@preventive/triage 1.0.0-alpha.33 → 1.0.0-alpha.35

package/server-managed/db-methods.ts

@@ -1,3 +1,5 @@
+import { type LinkReportStore, linkReportMethods, linkRevision } from './link-reports.ts'
+import { type RepositoryAliasStore, repositoryAliasMethods } from './repository-aliases.ts'
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
 import { type Role, roleAtLeast } from '../common/managed/roles.ts'
@@ -8,7 +10,9 @@ import { type CommentStore, commentMethods } from './comments.ts'
 import { type ActivityStore, activityMethods } from './activity.ts'
 import { type GithubMetadataStore, githubMetadataMethods } from './github-metadata.ts'
 import { type ManagedIssueStore, managedIssueMethods } from './managed-issues.ts'
+import type { IssueFixUpdate } from './github-issue-links.ts'
 import { type BundleBuildLeaseStore, bundleBuildLeaseMethods } from './bundle-build-leases.ts'
+import { type UpstreamCacheStore, upstreamCacheMethods } from './upstream-cache.ts'
 import { type ImportTriageStore, importTriageMethods } from './import-triage.ts'
 import type { ManagedSql } from './sql.ts'
 import { type WorkspaceShareStore, workspaceShareMethods } from './workspace-shares.ts'
@@ -126,10 +130,13 @@ export interface ReportAccessRecord {
 }
 export interface TeamReportAccessSnapshot extends ReportAccessSnapshot {
   teamId: string | null
+  reportId?: string | null
+  hiddenReportId?: string | null
   repositories: { repoId: number; github: string; path: string | null }[]
 }
 export interface ReportAccessSnapshot {
   user: StoredUser
+  linkRevision?: string
   reports: ReportAccessRecord[]
 }
 
@@ -218,10 +225,19 @@ export interface TriageEventRow {
   at: number
 }
 
+// How a bundle's bytes arrived: uploaded, or generated by this server from a
+// repository. null predates the distinction (possibly built).
+export type BundleProvenance = 'upload' | 'build'
+
+// The preset, export conditions and Metro platforms a server build of a JS/TS
+// bundle resolved with, as the build request named them. Stored as JSON.
+export interface BundleBuildConditions { preset: 'node' | 'browser' | 'metro'; conditions: string[]; platforms: string[] }
+
 // A stored bundle's metadata. Bytes live in the blob-store keyed by `id`;
 // `integrity` (sha512-<base64>) is the content-addressed identity (UNIQUE),
 // matched against a report's bundleHashes to auto-link.
 export interface ManagedBundle {
+  visible: boolean
   id: string
   slug: string
   integrity: string
@@ -232,15 +248,25 @@ export interface ManagedBundle {
   repoDirectory: string
   repoId: number | null
   uploadedAt: number
+  provenance: BundleProvenance | null
+  // null for uploads, Solidity builds, and builds predating the column.
+  buildConditions: BundleBuildConditions | null
 }
 
 // What the upload handler supplies to record a bundle; the store stamps
 // uploaded_at. `uploadedByLogin` is the durable uploader-login snapshot.
-export type BundleInput = Omit<ManagedBundle, 'uploadedAt' | 'slug' | 'repoDirectory'> & { uploadedByLogin: string | null; repoDirectory?: string; dataKey?: string | null }
+export type BundleInput = Omit<ManagedBundle, 'uploadedAt' | 'slug' | 'repoDirectory' | 'visible' | 'provenance' | 'buildConditions'> & {
+  visible?: boolean; uploadedByLogin: string | null; repoDirectory?: string; dataKey?: string | null; provenance?: BundleProvenance | null
+  buildConditions?: BundleBuildConditions | null
+}
+
+// A repeated upload or build of stored bytes (see reuseBundle).
