@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.28

package/server-managed/db-neon.ts

@@ -1,12 +1,15 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
+import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA } from './activity.ts'
-import { ManagedCommitError, type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -20,11 +23,38 @@ export interface PgConnection {
   release(): Promise<void>
 }
 export type PgConnect = () => Promise<PgConnection>
-// All managed writers cooperate on this transaction-scoped lock. Reads use a
-// consistent snapshot without taking it. Also protects concurrent cold starts.
+// Content/access mutations cooperate on this transaction-scoped lock. Reads,
+// presence updates, and maintenance leases do not take it. Also fences migrations.
 const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
 
+async function currentSchema(db: PgConnection): Promise<boolean> {
+  const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
+  if (!exists) return false
+  const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
+  return Array.from({ length: 14 }, (_, i) => i + 1).every(version => versions.has(version))
+}
+
+async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 12')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_selected_repo ADD COLUMN IF NOT EXISTS cached_default_branch TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (12)')
+}
+
+async function migrateBundleBuildLeases(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 13')).rows.length > 0) return
+  await db.query(postgresSchema(BUNDLE_BUILD_LEASE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (13)')
+}
+
+async function migrateGithubMetadata(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
+  await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
+  await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
+  await db.query('INSERT INTO managed_schema_version VALUES (14) ON CONFLICT DO NOTHING')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
+  if (await currentSchema(db)) return
   await db.query('BEGIN')
   try {
     await db.query(LOCK)
@@ -57,9 +87,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(WORKSPACE_SHARE_SCHEMA))
       await db.query('INSERT INTO managed_schema_version VALUES (4)')
     }
-    await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
-    await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
-    await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
+    await migrateGithubMetadata(db)
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 5')).rows.length === 0) {
       await db.query(`ALTER TABLE managed_workspace_share ADD COLUMN IF NOT EXISTS dependencies INTEGER NOT NULL DEFAULT 0,
         ADD COLUMN IF NOT EXISTS security INTEGER NOT NULL DEFAULT 0`)
@@ -83,6 +111,21 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query('CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id)')
       await db.query('INSERT INTO managed_schema_version VALUES (8)')
     }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 9')).rows.length === 0) {
+      await db.query(postgresSchema(STORAGE_SCHEMA))
+      for (const table of ['managed_report', 'managed_bundle']) {
+        await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+      }
+      await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
+      await db.query('INSERT INTO managed_schema_version VALUES (9)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 10')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (10)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
+    }
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -107,10 +150,53 @@ async function createUploadTrigger(db: PgConnection, type: string, createTrigger
   }
 }
 
+function requestConnections(connect: PgConnect) {
+  const requests = new AsyncLocalStorage<{ connection?: PgConnection; queue: Promise<unknown>; ended: boolean }>()
+  async function withConnection<T>(work: (db: PgConnection) => Promise<T>): Promise<T> {
+    const request = requests.getStore()
+    if (!request || request.ended) {
+      const connection = await connect()
+      let result: T
+      try { result = await work(connection) }
+      catch (error) { await connection.release().catch(() => {}); throw error }
+      await connection.release()
+      return result
+    }
+    // Serialize transactions on the leased connection, never interleave BEGINs
+    // from concurrent Blob/catalog tasks. Remote Blob reads remain concurrent.
+    const result = request.queue.then(async () => {
+      const connection = request.connection ??= await connect()
+      try { return await work(connection) }
+      catch (error) {
+        delete request.connection
+        await connection.release().catch(() => {})
+        throw error
+      }
+    })
+    request.queue = result.catch(() => {})
+    return result
+  }
+  async function withRequest<T>(work: () => Promise<T>): Promise<T> {
+    if (requests.getStore()) return work()
+    const request: { connection?: PgConnection; queue: Promise<unknown>; ended: boolean } = { queue: Promise.resolve(), ended: false }
+    let failed = false
+    try { return await requests.run(request, work) }
+    catch (error) { failed = true; throw error }
+    finally {
+      request.ended = true
+      await request.queue
+      if (failed) await request.connection?.release().catch(() => {})
+      else await request.connection?.release()
+    }
+  }
+  return { withConnection, withRequest }
+}
+
 // Exposed for parity tests against real PostgreSQL semantics via PGlite.
-export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}): Promise<ManagedDb> {
+export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
   const initial = await connect()
   try { await initialize(initial) } finally { await initial.release() }
+  const { withConnection, withRequest } = requestConnections(connect)
   const context = new AsyncLocalStorage<PgConnection>()
   let closed = false
   const driver: ManagedSqlDriver = {
@@ -141,43 +227,51 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
         run: async (...args) => ({ changes: (await query(args)).rowCount ?? 0 }),
       }
     },
-    async scope(write, work) {
+    async scope(write, work, { lock = write, statement = false } = {}) {
       if (closed) throw new Error('Managed database is closed')
-      const db = await connect()
-      let commitAttempted = false
-      let result
-      try {
-        await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
-        if (write) await db.query(LOCK)
-        result = await context.run(db, work)
-        commitAttempted = true
-        await db.query('COMMIT')
-      } catch (err) {
-        await db.query('ROLLBACK').catch(() => {})
-        await db.release().catch(() => {})
-        if (write && commitAttempted) throw new ManagedCommitError(err)
-        throw err
+      let committed = false
+      try { return await withConnection(async db => {
+        if (statement) return context.run(db, work)
+        let commitAttempted = false
+        try {
+          await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
+          if (lock) await db.query(LOCK)
+          const result = await context.run(db, work)
+          commitAttempted = true
+          await db.query('COMMIT')
+          committed = true
+          return result
+        } catch (err) {
+          await db.query('ROLLBACK').catch(() => {})
+          if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
+          throw err
+        }
+      }) } catch (error) {
+        if (write && committed) throw new Error('Managed commit outcome is uncertain', { cause: error })
+        throw error
       }
-      try { await db.release() }
-      catch (err) { if (write) throw new ManagedCommitError(err); throw err }
-      return result
     },
     close() { closed = true },
   }
-  return scopeManagedMethods(createManagedMethods(driver, options), driver)
+  const methods = scopeManagedMethods(createManagedMethods(driver, options), driver)
+  if (reuseConnections) methods.withRequest = withRequest
+  return methods
 }
 
