@preventive/triage 1.0.0-alpha.27 → 1.0.0-alpha.28

package/server-managed/bundle.ts

@@ -7,6 +7,8 @@
 // report auto-links to its bundle.
 import { createHash } from 'node:crypto'
 import type { Buffer } from 'node:buffer'
+import { StringDecoder } from 'node:string_decoder'
+import { createBrotliDecompress } from 'node:zlib'
 
 // `sha512-<base64>` identity for a bundle's bytes. MUST stay byte-identical to
 // the client's common/integrity.js (SHA-512 → standard base64 WITH padding) so
@@ -21,12 +23,75 @@ export function bundleIntegrity(bytes: Buffer): string {
 // `bundleKind`: sourcemap (.map) or stasis (stasis.code.br / .stasis.code.br).
 // null for anything else (stored anyway; the kind is informational).
 export function bundleKind(filename: string): 'sourcemap' | 'stasis' | null {
-  const lower = filename.toLowerCase()
+  // Browsers insert a duplicate-download counter before the final extension.
+  const lower = filename.toLowerCase().replace(/ \(\d+\)(?=\.[^.]*$)/u, '')
   if (lower.endsWith('.map')) return 'sourcemap'
   if (lower === 'stasis.code.br' || lower.endsWith('.stasis.code.br')) return 'stasis'
   return null
 }
 
+interface BundleRepo { github?: unknown; directory?: unknown }
+const HEADER_KEYS = new Set(['version', 'config', 'repo', 'package'])
+const MAX_HEADER_BYTES = 64 * 1024
+
+// Stasis writes origin metadata before entries, formats and source bodies.
+// undefined means another chunk is needed; null means the header has no repo.
+function headerRepo(text: string): BundleRepo | null | undefined {
+  let depth = 0, escaped = false, expectKey = false, quoted = false
+  let key = '', start = 0, valueStart = 0
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i]
+    if (quoted) {
+      if (escaped) { escaped = false; continue }
+      if (c === '\\') { escaped = true; continue }
+      if (c !== '"') continue
+      quoted = false
+      if (depth === 1 && expectKey) {
+        key = JSON.parse(text.slice(start, i + 1)) as string
+        if (!HEADER_KEYS.has(key)) return null
+        expectKey = false
+      }
+      continue
+    }
+    if (c === '"') { quoted = true; start = i; continue }
+    if (c === '{' || c === '[') {
+      if (depth === 0 && c !== '{') return null
+      depth++
+      if (depth === 1) expectKey = true
+    } else if (depth === 1 && (c === ',' || c === '}')) {
+      if (key === 'repo') {
+        const repo: unknown = JSON.parse(text.slice(valueStart, i))
+        return repo != null && typeof repo === 'object' && !Array.isArray(repo) ? repo as BundleRepo : null
+      }
+      if (c === '}') return null
+      expectKey = true
+    } else if (c === '}' || c === ']') depth--
+    else if (depth === 1 && c === ':') valueStart = i + 1
+    else if (depth === 0 && c?.trim()) return null
+  }
+  return undefined
+}
+
+// Decode only a bounded prefix, stopping as soon as repo is read or the
+// header ends. Unknown/malformed archives remain uploadable as opaque bytes.
+export async function bundleRepo(bytes: Buffer): Promise<BundleRepo | null> {
+  const stream = createBrotliDecompress({ chunkSize: 4096 })
+  const decoder = new StringDecoder('utf8')
+  let size = 0, text = ''
+  stream.end(bytes)
+  try {
+    for await (const chunk of stream) {
+      size += chunk.length
+      if (size > MAX_HEADER_BYTES) return null
+      text += decoder.write(chunk)
+      const repo = headerRepo(text)
+      if (repo !== undefined) return repo
+    }
+    return null
+  } catch { return null }
+  finally { stream.destroy() }
+}
+
 // Extract the bundle integrities a report declares (its top-level
 // `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
 export function reportBundleHashes(bytes: Buffer): string[] {

package/server-managed/cache-storage.ts

@@ -1,6 +1,10 @@
 import type { Buffer } from 'node:buffer'
 import type { OpenedBlob } from './blob-store.ts'
 
