@preventive/triage 1.0.0-alpha.32 → 1.0.0-alpha.34

package/server-managed/storage-encryption.ts

@@ -4,7 +4,7 @@ import { Readable } from 'node:stream'
 import { type StorageKey, decryptStorageStream, encryptStorageStream, wrapStorageValue } from '../server-common/storage-crypto.ts'
 import { ENCRYPTED_CACHE_PREFIX, type ObjectStorage, type RawObject, type RawObjectStorage, deleteObjects, objectPath, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageRow, type StorageRowKind, dataKeyIdentity, unwrapDataKey } from './storage-db.ts'
-import { inspectStorageObject, storageOwner, storageRowPath, verifyStoragePayload } from './storage-payload.ts'
+import { inspectStorageObject, storageOwner, storageRowPaths, verifyStoragePayload } from './storage-payload.ts'
 
 const STORAGE_WRITE_MS = 180_000
 export const STORAGE_UPLOAD_TTL_MS = 86_400_000
@@ -78,7 +78,7 @@ async function openEncrypted(raw: RawObjectStorage, db: StorageDb, key: StorageK
   for (let attempt = 0; attempt < 3; attempt++) {
     const row = await db.getStorageRow(owner.type, owner.id)
     if (!row) return null
-    if (!owner.cache && storageRowPath(owner.type, row) !== identity) return null
+    if (!owner.cache && !storageRowPaths(owner.type, row).includes(identity)) return null
     if (owner.cache && !row.dataKey) return null
     if (!owner.cache && !row.encrypted) state = (await db.getStorageEncryption())!
     const stored = await raw.open(owner.cache ? encryptedCachePath(identity) : identity)
@@ -104,13 +104,78 @@ async function openEncrypted(raw: RawObjectStorage, db: StorageDb, key: StorageK
     }
     // Only a pending row may read plaintext, and only the original upload.
     // Verify first, then reopen that exact version before exposing bytes.
-    await verifyStoragePayload(owner.type, row, inspected.stream)
+    await verifyStoragePayload(owner.type, row, inspected.stream, undefined, identity)
     const current = await openObjectVersion(raw, identity, stored.version)
     if (current) return current
   }
   throw new Error('Storage changed repeatedly during read')
 }
 
