@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.28

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.26",
+  "version": "1.0.0-alpha.28",
   "description": "Client & relay server for triaging of automated reports",
-  "license": "MIT",
+  "license": "MIT OR Apache-2.0",
   "author": {
     "name": "Nikita Skovoroda",
     "email": "chalkerx@gmail.com",
@@ -30,7 +30,6 @@
   },
   "exports": {
     "./reap": "./api/reap.ts",
-    "./report": "./report/index.js",
     "./server": "./server.ts",
     "./server-e2e": "./server-e2e/index.ts",
     "./strip-types-loader": "./strip-types-loader.js",
@@ -42,6 +41,8 @@
     "triage-managed-server": "server-managed/cli.js"
   },
   "files": [
+    "LICENSE-APACHE",
+    "LICENSE-MIT",
     "api/reap.ts",
     "cli.js",
     "server.ts",
@@ -89,9 +90,13 @@
     "server-managed/activity.ts",
     "server-managed/avatar-store.ts",
     "server-managed/blob-store.ts",
-    "server-managed/blob-vercel.ts",
     "server-managed/brotli.ts",
+    "server-managed/bundle-advisories.ts",
+    "server-managed/bundle-advisory-inventory.ts",
     "server-managed/bundle-cache.ts",
+    "server-managed/bundle-build.ts",
+    "server-managed/bundle-build-leases.ts",
+    "server-managed/bundle-build-worker.js",
     "server-managed/bundle-catalog.ts",
     "server-managed/bundle-store.ts",
     "server-managed/bundle-summary-cache.ts",
@@ -120,6 +125,10 @@
     "server-managed/import-triage.ts",
     "server-managed/managed-issues.ts",
     "server-managed/management.ts",
+    "server-managed/management-catalog.ts",
+    "server-managed/object-storage.ts",
+    "server-managed/object-storage-disk.ts",
+    "server-managed/object-storage-vercel.ts",
     "server-managed/index.ts",
     "server-managed/package-entry-points.ts",
     "server-managed/public-workspace.ts",
@@ -128,15 +137,23 @@
     "server-managed/report-query.ts",
     "server-managed/report-response.ts",
     "server-managed/report-sources.ts",
+    "server-managed/revisions.ts",
     "server-managed/repository-browser.ts",
     "server-managed/repository-discovery.ts",
     "server-managed/repository-policy.ts",
     "server-managed/session.ts",
     "server-managed/slugs.ts",
+    "server-managed/solidity-entry-points.ts",
     "server-managed/sql-postgres.ts",
     "server-managed/sql.ts",
     "server-managed/static.ts",
     "server-managed/storage.ts",
+    "server-managed/storage-command.ts",
+    "server-managed/storage-db.ts",
+    "server-managed/storage-encryption.ts",
+    "server-managed/storage-maintenance.ts",
+    "server-managed/storage-payload.ts",
+    "server-managed/storage-stores.ts",
     "server-managed/team-catalog.ts",
     "server-managed/team-feed.ts",
     "server-managed/team-reports.ts",
@@ -150,30 +167,9 @@
     "server-common/origin.ts",
     "server-common/standalone.ts",
     "server-common/storage-log.ts",
+    "server-common/storage-crypto.ts",
     "server-common/vercel-blob.ts",
     "server-common/scan-config.ts",
-    "report/index.js",
-    "report/src/finding-id.js",
-    "report/src/finding.js",
-    "report/src/severity.js",
-    "report/src/security.js",
-    "report/src/labels.js",
-    "report/src/md-structure.js",
-    "report/src/md-text.js",
-    "report/src/meta.js",
-    "report/src/parse-codex.js",
-    "report/src/parse-deepsec.js",
-    "report/src/parse-deepview-fields.js",
-    "report/src/parse-deepview-md.js",
-    "report/src/parse-md-id.js",
-    "report/src/parse-md.js",
-    "report/src/parse-piolium-id.js",
-    "report/src/parse-piolium-rows.js",
-    "report/src/parse-piolium-tokens.js",
-    "report/src/parse-piolium.js",
-    "report/src/utf8.js",
-    "report/src/write-md-finding.js",
-    "report/src/write-md.js",
     "common/bundle-metadata.d.ts",
     "common/bundle-metadata.js",
     "common/bundle-reasons.d.ts",
@@ -228,7 +224,7 @@
   ],
   "scripts": {
     "lint": "node --run lint:js && node --run lint:css && node --run lint:ts",
-    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./report/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./api/",
+    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./api/",
     "lint:css": "stylelint 'ui/**/*.css'",
     "lint:ts": "tsc --noEmit",
     "prepack": "node --run build",
@@ -238,12 +234,13 @@
     "server-e2e": "node server-e2e/index.ts",
     "server-managed": "node server-managed/index.ts",
     "server-managed-test": "node server-managed/test-server.ts",
-    "test": "node --js-base-64 --import=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js ./report/tests/*.test.js"
+    "test": "node --js-base-64 --import=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.5",
     "@noble/ciphers": "^2.3.0",
     "@preventive/diff": "^1.0.0",
+    "@preventive/lockfile": "1.0.0-alpha.5",
     "@preventive/terminal": "2.0.0-beta.1",
     "@rray/frontend": "^1.0.0",
     "@stylistic/stylelint-plugin": "^5.3.0",
@@ -260,7 +257,10 @@
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@exodus/stasis-core": "^1.0.0-beta.4",
+    "@exodus/stasis": "1.0.0-beta.5",
+    "@exodus/stasis-core": "1.0.0-beta.5",
+    "@preventive/report": "1.0.0-alpha.4",
+    "@preventive/upstream": "1.0.0-alpha.4",
     "ws": "^8.20.1"
   },
   "peerDependencies": {

