@preventive/triage 1.0.0-alpha.25 → 1.0.0-alpha.27

package/server-managed/db-methods.ts

@@ -12,6 +12,8 @@ import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
 import { ManagedMutationError, type ManagementStore, managementMethods } from './management.ts'
+import { type StorageKey } from '../server-common/storage-crypto.ts'
+import { type StorageDb, type StoredTokens, decodeStorageTokens, encodeStorageTokens, storageMethods, storageState, validateStorageUpload } from './storage-db.ts'
 
 // A managed user identity (the subset of GitHub's `GET /user` we keep). Input
 // to the upsert; `githubUserId` is the provider lookup key, never exposed to
@@ -131,6 +133,7 @@ export interface ReportAccessSnapshot {
 // bundle links; `bundleIntegrity` is the report's declared primary bundle (kept
 // so a later bundle upload of that integrity re-links it).
 export interface ReportRecordInput {
+  dataKey?: string | null
   id: string
   filename: string
   contentType: string
@@ -204,7 +207,9 @@ export interface TriageEventRow {
   comment: string | null
   fix: string | null
   flagged: boolean | null
+  actorId: string | null
   actorLogin: string | null
+  actorName: string | null
   at: number
 }
 
@@ -226,7 +231,7 @@ export interface ManagedBundle {
 
 // What the upload handler supplies to record a bundle; the store stamps
 // uploaded_at. `uploadedByLogin` is the durable uploader-login snapshot.
-export type BundleInput = Omit<ManagedBundle, 'uploadedAt' | 'slug' | 'repoDirectory'> & { uploadedByLogin: string | null; repoDirectory?: string }
+export type BundleInput = Omit<ManagedBundle, 'uploadedAt' | 'slug' | 'repoDirectory'> & { uploadedByLogin: string | null; repoDirectory?: string; dataKey?: string | null }
 
