@preventive/triage 1.0.0-alpha.3 → 1.0.0-alpha.31

package/server-managed/activity.ts

@@ -0,0 +1,231 @@
+// Persistent workspace activity. Uploads are recorded in the same transaction
+// as their metadata; triage reuses its existing immutable trail, including
+// legacy entries. Never copy annotation bodies or credentials into this feed.
+import { randomUUID } from 'node:crypto'
+import type { DatabaseSync } from 'node:sqlite'
+import type { ManagedSql } from './sql.ts'
+
+export interface ActivityInput {
+  kind: 'access' | 'repository' | 'visibility' | 'delete'
+  actor: string
+  actorId?: string | null
+  action: string
+  repo?: string | null
+  reportId?: string | null
+  bundleId?: string | null
+  repoId?: number | null
+  repoDirectory?: string | null
+  report?: string | null
+}
+
+export interface ActivityContext {
+  finding: string
+  reportId: string
+  report: string
+  repo: string | null
+}
+
+export type ActivityEntry = {
+  id: string; kind: string; actor: string | null; action: string
+  repo: string | null; reportId: string | null; report: string | null
+  finding: string | null; at: number
+}
+
+export interface ActivityQuery {
+  page: number
+  limit: number
+  kind: string
+  query: string
+  repo?: string
+  actor?: string
+  // null = admin; [] = no accessible findings. Context is supplied by the
+  // server, never by the client. It also replaces potentially private context
+  // from an old report carrying the same globally shared finding.
+  contexts: ActivityContext[] | null
+  userId?: string
+}
+
+export interface ActivityFilters {
+  repos: string[]
+  users: { id: string; login: string; detail: string | null }[]
+}
+
+export interface ActivityStore {
+  recordActivity(entry: ActivityInput, at: number): Promise<void>
+  listActivityReports(userId: string): Promise<Omit<ActivityContext, 'finding'>[]>
+  listActivity(query: ActivityQuery): Promise<{ history: ActivityEntry[]; total: number; page: number; limit: number; filters: ActivityFilters }>
+}
+
+const triageFields = `'triage:' || e.seq AS id, 'triage' AS kind,
+  COALESCE(u.login, e.actor_login) AS actor, e.actor_id AS actorId,
+  CASE WHEN e.color IS NULL AND e.triage IS NULL AND e.comment IS NULL AND e.fix IS NULL AND e.flagged IS NULL
+    THEN 'cleared triage' ELSE 'updated triage' END AS action`
+const triage = `SELECT ${triageFields}, e.repo, e.report_id AS reportId, e.report, e.finding_id AS finding, e.at
+  FROM managed_finding_triage_event e LEFT JOIN managed_user u ON u.id = e.actor_id`
+const commentFields = `'comment:' || e.seq AS id, 'triage' AS kind,
+  COALESCE(u.login, e.actor_login) AS actor, e.actor_id AS actorId, e.action`
+const comments = `SELECT ${commentFields}, e.repo, e.report_id AS reportId, e.report, e.finding_id AS finding, e.at
+  FROM managed_finding_comment_event e LEFT JOIN managed_user u ON u.id = e.actor_id`
+const adminSource = `${triage} UNION ALL ${comments} UNION ALL
+  SELECT id, kind, actor, actor_id AS actorId, action, repo, report_id AS reportId, report, NULL AS finding, at FROM managed_activity`
+// Keep the finite set of accessible findings outside the indexed event
+// lookup. Scanning all events against json_each for every row is quadratic.
+const managerSource = `SELECT ${triageFields},