+async function verifyReportConversion(db: StorageDb, identity: string, bytes: Buffer): Promise<string> {
+  const owner = storageOwner(identity)
+  if (owner?.type !== 'report' || owner.cache || identity !== `reports/${owner.id}.br`) throw new Error('Invalid report conversion')
+  const row = await db.getStorageRow('report', owner.id)
+  if (!row) throw new Error('Report deleted during compression')
+  // Representation changes must preserve the immutable upload hash.
+  await verifyStoragePayload('report', row, Readable.from([bytes]), undefined, identity)
+  return owner.id
+}
+
+async function finishReportConversion(raw: RawObjectStorage, db: StorageDb, id: string, encrypted: boolean): Promise<void> {
+  const row = await db.getStorageRow('report', id)
+  if (!row) { await raw.delete(`reports/${id}.br`); throw new Error('Report deleted during compression') }
+  // Conversion preserves the original row/key. Keep the original until the
+  // compressed PUT has succeeded, and mark encrypted only after removing it.
+  await raw.delete(`reports/${id}`)
+  if (encrypted) await db.markStorageEncrypted('report', id, row.dataKey!)
+}
+
+async function existingReportConversion(raw: RawObjectStorage, identity: string, row: StorageRow, key: StorageKey | null,
+  encryptedMode: boolean): Promise<{ version: string; encrypted: boolean } | null> {
+  const stored = await raw.open(identity)
+  if (!stored) return null
+  const inspected = await inspectStorageObject(stored)
+  // Activation or a concurrent key allocation can win after the SQL read.
+  // Retry with fresh policy/row state before interpreting any ciphertext.
+  if (inspected.encrypted && (!encryptedMode || !row.dataKey)) {
+    inspected.stream.destroy()
+    return { version: stored.version, encrypted: true }
+  }
+  const source = inspected.encrypted ? await decryptOwned(inspected, key!, 'report', row, identity) : inspected
+  await verifyStoragePayload('report', row, source.stream, undefined, identity)
+  return { version: stored.version, encrypted: inspected.encrypted }
+}
+
+async function publishReportConversion(raw: RawObjectStorage, identity: string, bytes: Buffer, row: StorageRow,
+  key: StorageKey | null, expected: string | null, encrypted: boolean): Promise<boolean> {
+  if (!encrypted) return raw.put(identity, bytes, AbortSignal.timeout(STORAGE_WRITE_MS), expected)
+  const dataKey = unwrapDataKey(key!, 'report', row)
+  const source = encryptStorageStream(Readable.from([bytes]), dataKey, identity, bytes.length)
+  try { return await raw.put(identity, source, AbortSignal.timeout(STORAGE_WRITE_MS), expected, bytes.length) }
+  finally { source.destroy(); dataKey.fill(0) }
+}
+
+async function convertStoredReport(raw: RawObjectStorage, db: StorageDb, key: StorageKey | null, identity: string, bytes: Buffer,
+  mode: (fresh?: boolean) => Promise<StorageEncryptionState | null>): Promise<null> {
+  const id = await verifyReportConversion(db, identity, bytes)
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const state = await mode(true)
+    const row = state ? await db.ensureStorageDataKey('report', id) : await db.getStorageRow('report', id)
+    if (!row) throw new Error('Report deleted during compression')
+    const current = await existingReportConversion(raw, identity, row, key, Boolean(state))
+    if (current?.encrypted && (!state || !row.dataKey)) continue
+    // A stale plaintext writer must never replace a concurrent encrypted
+    // winner. Retain the original on uncertain writes; the next open resumes.
+    if ((!current || state && !current.encrypted) &&
+      !await publishReportConversion(raw, identity, bytes, row, key, current?.version ?? null, Boolean(state))) continue
+    if (!state && await mode(true)) continue
+    await raw.sync?.(identity)
+    await finishReportConversion(raw, db, id, Boolean(state))
+    return null
+  }
+  throw new Error('Report changed repeatedly during compression')
+}
+
 // Startup enables encryption before constructing stores; validate the persisted
 // requirement even when this adapter is opened without a key.
 async function storagePolicy(db: StorageDb, key: StorageKey | null) {
@@ -156,17 +221,18 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
       const owner = storageOwner(identity), state = await mode()
       if (state && owner) {
         const row = await db.getStorageRow(owner.type, owner.id)
-        if (!row || (owner.cache ? !row.dataKey : storageRowPath(owner.type, row) !== identity)) return false
+        if (!row || (owner.cache ? !row.dataKey : !storageRowPaths(owner.type, row).includes(identity))) return false
       }
       // Existence is metadata only; open() authenticates the actual bytes.
       return await raw.head(state && owner?.cache ? encryptedCachePath(identity) : identity) !== null
     },
-    async put(identity, bytes) {
+    async put(identity, bytes, { replaceReport = false } = {}) {
       logicalKey(identity)
+      if (replaceReport) return convertStoredReport(raw, db, key, identity, bytes, mode)
       const state = await mode()
+      const owner = storageOwner(identity)
       if (identity.startsWith('avatars/')) { await raw.put(identity, bytes); return null }
       if (!state) return putPlaintext(raw, identity, bytes, () => mode(true))
-      const owner = storageOwner(identity)
       let dataKey: Buffer, wrapped: string | null = null
       if (owner?.cache) {
         const row = await db.ensureStorageDataKey(owner.type, owner.id)

package/server-managed/storage-maintenance.ts

@@ -1,8 +1,9 @@
+import type { Buffer } from 'node:buffer'
 import { type StorageKey, decryptStorageStream, encryptStorageStream } from '../server-common/storage-crypto.ts'
 import { ENCRYPTED_CACHE_PREFIX, type RawObjectStorage, deleteObjects, isBlobId, openObjectVersion } from './object-storage.ts'
-import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, unwrapDataKey } from './storage-db.ts'
+import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, type StorageRow, type StorageRowKind, unwrapDataKey } from './storage-db.ts'
 import { STORAGE_UPLOAD_TTL_MS } from './storage-encryption.ts'
-import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPath, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
+import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPaths, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
 
 async function replacementFailure(raw: RawObjectStorage, identity: string, version: string, signal: AbortSignal): Promise<string> {
   const format = (value: string) => value.startsWith('W/') ? 'weak' : value.startsWith('"') && value.endsWith('"') ? 'quoted' : 'unquoted'
@@ -21,63 +22,77 @@ async function replacementFailure(raw: RawObjectStorage, identity: string, versi
 }
 