 // A bundle row for the "Manage bundles" list — adds the uploader login + repo
 // full name display joins (null when absent / since removed).
@@ -308,7 +313,7 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, StorageDb {
   // Upsert the identity; returns the user's opaque id (stable across logins).
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
@@ -354,7 +359,10 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord>
   getReportByHash(sha256: string, analyzer: string | null): Promise<ReportRecord | null>
   listReports(userId?: string): Promise<AdminReport[]>
+  listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]>
   getReport(id: string): Promise<ReportRecord | null>
+  // Writer-locked reconciliation waits for an uncertain earlier insert.
+  resolveReportUpload(id: string): Promise<ReportRecord | null>
   getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null>
   getReportAccessSnapshot(sessionId: string, now: number, ids: readonly string[]): Promise<ReportAccessSnapshot | null>
   listReportFilenamesWithBundleHash(bundleId: string, sha256: string): Promise<string[]>
@@ -389,6 +397,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // declared its integrity.
   insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void>
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
+  resolveBundleUpload(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
   listBundles(userId?: string): Promise<AdminBundle[]>
   userCanReadBundle(userId: string, id: string): Promise<boolean>
@@ -496,11 +505,11 @@ function prepareStatements(db: ManagedSql) {
     updateRoleStmt: db.prepare(`UPDATE managed_user SET role = ?, updated_at = ? WHERE id = ?`),
     updateTokensStmt: db.prepare(
       `UPDATE managed_user
-          SET gh_access_token = ?, gh_refresh_token = ?, gh_token_expires_at = ?, updated_at = ?
+          SET gh_access_token = ?, gh_refresh_token = ?, gh_token_expires_at = ?, gh_tokens_encrypted = ?, updated_at = ?
         WHERE id = ?`,
     ),
     selectTokensStmt: db.prepare(
-      `SELECT gh_access_token AS access, gh_refresh_token AS refresh, gh_token_expires_at AS exp
+      `SELECT gh_access_token AS access, gh_refresh_token AS refresh, gh_token_expires_at AS exp, gh_tokens_encrypted AS encrypted
          FROM managed_user WHERE id = ?`,
     ),
     deleteSessionStmt: db.prepare(`DELETE FROM managed_session WHERE id = ?`),
@@ -548,9 +557,9 @@ function prepareStatements(db: ManagedSql) {
     ),
     insertReportStmt: db.prepare(
       `WITH candidate(id, slug) AS (VALUES (?, ?))
-       INSERT INTO managed_report (id, slug, filename, content_type, byte_size, sha256, uploaded_by, uploaded_by_login, repo_id, repo_directory, repo_embedded, analyzer, visible, bundle_id, bundle_integrity, uploaded_at)
+       INSERT INTO managed_report (id, slug, filename, content_type, byte_size, sha256, uploaded_by, uploaded_by_login, repo_id, repo_directory, repo_embedded, analyzer, visible, bundle_id, bundle_integrity, uploaded_at, data_key, storage_encrypted)
        SELECT id, CASE WHEN EXISTS (SELECT 1 FROM managed_report WHERE slug = candidate.slug) THEN id ELSE slug END,
-              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
+              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
     ),
     // LEFT JOINs so a report whose uploader / repo / bundle was removed (the FK
     // nulled) still lists, with null display fields.
@@ -571,6 +580,7 @@ function prepareStatements(db: ManagedSql) {
           WHERE tr.repo_id = r.repo_id AND tu.user_id = ? AND ${REPORT_IN_TEAM_PATH_SQL}))
         ORDER BY r.uploaded_at DESC, r.filename ASC`,
     ),
+    findingCatalogReportsStmt: db.prepare(`SELECT id, byte_size AS byteSize FROM managed_report WHERE id > ? ORDER BY id LIMIT ?`),
     selectReportStmt: db.prepare(
       `SELECT id, slug, filename, content_type AS contentType, byte_size AS byteSize,
               sha256, uploaded_by AS uploadedBy, uploaded_at AS uploadedAt,
@@ -646,7 +656,7 @@ function prepareStatements(db: ManagedSql) {
     selectTriageHistoryStmt: db.prepare(
       `SELECT e.seq AS seq, e.finding_id AS findingId, e.batch_id AS batchId, e.color AS color, e.triage AS triage,
               e.comment AS comment, e.fix AS fix, e.flagged AS flagged,
-              COALESCE(u.login, e.actor_login) AS actorLogin, e.at AS at
+              u.id AS actorId, COALESCE(u.login, e.actor_login) AS actorLogin, u.name AS actorName, e.at AS at
          FROM managed_finding_triage_event e
          LEFT JOIN managed_user u ON u.id = e.actor_id
         WHERE e.finding_id = ?
@@ -676,9 +686,9 @@ function prepareStatements(db: ManagedSql) {
       WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY id`),
     insertBundleStmt: db.prepare(
       `WITH candidate(id, slug) AS (VALUES (?, ?))
-       INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, uploaded_at)
+       INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, uploaded_at, data_key, storage_encrypted)
        SELECT id, CASE WHEN EXISTS (SELECT 1 FROM managed_bundle WHERE slug = candidate.slug) THEN id ELSE slug END,
-              ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
+              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
     ),
     selectBundleByIntegrityStmt: db.prepare(
       `SELECT id, slug, integrity, filename, kind, byte_size AS byteSize,
@@ -920,7 +930,7 @@ async function authorizeUpload(stmts: ReturnType<typeof prepareStatements>, sess
 }
 
