@preventive/triage 1.0.0-alpha.32 → 1.0.0-alpha.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.32",
+  "version": "1.0.0-alpha.34",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -121,10 +121,12 @@
     "server-managed/github-metadata.ts",
     "server-managed/github-issue-oauth.ts",
     "server-managed/github-issues.ts",
+    "server-managed/github-issue-links.ts",
     "server-managed/github-oauth.ts",
     "server-managed/github-pulls.ts",
     "server-managed/http-response.ts",
     "server-managed/http.ts",
+    "server-managed/link-reports.ts",
     "server-managed/import-triage.ts",
     "server-managed/managed-issues.ts",
     "server-managed/management.ts",
@@ -139,9 +141,11 @@
     "server-managed/report-migration.ts",
     "server-managed/report-query.ts",
     "server-managed/report-response.ts",
+    "server-managed/report-store.ts",
     "server-managed/report-sources.ts",
     "server-managed/revisions.ts",
     "server-managed/repository-browser.ts",
+    "server-managed/repository-aliases.ts",
     "server-managed/repository-discovery.ts",
     "server-managed/repository-policy.ts",
     "server-managed/session.ts",
@@ -162,6 +166,7 @@
     "server-managed/team-reports.ts",
     "server-managed/triage-response.ts",
     "server-managed/uploads.ts",
+    "server-managed/upstream-cache.ts",
     "server-managed/workspace-shares.ts",
     "server-common/database-config.ts",
     "server-common/initialize.ts",
@@ -194,6 +199,7 @@
     "common/managed/comments.ts",
     "common/managed/permissions.ts",
     "common/managed/report-content.ts",
+    "common/managed/repository-alias.ts",
     "common/managed/report-filter.ts",
     "common/managed/roles.ts",
     "common/managed/routes.d.ts",
@@ -239,35 +245,35 @@
     "server-e2e": "node server-e2e/index.ts",
     "server-managed": "node server-managed/index.ts",
     "server-managed-test": "node server-managed/test-server.ts",
-    "test": "node --js-base-64 --import=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js"
+    "test": "node --js-base-64 --require=./tests/_resource-loader.js --experimental-test-module-mocks --test-timeout=120000 --test ./tests/*.test.js"
   },
   "devDependencies": {
-    "@electric-sql/pglite": "^0.5.5",
-    "@noble/ciphers": "^2.3.0",
-    "@preventive/diff": "^1.0.0",
-    "@preventive/lockfile": "1.0.0-alpha.5",
-    "@preventive/terminal": "2.0.0-beta.1",
+    "@electric-sql/pglite": "^0.5.8",
+    "@noble/ciphers": "^2.4.0",
+    "@preventive/diff": "^1.0.1",
+    "@preventive/lockfile": "1.0.0-alpha.7",
+    "@preventive/terminal": "2.0.0-beta.2",
     "@rray/frontend": "^1.0.0",
-    "@stylistic/stylelint-plugin": "^5.3.0",
-    "@types/node": "^26.2.0",
-    "@types/ws": "^8.18.1",
+    "@stylistic/stylelint-plugin": "^5.3.1",
+    "@types/node": "^26.6.4",
+    "@types/ws": "^8.18.2",
     "@vercel/functions": "^3.9.11",
     "brotli": "^1.3.3",
     "esbuild": "^0.28.2",
     "lit": "^3.3.3",
     "minify-html-literals": "^1.3.5",
-    "oxlint": "^1.79.0",
+    "oxlint": "^1.87.0",
     "prismjs": "^1.30.0",
-    "stylelint": "^17.14.1",
+    "stylelint": "^17.16.0",
     "stylelint-config-recommended": "^18.0.0",
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@exodus/stasis": "1.0.0-beta.5",
-    "@exodus/stasis-core": "1.0.0-beta.5",
-    "@preventive/report": "1.0.0-alpha.5",
-    "@preventive/upstream": "1.0.0-alpha.7",
-    "ws": "^8.20.1"
+    "@exodus/stasis": "1.0.0-beta.9",
+    "@exodus/stasis-core": "1.0.0-beta.9",
+    "@preventive/report": "1.0.0-alpha.9",
+    "@preventive/upstream": "1.0.0-alpha.12",
+    "ws": "^8.22.0"
   },
   "peerDependencies": {
     "@neondatabase/serverless": "^1.0.2",