 export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}): Promise<ManagedDb> {
-  // Reuse the e2e optional-driver boundary. Each operation closes its socket
-  // before returning; no open connection has to survive a frozen invocation.
+  // Reuse the e2e optional-driver boundary. Requests lease one connection and
+  // close it before returning; no socket must survive a frozen invocation.
   const { Client, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
-    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query'] }
+    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query']; on?(event: 'error', listener: (error: Error) => void): void }
     neonConfig: { webSocketConstructor: typeof WebSocket }
   }
   neonConfig.webSocketConstructor = WebSocket
   return openPostgresManagedDb(async () => {
     const client = new Client(url)
+    // A remote disconnect between operations must reject the next query, not
+    // become an unhandled EventEmitter error while the request is reading Blob.
+    client.on?.('error', () => {})
     try { await client.connect() } catch (err) { await client.end().catch(() => {}); throw err }
     return { query: (sql, params) => client.query(sql, params), release: () => client.end() }
-  }, options)
+  }, options, true)
 }

package/server-managed/db-schema.ts

@@ -45,6 +45,8 @@ CREATE TABLE IF NOT EXISTS managed_selected_repo (
   is_private      INTEGER NOT NULL,
   installation_id INTEGER,
   default_branch  TEXT NOT NULL,
+  -- Live browser hint; independent of the default discovered at selection.
+  cached_default_branch TEXT,
   html_url        TEXT NOT NULL,
   added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   added_at        INTEGER NOT NULL,

package/server-managed/db.ts

@@ -6,9 +6,12 @@ import { migrateSlugs } from './slugs.ts'
 import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
+import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { createSqliteDriver, scopeManagedMethods } from './sql.ts'
@@ -65,7 +68,13 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     db.exec('PRAGMA synchronous = FULL;')
     db.exec('PRAGMA foreign_keys = ON;')
     migrateManagedTableNames(db)
-    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA)
+    ensureColumn(db, 'managed_selected_repo', 'cached_default_branch', 'TEXT')
+    for (const table of ['managed_report', 'managed_bundle']) {
+      ensureColumn(db, table, 'data_key', 'TEXT')
+      ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    }
+    ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
     ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
     ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
     // Existing public links must opt in too; never preserve an implicit grant.
@@ -100,6 +109,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')
     initCommentMethods(db)
     initActivityMethods(db)
+    db.exec(revisionSchema())
   } catch (err) {
     try { db.close() } catch {}
     throw err

package/server-managed/github-app.ts

@@ -4,8 +4,9 @@
 // permissions. Discovery itself is read-only and skips archived repositories.
 import { Buffer } from 'node:buffer'
 import { createHash, createSign } from 'node:crypto'
+import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
-import { GithubApiError, throwGithubResponseError } from './github-errors.ts'
+import { GithubApiError, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
 
 export { GithubApiError } from './github-errors.ts'
 