 // The report slice of ManagedDb closes over its prepared statements.
-function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
+function reportMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql, key: StorageKey | null) {
   const { insertReportStmt, selectReportsStmt, selectReportStmt, deleteReportStmt, setReportRepoStmt, setReportVisibleStmt } = stmts
   async function getReport(id: string): Promise<ReportRecord | null> {
     const row = (await selectReportStmt.get(id)) as ReportRow | undefined
@@ -932,16 +942,18 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
     return row ? getReport(row.id) : null
   }
   async function insertReport(report: ReportRecordInput, now: number): Promise<void> {
+    await validateStorageUpload(db, key, 'report', report.id, report.dataKey)
     await insertReportStmt.run(
       report.id, preferredSlug(report.id), report.filename, report.contentType, report.byteSize,
       report.sha256, report.uploadedBy, report.uploadedByLogin ?? null, report.repoId,
       report.repoDirectory ?? '', report.repoEmbedded ? 1 : 0, report.analyzer ?? null, report.visible == null ? 0 : report.visible ? 1 : 0, report.bundleId ?? null,
-      report.bundleIntegrity ?? null, now,
+      report.bundleIntegrity ?? null, now, report.dataKey ?? null, report.dataKey ? 1 : 0,
     )
   }
   return {
     insertReport,
     getReport,
+    resolveReportUpload: getReport,
     getReportByHash,
     async insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord> {
       await authorizeUpload(stmts, sessionId, report)
@@ -963,6 +975,9 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
         uploadedAt: r.uploadedAt,
       }))
     },
+    async listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]> {
+      return await stmts.findingCatalogReportsStmt.all(after, limit) as Pick<ReportRecord, 'id' | 'byteSize'>[]
+    },
     async getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null> {
       const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
       if (!session) return null
@@ -1019,7 +1034,9 @@ type TriageDbRow = {
   updatedByLogin: string | null; updatedAt: number
 }
 type TriageStateDbRow = { color: string | null; triage: string | null; comment: string | null; fix: string | null; flagged: number | null }
-type TriageEventDbRow = TriageStateDbRow & { seq: number; findingId: string; batchId: string; actorLogin: string | null; at: number }
+type TriageEventDbRow = TriageStateDbRow & {
+  seq: number; findingId: string; batchId: string; actorId: string | null; actorLogin: string | null; actorName: string | null; at: number
+}
 
 // The per-finding triage slice of ManagedDb. Closes over its prepared
 // statements (and the handle, for the batch write's transaction). A
@@ -1074,7 +1091,7 @@ function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimi
         seq: r.seq, findingId: r.findingId, batchId: r.batchId,
         color: r.color, triage: r.triage, comment: r.comment, fix: r.fix,
         flagged: r.flagged == null ? null : r.flagged === 1,
-        actorLogin: r.actorLogin, at: r.at,
+        actorId: r.actorId, actorLogin: r.actorLogin, actorName: r.actorName, at: r.at,
       }))
     },
     async listTriage(findingIds: readonly string[]): Promise<TriageRow[]> {
@@ -1117,23 +1134,27 @@ function mapBundle(r: BundleRow): ManagedBundle {
 }
 
 // The bundle slice of ManagedDb. Closes over its prepared statements.
-function bundleMethods(stmts: ReturnType<typeof prepareStatements>) {
+function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql, key: StorageKey | null) {
   const {
     insertBundleStmt, selectBundleByIntegrityStmt, selectBundleStmt,
     selectBundlesStmt, deleteBundleStmt, setBundleRepoStmt, linkReportsToBundleStmt, selectBundleReadableStmt, selectRepoReadableStmt, selectRepoPathReadableStmt,
   } = stmts
+  async function getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null> {
+    const row = (await selectBundleByIntegrityStmt.get(integrity)) as BundleRow | undefined
+    return row == null ? null : mapBundle(row)
+  }
   return {
     async insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void> {
       await authorizeUpload(stmts, sessionId, bundle)
+      await validateStorageUpload(db, key, 'bundle', bundle.id, bundle.dataKey)
       await insertBundleStmt.run(
         bundle.id, preferredSlug(bundle.id), bundle.integrity, bundle.filename, bundle.kind,
-        bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now,
+        bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now, bundle.dataKey ?? null, bundle.dataKey ? 1 : 0,
       )
     },
-    async getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null> {
-      const row = (await selectBundleByIntegrityStmt.get(integrity)) as BundleRow | undefined
-      return row == null ? null : mapBundle(row)
-    },
+    getBundleByIntegrity,
+    // The distinct method name selects a writer-locked reconciliation scope.
+    resolveBundleUpload: getBundleByIntegrity,
     async getBundle(id: string): Promise<ManagedBundle | null> {
       const row = (await selectBundleStmt.get(id)) as BundleRow | undefined
       return row == null ? null : mapBundle(row)
@@ -1300,13 +1321,16 @@ function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
 // `triageHistoryLimit`: events kept per finding in the triage trail; 0 (the
 // default) keeps everything. See ManagedConfig.
 export interface ManagedDbOptions {
+  storageEncryptionKey?: StorageKey | null
   triageHistoryLimit?: number
 }
 