+  json_extract(c.value, '$.repo') AS repo, json_extract(c.value, '$.reportId') AS reportId,
+  json_extract(c.value, '$.report') AS report, e.finding_id AS finding, e.at
+  FROM json_each(:contexts) c
+  CROSS JOIN managed_finding_triage_event e ON e.finding_id = json_extract(c.value, '$.finding')
+  LEFT JOIN managed_user u ON u.id = e.actor_id
+  UNION ALL SELECT ${commentFields},
+    json_extract(c.value, '$.repo') AS repo, json_extract(c.value, '$.reportId') AS reportId,
+    json_extract(c.value, '$.report') AS report, e.finding_id AS finding, e.at
+  FROM json_each(:contexts) c
+  CROSS JOIN managed_finding_comment_event e ON e.finding_id = json_extract(c.value, '$.finding')
+  LEFT JOIN managed_user u ON u.id = e.actor_id
+  UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId,
+    CASE WHEN a.kind = 'repository' THEN 'changed a report repository assignment' ELSE a.action END AS action,
+    p.full_name AS repo, r.id AS reportId, r.filename AS report, NULL AS finding, a.at
+  FROM managed_activity a JOIN managed_report r ON r.id = a.report_id
+  LEFT JOIN managed_selected_repo p ON p.repo_id = r.repo_id
+  WHERE EXISTS (
+    SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+    WHERE tu.user_id = :userId AND tr.repo_id = r.repo_id AND ${withinTeamPath('r.repo_directory')}
+  )
+  UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId,
+    CASE WHEN a.kind = 'repository' THEN 'changed a bundle repository assignment' ELSE a.action END AS action,
+    p.full_name AS repo, NULL AS reportId, b.filename AS report, NULL AS finding, a.at
+  FROM managed_activity a JOIN managed_bundle b ON b.id = a.bundle_id
+  LEFT JOIN managed_selected_repo p ON p.repo_id = b.repo_id
+  WHERE a.report_id IS NULL AND EXISTS (
+    SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+    WHERE tu.user_id = :userId AND tr.repo_id = b.repo_id AND ${withinTeamPath('b.repo_directory')}
+  )
+  UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId, a.action, a.repo, a.report_id AS reportId,
+    a.report, NULL AS finding, a.at FROM managed_activity a
+  WHERE a.kind = 'delete' AND (a.report_id IS NOT NULL OR a.bundle_id IS NOT NULL)
+    AND NOT EXISTS (SELECT 1 FROM managed_report WHERE id = a.report_id)
+    AND NOT EXISTS (SELECT 1 FROM managed_bundle WHERE id = a.bundle_id)
+    AND EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+      WHERE tu.user_id = :userId AND tr.repo_id = a.repo_id
+      AND ${withinTeamPath('a.repo_directory')})`
+
+export const ACTIVITY_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS managed_activity (
+      id TEXT PRIMARY KEY, kind TEXT NOT NULL, actor TEXT, action TEXT NOT NULL,
+      repo TEXT, report_id TEXT, report TEXT, at INTEGER NOT NULL,
+      bundle_id TEXT, repo_id INTEGER, repo_directory TEXT, actor_id TEXT
+    ) STRICT;
+    CREATE INDEX IF NOT EXISTS managed_activity_at_idx ON managed_activity(at, id);
+    CREATE INDEX IF NOT EXISTS finding_triage_event_at_idx ON managed_finding_triage_event(at, seq);
+`
+
+export function initActivityMethods(db: DatabaseSync): void {
+  db.exec(ACTIVITY_SCHEMA)
+  migrateActivityScope(db)
+  db.exec('CREATE INDEX IF NOT EXISTS managed_activity_actor_at_idx ON managed_activity(actor_id, at)')
+  // Stable upload IDs make backfill idempotent, including after restarts.
+  // Snapshots deliberately have no cascading FKs: deletion is itself activity.
