@preventive/triage 1.0.0-alpha.25 → 1.0.0-alpha.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.25",
+  "version": "1.0.0-alpha.26",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT",
   "author": {

package/server-e2e/config.ts

@@ -54,6 +54,10 @@ Environment:
   DEEPVIEW_SCAN_SERVER       optional HTTP(S) scan-service URL; advertised
                              in /api/config and allowed by the UI CSP.
                              Unset by default (no external scan service).
+  GITHUB_NEW_ISSUE_LABELS    optional comma-separated labels for the client's
+                             prefilled GitHub issue form, in addition to
+                             deepview and security (for security findings).
+                             Advertised in /api/config and sync connections.
   DB_PATH                    sqlite file (default: server-e2e/data/data.db);
                              ignored when an e2e database URL is set
   DATABASE_URL               shared Neon Postgres URL for enabled modes.

package/server-managed/blob-vercel.ts

@@ -100,11 +100,13 @@ export async function openManagedVercelStorage(token: string, sdk?: VercelBlobSd
     },
     delete: id => deletePrefix(blobs, token, cachePath(id, ''), remove),
   }
-  // Staging uploads are never published. An interrupted browser leaves only
-  // parts here; the authenticated cron removes them after a full day.
-  function reapUploads(now = Date.now()) {
-    return deletePrefix(blobs, token, '.managed/uploads/', remove,
+  // Staging uploads are never published. Automatic maintenance and explicit
+  // cleanup remove abandoned parts after a full day.
+  async function reapUploads(now = Date.now()) {
+    let removed = 0
+    await deletePrefix(blobs, token, '.managed/uploads/', async path => { await remove(path); removed++ },
       blob => new Date(blob.uploadedAt ?? now).getTime() < now - 86_400_000)
+    return removed
   }
   const sourcesPath = (key: string) => `.managed/cache/report-sources/${validateCacheKey(key)}`
   const reportSourcesStorage: CacheStorage = {

package/server-managed/config.ts

@@ -3,6 +3,7 @@
 // GitHub App can provide both flows, with repository grants at installation.
 import { env } from 'node:process'
 import { databaseUrls } from '../server-common/database-config.ts'
+import { MAX_UPLOAD_BYTES } from './uploads.ts'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
 
@@ -124,7 +125,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,
     githubNewIssueLabels: env['GITHUB_NEW_ISSUE_LABELS'] ?? '',
     maxReportBytes: intEnv('MAX_REPORT_BYTES', 10_485_760, 1, 104_857_600),
-    maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, 1_073_741_824),
+    maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, MAX_UPLOAD_BYTES),
     triageHistoryLimit: intEnv('TRIAGE_HISTORY_LIMIT', 0, 0, 1_000_000_000),
   }
 }

package/server-managed/db-methods.ts

@@ -204,7 +204,9 @@ export interface TriageEventRow {
   comment: string | null
   fix: string | null
   flagged: boolean | null
+  actorId: string | null
   actorLogin: string | null
+  actorName: string | null
   at: number
 }
 