+export class CacheMissError extends Error {
+  constructor() { super('Managed cache unavailable') }
+}
+
 // Keys are internal relative paths; delete removes a whole directory of variants.
 export interface CacheStorage {
   exists(key: string): Promise<boolean>

package/server-managed/content-access.ts

@@ -6,7 +6,7 @@ type Content = { repoId: number | null; repoDirectory?: string }
 // Read grants for each request: neither the manager role nor a cached page
 // confers repository access. Bundles have repository scope; reports also have
 // a directory scope. Unassigned content is only available to administrators.
-export async function contentAccess(db: ManagedDb, user: StoredUser) {
+export async function contentAccess(db: Pick<ManagedDb, 'listRepoScopesForUser'>, user: StoredUser) {
   const scopes = user.role === 'admin' ? null : await db.listRepoScopesForUser(user.id)
   const bundle = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId)
   const report = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId

package/server-managed/db-methods.ts

@@ -8,10 +8,12 @@ import { type CommentStore, commentMethods } from './comments.ts'
 import { type ActivityStore, activityMethods } from './activity.ts'
 import { type GithubMetadataStore, githubMetadataMethods } from './github-metadata.ts'
 import { type ManagedIssueStore, managedIssueMethods } from './managed-issues.ts'
+import { type BundleBuildLeaseStore, bundleBuildLeaseMethods } from './bundle-build-leases.ts'
 import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
 import { ManagedMutationError, type ManagementStore, managementMethods } from './management.ts'
+import { type ManagementCatalogStore, managementCatalogMethods } from './management-catalog.ts'
 import { type StorageKey } from '../server-common/storage-crypto.ts'
 import { type StorageDb, type StoredTokens, decodeStorageTokens, encodeStorageTokens, storageMethods, storageState, validateStorageUpload } from './storage-db.ts'
 
@@ -72,6 +74,9 @@ export interface SelectedRepo {
   private: boolean
   installationId: number | null
   defaultBranch: string
+  // Last live default observed by the repository browser, independent of the
+  // selection/discovery snapshot above. NULL means unknown or unavailable.
+  cachedDefaultBranch: string | null
   htmlUrl: string
   addedBy: string | null
   addedAt: number
@@ -86,7 +91,7 @@ export interface ManagedRepo extends SelectedRepo {
 
 // What a caller supplies to select (upsert) a repo; the store stamps the
 // timestamps.
-export type SelectedRepoInput = Omit<SelectedRepo, 'addedAt'>
+export type SelectedRepoInput = Omit<SelectedRepo, 'addedAt' | 'cachedDefaultBranch'>
 