+  for (const type of ['report', 'bundle']) {
+    const columns = `id, kind, actor, action, repo, report_id, report, at, bundle_id, actor_id`
+    const values = (alias: string) => `'${type}-upload:' || ${alias}.id, 'upload',
+      COALESCE(${alias}.uploaded_by_login, (SELECT login FROM managed_user WHERE id = ${alias}.uploaded_by)), 'uploaded a ${type}',
+      (SELECT full_name FROM managed_selected_repo WHERE repo_id = ${alias}.repo_id),
+      ${type === 'report' ? `${alias}.id` : 'NULL'}, ${alias}.filename, ${alias}.uploaded_at,
+      ${type === 'bundle' ? `${alias}.id` : 'NULL'}, ${alias}.uploaded_by`
+    db.exec(`
+      CREATE TRIGGER IF NOT EXISTS managed_${type}_activity AFTER INSERT ON managed_${type}
+      BEGIN INSERT INTO managed_activity (${columns}) SELECT ${values('NEW')}; END;
+      INSERT OR IGNORE INTO managed_activity (${columns}) SELECT ${values('source')} FROM managed_${type} source;
+    `)
+  }
+}
+
+export function activityMethods(db: ManagedSql): ActivityStore {
+  const insert = db.prepare(`INSERT INTO managed_activity (id, kind, actor, action, repo, report_id, report, at, bundle_id, repo_id, repo_directory, actor_id)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+  const admin = activityStatements(db, adminSource)
+  const manager = activityStatements(db, managerSource)
+  const reports = db.prepare(`SELECT r.id AS reportId, r.filename AS report, p.full_name AS repo
+    FROM managed_report r JOIN managed_selected_repo p ON p.repo_id = r.repo_id
+    WHERE EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+      WHERE tu.user_id = ? AND tr.repo_id = r.repo_id AND ${withinTeamPath('r.repo_directory')})
+    ORDER BY r.uploaded_at DESC, r.id`)
+  return {
+    async recordActivity(entry, at) {
+      await insert.run(randomUUID(), entry.kind, entry.actor, entry.action, entry.repo ?? null, entry.reportId ?? null, entry.report ?? null, at,
+        entry.bundleId ?? null, entry.repoId ?? null, entry.repoDirectory ?? null, entry.actorId ?? null)
+    },
+    async listActivityReports(userId) {
+      return (await reports.all(userId)) as Omit<ActivityContext, 'finding'>[]
+    },
+    async listActivity({ page, limit, kind, query, repo = '', actor = '', contexts, userId }) {
+      const stmts = contexts == null ? admin : manager
+      const scope = contexts == null ? {} : { contexts: JSON.stringify(contexts), userId: userId ?? '' }
+      const params = { ...scope, kind, query, repo, actor }
+      const { total } = (await stmts.count.get(params)) as { total: number }
+      const currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
+      const history = (await stmts.rows.all({ ...params, limit, offset: (currentPage - 1) * limit })) as ActivityEntry[]
+      const filters: ActivityFilters = {
+        repos: ((await stmts.repos.all(scope)) as { repo: string }[]).map(row => row.repo),
+        users: ((await stmts.users.all(scope)) as ActivityFilters['users']).map(row => ({ id: row.id, login: row.login, detail: row.detail })),
+      }
+      return { history, total, page: currentPage, limit, filters }
+    },
+  }
+}
+
+// Both rows and selector choices come from the authorized source. Keep legacy
+// login-only actors separate: a historical login is not proof of user identity.
