@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.27

package/server-managed/db-methods.ts

@@ -12,6 +12,8 @@ import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
 import { ManagedMutationError, type ManagementStore, managementMethods } from './management.ts'
+import { type StorageKey } from '../server-common/storage-crypto.ts'
+import { type StorageDb, type StoredTokens, decodeStorageTokens, encodeStorageTokens, storageMethods, storageState, validateStorageUpload } from './storage-db.ts'
 
 // A managed user identity (the subset of GitHub's `GET /user` we keep). Input
 // to the upsert; `githubUserId` is the provider lookup key, never exposed to
@@ -131,6 +133,7 @@ export interface ReportAccessSnapshot {
 // bundle links; `bundleIntegrity` is the report's declared primary bundle (kept
 // so a later bundle upload of that integrity re-links it).
 export interface ReportRecordInput {
+  dataKey?: string | null
   id: string
   filename: string
   contentType: string
@@ -228,7 +231,7 @@ export interface ManagedBundle {
 
 // What the upload handler supplies to record a bundle; the store stamps
 // uploaded_at. `uploadedByLogin` is the durable uploader-login snapshot.
-export type BundleInput = Omit<ManagedBundle, 'uploadedAt' | 'slug' | 'repoDirectory'> & { uploadedByLogin: string | null; repoDirectory?: string }
+export type BundleInput = Omit<ManagedBundle, 'uploadedAt' | 'slug' | 'repoDirectory'> & { uploadedByLogin: string | null; repoDirectory?: string; dataKey?: string | null }
 
 // A bundle row for the "Manage bundles" list — adds the uploader login + repo
 // full name display joins (null when absent / since removed).
@@ -310,7 +313,7 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, StorageDb {
   // Upsert the identity; returns the user's opaque id (stable across logins).
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
@@ -358,6 +361,8 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   listReports(userId?: string): Promise<AdminReport[]>
   listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]>
   getReport(id: string): Promise<ReportRecord | null>
+  // Writer-locked reconciliation waits for an uncertain earlier insert.
+  resolveReportUpload(id: string): Promise<ReportRecord | null>
   getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null>
   getReportAccessSnapshot(sessionId: string, now: number, ids: readonly string[]): Promise<ReportAccessSnapshot | null>
   listReportFilenamesWithBundleHash(bundleId: string, sha256: string): Promise<string[]>
@@ -392,6 +397,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // declared its integrity.
   insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void>
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
+  resolveBundleUpload(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
   listBundles(userId?: string): Promise<AdminBundle[]>
   userCanReadBundle(userId: string, id: string): Promise<boolean>
@@ -499,11 +505,11 @@ function prepareStatements(db: ManagedSql) {
     updateRoleStmt: db.prepare(`UPDATE managed_user SET role = ?, updated_at = ? WHERE id = ?`),
     updateTokensStmt: db.prepare(
       `UPDATE managed_user
-          SET gh_access_token = ?, gh_refresh_token = ?, gh_token_expires_at = ?, updated_at = ?
+          SET gh_access_token = ?, gh_refresh_token = ?, gh_token_expires_at = ?, gh_tokens_encrypted = ?, updated_at = ?
         WHERE id = ?`,
     ),
     selectTokensStmt: db.prepare(
-      `SELECT gh_access_token AS access, gh_refresh_token AS refresh, gh_token_expires_at AS exp
+      `SELECT gh_access_token AS access, gh_refresh_token AS refresh, gh_token_expires_at AS exp, gh_tokens_encrypted AS encrypted
          FROM managed_user WHERE id = ?`,
     ),
     deleteSessionStmt: db.prepare(`DELETE FROM managed_session WHERE id = ?`),
@@ -551,9 +557,9 @@ function prepareStatements(db: ManagedSql) {
     ),
     insertReportStmt: db.prepare(
       `WITH candidate(id, slug) AS (VALUES (?, ?))
-       INSERT INTO managed_report (id, slug, filename, content_type, byte_size, sha256, uploaded_by, uploaded_by_login, repo_id, repo_directory, repo_embedded, analyzer, visible, bundle_id, bundle_integrity, uploaded_at)
+       INSERT INTO managed_report (id, slug, filename, content_type, byte_size, sha256, uploaded_by, uploaded_by_login, repo_id, repo_directory, repo_embedded, analyzer, visible, bundle_id, bundle_integrity, uploaded_at, data_key, storage_encrypted)
        SELECT id, CASE WHEN EXISTS (SELECT 1 FROM managed_report WHERE slug = candidate.slug) THEN id ELSE slug END,
-              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
+              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
     ),
     // LEFT JOINs so a report whose uploader / repo / bundle was removed (the FK
     // nulled) still lists, with null display fields.
@@ -680,9 +686,9 @@ function prepareStatements(db: ManagedSql) {
       WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY id`),
     insertBundleStmt: db.prepare(
       `WITH candidate(id, slug) AS (VALUES (?, ?))
-       INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, uploaded_at)
+       INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, uploaded_at, data_key, storage_encrypted)
        SELECT id, CASE WHEN EXISTS (SELECT 1 FROM managed_bundle WHERE slug = candidate.slug) THEN id ELSE slug END,
-              ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
+              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
     ),
     selectBundleByIntegrityStmt: db.prepare(
       `SELECT id, slug, integrity, filename, kind, byte_size AS byteSize,
@@ -924,7 +930,7 @@ async function authorizeUpload(stmts: ReturnType<typeof prepareStatements>, sess
 }
 