@@ -354,6 +356,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord>
   getReportByHash(sha256: string, analyzer: string | null): Promise<ReportRecord | null>
   listReports(userId?: string): Promise<AdminReport[]>
+  listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]>
   getReport(id: string): Promise<ReportRecord | null>
   getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null>
   getReportAccessSnapshot(sessionId: string, now: number, ids: readonly string[]): Promise<ReportAccessSnapshot | null>
@@ -571,6 +574,7 @@ function prepareStatements(db: ManagedSql) {
           WHERE tr.repo_id = r.repo_id AND tu.user_id = ? AND ${REPORT_IN_TEAM_PATH_SQL}))
         ORDER BY r.uploaded_at DESC, r.filename ASC`,
     ),
+    findingCatalogReportsStmt: db.prepare(`SELECT id, byte_size AS byteSize FROM managed_report WHERE id > ? ORDER BY id LIMIT ?`),
     selectReportStmt: db.prepare(
       `SELECT id, slug, filename, content_type AS contentType, byte_size AS byteSize,
               sha256, uploaded_by AS uploadedBy, uploaded_at AS uploadedAt,
@@ -646,7 +650,7 @@ function prepareStatements(db: ManagedSql) {
     selectTriageHistoryStmt: db.prepare(
       `SELECT e.seq AS seq, e.finding_id AS findingId, e.batch_id AS batchId, e.color AS color, e.triage AS triage,
               e.comment AS comment, e.fix AS fix, e.flagged AS flagged,
-              COALESCE(u.login, e.actor_login) AS actorLogin, e.at AS at
+              u.id AS actorId, COALESCE(u.login, e.actor_login) AS actorLogin, u.name AS actorName, e.at AS at
          FROM managed_finding_triage_event e
          LEFT JOIN managed_user u ON u.id = e.actor_id
         WHERE e.finding_id = ?
@@ -963,6 +967,9 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
         uploadedAt: r.uploadedAt,
       }))
     },
+    async listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]> {
+      return await stmts.findingCatalogReportsStmt.all(after, limit) as Pick<ReportRecord, 'id' | 'byteSize'>[]
+    },
     async getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null> {
       const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
       if (!session) return null
@@ -1019,7 +1026,9 @@ type TriageDbRow = {
   updatedByLogin: string | null; updatedAt: number
 }
 type TriageStateDbRow = { color: string | null; triage: string | null; comment: string | null; fix: string | null; flagged: number | null }
-type TriageEventDbRow = TriageStateDbRow & { seq: number; findingId: string; batchId: string; actorLogin: string | null; at: number }
+type TriageEventDbRow = TriageStateDbRow & {
+  seq: number; findingId: string; batchId: string; actorId: string | null; actorLogin: string | null; actorName: string | null; at: number
+}
 
 // The per-finding triage slice of ManagedDb. Closes over its prepared
 // statements (and the handle, for the batch write's transaction). A
@@ -1074,7 +1083,7 @@ function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimi
         seq: r.seq, findingId: r.findingId, batchId: r.batchId,
         color: r.color, triage: r.triage, comment: r.comment, fix: r.fix,
         flagged: r.flagged == null ? null : r.flagged === 1,
-        actorLogin: r.actorLogin, at: r.at,
+        actorId: r.actorId, actorLogin: r.actorLogin, actorName: r.actorName, at: r.at,
       }))
     },
     async listTriage(findingIds: readonly string[]): Promise<TriageRow[]> {
@@ -1307,6 +1316,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const comments = commentMethods(db)
   const activity = activityMethods(db)
   const stmts = prepareStatements(db)
+  const reports = reportMethods(stmts)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0)
   const {
     upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
@@ -1371,9 +1381,9 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...activity,
     ...comments,
     ...workspaceShareMethods(db),
-    ...reportMethods(stmts),
+    ...reports,
     ...triage,
-    ...importTriageMethods({ ...triage, ...comments }),
+    ...importTriageMethods({ getReport: reports.getReport, ...triage, ...comments }),
     ...bundleMethods(stmts),
     ...teamMethods(stmts),
     async close() {

package/server-managed/http.ts

@@ -48,7 +48,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
 import { NPM_ADVISORIES_TIMEOUT_MS, fetchNpmAdvisories } from '../server-common/npm-advisories.ts'
-import { UPLOAD_CHUNK_BYTES, type UploadKind, putUploadPart, readUpload, validUploadPart } from './uploads.ts'
+import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, putUploadPart, readUpload, validUpload, validUploadPart } from './uploads.ts'
 import { type BundleCache, type BundleCachePart, MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import type { BundleStore } from './bundle-store.ts'
@@ -82,7 +82,7 @@ import { clearCookie, endSession, readSession } from './session.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
 import { TeamReportsError, loadTeamReports, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
-import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
+import { FINDING_CATALOG_PAGE_BYTES, FINDING_CATALOG_PAGE_COUNT, MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
@@ -280,19 +280,32 @@ function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: st
 }
 
