@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.28

package/server-managed/index.ts

@@ -1,5 +1,6 @@
 // Managed HTTP app and standalone boot. The combined launcher mounts this
 // same app on e2e's listener; storage, routing and cleanup stay here.
+import { randomUUID } from 'node:crypto'
 import { type Server, createServer } from 'node:http'
 import { fileURLToPath } from 'node:url'
 import { createOriginGate } from '../server-common/origin.ts'
@@ -42,22 +43,37 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
   })
   const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, originGate, serveStatic,
-    ...('uploadStore' in storage ? { uploadStore: storage.uploadStore } : {}),
+    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}),
     isShuttingDown, track,
   })
 
   let cleanup: Promise<void> | undefined
   let nextCleanupAt = 0
-  function reap(): Promise<void> {
+  const maintenance = new AbortController()
+  function reap(automatic = false): Promise<void> {
     if (cleanup) return cleanup
+    if (isShuttingDown()) return Promise.resolve()
     const startedAt = Date.now()
     nextCleanupAt = startedAt + REAP_INTERVAL_MS
     let sessions = 0, uploads = 0
-    cleanup = runReapers({
-      sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
-      ...('reapUploads' in storage ? { uploads: async () => { uploads = await storage.reapUploads() } } : {}),
-    }).then(() => {
+    cleanup = (async () => {
+      const owner = automatic && config.serverless ? randomUUID() : null
+      if (owner && !await db.claimMaintenanceLease(owner, startedAt, startedAt + Math.max(300_000, (config.storageEncryptionMigrateMaxMs ?? 0) + 60_000), config.storageEncryptionMigrate)) return false
+      let succeeded = false
+      try {
+        await runReapers({
+          sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
+          ...(storage.reapUploads ? { uploads: async () => { uploads = await storage.reapUploads!(maintenance.signal) } } : {}),
+          ...('reapStorage' in storage ? { storage: () => storage.reapStorage(maintenance.signal) } : {}),
+        })
+        succeeded = true
+        return true
+      } finally {
+        if (owner) await db.finishMaintenanceLease(owner, Date.now() + (succeeded ? REAP_INTERVAL_MS : REAP_RETRY_MS))
+      }
+    })().then(ran => {
       nextCleanupAt = Date.now() + REAP_INTERVAL_MS
+      if (!ran) return
       return console.info(`managed-reaper: removed ${sessions} expired session(s), ${uploads} stale upload part(s) in ${Date.now() - startedAt}ms`)
     }, err => {
       nextCleanupAt = Date.now() + REAP_RETRY_MS
@@ -68,14 +84,14 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
   }
   function automaticReap(): Promise<void> {
     if (isShuttingDown() || cleanup || Date.now() < nextCleanupAt) return Promise.resolve()
-    return reap().catch(err => console.warn('managed-reaper: cleanup failed:', err))
+    return reap(true).catch(err => console.warn('managed-reaper: cleanup failed:', err))
   }
   async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
-    const maintenance = automaticReap()
+    const pendingMaintenance = automaticReap()
     // Send the normal response without waiting for storage housekeeping, but
     // keep the invocation alive until both finish. No detached serverless work.
     try { await routeRequest(req, res) }
-    finally { await maintenance }
+    finally { await pendingMaintenance }
   }
   const gcTimer = config.serverless ? null : setInterval(() => {
     void automaticReap()
@@ -84,6 +100,7 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
 
   function stop(): void {
     shuttingDown = true
+    maintenance.abort()
     if (gcTimer) clearInterval(gcTimer)
   }
 