package/server-common/storage-crypto.ts

@@ -0,0 +1,182 @@
+// Storage envelope v1: header, then 64 KiB plaintext chunks with full AEAD tags.
+// The nonce layout follows age's STREAM construction (counter || final flag).
+// Every write derives a new key, including rewrites of the same logical object.
+import { Buffer } from 'node:buffer'
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from 'node:crypto'
+import { Readable } from 'node:stream'
+
+export const STORAGE_MAGIC = Buffer.from('DeepView.storage')
+const VERSION = 1
+export const STORAGE_CHUNK_BYTES = 65_536
+export const STORAGE_HEADER_BYTES = 57
+const TAG_BYTES = 16
+const UNKNOWN_SIZE = 0xffff_ffff_ffff_ffffn
+
+export interface StorageKey { bytes: Buffer; id: string }
+
+export function parseStorageKey(value: string | null | undefined): StorageKey | null {
+  if (value == null || value === '') return null
+  const bytes = Buffer.from(value, 'base64')
+  if (bytes.length !== 32 || bytes.toString('base64') !== value) {
+    throw new Error('MANAGED_STORAGE_ENCRYPTION_KEY must be canonical base64 encoding of 32 random bytes')
+  }
+  const id = createHash('sha256').update('deepview.storage.key.v1\0').update(bytes).digest('hex').slice(0, 32)
+  return { bytes, id }
+}
+
+// Re-chunk without accumulating a file, regardless of the input's read sizes.
+async function* chunks(source: AsyncIterable<Uint8Array>, size: number): AsyncGenerator<Buffer> {
+  let length = 0, pending: Buffer[] = []
+  for await (const value of source) {
+    const input = Buffer.from(value.buffer, value.byteOffset, value.byteLength)
+    for (let offset = 0; offset < input.length;) {
+      const n = Math.min(size - length, input.length - offset)
+      pending.push(input.subarray(offset, offset + n)); length += n; offset += n
+      if (length === size) { yield Buffer.concat(pending, length); pending = []; length = 0 }
+    }
+  }
+  if (length) yield Buffer.concat(pending, length)
+}
+
+async function* frames(source: AsyncIterable<Uint8Array>, size: number) {
+  const iterator = chunks(source, size)[Symbol.asyncIterator]()
+  try {
+    let current = await iterator.next()
+    if (current.done) { yield { bytes: Buffer.alloc(0), last: true }; return }
+    while (!current.done) {
+      const next = await iterator.next()
+      yield { bytes: current.value, last: next.done === true }
+      current = next
+    }
+  } finally { await iterator.return(undefined) }
+}
+
+function nonce(index: number, last: boolean): Buffer {
+  if (!Number.isSafeInteger(index) || index < 0 || index > 0xffff_ffff) throw new Error('Storage object has too many chunks')
+  const value = Buffer.alloc(12)
+  value.writeUInt32BE(index, 7)
+  value[11] = last ? 1 : 0
+  return value
+}
+
+function objectKey(key: Uint8Array, header: Buffer, identity: string): Buffer {
+  return Buffer.from(hkdfSync('sha256', key, header.subarray(17, 49),
+    Buffer.from(JSON.stringify(['deepview.storage.v1', identity])), 32))
+}
+
+function makeHeader(size: number | null): Buffer {
+  if (size !== null && (!Number.isSafeInteger(size) || size < 0)) throw new Error('Invalid storage size')