 async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, path: string) {
-  if (req.method !== 'POST') { send405(res, 'POST'); return }
+  const cancel = req.method === 'DELETE'
+  if (req.method !== 'POST' && !cancel) { send405(res, 'POST, DELETE'); return }
   const s = await checkMutation(req, res, deps, cookie)
   if (!s || !requireManageRole(res, s.user)) return
   if (!deps.uploadStore) { sendJson(res, 404, { error: 'not-found' }); return }
-  const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)\/(0|[1-9][0-9]*)$/u.exec(path)
-  if (!match) { sendJson(res, 400, { error: 'bad-upload' }); return }
-  const id = match[2]!, index = Number(match[3]), kind = match[1] as UploadKind
+  const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)(?:\/(0|[1-9][0-9]*))?$/u.exec(path)
+  if (!match || (cancel ? match[3] !== undefined : match[3] === undefined)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+  const id = match[2]!, kind = match[1] as UploadKind
+  if (cancel) {
+    const count = Number(req.headers['x-upload-parts'])
+    if (!validUpload(id, count)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+    await deleteUpload(deps.uploadStore, s.session.id, kind, id, count)
+    sendJson(res, 200, { ok: true }); return
+  }
+  const index = Number(match[3])
   const maxBytes = kind === 'reports' ? deps.config.maxReportBytes : deps.config.maxBundleBytes
-  if (!validUploadPart(id, index, maxBytes)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+  const discard = async () => {
+    if (validUpload(id, index + 1)) {
+      await deleteUpload(deps.uploadStore!, s.session.id, kind, id, index + 1).catch(err => console.warn('managed: upload cleanup failed:', err))
+    }
+  }
+  if (!validUploadPart(id, index, maxBytes)) { await discard(); sendJson(res, 400, { error: 'bad-upload' }); return }
   let bytes
   try { bytes = await readBodyBytes(req, Math.min(UPLOAD_CHUNK_BYTES, maxBytes)) }
-  catch { sendJson(res, 413, { error: 'too-large' }); return }
-  if (bytes.length === 0) { sendJson(res, 400, { error: 'empty' }); return }
+  catch { await discard(); sendJson(res, 413, { error: 'too-large' }); return }
+  if (bytes.length === 0) { await discard(); sendJson(res, 400, { error: 'empty' }); return }
   if (await manageMutation(req, res, deps, cookie) == null) return
   await putUploadPart(deps.uploadStore, s.session.id, kind, id, index, bytes)
   sendJson(res, 200, { ok: true })
@@ -1582,7 +1595,8 @@ async function handleGetReportTriageHistory(res: ServerResponse, deps: ManagedHt
   const visible = await visibleFindingIds(deps, current.user, id, current.session.id, teamId)
   if (!visible.has(finding)) { sendJson(res, 404, { error: 'no-finding' }); return }
   const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map((row: TriageEventRow) => ({
-    seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
+    seq: row.seq, at: row.at, actorId: row.actorId, actorLogin: row.actorLogin, actorName: row.actorName,
+    batchId: row.batchId, entry: triageWireEntry(row, true),
   }))
   // A database read can outlive a role, membership, or visibility change.
   const latest = await readSession(deps.config, deps.db, cookie, Date.now())
@@ -1632,9 +1646,31 @@ async function handleSetReportTriage(req: IncomingMessage, res: ServerResponse,
   sendJson(res, 200, { ok: true })
 }
 
