@preventive/triage 1.0.0-alpha.31 → 1.0.0-alpha.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.31",
+  "version": "1.0.0-alpha.33",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -139,6 +139,7 @@
     "server-managed/report-migration.ts",
     "server-managed/report-query.ts",
     "server-managed/report-response.ts",
+    "server-managed/report-store.ts",
     "server-managed/report-sources.ts",
     "server-managed/revisions.ts",
     "server-managed/repository-browser.ts",
@@ -266,7 +267,7 @@
     "@exodus/stasis": "1.0.0-beta.5",
     "@exodus/stasis-core": "1.0.0-beta.5",
     "@preventive/report": "1.0.0-alpha.5",
-    "@preventive/upstream": "1.0.0-alpha.7",
+    "@preventive/upstream": "1.0.0-alpha.8",
     "ws": "^8.20.1"
   },
   "peerDependencies": {

package/server-managed/brotli.ts

@@ -4,7 +4,7 @@ import type { Buffer } from 'node:buffer'
 
 const compress = promisify(brotliCompress)
 
-// Quality 4 avoids Brotli's expensive default (11) for uploads and cold caches.
-export function encodeBrotli(bytes: Uint8Array): Promise<Buffer> {
-  return compress(bytes, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } })
+// Bundles and cold caches use quality 4; stored reports use quality 9.
+export function encodeBrotli(bytes: Uint8Array, quality = 4): Promise<Buffer> {
+  return compress(bytes, { params: { [constants.BROTLI_PARAM_QUALITY]: quality } })
 }

package/server-managed/config.ts

@@ -44,7 +44,7 @@ export interface ManagedConfig {
   githubAppSlug: string | null
   githubNewIssueLabels?: string
   // Max accepted size (bytes) for an uploaded report on the "Manage reports"
-  // page. Reports are findings dumps (JSON / markdown / CSV), small to a few MB.
+  // page, before storage compression (default 25 MiB).
   maxReportBytes: number
   // Max accepted size (bytes) for an uploaded bundle (sourcemap / stasis
   // archive). Bundles run larger than reports, so a higher cap (default 200 MiB).
@@ -135,7 +135,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,
     githubNewIssueLabels: env['GITHUB_NEW_ISSUE_LABELS'] ?? '',
-    maxReportBytes: intEnv('MAX_REPORT_BYTES', 10_485_760, 1, 104_857_600),
+    maxReportBytes: intEnv('MAX_REPORT_BYTES', 26_214_400, 1, 104_857_600),
     maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, MAX_UPLOAD_BYTES),
     triageHistoryLimit: intEnv('TRIAGE_HISTORY_LIMIT', 0, 0, 1_000_000_000),
   }

package/server-managed/db-methods.ts

@@ -312,6 +312,7 @@ export interface UserTeam {
   id: string
   slug: string
   name: string
+  permissions: TeamUserPermissions
   cacheKey?: string
   reports: UserTeamReport[]
   bundles: UserTeamBundle[]
@@ -1337,6 +1338,7 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
       }
       return teams.map((t) => ({
         id: t.id, slug: t.slug, name: t.name,
+        permissions: { dependencies: t.dependencies === 1, security: t.security === 1 },
         cacheKey: createHash('sha256').update(JSON.stringify([
           t.dependencies, t.security, scopes.filter(scope => scope.teamId === t.id),
         ])).digest('base64url'),

package/server-managed/index.ts

@@ -21,10 +21,13 @@ const REAP_RETRY_MS = 60_000
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
 export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
-  return await initializeApp(rollback => assembleManagedApp(config, options, rollback))
+  // Load the optional peer only for serverless managed deployments. Embedding
+  // hosts can discard listener promises, so retain maintenance inside the app.
+  const waitUntil = config.serverless ? (await import('@vercel/functions')).waitUntil : undefined
+  return await initializeApp(rollback => assembleManagedApp(config, options, rollback, waitUntil))
 }
 
