@preventive/triage 1.0.0-alpha.27 → 1.0.0-alpha.29

package/server-managed/bundle-summary-cache.ts

@@ -1,10 +1,11 @@
 import { Buffer } from 'node:buffer'
 import { setImmediate } from 'node:timers/promises'
-import { BUNDLE_METADATA_VERSION } from '../common/bundle-metadata.js'
+import { CacheMissError } from './cache-storage.ts'
 import { decodeUtf8 } from '../common/utf8.js'
 import type { BundleCacheRecord, BundleCacheStorage, BundleSummary } from './bundle-cache.ts'
 
-export const SUMMARY_FILENAME = `v${BUNDLE_METADATA_VERSION}-summary.json`
+// Origin metadata does not change these counts; retain the byte-sized v2 cache.
+export const SUMMARY_FILENAME = 'v2-summary.json'
 const RETRY_MS = 5 * 60_000
 const BACKFILL_LIMIT = 4
 type CachedSummary = BundleSummary | { retryAt: number }
@@ -30,19 +31,33 @@ async function readSummary(storage: BundleCacheStorage, id: string): Promise<Cac
 
 export function createBundleSummaryCache(storage: BundleCacheStorage, build: (record: BundleCacheRecord) => Promise<BundleSummary>, exists: (id: string) => Promise<unknown>) {
   const entries = new Map<string, { id: string; value: CachedSummary }>()
+  const reads = new Map<string, { id: string; job: Promise<CachedSummary | null> }>()
   const active = new Map<string, Promise<void>>()
   let pending: Promise<void> | null = null
   function remember(record: BundleCacheRecord, value: CachedSummary) {
-    if (entries.size >= 256) entries.delete(entries.keys().next().value!)
+    // A completed build supersedes any older storage read still in flight.
+    reads.delete(record.integrity)
+    // Summaries are tiny and immutable by integrity. Refuse overflow admission
+    // instead of evicting the next hit during a scan larger than the cache.
+    if (entries.size >= 4096 && !entries.has(record.integrity)) return
     entries.set(record.integrity, { id: record.id, value })
   }
-  async function read(record: BundleCacheRecord) {
+  function read(record: BundleCacheRecord): Promise<CachedSummary | null> {
     const known = entries.get(record.integrity)
-    if (known) return known.value
-    if (!await storage.exists(record.id, SUMMARY_FILENAME)) return null
-    const value = await readSummary(storage, record.id)
-    remember(record, value)
-    return value
+    if (known) return Promise.resolve(known.value)
+    const existing = reads.get(record.integrity)
+    if (existing) return existing.job
+    // Concurrent catalogs share the decoded summary, never the response stream.
+    // Only in-flight work is shared: misses and failures remain retryable.
+    const job: Promise<CachedSummary | null> = readSummary(storage, record.id).then(value => {
+      if (reads.get(record.integrity)?.job === job) remember(record, value)
+      return entries.get(record.integrity)?.value ?? value
+    }).catch(error => {
+      if (error instanceof CacheMissError) return null
+      throw error
+    }).finally(() => { if (reads.get(record.integrity)?.job === job) reads.delete(record.integrity) })
+    reads.set(record.integrity, { id: record.id, job })
+    return job
   }
   async function publish(record: BundleCacheRecord, value: CachedSummary) {
     if (!await exists(record.id)) return
@@ -92,6 +107,9 @@ export function createBundleSummaryCache(storage: BundleCacheStorage, build: (re
       // backfill elsewhere must not delay removing these bytes or responding.
       await active.get(id)
       for (const [hash, entry] of entries) if (entry.id === id) entries.delete(hash)
+      // Do not wait for remote reads during deletion. Their callers still own
+      // and drain them, but a late response must not repopulate this cache.
+      for (const [hash, entry] of reads) if (entry.id === id) reads.delete(hash)
     },
   }
 }

package/server-managed/bundle.ts

@@ -7,6 +7,8 @@
 // report auto-links to its bundle.
 import { createHash } from 'node:crypto'
 import type { Buffer } from 'node:buffer'
+import { StringDecoder } from 'node:string_decoder'
+import { createBrotliDecompress } from 'node:zlib'
 