 // The report slice of ManagedDb closes over its prepared statements.
-function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
+function reportMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql, key: StorageKey | null) {
   const { insertReportStmt, selectReportsStmt, selectReportStmt, deleteReportStmt, setReportRepoStmt, setReportVisibleStmt } = stmts
   async function getReport(id: string): Promise<ReportRecord | null> {
     const row = (await selectReportStmt.get(id)) as ReportRow | undefined
@@ -936,16 +942,18 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>) {
     return row ? getReport(row.id) : null
   }
   async function insertReport(report: ReportRecordInput, now: number): Promise<void> {
+    await validateStorageUpload(db, key, 'report', report.id, report.dataKey)
     await insertReportStmt.run(
       report.id, preferredSlug(report.id), report.filename, report.contentType, report.byteSize,
       report.sha256, report.uploadedBy, report.uploadedByLogin ?? null, report.repoId,
       report.repoDirectory ?? '', report.repoEmbedded ? 1 : 0, report.analyzer ?? null, report.visible == null ? 0 : report.visible ? 1 : 0, report.bundleId ?? null,
-      report.bundleIntegrity ?? null, now,
+      report.bundleIntegrity ?? null, now, report.dataKey ?? null, report.dataKey ? 1 : 0,
     )
   }
   return {
     insertReport,
     getReport,
+    resolveReportUpload: getReport,
     getReportByHash,
     async insertOrReuseReport(report: ReportRecordInput, now: number, sessionId?: string): Promise<ReportRecord> {
       await authorizeUpload(stmts, sessionId, report)
@@ -1126,23 +1134,27 @@ function mapBundle(r: BundleRow): ManagedBundle {
 }
 
