@preventive/triage 1.0.0-alpha.30 → 1.0.0-alpha.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.30",
+  "version": "1.0.0-alpha.32",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -265,8 +265,8 @@
   "dependencies": {
     "@exodus/stasis": "1.0.0-beta.5",
     "@exodus/stasis-core": "1.0.0-beta.5",
-    "@preventive/report": "1.0.0-alpha.4",
-    "@preventive/upstream": "1.0.0-alpha.4",
+    "@preventive/report": "1.0.0-alpha.5",
+    "@preventive/upstream": "1.0.0-alpha.7",
     "ws": "^8.20.1"
   },
   "peerDependencies": {

package/server-common/vercel-blob.ts

@@ -44,6 +44,7 @@ export type VercelBlobSdk = {
       access: 'private' | 'public'
       token?: string
       useCache?: boolean
+      headers?: Record<string, string>
       abortSignal?: AbortSignal
     },
   ) => Promise<{

package/server-managed/index.ts

@@ -21,10 +21,13 @@ const REAP_RETRY_MS = 60_000
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
 export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
-  return await initializeApp(rollback => assembleManagedApp(config, options, rollback))
+  // Load the optional peer only for serverless managed deployments. Embedding
+  // hosts can discard listener promises, so retain maintenance inside the app.
+  const waitUntil = config.serverless ? (await import('@vercel/functions')).waitUntil : undefined
+  return await initializeApp(rollback => assembleManagedApp(config, options, rollback, waitUntil))
 }
 
-async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack) {
+async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
   const storage = await openManagedStorage(config)
   const { db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache } = storage
   rollback.defer(() => db.close())
@@ -87,10 +90,9 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
     return reap(true).catch(err => console.warn('managed-reaper: cleanup failed:', err))
   }
   async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
-    const pendingMaintenance = automaticReap()
-    // Send the normal response without waiting for storage housekeeping. The
-    // Vercel entrypoint registers this whole promise with waitUntil; awaiting
-    // work after res.end() alone cannot extend a serverless invocation.
+    // Register before routing can end the response, including when init()'s
+    // listener is mounted in Fastify rather than using api/managed.ts.
+    const pendingMaintenance = automaticReap(); waitUntil?.(pendingMaintenance)
     try { await routeRequest(req, res) }
     finally { await pendingMaintenance }
   }

package/server-managed/object-storage-vercel.ts

@@ -16,7 +16,10 @@ export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk
     },
     async open(key, signal) {
       try {
-        const result = await blobs.get(path(key), { token, access: 'private', useCache: false, ...(signal ? { abortSignal: signal } : {}) })
+        // Read the stored representation: transport compression can weaken its
+        // ETag, which cannot satisfy ifMatch, and changes the advertised size.
+        const result = await blobs.get(path(key), { token, access: 'private', useCache: false,
+          headers: { 'accept-encoding': 'identity' }, ...(signal ? { abortSignal: signal } : {}) })
         if (!result) return null
         if (result.statusCode !== 200 || !result.stream || !result.blob.etag) {
           await result.stream?.cancel()

package/server-managed/object-storage.ts

@@ -16,6 +16,8 @@ export interface RawObjectStorage {
   // Persist an observed disk replacement before its SQL migration checkpoint.
   sync?(key: string, signal?: AbortSignal): Promise<void>
   // A plaintext size hint selects multipart uploads without buffering streams.
+  // Publish atomically only after consuming the body through clean EOF; a body
+  // error must preserve the existing object (migration verifies while streaming).
   put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string, sizeHint?: number): Promise<boolean>
   // Return false if the original version changed; do not delete its replacement.
   delete(key: string, version?: string, signal?: AbortSignal): Promise<boolean>

package/server-managed/storage-maintenance.ts

@@ -2,7 +2,7 @@ import { type StorageKey, decryptStorageStream, encryptStorageStream } from '../
 import { ENCRYPTED_CACHE_PREFIX, type RawObjectStorage, deleteObjects, isBlobId, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, unwrapDataKey } from './storage-db.ts'
 import { STORAGE_UPLOAD_TTL_MS } from './storage-encryption.ts'
-import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPath, verifyStoragePayload } from './storage-payload.ts'
+import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPath, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
 
 async function replacementFailure(raw: RawObjectStorage, identity: string, version: string, signal: AbortSignal): Promise<string> {
   const format = (value: string) => value.startsWith('W/') ? 'weak' : value.startsWith('"') && value.endsWith('"') ? 'quoted' : 'unquoted'
@@ -20,12 +20,16 @@ async function replacementFailure(raw: RawObjectStorage, identity: string, versi
   return `${reason}; metadata=${format(current.version)}; comparison=${comparison}`
 }
 