@@ -124,10 +125,9 @@ export function publicRepositoryName(raw: unknown): string | null {
 // Public additions must be readable by the server without the acting user's
 // credentials. Require explicit public visibility and use GitHub's canonical
 // metadata, never client-supplied ids, installation ids, or branches.
-export async function fetchPublicRepository(fullName: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<ConnectedRepo> {
+export async function fetchPublicRepository(fullName: string): Promise<ConnectedRepo> {
   if (publicRepositoryName(fullName) !== fullName) throw new GithubApiError(400, 'bad-repository')
-  const path = fullName.split('/').map(encodeURIComponent).join('/')
-  const repo = parseRepo(await githubJson(`${GITHUB_API}/repos/${path}`, null, fetchImpl), null)
+  const repo = parseRepo(await upstreamGithub(() => createClient({ token: null, userAgent: USER_AGENT }).getRepo({ repo: fullName })), null)
   if (repo == null || repo.private || repo.visibility !== 'public') throw new GithubApiError(409, 'repo-not-public')
   if (publicRepositoryName(repo.fullName) !== repo.fullName || repo.fullName.toLowerCase() !== fullName.toLowerCase()) throw new GithubApiError(502, 'github-malformed')
   return { ...repo, htmlUrl: `https://github.com/${repo.fullName}` }
@@ -138,17 +138,12 @@ export async function fetchPublicRepository(fullName: string, fetchImpl: typeof
 // List the authenticated user's repositories (GET /user/repos), paginated until
 // a short page, deduped + sorted. With an identity-only token this returns the
 // user's PUBLIC repos. READ-ONLY.
-export async function listUserRepos(accessToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<ConnectedRepo[]> {
+export async function listUserRepos(accessToken: string): Promise<ConnectedRepo[]> {
   const byName = new Map<string, ConnectedRepo>()
-  for (let page = 1; ; page++) {
-    const url = `${GITHUB_API}/user/repos?per_page=${PER_PAGE}&page=${page}&sort=full_name`
-    const body = await githubJson(url, accessToken, fetchImpl)
-    if (!Array.isArray(body)) break
-    for (const r of body) {
-      const repo = parseRepo(r, null)
-      if (repo != null) byName.set(repo.fullName, repo)
-    }
-    if (body.length < PER_PAGE) break
+  const body = await upstreamGithub(() => createClient({ token: accessToken, userAgent: USER_AGENT }).listUserRepos())
+  for (const r of body) {
+    const repo = parseRepo(r, null)
+    if (repo != null) byName.set(repo.fullName, repo)
   }
   return [...byName.values()].toSorted((a, b) => a.fullName.localeCompare(b.fullName))
 }
@@ -373,7 +368,7 @@ export async function collectRepos(config: ManagedConfig, userToken: string | nu
   const lists: ConnectedRepo[][] = []
   if (userToken != null) {
     try {
-      lists.push(await listUserRepos(userToken, fetchImpl))
+      lists.push(await listUserRepos(userToken))
     } catch (err) {
       if (err instanceof GithubApiError && err.status === 401) tokenMissing = true
       else console.warn('managed: public repo list failed:', err)

package/server-managed/github-errors.ts

@@ -1,3 +1,5 @@
+import { HttpError } from '@preventive/upstream/github.js'
+
 // A failure carrying the HTTP status the router should surface. 401 passes
 // through so the user-token path can map it to "log in again".
 export class GithubApiError extends Error {
@@ -26,3 +28,22 @@ export async function throwGithubResponseError(res: Response): Promise<never> {
   if (res.status === 404) throw new GithubApiError(404, 'github-not-found')
   throw new GithubApiError(502, `github-status-${res.status}`)
 }
+
+export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
+  try { return await request() } catch (error) {
+    if (error instanceof HttpError) {
+      // The upstream error includes GitHub's response text. Retain managed
+      // status handling, including rate limits, without exposing that text.
+      if (error.status === 401) throw new GithubApiError(401, 'github-unauthorized')
+      if (error.status === 404) throw new GithubApiError(404, 'github-not-found')
+      if (error.status === 429 || (error.status === 403 && /rate limit|abuse detection/iu.test(error.message))) {
+        throw new GithubApiError(429, 'github-rate-limited', 60)
+      }
+      throw new GithubApiError(502, `github-status-${error.status}`)
+    }
+    if (error instanceof Error && (error.name === 'AssertionError' || error.cause instanceof SyntaxError)) {
+      throw new GithubApiError(502, 'github-malformed')
+    }
+    throw new GithubApiError(502, 'github-unreachable')
+  }
+}

package/server-managed/github-issues.ts

@@ -4,7 +4,7 @@ import type { BlobStore } from './blob-store.ts'
 import type { ManagedIssue } from './managed-issues.ts'
 import { randomToken } from './crypto.ts'
 import { githubIssueClosedReason } from '../common/github-pr.ts'
-import { reportEntries, reportRepoGithub } from '../report/index.js'
+import { reportEntries, reportRepoGithub } from '@preventive/report'
 import { newIssueLabels } from '../common/github-issue-labels.js'
 import { appJwt, githubAppConfigured, installUrl, publicRepositoryName } from './github-app.ts'
 import { ISSUE_LOGIN_PATH, issueUserToken } from './github-issue-oauth.ts'