+  const header = Buffer.alloc(STORAGE_HEADER_BYTES)
+  STORAGE_MAGIC.copy(header); header[16] = VERSION
+  randomBytes(32).copy(header, 17)
+  header.writeBigUInt64BE(size === null ? UNKNOWN_SIZE : BigInt(size), 49)
+  return header
+}
+
+export function encryptStorageStream(source: Readable, key: Uint8Array, identity: string, size: number | null): Readable {
+  async function* encrypt() {
+    const header = makeHeader(size)
+    const derived = objectKey(key, header, identity)
+    let index = 0, length = 0
+    try {
+      yield header
+      for await (const { bytes, last } of frames(source, STORAGE_CHUNK_BYTES)) {
+        length += bytes.length
+        if (last && size !== null && length !== size) throw new Error('Storage size changed while encrypting')
+        const cipher = createCipheriv('chacha20-poly1305', derived, nonce(index++, last), { authTagLength: TAG_BYTES })
+        cipher.setAAD(header)
+        yield Buffer.concat([cipher.update(bytes), cipher.final(), cipher.getAuthTag()])
+      }
+    } finally { derived.fill(0); source.destroy() }
+  }
+  const stream = Readable.from(encrypt(), { objectMode: false })
+  stream.once('close', () => source.destroy())
+  return stream
+}
+
+// Read just the envelope and authenticate the first frame before returning.
+// In particular, never trust a corrupted size or release update() output
+// before final() authenticates the complete chunk.
+export async function decryptStorageStream(source: Readable, key: Uint8Array, identity: string) {
+  const iterator = source[Symbol.asyncIterator]()
+  let done = false
+  let peek: Buffer = Buffer.alloc(0), remainder: Buffer = Buffer.alloc(0)
+  async function read(size: number): Promise<Buffer> {
+    const parts: Buffer[] = peek.length > 0 ? [peek] : []
+    let length = peek.length
+    peek = Buffer.alloc(0)
+    while (length < size) {
+      if (remainder.length === 0 && !done) {
+        const next = await iterator.next(); done = next.done === true
+        remainder = done ? Buffer.alloc(0) : next.value
+      }
+      if (remainder.length === 0 && done) break
+      const n = Math.min(size - length, remainder.length)
+      parts.push(remainder.subarray(0, n)); remainder = remainder.subarray(n); length += n
+    }
+    return Buffer.concat(parts, length)
+  }
+  let derived: Buffer | undefined
+  try {
+    const header = await read(STORAGE_HEADER_BYTES)
+    if (header.length !== STORAGE_HEADER_BYTES || !header.subarray(0, 16).equals(STORAGE_MAGIC) || header[16] !== VERSION) {
+      throw new Error('Invalid encrypted storage envelope')
+    }
+    const rawSize = header.readBigUInt64BE(49)
+    if (rawSize !== UNKNOWN_SIZE && rawSize > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error('Invalid encrypted storage size')
+    const size = rawSize === UNKNOWN_SIZE ? null : Number(rawSize)
+    derived = objectKey(key, header, identity)
+    const derivedKey = derived
+    let index = 0, length = 0
+    const nextFrame = async () => {
+      const bytes = await read(STORAGE_CHUNK_BYTES + TAG_BYTES)
+      // Peek beyond the frame: EOF authenticates the final flag, including