 // `sha512-<base64>` identity for a bundle's bytes. MUST stay byte-identical to
 // the client's common/integrity.js (SHA-512 → standard base64 WITH padding) so
@@ -21,12 +23,75 @@ export function bundleIntegrity(bytes: Buffer): string {
 // `bundleKind`: sourcemap (.map) or stasis (stasis.code.br / .stasis.code.br).
 // null for anything else (stored anyway; the kind is informational).
 export function bundleKind(filename: string): 'sourcemap' | 'stasis' | null {
-  const lower = filename.toLowerCase()
+  // Browsers insert a duplicate-download counter before the final extension.
+  const lower = filename.toLowerCase().replace(/ \(\d+\)(?=\.[^.]*$)/u, '')
   if (lower.endsWith('.map')) return 'sourcemap'
   if (lower === 'stasis.code.br' || lower.endsWith('.stasis.code.br')) return 'stasis'
   return null
 }
 
+interface BundleRepo { github?: unknown; directory?: unknown }
+const HEADER_KEYS = new Set(['version', 'config', 'repo', 'package'])
+const MAX_HEADER_BYTES = 64 * 1024
+
+// Stasis writes origin metadata before entries, formats and source bodies.
+// undefined means another chunk is needed; null means the header has no repo.
+function headerRepo(text: string): BundleRepo | null | undefined {
+  let depth = 0, escaped = false, expectKey = false, quoted = false
+  let key = '', start = 0, valueStart = 0
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i]
+    if (quoted) {
+      if (escaped) { escaped = false; continue }
+      if (c === '\\') { escaped = true; continue }
+      if (c !== '"') continue
+      quoted = false
+      if (depth === 1 && expectKey) {
+        key = JSON.parse(text.slice(start, i + 1)) as string
+        if (!HEADER_KEYS.has(key)) return null
+        expectKey = false
+      }
+      continue
+    }
+    if (c === '"') { quoted = true; start = i; continue }
+    if (c === '{' || c === '[') {
+      if (depth === 0 && c !== '{') return null
+      depth++
+      if (depth === 1) expectKey = true
+    } else if (depth === 1 && (c === ',' || c === '}')) {
+      if (key === 'repo') {
+        const repo: unknown = JSON.parse(text.slice(valueStart, i))
+        return repo != null && typeof repo === 'object' && !Array.isArray(repo) ? repo as BundleRepo : null
+      }
+      if (c === '}') return null
+      expectKey = true
+    } else if (c === '}' || c === ']') depth--
+    else if (depth === 1 && c === ':') valueStart = i + 1
+    else if (depth === 0 && c?.trim()) return null
+  }
+  return undefined
+}
+
+// Decode only a bounded prefix, stopping as soon as repo is read or the
+// header ends. Unknown/malformed archives remain uploadable as opaque bytes.
+export async function bundleRepo(bytes: Buffer): Promise<BundleRepo | null> {
+  const stream = createBrotliDecompress({ chunkSize: 4096 })
+  const decoder = new StringDecoder('utf8')
+  let size = 0, text = ''
+  stream.end(bytes)
+  try {
+    for await (const chunk of stream) {
+      size += chunk.length
+      if (size > MAX_HEADER_BYTES) return null
+      text += decoder.write(chunk)
+      const repo = headerRepo(text)
+      if (repo !== undefined) return repo
+    }
+    return null
+  } catch { return null }
+  finally { stream.destroy() }
+}
+
 // Extract the bundle integrities a report declares (its top-level
 // `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
 export function reportBundleHashes(bytes: Buffer): string[] {

package/server-managed/cache-storage.ts

@@ -1,6 +1,10 @@
 import type { Buffer } from 'node:buffer'
 import type { OpenedBlob } from './blob-store.ts'
 
