@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.28

package/server-managed/bundle-build-leases.ts

@@ -0,0 +1,41 @@
+import type { ManagedSql } from './sql.ts'
+
+export const BUNDLE_BUILD_TIMEOUT_MS = 180_000
+// Leave time to terminate a timed-out worker before a crashed owner's slot
+// becomes reusable. Expiration uses the database clock, not an instance's clock.
+const LEASE_MS = BUNDLE_BUILD_TIMEOUT_MS + 60_000
+export const BUNDLE_BUILD_LEASE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_bundle_build_lease (
+  slot INTEGER PRIMARY KEY CHECK (slot IN (1, 2)),
+  owner TEXT NOT NULL UNIQUE,
+  user_id TEXT NOT NULL UNIQUE,
+  expires_at INTEGER NOT NULL
+) STRICT;
+`
+
+export interface BundleBuildLeaseStore {
+  claimBundleBuildLease(userId: string, owner: string): Promise<boolean>
+  releaseBundleBuildLease(owner: string): Promise<void>
+}
+
+export function bundleBuildLeaseMethods(db: ManagedSql): BundleBuildLeaseStore {
+  return {
+    // scopeManagedMethods holds SQLite's write transaction / PostgreSQL's
+    // advisory transaction lock across cleanup, inspection, and admission.
+    async claimBundleBuildLease(userId, owner) {
+      const { now } = await db.prepare("SELECT CAST(unixepoch('subsec') * 1000 AS INTEGER) AS now").get() as { now: number }
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE expires_at <= ?').run(now)
+      const leases = await db.prepare('SELECT slot, user_id AS userId FROM managed_bundle_build_lease').all() as { slot: number; userId: string }[]
+      if (leases.length >= 2 || leases.some(lease => lease.userId === userId)) return false
+      const slot = leases.some(lease => lease.slot === 1) ? 2 : 1
+      await db.prepare('INSERT INTO managed_bundle_build_lease (slot, owner, user_id, expires_at) VALUES (?, ?, ?, ?)')
+        .run(slot, owner, userId, now + LEASE_MS)
+      return true
+    },
+    // No user FK: deleting an account must not free a still-running worker's
+    // slot. A delayed/crashed owner's cleanup cannot release its successor.
+    async releaseBundleBuildLease(owner) {
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE owner = ?').run(owner)
+    },
+  }
+}

package/server-managed/bundle-build-worker.js

@@ -0,0 +1,44 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { Buffer } from 'node:buffer'
+import { posix } from 'node:path'
+import { brotliCompressSync } from 'node:zlib'
+import { buildGitHubBundle } from '@exodus/stasis/vfs-bundle'
+import { brotliOptions } from '@exodus/stasis-core/brotli'
+import { HttpError, createClient } from '@preventive/upstream/github.js'
+import { githubBundleFilename } from './bundle-build.ts'
+
+export async function buildStasisBundle({ input, github, token, maxBytes, scopes }, client = createClient({ token })) {
+  const allowed = path => scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))
+  // Stasis/upstream cache writes are disabled by default; this fresh worker
+  // never enables a cache directory or inherits application credentials.
+  const { bundle } = await buildGitHubBundle({
+    github, sha: input.commit, directory: input.directory || undefined,
+    entries: input.entries.map(entry => posix.relative(input.directory || '.', entry)),
+    ...input.options, client,
+  })
+  const directory = bundle.repo?.directory ?? ''
+  // A workspace lockfile may widen the build root. Never publish it under a
+  // narrower team grant: the storage location must cover the actual bundle.
+  if (!allowed(directory)) throw new Error('build-scope')
+  const serialized = bundle.serialize()
+  if (Buffer.byteLength(serialized) > 200 * 1024 * 1024) throw new Error('too-large')
+  const bytes = brotliCompressSync(serialized, brotliOptions())
+  if (bytes.length > maxBytes) throw new Error('too-large')
+  return { bytes, directory, filename: githubBundleFilename(github, input.directory, input.commit) }
+}
+
+if (parentPort && workerData?.type === 'managed-bundle-build') {
+  try {
+    // Node worker messages have no browser target origin.
+    // oxlint-disable-next-line unicorn/require-post-message-target-origin
+    parentPort.postMessage(await buildStasisBundle(workerData))
+  } catch (error) {
+    // Do not return upstream bodies or paths outside the caller's grants.
+    const code = ['build-scope', 'too-large'].includes(error.message) ? error.message
+      : error instanceof HttpError ? (error.status === 429 ? 'github-rate-limited' : 'github-build-failed')
+        : /no packageManager given|lockfile installs/u.test(error.message) ? 'build-lockfile'
+          : 'build-failed'
+    // oxlint-disable-next-line unicorn/require-post-message-target-origin
+    parentPort.postMessage({ error: code, status: code === 'too-large' ? 413 : code === 'build-scope' ? 403 : 422 })
+  }
+}