package/server-managed/activity.ts

@@ -89,6 +89,7 @@ const managerSource = `SELECT ${triageFields},
   LEFT JOIN managed_selected_repo p ON p.repo_id = r.repo_id
   WHERE EXISTS (
     SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+    JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
     WHERE tu.user_id = :userId AND tr.repo_id = r.repo_id AND ${withinTeamPath('r.repo_directory')}
   )
   UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId,
@@ -98,6 +99,7 @@ const managerSource = `SELECT ${triageFields},
   LEFT JOIN managed_selected_repo p ON p.repo_id = b.repo_id
   WHERE a.report_id IS NULL AND EXISTS (
     SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+    JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
     WHERE tu.user_id = :userId AND tr.repo_id = b.repo_id AND ${withinTeamPath('b.repo_directory')}
   )
   UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId, a.action, a.repo, a.report_id AS reportId,
@@ -106,6 +108,7 @@ const managerSource = `SELECT ${triageFields},
     AND NOT EXISTS (SELECT 1 FROM managed_report WHERE id = a.report_id)
     AND NOT EXISTS (SELECT 1 FROM managed_bundle WHERE id = a.bundle_id)
     AND EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+      JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
       WHERE tu.user_id = :userId AND tr.repo_id = a.repo_id
       AND ${withinTeamPath('a.repo_directory')})`
 
@@ -125,10 +128,14 @@ export function initActivityMethods(db: DatabaseSync): void {
   db.exec('CREATE INDEX IF NOT EXISTS managed_activity_actor_at_idx ON managed_activity(actor_id, at)')
   // Stable upload IDs make backfill idempotent, including after restarts.
   // Snapshots deliberately have no cascading FKs: deletion is itself activity.
+  // CREATE TRIGGER IF NOT EXISTS keeps an older body; replace the one that
+  // predates server-built bundles so builds are not recorded as uploads.
+  const bundleTrigger = db.prepare("SELECT sql FROM sqlite_schema WHERE type = 'trigger' AND name = 'managed_bundle_activity'").get() as { sql: string } | undefined
+  if (bundleTrigger && !bundleTrigger.sql.includes('provenance')) db.exec('DROP TRIGGER managed_bundle_activity')
   for (const type of ['report', 'bundle']) {
     const columns = `id, kind, actor, action, repo, report_id, report, at, bundle_id, actor_id`
     const values = (alias: string) => `'${type}-upload:' || ${alias}.id, 'upload',
-      COALESCE(${alias}.uploaded_by_login, (SELECT login FROM managed_user WHERE id = ${alias}.uploaded_by)), 'uploaded a ${type}',
+      COALESCE(${alias}.uploaded_by_login, (SELECT login FROM managed_user WHERE id = ${alias}.uploaded_by)), ${uploadAction(type, alias)},
       (SELECT full_name FROM managed_selected_repo WHERE repo_id = ${alias}.repo_id),
       ${type === 'report' ? `${alias}.id` : 'NULL'}, ${alias}.filename, ${alias}.uploaded_at,
       ${type === 'bundle' ? `${alias}.id` : 'NULL'}, ${alias}.uploaded_by`
@@ -140,6 +147,12 @@ export function initActivityMethods(db: DatabaseSync): void {
   }
 }
 
+// The creation entry for a stored report or bundle. Shared with the Postgres
+// trigger function; `alias` is the trigger row (NEW) or a backfill alias.
+export function uploadAction(type: string, alias: string): string {
+  return type === 'bundle' ? `CASE WHEN ${alias}.provenance = 'build' THEN 'built a bundle' ELSE 'uploaded a bundle' END` : `'uploaded a ${type}'`
+}
+
 export function activityMethods(db: ManagedSql): ActivityStore {
   const insert = db.prepare(`INSERT INTO managed_activity (id, kind, actor, action, repo, report_id, report, at, bundle_id, repo_id, repo_directory, actor_id)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
@@ -148,6 +161,7 @@ export function activityMethods(db: ManagedSql): ActivityStore {
   const reports = db.prepare(`SELECT r.id AS reportId, r.filename AS report, p.full_name AS repo
     FROM managed_report r JOIN managed_selected_repo p ON p.repo_id = r.repo_id
     WHERE EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+      JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
       WHERE tu.user_id = ? AND tr.repo_id = r.repo_id AND ${withinTeamPath('r.repo_directory')})
     ORDER BY r.uploaded_at DESC, r.id`)
   return {

package/server-managed/brotli.ts

@@ -4,7 +4,7 @@ import type { Buffer } from 'node:buffer'
 
 const compress = promisify(brotliCompress)
 