+function activityStatements(db: ManagedSql, source: string) {
+  const activity = `WITH events AS (${source}), activity AS (
+    SELECT events.*, COALESCE('user:' || actorId, 'legacy:' || actor) AS actorKey FROM events
+  )`
+  const filtered = `${activity} SELECT id, kind, actor, action, repo, reportId, report, finding, at FROM activity
+    WHERE (:kind = 'all' OR kind = :kind)
+    AND (:repo = '' OR repo = :repo) AND (:actor = '' OR actorKey = :actor)
+    AND (:query = '' OR instr(lower(coalesce(actor, '') || ' ' || action || ' ' ||
+      coalesce(repo, '') || ' ' || coalesce(report, '') || ' ' || coalesce(finding, '')), lower(:query)) > 0)`
+  return {
+    count: db.prepare(`SELECT count(*) AS total FROM (${filtered}) AS filtered`),
+    rows: db.prepare(`${filtered} ORDER BY at DESC,
+      CASE WHEN kind = 'triage' THEN CAST(substr(id, instr(id, ':') + 1) AS INTEGER) ELSE 0 END DESC,
+      id DESC LIMIT :limit OFFSET :offset`),
+    repos: db.prepare(`${activity} SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '' ORDER BY repo`),
+    users: db.prepare(`${activity} SELECT a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
+      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail FROM (
+        SELECT actorKey, actorId, actor, ROW_NUMBER() OVER (PARTITION BY actorKey ORDER BY at DESC, id DESC) AS position
+        FROM activity WHERE actorKey IS NOT NULL AND actorKey <> 'legacy:'
+      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1 ORDER BY login, a.actorKey`),
+  }
+}
+
+// Literal path comparison preserves separators, case and SQL wildcard chars.
+function withinTeamPath(path: string): string {
+  return `(tr.path IS NULL OR tr.path = '' OR ${path} = tr.path OR substr(${path}, 1, length(tr.path) + 1) = tr.path || '/')`
+}
+
+function migrateActivityScope(db: DatabaseSync): void {
+  const columns = new Set((db.prepare('PRAGMA table_info(managed_activity)').all() as { name: string }[]).map(column => column.name))
+  const missing = [['bundle_id', 'TEXT'], ['repo_id', 'INTEGER'], ['repo_directory', 'TEXT'], ['actor_id', 'TEXT']].filter(([name]) => !columns.has(name!))
+  if (missing.length === 0) return
+  db.exec('BEGIN')
+  try {
+    for (const [name, type] of missing) db.exec(`ALTER TABLE managed_activity ADD COLUMN ${name} ${type}`)
+    if (!columns.has('bundle_id') || !columns.has('actor_id')) {
+      db.exec('DROP TRIGGER IF EXISTS managed_report_activity; DROP TRIGGER IF EXISTS managed_bundle_activity;')
+    }
+    if (!columns.has('bundle_id')) db.exec("UPDATE managed_activity SET bundle_id = substr(id, 15) WHERE id LIKE 'bundle-upload:%'")
+    if (!columns.has('actor_id')) {
+      // Existing upload targets retain a reliable uploader identity. Do not
+      // guess identities from historical logins: names can change or be reused.
+      for (const type of ['report', 'bundle']) {
+        db.exec(`UPDATE managed_activity SET actor_id = (
+          SELECT uploaded_by FROM managed_${type} WHERE id = substr(managed_activity.id, 15)
+        ) WHERE id LIKE '${type}-upload:%'`)
+      }
+    }
+    // Legacy deletions/assignments without a durable target/scope remain
+    // admin-only; neither filenames nor repository names authorize access.
+    db.exec('COMMIT')
+  } catch (err) { db.exec('ROLLBACK'); throw err }
+}