-async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack) {
+async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
   const storage = await openManagedStorage(config)
   const { db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache } = storage
   rollback.defer(() => db.close())
@@ -87,10 +90,9 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
     return reap(true).catch(err => console.warn('managed-reaper: cleanup failed:', err))
   }
   async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
-    const pendingMaintenance = automaticReap()
-    // Send the normal response without waiting for storage housekeeping. The
-    // Vercel entrypoint registers this whole promise with waitUntil; awaiting
-    // work after res.end() alone cannot extend a serverless invocation.
+    // Register before routing can end the response, including when init()'s
+    // listener is mounted in Fastify rather than using api/managed.ts.
+    const pendingMaintenance = automaticReap(); waitUntil?.(pendingMaintenance)
     try { await routeRequest(req, res) }
     finally { await pendingMaintenance }
   }

package/server-managed/object-storage-disk.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto'
-import { lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
+import { link, lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import { type ObjectPage, type RawObjectStorage, objectPath } from './object-storage.ts'
 
@@ -100,11 +100,15 @@ export function createDiskObjectStorage(dir: string): RawObjectStorage {
         await file.writeFile(bytes, signal ? { signal } : {})
         await file.sync(); await file.close()
         signal?.throwIfAborted()
-        if (expected !== undefined) {
+        if (expected === null) {
+          try { await link(temp, target) }
+          catch (err) { if ((err as NodeJS.ErrnoException).code === 'EEXIST') return false; throw err }
+        } else if (expected === undefined) await rename(temp, target)
+        else {
           try { if (version(await stat(target)) !== expected) return false }
           catch (err) { if (missing(err)) return false; throw err }
+          await rename(temp, target)
         }
-        await rename(temp, target)
         await syncDirectory(dirname(target))
         return true
       } finally { await file.close(); await rm(temp, { force: true }) }

package/server-managed/object-storage-vercel.ts

@@ -6,7 +6,7 @@ import { type RawObjectStorage, objectPath } from './object-storage.ts'
 export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk): Promise<RawObjectStorage> {
   const blobs = sdk ?? await loadVercelBlobSdk()
   const path = (key: string) => `.managed/${objectPath(key)}`
-  return {
+  const storage: RawObjectStorage = {
     async head(key, signal) {
       try {
         const meta = await blobs.head(path(key), { token, ...(signal ? { abortSignal: signal } : {}) })
@@ -32,11 +32,14 @@ export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk
     },
     async put(key, bytes, signal, expected, sizeHint) {
       const multipart = (sizeHint ?? (Buffer.isBuffer(bytes) ? bytes.length : Infinity)) >= 5 * 1024 * 1024
-      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: true,
+      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: expected !== null,
         ...(expected ? { ifMatch: expected } : {}), multipart, contentType: 'application/octet-stream', cacheControlMaxAge: 60, ...(signal ? { abortSignal: signal } : {}) })
         return true
       } catch (err) {
         if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        // The SDK uses a generic error for an occupied pathname. Reconcile a
+        // create-only failure against storage; the caller verifies the winner.
+        if (expected === null && await storage.head(key, signal)) return false
         throw err
       }
     },
@@ -60,4 +63,5 @@ export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk
       cursor: page.hasMore ? page.cursor! : null }
     },
   }
+  return storage
 }

package/server-managed/object-storage.ts

@@ -16,7 +16,10 @@ export interface RawObjectStorage {
   // Persist an observed disk replacement before its SQL migration checkpoint.
   sync?(key: string, signal?: AbortSignal): Promise<void>
   // A plaintext size hint selects multipart uploads without buffering streams.
-  put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string, sizeHint?: number): Promise<boolean>
+  // Publish atomically only after consuming the body through clean EOF; a body
+  // error must preserve the existing object (migration verifies while streaming).
+  // A null expected version creates only if absent, without replacing a winner.
+  put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string | null, sizeHint?: number): Promise<boolean>
   // Return false if the original version changed; do not delete its replacement.
   delete(key: string, version?: string, signal?: AbortSignal): Promise<boolean>
   list(prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage>
@@ -25,7 +28,7 @@ export interface ObjectStorage {
   open(key: string): Promise<OpenedBlob | null>
   get(key: string): Promise<Buffer | null>
   exists(key: string): Promise<boolean>
-  put(key: string, bytes: Buffer): Promise<string | null>
+  put(key: string, bytes: Buffer, options?: { replaceReport?: boolean }): Promise<string | null>
   delete(key: string): Promise<void>
   deletePrefix(prefix: string): Promise<void>
 }