-// Quality 4 avoids Brotli's expensive default (11) for uploads and cold caches.
-export function encodeBrotli(bytes: Uint8Array): Promise<Buffer> {
-  return compress(bytes, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } })
+// Bundles and cold caches use quality 4; stored reports use quality 9.
+export function encodeBrotli(bytes: Uint8Array, quality = 4): Promise<Buffer> {
+  return compress(bytes, { params: { [constants.BROTLI_PARAM_QUALITY]: quality } })
 }

package/server-managed/bundle-advisories.ts

@@ -1,4 +1,4 @@
-import { type Advisory, type Package, advisories } from '@preventive/upstream/advisories.js'
+import { type Advisory, type CacheStore, type Package, advisories } from '@preventive/upstream/advisories.js'
 import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
 
 export const ADVISORIES_TIMEOUT_MS = 30_000
@@ -26,8 +26,11 @@ function advisoryGithubClient(token: string | null, signal: AbortSignal): Client
 // The managed caller supplies its user's token when available; public shares
 // remain anonymous. Upstream sends this credential only to GitHub and returns
 // published advisories, matching versions across npm, OSV and repository rows.
+// `cache` keeps each repository's listing (upstream-cache.ts) across audits.
 export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
-  { debug = false, repoAdvisories = false, githubToken = null }: { debug?: boolean; repoAdvisories?: boolean; githubToken?: string | null } = {}): Promise<
+  { debug = false, repoAdvisories = false, details = false, githubToken = null, cache }: {
+    debug?: boolean; repoAdvisories?: boolean; details?: boolean; githubToken?: string | null; cache?: CacheStore | undefined
+  } = {}): Promise<
   { status: 200; body: Advisory[] } | { status: 502; body: { error: string } }
 > {
   let onAbort: (() => void) | undefined
@@ -40,8 +43,10 @@ export async function fetchBundleAdvisories(packages: Package[], signal: AbortSi
       onAbort = () => reject(signal.reason)
       signal.addEventListener('abort', onAbort, { once: true })
     })
+    // Kept in the caller's store, or without one in upstream's disk cache,
+    // where the server set one (auditCache).
     const result = await Promise.race([
-      advisories(packages, { github: advisoryGithubClient(githubToken, signal), repoAdvisories }), deadline,
+      advisories(packages, { github: advisoryGithubClient(githubToken, signal), repoAdvisories, details, ...(cache && { cache }) }), deadline,
     ])
     return { status: 200, body: result }
   } catch (error) {

package/server-managed/bundle-advisory-inventory.ts

@@ -1,5 +1,6 @@
+import { isEvidenceFile } from '@exodus/stasis/audit-corrections'
+import { packageRepo } from '@exodus/stasis-core/bundle-util'
 import type { Package } from '@preventive/upstream/advisories.js'
-import { satisfies, valid } from '@preventive/upstream/semver.js'
 import type { BundleDetails } from '../common/bundle-metadata.js'
 
 export interface SkippedAdvisoryPackage {
@@ -9,25 +10,14 @@ export interface SkippedAdvisoryPackage {
   because: string
 }
 export interface BundleAdvisoryInventory { packages: Package[]; skipped: SkippedAdvisoryPackage[] }
-interface BundleModule { ecosystem?: string; name?: string; version?: string; files: Record<string, unknown> }
+interface BundleModule { ecosystem?: string; name?: string; version?: string; repo?: { github?: Package['github'] }; files: Record<string, unknown> }
 