 // The bundle slice of ManagedDb. Closes over its prepared statements.
-function bundleMethods(stmts: ReturnType<typeof prepareStatements>) {
+function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql, key: StorageKey | null) {
   const {
     insertBundleStmt, selectBundleByIntegrityStmt, selectBundleStmt,
     selectBundlesStmt, deleteBundleStmt, setBundleRepoStmt, linkReportsToBundleStmt, selectBundleReadableStmt, selectRepoReadableStmt, selectRepoPathReadableStmt,
   } = stmts
+  async function getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null> {
+    const row = (await selectBundleByIntegrityStmt.get(integrity)) as BundleRow | undefined
+    return row == null ? null : mapBundle(row)
+  }
   return {
     async insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void> {
       await authorizeUpload(stmts, sessionId, bundle)
+      await validateStorageUpload(db, key, 'bundle', bundle.id, bundle.dataKey)
       await insertBundleStmt.run(
         bundle.id, preferredSlug(bundle.id), bundle.integrity, bundle.filename, bundle.kind,
-        bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now,
+        bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now, bundle.dataKey ?? null, bundle.dataKey ? 1 : 0,
       )
     },
-    async getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null> {
-      const row = (await selectBundleByIntegrityStmt.get(integrity)) as BundleRow | undefined
-      return row == null ? null : mapBundle(row)
-    },
+    getBundleByIntegrity,
+    // The distinct method name selects a writer-locked reconciliation scope.
+    resolveBundleUpload: getBundleByIntegrity,
     async getBundle(id: string): Promise<ManagedBundle | null> {
       const row = (await selectBundleStmt.get(id)) as BundleRow | undefined
       return row == null ? null : mapBundle(row)
@@ -1309,14 +1321,16 @@ function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
 // `triageHistoryLimit`: events kept per finding in the triage trail; 0 (the
 // default) keeps everything. See ManagedConfig.
 export interface ManagedDbOptions {
+  storageEncryptionKey?: StorageKey | null
   triageHistoryLimit?: number
 }
 
 export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions = {}): ManagedDb {
+  const key = options.storageEncryptionKey ?? null
   const comments = commentMethods(db)
   const activity = activityMethods(db)
   const stmts = prepareStatements(db)
-  const reports = reportMethods(stmts)
+  const reports = reportMethods(stmts, db, key)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0)
   const {
     upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
@@ -1324,6 +1338,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   } = stmts
 
   const methods: Omit<ManagedDb, keyof ManagementStore> = {
+    ...storageMethods(db, key),
     async upsertUser(user, now, initialAdminGithubId = null) {
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
@@ -1364,12 +1379,18 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       return Number((await updateRoleStmt.run(role, Date.now(), id)).changes) > 0
     },
     async setUserTokens(id, tokens) {
-      await updateTokensStmt.run(tokens.accessToken, tokens.refreshToken, tokens.expiresAt, Date.now(), id)
+      const state = await storageState(db, key)
+      const value = state ? encodeStorageTokens(key!, id, tokens.accessToken, tokens.refreshToken) : { access: tokens.accessToken, refresh: tokens.refreshToken }
+      await updateTokensStmt.run(value.access, value.refresh, tokens.expiresAt, state ? 1 : 0, Date.now(), id)
     },
     async getUserTokens(id) {
-      const row = (await selectTokensStmt.get(id)) as { access: string | null; refresh: string | null; exp: number | null } | undefined
+      const state = await storageState(db, key)
+      const row = (await selectTokensStmt.get(id)) as StoredTokens | undefined
       if (row == null || row.access == null) return null
-      return { accessToken: row.access, refreshToken: row.refresh, expiresAt: row.exp }
+      if (row.encrypted && !state) throw new Error('Encrypted tokens without storage encryption state')
+      if (!row.encrypted && state?.complete) throw new Error('Unexpected plaintext GitHub tokens')
+      const value = row.encrypted ? decodeStorageTokens(key!, id, row) : row
+      return { accessToken: value.access!, refreshToken: value.refresh, expiresAt: row.exp }
     },
     async getUserGithubId(id) {
       const row = (await selectGithubIdStmt.get(id)) as { githubId: number } | undefined
@@ -1384,7 +1405,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...reports,
     ...triage,
     ...importTriageMethods({ getReport: reports.getReport, ...triage, ...comments }),
-    ...bundleMethods(stmts),
+    ...bundleMethods(stmts, db, key),
     ...teamMethods(stmts),
     async close() {
       await db.close()