package/server-managed/report-store.ts

@@ -0,0 +1,47 @@
+// Compress before the object-storage encryption boundary. Separate paths let
+// legacy arbitrary report bytes remain readable without format sniffing.
+import { Buffer } from 'node:buffer'
+import { Readable } from 'node:stream'
+import { pipeline } from 'node:stream/promises'
+import { createBrotliDecompress } from 'node:zlib'
+import type { BlobStore, OpenedBlob } from './blob-store.ts'
+import { encodeBrotli } from './brotli.ts'
+
+async function readBytes(stored: OpenedBlob): Promise<Buffer> {
+  const parts: Buffer[] = []
+  try {
+    for await (const part of stored.stream) parts.push(Buffer.from(part))
+    return Buffer.concat(parts)
+  } finally { stored.stream.destroy() }
+}
+
+export function createReportStore(legacy: BlobStore, compressed: BlobStore,
+  replaceLegacy: (id: string, bytes: Buffer) => Promise<unknown>): BlobStore {
+  async function open(id: string): Promise<OpenedBlob | null> {
+    // Keep the original available until conversion succeeds. Concurrent reads
+    // can finish using an already-open stream while another reader converts it.
+    const original = await legacy.open(id)
+    if (original) {
+      const bytes = await readBytes(original)
+      await replaceLegacy(id, await encodeBrotli(bytes, 9))
+      return { size: bytes.length, stream: Readable.from([bytes]) }
+    }
+    const stored = await compressed.open(id)
+    if (!stored) return null
+    const stream = createBrotliDecompress()
+    // pipeline carries storage/authentication errors into the decoded stream
+    // and closes the stored source when a reader leaves before EOF.
+    void pipeline(stored.stream, stream).catch(() => {})
+    return { size: null, stream }
+  }
+  return {
+    put: async (id, bytes) => compressed.put(id, await encodeBrotli(bytes, 9)),
+    open,
+    async get(id) {
+      const stored = await open(id)
+      if (!stored) return null
+      return readBytes(stored)
+    },
+    async delete(id) { await Promise.all([compressed.delete(id), legacy.delete(id)]) },
+  }
+}

package/server-managed/storage-encryption.ts

@@ -4,7 +4,7 @@ import { Readable } from 'node:stream'
 import { type StorageKey, decryptStorageStream, encryptStorageStream, wrapStorageValue } from '../server-common/storage-crypto.ts'
 import { ENCRYPTED_CACHE_PREFIX, type ObjectStorage, type RawObject, type RawObjectStorage, deleteObjects, objectPath, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageRow, type StorageRowKind, dataKeyIdentity, unwrapDataKey } from './storage-db.ts'
-import { inspectStorageObject, storageOwner, storageRowPath, verifyStoragePayload } from './storage-payload.ts'
+import { inspectStorageObject, storageOwner, storageRowPaths, verifyStoragePayload } from './storage-payload.ts'
 
 const STORAGE_WRITE_MS = 180_000
 export const STORAGE_UPLOAD_TTL_MS = 86_400_000
@@ -78,7 +78,7 @@ async function openEncrypted(raw: RawObjectStorage, db: StorageDb, key: StorageK
   for (let attempt = 0; attempt < 3; attempt++) {
     const row = await db.getStorageRow(owner.type, owner.id)
     if (!row) return null
-    if (!owner.cache && storageRowPath(owner.type, row) !== identity) return null
+    if (!owner.cache && !storageRowPaths(owner.type, row).includes(identity)) return null
     if (owner.cache && !row.dataKey) return null
     if (!owner.cache && !row.encrypted) state = (await db.getStorageEncryption())!
     const stored = await raw.open(owner.cache ? encryptedCachePath(identity) : identity)
@@ -104,13 +104,78 @@ async function openEncrypted(raw: RawObjectStorage, db: StorageDb, key: StorageK
     }
     // Only a pending row may read plaintext, and only the original upload.
     // Verify first, then reopen that exact version before exposing bytes.
-    await verifyStoragePayload(owner.type, row, inspected.stream)
+    await verifyStoragePayload(owner.type, row, inspected.stream, undefined, identity)
     const current = await openObjectVersion(raw, identity, stored.version)
     if (current) return current
   }
   throw new Error('Storage changed repeatedly during read')
 }
 