+export interface BundleReuse { provenance: BundleProvenance; filename: string; kind: string | null; rename: boolean; buildConditions?: BundleBuildConditions | null }
 
 // A bundle row for the "Manage bundles" list — adds the uploader login + repo
 // full name display joins (null when absent / since removed).
 export interface AdminBundle {
+  visible: boolean
   id: string
   slug: string
   integrity: string
@@ -252,6 +278,7 @@ export interface AdminBundle {
   repoId: number | null
   repoFullName: string | null
   uploadedAt: number
+  provenance: BundleProvenance | null
 }
 
 // A team's repo link (with its optional subpath) and member (with resolved
@@ -271,6 +298,7 @@ export interface AdminTeam {
   id: string
   slug: string
   name: string
+  hidden: boolean
   repos: TeamRepoLink[]
   members: TeamMember[]
 }
@@ -289,6 +317,7 @@ export type UserOption = {
 // bundles attached to the team's repos (id + filename, newest first). An item
 // shows under a team when its repo is one of the team's linked repos.
 export interface UserTeamReport {
+  visible: boolean
   id: string
   slug: string
   filename: string
@@ -298,6 +327,7 @@ export interface UserTeamReport {
   cacheKey: string
 }
 export interface UserTeamBundle {
+  visible: boolean
   id: string
   slug: string
   integrity: string
@@ -307,6 +337,7 @@ export interface UserTeamBundle {
   repoDirectory: string
   repoId: number
   repoFullName: string
+  provenance: BundleProvenance | null
 }
 export interface UserTeam {
   id: string
@@ -319,7 +350,7 @@ export interface UserTeam {
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, BundleBuildLeaseStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb {
+export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore {
   claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
   finishMaintenanceLease(owner: string, until: number): Promise<void>
   getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
@@ -375,7 +406,7 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   getReport(id: string): Promise<ReportRecord | null>
   // Writer-locked reconciliation waits for an uncertain earlier insert.
   resolveReportUpload(id: string): Promise<ReportRecord | null>
-  getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null>
+  getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string, reportId?: string | null): Promise<TeamReportAccessSnapshot | null>
   getReportAccessSnapshot(sessionId: string, now: number, ids: readonly string[]): Promise<ReportAccessSnapshot | null>
   listReportFilenamesWithBundleHash(bundleId: string, sha256: string): Promise<string[]>
   deleteReport(id: string): Promise<boolean>
@@ -395,7 +426,8 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // stamp nor the trail. Every change also appends to managed_finding_triage_event;
   // listTriageHistory walks one finding's trail, newest first.
   listTriage(findingIds: readonly string[]): Promise<TriageRow[]>
-  getAnnotations(findingIds: readonly string[]): Promise<{ triage: TriageRow[]; comments: Awaited<ReturnType<CommentStore['listComments']>> }>
+  getAnnotations(findingIds: readonly string[]): Promise<{ triage: TriageRow[]; comments: Awaited<ReturnType<CommentStore['listComments']>>; issues: Awaited<ReturnType<ManagedIssueStore['listManagedIssues']>> }>
+  applyManagedIssueFixes(sessionId: string, snapshot: TeamReportAccessSnapshot, updates: IssueFixUpdate[]): Promise<boolean>
   // A content-free fingerprint of current annotations, read in one snapshot.
   getAnnotationRevision(findingIds: readonly string[]): Promise<string>
   setTriage(findingId: string, entry: TriageEntryPatch | null, updatedBy: string | null, updatedByLogin: string | null, now: number): Promise<void>
@@ -407,8 +439,14 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // uploader login + repo; deleteBundle resolves true iff a row was removed
   // (referencing reports' bundle_id null out via the FK). linkReportsToBundle
   // attaches a freshly-stored bundle to the (still-unlinked) reports that
-  // declared its integrity.
+  // declared its integrity. reuseBundle records a repeated upload or build of
+  // stored bytes: a build always marks the row built and records its conditions
+  // where the row has none, and with `rename` an uploaded row takes the new
+  // filename/kind. A built row is never renamed; one predating provenance is
+  // renamed only by a build. Resolves true iff changed.