package/server-managed/bundle-build.ts

@@ -0,0 +1,141 @@
+import { Buffer } from 'node:buffer'
+import { createHash, randomUUID } from 'node:crypto'
+import { posix } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { BUNDLE_BUILD_TIMEOUT_MS, type BundleBuildLeaseStore } from './bundle-build-leases.ts'
+
+export class BundleBuildError extends Error {
+  status: number
+  code: string
+  constructor(status: number, code: string) { super(code); this.status = status; this.code = code }
+}
+
+export interface BundleBuildInput {
+  repoId: number
+  commit: string
+  entries: string[]
+  directory: string
+  options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; typescript?: boolean; jsx?: boolean }
+}
+
+function path(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0 && value.length <= 1024 && !/[\\\p{Cc}]/u.test(value)
+    && value.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+}
+
+export function parseBundleBuild(value: unknown): BundleBuildInput {
+  const fail = (code = 'bad-request'): never => { throw new BundleBuildError(400, code) }
+  if (value == null || typeof value !== 'object' || Array.isArray(value)) return fail()
+  const { repoId, commit, entries, conditions } = value as Record<string, unknown>
+  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId) || repoId <= 0
+    || typeof commit !== 'string' || !/^[a-f\d]{40}$/u.test(commit)
+    || !Array.isArray(entries) || entries.length === 0 || entries.length > 100 || !entries.every(path)) return fail()
+  const selected = [...new Set(entries as string[])]
+  const scripts = selected.every(entry => /\.[mc]?[jt]s$/u.test(entry))
+  if (!scripts && !selected.every(entry => entry.endsWith('.sol'))) return fail('unsupported-entries')
+  const parts = posix.dirname(selected[0]!).split('/').filter(part => part !== '.')
+  for (const entry of selected) {
+    const parent = posix.dirname(entry).split('/')
+    while (parts.some((part, i) => parent[i] !== part)) parts.pop()
+  }
+  const options: BundleBuildInput['options'] = {}
+  if (scripts) {
+    if (conditions == null || typeof conditions !== 'object' || Array.isArray(conditions)) return fail('bad-conditions')
+    const { preset, conditions: names, platforms } = conditions as Record<string, unknown>
+    if (!['node', 'browser', 'metro'].includes(String(preset)) || !Array.isArray(names) || names.length > 16
+      || !names.every(name => typeof name === 'string' && name.length > 0 && name.length <= 64
+        && !/^\.|^\d+$|[\s,/\\\p{Cc}]/u.test(name) && !['default', 'import', 'require'].includes(name))) return fail('bad-conditions')
+    if (preset === 'metro') {
+      if (names.length !== 1 || names[0] !== 'react-native') return fail('metro-conditions')
+      if (!Array.isArray(platforms) || platforms.length === 0 || platforms.length > 2
+        || !platforms.every(platform => ['ios', 'android'].includes(platform))) return fail('bad-conditions')
+      Object.assign(options, { metro: true, platforms: [...new Set(platforms)] })
+    } else {
+      options.conditions = [...new Set(names)]
+      if (preset === 'browser') options.mainFields = ['browser', 'module', 'main']
+    }
+    options.typescript = true
+    options.jsx = true
+  }
+  return { repoId, commit, entries: selected, directory: parts.join('/'), options }
+}
+
+// Same portable name and 255-character limit as Stasis's githubBundleFile
+// (src/cmd/github-bundle.js), which is not a public package export.
+export function githubBundleFilename(github: string, directory: string, commit: string): string {
+  const portable = (value: string) => value.replaceAll(/[^\w.-]/gu, '_')
+  const repo = portable(github.replace('/', '-'))
+  const tail = `.${portable(commit.slice(0, 7))}.stasis.code.br`