+async function verifyReportConversion(db: StorageDb, identity: string, bytes: Buffer): Promise<string> {
+  const owner = storageOwner(identity)
+  if (owner?.type !== 'report' || owner.cache || identity !== `reports/${owner.id}.br`) throw new Error('Invalid report conversion')
+  const row = await db.getStorageRow('report', owner.id)
+  if (!row) throw new Error('Report deleted during compression')
+  // Representation changes must preserve the immutable upload hash.
+  await verifyStoragePayload('report', row, Readable.from([bytes]), undefined, identity)
+  return owner.id
+}
+
+async function finishReportConversion(raw: RawObjectStorage, db: StorageDb, id: string, encrypted: boolean): Promise<void> {
+  const row = await db.getStorageRow('report', id)
+  if (!row) { await raw.delete(`reports/${id}.br`); throw new Error('Report deleted during compression') }
+  // Conversion preserves the original row/key. Keep the original until the
+  // compressed PUT has succeeded, and mark encrypted only after removing it.
+  await raw.delete(`reports/${id}`)
+  if (encrypted) await db.markStorageEncrypted('report', id, row.dataKey!)
+}
+
+async function existingReportConversion(raw: RawObjectStorage, identity: string, row: StorageRow, key: StorageKey | null,
+  encryptedMode: boolean): Promise<{ version: string; encrypted: boolean } | null> {
+  const stored = await raw.open(identity)
+  if (!stored) return null
+  const inspected = await inspectStorageObject(stored)
+  // Activation or a concurrent key allocation can win after the SQL read.
+  // Retry with fresh policy/row state before interpreting any ciphertext.
+  if (inspected.encrypted && (!encryptedMode || !row.dataKey)) {
+    inspected.stream.destroy()
+    return { version: stored.version, encrypted: true }
+  }
+  const source = inspected.encrypted ? await decryptOwned(inspected, key!, 'report', row, identity) : inspected
+  await verifyStoragePayload('report', row, source.stream, undefined, identity)
+  return { version: stored.version, encrypted: inspected.encrypted }
+}
+
+async function publishReportConversion(raw: RawObjectStorage, identity: string, bytes: Buffer, row: StorageRow,
+  key: StorageKey | null, expected: string | null, encrypted: boolean): Promise<boolean> {
+  if (!encrypted) return raw.put(identity, bytes, AbortSignal.timeout(STORAGE_WRITE_MS), expected)
+  const dataKey = unwrapDataKey(key!, 'report', row)
+  const source = encryptStorageStream(Readable.from([bytes]), dataKey, identity, bytes.length)
+  try { return await raw.put(identity, source, AbortSignal.timeout(STORAGE_WRITE_MS), expected, bytes.length) }
+  finally { source.destroy(); dataKey.fill(0) }
+}
+
+async function convertStoredReport(raw: RawObjectStorage, db: StorageDb, key: StorageKey | null, identity: string, bytes: Buffer,
+  mode: (fresh?: boolean) => Promise<StorageEncryptionState | null>): Promise<null> {
+  const id = await verifyReportConversion(db, identity, bytes)
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const state = await mode(true)
+    const row = state ? await db.ensureStorageDataKey('report', id) : await db.getStorageRow('report', id)
+    if (!row) throw new Error('Report deleted during compression')
+    const current = await existingReportConversion(raw, identity, row, key, Boolean(state))
+    if (current?.encrypted && (!state || !row.dataKey)) continue
+    // A stale plaintext writer must never replace a concurrent encrypted
+    // winner. Retain the original on uncertain writes; the next open resumes.
+    if ((!current || state && !current.encrypted) &&
+      !await publishReportConversion(raw, identity, bytes, row, key, current?.version ?? null, Boolean(state))) continue
+    if (!state && await mode(true)) continue
+    await raw.sync?.(identity)
+    await finishReportConversion(raw, db, id, Boolean(state))
+    return null
+  }
+  throw new Error('Report changed repeatedly during compression')
+}
+
 // Startup enables encryption before constructing stores; validate the persisted
 // requirement even when this adapter is opened without a key.
 async function storagePolicy(db: StorageDb, key: StorageKey | null) {
@@ -156,17 +221,18 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
       const owner = storageOwner(identity), state = await mode()
       if (state && owner) {
         const row = await db.getStorageRow(owner.type, owner.id)
-        if (!row || (owner.cache ? !row.dataKey : storageRowPath(owner.type, row) !== identity)) return false
+        if (!row || (owner.cache ? !row.dataKey : !storageRowPaths(owner.type, row).includes(identity))) return false
       }
       // Existence is metadata only; open() authenticates the actual bytes.
       return await raw.head(state && owner?.cache ? encryptedCachePath(identity) : identity) !== null
     },
-    async put(identity, bytes) {
+    async put(identity, bytes, { replaceReport = false } = {}) {
       logicalKey(identity)
+      if (replaceReport) return convertStoredReport(raw, db, key, identity, bytes, mode)
       const state = await mode()
+      const owner = storageOwner(identity)
       if (identity.startsWith('avatars/')) { await raw.put(identity, bytes); return null }
       if (!state) return putPlaintext(raw, identity, bytes, () => mode(true))
-      const owner = storageOwner(identity)
       let dataKey: Buffer, wrapped: string | null = null
       if (owner?.cache) {
         const row = await db.ensureStorageDataKey(owner.type, owner.id)