 type MigrationPhase = 'prepare-key' | 'open-payload' | 'verify-existing' | 'encrypt-upload' | 'verify-replacement' | 'checkpoint'
+async function migratePayload(raw: RawObjectStorage, db: StorageDb, type: StorageRowKind, row: StorageRow,
+  dataKey: Buffer, identity: string, signal: AbortSignal, progress: (phase: MigrationPhase) => void): Promise<boolean | string | null> {
+  progress('open-payload')
+  const source = await raw.open(identity, signal)
+  if (!source) return false
+  let inspected = await inspectStorageObject(source)
+  if (inspected.encrypted) {
+    progress('verify-existing')
+    // A previous PUT may have completed before a timeout or lost SQL ack.
+    try {
+      const decoded = await decryptStorageStream(inspected.stream, dataKey, identity)
+      await verifyStoragePayload(type, row, decoded.stream, signal, identity)
+    } catch {
+      signal.throwIfAborted()
+      // Legacy arbitrary bytes can share the magic prefix. A matching
+      // original upload hash is required before encrypting them as plaintext.
+      const legacy = await openObjectVersion(raw, identity, source.version, signal)
+      if (!legacy) return 'Payload disappeared or changed version before plaintext verification'
+      inspected = { ...legacy, encrypted: false }
+    }
+  }
+  if (!inspected.encrypted) {
+    progress('encrypt-upload')
+    signal.throwIfAborted()
+    const verified = verifiedStoragePayload(type, row, inspected.stream, signal, identity)
+    const encrypted = encryptStorageStream(verified, dataKey, identity, inspected.size)
+    let replaced: boolean
+    try { replaced = await raw.put(identity, encrypted, signal, source.version, inspected.size ?? undefined) }
+    // A provider may wrap a request-body error; keep safe payload diagnostics.
+    catch (err) { throw verified.errored ?? err }
+    finally { encrypted.destroy(); verified.destroy(); inspected.stream.destroy(); source.stream.destroy() }
+    if (!replaced) return await replacementFailure(raw, identity, source.version, signal)
+    // Do not mark the row encrypted until the stored bytes authenticate and
+    // match the original upload (including Brotli decompression).
+    progress('verify-replacement')
+    const replacement = await raw.open(identity, signal)
+    if (!replacement) {
+      if (!await db.getStorageRow(type, row.id)) return null
+      throw new StoragePayloadError('Migrated payload unavailable')
+    }
+    const decoded = await decryptStorageStream(replacement.stream, dataKey, identity)
+    await verifyStoragePayload(type, row, decoded.stream, signal, identity)
+  }
+  signal.throwIfAborted()
+  // Persist observed replacements, including both report representations
+  // if they coexist, before marking the whole row encrypted.
+  progress('checkpoint')
+  await raw.sync?.(identity, signal)
+  return true
+}
+
 async function migrateRow(raw: RawObjectStorage, db: StorageDb, key: StorageKey, item: StorageMigrationRow, signal: AbortSignal,
   progress: (phase: MigrationPhase) => void): Promise<string | void> {
   if (item.type === 'user') { await db.migrateStorageUserTokens(item.id); return }
   progress('prepare-key')
   const row = await db.ensureStorageDataKey(item.type, item.id)
   if (!row || row.encrypted) return
-  const dataKey = unwrapDataKey(key, item.type, row), identity = storageRowPath(item.type, row)
+  const dataKey = unwrapDataKey(key, item.type, row)
   try {
-    progress('open-payload')
-    const source = await raw.open(identity, signal)
-    if (!source) {
+    let found = false
+    for (const identity of storageRowPaths(item.type, row)) {
+      const result = await migratePayload(raw, db, item.type, row, dataKey, identity, signal, progress)
+      if (result === null) return
+      if (typeof result === 'string') return result
+      found ||= result
+    }
+    if (!found) {
       if (!await db.getStorageRow(item.type, item.id)) return
       throw new StoragePayloadError('Migration payload unavailable')
     }
-    let inspected = await inspectStorageObject(source)
-    if (inspected.encrypted) {
-      progress('verify-existing')
-      // A previous PUT may have completed before a timeout or lost SQL ack.
-      try {
-        const decoded = await decryptStorageStream(inspected.stream, dataKey, identity)
-        await verifyStoragePayload(item.type, row, decoded.stream, signal)
-      } catch {
-        signal.throwIfAborted()
-        // Legacy arbitrary bytes can share the magic prefix. A matching
-        // original upload hash is required before encrypting them as plaintext.
-        const legacy = await openObjectVersion(raw, identity, source.version, signal)
-        if (!legacy) return 'Payload disappeared or changed version before plaintext verification'
-        inspected = { ...legacy, encrypted: false }
-      }
-    }
-    if (!inspected.encrypted) {
-      progress('encrypt-upload')
-      signal.throwIfAborted()
-      const verified = verifiedStoragePayload(item.type, row, inspected.stream, signal)
-      const encrypted = encryptStorageStream(verified, dataKey, identity, inspected.size)
-      let replaced: boolean
-      try { replaced = await raw.put(identity, encrypted, signal, source.version, inspected.size ?? undefined) }
-      // A provider may wrap a request-body error; keep safe payload diagnostics.
-      catch (err) { throw verified.errored ?? err }
-      finally { encrypted.destroy(); verified.destroy(); inspected.stream.destroy(); source.stream.destroy() }
-      if (!replaced) return await replacementFailure(raw, identity, source.version, signal)
-      // Do not mark the row encrypted until the stored bytes authenticate and
-      // match the original upload (including decompression for sourcemaps).
-      progress('verify-replacement')
-      const replacement = await raw.open(identity, signal)
-      if (!replacement) {
-        if (!await db.getStorageRow(item.type, item.id)) return
-        throw new StoragePayloadError('Migrated payload unavailable')
-      }
-      const decoded = await decryptStorageStream(replacement.stream, dataKey, identity)
-      await verifyStoragePayload(item.type, row, decoded.stream, signal)
-    }
     signal.throwIfAborted()
-    // Another process may have renamed ciphertext but stopped before syncing
-    // the directory. Persist the observed rename even on the resume path.
-    progress('checkpoint')
-    await raw.sync?.(identity, signal)
     await db.markStorageEncrypted(item.type, item.id, row.dataKey!)
   } finally { dataKey.fill(0) }
 }
@@ -116,7 +131,7 @@ async function cleanupLegacy(raw: RawObjectStorage, db: StorageDb, state: Storag
     const { owner, temporary } = target
     if (!temporary && !owner.cache) {
       const row = await db.getStorageRow(owner.type, owner.id)
-      if (row && storageRowPath(owner.type, row) === object.key) continue
+      if (row && storageRowPaths(owner.type, row).includes(object.key)) continue
     }
     const stored = await raw.head(object.key, signal)
     if (!stored) continue