-// Match Stasis's audit evidence rules, including their verified version bounds:
-// https://github.com/PreventiveMeasures/stasis/blob/2bd4c14354da9888c00ab45fa89740413099b5dc/stasis/src/audit-corrections.js
-// Keep this on the server: upstream's semver implementation uses Node's npm.
-const cargoManifests = ['Cargo.toml', 'Cargo.lock', '.cargo-checksum.json']
-const solidityManifests = ['package.json', 'foundry.toml', 'remappings.txt', 'soldeer.toml']
-const manifests = new Map([
-  ['npm', ['package.json']],
-  ['cargo', cargoManifests], ['cargo-git', cargoManifests], ['cargo-unknown', cargoManifests],
-  ['composer', ['composer.json', 'composer.lock']],
-  ['soldeer', solidityManifests], ['github', solidityManifests],
-])
-const browserStubRanges = new Map([['ws', '<=8.21.1'], ['node-fetch', '<=2.7.0']])
-
-function isEvidence(ecosystem: string, name: string, version: string, file: string): boolean {
-  if (manifests.get(ecosystem)?.includes(file.slice(file.lastIndexOf('/') + 1))) return false
-  const stubRange = ecosystem === 'npm' && file === 'browser.js' ? browserStubRanges.get(name) : undefined
-  return !stubRange || !valid(version) || !satisfies(version, stubRange)
+// The GitHub repository a bundled package.json's text names, read as Stasis
+// records a dependency's (packageRepo) and as Node reads the file, past a byte
+// order mark the bundle keeps. Undefined where it names none or doesn't parse.
+function manifestRepo(text: unknown): Package['github'] {
+  if (typeof text !== 'string') return undefined
+  try { return packageRepo(JSON.parse(text.replace(/^\uFEFF/u, '')))?.github } catch { return undefined }
 }
 
 function supported(ecosystem: string): ecosystem is Package['ecosystem'] {
@@ -41,20 +31,21 @@ function skipReason(ecosystem: string, version: string): string | undefined {
   return undefined
 }
 
-// Package and reason presence both require a recorded evidence file. Entry and
-// manually added files count even when they have no incoming import edge.
+// Package and reason presence both require a recorded evidence file, by Stasis's
+// audit rule (server-only, as its semver uses Node's npm). Entry and manually
+// added files count even when they have no incoming import edge.
 export function bundleAdvisoryInventory(details: BundleDetails, paths: Iterable<string> | null = null): BundleAdvisoryInventory {
   const modules = (details.bundle as { modules?: ReadonlyMap<string, BundleModule> } | undefined)?.modules
   if (details.kind !== 'stasis' || !modules) return { packages: [], skipped: [] }
   const selected = paths === null ? null : new Set(paths)
-  const packages = new Map<string, { ecosystem: Package['ecosystem']; name: string; versions: Set<string> }>()
+  const packages = new Map<string, { ecosystem: Package['ecosystem']; name: string; versions: Set<string>; github?: Package['github'] | null }>()
   const skipped = new Map<string, SkippedAdvisoryPackage>()
   for (const [dir, info] of modules) {
     if (dir === '.') continue
     const ecosystem = info.ecosystem ?? (/(?:^|\/)node_modules\//u.test(dir) ? 'npm' : undefined)
     const { name, version } = info
     if (ecosystem === undefined || typeof name !== 'string' || !name || typeof version !== 'string' || !version) continue
-    if (!Object.keys(info.files).some(file => (!selected || selected.has(`${dir}/${file}`)) && isEvidence(ecosystem, name, version, file))) continue
+    if (!Object.keys(info.files).some(file => (!selected || selected.has(`${dir}/${file}`)) && isEvidenceFile(name, version, file, ecosystem))) continue
     const because = skipReason(ecosystem, version)
     if (!supported(ecosystem) || because !== undefined) {
       skipped.set(JSON.stringify([ecosystem, name, version]), { ecosystem, name, version, because: because ?? `No advisory source is supported for ${ecosystem}.` })
@@ -65,11 +56,22 @@ export function bundleAdvisoryInventory(details: BundleDetails, paths: Iterable<
     const auditedVersion = ecosystem === 'github' && version === '.' ? '0.0.0' : version
     const key = JSON.stringify([ecosystem, ecosystem === 'github' ? name.toLowerCase() : name])
     if (!packages.has(key)) packages.set(key, { ecosystem, name, versions: new Set() })
-    packages.get(key)!.versions.add(auditedVersion)
+    const pkg = packages.get(key)!
+    pkg.versions.add(auditedVersion)
+    // A bundle from before Stasis recorded `repo` may still carry the npm
+    // package's package.json; ask the repository it names, as Stasis does.
+    let github = ecosystem === 'github' ? undefined : info.repo?.github
+    if (github === undefined && ecosystem === 'npm') github = manifestRepo(info.files['package.json'])
+    if (github !== undefined) {
+      // Upstream accepts one repository per package. Conflicting hints (for
+      // example, versions from before and after a move) use registry discovery.
+      if (pkg.github === undefined) pkg.github = github
+      else if (pkg.github !== null && pkg.github.toLowerCase() !== github.toLowerCase()) pkg.github = null
+    }
   }
   const byPackage = (a: { ecosystem: string; name: string }, b: { ecosystem: string; name: string }) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name)
   return {
-    packages: [...packages.values()].map(pkg => ({ ...pkg, versions: [...pkg.versions].toSorted() })).toSorted(byPackage),
+    packages: [...packages.values()].map(({ github, ...pkg }) => ({ ...pkg, versions: [...pkg.versions].toSorted(), ...(github ? { github } : {}) })).toSorted(byPackage),
     skipped: [...skipped.values()].toSorted((a, b) => byPackage(a, b) || a.version.localeCompare(b.version)),
   }
 }