+// GET only: clients match local annotations against these IDs without sending
+// their local finding IDs or annotation bodies to discover which reports exist.
+async function handleImportFindingIds(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, search: URLSearchParams): Promise<void> {
+  const s = await readAdminSession(res, deps, cookie)
+  if (!s) return
+  const after = search.get('after') ?? ''
+  if (after && !/^[a-f\d-]{36}$/iu.test(after)) { sendJson(res, 400, { error: 'bad-cursor' }); return }
+  const stored = await deps.db.listFindingCatalogReports(after, FINDING_CATALOG_PAGE_COUNT + 1)
+  const reports = []
+  let bytes = 0, cursor = after, processed = 0
+  for (const report of stored) {
+    if (processed >= FINDING_CATALOG_PAGE_COUNT || (processed > 0 && bytes + report.byteSize > FINDING_CATALOG_PAGE_BYTES)) break
+    bytes += report.byteSize
+    processed++
+    cursor = report.id
+    const findingIds = [...await visibleFindingIds(deps, s.user, report.id, s.session.id, null)]
+    if (findingIds.length > 0) reports.push({ id: report.id, findingIds })
+  }
+  if (await readAdminSession(res, deps, cookie) == null) return
+  sendJson(res, 200, { reports, nextCursor: processed < stored.length ? cursor : null })
+}
+
 // Admin imports compare the exact snapshot shown by the conflict dialog before
 // writing. The store commits shared finding triage and imported comments together.
-async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
+async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
   const s = await adminMutation(req, res, deps, cookie)
   if (!s) return
   let body: { findingIds?: unknown; entries?: unknown; expected?: unknown }
@@ -1658,15 +1694,10 @@ async function handleImportTriage(req: IncomingMessage, res: ServerResponse, dep
       parsed.push([findingId, patch])
     }
   }
-  // Workspace imports remain report-scoped. Standalone local triage can be
-  // imported before its reports; only administrators have this global access.
-  let visible: Set<string> | undefined
-  if (id !== undefined) {
-    if (!(await deps.db.getReport(id))) { sendJson(res, 404, { error: 'no-report' }); return }
-    visible = await visibleFindingIds(deps, s.user, id, s.session.id, null)
-  }
+  if (!(await deps.db.getReport(id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  const visible = await visibleFindingIds(deps, s.user, id, s.session.id, null)
   if (await readAdminSession(res, deps, cookie) == null) return
-  if (visible && ids.some(findingId => !visible.has(findingId))) { sendJson(res, 404, { error: 'no-finding' }); return }
+  if (ids.some(findingId => !visible.has(findingId))) { sendJson(res, 404, { error: 'no-finding' }); return }
   if (reading) { sendJson(res, 200, { snapshots: await deps.db.getImportTriage(ids) }); return }
   const applied = await deps.db.importTriage(parsed, expected!, { id: s.user.id, login: s.user.login }, id, Date.now())
   sendJson(res, applied ? 200 : 409, { ok: applied })
@@ -1925,7 +1956,9 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
       sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
-        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? { uploadChunkBytes: UPLOAD_CHUNK_BYTES } : {}) } })
+        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? {
+          uploadChunkBytes: UPLOAD_CHUNK_BYTES, uploadMaxBytes: { reports: config.maxReportBytes, bundles: config.maxBundleBytes },
+        } : {}) } })
       return
     }
     // OAuth: start → redirect to GitHub with the CSRF state cookie.
@@ -2064,9 +2097,9 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleSetReportVisible(req, res, deps, cookie); return
     }
-    if (path === '/api/admin/import-triage') {
-      if (method !== 'POST') { send405(res, 'POST'); return }
-      await handleImportTriage(req, res, deps, cookie); return
+    if (path === '/api/admin/reports/finding-ids') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleImportFindingIds(res, deps, cookie, url.searchParams); return
     }
     const importTriage = /^\/api\/admin\/reports\/([a-f\d-]{36})\/import-triage$/iu.exec(path)
     if (importTriage) {

package/server-managed/import-triage.ts

@@ -11,11 +11,11 @@ export interface ImportTriageSnapshot {
 }
 export interface ImportTriageStore {
   getImportTriage(ids: readonly string[]): Promise<Record<string, ImportTriageSnapshot>>
-  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string | undefined, now: number): Promise<boolean>
+  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string, now: number): Promise<boolean>
 }
 
 // Raw store methods share one transaction for comparison, triage, and comments.
-export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
+export function importTriageMethods(store: Pick<ManagedDb, 'getReport' | 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
   async function snapshot(ids: readonly string[]) {
     const rows = new Map((await store.listTriage(ids)).map(row => [row.findingId, row]))
     const comments = await store.listComments(ids)
@@ -30,6 +30,9 @@ export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listC
   return {
     getImportTriage: snapshot,
     async importTriage(entries, expected, actor, reportId, now) {
+      // A report deleted after the HTTP membership check must not leave newly
+      // imported annotations behind. Check existence in the write transaction.
+      if (!reportId || !(await store.getReport(reportId))) return false
       const current = await snapshot(entries.map(([id]) => id))
       if (entries.some(([id]) => current[id]!.version !== expected[id])) return false
       const changes: [string, TriageEntryPatch | null][] = []
@@ -38,7 +41,7 @@ export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listC
         changes.push([id, Object.keys(entry).length > 0 ? entry : null])
         if (comment && !current[id]!.comments.some(existing => existing.body === comment)) {
           await store.createComment({ findingId: id, body: comment, authorId: null, authorLogin: null,
-            actor, createdAt: null, updatedAt: null, reportId: reportId ?? null }, now)
+            actor, createdAt: null, updatedAt: null, reportId }, now)
         }
       }
       await store.setTriageEntries(changes, actor.id, actor.login, now, reportId)

package/server-managed/index.ts

@@ -12,9 +12,10 @@ import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
 import { loadManagedStatic } from './static.ts'
 import { openManagedStorage } from './storage.ts'
 