+  if (!directory) return `${repo}${tail}`
+  const room = 255 - `${repo}.${tail}`.length
+  let dir = portable(directory.replaceAll('/', '-'))
+  if (dir.length > room) dir = `${dir.slice(0, room - 9)}_${createHash('sha256').update(directory).digest('hex').slice(0, 8)}`
+  return `${repo}.${dir}${tail}`
+}
+
+export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: string }
+export interface BuildRequest { input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[] }
+// An extra per-process ceiling; admission must also hold the shared DB lease.
+const active = new Set<string>()
+
+export async function withBundleBuildLease<T>(db: BundleBuildLeaseStore, userId: string, signal: AbortSignal,
+  work: (signal: AbortSignal) => Promise<T>): Promise<T> {
+  signal.throwIfAborted()
+  const owner = randomUUID(), started = performance.now(), timeout = new AbortController()
+  const expired = () => timeout.abort(new BundleBuildError(504, 'build-timeout'))
+  const timer = setTimeout(expired, BUNDLE_BUILD_TIMEOUT_MS)
+  const combined = AbortSignal.any([signal, timeout.signal])
+  let claimed = false
+  try {
+    claimed = await db.claimBundleBuildLease(userId, owner)
+    if (!claimed) throw new BundleBuildError(429, 'build-busy')
+    // Account for a slow/lost claim response or a suspended invocation before
+    // starting work. The three-minute budget starts before lease acquisition.
+    if (performance.now() - started >= BUNDLE_BUILD_TIMEOUT_MS) expired()
+    combined.throwIfAborted()
+    return await work(combined)
+  } catch (error) {
+    if (timeout.signal.aborted && !signal.aborted) throw timeout.signal.reason
+    throw error
+  } finally {
+    clearTimeout(timer)
+    // buildRepositoryBundle waits for worker termination before settling.
+    // Unknown claim/release outcomes expire safely without starting more work.
+    if (claimed) await db.releaseBundleBuildLease(owner)
+  }
+}
+
+// Parsing repositories and compressing bundles stays off the HTTP event loop.
+// Cap concurrent builds, terminate disconnected/timed-out work, and share no
+// credentials or mutable Stasis state between requests.
+export async function buildRepositoryBundle(userId: string, request: BuildRequest, signal: AbortSignal): Promise<BuiltBundle> {
+  if (active.has(userId) || active.size >= 2) throw new BundleBuildError(429, 'build-busy')
+  signal.throwIfAborted()
+  active.add(userId)
+  let worker: Worker | undefined
+  try {
+    worker = new Worker(new URL('./bundle-build-worker.js', import.meta.url), {
+      workerData: { ...request, type: 'managed-bundle-build' }, env: {}, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 512 },
+    })
+    const running = worker
+    return await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new BundleBuildError(504, 'build-timeout')), BUNDLE_BUILD_TIMEOUT_MS)
+      const abort = () => reject(new BundleBuildError(499, 'build-cancelled'))
+      signal.addEventListener('abort', abort, { once: true })
+      running.once('message', (message: BuiltBundle & { error?: string; status?: number }) => {
+        clearTimeout(timer)
+        signal.removeEventListener('abort', abort)
+        if (message.error) reject(new BundleBuildError(message.status ?? 422, message.error))
+        else resolve({ ...message, bytes: Buffer.from(message.bytes) })
+      })
+      running.once('error', () => reject(new BundleBuildError(422, 'build-failed')))
+      running.once('exit', () => {
+        clearTimeout(timer)
+        signal.removeEventListener('abort', abort)
+        reject(new BundleBuildError(422, 'build-failed'))
+      })
+    })
+  } finally {
+    try { await worker?.terminate() } finally { active.delete(userId) }
+  }
+}