+      // exact chunk boundaries. Keep the byte for the next read.
+      peek = await read(1)
+      const last = peek.length === 0
+      if (bytes.length < TAG_BYTES || (index > 0 && bytes.length === TAG_BYTES)) throw new Error('Truncated encrypted storage object')
+      const decipher = createDecipheriv('chacha20-poly1305', derivedKey, nonce(index++, last), { authTagLength: TAG_BYTES })
+      decipher.setAAD(header); decipher.setAuthTag(bytes.subarray(-TAG_BYTES))
+      const plain = Buffer.concat([decipher.update(bytes.subarray(0, -TAG_BYTES)), decipher.final()])
+      length += plain.length
+      if (size !== null && (length > size || (last && length !== size))) throw new Error('Encrypted storage size mismatch')
+      return { plain, last }
+    }
+    const first = await nextFrame()
+    const decrypt = async function* () {
+      try {
+        yield first.plain
+        let last = first.last
+        while (!last) { const frame = await nextFrame(); last = frame.last; yield frame.plain }
+      } finally { derivedKey.fill(0); await iterator.return?.(); source.destroy() }
+    }
+    const stream = Readable.from(decrypt(), { objectMode: false })
+    stream.once('close', () => { derivedKey.fill(0); source.destroy() })
+    return { size, stream }
+  } catch (err) { derived?.fill(0); source.destroy(); throw err }
+}
+
+// Small SQL values (data keys, OAuth tokens and the installation sentinel).
+// Fresh salt derives a one-use wrapping key, so the nonce can be all zeroes.
+// The version and master-key ID are authenticated along with the row/field.
+export function wrapStorageValue(key: StorageKey, identity: string, value: Uint8Array): string {
+  const header = Buffer.concat([Buffer.from([1]), Buffer.from(key.id, 'hex'), randomBytes(32)])
+  const derived = Buffer.from(hkdfSync('sha256', key.bytes, header.subarray(17), 'deepview.wrap.v1', 32))
+  try {
+    const cipher = createCipheriv('chacha20-poly1305', derived, Buffer.alloc(12), { authTagLength: TAG_BYTES })
+    cipher.setAAD(Buffer.concat([header, Buffer.from(identity)]))
+    return Buffer.concat([header, cipher.update(value), cipher.final(), cipher.getAuthTag()]).toString('base64')
+  } finally { derived.fill(0) }
+}
+
+export function unwrapStorageValue(key: StorageKey, identity: string, value: string): Buffer {
+  const bytes = Buffer.from(value, 'base64'), header = bytes.subarray(0, 49)
+  if (bytes.length < 65 || bytes.toString('base64') !== value || header[0] !== 1
+    || header.subarray(1, 17).toString('hex') !== key.id) throw new Error('Invalid wrapped storage value or encryption key')
+  const derived = Buffer.from(hkdfSync('sha256', key.bytes, header.subarray(17), 'deepview.wrap.v1', 32))
+  try {
+    const decipher = createDecipheriv('chacha20-poly1305', derived, Buffer.alloc(12), { authTagLength: TAG_BYTES })
+    decipher.setAAD(Buffer.concat([header, Buffer.from(identity)])); decipher.setAuthTag(bytes.subarray(-TAG_BYTES))
+    return Buffer.concat([decipher.update(bytes.subarray(49, -TAG_BYTES)), decipher.final()])
+  } finally { derived.fill(0) }
+}