 export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions = {}): ManagedDb {
+  const key = options.storageEncryptionKey ?? null
   const comments = commentMethods(db)
   const activity = activityMethods(db)
   const stmts = prepareStatements(db)
+  const reports = reportMethods(stmts, db, key)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0)
   const {
     upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
@@ -1314,6 +1338,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   } = stmts
 
   const methods: Omit<ManagedDb, keyof ManagementStore> = {
+    ...storageMethods(db, key),
     async upsertUser(user, now, initialAdminGithubId = null) {
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
@@ -1354,12 +1379,18 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       return Number((await updateRoleStmt.run(role, Date.now(), id)).changes) > 0
     },
     async setUserTokens(id, tokens) {
-      await updateTokensStmt.run(tokens.accessToken, tokens.refreshToken, tokens.expiresAt, Date.now(), id)
+      const state = await storageState(db, key)
+      const value = state ? encodeStorageTokens(key!, id, tokens.accessToken, tokens.refreshToken) : { access: tokens.accessToken, refresh: tokens.refreshToken }
+      await updateTokensStmt.run(value.access, value.refresh, tokens.expiresAt, state ? 1 : 0, Date.now(), id)
     },
     async getUserTokens(id) {
-      const row = (await selectTokensStmt.get(id)) as { access: string | null; refresh: string | null; exp: number | null } | undefined
+      const state = await storageState(db, key)
+      const row = (await selectTokensStmt.get(id)) as StoredTokens | undefined
       if (row == null || row.access == null) return null
-      return { accessToken: row.access, refreshToken: row.refresh, expiresAt: row.exp }
+      if (row.encrypted && !state) throw new Error('Encrypted tokens without storage encryption state')
+      if (!row.encrypted && state?.complete) throw new Error('Unexpected plaintext GitHub tokens')
+      const value = row.encrypted ? decodeStorageTokens(key!, id, row) : row
+      return { accessToken: value.access!, refreshToken: value.refresh, expiresAt: row.exp }
     },
     async getUserGithubId(id) {
       const row = (await selectGithubIdStmt.get(id)) as { githubId: number } | undefined
@@ -1371,10 +1402,10 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...activity,
     ...comments,
     ...workspaceShareMethods(db),
-    ...reportMethods(stmts),
+    ...reports,
     ...triage,
-    ...importTriageMethods({ ...triage, ...comments }),
-    ...bundleMethods(stmts),
+    ...importTriageMethods({ getReport: reports.getReport, ...triage, ...comments }),
+    ...bundleMethods(stmts, db, key),
     ...teamMethods(stmts),
     async close() {
       await db.close()

package/server-managed/db-neon.ts

@@ -2,11 +2,12 @@ import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA } from './activity.ts'
-import { ManagedCommitError, type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -57,7 +58,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(WORKSPACE_SHARE_SCHEMA))
       await db.query('INSERT INTO managed_schema_version VALUES (4)')
     }
-    await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
+    await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA))
     await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
     await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 5')).rows.length === 0) {
@@ -83,6 +84,10 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query('CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id)')
       await db.query('INSERT INTO managed_schema_version VALUES (8)')
     }
+    for (const table of ['managed_report', 'managed_bundle']) {
+      await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+    }
+    await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -155,11 +160,11 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
       } catch (err) {
         await db.query('ROLLBACK').catch(() => {})
         await db.release().catch(() => {})
-        if (write && commitAttempted) throw new ManagedCommitError(err)
+        if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
         throw err
       }
       try { await db.release() }
-      catch (err) { if (write) throw new ManagedCommitError(err); throw err }
+      catch (err) { if (write) throw new Error('Managed commit outcome is uncertain', { cause: err }); throw err }
       return result
     },
     close() { closed = true },

package/server-managed/db.ts

@@ -7,6 +7,7 @@ import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { managedTableRenames } from './db-table-names.ts'
@@ -65,7 +66,12 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     db.exec('PRAGMA synchronous = FULL;')
     db.exec('PRAGMA foreign_keys = ON;')
     migrateManagedTableNames(db)
-    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA)
+    for (const table of ['managed_report', 'managed_bundle']) {
+      ensureColumn(db, table, 'data_key', 'TEXT')
+      ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    }
+    ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
     ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
     ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
     // Existing public links must opt in too; never preserve an implicit grant.