+export class CacheMissError extends Error {
+  constructor() { super('Managed cache unavailable') }
+}
+
 // Keys are internal relative paths; delete removes a whole directory of variants.
 export interface CacheStorage {
   exists(key: string): Promise<boolean>

package/server-managed/content-access.ts

@@ -6,7 +6,7 @@ type Content = { repoId: number | null; repoDirectory?: string }
 // Read grants for each request: neither the manager role nor a cached page
 // confers repository access. Bundles have repository scope; reports also have
 // a directory scope. Unassigned content is only available to administrators.
-export async function contentAccess(db: ManagedDb, user: StoredUser) {
+export async function contentAccess(db: Pick<ManagedDb, 'listRepoScopesForUser'>, user: StoredUser) {
   const scopes = user.role === 'admin' ? null : await db.listRepoScopesForUser(user.id)
   const bundle = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId)
   const report = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId

package/server-managed/db-methods.ts

@@ -8,10 +8,12 @@ import { type CommentStore, commentMethods } from './comments.ts'
 import { type ActivityStore, activityMethods } from './activity.ts'
 import { type GithubMetadataStore, githubMetadataMethods } from './github-metadata.ts'
 import { type ManagedIssueStore, managedIssueMethods } from './managed-issues.ts'
+import { type BundleBuildLeaseStore, bundleBuildLeaseMethods } from './bundle-build-leases.ts'
 import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
 import { ManagedMutationError, type ManagementStore, managementMethods } from './management.ts'
+import { type ManagementCatalogStore, managementCatalogMethods } from './management-catalog.ts'
 import { type StorageKey } from '../server-common/storage-crypto.ts'
 import { type StorageDb, type StoredTokens, decodeStorageTokens, encodeStorageTokens, storageMethods, storageState, validateStorageUpload } from './storage-db.ts'
 
@@ -72,6 +74,9 @@ export interface SelectedRepo {
   private: boolean
   installationId: number | null
   defaultBranch: string
+  // Last live default observed by the repository browser, independent of the
+  // selection/discovery snapshot above. NULL means unknown or unavailable.
+  cachedDefaultBranch: string | null
   htmlUrl: string
   addedBy: string | null
   addedAt: number
@@ -86,7 +91,7 @@ export interface ManagedRepo extends SelectedRepo {
 
 // What a caller supplies to select (upsert) a repo; the store stamps the
 // timestamps.
-export type SelectedRepoInput = Omit<SelectedRepo, 'addedAt'>
+export type SelectedRepoInput = Omit<SelectedRepo, 'addedAt' | 'cachedDefaultBranch'>
 