package/server-common/storage-log.ts

@@ -19,11 +19,15 @@ export function e2eStorageLines(config: DatabaseConfig & { objstoreDir: string }
   ]
 }
 
-export function managedStorageLines(config: DatabaseConfig): string[] {
+export function managedStorageLines(config: DatabaseConfig & { storageEncryptionKey?: string | null }): string[] {
   const dir = dirname(config.dbPath)
   const location = (path: string) => config.neonUrl ? `Vercel Blob (private), .managed/${path}/` : resolve(dir, path)
   return [
     `  Managed database: ${databaseLocation(config)}`,
+    ...(config.storageEncryptionKey ? [
+      '  Managed storage encryption: ChaCha20-Poly1305',
+      `  Managed encrypted caches: ${location('cache-encrypted-v1')}`,
+    ] : []),
     `  Managed reports: ${location('reports')}`,
     `  Managed bundles: ${location('bundles')}`,
     `  Managed avatars: ${location('avatars')}`,

package/server-common/vercel-blob.ts

@@ -18,6 +18,7 @@ import type { Buffer } from 'node:buffer'
 type VercelBlobBody = Readable | Buffer | string | Blob | ArrayBuffer | ReadableStream<Uint8Array>
 export type VercelBlobSdk = {
   BlobNotFoundError: new () => Error
+  BlobPreconditionFailedError?: new () => Error
   put: (
     pathname: string,
     body: VercelBlobBody,
@@ -27,6 +28,7 @@ export type VercelBlobSdk = {
       allowOverwrite?: boolean
       contentType?: string
       token?: string
+      ifMatch?: string
       multipart?: boolean
       abortSignal?: AbortSignal
       cacheControlMaxAge?: number
@@ -35,7 +37,7 @@ export type VercelBlobSdk = {
   head: (
     pathname: string,
     options?: { token?: string; abortSignal?: AbortSignal },
-  ) => Promise<{ size: number; pathname: string; url: string }>
+  ) => Promise<{ size: number; pathname: string; url: string; etag?: string; uploadedAt?: Date | string | number }>
   get: (
     pathname: string,
     options: {
@@ -47,7 +49,7 @@ export type VercelBlobSdk = {
   ) => Promise<{
     statusCode: 200 | 304
     stream: ReadableStream<Uint8Array> | null
-    blob: { size: number | null }
+    blob: { size: number | null; etag?: string; uploadedAt?: Date | string | number }
   } | null>
   copy: (
     fromPathname: string,
@@ -63,7 +65,7 @@ export type VercelBlobSdk = {
   ) => Promise<{ url: string; pathname: string }>
   del: (
     urlOrPathname: string | string[],
-    options?: { token?: string; abortSignal?: AbortSignal },
+    options?: { token?: string; abortSignal?: AbortSignal; ifMatch?: string },
   ) => Promise<void>
   list: (options: {
     prefix?: string
@@ -71,6 +73,7 @@ export type VercelBlobSdk = {
     limit?: number
     mode?: 'expanded' | 'folded'
     token?: string
+    abortSignal?: AbortSignal
   }) => Promise<{
     // `uploadedAt` (a Date per the SDK v2 surface) is the blob's
     // creation time — used by the reaper's GC grace window. Optional

package/server-e2e/static.ts

@@ -194,13 +194,12 @@ function buildEntry(staticDir: string, name: string, deepviewScanServer: string
   // collision-resistance against the ~tens of files we load.
   const etag = `"${createHash('sha256').update(identity).digest('hex').slice(0, 32)}"`
   const isCompressible = COMPRESSIBLE.has(ext)
-  // Brotli quality 11 is the maximum — slow at compress time but
-  // we pay it once at boot and ship the smaller bytes on every
-  // request thereafter. text mode tells the encoder we're working
+  // Brotli quality 9 limits boot-time compression work, including on
+  // serverless cold starts. Text mode tells the encoder we're working
   // on UTF-8 text (every COMPRESSIBLE entry is text-shaped).
   const br = isCompressible ? brotliCompressSync(identity, {
     params: {
-      [zlibConstants.BROTLI_PARAM_QUALITY]: 11,
+      [zlibConstants.BROTLI_PARAM_QUALITY]: 9,
       [zlibConstants.BROTLI_PARAM_MODE]: zlibConstants.BROTLI_MODE_TEXT,
     },
   }) : null