package/server-managed/bundle-build-worker.js

@@ -2,25 +2,60 @@ import { parentPort, workerData } from 'node:worker_threads'
 import { Buffer } from 'node:buffer'
 import { posix } from 'node:path'
 import { brotliCompressSync } from 'node:zlib'
-import { buildGitHubBundle } from '@exodus/stasis/vfs-bundle'
+import { buildGitHubBundle, setCacheDir } from '@exodus/stasis/vfs-bundle'
 import { brotliOptions } from '@exodus/stasis-core/brotli'
 import { HttpError, createClient } from '@preventive/upstream/github.js'
 import { githubBundleFilename } from './bundle-build.ts'
 import { bundleBuildDiagnostic } from './bundle-build-diagnostics.js'
 
-export async function buildStasisBundle({ input, github, token, maxBytes, scopes }, client = createClient({ token }), progress = () => {}) {
+const regularFile = entry => entry.type === 'blob' && ['100644', '100755'].includes(entry.mode)
+
+async function projectDirectory(input, github, client) {
+  // Input validation permits either JS/TS entries or Solidity entries, never a mix.
+  const manifests = input.entries[0].endsWith('.sol') ? ['foundry.toml', 'soldeer.toml', 'soldeer.lock'] : ['package.json']
+  if (!input.directory) return ''
+  for (let directory = input.directory; ; directory = posix.dirname(directory).replace(/^\.$/u, '')) {
+    const entries = await client.listRepoDir({ repo: github, sha: input.commit, directory: directory || undefined })
+    if (entries.some(entry => manifests.includes(entry.path) && regularFile(entry))) return directory
+    if (!directory) return input.directory
+  }
+}
+
+// The name Stasis read from the package.json in the project directory we
+// provide, where its module holds bundled files. JS builds only: a Solidity
+// build records `solidity-bundle` for a package.json without name and version.
+async function packageName(input, github, project, bundle, client) {
+  if (!project || input.entries[0].endsWith('.sol')) return null
+  const entries = await client.listRepoDir({ repo: github, sha: input.commit, directory: project })
+  if (!entries.some(entry => entry.path === 'package.json' && regularFile(entry))) return null
+  const name = bundle.modules.get(posix.relative(bundle.repo?.directory ?? '', project) || '.')?.name
+  return typeof name === 'string' ? name : null
+}
+
+export async function buildStasisBundle({ input, github, token, maxBytes, scopes, cacheDir = null }, client = createClient({ token }), progress = () => {}) {
   const allowed = path => scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))
-  // Stasis/upstream cache writes are disabled by default; this fresh worker
-  // never enables a cache directory or inherits application credentials.
+  // Reuse these immutable listings when Stasis discovers the lockfile root.
+  const listings = new Map()
+  const buildClient = { ...client, listRepoDir(options) {
+    const key = JSON.stringify([options.repo, options.sha, options.directory ?? ''])
+    if (!listings.has(key)) listings.set(key, client.listRepoDir(options))
+    return listings.get(key)
+  } }
+  // Upstream's disk cache keeps the npm tarballs and version documents, and
+  // the repo's tree, in `cacheDir`; without one (Vercel), nothing is kept on
+  // disk. This fresh worker inherits no application credentials.
+  setCacheDir(cacheDir ?? false)
   progress('build')
+  const project = await projectDirectory(input, github, buildClient)
+  if (!allowed(project)) throw new Error('build-scope')
   const { bundle } = await buildGitHubBundle({
-    github, sha: input.commit, directory: input.directory || undefined,
-    entries: input.entries.map(entry => posix.relative(input.directory || '.', entry)),
-    ...input.options, client,
+    github, sha: input.commit, directory: project || undefined,
+    entries: input.entries.map(entry => posix.relative(project || '.', entry)),
+    ...input.options, client: buildClient, ...(cacheDir === null && { cache: false }),
   })
   const directory = bundle.repo?.directory ?? ''
   progress('scope')
-  // A workspace lockfile may widen the build root. Never publish it under a
+  // Imports outside the selected package may widen the root. Never publish it under a
   // narrower team grant: the storage location must cover the actual bundle.
   if (!allowed(directory)) throw new Error('build-scope')
   progress('serialize')
@@ -29,7 +64,8 @@ export async function buildStasisBundle({ input, github, token, maxBytes, scopes
   progress('compress')
   const bytes = brotliCompressSync(serialized, brotliOptions())
   if (bytes.length > maxBytes) throw new Error('too-large')
-  return { bytes, directory, filename: githubBundleFilename(github, input.directory, input.commit) }
+  const name = await packageName(input, github, project, bundle, buildClient)
+  return { bytes, directory, filename: githubBundleFilename(github, project, input.commit, name) }
 }
 