package/server-managed/db-neon.ts

@@ -2,11 +2,12 @@ import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA } from './activity.ts'
-import { ManagedCommitError, type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -57,7 +58,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(WORKSPACE_SHARE_SCHEMA))
       await db.query('INSERT INTO managed_schema_version VALUES (4)')
     }
-    await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
+    await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA))
     await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
     await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 5')).rows.length === 0) {
@@ -83,6 +84,10 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query('CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id)')
       await db.query('INSERT INTO managed_schema_version VALUES (8)')
     }
+    for (const table of ['managed_report', 'managed_bundle']) {
+      await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+    }
+    await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -155,11 +160,11 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
       } catch (err) {
         await db.query('ROLLBACK').catch(() => {})
         await db.release().catch(() => {})
-        if (write && commitAttempted) throw new ManagedCommitError(err)
+        if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
         throw err
       }
       try { await db.release() }
-      catch (err) { if (write) throw new ManagedCommitError(err); throw err }
+      catch (err) { if (write) throw new Error('Managed commit outcome is uncertain', { cause: err }); throw err }
       return result
     },
     close() { closed = true },

package/server-managed/db.ts

@@ -7,6 +7,7 @@ import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { managedTableRenames } from './db-table-names.ts'
@@ -65,7 +66,12 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     db.exec('PRAGMA synchronous = FULL;')
     db.exec('PRAGMA foreign_keys = ON;')
     migrateManagedTableNames(db)
-    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA)
+    for (const table of ['managed_report', 'managed_bundle']) {
+      ensureColumn(db, table, 'data_key', 'TEXT')
+      ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    }
+    ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
     ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
     ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
     // Existing public links must opt in too; never preserve an implicit grant.

package/server-managed/http.ts

@@ -59,7 +59,7 @@ import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
 import { bundleIntegrity, bundleKind, reportBundleHashes } from './bundle.ts'
 import type { ManagedConfig } from './config.ts'
-import type { ManagedDb, ManagedSession, ReportRecord, StoredUser, TriageEventRow } from './db.ts'
+import type { ManagedBundle, ManagedDb, ManagedSession, ReportRecord, StoredUser, TriageEventRow } from './db.ts'
 import type { OriginGate } from '../server-common/origin.ts'
 import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
@@ -92,7 +92,6 @@ import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
 import { hashToken, randomToken } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
-import { ManagedCommitError } from './sql.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 
 const SESSION_PATH = '/api/auth/session'
@@ -914,18 +913,22 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
   const { bundleId, integrity } = await resolveReportBundle(deps, s.user, bytes)
-  await deps.reportStore.put(id, bytes)
+  const dataKey = await deps.reportStore.put(id, bytes)
   let report: ReportRecord
   try {
     report = await deps.db.insertOrReuseReport({
-      id, filename, contentType, byteSize: bytes.length, sha256,
+      id, filename, contentType, byteSize: bytes.length, sha256, dataKey,
       uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
     }, Date.now(), s.session.id)
   } catch (err) {
-    // Losing the commit acknowledgement cannot turn primary bytes into garbage.
-    if (!(err instanceof ManagedCommitError)) await deps.reportStore.delete(id).catch(() => {})
-    throw err
+    // A successful COMMIT can lose its acknowledgement. Never delete a file
+    // until a writer-locked read confirms that this candidate did not commit.
+    let committed: ReportRecord | null
+    try { committed = await deps.db.resolveReportUpload(id) }
+    catch (lookup) { throw new AggregateError([err, lookup], 'Report upload reconciliation failed', { cause: lookup }) }
+    if (committed) report = committed
+    else { await deps.reportStore.delete(id).catch(() => {}); throw err }
   }
   if (report.id !== id) await deps.reportStore.delete(id).catch(() => {})
   await sendUploadedReport(req, res, deps, cookie, report, report.id !== id)
@@ -1043,7 +1046,7 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     if (!current) return
     if (JSON.stringify(current.repo) !== JSON.stringify(access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
     sendJson(res, 200, refs ? result : {
-      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [] } : {}), path, commit,
+      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [], solidityEntryPoints: [], soliditySuggestionsLimited: false } : {}), path, commit,
     })
   } catch (err) {
     if (err instanceof GithubApiError) {
@@ -1155,6 +1158,18 @@ async function handleListBundles(res: ServerResponse, deps: ManagedHttpDeps, coo
   await backfillBundleSummaries(bundles, deps.bundleCache)
 }
 