package/server-managed/avatar-store.ts

@@ -1,12 +1,4 @@
-// Avatar cache for the managed server. The user's GitHub avatar is fetched once
-// at login (see github-oauth.ts) and served same-origin from GET
-// /api/auth/avatar — the app's CSP is `img-src 'self'`, so the GitHub-hosted
-// original can't be loaded by the page directly.
-//
-// The disk backend uses a dir beside SQLite; blob-vercel.ts implements the
-// same AvatarStore interface for remote storage. Keyed by the user's opaque `id`.
-import { mkdir, readFile, writeFile } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
+// Shared avatar cache interface, implemented by storage-stores.ts.
 import type { Buffer } from 'node:buffer'
 
 export interface CachedAvatar {
@@ -18,34 +10,3 @@ export interface AvatarStore {
   put(id: string, contentType: string, bytes: Buffer): Promise<void>
   get(id: string): Promise<CachedAvatar | null>
 }
-
-// The user id is a v4 uuid (crypto.randomUUID) — lowercase hex + dashes, no
-// path separators. Validated anyway so a crafted id can't escape the store dir.
-const ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u
-
-export function createDiskAvatarStore(dir: string): AvatarStore {
-  function pathFor(id: string): string {
-    if (!ID_RE.test(id)) throw new Error('invalid avatar id')
-    return join(dir, id)
-  }
-  return {
-    async put(id, contentType, bytes) {
-      const p = pathFor(id)
-      await mkdir(dirname(p), { recursive: true })
-      // Bytes first, then the content-type sidecar — a crash between the two
-      // leaves a typeless blob that `get` treats as missing (re-fetched next
-      // login) rather than serving with a wrong/absent type.
-      await writeFile(p, bytes)
-      await writeFile(`${p}.type`, contentType, 'utf8')
-    },
-    async get(id) {
-      try {
-        const p = pathFor(id)
-        const [bytes, contentType] = await Promise.all([readFile(p), readFile(`${p}.type`, 'utf8')])
-        return { bytes, contentType: contentType.trim() || 'application/octet-stream' }
-      } catch {
-        return null
-      }
-    },
-  }
-}

package/server-managed/blob-store.ts

@@ -1,14 +1,4 @@
-// Disk byte-store for the managed server's stored blobs (uploaded reports and
-// bundles). Unlike the e2e relay (which only ever holds opaque client-encrypted
-// blobs), a managed server is TRUSTED and stores the bytes in the clear so it
-// can operate on them — the metadata + attribution live in the DB, the bytes
-// live here, keyed by the blob's opaque `id`.
-//
-// The disk backend uses a dir beside SQLite (data/reports/<uuid> or
-// data/bundles/<uuid>); blob-vercel.ts implements the same interface remotely. Bytes only — the
-// content-type / filename / integrity ride the DB row, so there's no sidecar.
-import { mkdir, open, readFile, rm, writeFile } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
+// Logical upload-store interfaces shared by disk and Vercel storage.
 import type { Buffer } from 'node:buffer'
 import type { Readable } from 'node:stream'
 
@@ -19,48 +9,9 @@ export interface OpenedBlob {
 }
 
 export interface BlobStore {
-  put(id: string, bytes: Buffer): Promise<void>
+  // Encrypted upload stores return the wrapped data key for the SQL insert.
+  put(id: string, bytes: Buffer): Promise<string | null>
   get(id: string): Promise<Buffer | null>
   open(id: string): Promise<OpenedBlob | null>
   delete(id: string): Promise<void>
 }
-
-// The blob id is a v4 uuid (crypto.randomUUID) — lowercase hex + dashes, no
-// path separators. Validated anyway so a crafted id can't escape the store dir.
-const ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u
-
-export function createDiskBlobStore(dir: string, suffix = ''): BlobStore {
-  function pathFor(id: string): string {
-    if (!ID_RE.test(id)) throw new Error('invalid blob id')
-    return join(dir, id + suffix)
-  }
-  return {
-    async put(id, bytes) {
-      const p = pathFor(id)
-      await mkdir(dirname(p), { recursive: true })
-      await writeFile(p, bytes)
-    },
-    async get(id) {
-      try {
-        return await readFile(pathFor(id))
-      } catch {
-        return null
-      }
-    },
-    async open(id) {
-      let file
-      try { file = await open(pathFor(id), 'r') }
-      catch (err) { if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null; throw err }
-      try {
-        const info = await file.stat()
-        // Remain paused until piped. HEAD can close without reading the body.
-        return { size: info.size, stream: file.createReadStream() }
-      } catch (err) { await file.close(); throw err }
-    },
-    async delete(id) {
-      // `force` so a missing file (already gone) is a no-op, not a throw — the
-      // metadata row is the source of truth for whether a blob "exists".
-      await rm(pathFor(id), { force: true })
-    },
-  }
-}