+  // The caller authorizes `rename` (see reuseBundleUpload).
   insertBundle(bundle: BundleInput, now: number, sessionId?: string): Promise<void>
+  reuseBundle(id: string, reuse: BundleReuse): Promise<boolean>
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
   resolveBundleUpload(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
@@ -427,31 +465,34 @@ export interface ManagedDb extends ActivityStore, CommentStore, GithubMetadataSt
   // Set a bundle's repository and normalized directory (repoId null detaches
   // and clears the directory). The caller validates the location and access.
   setBundleRepo(id: string, repoId: number | null, directory?: string): Promise<boolean>
+  setBundleVisible(id: string, visible: boolean): Promise<boolean>
   linkReportsToBundle(integrity: string, bundleId: string, userId?: string): Promise<void>
   // Teams ("Manage teams"). createTeam inserts a team (false iff the name is
   // taken); renameTeam changes a team's name ('name-taken' iff another team
   // already has it, 'not-found' iff no such team, 'ok' otherwise — same name is
   // idempotent); deleteTeam drops it (cascading its links); listTeams returns
-  // every team with its repos + members inlined; listUserOptions is the id+login+name
+  // every team (including hidden ones) with its repos + members inlined; listUserOptions is the id+login+name
   // set for the member picker. The set*/remove* pairs maintain the link tables:
   // setTeamRepo adds a path (whole repo replaces paths); setTeamMember upserts a
   // membership + its visibility permissions (each resolves true iff a row was
   // written / removed; the caller validates the team/repo/user exist first).
   createTeam(id: string, name: string, now: number): Promise<boolean>
   renameTeam(id: string, name: string, now: number): Promise<'ok' | 'name-taken' | 'not-found'>
+  // Hiding preserves links but disables all grants and workspace access.
+  setTeamHidden(id: string, hidden: boolean, now: number): Promise<boolean>
   deleteTeam(id: string): Promise<boolean>
-  getTeam(id: string): Promise<{ id: string; slug: string; name: string } | null>
+  getTeam(id: string): Promise<{ id: string; slug: string; name: string; hidden: boolean } | null>
   listTeams(): Promise<AdminTeam[]>
   listUserOptions(): Promise<UserOption[]>
   // Current grants for manager content reads, writes, and repository pickers.
   listRepoScopesForUser(userId: string): Promise<{ repoId: number; path: string | null }[]>
-  // The teams a given user belongs to (name-sorted), each with reports and
+  // The non-hidden teams a given user belongs to (name-sorted), each with reports and
   // bundles attached to that team's repos — for that user's own sidebar Teams section.
   // Any user; only their own memberships.
   listTeamsForUser(userId: string): Promise<UserTeam[]>
   getUserTeamFeedSnapshot(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; revision: string; teams: UserTeam[]; catalog: number } | null>
   // Whether `userId` may read `reportId`: true iff the report's repo belongs to
-  // a team the user is a member of. Backs the team-scoped report view endpoint.
+  // a non-hidden team the user is a member of. Backs the team-scoped report view endpoint.
   userCanReadReport(userId: string, reportId: string): Promise<boolean>
   // The viewer's effective visibility permissions for a report, OR'd across the
   // teams (holding the report's repo) the user belongs to — drives the content
@@ -480,6 +521,14 @@ const REPORT_IN_TEAM_PATH_SQL = `(tr.path IS NULL OR tr.path = ''
 
 const BUNDLE_IN_TEAM_PATH_SQL = REPORT_IN_TEAM_PATH_SQL.replaceAll('r.repo_directory', 'b.repo_directory')
 
+// Whether a repeated upload/build renames the stored row. Uploads never rename
+// a built row, or one whose provenance is unknown; builds rename either. The
+// kind must stay readable from its blob store (sourcemaps are stored apart):
+// keep it, or let an unrecognized archive become Stasis — never downgrade.
+const BUNDLE_RENAMED_SQL = `(:rename = 1 AND (provenance = 'upload' OR (:provenance = 'build' AND provenance IS NULL))
+  AND (COALESCE(kind, '') = COALESCE(:kind, '') OR (kind IS NULL AND :kind = 'stasis'))
+  AND (filename <> :filename OR kind IS DISTINCT FROM :kind))`
+
 // Prepare every statement the store uses, returned as a bag the factory
 // destructures — keeps openSqliteManagedDb itself small (one place per query).