package/server-managed/management-catalog.ts

@@ -0,0 +1,45 @@
+import { roleAtLeast } from '../common/managed/roles.ts'
+import { type RepoScope, contentAccess } from './content-access.ts'
+import type { AdminBundle, AdminReport, ManagedDb } from './db-methods.ts'
+import { ManagedMutationError } from './management.ts'
+
+type CatalogAccess = { repos: { repoId: number; fullName: string }[]; repoScopes: RepoScope[] | null }
+export interface ManagementCatalogStore {
+  getReportCatalog(sessionId: string, now: number): Promise<CatalogAccess & { reports: (AdminReport & { canChangeRepo: boolean })[] }>
+  getBundleCatalog(sessionId: string, now: number): Promise<CatalogAccess & { bundles: (AdminBundle & { canChangeRepo: boolean })[] }>
+}
+type CatalogDb = Pick<ManagedDb, 'getReportAccessSnapshot' | 'listRepoScopesForUser' | 'listSelectedRepos'
+  | 'listReports' | 'listBundles' | 'listReadableBundleIds'>
+
+// The outer store method owns one read snapshot. Use raw methods here so the
+// session, grants, rows and action flags agree without per-row transactions.
+export function managementCatalogMethods(db: CatalogDb): ManagementCatalogStore {
+  async function access(sessionId: string, now: number) {
+    const snapshot = await db.getReportAccessSnapshot(sessionId, now, [])
+    if (!snapshot) throw new ManagedMutationError(401, 'unauthenticated')
+    if (!roleAtLeast(snapshot.user.role, 'manage')) throw new ManagedMutationError(403, 'forbidden')
+    const scope = await contentAccess(db, snapshot.user)
+    const repos = (await db.listSelectedRepos()).filter(scope.bundle).map(({ repoId, fullName }) => ({ repoId, fullName }))
+    return { userId: snapshot.user.role === 'admin' ? undefined : snapshot.user.id, scope, repos }
+  }
+  return {
+    async getReportCatalog(sessionId, now) {
+      const { userId, scope, repos } = await access(sessionId, now)
+      const reports = await db.listReports(userId)
+      const linked = reports.flatMap(report => report.bundleId ? [report.bundleId] : [])
+      const readable = userId === undefined ? new Set(linked) : new Set(await db.listReadableBundleIds(userId, linked))
+      return { repos, repoScopes: scope.scopes, reports: reports.map(report => ({ ...report,
+        canChangeRepo: report.repoId === null || scope.report(report),
+        bundleId: report.bundleId && readable.has(report.bundleId) ? report.bundleId : null,
+        bundleFilename: report.bundleId && readable.has(report.bundleId) ? report.bundleFilename : null,
+      })) }
+    },
+    async getBundleCatalog(sessionId, now) {
+      const { userId, scope, repos } = await access(sessionId, now)
+      const bundles = await db.listBundles(userId)
+      return { repos, repoScopes: scope.scopes, bundles: bundles.map(bundle => ({ ...bundle,
+        canChangeRepo: bundle.repoId === null || scope.report(bundle),
+      })) }
+    },
+  }
+}