 if (parentPort && workerData?.type === 'managed-bundle-build') {

package/server-managed/bundle-build.ts

@@ -4,6 +4,7 @@ import { posix } from 'node:path'
 import { Worker } from 'node:worker_threads'
 import { BUNDLE_BUILD_TIMEOUT_MS, type BundleBuildLeaseStore } from './bundle-build-leases.ts'
 import { type BundleBuildDiagnostic, type BundleBuildStage, bundleBuildDiagnostic } from './bundle-build-diagnostics.js'
+import type { BundleBuildConditions } from './db-methods.ts'
 
 export class BundleBuildError extends Error {
   status: number
@@ -16,7 +17,9 @@ export interface BundleBuildInput {
   commit: string
   entries: string[]
   directory: string
-  options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; typescript?: boolean; jsx?: boolean }
+  options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; jsx?: boolean }
+  // What the stored bundle records; null for Solidity, which takes no conditions.
+  conditions: BundleBuildConditions | null
 }
 
 function path(value: unknown): value is string {
@@ -32,7 +35,7 @@ export function parseBundleBuild(value: unknown): BundleBuildInput {
     || typeof commit !== 'string' || !/^[a-f\d]{40}$/u.test(commit)
     || !Array.isArray(entries) || entries.length === 0 || entries.length > 100 || !entries.every(path)) return fail()
   const selected = [...new Set(entries as string[])]
-  const scripts = selected.every(entry => /\.[mc]?[jt]s$/u.test(entry))
+  const scripts = selected.every(entry => /\.[cm]?[tj]sx?$/iu.test(entry))
   if (!scripts && !selected.every(entry => entry.endsWith('.sol'))) return fail('unsupported-entries')
   const parts = posix.dirname(selected[0]!).split('/').filter(part => part !== '.')
   for (const entry of selected) {
@@ -40,33 +43,49 @@ export function parseBundleBuild(value: unknown): BundleBuildInput {
     while (parts.some((part, i) => parent[i] !== part)) parts.pop()
   }
   const options: BundleBuildInput['options'] = {}
+  let recorded: BundleBuildConditions | null = null
   if (scripts) {
     if (conditions == null || typeof conditions !== 'object' || Array.isArray(conditions)) return fail('bad-conditions')
     const { preset, conditions: names, platforms } = conditions as Record<string, unknown>
-    if (!['node', 'browser', 'metro'].includes(String(preset)) || !Array.isArray(names) || names.length > 16
+    if (typeof preset !== 'string' || !['node', 'browser', 'metro'].includes(preset) || !Array.isArray(names) || names.length > 16
       || !names.every(name => typeof name === 'string' && name.length > 0 && name.length <= 64
         && !/^\.|^\d+$|[\s,/\\\p{Cc}]/u.test(name) && !['default', 'import', 'require'].includes(name))) return fail('bad-conditions')
     if (preset === 'metro') {
       if (names.length !== 1 || names[0] !== 'react-native') return fail('metro-conditions')
       if (!Array.isArray(platforms) || platforms.length === 0 || platforms.length > 2
         || !platforms.every(platform => ['ios', 'android'].includes(platform))) return fail('bad-conditions')
-      Object.assign(options, { metro: true, platforms: [...new Set(platforms)] })
+      // React Native's convention puts JSX in .js files, which Stasis parses as
+      // JSX only on request. TypeScript is left to Stasis to detect.
