, bytes gone"
         // transient, so `unavailable` (503), matching the get() path above.
-        if (isNotFound(headErr)) return { ok: false, reason: 'unavailable', detail: 'vercel-head-not-found' }
+        if (isNotFound(headErr, sdk)) return { ok: false, reason: 'unavailable', detail: 'vercel-head-not-found' }
         throw headErr
       }
     }
@@ -328,7 +328,7 @@ function buildOpenLiveReader(sdk: VercelBlobSdk, token: string): BlobBackend['op
 function buildUnlink(sdk: VercelBlobSdk, token: string, op: 'staging' | 'live', toPath: (tag: string, id: string) => string): (tag: string, id: string) => Promise<void> {
   return async (tag, id) => {
     try { await sdk.del(toPath(tag, id), { token }) } catch (err) {
-      if (isNotFound(err)) return
+      if (isNotFound(err, sdk)) return
       // Don't propagate — the DB-side row drop has already
       // committed by the time the caller reaches here, and the
       // reaper picks up the stranded blob on its next sweep. Same

package/server-managed/blob-vercel.ts

@@ -64,7 +64,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
       // Content-Length in that case so HTTP clients do not truncate the body.
       const size = result.blob.size === 0 ? null : result.blob.size
       return { size, stream: Readable.fromWeb(result.stream as Parameters<typeof Readable.fromWeb>[0]) }
-    } catch (err) { if (isNotFound(err)) return null; throw err }
+    } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
   }
   async function get(path: string) {
     const result = await open(path)
@@ -74,7 +74,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
     return Buffer.concat(parts)
   }
   async function remove(path: string) {
-    try { await blobs.del(path, { token }) } catch (err) { if (!isNotFound(err)) throw err }
+    try { await blobs.del(path, { token }) } catch (err) { if (!isNotFound(err, blobs)) throw err }
   }
   function store(name: string, suffix = ''): BlobStore {
     const path = (id: string) => `.managed/${name}/${validate(id)}${suffix}`
@@ -90,7 +90,7 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
   const cacheStorage: BundleCacheStorage = {
     async exists(id, file) {
       try { await blobs.head(cachePath(id, file), { token }); return true }
-      catch (err) { if (isNotFound(err)) return false; throw err }
+      catch (err) { if (isNotFound(err, blobs)) return false; throw err }
     },
     put: (id, file, bytes) => put(cachePath(id, file), bytes),
     async open(id, file) {
@@ -100,17 +100,19 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
     },
     delete: id => deletePrefix(blobs, token, cachePath(id, ''), remove),
   }
-  // Staging uploads are never published. An interrupted browser leaves only
-  // parts here; the authenticated cron removes them after a full day.
-  function reapUploads(now = Date.now()) {
-    return deletePrefix(blobs, token, '.managed/uploads/', remove,
+  // Staging uploads are never published. Automatic maintenance and explicit
+  // cleanup remove abandoned parts after a full day.
+  async function reapUploads(now = Date.now()) {
+    let removed = 0
+    await deletePrefix(blobs, token, '.managed/uploads/', async path => { await remove(path); removed++ },
       blob => new Date(blob.uploadedAt ?? now).getTime() < now - 86_400_000)
+    return removed
   }
   const sourcesPath = (key: string) => `.managed/cache/report-sources/${validateCacheKey(key)}`
   const reportSourcesStorage: CacheStorage = {
     async exists(key) {
       try { await blobs.head(sourcesPath(key), { token }); return true }
-      catch (err) { if (isNotFound(err)) return false; throw err }
+      catch (err) { if (isNotFound(err, blobs)) return false; throw err }
     },
     put: (key, bytes) => put(sourcesPath(key), bytes),
     async open(key) {

package/server-managed/config.ts

@@ -3,6 +3,7 @@
 // GitHub App can provide both flows, with repository grants at installation.
 import { env } from 'node:process'
 import { databaseUrls } from '../server-common/database-config.ts'
+import { MAX_UPLOAD_BYTES } from './uploads.ts'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
 
@@ -124,7 +125,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,
     githubNewIssueLabels: env['GITHUB_NEW_ISSUE_LABELS'] ?? '',
     maxReportBytes: intEnv('MAX_REPORT_BYTES', 10_485_760, 1, 104_857_600),
-    maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, 1_073_741_824),
+    maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, MAX_UPLOAD_BYTES),
     triageHistoryLimit: intEnv('TRIAGE_HISTORY_LIMIT', 0, 0, 1_000_000_000),
   }
 }