package/server-managed/object-storage-disk.ts

@@ -0,0 +1,144 @@
+import { randomUUID } from 'node:crypto'
+import { lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { type ObjectPage, type RawObjectStorage, objectPath } from './object-storage.ts'
+
+function missing(err: unknown): boolean { return (err as NodeJS.ErrnoException).code === 'ENOENT' }
+function version(info: { dev: number; ino: number; size: number; mtimeMs: number; ctimeMs: number }): string {
+  return JSON.stringify([info.dev, info.ino, info.size, info.mtimeMs, info.ctimeMs])
+}
+
+async function syncDirectory(dir: string): Promise<void> {
+  try {
+    const directory = await open(dir, 'r')
+    try { await directory.sync() } finally { await directory.close() }
+  } catch (err) {
+    // Windows and some mounted filesystems cannot open/fsync directories.
+    // Preserve real I/O failures; file fsync remains mandatory on every write.
+    if (!['EINVAL', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EISDIR', 'EBADF', 'EPERM'].includes((err as NodeJS.ErrnoException).code ?? '')) throw err
+  }
+}
+
+// Keyset pagination survives concurrent file creation/deletion. A final sweep
+// catches objects inserted before the cursor during migration.
+async function listFiles(dir: string, prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage> {
+  const objects: ObjectPage['objects'] = []
+  async function visit(key: string): Promise<void> {
+    signal?.throwIfAborted()
+    let entries
+    try {
+      if (!(await lstat(join(dir, key))).isDirectory()) {
+        console.warn('managed-storage: skipping unsupported directory', JSON.stringify(key))
+        return
+      }
+      entries = await readdir(join(dir, key), { withFileTypes: true })
+    }
+    catch (err) { if (missing(err)) return; throw err }
+    const order = (entry: typeof entries[number]) => `${entry.name}${entry.isDirectory() ? '/' : ''}`
+    entries.sort((a, b) => order(a) < order(b) ? -1 : order(a) > order(b) ? 1 : 0)
+    for (const entry of entries) {
+      signal?.throwIfAborted()
+      const child = `${key}${entry.name}`
+      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
+        console.warn('managed-storage: skipping unsupported entry', JSON.stringify(child))
+        continue
+      }
+      try { objectPath(child) }
+      catch { console.warn('managed-storage: skipping invalid entry', JSON.stringify(child)); continue }
+      if (entry.isDirectory()) {
+        const folder = `${child}/`
+        if (cursor && folder < cursor && !cursor.startsWith(folder)) continue
+        await visit(folder)
+        if (objects.length > limit) return
+      }
+      else if (entry.isFile() && (!cursor || child > cursor)) {
+        try { objects.push({ key: objectPath(child), modifiedAt: (await stat(join(dir, child))).mtimeMs }) }
+        catch (err) { if (!missing(err)) throw err }
+        if (objects.length > limit) return
+      }
+    }
+    // Another migration worker can observe an unlink before its writer has
+    // synced the directory. Persist those observed removals before an empty
+    // inventory can mark the shared migration complete.
+    try { await syncDirectory(join(dir, key)) } catch (err) { if (!missing(err)) throw err }
+  }
+  if (!prefix.endsWith('/') || !Number.isInteger(limit) || limit < 1) throw new Error('Invalid storage page')
+  objectPath(`${prefix}validate`)
+  await visit(prefix)
+  return { objects: objects.slice(0, limit), cursor: objects.length > limit ? objects[limit - 1]!.key : null }
+}
+
+export function createDiskObjectStorage(dir: string): RawObjectStorage {
+  const path = (key: string) => join(dir, objectPath(key))
+  return {
+    async head(key, signal) {
+      signal?.throwIfAborted()
+      try {
+        const info = await stat(path(key))
+        return { size: info.size, version: version(info), modifiedAt: info.mtimeMs }
+      } catch (err) { if (missing(err)) return null; throw err }
+    },
+    async open(key, signal) {
+      signal?.throwIfAborted()
+      let file
+      try { file = await open(path(key), 'r') }
+      catch (err) { if (missing(err)) return null; throw err }
+      try {
+        const info = await file.stat()
+        return { size: info.size, version: version(info), modifiedAt: info.mtimeMs,
+          stream: file.createReadStream(signal ? { signal } : {}) }
+      } catch (err) { await file.close(); throw err }
+    },
+    async put(key, bytes, signal, expected) {
+      const target = path(key)
+      // Temp-file + rename makes replacement atomic to readers. Concurrent
+      // migrations use the same persisted data key and immutable plaintext.
+      const temp = `${target}.${randomUUID()}.tmp`
+      await mkdir(dirname(target), { recursive: true })
+      const file = await open(temp, 'wx', 0o600)
+      try {
+        await file.writeFile(bytes, signal ? { signal } : {})
+        await file.sync(); await file.close()
+        signal?.throwIfAborted()
+        if (expected !== undefined) {
+          try { if (version(await stat(target)) !== expected) return false }
+          catch (err) { if (missing(err)) return false; throw err }
+        }
+        await rename(temp, target)
+        await syncDirectory(dirname(target))
+        return true
+      } finally { await file.close(); await rm(temp, { force: true }) }
+    },
+    async delete(key, expected, signal) {
+      signal?.throwIfAborted()
+      try {
+        if (expected !== undefined && version(await stat(path(key))) !== expected) return false
+        await rm(path(key), { force: true })
+        // Persist plaintext removal before migration checkpoints completion.
+        // Otherwise a crash could restore the directory entry after SQL has
+        // durably disabled further plaintext inventory sweeps.
+        await syncDirectory(dirname(path(key)))
+        return true
+      } catch (err) { if (missing(err)) return true; throw err }
+    },
+    async sync(key, signal) { signal?.throwIfAborted(); await syncDirectory(dirname(path(key))) },
+    async prune(prefix, signal) {
+      if (!prefix.endsWith('/')) throw new Error('Invalid storage prefix')
+      objectPath(`${prefix}validate`)
+      async function visit(folder: string): Promise<void> {
+        signal?.throwIfAborted()
+        let entries
+        try {
+          if (!(await lstat(folder)).isDirectory()) return
+          entries = await readdir(folder, { withFileTypes: true })
+        }
+        catch (err) { if (missing(err)) return; throw err }
+        for (const entry of entries) if (entry.isDirectory()) await visit(join(folder, entry.name))
+        try { await rmdir(folder); await syncDirectory(dirname(folder)) }
+        catch (err) { if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes((err as NodeJS.ErrnoException).code ?? '')) throw err }
+      }
+      await visit(join(dir, prefix))
+    },
+    list: (prefix, cursor, limit, signal) => listFiles(dir, prefix, cursor, limit, signal),
+  }
+}