 // A stored report's metadata. The bytes live in the blob-store keyed by `id`;
 // `contentType` + `filename` ride here so a download can label them, `sha256`
@@ -313,7 +318,12 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, StorageDb {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, BundleBuildLeaseStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb {
+  claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
+  finishMaintenanceLease(owner: string, until: number): Promise<void>
+  getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
+  // Reuse connections within a finite request or one feed polling iteration.
+  withRequest?<T>(work: () => Promise<T>): Promise<T>
   // Upsert the identity; returns the user's opaque id (stable across logins).
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
@@ -333,6 +343,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // mutable context while keeping the original added_by/added_at; deselectRepo
   // resolves true iff a row was removed.
   selectRepo(repo: SelectedRepoInput, now: number): Promise<void>
+  cacheRepoDefaultBranch(repo: SelectedRepo, branch: string | null): Promise<boolean>
   connectRepoInstallation(repo: SelectedRepo, installationId: number, sessionId: string, now: number): Promise<boolean>
   deselectRepo(repoId: number): Promise<boolean>
   listSelectedRepos(): Promise<SelectedRepo[]>
@@ -383,6 +394,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // stamp nor the trail. Every change also appends to managed_finding_triage_event;
   // listTriageHistory walks one finding's trail, newest first.
   listTriage(findingIds: readonly string[]): Promise<TriageRow[]>
+  getAnnotations(findingIds: readonly string[]): Promise<{ triage: TriageRow[]; comments: Awaited<ReturnType<CommentStore['listComments']>> }>
   // A content-free fingerprint of current annotations, read in one snapshot.
   getAnnotationRevision(findingIds: readonly string[]): Promise<string>
   setTriage(findingId: string, entry: TriageEntryPatch | null, updatedBy: string | null, updatedByLogin: string | null, now: number): Promise<void>
@@ -399,7 +411,13 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
   resolveBundleUpload(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
+  // One read snapshot of the live session, bundle and grants. Passing a team
+  // (or null for any team) also checks advisory security access; omission skips it.
+  getBundleAccessSnapshot(sessionId: string, now: number, id: string, advisoriesTeamId?: string | null): Promise<{
+    bundle: ManagedBundle | null; canReadAdvisories: boolean
+  } | null>
   listBundles(userId?: string): Promise<AdminBundle[]>
+  listReadableBundleIds(userId: string, ids: readonly string[]): Promise<string[]>
   userCanReadBundle(userId: string, id: string): Promise<boolean>
   userCanReadRepo(userId: string, repoId: number): Promise<boolean>
   userCanReadBundleAdvisories(userId: string, bundleId: string, teamId: string | null): Promise<boolean>
@@ -430,7 +448,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // bundles attached to that team's repos — for that user's own sidebar Teams section.
   // Any user; only their own memberships.
   listTeamsForUser(userId: string): Promise<UserTeam[]>
-  getUserTeamFeedSnapshot(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; revision: string } | null>
+  getUserTeamFeedSnapshot(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; revision: string; teams: UserTeam[]; catalog: number } | null>
   // Whether `userId` may read `reportId`: true iff the report's repo belongs to
   // a team the user is a member of. Backs the team-scoped report view endpoint.
   userCanReadReport(userId: string, reportId: string): Promise<boolean>
@@ -528,6 +546,8 @@ function prepareStatements(db: ManagedSql) {
       WHERE repo_id = ? AND full_name = ? AND added_at = ? AND installation_id IS NULL
         AND EXISTS (SELECT 1 FROM managed_session s JOIN managed_user u ON u.id = s.user_id
           WHERE s.id = ? AND s.expires_at > ? AND u.role = 'admin')`),
+    cacheRepoDefaultBranchStmt: db.prepare(`UPDATE managed_selected_repo SET cached_default_branch = ?
+      WHERE repo_id = ? AND full_name = ? AND added_at = ? AND active = 1`),
     deleteRepoStmt: db.prepare(`DELETE FROM managed_selected_repo WHERE repo_id = ?`),
     deactivateRepoStmt: db.prepare(`UPDATE managed_selected_repo SET active = 0 WHERE repo_id = ? AND active = 1`),
     reactivateRepoStmt: db.prepare(`UPDATE managed_selected_repo SET active = 1 WHERE repo_id = ? AND active = 0`),
@@ -545,13 +565,13 @@ function prepareStatements(db: ManagedSql) {
       UNION SELECT finding_id FROM managed_finding_comment_event WHERE finding_id IN (SELECT value FROM json_each(?))) AS annotations`),
     selectReposStmt: db.prepare(
       `SELECT repo_id AS repoId, full_name AS fullName, is_private AS priv,
-              installation_id AS installId, default_branch AS branch, html_url AS htmlUrl,
+              installation_id AS installId, default_branch AS branch, cached_default_branch AS cachedDefaultBranch, html_url AS htmlUrl,
               added_by AS addedBy, added_at AS addedAt, active AS active
          FROM managed_selected_repo WHERE active = 1 ORDER BY full_name ASC`,
     ),
     selectAllReposStmt: db.prepare(
       `SELECT repo_id AS repoId, full_name AS fullName, is_private AS priv,
-              installation_id AS installId, default_branch AS branch, html_url AS htmlUrl,
+              installation_id AS installId, default_branch AS branch, cached_default_branch AS cachedDefaultBranch, html_url AS htmlUrl,
               added_by AS addedBy, added_at AS addedAt, active AS active
          FROM managed_selected_repo ORDER BY full_name ASC`,
     ),
@@ -717,6 +737,11 @@ function prepareStatements(db: ManagedSql) {
           SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
           WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?))`,
     ),
+    selectReadableBundleIdsStmt: db.prepare(
+      `SELECT b.id FROM managed_bundle b WHERE b.id IN (SELECT value FROM json_each(?)) AND (b.uploaded_by = ? OR EXISTS (
+          SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+          WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?))`,
+    ),
     selectRepoReadableStmt: db.prepare(
       `SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
         WHERE tr.repo_id = ? AND tu.user_id = ? LIMIT 1`,
@@ -842,7 +867,7 @@ function prepareStatements(db: ManagedSql) {
 