 // A stored report's metadata. The bytes live in the blob-store keyed by `id`;
 // `contentType` + `filename` ride here so a download can label them, `sha256`
@@ -313,7 +318,12 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, StorageDb {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, BundleBuildLeaseStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb {
+  claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
+  finishMaintenanceLease(owner: string, until: number): Promise<void>
+  getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
+  // Reuse connections within a finite request or one feed polling iteration.
+  withRequest?<T>(work: () => Promise<T>): Promise<T>
   // Upsert the identity; returns the user's opaque id (stable across logins).
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
@@ -333,6 +343,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // mutable context while keeping the original added_by/added_at; deselectRepo
   // resolves true iff a row was removed.
   selectRepo(repo: SelectedRepoInput, now: number): Promise<void>
+  cacheRepoDefaultBranch(repo: SelectedRepo, branch: string | null): Promise<boolean>
   connectRepoInstallation(repo: SelectedRepo, installationId: number, sessionId: string, now: number): Promise<boolean>
   deselectRepo(repoId: number): Promise<boolean>
   listSelectedRepos(): Promise<SelectedRepo[]>
@@ -383,6 +394,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // stamp nor the trail. Every change also appends to managed_finding_triage_event;
   // listTriageHistory walks one finding's trail, newest first.
   listTriage(findingIds: readonly string[]): Promise<TriageRow[]>
+  getAnnotations(findingIds: readonly string[]): Promise<{ triage: TriageRow[]; comments: Awaited<ReturnType<CommentStore['listComments']>> }>
   // A content-free fingerprint of current annotations, read in one snapshot.
   getAnnotationRevision(findingIds: readonly string[]): Promise<string>
   setTriage(findingId: string, entry: TriageEntryPatch | null, updatedBy: string | null, updatedByLogin: string | null, now: number): Promise<void>
@@ -399,7 +411,13 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
   resolveBundleUpload(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
+  // One read snapshot of the live session, bundle and grants. Passing a team
+  // (or null for any team) also checks advisory security access; omission skips it.
+  getBundleAccessSnapshot(sessionId: string, now: number, id: string, advisoriesTeamId?: string | null): Promise<{
+    bundle: ManagedBundle | null; canReadAdvisories: boolean
+  } | null>
   listBundles(userId?: string): Promise<AdminBundle[]>
+  listReadableBundleIds(userId: string, ids: readonly string[]): Promise<string[]>
   userCanReadBundle(userId: string, id: string): Promise<boolean>
   userCanReadRepo(userId: string, repoId: number): Promise<boolean>
   userCanReadBundleAdvisories(userId: string, bundleId: string, teamId: string | null): Promise<boolean>
@@ -430,7 +448,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // bundles attached to that team's repos — for that user's own sidebar Teams section.
   // Any user; only their own memberships.
   listTeamsForUser(userId: string): Promise<UserTeam[]>
-  getUserTeamFeedSnapshot(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; revision: string } | null>
+  getUserTeamFeedSnapshot(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; revision: string; teams: UserTeam[]; catalog: number } | null>
   // Whether `userId` may read `reportId`: true iff the report's repo belongs to
   // a team the user is a member of. Backs the team-scoped report view endpoint.
   userCanReadReport(userId: string, reportId: string): Promise<boolean>
@@ -528,6 +546,8 @@ function prepareStatements(db: ManagedSql) {
       WHERE repo_id = ? AND full_name = ? AND added_at = ? AND installation_id IS NULL
         AND EXISTS (SELECT 1 FROM managed_session s JOIN managed_user u ON u.id = s.user_id
           WHERE s.id = ? AND s.expires_at > ? AND u.role = 'admin')`),
+    cacheRepoDefaultBranchStmt: db.prepare(`UPDATE managed_selected_repo SET cached_default_branch = ?
+      WHERE repo_id = ? AND full_name = ? AND added_at = ? AND active = 1`),
     deleteRepoStmt: db.prepare(`DELETE FROM managed_selected_repo WHERE repo_id = ?`),
     deactivateRepoStmt: db.prepare(`UPDATE managed_selected_repo SET active = 0 WHERE repo_id = ? AND active = 1`),
     reactivateRepoStmt: db.prepare(`UPDATE managed_selected_repo SET active = 1 WHERE repo_id = ? AND active = 0`),
@@ -545,13 +565,13 @@ function prepareStatements(db: ManagedSql) {
       UNION SELECT finding_id FROM managed_finding_comment_event WHERE finding_id IN (SELECT value FROM json_each(?))) AS annotations`),
     selectReposStmt: db.prepare(
       `SELECT repo_id AS repoId, full_name AS fullName, is_private AS priv,
-              installation_id AS installId, default_branch AS branch, html_url AS htmlUrl,
+              installation_id AS installId, default_branch AS branch, cached_default_branch AS cachedDefaultBranch, html_url AS htmlUrl,
               added_by AS addedBy, added_at AS addedAt, active AS active
          FROM managed_selected_repo WHERE active = 1 ORDER BY full_name ASC`,
     ),
     selectAllReposStmt: db.prepare(
       `SELECT repo_id AS repoId, full_name AS fullName, is_private AS priv,
-              installation_id AS installId, default_branch AS branch, html_url AS htmlUrl,
+              installation_id AS installId, default_branch AS branch, cached_default_branch AS cachedDefaultBranch, html_url AS htmlUrl,
               added_by AS addedBy, added_at AS addedAt, active AS active
          FROM managed_selected_repo ORDER BY full_name ASC`,
     ),
@@ -717,6 +737,11 @@ function prepareStatements(db: ManagedSql) {
           SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
           WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?))`,
     ),
+    selectReadableBundleIdsStmt: db.prepare(
+      `SELECT b.id FROM managed_bundle b WHERE b.id IN (SELECT value FROM json_each(?)) AND (b.uploaded_by = ? OR EXISTS (
+          SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+          WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?))`,
+    ),
     selectRepoReadableStmt: db.prepare(
       `SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
         WHERE tr.repo_id = ? AND tu.user_id = ? LIMIT 1`,
@@ -842,7 +867,7 @@ function prepareStatements(db: ManagedSql) {
 
 type RepoRow = {
   repoId: number; fullName: string; priv: number; installId: number | null
-  branch: string; htmlUrl: string; addedBy: string | null; addedAt: number; active: number
+  branch: string; cachedDefaultBranch: string | null; htmlUrl: string; addedBy: string | null; addedAt: number; active: number
 }
 