package/server-managed/object-storage-vercel.ts

@@ -0,0 +1,60 @@
+import { Readable } from 'node:stream'
+import { Buffer } from 'node:buffer'
+import { type VercelBlobSdk, isNotFound, loadVercelBlobSdk } from '../server-common/vercel-blob.ts'
+import { type RawObjectStorage, objectPath } from './object-storage.ts'
+
+export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk): Promise<RawObjectStorage> {
+  const blobs = sdk ?? await loadVercelBlobSdk()
+  const path = (key: string) => `.managed/${objectPath(key)}`
+  return {
+    async head(key, signal) {
+      try {
+        const meta = await blobs.head(path(key), { token, ...(signal ? { abortSignal: signal } : {}) })
+        if (!meta.etag) throw new Error('Missing object version')
+        return { size: meta.size, version: meta.etag, modifiedAt: new Date(meta.uploadedAt ?? Date.now()).getTime() }
+      } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
+    },
+    async open(key, signal) {
+      try {
+        const result = await blobs.get(path(key), { token, access: 'private', useCache: false, ...(signal ? { abortSignal: signal } : {}) })
+        if (!result) return null
+        if (result.statusCode !== 200 || !result.stream || !result.blob.etag) {
+          await result.stream?.cancel()
+          throw new Error('Unexpected blob response or missing object version')
+        }
+        return { size: result.blob.size === 0 ? null : result.blob.size, version: result.blob.etag,
+          modifiedAt: new Date(result.blob.uploadedAt ?? Date.now()).getTime(),
+          stream: Readable.fromWeb(result.stream as Parameters<typeof Readable.fromWeb>[0], signal ? { signal } : {}) }
+      } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
+    },
+    async put(key, bytes, signal, expected, sizeHint) {
+      const multipart = (sizeHint ?? (Buffer.isBuffer(bytes) ? bytes.length : Infinity)) >= 5 * 1024 * 1024
+      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: true,
+        ...(expected ? { ifMatch: expected } : {}), multipart, contentType: 'application/octet-stream', cacheControlMaxAge: 60, ...(signal ? { abortSignal: signal } : {}) })
+        return true
+      } catch (err) {
+        if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        throw err
+      }
+    },
+    async delete(key, version, signal) {
+      signal?.throwIfAborted()
+      try { await blobs.del(path(key), { token, ...(version ? { ifMatch: version } : {}), ...(signal ? { abortSignal: signal } : {}) }); return true }
+      catch (err) {
+        if (isNotFound(err, blobs)) return true
+        if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        throw err
+      }
+    },
+    async list(prefix, cursor, limit, signal) {
+      signal?.throwIfAborted()
+      if (!prefix.endsWith('/') || !Number.isInteger(limit) || limit < 1) throw new Error('Invalid storage page')
+      objectPath(`${prefix}validate`)
+      const page = await blobs.list({ prefix: `.managed/${prefix}`, token, limit, ...(cursor ? { cursor } : {}), ...(signal ? { abortSignal: signal } : {}) })
+      if (page.hasMore && (!page.cursor || page.cursor === cursor)) throw new Error('Invalid blob pagination')
+      return { objects: page.blobs.filter(blob => blob.pathname.startsWith(`.managed/${prefix}`)).map(blob => ({ key: blob.pathname.slice('.managed/'.length),
+        modifiedAt: new Date(blob.uploadedAt ?? Date.now()).getTime() })),
+      cursor: page.hasMore ? page.cursor! : null }
+    },
+  }
+}