package/server-managed/storage-payload.ts

@@ -11,13 +11,14 @@ import type { StorageRow, StorageRowKind } from './storage-db.ts'
 // not fix it. Keep this distinct from database, storage and cancellation errors.
 export class StoragePayloadError extends Error {}
 
-export function storageRowPath(type: StorageRowKind, row: Pick<StorageRow, 'id' | 'kind'>): string {
-  return `${type === 'report' ? 'reports' : 'bundles'}/${row.id}${type === 'bundle' && row.kind === 'sourcemap' ? '.map.br' : ''}`
+export function storageRowPaths(type: StorageRowKind, row: Pick<StorageRow, 'id' | 'kind'>): string[] {
+  return type === 'report' ? [`reports/${row.id}.br`, `reports/${row.id}`]
+    : [`bundles/${row.id}${row.kind === 'sourcemap' ? '.map.br' : ''}`]
 }
 export function storageOwner(identity: string): { type: StorageRowKind; id: string; cache: boolean } | null {
   const match = /^(reports|bundles)\/([^/]+)$/u.exec(identity)
   if (match) {
-    const id = match[1] === 'bundles' ? match[2]!.replace(/\.map\.br$/u, '') : match[2]!
+    const id = match[2]!.replace(match[1] === 'bundles' ? /\.map\.br$/u : /\.br$/u, '')
     if (isBlobId(id)) return { type: match[1] === 'reports' ? 'report' : 'bundle', id, cache: false }
   }
   const cache = /^cache\/(?:bundles|report-sources)\/([a-f\d-]{36})\//u.exec(identity)
@@ -50,20 +51,20 @@ export async function inspectStorageObject(stored: RawObject): Promise<RawObject
   return { ...stored, stream, encrypted: length === prefix.length && prefix.equals(STORAGE_MAGIC) }
 }
 