package/server-managed/bundle-cache.ts

@@ -1,19 +1,17 @@
 // Metadata is cached as Brotli. Contents use the stored Brotli bytes directly:
 // unchanged Stasis uploads or sourcemaps compressed once at upload.
 import { Buffer } from 'node:buffer'
-import { mkdir, open, rename, rm, stat, writeFile } from 'node:fs/promises'
-import { join } from 'node:path'
-import { randomUUID } from 'node:crypto'
 import { brotliDecompress } from 'node:zlib'
 import { promisify } from 'node:util'
 import { BUNDLE_METADATA_VERSION, type BundleDetails, createBundleMetadata, createBundleSummary, parseBundleContents } from '../common/bundle-metadata.js'
 import { bundleReasons } from '../common/bundle-reasons.js'
-import { bundlePackageVersions } from '../common/bundle-sources.js'
+import { type BundleAdvisoryInventory, bundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
 import { decodeUtf8 } from '../common/utf8.js'
 import type { OpenedBlob } from './blob-store.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { encodeBrotli } from './brotli.ts'
 import type { ManagedBundle, ManagedDb } from './db.ts'
+import { CacheMissError } from './cache-storage.ts'
 import { SUMMARY_FILENAME, createBundleSummaryCache } from './bundle-summary-cache.ts'
 
 const decompress = promisify(brotliDecompress)
@@ -40,7 +38,7 @@ export interface BundleCacheStorage {
 }
 
 const filename = `v${BUNDLE_METADATA_VERSION}-metadata.json.br`
-const packagesFilename = 'v2-package-versions.json'
+const packagesFilename = 'v4-advisory-inventory.json'
 
 // All scopes share one bounded derivative. Never decode full bundle metadata
 // on advisory requests, including when selecting a reason. Persist null when
@@ -54,14 +52,18 @@ function encodePackageInventory(details: BundleDetails): Buffer {
     parts.push(part)
     return true
   }
-  function inventory(paths: Set<string> | null) {
-    if (!append('{')) return false
+  function entries(rows: unknown[]) {
+    if (!append('[')) return false
     let first = true
-    for (const [name, versions] of bundlePackageVersions(details, paths)) {
-      if (!append(`${first ? '' : ','}${JSON.stringify(name)}:${JSON.stringify([...versions].toSorted())}`)) return false
+    for (const row of rows) {
+      if (!append(`${first ? '' : ','}${JSON.stringify(row)}`)) return false
       first = false
     }
-    return append('}')
+    return append(']')
+  }
+  function inventory(paths: Set<string> | null) {
+    const { packages, skipped } = bundleAdvisoryInventory(details, paths)
+    return append('{"packages":') && entries(packages) && append(',"skipped":') && entries(skipped) && append('}')
   }
   append('{"all":')
   if (!inventory(null) || !append(',"reasons":{')) return Buffer.from('null')
@@ -115,6 +117,12 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
     pending.set(record.id, job)
     try { await job } finally { if (pending.get(record.id) === job) pending.delete(record.id) }
   }
+  async function openCached(record: BundleCacheRecord, file: string) {
+    try { return await storage.open(record.id, file) }
+    catch (error) { if (!(error instanceof CacheMissError)) throw error }
+    await ensure(record)
+    return storage.open(record.id, file)
+  }
   return {
     prebuild: ensure,
     summary: summaries.summary,
@@ -127,13 +135,11 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
         if (!stored) throw new Error('Bundle bytes unavailable')
         return stored
       }
-      await ensure(record)
-      return storage.open(record.id, filename)
+      return openCached(record, filename)
     },
-    async packageVersions(record: ManagedBundle, reason = ''): Promise<Record<string, string[]> | null | undefined> {
-      if (record.kind !== 'stasis') return {}
-      await ensure(record)
-      const cached = await storage.open(record.id, packagesFilename)
+    async advisoryInventory(record: ManagedBundle, reason = ''): Promise<BundleAdvisoryInventory | null | undefined> {
+      if (record.kind !== 'stasis') return { packages: [], skipped: [] }
+      const cached = await openCached(record, packagesFilename)
       try {
         if (cached.size != null && cached.size > MAX_PACKAGE_INVENTORY_BYTES) return null
         const chunks: Buffer[] = []
@@ -158,28 +164,3 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
   }
 }
 export type BundleCache = ReturnType<typeof createBundleCache>
-
-export function createDiskBundleCache(dir: string, db: ManagedDb, store: BundleStore): BundleCache {
-  function directory(id: string) {
-    if (!/^[a-f\d-]{36}$/iu.test(id)) throw new Error('Invalid bundle id')
-    return join(dir, id)
-  }
-  return createBundleCache({
-    async exists(id, file) {
-      try { await stat(join(directory(id), file)); return true }
-      catch (err) { if ((err as NodeJS.ErrnoException).code === 'ENOENT') return false; throw err }
-    },
-    async put(id, file, bytes) {
-      await mkdir(directory(id), { recursive: true })
-      const target = join(directory(id), file), temp = `${target}.${randomUUID()}.tmp`
-      try { await writeFile(temp, bytes); await rename(temp, target) }
-      finally { await rm(temp, { force: true }) }
-    },
-    async open(id, name) {
-      const file = await open(join(directory(id), name), 'r')
-      try { return { size: (await file.stat()).size, stream: file.createReadStream() } }
-      catch (err) { await file.close(); throw err }
-    },
-    async delete(id) { await rm(directory(id), { recursive: true, force: true }) },
-  }, db, store)
-}