-async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey, item: StorageMigrationRow, signal: AbortSignal): Promise<string | void> {
+type MigrationPhase = 'prepare-key' | 'open-payload' | 'verify-existing' | 'encrypt-upload' | 'verify-replacement' | 'checkpoint'
+async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey, item: StorageMigrationRow, signal: AbortSignal,
+  progress: (phase: MigrationPhase) => void): Promise<string | void> {
   if (item.type === 'user') { await db.migrateStorageUserTokens(item.id); return }
+  progress('prepare-key')
   const row = await db.ensureStorageDataKey(item.type, item.id)
   if (!row || row.encrypted) return
   const dataKey = unwrapDataKey(key, item.type, row), identity = storageRowPath(item.type, row)
   try {
+    progress('open-payload')
     const source = await raw.open(identity, signal)
     if (!source) {
       if (!await db.getStorageRow(item.type, item.id)) return
@@ -33,6 +37,7 @@ async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey,
     }
     let inspected = await inspectStorageObject(source)
     if (inspected.encrypted) {
+      progress('verify-existing')
       // A previous PUT may have completed before a timeout or lost SQL ack.
       try {
         const decoded = await decryptStorageStream(inspected.stream, dataKey, identity)
@@ -47,17 +52,19 @@ async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey,
       }
     }
     if (!inspected.encrypted) {
-      await verifyStoragePayload(item.type, row, inspected.stream, signal)
+      progress('encrypt-upload')
       signal.throwIfAborted()
-      const current = await openObjectVersion(raw, identity, source.version, signal)
-      if (!current) return 'Payload disappeared or changed version before encryption'
-      const encrypted = encryptStorageStream(current.stream, dataKey, identity, current.size)
+      const verified = verifiedStoragePayload(item.type, row, inspected.stream, signal)
+      const encrypted = encryptStorageStream(verified, dataKey, identity, inspected.size)
       let replaced: boolean
-      try { replaced = await raw.put(identity, encrypted, signal, source.version, current.size ?? undefined) }
-      finally { encrypted.destroy(); current.stream.destroy() }
+      try { replaced = await raw.put(identity, encrypted, signal, source.version, inspected.size ?? undefined) }
+      // A provider may wrap a request-body error; keep safe payload diagnostics.
+      catch (err) { throw verified.errored ?? err }
+      finally { encrypted.destroy(); verified.destroy(); inspected.stream.destroy(); source.stream.destroy() }
       if (!replaced) return await replacementFailure(raw, identity, source.version, signal)
       // Do not mark the row encrypted until the stored bytes authenticate and
       // match the original upload (including decompression for sourcemaps).
+      progress('verify-replacement')
       const replacement = await raw.open(identity, signal)
       if (!replacement) {
         if (!await db.getStorageRow(item.type, item.id)) return
@@ -69,6 +76,7 @@ async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey,
     signal.throwIfAborted()
     // Another process may have renamed ciphertext but stopped before syncing
     // the directory. Persist the observed rename even on the resume path.
+    progress('checkpoint')
     await raw.sync?.(identity, signal)
     await db.markStorageEncrypted(item.type, item.id, row.dataKey!)
   } finally { dataKey.fill(0) }
@@ -176,8 +184,17 @@ export async function migrateStorage(raw: RawObjectStorage, db: StorageDb, key:
     for (const row of rows) {
       if (Date.now() >= deadline || signal.aborted) break
       console.info('managed-storage-migration-row-start:', JSON.stringify({ type: row.type, id: row.id }))
+      const startedAt = Date.now()
+      let phase: MigrationPhase | 'tokens' = 'tokens'
+      const logPhase = (aborted = false) => console.info('managed-storage-migration-row-phase:', JSON.stringify({
+        type: row.type, id: row.id, phase, elapsedMs: Date.now() - startedAt, ...(aborted ? { aborted: true } : {}),
+      }))
+      // Log directly on cancellation even if an underlying operation stalls
+      // while unwinding. These fixed phases contain no object/provider data.
+      const aborted = () => logPhase(true)
+      signal.addEventListener('abort', aborted, { once: true })
       try {
-        const pending = await migrateRow(raw, db, key, row, signal)
+        const pending = await migrateRow(raw, db, key, row, signal, next => { phase = next; logPhase() })
         if (pending) failures.push(rowFailure(row, pending))
       }
       catch (err) {
@@ -192,6 +209,7 @@ export async function migrateStorage(raw: RawObjectStorage, db: StorageDb, key:
           errors.push(new Error(`Could not migrate ${row.type} ${row.id}`, { cause: err }))
         } else failures.push(rowFailure(row, failure))
       }
+      finally { signal.removeEventListener('abort', aborted) }
       if (stopping?.aborted) break
       await db.advanceStorageMigration(state.cursor, row.position)
       processed++

package/server-managed/storage-payload.ts

@@ -1,6 +1,6 @@
 import { Buffer } from 'node:buffer'
 import { createHash } from 'node:crypto'
-import { Readable, Writable } from 'node:stream'
+import { PassThrough, Readable, Writable } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
 import { createBrotliDecompress } from 'node:zlib'
 import { STORAGE_MAGIC } from '../server-common/storage-crypto.ts'
@@ -70,3 +70,29 @@ export async function verifyStoragePayload(type: StorageRowKind, row: StorageRow
   const actual = type === 'report' ? hash.digest('base64url') : `sha512-${hash.digest('base64')}`
   if (actual !== row.hash) throw new StoragePayloadError('Stored payload does not match its upload hash')
 }
+
+// Forward the stored representation with backpressure, but withhold EOF until
+// its upload hash passes. Encryption cannot emit its final frame, and an atomic
+// PUT cannot commit, until verification (including sourcemap decompression) ends.
+export function verifiedStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal): Readable {
+  const input = new PassThrough(), output = new PassThrough()
+  const verification = verifyStoragePayload(type, row, input, signal)
+  // Propagate asynchronous decompression errors even if the source is stalled.
+  void verification.catch(err => { source.destroy(err); output.destroy(err) })
+  const forwarding = pipeline(source, async function* (chunks) {
+    try {
+      for await (const chunk of chunks) {
+        await new Promise<void>((resolve, reject) => { input.write(chunk, err => err ? reject(err) : resolve()) })
+        yield chunk
+      }
+      input.end()
+      await verification
+    } finally {
+      input.destroy()
+      await verification.catch(() => {})
+    }
+  }, output, signal ? { signal } : {})
+  // pipeline forwards errors to output and tears down input on early cancellation.
+  void forwarding.catch(() => {})
+  return output
+}