-// Sourcemap integrity describes the original upload, before Brotli storage.
+// Report hashes and sourcemap integrity describe the original upload, before Brotli storage.
 // Hash incrementally, including decompression, so migration stays streaming.
-export async function verifyStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal): Promise<void> {
+export async function verifyStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal, identity?: string): Promise<void> {
   const hash = createHash(type === 'report' ? 'sha256' : 'sha512')
   const sink = new Writable({ write(chunk, _encoding, next) { hash.update(chunk); next() } })
   const options = signal ? { signal } : {}
   try {
-    if (type === 'bundle' && row.kind === 'sourcemap') {
+    if (type === 'bundle' && row.kind === 'sourcemap' || type === 'report' && identity?.endsWith('.br')) {
       await pipeline(source, createBrotliDecompress(), sink, options)
     } else await pipeline(source, sink, options)
   } catch (err) {
     const code = (err as NodeJS.ErrnoException).code ?? ''
     if (['Z_DATA_ERROR', 'Z_BUF_ERROR'].includes(code) || code.startsWith('ERR__ERROR_FORMAT_')) {
-      throw new StoragePayloadError('Stored sourcemap cannot be decompressed', { cause: err })
+      throw new StoragePayloadError(`Stored ${type === 'report' ? 'report' : 'sourcemap'} cannot be decompressed`, { cause: err })
     }
     throw err
   }
@@ -73,10 +74,10 @@ export async function verifyStoragePayload(type: StorageRowKind, row: StorageRow
 
 // Forward the stored representation with backpressure, but withhold EOF until
 // its upload hash passes. Encryption cannot emit its final frame, and an atomic
-// PUT cannot commit, until verification (including sourcemap decompression) ends.
-export function verifiedStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal): Readable {
+// PUT cannot commit, until verification (including Brotli decompression) ends.
+export function verifiedStoragePayload(type: StorageRowKind, row: StorageRow, source: Readable, signal?: AbortSignal, identity?: string): Readable {
   const input = new PassThrough(), output = new PassThrough()
-  const verification = verifyStoragePayload(type, row, input, signal)
+  const verification = verifyStoragePayload(type, row, input, signal, identity)
   // Propagate asynchronous decompression errors even if the source is stalled.
   void verification.catch(err => { source.destroy(err); output.destroy(err) })
   const forwarding = pipeline(source, async function* (chunks) {

package/server-managed/storage-stores.ts

@@ -5,6 +5,7 @@ import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
 import type { BundleCacheStorage } from './bundle-cache.ts'
 import { createBundleStore } from './bundle-store.ts'
+import { createReportStore } from './report-store.ts'
 import { CacheMissError, type CacheStorage, validateCacheKey } from './cache-storage.ts'
 import { type ObjectStorage, isBlobId } from './object-storage.ts'
 
@@ -71,7 +72,8 @@ export function createManagedStores(objects: ObjectStorage, avatarSidecar: boole
     delete: value => bundles.delete(id(value)),
   }
   return {
-    reportStore: blobStore(objects, 'reports'),
+    reportStore: createReportStore(blobStore(objects, 'reports'), blobStore(objects, 'reports', '.br'),
+      (value, bytes) => objects.put(`reports/${id(value)}.br`, bytes, { replaceReport: true })),
     bundleStore: createBundleStore(blobStore(objects, 'bundles'), blobStore(objects, 'bundles', '.map.br')),
     uploadStore: blobStore(objects, 'uploads'),
     avatarStore: avatarStore(objects, avatarSidecar),