+type UploadedBundle = Pick<ManagedBundle, 'id' | 'integrity' | 'filename' | 'byteSize' | 'repoId' | 'repoDirectory'>
+async function sendUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, bundle: UploadedBundle, deduped: boolean): Promise<void> {
+  const s = await manageMutation(req, res, deps, cookie)
+  if (!s) return
+  if (deduped && !(await canAccessBundle(deps, s.user, bundle.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
+  const { id, integrity, filename, byteSize, repoId, repoDirectory } = bundle
+  // Re-uploading also repairs reports uploaded while the bundle was inaccessible.
+  await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
+  prebuildBundle(deps, id)
+  sendJson(res, deduped ? 200 : 201, { id, integrity, filename, repoId, repoDirectory, ...(deduped ? { deduped: true } : { byteSize }) })
+}
+
 // POST /api/admin/bundles — upload a bundle. Mutation: same-origin + CSRF,
 // admin|manage. Raw bytes; X-Bundle-Filename names it, optional X-Repo-Id and
 // X-Repo-Directory assign a repository location. The bundle's identity is its content hash (sha512), UNIQUE — a
@@ -1191,48 +1206,31 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   const integrity = bundleIntegrity(bytes)
   const filename = sanitizeFilename(firstHeader(req.headers['x-bundle-filename']), 'bundle')
   const existing = await deps.db.getBundleByIntegrity(integrity)
-  if (existing != null) {
-    s = await manageMutation(req, res, deps, cookie)
-    if (!s) return
-    if (!(await canAccessBundle(deps, s.user, existing.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
-    // Reports uploaded while this bundle was inaccessible retain only its
-    // integrity. An authorized re-upload repairs those pending links too.
-    await deps.db.linkReportsToBundle(integrity, existing.id, s.user.role === 'admin' ? undefined : s.user.id)
-    prebuildBundle(deps, existing.id)
-    sendJson(res, 200, { id: existing.id, integrity, filename: existing.filename, repoId: existing.repoId, repoDirectory: existing.repoDirectory, deduped: true })
-    return
-  }
+  if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const kind = bundleKind(filename)
-  await deps.bundleStore.put(id, bytes, kind)
+  const dataKey = await deps.bundleStore.put(id, bytes, kind)
   try {
     await deps.db.insertBundle({
-      id, integrity, filename, kind,
+      id, integrity, filename, kind, dataKey,
       byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: repo.repoId, repoDirectory: directory,
     }, Date.now(), s.session.id)
   } catch (err) {
-    // A committed row may already point here even though insertion rejected.
-    if (!(err instanceof ManagedCommitError)) await deps.bundleStore.delete(id).catch(() => {})
-    if (err instanceof ManagedMutationError) throw err
     // A concurrent upload of identical bytes can insert this integrity (UNIQUE)
     // between our dedup check and this insert — treat that as a dedup, not a 500.
     // Any other failure rethrows.
-    const raced = await deps.db.getBundleByIntegrity(integrity)
-    if (raced != null) {
-      s = await manageMutation(req, res, deps, cookie)
-      if (!s) return
-      if (!(await canAccessBundle(deps, s.user, raced.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
-      await deps.db.linkReportsToBundle(integrity, raced.id, s.user.role === 'admin' ? undefined : s.user.id)
-      prebuildBundle(deps, raced.id)
-      sendJson(res, 200, { id: raced.id, integrity, filename: raced.filename, repoId: raced.repoId, repoDirectory: raced.repoDirectory, deduped: true }); return }
-    throw err
+    let raced: ManagedBundle | null
+    try { raced = await deps.db.resolveBundleUpload(integrity) }
+    catch (lookup) { throw new AggregateError([err, lookup], 'Bundle upload reconciliation failed', { cause: lookup }) }
+    // Preserve a committed candidate after a lost acknowledgement. If this
+    // read fails too, leave the bytes for later reconciliation.
+    if (raced?.id !== id) await deps.bundleStore.delete(id).catch(() => {})
+    if (err instanceof ManagedMutationError) throw err
+    if (!raced) throw err
+    if (raced.id !== id) { await sendUploadedBundle(req, res, deps, cookie, raced, true); return }
+    // Our insert committed: continue with the ordinary creation response.
   }
-  // Auto-link reports that declared this integrity before the bundle existed.
-  s = await manageMutation(req, res, deps, cookie)
-  if (!s) return
-  await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
-  prebuildBundle(deps, id)
-  sendJson(res, 201, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory })
+  await sendUploadedBundle(req, res, deps, cookie, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory }, false)
 }
 