 type RepoRow = {
   repoId: number; fullName: string; priv: number; installId: number | null
-  branch: string; htmlUrl: string; addedBy: string | null; addedAt: number; active: number
+  branch: string; cachedDefaultBranch: string | null; htmlUrl: string; addedBy: string | null; addedAt: number; active: number
 }
 
 // The repo-selection slice of ManagedDb, split out to keep openSqliteManagedDb
@@ -852,7 +877,7 @@ function selectedRepoMethods(stmts: ReturnType<typeof prepareStatements>) {
     selectReportsForRepoStmt, selectBundlesForRepoStmt, deleteReportsForRepoStmt, deleteBundlesForRepoStmt } = stmts
   const readRepo = (r: RepoRow): SelectedRepo => ({
     repoId: r.repoId, fullName: r.fullName, private: r.priv === 1,
-    installationId: r.installId, defaultBranch: r.branch, htmlUrl: r.htmlUrl,
+    installationId: r.installId, defaultBranch: r.branch, cachedDefaultBranch: r.cachedDefaultBranch, htmlUrl: r.htmlUrl,
     addedBy: r.addedBy, addedAt: r.addedAt,
   })
   const readManagedRepo = (r: RepoRow): ManagedRepo => ({ ...readRepo(r), active: r.active === 1 })
@@ -863,6 +888,9 @@ function selectedRepoMethods(stmts: ReturnType<typeof prepareStatements>) {
         repo.defaultBranch, repo.htmlUrl, repo.addedBy, now, now,
       )
     },
+    async cacheRepoDefaultBranch(repo: SelectedRepo, branch: string | null): Promise<boolean> {
+      return Number((await stmts.cacheRepoDefaultBranchStmt.run(branch, repo.repoId, repo.fullName, repo.addedAt)).changes) > 0
+    },
     async deselectRepo(repoId: number): Promise<boolean> {
       return Number((await deleteRepoStmt.run(repoId)).changes) > 0
     },
@@ -1046,7 +1074,7 @@ type TriageEventDbRow = TriageStateDbRow & {
 // current row is skipped altogether, so a client re-pushing what already
 // stands neither re-stamps the writer nor echoes into the trail. `historyLimit`
 // > 0 keeps only that many events per finding; 0 keeps everything.
-function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimit: number) {
+function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit: number, db: ManagedSql) {
   const { upsertTriageStmt, selectTriageStmt, selectTriageStateStmt, insertTriageEventStmt, trimTriageEventsStmt, selectTriageHistoryStmt,
     deleteTriageStmt, deleteTriageHistoryStmt, deleteCommentsStmt, deleteCommentHistoryStmt, countAnnotationsStmt } = stmts
   async function writeEntry(findingId: string, entry: TriageEntryPatch | null, batchId: string, updatedBy: string | null, updatedByLogin: string | null, now: number, reportId: string | null = null): Promise<void> {
@@ -1112,7 +1140,43 @@ function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimi
       // (and costs one fsync under synchronous = FULL, not one per row); one
       // batch id groups its rows in the trail.
       const batchId = randomUUID()
-      for (const [findingId, entry] of entries) await writeEntry(findingId, entry, batchId, updatedBy, updatedByLogin, now, reportId)
+      if (new Set(entries.map(([id]) => id)).size !== entries.length) {
+        // Preserve the ordered history of callers that supply repeated IDs.
+        for (const [id, entry] of entries) await writeEntry(id, entry, batchId, updatedBy, updatedByLogin, now, reportId)
+        return
+      }
+      const current = new Map((await selectTriageStmt.all(JSON.stringify(entries.map(([id]) => id))) as TriageDbRow[])
+        .map(row => [row.findingId, row]))
+      const changed = entries.flatMap(([id, entry]) => {
+        const e = entry ?? {}, previous = current.get(id)
+        const next = { color: e.color ?? null, triage: e.triage ?? null, comment: e.comment ?? null,
+          fix: e.fix ?? null, flagged: e.flagged == null ? null : e.flagged ? 1 : 0 }
+        if (previous && Object.entries(next).every(([key, value]) => previous[key as keyof TriageStateDbRow] === value)) return []
+        return [[id, next.color, next.triage, next.comment, next.fix, next.flagged]]
+      })
+      // Bound SQL parameters while keeping the entire batch/history atomic.
+      for (let offset = 0; offset < changed.length; offset += 200) {
+        const rows = changed.slice(offset, offset + 200), values = rows.flat()
+        const input = `WITH changes(finding_id, color, triage, comment, fix, flagged, ordinal) AS
+          (VALUES ${rows.map((_, index) => `(?, ?, ?, ?, ?, CAST(? AS INTEGER), ${index})`).join(',')})`
+        await db.prepare(`${input}
+          INSERT INTO managed_finding_triage (finding_id, color, triage, comment, fix, flagged, updated_by, updated_by_login, updated_at)
+          SELECT finding_id, color, triage, comment, fix, flagged, ?, ?, CAST(? AS BIGINT) FROM changes WHERE TRUE
+          ON CONFLICT(finding_id) DO UPDATE SET color = excluded.color, triage = excluded.triage,
+            comment = excluded.comment, fix = excluded.fix, flagged = excluded.flagged, updated_by = excluded.updated_by,
+            updated_by_login = excluded.updated_by_login, updated_at = excluded.updated_at`).run(...values, updatedBy, updatedByLogin, now)
+        await db.prepare(`${input}
+          INSERT INTO managed_finding_triage_event (finding_id, batch_id, color, triage, comment, fix, flagged, actor_id, actor_login, at, report_id, report, repo)
+          SELECT c.finding_id, ?, c.color, c.triage, c.comment, c.fix, c.flagged, ?, ?, CAST(? AS BIGINT), ?, r.filename, p.full_name
+          FROM changes c LEFT JOIN managed_report r ON r.id = ? LEFT JOIN managed_selected_repo p ON p.repo_id = r.repo_id ORDER BY c.ordinal`)