package/server-managed/object-storage.ts

@@ -0,0 +1,71 @@
+import type { Buffer } from 'node:buffer'
+import type { Readable } from 'node:stream'
+import type { OpenedBlob } from './blob-store.ts'
+import { validateCacheKey } from './cache-storage.ts'
+
+export const ENCRYPTED_CACHE_PREFIX = 'cache-encrypted-v1/'
+const STORAGE_PREFIXES = ['reports/', 'bundles/', 'avatars/', 'uploads/', 'cache/', ENCRYPTED_CACHE_PREFIX]
+export interface RawObject extends OpenedBlob { version: string; modifiedAt: number }
+type ObjectMetadata = Omit<RawObject, 'stream'>
+interface ListedObject { key: string; modifiedAt: number }
+export interface ObjectPage { objects: ListedObject[]; cursor: string | null }
+export interface RawObjectStorage {
+  open(key: string, signal?: AbortSignal): Promise<RawObject | null>
+  head(key: string, signal?: AbortSignal): Promise<ObjectMetadata | null>
+  prune?(prefix: string, signal?: AbortSignal): Promise<void>
+  // Persist an observed disk replacement before its SQL migration checkpoint.
+  sync?(key: string, signal?: AbortSignal): Promise<void>
+  // A plaintext size hint selects multipart uploads without buffering streams.
+  put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string, sizeHint?: number): Promise<boolean>
+  // Return false if the original version changed; do not delete its replacement.
+  delete(key: string, version?: string, signal?: AbortSignal): Promise<boolean>
+  list(prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage>
+}
+export interface ObjectStorage {
+  open(key: string): Promise<OpenedBlob | null>
+  get(key: string): Promise<Buffer | null>
+  exists(key: string): Promise<boolean>
+  put(key: string, bytes: Buffer): Promise<string | null>
+  delete(key: string): Promise<void>
+  deletePrefix(prefix: string): Promise<void>
+}
+
+export function isBlobId(value: string): boolean {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u.test(value)
+}
+
+export function objectPath(key: string): string {
+  validateCacheKey(key)
+  if (!STORAGE_PREFIXES.some(prefix => key.startsWith(prefix))) throw new Error('Invalid managed storage namespace')
+  return key
+}
+
+// Hash verification and migration may consume a stream before it can be used.
+// Reopen only the same object version, closing any concurrent replacement.
+export async function openObjectVersion(raw: RawObjectStorage, key: string, version: string, signal?: AbortSignal): Promise<RawObject | null> {
+  const current = await raw.open(key, signal)
+  if (current?.version === version) return current
+  current?.stream.destroy()
+  return null
+}
+
+export async function deleteObjects(raw: RawObjectStorage, prefix: string, signal: AbortSignal, before?: number): Promise<number> {
+  const eligible = (modifiedAt: number) => before === undefined || modifiedAt < before
+  // Finish listing before deleting: provider cursors may be offset-based.
+  const cursors = new Set<string>(), keys = new Set<string>()
+  let cursor: string | null = null
+  do {
+    const page = await raw.list(prefix, cursor, 100, signal)
+    for (const object of page.objects) if (eligible(object.modifiedAt)) keys.add(object.key)
+    cursor = page.cursor
+    if (cursor !== null && cursors.has(cursor)) throw new Error('Invalid blob pagination')
+    if (cursor !== null) cursors.add(cursor)
+  } while (cursor !== null)
+  let removed = 0
+  for (const key of keys) {
+    const stored = await raw.head(key, signal)
+    // Ignore stale listings and preserve concurrent replacements.
+    if (stored && eligible(stored.modifiedAt) && await raw.delete(key, stored.version, signal)) removed++
+  }
+  return removed
+}