package/server-managed/storage-maintenance.ts

@@ -1,8 +1,9 @@
+import type { Buffer } from 'node:buffer'
 import { type StorageKey, decryptStorageStream, encryptStorageStream } from '../server-common/storage-crypto.ts'
 import { ENCRYPTED_CACHE_PREFIX, type RawObjectStorage, deleteObjects, isBlobId, openObjectVersion } from './object-storage.ts'
-import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, unwrapDataKey } from './storage-db.ts'
+import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, type StorageRow, type StorageRowKind, unwrapDataKey } from './storage-db.ts'
 import { STORAGE_UPLOAD_TTL_MS } from './storage-encryption.ts'
-import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPath, verifyStoragePayload } from './storage-payload.ts'
+import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPaths, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
 
 async function replacementFailure(raw: RawObjectStorage, identity: string, version: string, signal: AbortSignal): Promise<string> {
   const format = (value: string) => value.startsWith('W/') ? 'weak' : value.startsWith('"') && value.endsWith('"') ? 'quoted' : 'unquoted'
@@ -20,56 +21,78 @@ async function replacementFailure(raw: RawObjectStorage, identity: string, versi
   return `${reason}; metadata=${format(current.version)}; comparison=${comparison}`
 }
 
-async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey, item: StorageMigrationRow, signal: AbortSignal): Promise<string | void> {
+type MigrationPhase = 'prepare-key' | 'open-payload' | 'verify-existing' | 'encrypt-upload' | 'verify-replacement' | 'checkpoint'
+async function migratePayload(raw: RawObjectStorage, db: StorageDb, type: StorageRowKind, row: StorageRow,
+  dataKey: Buffer, identity: string, signal: AbortSignal, progress: (phase: MigrationPhase) => void): Promise<boolean | string | null> {
+  progress('open-payload')
+  const source = await raw.open(identity, signal)
+  if (!source) return false
+  let inspected = await inspectStorageObject(source)
+  if (inspected.encrypted) {
+    progress('verify-existing')
+    // A previous PUT may have completed before a timeout or lost SQL ack.
+    try {
+      const decoded = await decryptStorageStream(inspected.stream, dataKey, identity)
+      await verifyStoragePayload(type, row, decoded.stream, signal, identity)
+    } catch {
+      signal.throwIfAborted()
+      // Legacy arbitrary bytes can share the magic prefix. A matching
+      // original upload hash is required before encrypting them as plaintext.
+      const legacy = await openObjectVersion(raw, identity, source.version, signal)
+      if (!legacy) return 'Payload disappeared or changed version before plaintext verification'
+      inspected = { ...legacy, encrypted: false }
+    }
+  }
+  if (!inspected.encrypted) {
+    progress('encrypt-upload')
+    signal.throwIfAborted()
+    const verified = verifiedStoragePayload(type, row, inspected.stream, signal, identity)
+    const encrypted = encryptStorageStream(verified, dataKey, identity, inspected.size)
+    let replaced: boolean
+    try { replaced = await raw.put(identity, encrypted, signal, source.version, inspected.size ?? undefined) }
+    // A provider may wrap a request-body error; keep safe payload diagnostics.
+    catch (err) { throw verified.errored ?? err }
+    finally { encrypted.destroy(); verified.destroy(); inspected.stream.destroy(); source.stream.destroy() }
+    if (!replaced) return await replacementFailure(raw, identity, source.version, signal)
+    // Do not mark the row encrypted until the stored bytes authenticate and
+    // match the original upload (including Brotli decompression).
+    progress('verify-replacement')
+    const replacement = await raw.open(identity, signal)
+    if (!replacement) {
+      if (!await db.getStorageRow(type, row.id)) return null
+      throw new StoragePayloadError('Migrated payload unavailable')
+    }
+    const decoded = await decryptStorageStream(replacement.stream, dataKey, identity)
+    await verifyStoragePayload(type, row, decoded.stream, signal, identity)
+  }
+  signal.throwIfAborted()
+  // Persist observed replacements, including both report representations
+  // if they coexist, before marking the whole row encrypted.
+  progress('checkpoint')
+  await raw.sync?.(identity, signal)
+  return true
+}
+
+async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey, item: StorageMigrationRow, signal: AbortSignal,
+  progress: (phase: MigrationPhase) => void): Promise<string | void> {
   if (item.type === 'user') { await db.migrateStorageUserTokens(item.id); return }
+  progress('prepare-key')
   const row = await db.ensureStorageDataKey(item.type, item.id)
   if (!row || row.encrypted) return
-  const dataKey = unwrapDataKey(key, item.type, row), identity = storageRowPath(item.type, row)
+  const dataKey = unwrapDataKey(key, item.type, row)
   try {
-    const source = await raw.open(identity, signal)
-    if (!source) {