+          .run(...values, batchId, updatedBy, updatedByLogin, now, reportId ?? null, reportId ?? null)
+        if (historyLimit > 0) {
+          await db.prepare(`DELETE FROM managed_finding_triage_event WHERE seq IN (
+          SELECT seq FROM (SELECT seq, ROW_NUMBER() OVER (PARTITION BY finding_id ORDER BY seq DESC) AS position
+            FROM managed_finding_triage_event WHERE finding_id IN (SELECT value FROM json_each(?))) ranked WHERE position > ?)`)
+          .run(JSON.stringify(rows.map(row => row[0])), historyLimit)
+        }
+      }
     },
   }
 }
@@ -1159,6 +1223,23 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
       const row = (await selectBundleStmt.get(id)) as BundleRow | undefined
       return row == null ? null : mapBundle(row)
     },
+    async getBundleAccessSnapshot(sessionId: string, now: number, id: string, advisoriesTeamId?: string | null) {
+      const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
+      if (!session) return null
+      const denied = { bundle: null, canReadAdvisories: false }
+      if (!roleAtLeast(session.role, 'view')) return denied
+      const row = await selectBundleStmt.get(id) as BundleRow | undefined
+      if (!row) return denied
+      const manager = roleAtLeast(session.role, 'manage')
+      if (session.role !== 'admin') {
+        const allowed = manager ? await selectBundleReadableStmt.get(id, session.uid, session.uid)
+          : row.repoId !== null && await selectRepoPathReadableStmt.get(row.repoDirectory, row.repoId, session.uid)
+        if (!allowed) return denied
+      }
+      const canReadAdvisories = manager || (advisoriesTeamId !== undefined
+        && await stmts.selectBundleSecurityStmt.get(id, session.uid, advisoriesTeamId, advisoriesTeamId) != null)
+      return { bundle: mapBundle(row), canReadAdvisories }
+    },
     async listBundles(userId?: string): Promise<AdminBundle[]> {
       const rows = (await selectBundlesStmt.all(userId ?? null, userId ?? null, userId ?? null)) as BundleListRow[]
       return rows.map((r) => ({
@@ -1170,6 +1251,11 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
     async userCanReadBundle(userId: string, id: string): Promise<boolean> {
       return (await selectBundleReadableStmt.get(id, userId, userId)) != null
     },
+    async listReadableBundleIds(userId: string, ids: readonly string[]): Promise<string[]> {
+      if (ids.length === 0) return []
+      const rows = await stmts.selectReadableBundleIdsStmt.all(JSON.stringify([...new Set(ids)]), userId, userId) as { id: string }[]
+      return rows.map(row => row.id)
+    },
     async userCanReadRepo(userId: string, repoId: number): Promise<boolean> {
       return (await selectRepoReadableStmt.get(repoId, userId)) != null
     },
@@ -1195,7 +1281,7 @@ type TeamMemberRow = { teamId: string; userId: string; login: string; viewDepend
 // The team slice of ManagedDb. listTeams reads the three tables in full and
 // groups in JS (3 queries, not N+1) — fine for the handful of teams a managed
 // workspace has.
-function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
+function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql) {
   const {
     insertTeamStmt, selectTeamByNameStmt, renameTeamStmt, deleteTeamStmt, selectTeamStmt,
     selectUserRepoScopesStmt, selectTeamsStmt, selectTeamsForUserStmt, selectUserTeamReportsStmt, selectUserTeamBundlesStmt, selectReportReadableStmt,
@@ -1258,15 +1344,19 @@ function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
         bundles: bundlesByTeam.get(t.id) ?? [],
       }))
     },
+    async getFeedState(sessionId: string, now: number) {
+      const row = await db.prepare(`SELECT u.id, u.role, r.catalog, r.annotations FROM managed_session s
+        JOIN managed_user u ON u.id = s.user_id JOIN managed_change_revision r ON r.id = 1
+        WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, now) as { id: string; role: Role; catalog: number; annotations: number } | undefined
+      return row ? { user: { id: row.id, role: row.role }, catalog: row.catalog, annotations: row.annotations } : null
+    },
     async getUserTeamFeedSnapshot(sessionId: string, now: number) {
       // One short read-only transaction, shared by SQLite and Postgres. Never
       // touch last-seen timestamps or include other users' memberships.
-      const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
-      if (!session) return null
-      const teams = session.role === 'none' ? [] : await methods.listTeamsForUser(session.uid)
-      return { user: { id: session.uid, role: session.role },
-        revision: teamCatalogRevision(teams),
-      }
+      const state = await methods.getFeedState(sessionId, now)
+      if (!state) return null
+      const teams = state.user.role === 'none' ? [] : await methods.listTeamsForUser(state.user.id)
+      return { user: state.user, catalog: state.catalog, teams, revision: teamCatalogRevision(teams) }
     },
     async userCanReadReport(userId: string, reportId: string): Promise<boolean> {
       return (await selectReportReadableStmt.get(reportId, userId)) != null
@@ -1331,14 +1421,23 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const activity = activityMethods(db)
   const stmts = prepareStatements(db)
   const reports = reportMethods(stmts, db, key)
-  const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0)
+  const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0, db)
   const {
     upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, deleteSessionStmt, deleteExpiredStmt,
   } = stmts
 