package/server-managed/http.ts

@@ -48,7 +48,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
 import { NPM_ADVISORIES_TIMEOUT_MS, fetchNpmAdvisories } from '../server-common/npm-advisories.ts'
-import { UPLOAD_CHUNK_BYTES, type UploadKind, putUploadPart, readUpload, validUploadPart } from './uploads.ts'
+import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, putUploadPart, readUpload, validUpload, validUploadPart } from './uploads.ts'
 import { type BundleCache, type BundleCachePart, MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import type { BundleStore } from './bundle-store.ts'
@@ -59,7 +59,7 @@ import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
 import { bundleIntegrity, bundleKind, reportBundleHashes } from './bundle.ts'
 import type { ManagedConfig } from './config.ts'
-import type { ManagedDb, ManagedSession, ReportRecord, StoredUser, TriageEventRow } from './db.ts'
+import type { ManagedBundle, ManagedDb, ManagedSession, ReportRecord, StoredUser, TriageEventRow } from './db.ts'
 import type { OriginGate } from '../server-common/origin.ts'
 import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
@@ -82,7 +82,7 @@ import { clearCookie, endSession, readSession } from './session.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
 import { TeamReportsError, loadTeamReports, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
-import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
+import { FINDING_CATALOG_PAGE_BYTES, FINDING_CATALOG_PAGE_COUNT, MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
@@ -92,7 +92,6 @@ import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
 import { hashToken, randomToken } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
-import { ManagedCommitError } from './sql.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 
 const SESSION_PATH = '/api/auth/session'
@@ -280,19 +279,32 @@ function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: st
 }
 