+      Object.assign(options, { metro: true, platforms: [...new Set(platforms)], jsx: true })
     } else {
       options.conditions = [...new Set(names)]
       if (preset === 'browser') options.mainFields = ['browser', 'module', 'main']
     }
-    options.typescript = true
-    options.jsx = true
+    recorded = { preset: preset as BundleBuildConditions['preset'], conditions: [...new Set(names as string[])],
+      platforms: options.platforms ?? [] }
   }
-  return { repoId, commit, entries: selected, directory: parts.join('/'), options }
+  return { repoId, commit, entries: selected, directory: parts.join('/'), options, conditions: recorded }
+}
+
+// A package name as a filename base: `@scope/name` as `scope-name`, or as
+// `name` alone where it is `scope` or already starts with `scope-`. Null for
+// a name npm could not publish by its length or leading dot.
+function packageBase(name: string): string | null {
+  const match = name.length <= 214 ? /^(?:@([^/.][^/]*)\/)?([^/.][^/]*)$/u.exec(name) : null
+  if (!match) return null
+  const base = match[2]!, scope = match[1]
+  return scope === undefined || base === scope || base.startsWith(`${scope}-`) ? base : `${scope}-${base}`
 }
 
 // Same portable name and 255-character limit as Stasis's githubBundleFile
-// (src/cmd/github-bundle.js), which is not a public package export.
-export function githubBundleFilename(github: string, directory: string, commit: string): string {
+// (src/cmd/github-bundle.js), which is not a public package export, except
+// that a usable `packageName` replaces both the repo and the directory.
+export function githubBundleFilename(github: string, directory: string, commit: string, packageName: string | null = null): string {
   const portable = (value: string) => value.replaceAll(/[^\w.-]/gu, '_')
-  const repo = portable(github.replace('/', '-'))
   const tail = `.${portable(commit.slice(0, 7))}.stasis.code.br`
+  const named = packageName === null ? null : packageBase(packageName)
+  if (named !== null) return `${portable(named)}${tail}`
+  const repo = portable(github.replace('/', '-'))
   if (!directory) return `${repo}${tail}`
   const room = 255 - `${repo}.${tail}`.length
   let dir = portable(directory.replaceAll('/', '-'))
@@ -75,7 +94,12 @@ export function githubBundleFilename(github: string, directory: string, commit:
 }
 
 export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: string }
-export interface BuildRequest { input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[] }
+export interface BuildRequest {
+  input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[]
+  // Upstream's disk cache for what a build fetches (setCacheDir), or null for
+  // none, as on Vercel. Resolved here: the worker runs with an empty env.
+  cacheDir: string | null
+}
 // An extra per-process ceiling; admission must also hold the shared DB lease.
 const active = new Set<string>()
 

package/server-managed/bundle-cache.ts

@@ -38,7 +38,7 @@ export interface BundleCacheStorage {
 }
 
 const filename = `v${BUNDLE_METADATA_VERSION}-metadata.json.br`
-const packagesFilename = 'v4-advisory-inventory.json'
+const packagesFilename = 'v6-advisory-inventory.json'
 