+    let found = false
+    for (const identity of storageRowPaths(item.type, row)) {
+      const result = await migratePayload(raw, db, item.type, row, dataKey, identity, signal, progress)
+      if (result === null) return
+      if (typeof result === 'string') return result
+      found ||= result
+    }
+    if (!found) {
       if (!await db.getStorageRow(item.type, item.id)) return
       throw new StoragePayloadError('Migration payload unavailable')
     }
-    let inspected = await inspectStorageObject(source)
-    if (inspected.encrypted) {
-      // A previous PUT may have completed before a timeout or lost SQL ack.
-      try {
-        const decoded = await decryptStorageStream(inspected.stream, dataKey, identity)
-        await verifyStoragePayload(item.type, row, decoded.stream, signal)
-      } catch {
-        signal.throwIfAborted()
-        // Legacy arbitrary bytes can share the magic prefix. A matching
-        // original upload hash is required before encrypting them as plaintext.
-        const legacy = await openObjectVersion(raw, identity, source.version, signal)
-        if (!legacy) return 'Payload disappeared or changed version before plaintext verification'
-        inspected = { ...legacy, encrypted: false }
-      }
-    }
-    if (!inspected.encrypted) {
-      await verifyStoragePayload(item.type, row, inspected.stream, signal)
-      signal.throwIfAborted()
-      const current = await openObjectVersion(raw, identity, source.version, signal)
-      if (!current) return 'Payload disappeared or changed version before encryption'
-      const encrypted = encryptStorageStream(current.stream, dataKey, identity, current.size)
-      let replaced: boolean
-      try { replaced = await raw.put(identity, encrypted, signal, source.version, current.size ?? undefined) }
-      finally { encrypted.destroy(); current.stream.destroy() }
-      if (!replaced) return await replacementFailure(raw, identity, source.version, signal)
-      // Do not mark the row encrypted until the stored bytes authenticate and
-      // match the original upload (including decompression for sourcemaps).
-      const replacement = await raw.open(identity, signal)
-      if (!replacement) {
-        if (!await db.getStorageRow(item.type, item.id)) return
-        throw new StoragePayloadError('Migrated payload unavailable')
-      }
-      const decoded = await decryptStorageStream(replacement.stream, dataKey, identity)
-      await verifyStoragePayload(item.type, row, decoded.stream, signal)
-    }
     signal.throwIfAborted()
-    // Another process may have renamed ciphertext but stopped before syncing
-    // the directory. Persist the observed rename even on the resume path.
-    await raw.sync?.(identity, signal)
     await db.markStorageEncrypted(item.type, item.id, row.dataKey!)
   } finally { dataKey.fill(0) }
 }
@@ -108,7 +131,7 @@ async function cleanupLegacy(raw: RawObjectStorage, db: StorageDb, state: Storag
     const { owner, temporary } = target
     if (!temporary && !owner.cache) {
       const row = await db.getStorageRow(owner.type, owner.id)
-      if (row && storageRowPath(owner.type, row) === object.key) continue
+      if (row && storageRowPaths(owner.type, row).includes(object.key)) continue
     }
     const stored = await raw.head(object.key, signal)
     if (!stored) continue
@@ -176,8 +199,17 @@ export async function migrateStorage(raw: RawObjectStorage, db: StorageDb, key:
     for (const row of rows) {
       if (Date.now() >= deadline || signal.aborted) break
       console.info('managed-storage-migration-row-start:', JSON.stringify({ type: row.type, id: row.id }))
+      const startedAt = Date.now()
+      let phase: MigrationPhase | 'tokens' = 'tokens'
+      const logPhase = (aborted = false) => console.info('managed-storage-migration-row-phase:', JSON.stringify({
+        type: row.type, id: row.id, phase, elapsedMs: Date.now() - startedAt, ...(aborted ? { aborted: true } : {}),
+      }))
+      // Log directly on cancellation even if an underlying operation stalls
+      // while unwinding. These fixed phases contain no object/provider data.
+      const aborted = () => logPhase(true)
+      signal.addEventListener('abort', aborted, { once: true })
       try {
-        const pending = await migrateRow(raw, db, key, row, signal)
+        const pending = await migrateRow(raw, db, key, row, signal, next => { phase = next; logPhase() })
         if (pending) failures.push(rowFailure(row, pending))
       }
       catch (err) {
@@ -192,6 +224,7 @@ export async function migrateStorage(raw: RawObjectStorage, db: StorageDb, key:
           errors.push(new Error(`Could not migrate ${row.type} ${row.id}`, { cause: err }))
         } else failures.push(rowFailure(row, failure))
       }
+      finally { signal.removeEventListener('abort', aborted) }
       if (stopping?.aborted) break
       await db.advanceStorageMigration(state.cursor, row.position)
       processed++