 async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, path: string) {
-  if (req.method !== 'POST') { send405(res, 'POST'); return }
+  const cancel = req.method === 'DELETE'
+  if (req.method !== 'POST' && !cancel) { send405(res, 'POST, DELETE'); return }
   const s = await checkMutation(req, res, deps, cookie)
   if (!s || !requireManageRole(res, s.user)) return
   if (!deps.uploadStore) { sendJson(res, 404, { error: 'not-found' }); return }
-  const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)\/(0|[1-9][0-9]*)$/u.exec(path)
-  if (!match) { sendJson(res, 400, { error: 'bad-upload' }); return }
-  const id = match[2]!, index = Number(match[3]), kind = match[1] as UploadKind
+  const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)(?:\/(0|[1-9][0-9]*))?$/u.exec(path)
+  if (!match || (cancel ? match[3] !== undefined : match[3] === undefined)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+  const id = match[2]!, kind = match[1] as UploadKind
+  if (cancel) {
+    const count = Number(req.headers['x-upload-parts'])
+    if (!validUpload(id, count)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+    await deleteUpload(deps.uploadStore, s.session.id, kind, id, count)
+    sendJson(res, 200, { ok: true }); return
+  }
+  const index = Number(match[3])
   const maxBytes = kind === 'reports' ? deps.config.maxReportBytes : deps.config.maxBundleBytes
-  if (!validUploadPart(id, index, maxBytes)) { sendJson(res, 400, { error: 'bad-upload' }); return }
+  const discard = async () => {
+    if (validUpload(id, index + 1)) {
+      await deleteUpload(deps.uploadStore!, s.session.id, kind, id, index + 1).catch(err => console.warn('managed: upload cleanup failed:', err))
+    }
+  }
+  if (!validUploadPart(id, index, maxBytes)) { await discard(); sendJson(res, 400, { error: 'bad-upload' }); return }
   let bytes
   try { bytes = await readBodyBytes(req, Math.min(UPLOAD_CHUNK_BYTES, maxBytes)) }
-  catch { sendJson(res, 413, { error: 'too-large' }); return }
-  if (bytes.length === 0) { sendJson(res, 400, { error: 'empty' }); return }
+  catch { await discard(); sendJson(res, 413, { error: 'too-large' }); return }
+  if (bytes.length === 0) { await discard(); sendJson(res, 400, { error: 'empty' }); return }
   if (await manageMutation(req, res, deps, cookie) == null) return
   await putUploadPart(deps.uploadStore, s.session.id, kind, id, index, bytes)
   sendJson(res, 200, { ok: true })
@@ -901,18 +913,22 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
   const { bundleId, integrity } = await resolveReportBundle(deps, s.user, bytes)
-  await deps.reportStore.put(id, bytes)
+  const dataKey = await deps.reportStore.put(id, bytes)
   let report: ReportRecord
   try {
     report = await deps.db.insertOrReuseReport({
-      id, filename, contentType, byteSize: bytes.length, sha256,
+      id, filename, contentType, byteSize: bytes.length, sha256, dataKey,
       uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
     }, Date.now(), s.session.id)
   } catch (err) {
-    // Losing the commit acknowledgement cannot turn primary bytes into garbage.
-    if (!(err instanceof ManagedCommitError)) await deps.reportStore.delete(id).catch(() => {})
-    throw err
+    // A successful COMMIT can lose its acknowledgement. Never delete a file
+    // until a writer-locked read confirms that this candidate did not commit.
+    let committed: ReportRecord | null
+    try { committed = await deps.db.resolveReportUpload(id) }
+    catch (lookup) { throw new AggregateError([err, lookup], 'Report upload reconciliation failed', { cause: lookup }) }
+    if (committed) report = committed
+    else { await deps.reportStore.delete(id).catch(() => {}); throw err }
   }
   if (report.id !== id) await deps.reportStore.delete(id).catch(() => {})
   await sendUploadedReport(req, res, deps, cookie, report, report.id !== id)
@@ -1030,7 +1046,7 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     if (!current) return
     if (JSON.stringify(current.repo) !== JSON.stringify(access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
     sendJson(res, 200, refs ? result : {
-      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [] } : {}), path, commit,
+      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [], solidityEntryPoints: [], soliditySuggestionsLimited: false } : {}), path, commit,
     })
   } catch (err) {
     if (err instanceof GithubApiError) {
@@ -1142,6 +1158,18 @@ async function handleListBundles(res: ServerResponse, deps: ManagedHttpDeps, coo
   await backfillBundleSummaries(bundles, deps.bundleCache)
 }
 