-  const methods: Omit<ManagedDb, keyof ManagementStore> = {
+  const methods: Omit<ManagedDb, keyof ManagementStore | keyof ManagementCatalogStore> = {
     ...storageMethods(db, key),
+    ...bundleBuildLeaseMethods(db),
+    async claimMaintenanceLease(owner, now, until, migration = false) {
+      return !!await db.prepare(`INSERT INTO managed_maintenance_lease (id, owner, expires_at) VALUES (?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at
+        WHERE managed_maintenance_lease.expires_at <= ? RETURNING id`).get(migration ? 2 : 1, owner, until, now)
+    },
+    async finishMaintenanceLease(owner, until) {
+      await db.prepare('UPDATE managed_maintenance_lease SET expires_at = ? WHERE owner = ?').run(until, owner)
+    },
     async upsertUser(user, now, initialAdminGithubId = null) {
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
@@ -1401,15 +1500,18 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...selectedRepoMethods(stmts),
     ...activity,
     ...comments,
+    async getAnnotations(ids) {
+      return { triage: await triage.listTriage(ids), comments: await comments.listComments(ids) }
+    },
     ...workspaceShareMethods(db),
     ...reports,
     ...triage,
     ...importTriageMethods({ getReport: reports.getReport, ...triage, ...comments }),
     ...bundleMethods(stmts, db, key),
-    ...teamMethods(stmts),
+    ...teamMethods(stmts, db),
     async close() {
       await db.close()
     },
   }
-  return { ...methods, ...managementMethods(methods) }
+  return { ...methods, ...managementMethods(methods), ...managementCatalogMethods(methods) }
 }

package/server-managed/db-neon.ts

@@ -1,10 +1,12 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
+import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA } from './activity.ts'
 import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
@@ -21,11 +23,38 @@ export interface PgConnection {
   release(): Promise<void>
 }
 export type PgConnect = () => Promise<PgConnection>
-// All managed writers cooperate on this transaction-scoped lock. Reads use a
-// consistent snapshot without taking it. Also protects concurrent cold starts.
+// Content/access mutations cooperate on this transaction-scoped lock. Reads,
+// presence updates, and maintenance leases do not take it. Also fences migrations.
 const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
 
+async function currentSchema(db: PgConnection): Promise<boolean> {
+  const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
+  if (!exists) return false
+  const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
+  return Array.from({ length: 14 }, (_, i) => i + 1).every(version => versions.has(version))
+}
+
+async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 12')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_selected_repo ADD COLUMN IF NOT EXISTS cached_default_branch TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (12)')
+}
+
+async function migrateBundleBuildLeases(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 13')).rows.length > 0) return
+  await db.query(postgresSchema(BUNDLE_BUILD_LEASE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (13)')
+}
+
+async function migrateGithubMetadata(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
+  await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
+  await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
+  await db.query('INSERT INTO managed_schema_version VALUES (14) ON CONFLICT DO NOTHING')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
+  if (await currentSchema(db)) return
   await db.query('BEGIN')
   try {
     await db.query(LOCK)
@@ -58,9 +87,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(WORKSPACE_SHARE_SCHEMA))
       await db.query('INSERT INTO managed_schema_version VALUES (4)')
     }
-    await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA))
-    await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
-    await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
+    await migrateGithubMetadata(db)
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 5')).rows.length === 0) {
       await db.query(`ALTER TABLE managed_workspace_share ADD COLUMN IF NOT EXISTS dependencies INTEGER NOT NULL DEFAULT 0,
         ADD COLUMN IF NOT EXISTS security INTEGER NOT NULL DEFAULT 0`)
@@ -84,10 +111,21 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query('CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id)')
       await db.query('INSERT INTO managed_schema_version VALUES (8)')
     }
-    for (const table of ['managed_report', 'managed_bundle']) {
-      await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 9')).rows.length === 0) {
+      await db.query(postgresSchema(STORAGE_SCHEMA))
+      for (const table of ['managed_report', 'managed_bundle']) {
+        await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+      }
+      await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
+      await db.query('INSERT INTO managed_schema_version VALUES (9)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 10')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (10)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
-    await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -112,10 +150,53 @@ async function createUploadTrigger(db: PgConnection, type: string, createTrigger
   }
 }
 