package/server-managed/bundle-store.ts

@@ -1,11 +1,11 @@
 // Sourcemaps are stored once as Brotli. The DB retains the uploaded filename,
 // byte size and integrity so compression does not change report links/dedup.
 import type { Buffer } from 'node:buffer'
-import { type BlobStore, type OpenedBlob, createDiskBlobStore } from './blob-store.ts'
+import type { BlobStore, OpenedBlob } from './blob-store.ts'
 import { encodeBrotli } from './brotli.ts'
 
 export interface BundleStore {
-  put(id: string, bytes: Buffer, kind: string | null): Promise<void>
+  put(id: string, bytes: Buffer, kind: string | null): Promise<string | null>
   get(id: string, kind: string | null): Promise<Buffer | null>
   open(id: string, kind: string | null): Promise<OpenedBlob | null>
   delete(id: string): Promise<void>
@@ -15,14 +15,10 @@ export function createBundleStore(archives: BlobStore, sourcemaps: BlobStore): B
   const storage = (kind: string | null) => kind === 'sourcemap' ? sourcemaps : archives
   return {
     async put(id, bytes, kind) {
-      await storage(kind).put(id, kind === 'sourcemap' ? await encodeBrotli(bytes) : bytes)
+      return storage(kind).put(id, kind === 'sourcemap' ? await encodeBrotli(bytes) : bytes)
     },
     get: (id, kind) => storage(kind).get(id),
     open: (id, kind) => storage(kind).open(id),
     async delete(id) { await Promise.all([archives.delete(id), sourcemaps.delete(id)]) },
   }
 }
-
-export function createDiskBundleStore(dir: string): BundleStore {
-  return createBundleStore(createDiskBlobStore(dir), createDiskBlobStore(dir, '.map.br'))
-}

package/server-managed/bundle-summary-cache.ts

@@ -1,10 +1,11 @@
 import { Buffer } from 'node:buffer'
 import { setImmediate } from 'node:timers/promises'
-import { BUNDLE_METADATA_VERSION } from '../common/bundle-metadata.js'
+import { CacheMissError } from './cache-storage.ts'
 import { decodeUtf8 } from '../common/utf8.js'
 import type { BundleCacheRecord, BundleCacheStorage, BundleSummary } from './bundle-cache.ts'
 