package/server-managed/public-workspace.ts

@@ -5,13 +5,13 @@ import type { ManagedHttpDeps } from './http.ts'
 import type { ManagedBundle } from './db.ts'
 import type { OpenedBlob } from './blob-store.ts'
 import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
-import { sendJson } from './http-response.ts'
+import { sendJson, writeResponse } from './http-response.ts'
 import { hashToken } from './crypto.ts'
-import { TeamReportsError, loadTeamReports, teamReportVisibility } from './team-reports.ts'
+import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, teamReportVisibility } from './team-reports.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
-import { NPM_ADVISORIES_TIMEOUT_MS, fetchNpmAdvisories } from '../server-common/npm-advisories.ts'
+import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
 import { serveTeamFeed } from './team-feed.ts'
 
 function json(res: ServerResponse, status: number, body: unknown): void {
@@ -28,7 +28,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const method = req.method ?? 'GET'
   if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
-  const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed)$/u.exec(url.pathname)
+  const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed|annotations)$/u.exec(url.pathname)
   const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
   const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
@@ -72,10 +72,16 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
     if (teamRoute[1] !== snapshot.teamId) { json(res, 404, { error: 'no-team' }); return }
     if (teamRoute[2] === 'feed') {
       if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
-      await serveTeamFeed(res, deps, snapshot, recheck); return
+      await serveTeamFeed(res, deps, snapshot, recheck, { readState: () => deps.db.getWorkspaceShareFeedState(tokenHash) }); return
+    }
+    if (teamRoute[2] === 'annotations') {
+      await send(await loadTeamAnnotations(deps.db, deps.reportStore, snapshot, url.searchParams.get('reportId'))); return
     }
     if (teamRoute[2] === 'shared') { await sendTeam(); return }
-    await send({ reports: await loadTeamReports(deps.db, deps.reportStore, snapshot) }); return
+    const body = await loadTeamReportsResponse(deps.db, deps.reportStore, snapshot)
+    await recheck()
+    res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
+    writeResponse(res, body); return
   }
   if (reportRoute) {
     const id = reportRoute[1]!, part = reportRoute[2]!
@@ -103,16 +109,16 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
   if (!deps.bundleCache) { json(res, 503, { error: 'unavailable' }); return }
   if (part === 'advisories') {
     if (bundle.kind !== 'stasis') { json(res, 422, { error: 'unsupported-bundle' }); return }
-    const packages = await deps.bundleCache.packageVersions(bundle, url.searchParams.get('reason') ?? '')
+    const inventory = await deps.bundleCache.advisoryInventory(bundle, url.searchParams.get('reason') ?? '')
     await recheck()
-    if (packages === null) { json(res, 413, { error: 'payload-too-large' }); return }
-    if (packages === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
-    const body = Buffer.from(JSON.stringify(packages))
-    if (body.length > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
-    const result = Object.keys(packages).length === 0 ? { status: 200, body: {} }
-      : await fetchNpmAdvisories(body, AbortSignal.timeout(NPM_ADVISORIES_TIMEOUT_MS), deps.config.debug)
+    if (inventory === null) { json(res, 413, { error: 'payload-too-large' }); return }
+    if (inventory === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
+    if (Buffer.byteLength(JSON.stringify(inventory)) > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
+    const result = await fetchBundleAdvisories(inventory.packages, AbortSignal.timeout(ADVISORIES_TIMEOUT_MS), {
+      debug: deps.config.debug, repoAdvisories: url.searchParams.get('repoAdvisories') === 'true',
+    })
     await recheck()
-    json(res, result.status, result.status === 200 ? { packages, advisories: result.body } : result.body); return
+    json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return
   }
   let cached
   try { cached = await deps.bundleCache.open(bundle, part as 'metadata' | 'contents') }