package/server-managed/storage-payload.ts

@@ -1,6 +1,6 @@
 import { Buffer } from 'node:buffer'
 import { createHash } from 'node:crypto'
-import { Readable, Writable } from 'node:stream'
+import { PassThrough, Readable, Writable } from 'node:stream'
 import { pipeline } from 'node:stream/promises'
 import { createBrotliDecompress } from 'node:zlib'
 import { STORAGE_MAGIC } from '../server-common/storage-crypto.ts'
@@ -11,13 +11,14 @@ import type { StorageRow, StorageRowKind } from './storage-db.ts'
 // not fix it. Keep this distinct from database, storage and cancellation errors.
 export class StoragePayloadError extends Error {}
 
-export function storageRowPath(type: StorageRowKind, row: Pick<StorageRow, 'id' | 'kind'>): string {
-  return `${type === 'report' ? 'reports' : 'bundles'}/${row.id}${type === 'bundle' && row.kind === 'sourcemap' ? '.map.br' : ''}`
+export function storageRowPaths(type: StorageRowKind, row: Pick<StorageRow, 'id' | 'kind'>): string[] {
+  return type === 'report' ? [`reports/${row.id}.br`, `reports/${row.id}`]
+    : [`bundles/${row.id}${row.kind === 'sourcemap' ? '.map.br' : ''}`]
 }
 export function storageOwner(identity: string): { type: StorageRowKind; id: string; cache: boolean } | null {
   const match = /^(reports|bundles)\/([^/]+)$/u.exec(identity)
   if (match) {
-    const id = match[1] === 'bundles' ? match[2]!.replace(/\.map\.br$/u, '') : match[2]!
+    const id = match[2]!.replace(match[1] === 'bundles' ? /\.map\.br$/u : /\.br$/u, '')
     if (isBlobId(id)) return { type: match[1] === 'reports' ? 'report' : 'bundle', id, cache: false }
   }
   const cache = /^cache\/(?:bundles|report-sources)\/([a-f\d-]{36})\//u.exec(identity)
@@ -50,23 +51,49 @@ export async function inspectStorageObject(stored: RawObject): Promise<RawObject
   return { ...stored, stream, encrypted: length === prefix.length && prefix.equals(STORAGE_MAGIC) }
 }
 