 // The repo-selection slice of ManagedDb, split out to keep openSqliteManagedDb
@@ -852,7 +877,7 @@ function selectedRepoMethods(stmts: ReturnType<typeof prepareStatements>) {
     selectReportsForRepoStmt, selectBundlesForRepoStmt, deleteReportsForRepoStmt, deleteBundlesForRepoStmt } = stmts
   const readRepo = (r: RepoRow): SelectedRepo => ({
     repoId: r.repoId, fullName: r.fullName, private: r.priv === 1,
-    installationId: r.installId, defaultBranch: r.branch, htmlUrl: r.htmlUrl,
+    installationId: r.installId, defaultBranch: r.branch, cachedDefaultBranch: r.cachedDefaultBranch, htmlUrl: r.htmlUrl,
     addedBy: r.addedBy, addedAt: r.addedAt,
   })
   const readManagedRepo = (r: RepoRow): ManagedRepo => ({ ...readRepo(r), active: r.active === 1 })
@@ -863,6 +888,9 @@ function selectedRepoMethods(stmts: ReturnType<typeof prepareStatements>) {
         repo.defaultBranch, repo.htmlUrl, repo.addedBy, now, now,
       )
     },
+    async cacheRepoDefaultBranch(repo: SelectedRepo, branch: string | null): Promise<boolean> {
+      return Number((await stmts.cacheRepoDefaultBranchStmt.run(branch, repo.repoId, repo.fullName, repo.addedAt)).changes) > 0
+    },
     async deselectRepo(repoId: number): Promise<boolean> {
       return Number((await deleteRepoStmt.run(repoId)).changes) > 0
     },
@@ -1046,7 +1074,7 @@ type TriageEventDbRow = TriageStateDbRow & {
 // current row is skipped altogether, so a client re-pushing what already
 // stands neither re-stamps the writer nor echoes into the trail. `historyLimit`
 // > 0 keeps only that many events per finding; 0 keeps everything.
-function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimit: number) {
+function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit: number, db: ManagedSql) {
   const { upsertTriageStmt, selectTriageStmt, selectTriageStateStmt, insertTriageEventStmt, trimTriageEventsStmt, selectTriageHistoryStmt,
     deleteTriageStmt, deleteTriageHistoryStmt, deleteCommentsStmt, deleteCommentHistoryStmt, countAnnotationsStmt } = stmts
   async function writeEntry(findingId: string, entry: TriageEntryPatch | null, batchId: string, updatedBy: string | null, updatedByLogin: string | null, now: number, reportId: string | null = null): Promise<void> {
@@ -1112,7 +1140,43 @@ function triageMethods( stmts: ReturnType<typeof prepareStatements>, historyLimi
       // (and costs one fsync under synchronous = FULL, not one per row); one
       // batch id groups its rows in the trail.
       const batchId = randomUUID()
-      for (const [findingId, entry] of entries) await writeEntry(findingId, entry, batchId, updatedBy, updatedByLogin, now, reportId)
+      if (new Set(entries.map(([id]) => id)).size !== entries.length) {
+        // Preserve the ordered history of callers that supply repeated IDs.
+        for (const [id, entry] of entries) await writeEntry(id, entry, batchId, updatedBy, updatedByLogin, now, reportId)
+        return
+      }
+      const current = new Map((await selectTriageStmt.all(JSON.stringify(entries.map(([id]) => id))) as TriageDbRow[])
+        .map(row => [row.findingId, row]))
+      const changed = entries.flatMap(([id, entry]) => {
+        const e = entry ?? {}, previous = current.get(id)
+        const next = { color: e.color ?? null, triage: e.triage ?? null, comment: e.comment ?? null,
+          fix: e.fix ?? null, flagged: e.flagged == null ? null : e.flagged ? 1 : 0 }
+        if (previous && Object.entries(next).every(([key, value]) => previous[key as keyof TriageStateDbRow] === value)) return []
+        return [[id, next.color, next.triage, next.comment, next.fix, next.flagged]]
+      })
+      // Bound SQL parameters while keeping the entire batch/history atomic.
+      for (let offset = 0; offset < changed.length; offset += 200) {
+        const rows = changed.slice(offset, offset + 200), values = rows.flat()
+        const input = `WITH changes(finding_id, color, triage, comment, fix, flagged, ordinal) AS
+          (VALUES ${rows.map((_, index) => `(?, ?, ?, ?, ?, CAST(? AS INTEGER), ${index})`).join(',')})`
+        await db.prepare(`${input}
+          INSERT INTO managed_finding_triage (finding_id, color, triage, comment, fix, flagged, updated_by, updated_by_login, updated_at)
+          SELECT finding_id, color, triage, comment, fix, flagged, ?, ?, CAST(? AS BIGINT) FROM changes WHERE TRUE
+          ON CONFLICT(finding_id) DO UPDATE SET color = excluded.color, triage = excluded.triage,
+            comment = excluded.comment, fix = excluded.fix, flagged = excluded.flagged, updated_by = excluded.updated_by,
+            updated_by_login = excluded.updated_by_login, updated_at = excluded.updated_at`).run(...values, updatedBy, updatedByLogin, now)
+        await db.prepare(`${input}
+          INSERT INTO managed_finding_triage_event (finding_id, batch_id, color, triage, comment, fix, flagged, actor_id, actor_login, at, report_id, report, repo)
+          SELECT c.finding_id, ?, c.color, c.triage, c.comment, c.fix, c.flagged, ?, ?, CAST(? AS BIGINT), ?, r.filename, p.full_name
+          FROM changes c LEFT JOIN managed_report r ON r.id = ? LEFT JOIN managed_selected_repo p ON p.repo_id = r.repo_id ORDER BY c.ordinal`)
+          .run(...values, batchId, updatedBy, updatedByLogin, now, reportId ?? null, reportId ?? null)
+        if (historyLimit > 0) {
+          await db.prepare(`DELETE FROM managed_finding_triage_event WHERE seq IN (