-export const SUMMARY_FILENAME = `v${BUNDLE_METADATA_VERSION}-summary.json`
+// Origin metadata does not change these counts; retain the byte-sized v2 cache.
+export const SUMMARY_FILENAME = 'v2-summary.json'
 const RETRY_MS = 5 * 60_000
 const BACKFILL_LIMIT = 4
 type CachedSummary = BundleSummary | { retryAt: number }
@@ -30,19 +31,33 @@ async function readSummary(storage: BundleCacheStorage, id: string): Promise<Cac
 
 export function createBundleSummaryCache(storage: BundleCacheStorage, build: (record: BundleCacheRecord) => Promise<BundleSummary>, exists: (id: string) => Promise<unknown>) {
   const entries = new Map<string, { id: string; value: CachedSummary }>()
+  const reads = new Map<string, { id: string; job: Promise<CachedSummary | null> }>()
   const active = new Map<string, Promise<void>>()
   let pending: Promise<void> | null = null
   function remember(record: BundleCacheRecord, value: CachedSummary) {
-    if (entries.size >= 256) entries.delete(entries.keys().next().value!)
+    // A completed build supersedes any older storage read still in flight.
+    reads.delete(record.integrity)
+    // Summaries are tiny and immutable by integrity. Refuse overflow admission
+    // instead of evicting the next hit during a scan larger than the cache.
+    if (entries.size >= 4096 && !entries.has(record.integrity)) return
     entries.set(record.integrity, { id: record.id, value })
   }
-  async function read(record: BundleCacheRecord) {
+  function read(record: BundleCacheRecord): Promise<CachedSummary | null> {
     const known = entries.get(record.integrity)
-    if (known) return known.value
-    if (!await storage.exists(record.id, SUMMARY_FILENAME)) return null
-    const value = await readSummary(storage, record.id)
-    remember(record, value)
-    return value
+    if (known) return Promise.resolve(known.value)
+    const existing = reads.get(record.integrity)
+    if (existing) return existing.job
+    // Concurrent catalogs share the decoded summary, never the response stream.
+    // Only in-flight work is shared: misses and failures remain retryable.
+    const job: Promise<CachedSummary | null> = readSummary(storage, record.id).then(value => {
+      if (reads.get(record.integrity)?.job === job) remember(record, value)
+      return entries.get(record.integrity)?.value ?? value
+    }).catch(error => {
+      if (error instanceof CacheMissError) return null
+      throw error
+    }).finally(() => { if (reads.get(record.integrity)?.job === job) reads.delete(record.integrity) })
+    reads.set(record.integrity, { id: record.id, job })
+    return job
   }
   async function publish(record: BundleCacheRecord, value: CachedSummary) {
     if (!await exists(record.id)) return
@@ -92,6 +107,9 @@ export function createBundleSummaryCache(storage: BundleCacheStorage, build: (re
       // backfill elsewhere must not delay removing these bytes or responding.
       await active.get(id)
       for (const [hash, entry] of entries) if (entry.id === id) entries.delete(hash)
+      // Do not wait for remote reads during deletion. Their callers still own
+      // and drain them, but a late response must not repopulate this cache.
+      for (const [hash, entry] of reads) if (entry.id === id) reads.delete(hash)
     },
   }
 }

package/server-managed/bundle.ts

@@ -7,6 +7,8 @@
 // report auto-links to its bundle.
 import { createHash } from 'node:crypto'
 import type { Buffer } from 'node:buffer'
+import { StringDecoder } from 'node:string_decoder'
+import { createBrotliDecompress } from 'node:zlib'
 
 // `sha512-<base64>` identity for a bundle's bytes. MUST stay byte-identical to
 // the client's common/integrity.js (SHA-512 → standard base64 WITH padding) so
@@ -21,12 +23,75 @@ export function bundleIntegrity(bytes: Buffer): string {
 // `bundleKind`: sourcemap (.map) or stasis (stasis.code.br / .stasis.code.br).
 // null for anything else (stored anyway; the kind is informational).
 export function bundleKind(filename: string): 'sourcemap' | 'stasis' | null {
-  const lower = filename.toLowerCase()
+  // Browsers insert a duplicate-download counter before the final extension.
+  const lower = filename.toLowerCase().replace(/ \(\d+\)(?=\.[^.]*$)/u, '')
   if (lower.endsWith('.map')) return 'sourcemap'
   if (lower === 'stasis.code.br' || lower.endsWith('.stasis.code.br')) return 'stasis'
   return null
 }
 