 // GET /api/admin/bundles/<id> — download a stored bundle (admin|manage). Bytes

package/server-managed/index.ts

@@ -42,7 +42,7 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
   })
   const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, originGate, serveStatic,
-    ...('uploadStore' in storage ? { uploadStore: storage.uploadStore } : {}),
+    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}),
     isShuttingDown, track,
   })
 
@@ -55,7 +55,8 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
     let sessions = 0, uploads = 0
     cleanup = runReapers({
       sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
-      ...('reapUploads' in storage ? { uploads: async () => { uploads = await storage.reapUploads() } } : {}),
+      ...(storage.reapUploads ? { uploads: async () => { uploads = await storage.reapUploads!() } } : {}),
+      ...('reapStorage' in storage ? { storage: () => storage.reapStorage() } : {}),
     }).then(() => {
       nextCleanupAt = Date.now() + REAP_INTERVAL_MS
       return console.info(`managed-reaper: removed ${sessions} expired session(s), ${uploads} stale upload part(s) in ${Date.now() - startedAt}ms`)

package/server-managed/object-storage-disk.ts

@@ -0,0 +1,144 @@
+import { randomUUID } from 'node:crypto'
+import { lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { type ObjectPage, type RawObjectStorage, objectPath } from './object-storage.ts'
+
+function missing(err: unknown): boolean { return (err as NodeJS.ErrnoException).code === 'ENOENT' }
+function version(info: { dev: number; ino: number; size: number; mtimeMs: number; ctimeMs: number }): string {
+  return JSON.stringify([info.dev, info.ino, info.size, info.mtimeMs, info.ctimeMs])
+}
+
+async function syncDirectory(dir: string): Promise<void> {
+  try {
+    const directory = await open(dir, 'r')
+    try { await directory.sync() } finally { await directory.close() }
+  } catch (err) {
+    // Windows and some mounted filesystems cannot open/fsync directories.
+    // Preserve real I/O failures; file fsync remains mandatory on every write.
+    if (!['EINVAL', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EISDIR', 'EBADF', 'EPERM'].includes((err as NodeJS.ErrnoException).code ?? '')) throw err
+  }
+}
+
+// Keyset pagination survives concurrent file creation/deletion. A final sweep
+// catches objects inserted before the cursor during migration.
+async function listFiles(dir: string, prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage> {
+  const objects: ObjectPage['objects'] = []
+  async function visit(key: string): Promise<void> {
+    signal?.throwIfAborted()
+    let entries
+    try {
+      if (!(await lstat(join(dir, key))).isDirectory()) {
+        console.warn('managed-storage: skipping unsupported directory', JSON.stringify(key))
+        return
+      }
+      entries = await readdir(join(dir, key), { withFileTypes: true })
+    }
+    catch (err) { if (missing(err)) return; throw err }
+    const order = (entry: typeof entries[number]) => `${entry.name}${entry.isDirectory() ? '/' : ''}`
+    entries.sort((a, b) => order(a) < order(b) ? -1 : order(a) > order(b) ? 1 : 0)
+    for (const entry of entries) {
+      signal?.throwIfAborted()
+      const child = `${key}${entry.name}`
+      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
+        console.warn('managed-storage: skipping unsupported entry', JSON.stringify(child))
+        continue
+      }
+      try { objectPath(child) }
+      catch { console.warn('managed-storage: skipping invalid entry', JSON.stringify(child)); continue }
+      if (entry.isDirectory()) {
+        const folder = `${child}/`
+        if (cursor && folder < cursor && !cursor.startsWith(folder)) continue
+        await visit(folder)
+        if (objects.length > limit) return
+      }
+      else if (entry.isFile() && (!cursor || child > cursor)) {
+        try { objects.push({ key: objectPath(child), modifiedAt: (await stat(join(dir, child))).mtimeMs }) }
+        catch (err) { if (!missing(err)) throw err }
+        if (objects.length > limit) return