package/server-managed/avatar-store.ts

@@ -0,0 +1,12 @@
+// Shared avatar cache interface, implemented by storage-stores.ts.
+import type { Buffer } from 'node:buffer'
+
+export interface CachedAvatar {
+  contentType: string
+  bytes: Buffer
+}
+
+export interface AvatarStore {
+  put(id: string, contentType: string, bytes: Buffer): Promise<void>
+  get(id: string): Promise<CachedAvatar | null>
+}

package/server-managed/blob-store.ts

@@ -0,0 +1,17 @@
+// Logical upload-store interfaces shared by disk and Vercel storage.
+import type { Buffer } from 'node:buffer'
+import type { Readable } from 'node:stream'
+
+export interface OpenedBlob {
+  // Remote streams may omit their size; callers then omit Content-Length.
+  size: number | null
+  stream: Readable
+}
+
+export interface BlobStore {
+  // Encrypted upload stores return the wrapped data key for the SQL insert.
+  put(id: string, bytes: Buffer): Promise<string | null>
+  get(id: string): Promise<Buffer | null>
+  open(id: string): Promise<OpenedBlob | null>
+  delete(id: string): Promise<void>
+}

package/server-managed/brotli.ts

@@ -0,0 +1,10 @@
+import { brotliCompress, constants } from 'node:zlib'
+import { promisify } from 'node:util'
+import type { Buffer } from 'node:buffer'
+
+const compress = promisify(brotliCompress)
+
+// Quality 4 avoids Brotli's expensive default (11) for uploads and cold caches.
+export function encodeBrotli(bytes: Uint8Array): Promise<Buffer> {
+  return compress(bytes, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } })
+}

package/server-managed/bundle-advisories.ts

@@ -0,0 +1,53 @@
+import { type Advisory, type Package, advisories } from '@preventive/upstream/advisories.js'
+import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
+
+export const ADVISORIES_TIMEOUT_MS = 30_000
+
+function advisoryGithubClient(token: string | null, signal: AbortSignal): Client {
+  const authenticated = createClient({ token, userAgent: 'deepview-triage' })
+  if (token === null) return authenticated
+  let client = authenticated
+  return {
+    ...authenticated,
+    async listRepoAdvisories(options) {
+      const current = client
+      try { return await current.listRepoAdvisories(options) } catch (error) {
+        if (current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
+        signal.throwIfAborted()
+        // Published advisories remain readable after a token is revoked. Reuse
+        // anonymous access for subsequent repositories in this audit as well.
+        if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
+        return client.listRepoAdvisories(options)
+      }
+    },
+  }
+}
+
+// The managed caller supplies its user's token when available; public shares
+// remain anonymous. Upstream sends this credential only to GitHub and returns
+// published advisories, matching versions across npm, OSV and repository rows.
+export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
+  { debug = false, repoAdvisories = false, githubToken = null }: { debug?: boolean; repoAdvisories?: boolean; githubToken?: string | null } = {}): Promise<
+  { status: 200; body: Advisory[] } | { status: 502; body: { error: string } }
+> {
+  let onAbort: (() => void) | undefined
+  try {
+    signal.throwIfAborted()
+    if (packages.length === 0) return { status: 200, body: [] }
+    // Upstream owns each transport's timeout and exposes no cancellation
+    // option. Bound the caller's wait for the multi-request audit as well.
+    const deadline = new Promise<never>((_resolve, reject) => {
+      onAbort = () => reject(signal.reason)
+      signal.addEventListener('abort', onAbort, { once: true })
+    })
+    const result = await Promise.race([
+      advisories(packages, { github: advisoryGithubClient(githubToken, signal), repoAdvisories }), deadline,
+    ])
+    return { status: 200, body: result }
+  } catch (error) {
+    if (debug) console.warn('managed: advisories failed:', error)
+    return { status: 502, body: { error: 'upstream-unavailable' } }
+  } finally {
+    if (onAbort) signal.removeEventListener('abort', onAbort)
+  }
+}