+interface BundleRepo { github?: unknown; directory?: unknown }
+const HEADER_KEYS = new Set(['version', 'config', 'repo', 'package'])
+const MAX_HEADER_BYTES = 64 * 1024
+
+// Stasis writes origin metadata before entries, formats and source bodies.
+// undefined means another chunk is needed; null means the header has no repo.
+function headerRepo(text: string): BundleRepo | null | undefined {
+  let depth = 0, escaped = false, expectKey = false, quoted = false
+  let key = '', start = 0, valueStart = 0
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i]
+    if (quoted) {
+      if (escaped) { escaped = false; continue }
+      if (c === '\\') { escaped = true; continue }
+      if (c !== '"') continue
+      quoted = false
+      if (depth === 1 && expectKey) {
+        key = JSON.parse(text.slice(start, i + 1)) as string
+        if (!HEADER_KEYS.has(key)) return null
+        expectKey = false
+      }
+      continue
+    }
+    if (c === '"') { quoted = true; start = i; continue }
+    if (c === '{' || c === '[') {
+      if (depth === 0 && c !== '{') return null
+      depth++
+      if (depth === 1) expectKey = true
+    } else if (depth === 1 && (c === ',' || c === '}')) {
+      if (key === 'repo') {
+        const repo: unknown = JSON.parse(text.slice(valueStart, i))
+        return repo != null && typeof repo === 'object' && !Array.isArray(repo) ? repo as BundleRepo : null
+      }
+      if (c === '}') return null
+      expectKey = true
+    } else if (c === '}' || c === ']') depth--
+    else if (depth === 1 && c === ':') valueStart = i + 1
+    else if (depth === 0 && c?.trim()) return null
+  }
+  return undefined
+}
+
+// Decode only a bounded prefix, stopping as soon as repo is read or the
+// header ends. Unknown/malformed archives remain uploadable as opaque bytes.
+export async function bundleRepo(bytes: Buffer): Promise<BundleRepo | null> {
+  const stream = createBrotliDecompress({ chunkSize: 4096 })
+  const decoder = new StringDecoder('utf8')
+  let size = 0, text = ''
+  stream.end(bytes)
+  try {
+    for await (const chunk of stream) {
+      size += chunk.length
+      if (size > MAX_HEADER_BYTES) return null
+      text += decoder.write(chunk)
+      const repo = headerRepo(text)
+      if (repo !== undefined) return repo
+    }
+    return null
+  } catch { return null }
+  finally { stream.destroy() }
+}
+
 // Extract the bundle integrities a report declares (its top-level
 // `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
 export function reportBundleHashes(bytes: Buffer): string[] {

package/server-managed/cache-storage.ts

@@ -1,9 +1,10 @@
 import type { Buffer } from 'node:buffer'
-import { randomUUID } from 'node:crypto'
-import { mkdir, open, rename, rm, stat, writeFile } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
 import type { OpenedBlob } from './blob-store.ts'
 
+export class CacheMissError extends Error {
+  constructor() { super('Managed cache unavailable') }
+}
+
 // Keys are internal relative paths; delete removes a whole directory of variants.
 export interface CacheStorage {
   exists(key: string): Promise<boolean>
@@ -16,25 +17,3 @@ export function validateCacheKey(key: string): string {
   if (!key.split('/').every(part => /^[a-z0-9][a-z0-9.-]*$/iu.test(part))) throw new Error('Invalid cache key')
   return key
 }
-
-export function createDiskCacheStorage(dir: string): CacheStorage {
-  const path = (key: string) => join(dir, validateCacheKey(key))
-  return {
-    async exists(key) {
-      try { await stat(path(key)); return true }
-      catch (err) { if ((err as NodeJS.ErrnoException).code === 'ENOENT') return false; throw err }
-    },
-    async put(key, bytes) {
-      const target = path(key), temp = `${target}.${randomUUID()}.tmp`
-      await mkdir(dirname(target), { recursive: true })
-      try { await writeFile(temp, bytes); await rename(temp, target) }
-      finally { await rm(temp, { force: true }) }
-    },
-    async open(key) {
-      const file = await open(path(key), 'r')
-      try { return { size: (await file.stat()).size, stream: file.createReadStream() } }
-      catch (err) { await file.close(); throw err }
-    },
-    async delete(prefix) { await rm(path(prefix), { recursive: true, force: true }) },
-  }
-}