package/server-managed/storage.ts

@@ -34,6 +34,23 @@ export async function openManagedStorage(config: ManagedConfig) {
     }
     const objects = await createEncryptedObjectStorage(raw, db, key)
     const storage = createManagedStores(objects, !config.neonUrl)
+    // Move legacy team link uploads into encrypted SQL before serving catalogs.
+    // The DB transaction commits first; a failed blob cleanup cannot lose links.
+    for (const report of await db.listLegacyLinkReports()) {
+      if (!key) throw new Error('Migrating managed link reports requires MANAGED_STORAGE_ENCRYPTION_KEY')
+      let bytes
+      try { bytes = await storage.reportStore.get(report.id) } catch (error) {
+        if (!await db.getReport(report.id)) continue // another instance completed migration
+        throw error
+      }
+      if (!bytes) {
+        if (!await db.getReport(report.id)) continue
+        throw new Error(`Missing legacy link report: ${report.id}`)
+      }
+      if (await db.migrateLinkReport(report.id, bytes.toString('utf8'))) {
+        await storage.reportStore.delete(report.id).catch(error => console.warn('managed: legacy link cleanup failed:', error))
+      }
+    }
     return { ...storage, db, uploadStore: config.neonUrl ? storage.uploadStore : undefined,
       bundleCache: createBundleCache(storage.cacheStorage, db, storage.bundleStore),
       reportSourcesCache: createReportSourcesCache(storage.reportSourcesStorage, db, storage.reportStore, storage.bundleStore),

package/server-managed/team-feed.ts

@@ -47,7 +47,7 @@ export async function serveTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
 // the focused team needs report parsing or annotation reads; null is the
 // catalog-only subscription used on landing and management pages.
 export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
-  sessionId: string, user: StoredUser, teamId: string | null, options: FeedOptions = {}): Promise<void> {
+  sessionId: string, user: StoredUser, teamId: string | null, options: FeedOptions & { reportId?: string | null } = {}): Promise<void> {
   let ids: string[] = [], visibilityKey: string | undefined
   let focusedKey: string | undefined
   let previousState: { catalog: number; annotations: number } | undefined
@@ -86,7 +86,7 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
       return
     }
     let triage: string | undefined
-    const snapshot = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId)
+    const snapshot = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
     if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
     checkUser(snapshot)
     const key = teamSnapshotKey(snapshot)
@@ -102,7 +102,7 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
       }
     }
     if (snapshot.teamId) triage = JSON.stringify([key, await deps.db.getAnnotationRevision(ids)])
-    const current = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId)
+    const current = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
     // A concurrent access/content change discards only the annotation read.
     checkUser(current)
     if (!current || teamSnapshotKey(current) !== key) return