-// Sourcemap integrity describes the original upload, before Brotli storage.
+// Report hashes and sourcemap integrity describe the original upload, before Brotli storage.
 // Hash incrementally, including decompression, so migration stays streaming.
-export async function verifyStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal): Promise<void> {
+export async function verifyStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal, identity?: string): Promise<void> {
   const hash = createHash(type === 'report' ? 'sha256' : 'sha512')
   const sink = new Writable({ write(chunk, _encoding, next) { hash.update(chunk); next() } })
   const options = signal ? { signal } : {}
   try {
-    if (type === 'bundle' && row.kind === 'sourcemap') {
+    if (type === 'bundle' && row.kind === 'sourcemap' || type === 'report' && identity?.endsWith('.br')) {
       await pipeline(source, createBrotliDecompress(), sink, options)
     } else await pipeline(source, sink, options)
   } catch (err) {
     const code = (err as NodeJS.ErrnoException).code ?? ''
     if (['Z_DATA_ERROR', 'Z_BUF_ERROR'].includes(code) || code.startsWith('ERR__ERROR_FORMAT_')) {
-      throw new StoragePayloadError('Stored sourcemap cannot be decompressed', { cause: err })
+      throw new StoragePayloadError(`Stored ${type === 'report' ? 'report' : 'sourcemap'} cannot be decompressed`, { cause: err })
     }
     throw err
   }
   const actual = type === 'report' ? hash.digest('base64url') : `sha512-${hash.digest('base64')}`
   if (actual !== row.hash) throw new StoragePayloadError('Stored payload does not match its upload hash')
 }
+
+// Forward the stored representation with backpressure, but withhold EOF until
+// its upload hash passes. Encryption cannot emit its final frame, and an atomic
+// PUT cannot commit, until verification (including Brotli decompression) ends.
+export function verifiedStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal, identity?: string): Readable {
+  const input = new PassThrough(), output = new PassThrough()
+  const verification = verifyStoragePayload(type, row, input, signal, identity)
+  // Propagate asynchronous decompression errors even if the source is stalled.
+  void verification.catch(err => { source.destroy(err); output.destroy(err) })
+  const forwarding = pipeline(source, async function* (chunks) {
+    try {
+      for await (const chunk of chunks) {
+        await new Promise<void>((resolve, reject) => { input.write(chunk, err => err ? reject(err) : resolve()) })
+        yield chunk
+      }
+      input.end()
+      await verification
+    } finally {
+      input.destroy()
+      await verification.catch(() => {})
+    }
+  }, output, signal ? { signal } : {})
+  // pipeline forwards errors to output and tears down input on early cancellation.
+  void forwarding.catch(() => {})
+  return output
+}

package/server-managed/storage-stores.ts

@@ -5,6 +5,7 @@ import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
 import type { BundleCacheStorage } from './bundle-cache.ts'
 import { createBundleStore } from './bundle-store.ts'
+import { createReportStore } from './report-store.ts'
 import { CacheMissError, type CacheStorage, validateCacheKey } from './cache-storage.ts'
 import { type ObjectStorage, isBlobId } from './object-storage.ts'
 
@@ -71,7 +72,8 @@ export function createManagedStores(objects: ObjectStorage, avatarSidecar: boole
     delete: value => bundles.delete(id(value)),
   }
   return {
-    reportStore: blobStore(objects, 'reports'),
+    reportStore: createReportStore(blobStore(objects, 'reports'), blobStore(objects, 'reports', '.br'),
+      (value, bytes) => objects.put(`reports/${id(value)}.br`, bytes, { replaceReport: true })),
     bundleStore: createBundleStore(blobStore(objects, 'bundles'), blobStore(objects, 'bundles', '.map.br')),
     uploadStore: blobStore(objects, 'uploads'),
     avatarStore: avatarStore(objects, avatarSidecar),

package/server-managed/workspace-shares.ts

@@ -149,7 +149,7 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
         repositories: await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories'],
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
-        team: { ...team,
+        team: { ...team, permissions,
           reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,