package/server-managed/bundle-advisory-inventory.ts

@@ -0,0 +1,75 @@
+import type { Package } from '@preventive/upstream/advisories.js'
+import { satisfies, valid } from '@preventive/upstream/semver.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+
+export interface SkippedAdvisoryPackage {
+  ecosystem: string
+  name: string
+  version: string
+  because: string
+}
+export interface BundleAdvisoryInventory { packages: Package[]; skipped: SkippedAdvisoryPackage[] }
+interface BundleModule { ecosystem?: string; name?: string; version?: string; files: Record<string, unknown> }
+
+// Match Stasis's audit evidence rules, including their verified version bounds:
+// https://github.com/PreventiveMeasures/stasis/blob/2bd4c14354da9888c00ab45fa89740413099b5dc/stasis/src/audit-corrections.js
+// Keep this on the server: upstream's semver implementation uses Node's npm.
+const cargoManifests = ['Cargo.toml', 'Cargo.lock', '.cargo-checksum.json']
+const solidityManifests = ['package.json', 'foundry.toml', 'remappings.txt', 'soldeer.toml']
+const manifests = new Map([
+  ['npm', ['package.json']],
+  ['cargo', cargoManifests], ['cargo-git', cargoManifests], ['cargo-unknown', cargoManifests],
+  ['composer', ['composer.json', 'composer.lock']],
+  ['soldeer', solidityManifests], ['github', solidityManifests],
+])
+const browserStubRanges = new Map([['ws', '<=8.21.1'], ['node-fetch', '<=2.7.0']])
+
+function isEvidence(ecosystem: string, name: string, version: string, file: string): boolean {
+  if (manifests.get(ecosystem)?.includes(file.slice(file.lastIndexOf('/') + 1))) return false
+  const stubRange = ecosystem === 'npm' && file === 'browser.js' ? browserStubRanges.get(name) : undefined
+  return !stubRange || !valid(version) || !satisfies(version, stubRange)
+}
+
+function supported(ecosystem: string): ecosystem is Package['ecosystem'] {
+  return ['npm', 'cargo', 'composer', 'soldeer', 'github'].includes(ecosystem)
+}
+
+function skipReason(ecosystem: string, version: string): string | undefined {
+  if (ecosystem === 'cargo-git') return 'Crate vendored from git; its identity is not a crates.io package.'
+  if (ecosystem === 'cargo-unknown') return 'Crate source is unknown because .cargo-checksum.json is missing.'
+  if (ecosystem === 'composer' && /^dev-|-dev$/iu.test(version.replace(/#.*$/su, ''))) return 'Composer dev versions cannot be matched against release advisories.'
+  return undefined
+}
+
+// Package and reason presence both require a recorded evidence file. Entry and
+// manually added files count even when they have no incoming import edge.
+export function bundleAdvisoryInventory(details: BundleDetails, paths: Iterable<string> | null = null): BundleAdvisoryInventory {
+  const modules = (details.bundle as { modules?: ReadonlyMap<string, BundleModule> } | undefined)?.modules
+  if (details.kind !== 'stasis' || !modules) return { packages: [], skipped: [] }
+  const selected = paths === null ? null : new Set(paths)
+  const packages = new Map<string, { ecosystem: Package['ecosystem']; name: string; versions: Set<string> }>()
+  const skipped = new Map<string, SkippedAdvisoryPackage>()
+  for (const [dir, info] of modules) {
+    if (dir === '.') continue
+    const ecosystem = info.ecosystem ?? (/(?:^|\/)node_modules\//u.test(dir) ? 'npm' : undefined)
+    const { name, version } = info
+    if (ecosystem === undefined || typeof name !== 'string' || !name || typeof version !== 'string' || !version) continue
+    if (!Object.keys(info.files).some(file => (!selected || selected.has(`${dir}/${file}`)) && isEvidence(ecosystem, name, version, file))) continue
+    const because = skipReason(ecosystem, version)
+    if (!supported(ecosystem) || because !== undefined) {
+      skipped.set(JSON.stringify([ecosystem, name, version]), { ecosystem, name, version, because: because ?? `No advisory source is supported for ${ecosystem}.` })
+      continue
+    }
+    // Foundry's branch '.' means the superproject's branch. As in Stasis,
+    // 0.0.0 tells upstream its actual version is unknown, so every range covers it.
+    const auditedVersion = ecosystem === 'github' && version === '.' ? '0.0.0' : version
+    const key = JSON.stringify([ecosystem, ecosystem === 'github' ? name.toLowerCase() : name])
+    if (!packages.has(key)) packages.set(key, { ecosystem, name, versions: new Set() })
+    packages.get(key)!.versions.add(auditedVersion)
+  }
+  const byPackage = (a: { ecosystem: string; name: string }, b: { ecosystem: string; name: string }) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name)
+  return {
+    packages: [...packages.values()].map(pkg => ({ ...pkg, versions: [...pkg.versions].toSorted() })).toSorted(byPackage),
+    skipped: [...skipped.values()].toSorted((a, b) => byPackage(a, b) || a.version.localeCompare(b.version)),
+  }
+}