 function prepareStatements(db: ManagedSql) {
@@ -598,6 +647,7 @@ function prepareStatements(db: ManagedSql) {
          LEFT JOIN managed_bundle b ON b.id = r.bundle_id
         WHERE (? IS NULL OR r.uploaded_by = ? OR EXISTS (
           SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+          JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
           WHERE tr.repo_id = r.repo_id AND tu.user_id = ? AND ${REPORT_IN_TEAM_PATH_SQL}))
         ORDER BY r.uploaded_at DESC, r.filename ASC`,
     ),
@@ -619,6 +669,7 @@ function prepareStatements(db: ManagedSql) {
            FROM managed_report r JOIN requested q ON q.id = r.id
            JOIN managed_team_repo tr ON tr.repo_id = r.repo_id AND ${REPORT_IN_TEAM_PATH_SQL}
            JOIN managed_team_user tu ON tu.team_id = tr.team_id AND tu.user_id = ?
+           JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
           GROUP BY r.id
        )
        SELECT r.id AS id, r.filename AS filename, r.byte_size AS byteSize, r.sha256 AS sha256,
@@ -630,21 +681,23 @@ function prepareStatements(db: ManagedSql) {
         WHERE ? = 1 OR (? = 1 AND r.uploaded_by = ?)
            OR (g.id IS NOT NULL AND (? = 1 OR r.visible = 1))`,
     ),
-    selectTeamAccessStmt: db.prepare(`SELECT 1 FROM managed_team_user WHERE user_id = ? AND team_id = ?`),
+    selectTeamAccessStmt: db.prepare(`SELECT 1 FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id
+      WHERE tu.user_id = ? AND tu.team_id = ? AND t.hidden = 0`),
     selectTeamRepositoriesStmt: db.prepare(
       `SELECT tr.repo_id AS repoId, sr.full_name AS github, tr.path AS path
          FROM managed_team_repo tr JOIN managed_selected_repo sr ON sr.repo_id = tr.repo_id
         WHERE tr.team_id = ? ORDER BY tr.repo_id, tr.path`,
     ),
     selectTeamReportAccessStmt: db.prepare(
-      `SELECT DISTINCT r.id AS id, r.filename AS filename, r.byte_size AS byteSize, r.sha256 AS sha256,
+      `SELECT DISTINCT r.id AS id, r.filename AS filename, r.byte_size AS byteSize, r.sha256 AS sha256, r.visible AS visible,
               r.repo_directory AS repoDirectory, sr.full_name AS repoFullName,
               tu.view_dependencies AS dependencies, tu.view_security AS security
          FROM managed_team_user tu
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
          JOIN managed_team_repo tr ON tr.team_id = tu.team_id
          JOIN managed_report r ON r.repo_id = tr.repo_id AND ${REPORT_IN_TEAM_PATH_SQL}
          LEFT JOIN managed_selected_repo sr ON sr.repo_id = r.repo_id
-        WHERE tu.user_id = ? AND tu.team_id = ? AND (r.visible = 1 OR ? = 1)
+        WHERE tu.user_id = ? AND tu.team_id = ? AND (r.visible = 1 OR (? = 1 AND r.id = ?))
         ORDER BY r.id`,
     ),
     reportFilenamesWithBundleHashStmt: db.prepare(`SELECT DISTINCT filename FROM managed_report WHERE bundle_id = ? AND sha256 = ?`),
@@ -707,58 +760,80 @@ function prepareStatements(db: ManagedSql) {
       WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY id`),
     insertBundleStmt: db.prepare(
       `WITH candidate(id, slug) AS (VALUES (?, ?))
-       INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, uploaded_at, data_key, storage_encrypted)
+       INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, visible, uploaded_at, data_key, storage_encrypted, provenance, build_conditions)
        SELECT id, CASE WHEN EXISTS (SELECT 1 FROM managed_bundle WHERE slug = candidate.slug) THEN id ELSE slug END,
-              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
+              ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM candidate`,
+    ),
+    // SET reads the pre-update row. Unchanged rows match nothing, so identical
+    // retries do not bump the catalog revision. Conditions that rebuild the same
+    // bytes describe them equally, so the first recorded ones stay.