package/server-managed/cli.js

@@ -9,5 +9,13 @@
 // Imported here rather than run as the process entry, so index.ts's
 // `import.meta.main` auto-start gate stays off and we call `start()` ourselves.
 import '../strip-types-loader.js'
-const { start } = await import('./index.ts')
-await start()
+const command = process.argv[2]
+if (command === '--storage-encryption-status') {
+  const { storageCommand } = await import('./storage-command.ts')
+  await storageCommand(process.argv[3])
+} else if (command) {
+  throw new Error(`Unknown command: ${command}`)
+} else {
+  const { start } = await import('./index.ts')
+  await start()
+}

package/server-managed/config.ts

@@ -4,6 +4,7 @@
 import { env } from 'node:process'
 import { databaseUrls } from '../server-common/database-config.ts'
 import { MAX_UPLOAD_BYTES } from './uploads.ts'
+import { parseStorageKey } from '../server-common/storage-crypto.ts'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
 
@@ -13,6 +14,10 @@ export interface ManagedConfig {
   dbPath: string
   neonUrl?: string | null
   blobToken?: string | null
+  storageEncryptionKey?: string | null
+  storageEncryptionMigrate?: boolean
+  storageEncryptionMigrateMaxMs?: number
+  vercelPreview?: boolean
   serverless?: boolean
   debug: boolean
   allowShare: boolean
@@ -88,6 +93,10 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
   const serverless = env['VERCEL'] === '1'
   const neonUrl = databaseUrls({ combined }).managed
   const blobToken = env['BLOB_READ_WRITE_TOKEN'] || null
+  const storageEncryptionKey = env['MANAGED_STORAGE_ENCRYPTION_KEY'] || null
+  parseStorageKey(storageEncryptionKey)
+  const storageEncryptionMigrate = env['MANAGED_STORAGE_ENCRYPTION_MIGRATE'] === '1'
+  if (storageEncryptionMigrate && !storageEncryptionKey) fail('MANAGED_STORAGE_ENCRYPTION_MIGRATE requires MANAGED_STORAGE_ENCRYPTION_KEY.')
   if (serverless && !neonUrl) fail('Vercel managed mode requires DATABASE_URL or MANAGED_DATABASE_URL.')
   if (neonUrl && !blobToken) fail('Managed Neon mode requires BLOB_READ_WRITE_TOKEN.')
   const host = env['HOST'] ?? '127.0.0.1'
@@ -105,7 +114,9 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     fail(`SESSION_COOKIE_NAME=${sessionCookieName} uses the __Host- prefix but the callback is not https. Use a non-prefixed name for loopback http dev.`)
   }
   return {
-    neonUrl, blobToken, serverless,
+    neonUrl, blobToken, serverless, storageEncryptionKey, storageEncryptionMigrate,
+    storageEncryptionMigrateMaxMs: intEnv('MANAGED_STORAGE_ENCRYPTION_MIGRATE_MAX_MS', 150_000, 1, serverless ? 240_000 : 3_600_000),
+    vercelPreview: env['VERCEL_ENV'] === 'preview',
     port: intEnv('PORT', 8765, 0, 65535),
     host,
     // DB_PATH belongs to e2e in a combined process. Keep the two stores apart.

package/server-managed/content-access.ts

@@ -6,7 +6,7 @@ type Content = { repoId: number | null; repoDirectory?: string }
 // Read grants for each request: neither the manager role nor a cached page
 // confers repository access. Bundles have repository scope; reports also have
 // a directory scope. Unassigned content is only available to administrators.
-export async function contentAccess(db: ManagedDb, user: StoredUser) {
+export async function contentAccess(db: Pick<ManagedDb, 'listRepoScopesForUser'>, user: StoredUser) {
   const scopes = user.role === 'admin' ? null : await db.listRepoScopesForUser(user.id)
   const bundle = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId)
   const report = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId