@preventive/triage 1.0.0-alpha.27 → 1.0.0-alpha.28

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.27",
+  "version": "1.0.0-alpha.28",
   "description": "Client & relay server for triaging of automated reports",
-  "license": "MIT",
+  "license": "MIT OR Apache-2.0",
   "author": {
     "name": "Nikita Skovoroda",
     "email": "chalkerx@gmail.com",
@@ -30,7 +30,6 @@
   },
   "exports": {
     "./reap": "./api/reap.ts",
-    "./report": "./report/index.js",
     "./server": "./server.ts",
     "./server-e2e": "./server-e2e/index.ts",
     "./strip-types-loader": "./strip-types-loader.js",
@@ -42,6 +41,8 @@
     "triage-managed-server": "server-managed/cli.js"
   },
   "files": [
+    "LICENSE-APACHE",
+    "LICENSE-MIT",
     "api/reap.ts",
     "cli.js",
     "server.ts",
@@ -90,7 +91,12 @@
     "server-managed/avatar-store.ts",
     "server-managed/blob-store.ts",
     "server-managed/brotli.ts",
+    "server-managed/bundle-advisories.ts",
+    "server-managed/bundle-advisory-inventory.ts",
     "server-managed/bundle-cache.ts",
+    "server-managed/bundle-build.ts",
+    "server-managed/bundle-build-leases.ts",
+    "server-managed/bundle-build-worker.js",
     "server-managed/bundle-catalog.ts",
     "server-managed/bundle-store.ts",
     "server-managed/bundle-summary-cache.ts",
@@ -119,6 +125,7 @@
     "server-managed/import-triage.ts",
     "server-managed/managed-issues.ts",
     "server-managed/management.ts",
+    "server-managed/management-catalog.ts",
     "server-managed/object-storage.ts",
     "server-managed/object-storage-disk.ts",
     "server-managed/object-storage-vercel.ts",
@@ -130,6 +137,7 @@
     "server-managed/report-query.ts",
     "server-managed/report-response.ts",
     "server-managed/report-sources.ts",
+    "server-managed/revisions.ts",
     "server-managed/repository-browser.ts",
     "server-managed/repository-discovery.ts",
     "server-managed/repository-policy.ts",
@@ -162,28 +170,6 @@
     "server-common/storage-crypto.ts",
     "server-common/vercel-blob.ts",
     "server-common/scan-config.ts",
-    "report/index.js",
-    "report/src/finding-id.js",
-    "report/src/finding.js",
-    "report/src/severity.js",
-    "report/src/security.js",
-    "report/src/labels.js",
-    "report/src/md-structure.js",
-    "report/src/md-text.js",
-    "report/src/meta.js",
-    "report/src/parse-codex.js",
-    "report/src/parse-deepsec.js",
-    "report/src/parse-deepview-fields.js",
-    "report/src/parse-deepview-md.js",
-    "report/src/parse-md-id.js",
-    "report/src/parse-md.js",
-    "report/src/parse-piolium-id.js",
-    "report/src/parse-piolium-rows.js",
-    "report/src/parse-piolium-tokens.js",
-    "report/src/parse-piolium.js",
-    "report/src/utf8.js",
-    "report/src/write-md-finding.js",
-    "report/src/write-md.js",
     "common/bundle-metadata.d.ts",
     "common/bundle-metadata.js",
     "common/bundle-reasons.d.ts",
@@ -238,7 +224,7 @@
   ],
   "scripts": {
     "lint": "node --run lint:js && node --run lint:css && node --run lint:ts",
-    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./report/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./api/",
+    "lint:js": "oxlint -c .oxlintrc.json --ignore-pattern=ui/logs.js ./cli.js ./server.ts ./tests/ ./common/ ./server-common/ ./server-e2e/ ./server-managed/ ./client/ ./ui/ ./api/",
     "lint:css": "stylelint 'ui/**/*.css'",
     "lint:ts": "tsc --noEmit",
     "prepack": "node --run build",
@@ -248,12 +234,13 @@
     "server-e2e": "node server-e2e/index.ts",
     "server-managed": "node server-managed/index.ts",
     "server-managed-test": "node server-managed/test-server.ts",
-    "test": "node --js-base-64 --import=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js ./report/tests/*.test.js"
+    "test": "node --js-base-64 --import=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.5.5",
     "@noble/ciphers": "^2.3.0",
     "@preventive/diff": "^1.0.0",
+    "@preventive/lockfile": "1.0.0-alpha.5",
     "@preventive/terminal": "2.0.0-beta.1",
     "@rray/frontend": "^1.0.0",
     "@stylistic/stylelint-plugin": "^5.3.0",
@@ -270,7 +257,10 @@
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@exodus/stasis-core": "^1.0.0-beta.4",
+    "@exodus/stasis": "1.0.0-beta.5",
+    "@exodus/stasis-core": "1.0.0-beta.5",
+    "@preventive/report": "1.0.0-alpha.4",
+    "@preventive/upstream": "1.0.0-alpha.4",
     "ws": "^8.20.1"
   },
   "peerDependencies": {

package/server-e2e/static.ts

@@ -194,13 +194,12 @@ function buildEntry(staticDir: string, name: string, deepviewScanServer: string
   // collision-resistance against the ~tens of files we load.
   const etag = `"${createHash('sha256').update(identity).digest('hex').slice(0, 32)}"`
   const isCompressible = COMPRESSIBLE.has(ext)
-  // Brotli quality 11 is the maximum — slow at compress time but
-  // we pay it once at boot and ship the smaller bytes on every
-  // request thereafter. text mode tells the encoder we're working
+  // Brotli quality 9 limits boot-time compression work, including on
+  // serverless cold starts. Text mode tells the encoder we're working
   // on UTF-8 text (every COMPRESSIBLE entry is text-shaped).
   const br = isCompressible ? brotliCompressSync(identity, {
     params: {
-      [zlibConstants.BROTLI_PARAM_QUALITY]: 11,
+      [zlibConstants.BROTLI_PARAM_QUALITY]: 9,
       [zlibConstants.BROTLI_PARAM_MODE]: zlibConstants.BROTLI_MODE_TEXT,
     },
   }) : null

package/server-managed/bundle-advisories.ts

@@ -0,0 +1,53 @@
+import { type Advisory, type Package, advisories } from '@preventive/upstream/advisories.js'
+import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
+
+export const ADVISORIES_TIMEOUT_MS = 30_000
+
+function advisoryGithubClient(token: string | null, signal: AbortSignal): Client {
+  const authenticated = createClient({ token, userAgent: 'deepview-triage' })
+  if (token === null) return authenticated
+  let client = authenticated
+  return {
+    ...authenticated,
+    async listRepoAdvisories(options) {
+      const current = client
+      try { return await current.listRepoAdvisories(options) } catch (error) {
+        if (current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
+        signal.throwIfAborted()
+        // Published advisories remain readable after a token is revoked. Reuse
+        // anonymous access for subsequent repositories in this audit as well.
+        if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
+        return client.listRepoAdvisories(options)
+      }
+    },
+  }
+}
+
+// The managed caller supplies its user's token when available; public shares
+// remain anonymous. Upstream sends this credential only to GitHub and returns
+// published advisories, matching versions across npm, OSV and repository rows.
+export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
+  { debug = false, repoAdvisories = false, githubToken = null }: { debug?: boolean; repoAdvisories?: boolean; githubToken?: string | null } = {}): Promise<
+  { status: 200; body: Advisory[] } | { status: 502; body: { error: string } }
+> {
+  let onAbort: (() => void) | undefined
+  try {
+    signal.throwIfAborted()
+    if (packages.length === 0) return { status: 200, body: [] }
+    // Upstream owns each transport's timeout and exposes no cancellation
+    // option. Bound the caller's wait for the multi-request audit as well.
+    const deadline = new Promise<never>((_resolve, reject) => {
+      onAbort = () => reject(signal.reason)
+      signal.addEventListener('abort', onAbort, { once: true })
+    })
+    const result = await Promise.race([
+      advisories(packages, { github: advisoryGithubClient(githubToken, signal), repoAdvisories }), deadline,
+    ])
+    return { status: 200, body: result }
+  } catch (error) {
+    if (debug) console.warn('managed: advisories failed:', error)
+    return { status: 502, body: { error: 'upstream-unavailable' } }
+  } finally {
+    if (onAbort) signal.removeEventListener('abort', onAbort)
+  }
+}

package/server-managed/bundle-advisory-inventory.ts

@@ -0,0 +1,75 @@
+import type { Package } from '@preventive/upstream/advisories.js'
+import { satisfies, valid } from '@preventive/upstream/semver.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+
+export interface SkippedAdvisoryPackage {
+  ecosystem: string
+  name: string
+  version: string
+  because: string
+}
+export interface BundleAdvisoryInventory { packages: Package[]; skipped: SkippedAdvisoryPackage[] }
+interface BundleModule { ecosystem?: string; name?: string; version?: string; files: Record<string, unknown> }
+
+// Match Stasis's audit evidence rules, including their verified version bounds:
+// https://github.com/PreventiveMeasures/stasis/blob/2bd4c14354da9888c00ab45fa89740413099b5dc/stasis/src/audit-corrections.js
+// Keep this on the server: upstream's semver implementation uses Node's npm.
+const cargoManifests = ['Cargo.toml', 'Cargo.lock', '.cargo-checksum.json']
+const solidityManifests = ['package.json', 'foundry.toml', 'remappings.txt', 'soldeer.toml']
+const manifests = new Map([
+  ['npm', ['package.json']],
+  ['cargo', cargoManifests], ['cargo-git', cargoManifests], ['cargo-unknown', cargoManifests],
+  ['composer', ['composer.json', 'composer.lock']],
+  ['soldeer', solidityManifests], ['github', solidityManifests],
+])
+const browserStubRanges = new Map([['ws', '<=8.21.1'], ['node-fetch', '<=2.7.0']])
+
+function isEvidence(ecosystem: string, name: string, version: string, file: string): boolean {
+  if (manifests.get(ecosystem)?.includes(file.slice(file.lastIndexOf('/') + 1))) return false
+  const stubRange = ecosystem === 'npm' && file === 'browser.js' ? browserStubRanges.get(name) : undefined
+  return !stubRange || !valid(version) || !satisfies(version, stubRange)
+}
+
+function supported(ecosystem: string): ecosystem is Package['ecosystem'] {
+  return ['npm', 'cargo', 'composer', 'soldeer', 'github'].includes(ecosystem)
+}
+
+function skipReason(ecosystem: string, version: string): string | undefined {
+  if (ecosystem === 'cargo-git') return 'Crate vendored from git; its identity is not a crates.io package.'
+  if (ecosystem === 'cargo-unknown') return 'Crate source is unknown because .cargo-checksum.json is missing.'
+  if (ecosystem === 'composer' && /^dev-|-dev$/iu.test(version.replace(/#.*$/su, ''))) return 'Composer dev versions cannot be matched against release advisories.'
+  return undefined
+}
+
+// Package and reason presence both require a recorded evidence file. Entry and
+// manually added files count even when they have no incoming import edge.
+export function bundleAdvisoryInventory(details: BundleDetails, paths: Iterable<string> | null = null): BundleAdvisoryInventory {
+  const modules = (details.bundle as { modules?: ReadonlyMap<string, BundleModule> } | undefined)?.modules
+  if (details.kind !== 'stasis' || !modules) return { packages: [], skipped: [] }
+  const selected = paths === null ? null : new Set(paths)
+  const packages = new Map<string, { ecosystem: Package['ecosystem']; name: string; versions: Set<string> }>()
+  const skipped = new Map<string, SkippedAdvisoryPackage>()
+  for (const [dir, info] of modules) {
+    if (dir === '.') continue
+    const ecosystem = info.ecosystem ?? (/(?:^|\/)node_modules\//u.test(dir) ? 'npm' : undefined)
+    const { name, version } = info
+    if (ecosystem === undefined || typeof name !== 'string' || !name || typeof version !== 'string' || !version) continue
+    if (!Object.keys(info.files).some(file => (!selected || selected.has(`${dir}/${file}`)) && isEvidence(ecosystem, name, version, file))) continue
+    const because = skipReason(ecosystem, version)
+    if (!supported(ecosystem) || because !== undefined) {
+      skipped.set(JSON.stringify([ecosystem, name, version]), { ecosystem, name, version, because: because ?? `No advisory source is supported for ${ecosystem}.` })
+      continue
+    }
+    // Foundry's branch '.' means the superproject's branch. As in Stasis,
+    // 0.0.0 tells upstream its actual version is unknown, so every range covers it.
+    const auditedVersion = ecosystem === 'github' && version === '.' ? '0.0.0' : version
+    const key = JSON.stringify([ecosystem, ecosystem === 'github' ? name.toLowerCase() : name])
+    if (!packages.has(key)) packages.set(key, { ecosystem, name, versions: new Set() })
+    packages.get(key)!.versions.add(auditedVersion)
+  }
+  const byPackage = (a: { ecosystem: string; name: string }, b: { ecosystem: string; name: string }) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name)
+  return {
+    packages: [...packages.values()].map(pkg => ({ ...pkg, versions: [...pkg.versions].toSorted() })).toSorted(byPackage),
+    skipped: [...skipped.values()].toSorted((a, b) => byPackage(a, b) || a.version.localeCompare(b.version)),
+  }
+}

package/server-managed/bundle-build-leases.ts

@@ -0,0 +1,41 @@
+import type { ManagedSql } from './sql.ts'
+
+export const BUNDLE_BUILD_TIMEOUT_MS = 180_000
+// Leave time to terminate a timed-out worker before a crashed owner's slot
+// becomes reusable. Expiration uses the database clock, not an instance's clock.
+const LEASE_MS = BUNDLE_BUILD_TIMEOUT_MS + 60_000
+export const BUNDLE_BUILD_LEASE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_bundle_build_lease (
+  slot INTEGER PRIMARY KEY CHECK (slot IN (1, 2)),
+  owner TEXT NOT NULL UNIQUE,
+  user_id TEXT NOT NULL UNIQUE,
+  expires_at INTEGER NOT NULL
+) STRICT;
+`
+
+export interface BundleBuildLeaseStore {
+  claimBundleBuildLease(userId: string, owner: string): Promise<boolean>
+  releaseBundleBuildLease(owner: string): Promise<void>
+}
+
+export function bundleBuildLeaseMethods(db: ManagedSql): BundleBuildLeaseStore {
+  return {
+    // scopeManagedMethods holds SQLite's write transaction / PostgreSQL's
+    // advisory transaction lock across cleanup, inspection, and admission.
+    async claimBundleBuildLease(userId, owner) {
+      const { now } = await db.prepare("SELECT CAST(unixepoch('subsec') * 1000 AS INTEGER) AS now").get() as { now: number }
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE expires_at <= ?').run(now)
+      const leases = await db.prepare('SELECT slot, user_id AS userId FROM managed_bundle_build_lease').all() as { slot: number; userId: string }[]
+      if (leases.length >= 2 || leases.some(lease => lease.userId === userId)) return false
+      const slot = leases.some(lease => lease.slot === 1) ? 2 : 1
+      await db.prepare('INSERT INTO managed_bundle_build_lease (slot, owner, user_id, expires_at) VALUES (?, ?, ?, ?)')
+        .run(slot, owner, userId, now + LEASE_MS)
+      return true
+    },
+    // No user FK: deleting an account must not free a still-running worker's
+    // slot. A delayed/crashed owner's cleanup cannot release its successor.
+    async releaseBundleBuildLease(owner) {
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE owner = ?').run(owner)
+    },
+  }
+}

package/server-managed/bundle-build-worker.js

@@ -0,0 +1,44 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { Buffer } from 'node:buffer'
+import { posix } from 'node:path'
+import { brotliCompressSync } from 'node:zlib'
+import { buildGitHubBundle } from '@exodus/stasis/vfs-bundle'
+import { brotliOptions } from '@exodus/stasis-core/brotli'
+import { HttpError, createClient } from '@preventive/upstream/github.js'
+import { githubBundleFilename } from './bundle-build.ts'
+
+export async function buildStasisBundle({ input, github, token, maxBytes, scopes }, client = createClient({ token })) {
+  const allowed = path => scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))
+  // Stasis/upstream cache writes are disabled by default; this fresh worker
+  // never enables a cache directory or inherits application credentials.
+  const { bundle } = await buildGitHubBundle({
+    github, sha: input.commit, directory: input.directory || undefined,
+    entries: input.entries.map(entry => posix.relative(input.directory || '.', entry)),
+    ...input.options, client,
+  })
+  const directory = bundle.repo?.directory ?? ''
+  // A workspace lockfile may widen the build root. Never publish it under a
+  // narrower team grant: the storage location must cover the actual bundle.
+  if (!allowed(directory)) throw new Error('build-scope')
+  const serialized = bundle.serialize()
+  if (Buffer.byteLength(serialized) > 200 * 1024 * 1024) throw new Error('too-large')
+  const bytes = brotliCompressSync(serialized, brotliOptions())
+  if (bytes.length > maxBytes) throw new Error('too-large')
+  return { bytes, directory, filename: githubBundleFilename(github, input.directory, input.commit) }
+}
+
+if (parentPort && workerData?.type === 'managed-bundle-build') {
+  try {
+    // Node worker messages have no browser target origin.
+    // oxlint-disable-next-line unicorn/require-post-message-target-origin
+    parentPort.postMessage(await buildStasisBundle(workerData))
+  } catch (error) {
+    // Do not return upstream bodies or paths outside the caller's grants.
+    const code = ['build-scope', 'too-large'].includes(error.message) ? error.message
+      : error instanceof HttpError ? (error.status === 429 ? 'github-rate-limited' : 'github-build-failed')
+        : /no packageManager given|lockfile installs/u.test(error.message) ? 'build-lockfile'
+          : 'build-failed'
+    // oxlint-disable-next-line unicorn/require-post-message-target-origin
+    parentPort.postMessage({ error: code, status: code === 'too-large' ? 413 : code === 'build-scope' ? 403 : 422 })
+  }
+}

package/server-managed/bundle-build.ts

@@ -0,0 +1,141 @@
+import { Buffer } from 'node:buffer'
+import { createHash, randomUUID } from 'node:crypto'
+import { posix } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { BUNDLE_BUILD_TIMEOUT_MS, type BundleBuildLeaseStore } from './bundle-build-leases.ts'
+
+export class BundleBuildError extends Error {
+  status: number
+  code: string
+  constructor(status: number, code: string) { super(code); this.status = status; this.code = code }
+}
+
+export interface BundleBuildInput {
+  repoId: number
+  commit: string
+  entries: string[]
+  directory: string
+  options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; typescript?: boolean; jsx?: boolean }
+}
+
+function path(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0 && value.length <= 1024 && !/[\\\p{Cc}]/u.test(value)
+    && value.split('/').every(part => part !== '' && part !== '.' && part !== '..')
+}
+
+export function parseBundleBuild(value: unknown): BundleBuildInput {
+  const fail = (code = 'bad-request'): never => { throw new BundleBuildError(400, code) }
+  if (value == null || typeof value !== 'object' || Array.isArray(value)) return fail()
+  const { repoId, commit, entries, conditions } = value as Record<string, unknown>
+  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId) || repoId <= 0
+    || typeof commit !== 'string' || !/^[a-f\d]{40}$/u.test(commit)
+    || !Array.isArray(entries) || entries.length === 0 || entries.length > 100 || !entries.every(path)) return fail()
+  const selected = [...new Set(entries as string[])]
+  const scripts = selected.every(entry => /\.[mc]?[jt]s$/u.test(entry))
+  if (!scripts && !selected.every(entry => entry.endsWith('.sol'))) return fail('unsupported-entries')
+  const parts = posix.dirname(selected[0]!).split('/').filter(part => part !== '.')
+  for (const entry of selected) {
+    const parent = posix.dirname(entry).split('/')
+    while (parts.some((part, i) => parent[i] !== part)) parts.pop()
+  }
+  const options: BundleBuildInput['options'] = {}
+  if (scripts) {
+    if (conditions == null || typeof conditions !== 'object' || Array.isArray(conditions)) return fail('bad-conditions')
+    const { preset, conditions: names, platforms } = conditions as Record<string, unknown>
+    if (!['node', 'browser', 'metro'].includes(String(preset)) || !Array.isArray(names) || names.length > 16
+      || !names.every(name => typeof name === 'string' && name.length > 0 && name.length <= 64
+        && !/^\.|^\d+$|[\s,/\\\p{Cc}]/u.test(name) && !['default', 'import', 'require'].includes(name))) return fail('bad-conditions')
+    if (preset === 'metro') {
+      if (names.length !== 1 || names[0] !== 'react-native') return fail('metro-conditions')
+      if (!Array.isArray(platforms) || platforms.length === 0 || platforms.length > 2
+        || !platforms.every(platform => ['ios', 'android'].includes(platform))) return fail('bad-conditions')
+      Object.assign(options, { metro: true, platforms: [...new Set(platforms)] })
+    } else {
+      options.conditions = [...new Set(names)]
+      if (preset === 'browser') options.mainFields = ['browser', 'module', 'main']
+    }
+    options.typescript = true
+    options.jsx = true
+  }
+  return { repoId, commit, entries: selected, directory: parts.join('/'), options }
+}
+
+// Same portable name and 255-character limit as Stasis's githubBundleFile
+// (src/cmd/github-bundle.js), which is not a public package export.
+export function githubBundleFilename(github: string, directory: string, commit: string): string {
+  const portable = (value: string) => value.replaceAll(/[^\w.-]/gu, '_')
+  const repo = portable(github.replace('/', '-'))
+  const tail = `.${portable(commit.slice(0, 7))}.stasis.code.br`
+  if (!directory) return `${repo}${tail}`
+  const room = 255 - `${repo}.${tail}`.length
+  let dir = portable(directory.replaceAll('/', '-'))
+  if (dir.length > room) dir = `${dir.slice(0, room - 9)}_${createHash('sha256').update(directory).digest('hex').slice(0, 8)}`
+  return `${repo}.${dir}${tail}`
+}
+
+export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: string }
+export interface BuildRequest { input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[] }
+// An extra per-process ceiling; admission must also hold the shared DB lease.
+const active = new Set<string>()
+
+export async function withBundleBuildLease<T>(db: BundleBuildLeaseStore, userId: string, signal: AbortSignal,
+  work: (signal: AbortSignal) => Promise<T>): Promise<T> {
+  signal.throwIfAborted()
+  const owner = randomUUID(), started = performance.now(), timeout = new AbortController()
+  const expired = () => timeout.abort(new BundleBuildError(504, 'build-timeout'))
+  const timer = setTimeout(expired, BUNDLE_BUILD_TIMEOUT_MS)
+  const combined = AbortSignal.any([signal, timeout.signal])
+  let claimed = false
+  try {
+    claimed = await db.claimBundleBuildLease(userId, owner)
+    if (!claimed) throw new BundleBuildError(429, 'build-busy')
+    // Account for a slow/lost claim response or a suspended invocation before
+    // starting work. The three-minute budget starts before lease acquisition.
+    if (performance.now() - started >= BUNDLE_BUILD_TIMEOUT_MS) expired()
+    combined.throwIfAborted()
+    return await work(combined)
+  } catch (error) {
+    if (timeout.signal.aborted && !signal.aborted) throw timeout.signal.reason
+    throw error
+  } finally {
+    clearTimeout(timer)
+    // buildRepositoryBundle waits for worker termination before settling.
+    // Unknown claim/release outcomes expire safely without starting more work.
+    if (claimed) await db.releaseBundleBuildLease(owner)
+  }
+}
+
+// Parsing repositories and compressing bundles stays off the HTTP event loop.
+// Cap concurrent builds, terminate disconnected/timed-out work, and share no
+// credentials or mutable Stasis state between requests.
+export async function buildRepositoryBundle(userId: string, request: BuildRequest, signal: AbortSignal): Promise<BuiltBundle> {
+  if (active.has(userId) || active.size >= 2) throw new BundleBuildError(429, 'build-busy')
+  signal.throwIfAborted()
+  active.add(userId)
+  let worker: Worker | undefined
+  try {
+    worker = new Worker(new URL('./bundle-build-worker.js', import.meta.url), {
+      workerData: { ...request, type: 'managed-bundle-build' }, env: {}, execArgv: [], resourceLimits: { maxOldGenerationSizeMb: 512 },
+    })
+    const running = worker
+    return await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new BundleBuildError(504, 'build-timeout')), BUNDLE_BUILD_TIMEOUT_MS)
+      const abort = () => reject(new BundleBuildError(499, 'build-cancelled'))
+      signal.addEventListener('abort', abort, { once: true })
+      running.once('message', (message: BuiltBundle & { error?: string; status?: number }) => {
+        clearTimeout(timer)
+        signal.removeEventListener('abort', abort)
+        if (message.error) reject(new BundleBuildError(message.status ?? 422, message.error))
+        else resolve({ ...message, bytes: Buffer.from(message.bytes) })
+      })
+      running.once('error', () => reject(new BundleBuildError(422, 'build-failed')))
+      running.once('exit', () => {
+        clearTimeout(timer)
+        signal.removeEventListener('abort', abort)
+        reject(new BundleBuildError(422, 'build-failed'))
+      })
+    })
+  } finally {
+    try { await worker?.terminate() } finally { active.delete(userId) }
+  }
+}

package/server-managed/bundle-cache.ts

@@ -5,12 +5,13 @@ import { brotliDecompress } from 'node:zlib'
 import { promisify } from 'node:util'
 import { BUNDLE_METADATA_VERSION, type BundleDetails, createBundleMetadata, createBundleSummary, parseBundleContents } from '../common/bundle-metadata.js'
 import { bundleReasons } from '../common/bundle-reasons.js'
-import { bundlePackageVersions } from '../common/bundle-sources.js'
+import { type BundleAdvisoryInventory, bundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
 import { decodeUtf8 } from '../common/utf8.js'
 import type { OpenedBlob } from './blob-store.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { encodeBrotli } from './brotli.ts'
 import type { ManagedBundle, ManagedDb } from './db.ts'
+import { CacheMissError } from './cache-storage.ts'
 import { SUMMARY_FILENAME, createBundleSummaryCache } from './bundle-summary-cache.ts'
 
 const decompress = promisify(brotliDecompress)
@@ -37,7 +38,7 @@ export interface BundleCacheStorage {
 }
 
 const filename = `v${BUNDLE_METADATA_VERSION}-metadata.json.br`
-const packagesFilename = 'v2-package-versions.json'
+const packagesFilename = 'v4-advisory-inventory.json'
 
 // All scopes share one bounded derivative. Never decode full bundle metadata
 // on advisory requests, including when selecting a reason. Persist null when
@@ -51,14 +52,18 @@ function encodePackageInventory(details: BundleDetails): Buffer {
     parts.push(part)
     return true
   }
-  function inventory(paths: Set<string> | null) {
-    if (!append('{')) return false
+  function entries(rows: unknown[]) {
+    if (!append('[')) return false
     let first = true
-    for (const [name, versions] of bundlePackageVersions(details, paths)) {
-      if (!append(`${first ? '' : ','}${JSON.stringify(name)}:${JSON.stringify([...versions].toSorted())}`)) return false
+    for (const row of rows) {
+      if (!append(`${first ? '' : ','}${JSON.stringify(row)}`)) return false
       first = false
     }
-    return append('}')
+    return append(']')
+  }
+  function inventory(paths: Set<string> | null) {
+    const { packages, skipped } = bundleAdvisoryInventory(details, paths)
+    return append('{"packages":') && entries(packages) && append(',"skipped":') && entries(skipped) && append('}')
   }
   append('{"all":')
   if (!inventory(null) || !append(',"reasons":{')) return Buffer.from('null')
@@ -112,6 +117,12 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
     pending.set(record.id, job)
     try { await job } finally { if (pending.get(record.id) === job) pending.delete(record.id) }
   }
+  async function openCached(record: BundleCacheRecord, file: string) {
+    try { return await storage.open(record.id, file) }
+    catch (error) { if (!(error instanceof CacheMissError)) throw error }
+    await ensure(record)
+    return storage.open(record.id, file)
+  }
   return {
     prebuild: ensure,
     summary: summaries.summary,
@@ -124,13 +135,11 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
         if (!stored) throw new Error('Bundle bytes unavailable')
         return stored
       }
-      await ensure(record)
-      return storage.open(record.id, filename)
+      return openCached(record, filename)
     },
-    async packageVersions(record: ManagedBundle, reason = ''): Promise<Record<string, string[]> | null | undefined> {
-      if (record.kind !== 'stasis') return {}
-      await ensure(record)
-      const cached = await storage.open(record.id, packagesFilename)
+    async advisoryInventory(record: ManagedBundle, reason = ''): Promise<BundleAdvisoryInventory | null | undefined> {
+      if (record.kind !== 'stasis') return { packages: [], skipped: [] }
+      const cached = await openCached(record, packagesFilename)
       try {
         if (cached.size != null && cached.size > MAX_PACKAGE_INVENTORY_BYTES) return null
         const chunks: Buffer[] = []

package/server-managed/bundle-summary-cache.ts

@@ -1,10 +1,11 @@
 import { Buffer } from 'node:buffer'
 import { setImmediate } from 'node:timers/promises'
-import { BUNDLE_METADATA_VERSION } from '../common/bundle-metadata.js'
+import { CacheMissError } from './cache-storage.ts'
 import { decodeUtf8 } from '../common/utf8.js'
 import type { BundleCacheRecord, BundleCacheStorage, BundleSummary } from './bundle-cache.ts'
 
-export const SUMMARY_FILENAME = `v${BUNDLE_METADATA_VERSION}-summary.json`
+// Origin metadata does not change these counts; retain the byte-sized v2 cache.
+export const SUMMARY_FILENAME = 'v2-summary.json'
 const RETRY_MS = 5 * 60_000
 const BACKFILL_LIMIT = 4
 type CachedSummary = BundleSummary | { retryAt: number }
@@ -30,19 +31,33 @@ async function readSummary(storage: BundleCacheStorage, id: string): Promise<Cac
 
 export function createBundleSummaryCache(storage: BundleCacheStorage, build: (record: BundleCacheRecord) => Promise<BundleSummary>, exists: (id: string) => Promise<unknown>) {
   const entries = new Map<string, { id: string; value: CachedSummary }>()
+  const reads = new Map<string, { id: string; job: Promise<CachedSummary | null> }>()
   const active = new Map<string, Promise<void>>()
   let pending: Promise<void> | null = null
   function remember(record: BundleCacheRecord, value: CachedSummary) {
-    if (entries.size >= 256) entries.delete(entries.keys().next().value!)
+    // A completed build supersedes any older storage read still in flight.
+    reads.delete(record.integrity)
+    // Summaries are tiny and immutable by integrity. Refuse overflow admission
+    // instead of evicting the next hit during a scan larger than the cache.
+    if (entries.size >= 4096 && !entries.has(record.integrity)) return
     entries.set(record.integrity, { id: record.id, value })
   }
-  async function read(record: BundleCacheRecord) {
+  function read(record: BundleCacheRecord): Promise<CachedSummary | null> {
     const known = entries.get(record.integrity)
-    if (known) return known.value
-    if (!await storage.exists(record.id, SUMMARY_FILENAME)) return null
-    const value = await readSummary(storage, record.id)
-    remember(record, value)
-    return value
+    if (known) return Promise.resolve(known.value)
+    const existing = reads.get(record.integrity)
+    if (existing) return existing.job
+    // Concurrent catalogs share the decoded summary, never the response stream.
+    // Only in-flight work is shared: misses and failures remain retryable.
+    const job: Promise<CachedSummary | null> = readSummary(storage, record.id).then(value => {
+      if (reads.get(record.integrity)?.job === job) remember(record, value)
+      return entries.get(record.integrity)?.value ?? value
+    }).catch(error => {
+      if (error instanceof CacheMissError) return null
+      throw error
+    }).finally(() => { if (reads.get(record.integrity)?.job === job) reads.delete(record.integrity) })
+    reads.set(record.integrity, { id: record.id, job })
+    return job
   }
   async function publish(record: BundleCacheRecord, value: CachedSummary) {
     if (!await exists(record.id)) return
@@ -92,6 +107,9 @@ export function createBundleSummaryCache(storage: BundleCacheStorage, build: (re
       // backfill elsewhere must not delay removing these bytes or responding.
       await active.get(id)
       for (const [hash, entry] of entries) if (entry.id === id) entries.delete(hash)
+      // Do not wait for remote reads during deletion. Their callers still own
+      // and drain them, but a late response must not repopulate this cache.
+      for (const [hash, entry] of reads) if (entry.id === id) reads.delete(hash)
     },
   }
 }