+    reuseBundleStmt: db.prepare(
+      `UPDATE managed_bundle SET
+         filename = CASE WHEN ${BUNDLE_RENAMED_SQL} THEN :filename ELSE filename END,
+         kind = CASE WHEN ${BUNDLE_RENAMED_SQL} THEN :kind ELSE kind END,
+         provenance = CASE WHEN :provenance = 'build' THEN 'build' ELSE provenance END,
+         build_conditions = CASE WHEN :provenance = 'build' THEN COALESCE(build_conditions, :buildConditions) ELSE build_conditions END
+       WHERE id = :id AND (${BUNDLE_RENAMED_SQL} OR (:provenance = 'build' AND (provenance IS DISTINCT FROM 'build'
+         OR build_conditions IS DISTINCT FROM COALESCE(build_conditions, :buildConditions))))`,
     ),
     selectBundleByIntegrityStmt: db.prepare(
       `SELECT id, slug, integrity, filename, kind, byte_size AS byteSize,
-              uploaded_by AS uploadedBy, repo_id AS repoId, repo_directory AS repoDirectory, uploaded_at AS uploadedAt
+              uploaded_by AS uploadedBy, repo_id AS repoId, repo_directory AS repoDirectory, visible, uploaded_at AS uploadedAt, provenance,
+              build_conditions AS buildConditions
          FROM managed_bundle WHERE integrity = ?`,
     ),
     selectBundleStmt: db.prepare(
       `SELECT id, slug, integrity, filename, kind, byte_size AS byteSize,
-              uploaded_by AS uploadedBy, repo_id AS repoId, repo_directory AS repoDirectory, uploaded_at AS uploadedAt
+              uploaded_by AS uploadedBy, repo_id AS repoId, repo_directory AS repoDirectory, visible, uploaded_at AS uploadedAt, provenance,
+              build_conditions AS buildConditions
          FROM managed_bundle WHERE id = ?`,
     ),
     selectBundlesStmt: db.prepare(
       `SELECT b.id AS id, b.slug AS slug, b.integrity AS integrity, b.filename AS filename, b.kind AS kind,
               b.byte_size AS byteSize, COALESCE(u.login, b.uploaded_by_login) AS uploadedByLogin,
-              b.repo_id AS repoId, b.repo_directory AS repoDirectory, sr.full_name AS repoFullName, b.uploaded_at AS uploadedAt
+              b.repo_id AS repoId, b.repo_directory AS repoDirectory, b.visible, sr.full_name AS repoFullName, b.uploaded_at AS uploadedAt, b.provenance
          FROM managed_bundle b
          LEFT JOIN managed_user u ON u.id = b.uploaded_by
          LEFT JOIN managed_selected_repo sr ON sr.repo_id = b.repo_id
         WHERE (? IS NULL OR (b.uploaded_by = ? OR EXISTS (
           SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+          JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
           WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?)))
         ORDER BY b.uploaded_at DESC, b.filename ASC`,
     ),
     selectBundleReadableStmt: db.prepare(
       `SELECT 1 FROM managed_bundle b WHERE b.id = ? AND (b.uploaded_by = ? OR EXISTS (
           SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+          JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
           WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?))`,
     ),
     selectReadableBundleIdsStmt: db.prepare(
       `SELECT b.id FROM managed_bundle b WHERE b.id IN (SELECT value FROM json_each(?)) AND (b.uploaded_by = ? OR EXISTS (
           SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+          JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
           WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = ?))`,
     ),
     selectRepoReadableStmt: db.prepare(
       `SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
         WHERE tr.repo_id = ? AND tu.user_id = ? LIMIT 1`,
     ),
     selectRepoPathReadableStmt: db.prepare(
       `WITH r(repo_directory) AS (VALUES (?))
         SELECT 1 FROM r JOIN managed_team_repo tr ON tr.repo_id = ? AND ${REPORT_IN_TEAM_PATH_SQL}
-        JOIN managed_team_user tu ON tu.team_id = tr.team_id WHERE tu.user_id = ? LIMIT 1`,
+        JOIN managed_team_user tu ON tu.team_id = tr.team_id
+        JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+        WHERE tu.user_id = ? LIMIT 1`,
     ),
     deleteBundleStmt: db.prepare(`DELETE FROM managed_bundle WHERE id = ?`),
     setBundleRepoStmt: db.prepare(`UPDATE managed_bundle SET repo_id = ?, repo_directory = ? WHERE id = ?`),
+    setBundleVisibleStmt: db.prepare(`UPDATE managed_bundle SET visible = ? WHERE id = ?`),
     // Attach a freshly-stored bundle to the reports that declared its integrity
     // but haven't been linked yet (bundle uploaded after the report).