-// Expired-session sweep period. Lookups already exclude expired rows
-// (`WHERE expires_at > now`), so this is housekeeping, not a security control.
-const SESSION_GC_INTERVAL_MS = 3_600_000
+// Housekeeping runs on ordinary traffic too, including serverless instances
+// without a timer or cron. Failed sweeps retry on later traffic after a minute.
+const REAP_INTERVAL_MS = 3_600_000
+const REAP_RETRY_MS = 60_000
 
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
@@ -39,25 +40,46 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
   const serveStatic = loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
     indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
   })
-  const handleRequest = createManagedRequestHandler({
+  const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, originGate, serveStatic,
     ...('uploadStore' in storage ? { uploadStore: storage.uploadStore } : {}),
     isShuttingDown, track,
   })
 
   let cleanup: Promise<void> | undefined
+  let nextCleanupAt = 0
   function reap(): Promise<void> {
     if (cleanup) return cleanup
+    const startedAt = Date.now()
+    nextCleanupAt = startedAt + REAP_INTERVAL_MS
+    let sessions = 0, uploads = 0
     cleanup = runReapers({
-      sessions: () => db.deleteExpiredSessions(Date.now()),
-      ...('reapUploads' in storage ? { uploads: () => storage.reapUploads() } : {}),
+      sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
+      ...('reapUploads' in storage ? { uploads: async () => { uploads = await storage.reapUploads() } } : {}),
+    }).then(() => {
+      nextCleanupAt = Date.now() + REAP_INTERVAL_MS
+      return console.info(`managed-reaper: removed ${sessions} expired session(s), ${uploads} stale upload part(s) in ${Date.now() - startedAt}ms`)
+    }, err => {
+      nextCleanupAt = Date.now() + REAP_RETRY_MS
+      throw err
     }).finally(() => { cleanup = undefined })
     track(cleanup)
     return cleanup
   }
+  function automaticReap(): Promise<void> {
+    if (isShuttingDown() || cleanup || Date.now() < nextCleanupAt) return Promise.resolve()
+    return reap().catch(err => console.warn('managed-reaper: cleanup failed:', err))
+  }
+  async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
+    const maintenance = automaticReap()
+    // Send the normal response without waiting for storage housekeeping, but
+    // keep the invocation alive until both finish. No detached serverless work.
+    try { await routeRequest(req, res) }
+    finally { await maintenance }
+  }
   const gcTimer = config.serverless ? null : setInterval(() => {
-    void reap().catch(err => console.warn('managed: maintenance failed:', err))
-  }, SESSION_GC_INTERVAL_MS)
+    void automaticReap()
+  }, REAP_INTERVAL_MS)
   rollback.defer(stop)
 
   function stop(): void {

package/server-managed/report-query.ts

@@ -2,3 +2,9 @@
 // the encoded response, independently of the per-upload size limit.
 export const MAX_REPORT_QUERY_COUNT = 4096
 export const MAX_REPORT_QUERY_BYTES = 1024 * 1024 * 1024
+
+// The import catalog scans a bounded page, not the whole installation. A
+// report larger than the byte target occupies a page by itself; upload limits
+// still bound that single report and the cursor must always make progress.
+export const FINDING_CATALOG_PAGE_COUNT = 128
+export const FINDING_CATALOG_PAGE_BYTES = 32 * 1024 * 1024

package/server-managed/uploads.ts

@@ -7,6 +7,8 @@ import type { IncomingMessage } from 'node:http'
 import type { BlobStore } from './blob-store.ts'
 
 export const UPLOAD_CHUNK_BYTES = 3 * 1024 * 1024
+export const MAX_UPLOAD_BYTES = 1024 * 1024 * 1024
+const MAX_UPLOAD_PARTS = Math.ceil(MAX_UPLOAD_BYTES / UPLOAD_CHUNK_BYTES)
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u
 export type UploadKind = 'reports' | 'bundles'
 