package/server-managed/report-migration.ts

@@ -4,7 +4,7 @@
 import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import type { DatabaseSync } from 'node:sqlite'
-import { reportRepoGithub } from '../report/index.js'
+import { reportRepoGithub } from '@preventive/report'
 import { readManagedReport } from '../common/managed/report-content.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 

package/server-managed/report-sources.ts

@@ -5,9 +5,10 @@ import { promisify } from 'node:util'
 import { gzip } from 'node:zlib'
 import { bundleSourcesAsMap } from '../common/bundle-sources.js'
 import { bundleSourceImports } from '../common/bundle-source-links.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
 import { loadManagedFindings, managedFindingSourcePaths } from '../common/managed/report-content.ts'
 import { type ViewerPermissions, filterReportContent } from '../common/managed/report-filter.ts'
-import type { CacheStorage } from './cache-storage.ts'
+import { CacheMissError, type CacheStorage } from './cache-storage.ts'
 import { readBundleDetails } from './bundle-cache.ts'
 import type { BlobStore } from './blob-store.ts'
 import type { BundleStore } from './bundle-store.ts'
@@ -28,7 +29,7 @@ function formatDirectory(bundleId: string, sha256: string, name: string) {
 }
 function sourceCacheFilename(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
   const key = createHash('sha256').update(JSON.stringify([
-    'finding-access-v5', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
+    'finding-access-v6', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
   ])).digest('hex')
   return `${formatDirectory(bundle.id, report.sha256, report.filename)}/${key}.json.gz`
 }
@@ -60,6 +61,14 @@ function selectSources(sourcePaths: Set<string>, sources: Map<string, string>) {
   return { files: [...files], paths: [...paths] }
 }
 
+function encodeSources(integrity: string, details: BundleDetails, selection: ReturnType<typeof selectSources>) {
+  const sources = new Map(selection.files)
+  const imports = [...bundleSourceImports(details, sources)].map(([parent, targets]) => [parent, [...targets]])
+  const bundle = details.kind === 'stasis' ? details.bundle as { formats: Map<string, string> } : null
+  const formats = [...(bundle?.formats ?? [])].filter(([file]) => sources.has(file))
+  return compress(Buffer.from(JSON.stringify({ integrity, ...selection, imports, formats })), { level: 6 })
+}
+
 // Immutable report hashes share a derivative across duplicate uploads. Bundle
 // identity and visibility are part of the key: a broader viewer's sources must
 // never populate a restricted response. Group derivatives by hash and filename
@@ -89,8 +98,7 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
     const details = await readBundleDetails(bundle, bundles)
     if (!details) return false
     const selection = selectSources(sourcePaths, bundleSourcesAsMap(details))
-    const imports = [...bundleSourceImports(details, new Map(selection.files))].map(([parent, targets]) => [parent, [...targets]])
-    const body = await compress(Buffer.from(JSON.stringify({ integrity: bundle.integrity, ...selection, imports })), { level: 6 })
+    const body = await encodeSources(bundle.integrity, details, selection)
     // A duplicate with the same hash AND format can use these parsed bytes.
     // Another format must not keep a deleted variant's late build alive.
     if (!(await referenced(report, bundle))) return false
@@ -128,6 +136,8 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
     async open(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, sourcePaths?: Set<string>) {
       const repo = { github: (await db.listAllRepos()).find(entry => entry.repoId === report.repoId)?.fullName ?? null }
       const target = sourceCacheFilename(report, bundle, permissions, repo, sourcePaths)
+      try { return { ...await storage.open(target), repo } }
+      catch (error) { if (!(error instanceof CacheMissError)) throw error }
       if (!(await ensure(target, report, bundle, permissions, repo, sourcePaths))) return null
       const opened = await storage.open(target)
       return { ...opened, repo }

package/server-managed/repository-browser.ts

@@ -2,6 +2,7 @@ import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
 import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
+import { readSolidityEntryPoints } from './solidity-entry-points.ts'
 