package/server-managed/bundle-advisories.ts

@@ -0,0 +1,53 @@
+import { type Advisory, type Package, advisories } from '@preventive/upstream/advisories.js'
+import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
+
+export const ADVISORIES_TIMEOUT_MS = 30_000
+
+function advisoryGithubClient(token: string | null, signal: AbortSignal): Client {
+  const authenticated = createClient({ token, userAgent: 'deepview-triage' })
+  if (token === null) return authenticated
+  let client = authenticated
+  return {
+    ...authenticated,
+    async listRepoAdvisories(options) {
+      const current = client
+      try { return await current.listRepoAdvisories(options) } catch (error) {
+        if (current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
+        signal.throwIfAborted()
+        // Published advisories remain readable after a token is revoked. Reuse
+        // anonymous access for subsequent repositories in this audit as well.
+        if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
+        return client.listRepoAdvisories(options)
+      }
+    },
+  }
+}
+
+// The managed caller supplies its user's token when available; public shares
+// remain anonymous. Upstream sends this credential only to GitHub and returns
+// published advisories, matching versions across npm, OSV and repository rows.
+export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
+  { debug = false, repoAdvisories = false, githubToken = null }: { debug?: boolean; repoAdvisories?: boolean; githubToken?: string | null } = {}): Promise<
+  { status: 200; body: Advisory[] } | { status: 502; body: { error: string } }
+> {
+  let onAbort: (() => void) | undefined
+  try {
+    signal.throwIfAborted()
+    if (packages.length === 0) return { status: 200, body: [] }
+    // Upstream owns each transport's timeout and exposes no cancellation
+    // option. Bound the caller's wait for the multi-request audit as well.
+    const deadline = new Promise<never>((_resolve, reject) => {
+      onAbort = () => reject(signal.reason)
+      signal.addEventListener('abort', onAbort, { once: true })
+    })
+    const result = await Promise.race([
+      advisories(packages, { github: advisoryGithubClient(githubToken, signal), repoAdvisories }), deadline,
+    ])
+    return { status: 200, body: result }
+  } catch (error) {
+    if (debug) console.warn('managed: advisories failed:', error)
+    return { status: 502, body: { error: 'upstream-unavailable' } }
+  } finally {
+    if (onAbort) signal.removeEventListener('abort', onAbort)
+  }
+}