     linkReportsToBundleStmt: db.prepare(
       `UPDATE managed_report AS r SET bundle_id = ? WHERE bundle_integrity = ? AND bundle_id IS NULL
        AND (? IS NULL OR r.uploaded_by = ? OR EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
          WHERE tu.user_id = ? AND tr.repo_id = r.repo_id AND ${REPORT_IN_TEAM_PATH_SQL}))`,
     ),
     // OR IGNORE: a duplicate name (UNIQUE) is the "taken" signal (0 changes); the
@@ -768,30 +843,33 @@ function prepareStatements(db: ManagedSql) {
       SELECT id, CASE WHEN EXISTS (SELECT 1 FROM managed_team WHERE slug = candidate.slug) THEN id ELSE slug END,
              ?, ?, ? FROM candidate`),
     deleteTeamStmt: db.prepare(`DELETE FROM managed_team WHERE id = ?`),
-    selectTeamStmt: db.prepare(`SELECT id, slug, name FROM managed_team WHERE id = ?`),
+    selectTeamStmt: db.prepare(`SELECT id, slug, name, hidden FROM managed_team WHERE id = ?`),
     selectTeamByNameStmt: db.prepare(`SELECT id FROM managed_team WHERE name = ?`),
     renameTeamStmt: db.prepare(`UPDATE managed_team SET name = ?, updated_at = ? WHERE id = ?`),
-    selectTeamsStmt: db.prepare(`SELECT id, slug, name FROM managed_team ORDER BY name ASC`),
+    setTeamHiddenStmt: db.prepare(`UPDATE managed_team SET hidden = ?, updated_at = ? WHERE id = ?`),
+    selectTeamsStmt: db.prepare(`SELECT id, slug, name, hidden FROM managed_team ORDER BY name ASC`),
     selectTeamsForUserStmt: db.prepare(
       `SELECT t.id AS id, t.slug AS slug, t.name AS name,
               tu.view_dependencies AS dependencies, tu.view_security AS security
          FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id
-        WHERE tu.user_id = ? ORDER BY t.name ASC, t.id ASC`,
+        WHERE tu.user_id = ? AND t.hidden = 0 ORDER BY t.name ASC, t.id ASC`,
     ),
     selectUserTeamScopesStmt: db.prepare(
       `SELECT tr.team_id AS teamId, tr.repo_id AS repoId, tr.path AS path, sr.full_name AS fullName
          FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
          JOIN managed_selected_repo sr ON sr.repo_id = tr.repo_id
         WHERE tu.user_id = ? ORDER BY tr.team_id, tr.repo_id, tr.path`,
     ),
     // Reports attached to the repos of the user's teams, tagged by team (a report
     // shows under every team whose repo it's attached to). Newest first.
     selectUserTeamReportsStmt: db.prepare(
-      `SELECT DISTINCT tr.team_id AS teamId, r.id AS id, r.slug AS slug, r.filename AS filename, r.analyzer, r.uploaded_at,
+      `SELECT DISTINCT tr.team_id AS teamId, r.id AS id, r.slug AS slug, r.filename AS filename, r.analyzer, r.visible, r.uploaded_at,
               r.sha256 AS sha256, r.bundle_id AS bundleId, r.repo_id AS repoId, r.repo_directory AS repoDirectory, sr.full_name AS repoFullName,
               tu.view_dependencies AS dependencies, tu.view_security AS security,
               (SELECT role FROM managed_user WHERE id = tu.user_id) AS role
          FROM managed_team_user tu
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
          JOIN managed_team_repo tr ON tr.team_id = tu.team_id
          JOIN managed_report r ON r.repo_id = tr.repo_id AND ${REPORT_IN_TEAM_PATH_SQL}
          LEFT JOIN managed_selected_repo sr ON sr.repo_id = r.repo_id
@@ -799,33 +877,37 @@ function prepareStatements(db: ManagedSql) {
         ORDER BY r.uploaded_at DESC, r.filename ASC, r.id ASC`,
     ),
     // Bundles are scoped through the same team -> repository links as reports.