package/server-managed/github-metadata.ts

@@ -12,15 +12,24 @@ export interface GithubMetadata {
   fetchedAt: number
   attemptedAt: number | null
 }
+export interface GithubRepositoryVisibility {
+  repoId: number
+  github: string
+  public: boolean
+  checkedAt: number
+}
 export interface GithubMetadataStore {
   listGithubMetadata(keys: readonly string[]): Promise<GithubMetadata[]>
   setGithubMetadata(entries: readonly Omit<GithubMetadata, 'attemptedAt'>[]): Promise<void>
   recordGithubMetadataAttempts(keys: readonly string[], attemptedAt: number): Promise<void>
+  listGithubRepositoryVisibility(repoIds: readonly number[]): Promise<GithubRepositoryVisibility[]>
+  setGithubRepositoryVisibility(entries: readonly GithubRepositoryVisibility[]): Promise<void>
 }
 
 // Successful GitHub reads are shared and retained without eviction. The stable
 // repository ID in the key survives renames, but is never an access grant.
-// Callers must authorize the current user -> team -> repo before every read.
+// Callers must verify current user -> team -> repo grants plus either recently
+// verified public visibility or the viewer's live GitHub access with their token.
 export const GITHUB_STATE_REASON_COLUMN = "TEXT CHECK (state_reason IN ('completed', 'not_planned', 'duplicate', 'unknown'))"
 export const GITHUB_METADATA_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_github_metadata (
@@ -32,6 +41,12 @@ CREATE TABLE IF NOT EXISTS managed_github_metadata (
   fetched_at INTEGER NOT NULL,
   attempted_at INTEGER
 ) STRICT;
+CREATE TABLE IF NOT EXISTS managed_github_repository_visibility (
+  repo_id INTEGER PRIMARY KEY,
+  github TEXT NOT NULL,
+  is_public INTEGER NOT NULL CHECK (is_public IN (0, 1)),
+  checked_at INTEGER NOT NULL
+) STRICT;
 `
 
 export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
@@ -49,6 +64,16 @@ export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
   // The monotonic guard preserves a newer attempt recorded by another reader.
   const attempt = db.prepare(`UPDATE managed_github_metadata SET attempted_at = ?
     WHERE cache_key IN (SELECT value FROM json_each(?)) AND (attempted_at IS NULL OR attempted_at < ?)`)
+  const visibility = db.prepare(`SELECT repo_id AS repoId, github, is_public AS public, checked_at AS checkedAt
+    FROM managed_github_repository_visibility WHERE repo_id IN (SELECT CAST(value AS BIGINT) FROM json_each(?))`)
+  const setVisibility = db.prepare(`INSERT INTO managed_github_repository_visibility (repo_id, github, is_public, checked_at)
+    SELECT CAST(json_extract(e.value, '$.repoId') AS BIGINT), json_extract(e.value, '$.github'),
+      CAST(json_extract(e.value, '$.public') AS BIGINT), CAST(json_extract(e.value, '$.checkedAt') AS BIGINT)
+    FROM json_each(:contexts) e WHERE 1 = 1
+    ON CONFLICT (repo_id) DO UPDATE SET github = excluded.github, is_public = excluded.is_public, checked_at = excluded.checked_at
+    WHERE managed_github_repository_visibility.checked_at < excluded.checked_at
+      OR (managed_github_repository_visibility.checked_at = excluded.checked_at
+        AND (managed_github_repository_visibility.is_public = 1 OR excluded.is_public = 0))`)
   return {
     async listGithubMetadata(keys) {
       if (keys.length === 0) return []
@@ -61,5 +86,13 @@ export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
     async recordGithubMetadataAttempts(keys, attemptedAt) {
       if (keys.length > 0) await attempt.run(attemptedAt, JSON.stringify(keys), attemptedAt)
     },
+    async listGithubRepositoryVisibility(repoIds) {
+      if (repoIds.length === 0) return []
+      const rows = await visibility.all(JSON.stringify(repoIds)) as (Omit<GithubRepositoryVisibility, 'public'> & { public: number })[]
+      return rows.map(row => ({ ...row, public: row.public === 1 }))
+    },
+    async setGithubRepositoryVisibility(entries) {
+      if (entries.length > 0) await setVisibility.run({ contexts: JSON.stringify(entries.map(entry => ({ ...entry, public: entry.public ? 1 : 0 }))) })
+    },
   }
 }