package/server-managed/bundle-build-diagnostics.d.ts

@@ -0,0 +1,10 @@
+export interface BundleBuildDiagnostic {
+  message: string
+  name?: string
+  code?: string
+  status?: number
+  stack?: string
+  cause?: BundleBuildDiagnostic
+}
+export function bundleBuildDiagnostic(error: unknown, token: string | null): BundleBuildDiagnostic
+export type BundleBuildStage = 'worker-start' | 'build' | 'scope' | 'serialize' | 'compress'

package/server-managed/bundle-build-diagnostics.js

@@ -0,0 +1,23 @@
+// Whitelist diagnostic fields; never inspect/serialize an entire upstream
+// error, request, response, or workerData (which contains the GitHub token).
+export function bundleBuildDiagnostic(error, token, depth = 0) {
+  const redact = value => {
+    let text = String(value)
+    if (token) text = text.replaceAll(token, '[redacted]')
+    return text.replaceAll(/\b(?:github_pat_|gh[pousr]_)[\w]+/gu, '[redacted]')
+      .replaceAll(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gu, '$1[redacted]@')
+      .replaceAll(/([?&](?:access_token|token|key)=)[^\s&#]*/giu, '$1[redacted]')
+  }
+  if (!error || typeof error !== 'object') return { message: redact(error).slice(0, 2048) }
+  // Upstream HttpError messages append the response body after the status.
+  // Keep the method, URL and status, but omit that body from message and stack.
+  const raw = typeof error.message === 'string' ? error.message : 'Unknown error'
+  const message = error.name === 'HttpError' ? raw.replace(/(\s\d{3}):[\s\S]*$/u, '$1') : raw
+  const result = { message: redact(message).slice(0, 2048) }
+  if (typeof error.name === 'string') result.name = redact(error.name).slice(0, 128)
+  if (typeof error.code === 'string') result.code = redact(error.code).slice(0, 128)
+  if (typeof error.status === 'number') result.status = error.status
+  if (typeof error.stack === 'string') result.stack = redact(error.stack.replace(raw, message)).slice(0, 8192)
+  if (error.cause && depth < 3) result.cause = bundleBuildDiagnostic(error.cause, token, depth + 1)
+  return result
+}

package/server-managed/bundle-build-leases.ts

@@ -0,0 +1,41 @@
+import type { ManagedSql } from './sql.ts'
+
+export const BUNDLE_BUILD_TIMEOUT_MS = 180_000
+// Leave time to terminate a timed-out worker before a crashed owner's slot
+// becomes reusable. Expiration uses the database clock, not an instance's clock.
+const LEASE_MS = BUNDLE_BUILD_TIMEOUT_MS + 60_000
+export const BUNDLE_BUILD_LEASE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_bundle_build_lease (
+  slot INTEGER PRIMARY KEY CHECK (slot IN (1, 2)),
+  owner TEXT NOT NULL UNIQUE,
+  user_id TEXT NOT NULL UNIQUE,
+  expires_at INTEGER NOT NULL
+) STRICT;
+`
+
+export interface BundleBuildLeaseStore {
+  claimBundleBuildLease(userId: string, owner: string): Promise<boolean>
+  releaseBundleBuildLease(owner: string): Promise<void>
+}
+
+export function bundleBuildLeaseMethods(db: ManagedSql): BundleBuildLeaseStore {
+  return {
+    // scopeManagedMethods holds SQLite's write transaction / PostgreSQL's
+    // advisory transaction lock across cleanup, inspection, and admission.
+    async claimBundleBuildLease(userId, owner) {
+      const { now } = await db.prepare("SELECT CAST(unixepoch('subsec') * 1000 AS INTEGER) AS now").get() as { now: number }
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE expires_at <= ?').run(now)
+      const leases = await db.prepare('SELECT slot, user_id AS userId FROM managed_bundle_build_lease').all() as { slot: number; userId: string }[]
+      if (leases.length >= 2 || leases.some(lease => lease.userId === userId)) return false
+      const slot = leases.some(lease => lease.slot === 1) ? 2 : 1
+      await db.prepare('INSERT INTO managed_bundle_build_lease (slot, owner, user_id, expires_at) VALUES (?, ?, ?, ?)')
+        .run(slot, owner, userId, now + LEASE_MS)
+      return true
+    },
+    // No user FK: deleting an account must not free a still-running worker's
+    // slot. A delayed/crashed owner's cleanup cannot release its successor.
+    async releaseBundleBuildLease(owner) {
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE owner = ?').run(owner)
+    },
+  }
+}