+          SELECT seq FROM (SELECT seq, ROW_NUMBER() OVER (PARTITION BY finding_id ORDER BY seq DESC) AS position
+            FROM managed_finding_triage_event WHERE finding_id IN (SELECT value FROM json_each(?))) ranked WHERE position > ?)`)
+          .run(JSON.stringify(rows.map(row => row[0])), historyLimit)
+        }
+      }
     },
   }
 }
@@ -1159,6 +1223,23 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
       const row = (await selectBundleStmt.get(id)) as BundleRow | undefined
       return row == null ? null : mapBundle(row)
     },
+    async getBundleAccessSnapshot(sessionId: string, now: number, id: string, advisoriesTeamId?: string | null) {
+      const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
+      if (!session) return null
+      const denied = { bundle: null, canReadAdvisories: false }
+      if (!roleAtLeast(session.role, 'view')) return denied
+      const row = await selectBundleStmt.get(id) as BundleRow | undefined
+      if (!row) return denied
+      const manager = roleAtLeast(session.role, 'manage')
+      if (session.role !== 'admin') {
+        const allowed = manager ? await selectBundleReadableStmt.get(id, session.uid, session.uid)
+          : row.repoId !== null && await selectRepoPathReadableStmt.get(row.repoDirectory, row.repoId, session.uid)
+        if (!allowed) return denied
+      }
+      const canReadAdvisories = manager || (advisoriesTeamId !== undefined
+        && await stmts.selectBundleSecurityStmt.get(id, session.uid, advisoriesTeamId, advisoriesTeamId) != null)
+      return { bundle: mapBundle(row), canReadAdvisories }
+    },
     async listBundles(userId?: string): Promise<AdminBundle[]> {
       const rows = (await selectBundlesStmt.all(userId ?? null, userId ?? null, userId ?? null)) as BundleListRow[]
       return rows.map((r) => ({
@@ -1170,6 +1251,11 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
     async userCanReadBundle(userId: string, id: string): Promise<boolean> {
       return (await selectBundleReadableStmt.get(id, userId, userId)) != null
     },
+    async listReadableBundleIds(userId: string, ids: readonly string[]): Promise<string[]> {
+      if (ids.length === 0) return []
+      const rows = await stmts.selectReadableBundleIdsStmt.all(JSON.stringify([...new Set(ids)]), userId, userId) as { id: string }[]
+      return rows.map(row => row.id)
+    },
     async userCanReadRepo(userId: string, repoId: number): Promise<boolean> {
       return (await selectRepoReadableStmt.get(repoId, userId)) != null
     },
@@ -1195,7 +1281,7 @@ type TeamMemberRow = { teamId: string; userId: string; login: string; viewDepend
 // The team slice of ManagedDb. listTeams reads the three tables in full and
 // groups in JS (3 queries, not N+1) — fine for the handful of teams a managed
 // workspace has.
-function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
+function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql) {
   const {
     insertTeamStmt, selectTeamByNameStmt, renameTeamStmt, deleteTeamStmt, selectTeamStmt,
     selectUserRepoScopesStmt, selectTeamsStmt, selectTeamsForUserStmt, selectUserTeamReportsStmt, selectUserTeamBundlesStmt, selectReportReadableStmt,
@@ -1258,15 +1344,19 @@ function teamMethods( stmts: ReturnType<typeof prepareStatements>) {
         bundles: bundlesByTeam.get(t.id) ?? [],
       }))
     },
+    async getFeedState(sessionId: string, now: number) {
+      const row = await db.prepare(`SELECT u.id, u.role, r.catalog, r.annotations FROM managed_session s
+        JOIN managed_user u ON u.id = s.user_id JOIN managed_change_revision r ON r.id = 1
+        WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, now) as { id: string; role: Role; catalog: number; annotations: number } | undefined
+      return row ? { user: { id: row.id, role: row.role }, catalog: row.catalog, annotations: row.annotations } : null
+    },
     async getUserTeamFeedSnapshot(sessionId: string, now: number) {
       // One short read-only transaction, shared by SQLite and Postgres. Never
       // touch last-seen timestamps or include other users' memberships.
-      const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
-      if (!session) return null
-      const teams = session.role === 'none' ? [] : await methods.listTeamsForUser(session.uid)
-      return { user: { id: session.uid, role: session.role },
-        revision: teamCatalogRevision(teams),
-      }
+      const state = await methods.getFeedState(sessionId, now)
+      if (!state) return null
+      const teams = state.user.role === 'none' ? [] : await methods.listTeamsForUser(state.user.id)
+      return { user: state.user, catalog: state.catalog, teams, revision: teamCatalogRevision(teams) }
     },
     async userCanReadReport(userId: string, reportId: string): Promise<boolean> {
       return (await selectReportReadableStmt.get(reportId, userId)) != null
@@ -1331,14 +1421,23 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const activity = activityMethods(db)
   const stmts = prepareStatements(db)
   const reports = reportMethods(stmts, db, key)
-  const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0)
+  const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0, db)
   const {
     upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectSessionStmt, selectUsersStmt,
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, deleteSessionStmt, deleteExpiredStmt,
   } = stmts
 