+type UploadedBundle = Pick<ManagedBundle, 'id' | 'integrity' | 'filename' | 'byteSize' | 'repoId' | 'repoDirectory'>
+async function sendUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, bundle: UploadedBundle, deduped: boolean): Promise<void> {
+  const s = await manageMutation(req, res, deps, cookie)
+  if (!s) return
+  if (deduped && !(await canAccessBundle(deps, s.user, bundle.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
+  const { id, integrity, filename, byteSize, repoId, repoDirectory } = bundle
+  // Re-uploading also repairs reports uploaded while the bundle was inaccessible.
+  await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
+  prebuildBundle(deps, id)
+  sendJson(res, deduped ? 200 : 201, { id, integrity, filename, repoId, repoDirectory, ...(deduped ? { deduped: true } : { byteSize }) })
+}
+
 // POST /api/admin/bundles — upload a bundle. Mutation: same-origin + CSRF,
 // admin|manage. Raw bytes; X-Bundle-Filename names it, optional X-Repo-Id and
 // X-Repo-Directory assign a repository location. The bundle's identity is its content hash (sha512), UNIQUE — a
@@ -1178,48 +1206,31 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   const integrity = bundleIntegrity(bytes)
   const filename = sanitizeFilename(firstHeader(req.headers['x-bundle-filename']), 'bundle')
   const existing = await deps.db.getBundleByIntegrity(integrity)
-  if (existing != null) {
-    s = await manageMutation(req, res, deps, cookie)
-    if (!s) return
-    if (!(await canAccessBundle(deps, s.user, existing.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
-    // Reports uploaded while this bundle was inaccessible retain only its
-    // integrity. An authorized re-upload repairs those pending links too.
-    await deps.db.linkReportsToBundle(integrity, existing.id, s.user.role === 'admin' ? undefined : s.user.id)
-    prebuildBundle(deps, existing.id)
-    sendJson(res, 200, { id: existing.id, integrity, filename: existing.filename, repoId: existing.repoId, repoDirectory: existing.repoDirectory, deduped: true })
-    return
-  }
+  if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const kind = bundleKind(filename)
-  await deps.bundleStore.put(id, bytes, kind)
+  const dataKey = await deps.bundleStore.put(id, bytes, kind)
   try {
     await deps.db.insertBundle({
-      id, integrity, filename, kind,
+      id, integrity, filename, kind, dataKey,
       byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: repo.repoId, repoDirectory: directory,
     }, Date.now(), s.session.id)
   } catch (err) {
-    // A committed row may already point here even though insertion rejected.
-    if (!(err instanceof ManagedCommitError)) await deps.bundleStore.delete(id).catch(() => {})
-    if (err instanceof ManagedMutationError) throw err
     // A concurrent upload of identical bytes can insert this integrity (UNIQUE)
     // between our dedup check and this insert — treat that as a dedup, not a 500.
     // Any other failure rethrows.
-    const raced = await deps.db.getBundleByIntegrity(integrity)
-    if (raced != null) {
-      s = await manageMutation(req, res, deps, cookie)
-      if (!s) return
-      if (!(await canAccessBundle(deps, s.user, raced.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
-      await deps.db.linkReportsToBundle(integrity, raced.id, s.user.role === 'admin' ? undefined : s.user.id)
-      prebuildBundle(deps, raced.id)
-      sendJson(res, 200, { id: raced.id, integrity, filename: raced.filename, repoId: raced.repoId, repoDirectory: raced.repoDirectory, deduped: true }); return }
-    throw err
+    let raced: ManagedBundle | null
+    try { raced = await deps.db.resolveBundleUpload(integrity) }
+    catch (lookup) { throw new AggregateError([err, lookup], 'Bundle upload reconciliation failed', { cause: lookup }) }
+    // Preserve a committed candidate after a lost acknowledgement. If this
+    // read fails too, leave the bytes for later reconciliation.
+    if (raced?.id !== id) await deps.bundleStore.delete(id).catch(() => {})
+    if (err instanceof ManagedMutationError) throw err
+    if (!raced) throw err
+    if (raced.id !== id) { await sendUploadedBundle(req, res, deps, cookie, raced, true); return }
+    // Our insert committed: continue with the ordinary creation response.
   }
-  // Auto-link reports that declared this integrity before the bundle existed.
-  s = await manageMutation(req, res, deps, cookie)
-  if (!s) return
-  await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
-  prebuildBundle(deps, id)
-  sendJson(res, 201, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory })
+  await sendUploadedBundle(req, res, deps, cookie, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory }, false)
 }
 
 // GET /api/admin/bundles/<id> — download a stored bundle (admin|manage). Bytes
@@ -1582,7 +1593,8 @@ async function handleGetReportTriageHistory(res: ServerResponse, deps: ManagedHt
   const visible = await visibleFindingIds(deps, current.user, id, current.session.id, teamId)
   if (!visible.has(finding)) { sendJson(res, 404, { error: 'no-finding' }); return }
   const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map((row: TriageEventRow) => ({
-    seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
+    seq: row.seq, at: row.at, actorId: row.actorId, actorLogin: row.actorLogin, actorName: row.actorName,
+    batchId: row.batchId, entry: triageWireEntry(row, true),
   }))
   // A database read can outlive a role, membership, or visibility change.
   const latest = await readSession(deps.config, deps.db, cookie, Date.now())
@@ -1632,9 +1644,31 @@ async function handleSetReportTriage(req: IncomingMessage, res: ServerResponse,
   sendJson(res, 200, { ok: true })
 }
 