package/server-managed/team-reports.ts

@@ -1,5 +1,6 @@
 // Team content is filtered as one workspace, with separate report envelopes.
 // Bounded snapshots retain filtered content and visibility for repeated reads.
+import { mergeLinkGroups } from './link-reports.ts'
 import { Buffer } from 'node:buffer'
 import { backfillFindingIds, reportEntries, stampSecurityGroups } from '@preventive/report'
 import { managedFindingSourcePaths, readManagedReport } from '../common/managed/report-content.ts'
@@ -7,6 +8,7 @@ import { filterReportData, projectFinding } from '../common/managed/report-filte
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
 import { triageWireEntry } from './triage-response.ts'
+import { visibleManagedIssues } from './managed-issues.ts'
 import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 
 type Finding = Record<string, unknown>
@@ -54,16 +56,17 @@ export class TeamReportsError extends Error {
   constructor(status: number, error: string) { super(error); this.status = status }
 }
 export function teamSnapshotKey(snapshot: TeamReportAccessSnapshot): string {
-  return JSON.stringify([snapshot.user.id, snapshot.user.role, snapshot.teamId, snapshot.reports, snapshot.repositories])
+  return JSON.stringify([snapshot.user.id, snapshot.user.role, snapshot.teamId, snapshot.hiddenReportId ?? null, snapshot.reports, snapshot.repositories, snapshot.linkRevision])
 }
-export async function teamSnapshot(db: ManagedDb, sessionId: string, teamId: string): Promise<TeamReportAccessSnapshot> {
-  const snapshot = await db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId)
+export async function teamSnapshot(db: ManagedDb, sessionId: string, teamId: string, reportId: string | null = null): Promise<TeamReportAccessSnapshot> {
+  const snapshot = await db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, reportId)
   if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
   if (!snapshot.teamId) throw new TeamReportsError(404, 'no-team')
+  if (reportId !== null && !snapshot.reports.some(report => report.id === reportId)) throw new TeamReportsError(404, 'no-report')
   return snapshot
 }
 export async function recheckTeam(db: ManagedDb, sessionId: string, snapshot: TeamReportAccessSnapshot): Promise<void> {
-  if (teamSnapshotKey(await teamSnapshot(db, sessionId, snapshot.teamId!)) !== teamSnapshotKey(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
+  if (teamSnapshotKey(await teamSnapshot(db, sessionId, snapshot.teamId!, snapshot.reportId)) !== teamSnapshotKey(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
 }
 function groupsOf(data: unknown): Finding[][] {
   return (reportEntries(data) ?? []).map(entry => (Array.isArray(entry) ? entry : [entry]).filter(
@@ -100,6 +103,7 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
     }
   }))
   for (const result of results) if (result.status === 'rejected') throw result.reason
+  const globalLinks = snapshot.linkRevision ? await db.getEnabledLinkGroups(snapshot.linkRevision) : []
   const edges = new Map<string, Set<string>>()
   const connect = (a: string, b: string) => {
     if (!edges.has(a)) edges.set(a, new Set())
@@ -107,10 +111,8 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   }
   // A star is enough for transitive security propagation, without a quadratic
   // expansion for large links. Unknown IDs can connect known findings.
-  for (const report of reports) {
-    for (const ids of linksOf(report.data) ?? []) {
-      for (const id of ids.slice(1)) { connect(ids[0]!, id); connect(id, ids[0]!) }
-    }
+  for (const ids of globalLinks.concat(reports.flatMap(report => linksOf(report.data) ?? []))) {
+    for (const id of ids.slice(1)) { connect(ids[0]!, id); connect(id, ids[0]!) }
   }
   const groups = reports.flatMap(report => groupsOf(report.data).map(group => group.map(f => projectFinding(f, report.data as Finding)!)))
   stampSecurityGroups(groups, { linkedIds: id => edges.get(id) ?? [] })
@@ -130,7 +132,9 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   }
   for (const report of reports) {
     const links = linksOf(report.data)
-    if (links) report.data = { source: 'links', findings: [], links: links.map(ids => [...new Set(ids.filter(id => allIds.has(id)))]).filter(ids => ids.length >= 2) }
+    // Hidden previews are independently authorized; preserve a hidden links
+    // document even though its referenced findings are outside this response.
+    if (links && !snapshot.hiddenReportId) report.data = { source: 'links', findings: [], links: links.map(ids => [...new Set(ids.filter(id => allIds.has(id)))]).filter(ids => ids.length >= 2) }
   }
   let outputBytes = 14
   const parts = [Buffer.from('{"reports":[')]
@@ -141,7 +145,10 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
     if (index) parts.push(Buffer.from(','))
     parts.push(bytes)
   }
-  parts.push(Buffer.from(']}'))
+  const links = mergeLinkGroups(globalLinks, allIds)
+  const suffix = Buffer.from(links.length > 0 ? `],"links":${JSON.stringify(links)}}` : ']}')
+  if (outputBytes + suffix.length > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+  parts.push(suffix)
   const body = Buffer.concat(parts)
   retainVisibility(db, teamSnapshotKey(snapshot), visible)
   retainReports(db, teamSnapshotKey(snapshot), body)
@@ -190,13 +197,13 @@ export async function teamReportVisibility(db: ManagedDb, store: BlobStore, snap
   return visible.get(reportId)!
 }
 export async function teamFindingIds(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
-  const snapshot = await teamSnapshot(db, sessionId, teamId)
+  const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
   const visible = await teamReportVisibility(db, store, snapshot, reportId)
   await recheckTeam(db, sessionId, snapshot)
   return visible.ids
 }
 export async function teamSourcePaths(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
-  const snapshot = await teamSnapshot(db, sessionId, teamId)
+  const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
   const visible = await teamReportVisibility(db, store, snapshot, reportId)
   await recheckTeam(db, sessionId, snapshot)
   return visible.sourcePaths
@@ -211,9 +218,11 @@ export async function loadTeamAnnotations(db: ManagedDb, store: BlobStore, snaps
     : new Map([[reportId, await teamReportVisibility(db, store, snapshot, reportId)]])
   const ids = new Set<string>()
   for (const report of visible.values()) for (const id of report.ids) ids.add(id)
-  const { triage, comments } = await db.getAnnotations([...ids])
+  const { triage, comments, issues: savedIssues } = await db.getAnnotations([...ids])
+  const issues = Object.fromEntries(visibleManagedIssues(savedIssues, snapshot)
+    .map(issue => [issue.findingId, { url: issue.issueUrl!, autoFix: issue.autoFixUrl }]))
   const entries = Object.fromEntries(triage.map(row => [row.findingId, triageWireEntry(row)]))
-  const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId)])
+  const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId), ...Object.keys(issues)])
   const reports = Object.fromEntries([...visible].map(([id, report]) => [id, [...report.ids].filter(finding => annotated.has(finding))]))
-  return { reports, entries, comments }
+  return { reports, entries, comments, issues }
 }