+      }
+    }
+    // Another migration worker can observe an unlink before its writer has
+    // synced the directory. Persist those observed removals before an empty
+    // inventory can mark the shared migration complete.
+    try { await syncDirectory(join(dir, key)) } catch (err) { if (!missing(err)) throw err }
+  }
+  if (!prefix.endsWith('/') || !Number.isInteger(limit) || limit < 1) throw new Error('Invalid storage page')
+  objectPath(`${prefix}validate`)
+  await visit(prefix)
+  return { objects: objects.slice(0, limit), cursor: objects.length > limit ? objects[limit - 1]!.key : null }
+}
+
+export function createDiskObjectStorage(dir: string): RawObjectStorage {
+  const path = (key: string) => join(dir, objectPath(key))
+  return {
+    async head(key, signal) {
+      signal?.throwIfAborted()
+      try {
+        const info = await stat(path(key))
+        return { size: info.size, version: version(info), modifiedAt: info.mtimeMs }
+      } catch (err) { if (missing(err)) return null; throw err }
+    },
+    async open(key, signal) {
+      signal?.throwIfAborted()
+      let file
+      try { file = await open(path(key), 'r') }
+      catch (err) { if (missing(err)) return null; throw err }
+      try {
+        const info = await file.stat()
+        return { size: info.size, version: version(info), modifiedAt: info.mtimeMs,
+          stream: file.createReadStream(signal ? { signal } : {}) }
+      } catch (err) { await file.close(); throw err }
+    },
+    async put(key, bytes, signal, expected) {
+      const target = path(key)
+      // Temp-file + rename makes replacement atomic to readers. Concurrent
+      // migrations use the same persisted data key and immutable plaintext.
+      const temp = `${target}.${randomUUID()}.tmp`
+      await mkdir(dirname(target), { recursive: true })
+      const file = await open(temp, 'wx', 0o600)
+      try {
+        await file.writeFile(bytes, signal ? { signal } : {})
+        await file.sync(); await file.close()
+        signal?.throwIfAborted()
+        if (expected !== undefined) {
+          try { if (version(await stat(target)) !== expected) return false }
+          catch (err) { if (missing(err)) return false; throw err }
+        }
+        await rename(temp, target)
+        await syncDirectory(dirname(target))
+        return true
+      } finally { await file.close(); await rm(temp, { force: true }) }
+    },
+    async delete(key, expected, signal) {
+      signal?.throwIfAborted()
+      try {
+        if (expected !== undefined && version(await stat(path(key))) !== expected) return false
+        await rm(path(key), { force: true })
+        // Persist plaintext removal before migration checkpoints completion.
+        // Otherwise a crash could restore the directory entry after SQL has
+        // durably disabled further plaintext inventory sweeps.
+        await syncDirectory(dirname(path(key)))
+        return true
+      } catch (err) { if (missing(err)) return true; throw err }
+    },
+    async sync(key, signal) { signal?.throwIfAborted(); await syncDirectory(dirname(path(key))) },
+    async prune(prefix, signal) {
+      if (!prefix.endsWith('/')) throw new Error('Invalid storage prefix')
+      objectPath(`${prefix}validate`)
+      async function visit(folder: string): Promise<void> {
+        signal?.throwIfAborted()
+        let entries
+        try {
+          if (!(await lstat(folder)).isDirectory()) return
+          entries = await readdir(folder, { withFileTypes: true })
+        }
+        catch (err) { if (missing(err)) return; throw err }
+        for (const entry of entries) if (entry.isDirectory()) await visit(join(folder, entry.name))
+        try { await rmdir(folder); await syncDirectory(dirname(folder)) }
+        catch (err) { if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes((err as NodeJS.ErrnoException).code ?? '')) throw err }
+      }
+      await visit(join(dir, prefix))
+    },
+    list: (prefix, cursor, limit, signal) => listFiles(dir, prefix, cursor, limit, signal),
+  }
+}