package/server-managed/bundle-build-worker.js

@@ -0,0 +1,54 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { Buffer } from 'node:buffer'
+import { posix } from 'node:path'
+import { brotliCompressSync } from 'node:zlib'
+import { buildGitHubBundle } from '@exodus/stasis/vfs-bundle'
+import { brotliOptions } from '@exodus/stasis-core/brotli'
+import { HttpError, createClient } from '@preventive/upstream/github.js'
+import { githubBundleFilename } from './bundle-build.ts'
+import { bundleBuildDiagnostic } from './bundle-build-diagnostics.js'
+
+export async function buildStasisBundle({ input, github, token, maxBytes, scopes }, client = createClient({ token }), progress = () => {}) {
+  const allowed = path => scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))
+  // Stasis/upstream cache writes are disabled by default; this fresh worker
+  // never enables a cache directory or inherits application credentials.
+  progress('build')
+  const { bundle } = await buildGitHubBundle({
+    github, sha: input.commit, directory: input.directory || undefined,
+    entries: input.entries.map(entry => posix.relative(input.directory || '.', entry)),
+    ...input.options, client,
+  })
+  const directory = bundle.repo?.directory ?? ''
+  progress('scope')
+  // A workspace lockfile may widen the build root. Never publish it under a
+  // narrower team grant: the storage location must cover the actual bundle.
+  if (!allowed(directory)) throw new Error('build-scope')
+  progress('serialize')
+  const serialized = bundle.serialize()
+  if (Buffer.byteLength(serialized) > 200 * 1024 * 1024) throw new Error('too-large')
+  progress('compress')
+  const bytes = brotliCompressSync(serialized, brotliOptions())
+  if (bytes.length > maxBytes) throw new Error('too-large')
+  return { bytes, directory, filename: githubBundleFilename(github, input.directory, input.commit) }
+}
+
+if (parentPort && workerData?.type === 'managed-bundle-build') {
+  // Send diagnostics to the request's parent thread, which writes them before
+  // returning the HTTP response. Worker stdout can be lost on termination.
+  const send = message => {
+    // Node worker messages have no browser target origin.
+    // oxlint-disable-next-line unicorn/require-post-message-target-origin
+    parentPort.postMessage(message)
+  }
+  try {
+    send(await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage })))
+  } catch (error) {
+    const diagnostic = bundleBuildDiagnostic(error, workerData.token)
+    // Do not return upstream bodies or paths outside the caller's grants.
+    const code = ['build-scope', 'too-large'].includes(diagnostic.message) ? diagnostic.message
+      : error instanceof HttpError ? (error.status === 429 ? 'github-rate-limited' : 'github-build-failed')
+        : /no packageManager given|lockfile installs/u.test(diagnostic.message) ? 'build-lockfile'
+          : 'build-failed'
+    send({ error: code, status: code === 'too-large' ? 413 : code === 'build-scope' ? 403 : 422, diagnostic })
+  }
+}