package/server-managed/upstream-cache.ts

@@ -0,0 +1,73 @@
+import type { CacheStore } from '@preventive/upstream/advisories.js'
+import type { ManagedSql } from './sql.ts'
+
+// Records @preventive/upstream would otherwise keep in its disk cache, shared
+// by every instance: each repository's published advisory listing, written by
+// dependency audits that ask repositories, keyed `github/advisories/owner/name`.
+// Upstream stamps, validates and expires each value (90 minutes for a listing);
+// a refresh replaces the row, and there is one row per repository, so rows are
+// not evicted. Only public repositories publish advisories: rows are shared
+// across viewers.
+export const UPSTREAM_CACHE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_upstream_cache (
+  cache_key TEXT PRIMARY KEY,
+  value     TEXT NOT NULL,
+  cached_at INTEGER NOT NULL
+) STRICT;
+`
+
+export interface UpstreamCacheStore {
+  getUpstreamCacheEntry(key: string): Promise<string | null>
+  setUpstreamCacheEntry(key: string, value: string, cachedAt: number): Promise<void>
+}
+
+export function upstreamCacheMethods(db: ManagedSql): UpstreamCacheStore {
+  const get = db.prepare('SELECT value FROM managed_upstream_cache WHERE cache_key = ?')
+  // A slower concurrent audit cannot replace a newer listing with an older one.
+  const set = db.prepare(`INSERT INTO managed_upstream_cache (cache_key, value, cached_at) VALUES (?, ?, ?)
+    ON CONFLICT (cache_key) DO UPDATE SET value = excluded.value, cached_at = excluded.cached_at
+    WHERE managed_upstream_cache.cached_at <= excluded.cached_at`)
+  return {
+    async getUpstreamCacheEntry(key) {
+      const row = await get.get(key) as { value: string } | undefined
+      return row?.value ?? null
+    },
+    async setUpstreamCacheEntry(key, value, cachedAt) {
+      await set.run(key, value, cachedAt)
+    },
+  }
+}
+
+// An audit's `cache`: where the server has an upstream disk cache (off Vercel,
+// set at startup), that keeps everything; else this store keeps listings.
+export function auditCache(cacheDir: string | null | undefined, db: UpstreamCacheStore, signal: AbortSignal, debug = false): CacheStore | undefined {
+  return cacheDir ? undefined : upstreamCache(db, signal, debug)
+}
+
+// Only listings are kept: upstream's other records (npm version documents,
+// registries' repository lookups) read as misses and are not written.
+const CACHED_TYPE = 'github/advisories'
+
+// The cache is an optimization: a database failure is a miss, never a failed
+// audit. Upstream keeps listing after an abandoned audit; once `signal` aborts,
+// the request's database work is over and the store is left alone.
+export function upstreamCache(db: UpstreamCacheStore, signal: AbortSignal, debug = false): CacheStore {
+  return {
+    async read(type, key) {
+      if (type !== CACHED_TYPE || signal.aborted) return null
+      try {
+        const value = await db.getUpstreamCacheEntry(`${type}/${key}`)
+        return value === null ? null : JSON.parse(value) as unknown
+      } catch (error) {
+        if (debug) console.warn('managed: upstream cache read failed:', error)
+        return null
+      }
+    },
+    async write(type, key, value) {
+      if (type !== CACHED_TYPE || signal.aborted) return
+      try { await db.setUpstreamCacheEntry(`${type}/${key}`, JSON.stringify(value), Date.now()) } catch (error) {
+        if (debug) console.warn('managed: upstream cache write failed:', error)
+      }
+    },
+  }
+}