package/server-managed/object-storage-vercel.ts

@@ -0,0 +1,60 @@
+import { Readable } from 'node:stream'
+import { Buffer } from 'node:buffer'
+import { type VercelBlobSdk, isNotFound, loadVercelBlobSdk } from '../server-common/vercel-blob.ts'
+import { type RawObjectStorage, objectPath } from './object-storage.ts'
+
+export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk): Promise<RawObjectStorage> {
+  const blobs = sdk ?? await loadVercelBlobSdk()
+  const path = (key: string) => `.managed/${objectPath(key)}`
+  return {
+    async head(key, signal) {
+      try {
+        const meta = await blobs.head(path(key), { token, ...(signal ? { abortSignal: signal } : {}) })
+        if (!meta.etag) throw new Error('Missing object version')
+        return { size: meta.size, version: meta.etag, modifiedAt: new Date(meta.uploadedAt ?? Date.now()).getTime() }
+      } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
+    },
+    async open(key, signal) {
+      try {
+        const result = await blobs.get(path(key), { token, access: 'private', useCache: false, ...(signal ? { abortSignal: signal } : {}) })
+        if (!result) return null
+        if (result.statusCode !== 200 || !result.stream || !result.blob.etag) {
+          await result.stream?.cancel()
+          throw new Error('Unexpected blob response or missing object version')
+        }
+        return { size: result.blob.size === 0 ? null : result.blob.size, version: result.blob.etag,
+          modifiedAt: new Date(result.blob.uploadedAt ?? Date.now()).getTime(),
+          stream: Readable.fromWeb(result.stream as Parameters<typeof Readable.fromWeb>[0]) }
+      } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
+    },
+    async put(key, bytes, signal, expected, sizeHint) {
+      const multipart = (sizeHint ?? (Buffer.isBuffer(bytes) ? bytes.length : Infinity)) >= 5 * 1024 * 1024
+      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: true,
+        ...(expected ? { ifMatch: expected } : {}), multipart, contentType: 'application/octet-stream', cacheControlMaxAge: 60, ...(signal ? { abortSignal: signal } : {}) })
+        return true
+      } catch (err) {
+        if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        throw err
+      }
+    },
+    async delete(key, version, signal) {
+      signal?.throwIfAborted()
+      try { await blobs.del(path(key), { token, ...(version ? { ifMatch: version } : {}), ...(signal ? { abortSignal: signal } : {}) }); return true }
+      catch (err) {
+        if (isNotFound(err, blobs)) return true
+        if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        throw err
+      }
+    },
+    async list(prefix, cursor, limit, signal) {
+      signal?.throwIfAborted()
+      if (!prefix.endsWith('/') || !Number.isInteger(limit) || limit < 1) throw new Error('Invalid storage page')
+      objectPath(`${prefix}validate`)
+      const page = await blobs.list({ prefix: `.managed/${prefix}`, token, limit, ...(cursor ? { cursor } : {}), ...(signal ? { abortSignal: signal } : {}) })
+      if (page.hasMore && (!page.cursor || page.cursor === cursor)) throw new Error('Invalid blob pagination')
+      return { objects: page.blobs.filter(blob => blob.pathname.startsWith(`.managed/${prefix}`)).map(blob => ({ key: blob.pathname.slice('.managed/'.length),
+        modifiedAt: new Date(blob.uploadedAt ?? Date.now()).getTime() })),
+      cursor: page.hasMore ? page.cursor! : null }
+    },
+  }
+}