package/server-managed/bundle-advisory-inventory.ts

@@ -0,0 +1,75 @@
+import type { Package } from '@preventive/upstream/advisories.js'
+import { satisfies, valid } from '@preventive/upstream/semver.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+
+export interface SkippedAdvisoryPackage {
+  ecosystem: string
+  name: string
+  version: string
+  because: string
+}
+export interface BundleAdvisoryInventory { packages: Package[]; skipped: SkippedAdvisoryPackage[] }
+interface BundleModule { ecosystem?: string; name?: string; version?: string; files: Record<string, unknown> }
+
+// Match Stasis's audit evidence rules, including their verified version bounds:
+// https://github.com/PreventiveMeasures/stasis/blob/2bd4c14354da9888c00ab45fa89740413099b5dc/stasis/src/audit-corrections.js
+// Keep this on the server: upstream's semver implementation uses Node's npm.
+const cargoManifests = ['Cargo.toml', 'Cargo.lock', '.cargo-checksum.json']
+const solidityManifests = ['package.json', 'foundry.toml', 'remappings.txt', 'soldeer.toml']
+const manifests = new Map([
+  ['npm', ['package.json']],
+  ['cargo', cargoManifests], ['cargo-git', cargoManifests], ['cargo-unknown', cargoManifests],
+  ['composer', ['composer.json', 'composer.lock']],
+  ['soldeer', solidityManifests], ['github', solidityManifests],
+])
+const browserStubRanges = new Map([['ws', '<=8.21.1'], ['node-fetch', '<=2.7.0']])
+
+function isEvidence(ecosystem: string, name: string, version: string, file: string): boolean {
+  if (manifests.get(ecosystem)?.includes(file.slice(file.lastIndexOf('/') + 1))) return false
+  const stubRange = ecosystem === 'npm' && file === 'browser.js' ? browserStubRanges.get(name) : undefined
+  return !stubRange || !valid(version) || !satisfies(version, stubRange)
+}
+
+function supported(ecosystem: string): ecosystem is Package['ecosystem'] {
+  return ['npm', 'cargo', 'composer', 'soldeer', 'github'].includes(ecosystem)
+}
+
+function skipReason(ecosystem: string, version: string): string | undefined {
+  if (ecosystem === 'cargo-git') return 'Crate vendored from git; its identity is not a crates.io package.'
+  if (ecosystem === 'cargo-unknown') return 'Crate source is unknown because .cargo-checksum.json is missing.'
+  if (ecosystem === 'composer' && /^dev-|-dev$/iu.test(version.replace(/#.*$/su, ''))) return 'Composer dev versions cannot be matched against release advisories.'
+  return undefined
+}
+
+// Package and reason presence both require a recorded evidence file. Entry and
+// manually added files count even when they have no incoming import edge.
+export function bundleAdvisoryInventory(details: BundleDetails, paths: Iterable<string> | null = null): BundleAdvisoryInventory {
+  const modules = (details.bundle as { modules?: ReadonlyMap<string, BundleModule> } | undefined)?.modules
+  if (details.kind !== 'stasis' || !modules) return { packages: [], skipped: [] }
+  const selected = paths === null ? null : new Set(paths)
+  const packages = new Map<string, { ecosystem: Package['ecosystem']; name: string; versions: Set<string> }>()
+  const skipped = new Map<string, SkippedAdvisoryPackage>()
+  for (const [dir, info] of modules) {
+    if (dir === '.') continue
+    const ecosystem = info.ecosystem ?? (/(?:^|\/)node_modules\//u.test(dir) ? 'npm' : undefined)
+    const { name, version } = info
+    if (ecosystem === undefined || typeof name !== 'string' || !name || typeof version !== 'string' || !version) continue
+    if (!Object.keys(info.files).some(file => (!selected || selected.has(`${dir}/${file}`)) && isEvidence(ecosystem, name, version, file))) continue
+    const because = skipReason(ecosystem, version)
+    if (!supported(ecosystem) || because !== undefined) {
+      skipped.set(JSON.stringify([ecosystem, name, version]), { ecosystem, name, version, because: because ?? `No advisory source is supported for ${ecosystem}.` })
+      continue
+    }
+    // Foundry's branch '.' means the superproject's branch. As in Stasis,
+    // 0.0.0 tells upstream its actual version is unknown, so every range covers it.
+    const auditedVersion = ecosystem === 'github' && version === '.' ? '0.0.0' : version
+    const key = JSON.stringify([ecosystem, ecosystem === 'github' ? name.toLowerCase() : name])
+    if (!packages.has(key)) packages.set(key, { ecosystem, name, versions: new Set() })
+    packages.get(key)!.versions.add(auditedVersion)
+  }
+  const byPackage = (a: { ecosystem: string; name: string }, b: { ecosystem: string; name: string }) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name)
+  return {
+    packages: [...packages.values()].map(pkg => ({ ...pkg, versions: [...pkg.versions].toSorted() })).toSorted(byPackage),
+    skipped: [...skipped.values()].toSorted((a, b) => byPackage(a, b) || a.version.localeCompare(b.version)),
+  }
+}