-  const methods: Omit<ManagedDb, keyof ManagementStore> = {
+  const methods: Omit<ManagedDb, keyof ManagementStore | keyof ManagementCatalogStore> = {
     ...storageMethods(db, key),
+    ...bundleBuildLeaseMethods(db),
+    async claimMaintenanceLease(owner, now, until, migration = false) {
+      return !!await db.prepare(`INSERT INTO managed_maintenance_lease (id, owner, expires_at) VALUES (?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at
+        WHERE managed_maintenance_lease.expires_at <= ? RETURNING id`).get(migration ? 2 : 1, owner, until, now)
+    },
+    async finishMaintenanceLease(owner, until) {
+      await db.prepare('UPDATE managed_maintenance_lease SET expires_at = ? WHERE owner = ?').run(until, owner)
+    },
     async upsertUser(user, now, initialAdminGithubId = null) {
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
@@ -1401,15 +1500,18 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...selectedRepoMethods(stmts),
     ...activity,
     ...comments,
+    async getAnnotations(ids) {
+      return { triage: await triage.listTriage(ids), comments: await comments.listComments(ids) }
+    },
     ...workspaceShareMethods(db),
     ...reports,
     ...triage,
     ...importTriageMethods({ getReport: reports.getReport, ...triage, ...comments }),
     ...bundleMethods(stmts, db, key),
-    ...teamMethods(stmts),
+    ...teamMethods(stmts, db),
     async close() {
       await db.close()
     },
   }
-  return { ...methods, ...managementMethods(methods) }
+  return { ...methods, ...managementMethods(methods), ...managementCatalogMethods(methods) }
 }