@@ -16,7 +18,24 @@ function partId(session: string, kind: UploadKind, id: string, index: number): s
 }
 
 export function validUploadPart(id: string, index: number, maxBytes: number): boolean {
-  return UUID.test(id) && Number.isSafeInteger(index) && index >= 0 && index < Math.ceil(maxBytes / UPLOAD_CHUNK_BYTES)
+  return UUID.test(id) && Number.isSafeInteger(index) && index >= 0 && index < Math.ceil(Math.min(maxBytes, MAX_UPLOAD_BYTES) / UPLOAD_CHUNK_BYTES)
+}
+
+export function validUpload(id: string, count: number): boolean {
+  return UUID.test(id) && Number.isSafeInteger(count) && count > 0
+}
+
+// Limit cleanup to indices that any configured server could have accepted,
+// even if the request advertises an enormous count or the limit was lowered.
+export async function deleteUpload(store: BlobStore, session: string, kind: UploadKind, id: string, count: number): Promise<void> {
+  if (!validUpload(id, count)) throw new Error('bad-upload')
+  const end = Math.min(count, MAX_UPLOAD_PARTS), errors = []
+  for (let start = 0; start < end; start += 8) {
+    const results = await Promise.allSettled(Array.from({ length: Math.min(8, end - start) },
+      (_, index) => store.delete(partId(session, kind, id, start + index))))
+    for (const result of results) if (result.status === 'rejected') errors.push(result.reason)
+  }
+  if (errors.length > 0) throw new AggregateError(errors, 'Upload cleanup failed')
 }
 
 export function putUploadPart(store: BlobStore, session: string, kind: UploadKind, id: string, index: number, bytes: Buffer): Promise<void> {
@@ -26,14 +45,13 @@ export function putUploadPart(store: BlobStore, session: string, kind: UploadKin
 export async function readUpload(store: BlobStore, req: IncomingMessage, session: string, kind: UploadKind, maxBytes: number): Promise<Buffer> {
   const id = req.headers['x-upload-id']
   const count = Number(req.headers['x-upload-parts']), size = Number(req.headers['x-upload-size'])
-  if (typeof id !== 'string' || !UUID.test(id) || !Number.isSafeInteger(size) || size <= 0
-    || !Number.isSafeInteger(count) || count !== Math.ceil(size / UPLOAD_CHUNK_BYTES)) throw new Error('bad-upload')
-  if (size > maxBytes) throw new Error('too-large')
-  const ids = Array.from({ length: count }, (_, index) => partId(session, kind, id, index))
-  const parts: Buffer[] = []
+  if (typeof id !== 'string' || !validUpload(id, count)) throw new Error('bad-upload')
   try {
-    for (const [index, key] of ids.entries()) {
-      const bytes = await store.get(key)
+    if (!Number.isSafeInteger(size) || size <= 0 || count !== Math.ceil(size / UPLOAD_CHUNK_BYTES)) throw new Error('bad-upload')
+    if (size > maxBytes || size > MAX_UPLOAD_BYTES) throw new Error('too-large')
+    const parts: Buffer[] = []
+    for (let index = 0; index < count; index++) {
+      const bytes = await store.get(partId(session, kind, id, index))
       const expected = Math.min(UPLOAD_CHUNK_BYTES, size - index * UPLOAD_CHUNK_BYTES)
       if (!bytes || bytes.length !== expected) throw new Error('bad-upload')
       parts.push(bytes)
@@ -41,7 +59,7 @@ export async function readUpload(store: BlobStore, req: IncomingMessage, session
     return Buffer.concat(parts, size)
   } finally {
     // These bytes can no longer be finalized. Failed/abandoned chunk uploads
-    // are also covered by the daily staging sweep.
-    for (const key of ids) await store.delete(key).catch(err => console.warn('managed: upload cleanup failed:', err))
+    // are also covered by automatic staging maintenance.
+    await deleteUpload(store, session, kind, id, count).catch(err => console.warn('managed: upload cleanup failed:', err))
   }
 }