+// GET only: clients match local annotations against these IDs without sending
+// their local finding IDs or annotation bodies to discover which reports exist.
+async function handleImportFindingIds(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, search: URLSearchParams): Promise<void> {
+  const s = await readAdminSession(res, deps, cookie)
+  if (!s) return
+  const after = search.get('after') ?? ''
+  if (after && !/^[a-f\d-]{36}$/iu.test(after)) { sendJson(res, 400, { error: 'bad-cursor' }); return }
+  const stored = await deps.db.listFindingCatalogReports(after, FINDING_CATALOG_PAGE_COUNT + 1)
+  const reports = []
+  let bytes = 0, cursor = after, processed = 0
+  for (const report of stored) {
+    if (processed >= FINDING_CATALOG_PAGE_COUNT || (processed > 0 && bytes + report.byteSize > FINDING_CATALOG_PAGE_BYTES)) break
+    bytes += report.byteSize
+    processed++
+    cursor = report.id
+    const findingIds = [...await visibleFindingIds(deps, s.user, report.id, s.session.id, null)]
+    if (findingIds.length > 0) reports.push({ id: report.id, findingIds })
+  }
+  if (await readAdminSession(res, deps, cookie) == null) return
+  sendJson(res, 200, { reports, nextCursor: processed < stored.length ? cursor : null })
+}
+
 // Admin imports compare the exact snapshot shown by the conflict dialog before
 // writing. The store commits shared finding triage and imported comments together.
-async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
+async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
   const s = await adminMutation(req, res, deps, cookie)
   if (!s) return
   let body: { findingIds?: unknown; entries?: unknown; expected?: unknown }
@@ -1658,15 +1692,10 @@ async function handleImportTriage(req: IncomingMessage, res: ServerResponse, dep
       parsed.push([findingId, patch])
     }
   }
-  // Workspace imports remain report-scoped. Standalone local triage can be
-  // imported before its reports; only administrators have this global access.
-  let visible: Set<string> | undefined
-  if (id !== undefined) {
-    if (!(await deps.db.getReport(id))) { sendJson(res, 404, { error: 'no-report' }); return }
-    visible = await visibleFindingIds(deps, s.user, id, s.session.id, null)
-  }
+  if (!(await deps.db.getReport(id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  const visible = await visibleFindingIds(deps, s.user, id, s.session.id, null)
   if (await readAdminSession(res, deps, cookie) == null) return
-  if (visible && ids.some(findingId => !visible.has(findingId))) { sendJson(res, 404, { error: 'no-finding' }); return }
+  if (ids.some(findingId => !visible.has(findingId))) { sendJson(res, 404, { error: 'no-finding' }); return }
   if (reading) { sendJson(res, 200, { snapshots: await deps.db.getImportTriage(ids) }); return }
   const applied = await deps.db.importTriage(parsed, expected!, { id: s.user.id, login: s.user.login }, id, Date.now())
   sendJson(res, applied ? 200 : 409, { ok: applied })
@@ -1925,7 +1954,9 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
       sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
-        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? { uploadChunkBytes: UPLOAD_CHUNK_BYTES } : {}) } })
+        managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? {
+          uploadChunkBytes: UPLOAD_CHUNK_BYTES, uploadMaxBytes: { reports: config.maxReportBytes, bundles: config.maxBundleBytes },
+        } : {}) } })
       return
     }
     // OAuth: start → redirect to GitHub with the CSRF state cookie.
@@ -2064,9 +2095,9 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleSetReportVisible(req, res, deps, cookie); return
     }
-    if (path === '/api/admin/import-triage') {
-      if (method !== 'POST') { send405(res, 'POST'); return }
-      await handleImportTriage(req, res, deps, cookie); return
+    if (path === '/api/admin/reports/finding-ids') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleImportFindingIds(res, deps, cookie, url.searchParams); return
     }
     const importTriage = /^\/api\/admin\/reports\/([a-f\d-]{36})\/import-triage$/iu.exec(path)
     if (importTriage) {