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
@@ -96,6 +97,9 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
   const defaultBranch = typeof current.default_branch === 'string' ? current.default_branch : ''
   return {
     recheckAccess: () => checkAccess(true),
+    // Server-only credential, selected by the same live visibility/permission
+    // gate as directory browsing. Never included in an HTTP response.
+    readToken: () => token,
     async refs() {
       // Suggestions are bounded; the input also accepts any branch or tag name.
       const results = await Promise.all(['branches', 'tags'].map(async kind => {
@@ -126,7 +130,10 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
         && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
       const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
-      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}) }
+      const solidity = await readSolidityEntryPoints(path, data, read)
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
+        ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
+      }
     },
   }
 }

package/server-managed/repository-discovery.ts

@@ -65,7 +65,7 @@ export class RepositoryDiscovery {
       // Cache the two sources separately so failed installation discovery is
       // retried without caching a degraded combined list for another minute.
       const [userRepos, installedRepos] = await Promise.all([
-        this.read(key, () => listUserRepos(token, this.fetchImpl)),
+        this.read(key, () => listUserRepos(token)),
         installed().catch((err: unknown) => {
           console.warn('managed: installed repo deduplication failed:', err)
           return []

package/server-managed/revisions.ts

@@ -0,0 +1,35 @@
+// Internal invalidation counters. Never expose these global values to clients:
+// feeds still publish only the existing user/visibility-scoped revisions.
+const catalogTables = ['managed_team', 'managed_team_user', 'managed_team_repo', 'managed_report', 'managed_bundle', 'managed_selected_repo']
+const annotationTables = ['managed_finding_triage', 'managed_finding_triage_event', 'managed_finding_comment']
+export function revisionSchema(postgres = false): string {
+  let sql = `CREATE TABLE IF NOT EXISTS managed_maintenance_lease (
+    id INTEGER PRIMARY KEY, owner TEXT NOT NULL, expires_at INTEGER NOT NULL
+  ); CREATE TABLE IF NOT EXISTS managed_change_revision (
+    id INTEGER PRIMARY KEY, catalog INTEGER NOT NULL, annotations INTEGER NOT NULL
+  ); INSERT INTO managed_change_revision VALUES (1, 0, 0) ON CONFLICT(id) DO NOTHING;`
+  for (const [column, tables] of [['catalog', catalogTables], ['annotations', annotationTables]] as const) {
+    const update = `UPDATE managed_change_revision SET ${column} = ${column} + 1 WHERE id = 1;`
+    if (postgres) {
+      sql += `CREATE OR REPLACE FUNCTION managed_${column}_changed() RETURNS trigger LANGUAGE plpgsql AS $$
+        BEGIN IF EXISTS (SELECT 1 FROM managed_revision_rows) THEN ${update} END IF; RETURN NULL; END $$;`
+    }
+    for (const table of tables) {
+      if (postgres) {
+        sql += `DROP TRIGGER IF EXISTS ${table}_revision ON ${table};`
+        for (const event of ['INSERT', 'UPDATE', 'DELETE']) {
+          sql += `DROP TRIGGER IF EXISTS ${table}_revision_${event} ON ${table};
+            CREATE TRIGGER ${table}_revision_${event} AFTER ${event} ON ${table}
+            REFERENCING ${event === 'DELETE' ? 'OLD' : 'NEW'} TABLE AS managed_revision_rows
+            FOR EACH STATEMENT EXECUTE FUNCTION managed_${column}_changed();`
+        }
+      } else {
+        for (const event of ['INSERT', 'UPDATE', 'DELETE']) {
+          sql += `CREATE TRIGGER IF NOT EXISTS ${table}_revision_${event}
+            AFTER ${event} ON ${table} BEGIN ${update} END;`
+        }
+      }
+    }
+  }
+  return sql
+}