+function requestConnections(connect: PgConnect) {
+  const requests = new AsyncLocalStorage<{ connection?: PgConnection; queue: Promise<unknown>; ended: boolean }>()
+  async function withConnection<T>(work: (db: PgConnection) => Promise<T>): Promise<T> {
+    const request = requests.getStore()
+    if (!request || request.ended) {
+      const connection = await connect()
+      let result: T
+      try { result = await work(connection) }
+      catch (error) { await connection.release().catch(() => {}); throw error }
+      await connection.release()
+      return result
+    }
+    // Serialize transactions on the leased connection, never interleave BEGINs
+    // from concurrent Blob/catalog tasks. Remote Blob reads remain concurrent.
+    const result = request.queue.then(async () => {
+      const connection = request.connection ??= await connect()
+      try { return await work(connection) }
+      catch (error) {
+        delete request.connection
+        await connection.release().catch(() => {})
+        throw error
+      }
+    })
+    request.queue = result.catch(() => {})
+    return result
+  }
+  async function withRequest<T>(work: () => Promise<T>): Promise<T> {
+    if (requests.getStore()) return work()
+    const request: { connection?: PgConnection; queue: Promise<unknown>; ended: boolean } = { queue: Promise.resolve(), ended: false }
+    let failed = false
+    try { return await requests.run(request, work) }
+    catch (error) { failed = true; throw error }
+    finally {
+      request.ended = true
+      await request.queue
+      if (failed) await request.connection?.release().catch(() => {})
+      else await request.connection?.release()
+    }
+  }
+  return { withConnection, withRequest }
+}
+
 // Exposed for parity tests against real PostgreSQL semantics via PGlite.
-export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}): Promise<ManagedDb> {
+export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
   const initial = await connect()
   try { await initialize(initial) } finally { await initial.release() }
+  const { withConnection, withRequest } = requestConnections(connect)
   const context = new AsyncLocalStorage<PgConnection>()
   let closed = false
   const driver: ManagedSqlDriver = {
@@ -146,43 +227,51 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
         run: async (...args) => ({ changes: (await query(args)).rowCount ?? 0 }),
       }
     },
-    async scope(write, work) {
+    async scope(write, work, { lock = write, statement = false } = {}) {
       if (closed) throw new Error('Managed database is closed')
-      const db = await connect()
-      let commitAttempted = false
-      let result
-      try {
-        await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
-        if (write) await db.query(LOCK)
-        result = await context.run(db, work)
-        commitAttempted = true
-        await db.query('COMMIT')
-      } catch (err) {
-        await db.query('ROLLBACK').catch(() => {})
-        await db.release().catch(() => {})
-        if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
-        throw err
+      let committed = false
+      try { return await withConnection(async db => {
+        if (statement) return context.run(db, work)
+        let commitAttempted = false
+        try {
+          await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
+          if (lock) await db.query(LOCK)
+          const result = await context.run(db, work)
+          commitAttempted = true
+          await db.query('COMMIT')
+          committed = true
+          return result
+        } catch (err) {
+          await db.query('ROLLBACK').catch(() => {})
+          if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
+          throw err
+        }
+      }) } catch (error) {
+        if (write && committed) throw new Error('Managed commit outcome is uncertain', { cause: error })
+        throw error
       }
-      try { await db.release() }
-      catch (err) { if (write) throw new Error('Managed commit outcome is uncertain', { cause: err }); throw err }
-      return result
     },
     close() { closed = true },
   }
-  return scopeManagedMethods(createManagedMethods(driver, options), driver)
+  const methods = scopeManagedMethods(createManagedMethods(driver, options), driver)
+  if (reuseConnections) methods.withRequest = withRequest
+  return methods
 }
 
 export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}): Promise<ManagedDb> {
-  // Reuse the e2e optional-driver boundary. Each operation closes its socket
-  // before returning; no open connection has to survive a frozen invocation.
+  // Reuse the e2e optional-driver boundary. Requests lease one connection and
+  // close it before returning; no socket must survive a frozen invocation.
   const { Client, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
-    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query'] }
+    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query']; on?(event: 'error', listener: (error: Error) => void): void }
     neonConfig: { webSocketConstructor: typeof WebSocket }
   }
   neonConfig.webSocketConstructor = WebSocket
   return openPostgresManagedDb(async () => {
     const client = new Client(url)
+    // A remote disconnect between operations must reject the next query, not
+    // become an unhandled EventEmitter error while the request is reading Blob.
+    client.on?.('error', () => {})
     try { await client.connect() } catch (err) { await client.end().catch(() => {}); throw err }
     return { query: (sql, params) => client.query(sql, params), release: () => client.end() }
-  }, options)
+  }, options, true)
 }