 // All scopes share one bounded derivative. Never decode full bundle metadata
 // on advisory requests, including when selecting a reason. Persist null when

package/server-managed/bundle.ts

@@ -8,7 +8,12 @@
 import { createHash } from 'node:crypto'
 import type { Buffer } from 'node:buffer'
 import { StringDecoder } from 'node:string_decoder'
-import { createBrotliDecompress } from 'node:zlib'
+import { brotliDecompress, createBrotliDecompress } from 'node:zlib'
+import { promisify } from 'node:util'
+import { parseBundleContents } from '../common/bundle-metadata.js'
+import { bundleFilesAsMap } from '../common/bundle-sources.js'
+import { commonFileDirectory } from '../common/managed/repository-alias.ts'
+import { decodeUtf8 } from '../common/utf8.js'
 
 // `sha512-<base64>` identity for a bundle's bytes. MUST stay byte-identical to
 // the client's common/integrity.js (SHA-512 → standard base64 WITH padding) so
@@ -92,6 +97,17 @@ export async function bundleRepo(bytes: Buffer): Promise<BundleRepo | null> {
   finally { stream.destroy() }
 }
 
+const decompress = promisify(brotliDecompress)
+// Same decoded size bound as the bundle metadata cache; only reached when an
+// alias can use a shared file suffix. Invalid/opaque bundles keep header defaults.
+export async function bundleFilePrefix(bytes: Buffer): Promise<string> {
+  try {
+    const decoded = await decompress(bytes, { maxOutputLength: 512 * 1024 * 1024 })
+    const details = parseBundleContents(decodeUtf8(decoded), { integrity: '', kind: 'stasis', size: bytes.length })
+    return commonFileDirectory(bundleFilesAsMap(details).keys())
+  } catch { return '' }
+}
+
 // Extract the bundle integrities a report declares (its top-level
 // `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
 export function reportBundleHashes(bytes: Buffer): string[] {

package/server-managed/config.ts

@@ -5,6 +5,7 @@ import { env } from 'node:process'
 import { databaseUrls } from '../server-common/database-config.ts'
 import { MAX_UPLOAD_BYTES } from './uploads.ts'
 import { parseStorageKey } from '../server-common/storage-crypto.ts'
+import { defaultCacheDir } from '@preventive/upstream/npm.js'
 
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
 
@@ -19,6 +20,9 @@ export interface ManagedConfig {
   storageEncryptionMigrateMaxMs?: number
   vercelPreview?: boolean
   serverless?: boolean
+  // Upstream's disk cache (setCacheDir) for audits and bundle builds: its default
+  // location, or null for none, as on Vercel, where the database keeps listings.
+  upstreamCacheDir?: string | null
   debug: boolean
   allowShare: boolean
   trustProxyEnv: string | undefined
@@ -44,7 +48,7 @@ export interface ManagedConfig {
   githubAppSlug: string | null
   githubNewIssueLabels?: string
   // Max accepted size (bytes) for an uploaded report on the "Manage reports"
-  // page. Reports are findings dumps (JSON / markdown / CSV), small to a few MB.
+  // page, before storage compression (default 25 MiB).
   maxReportBytes: number
   // Max accepted size (bytes) for an uploaded bundle (sourcemap / stasis
   // archive). Bundles run larger than reports, so a higher cap (default 200 MiB).
@@ -117,6 +121,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     neonUrl, blobToken, serverless, storageEncryptionKey, storageEncryptionMigrate,
     storageEncryptionMigrateMaxMs: intEnv('MANAGED_STORAGE_ENCRYPTION_MIGRATE_MAX_MS', 150_000, 1, serverless ? 240_000 : 3_600_000),
     vercelPreview: env['VERCEL_ENV'] === 'preview',
+    upstreamCacheDir: serverless ? null : defaultCacheDir ?? null,
     port: intEnv('PORT', 8765, 0, 65535),
     host,
     // DB_PATH belongs to e2e in a combined process. Keep the two stores apart.
@@ -135,7 +140,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,
     githubNewIssueLabels: env['GITHUB_NEW_ISSUE_LABELS'] ?? '',
-    maxReportBytes: intEnv('MAX_REPORT_BYTES', 10_485_760, 1, 104_857_600),
+    maxReportBytes: intEnv('MAX_REPORT_BYTES', 26_214_400, 1, 104_857_600),
     maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, MAX_UPLOAD_BYTES),
     triageHistoryLimit: intEnv('TRIAGE_HISTORY_LIMIT', 0, 0, 1_000_000_000),
   }