-    // They have no visibility flag: the bundle directory must fall inside a
-    // team repository scope to appear in that team's sidebar.
+    // Hidden bundles remain available to managers within their team scopes.
     selectUserTeamBundlesStmt: db.prepare(
       `SELECT DISTINCT tr.team_id AS teamId, b.id AS id, b.slug AS slug, b.integrity AS integrity,
-              b.filename AS filename, b.kind, b.byte_size AS byteSize, b.repo_id AS repoId, b.repo_directory AS repoDirectory, sr.full_name AS repoFullName, b.uploaded_at
+              b.filename AS filename, b.kind, b.visible, b.byte_size AS byteSize, b.repo_id AS repoId, b.repo_directory AS repoDirectory, sr.full_name AS repoFullName, b.uploaded_at, b.provenance
          FROM managed_team_user tu
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
          JOIN managed_team_repo tr ON tr.team_id = tu.team_id
          JOIN managed_bundle b ON b.repo_id = tr.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL}
          JOIN managed_selected_repo sr ON sr.repo_id = b.repo_id
-        WHERE tu.user_id = ?
+        WHERE tu.user_id = ? AND (b.visible = 1 OR (SELECT role FROM managed_user WHERE id = tu.user_id) IN ('admin', 'manage'))
         ORDER BY b.uploaded_at DESC, b.filename ASC, b.id ASC`,
     ),
     selectUserRepoScopesStmt: db.prepare(
       `SELECT DISTINCT tr.repo_id AS repoId, NULLIF(tr.path, '') AS path
-         FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id WHERE tu.user_id = ?`,
+         FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+        WHERE tu.user_id = ?`,
     ),
     // A report is readable iff one of the user's team scopes contains it.
     selectReportReadableStmt: db.prepare(
       `SELECT 1 FROM managed_report r
          JOIN managed_team_repo tr ON tr.repo_id = r.repo_id AND ${REPORT_IN_TEAM_PATH_SQL}
          JOIN managed_team_user tu ON tu.team_id = tr.team_id
+        JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
         WHERE r.id = ? AND tu.user_id = ? LIMIT 1`,
     ),
     selectBundleSecurityStmt: db.prepare(
       `SELECT 1 FROM managed_bundle b
          JOIN managed_team_repo tr ON tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL}
          JOIN managed_team_user tu ON tu.team_id = tr.team_id
+        JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
         WHERE b.id = ? AND tu.user_id = ? AND tu.view_security = 1
           AND (? IS NULL OR tr.team_id = ?) LIMIT 1`,
     ),
@@ -837,6 +919,7 @@ function prepareStatements(db: ManagedSql) {
          FROM managed_report r
          JOIN managed_team_repo tr ON tr.repo_id = r.repo_id AND ${REPORT_IN_TEAM_PATH_SQL}
          JOIN managed_team_user tu ON tu.team_id = tr.team_id AND tu.user_id = ?
+         JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
         WHERE r.id = ?`,
     ),
     selectUserOptionsStmt: db.prepare(`SELECT id, login, name, role FROM managed_user ORDER BY login ASC`),
@@ -1007,18 +1090,23 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
     async listFindingCatalogReports(after: string, limit: number): Promise<Pick<ReportRecord, 'id' | 'byteSize'>[]> {
       return await stmts.findingCatalogReportsStmt.all(after, limit) as Pick<ReportRecord, 'id' | 'byteSize'>[]
     },
-    async getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string): Promise<TeamReportAccessSnapshot | null> {
+    async getTeamReportAccessSnapshot(sessionId: string, now: number, teamId: string, reportId: string | null = null): Promise<TeamReportAccessSnapshot | null> {
       const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
       if (!session) return null
       const user: StoredUser = { id: session.uid, login: session.login, name: session.name, avatarUrl: session.avatar, role: session.role }
       if (user.role === 'none' || !await stmts.selectTeamAccessStmt.get(user.id, teamId)) return { user, teamId: null, reports: [], repositories: [] }
       const whole = user.role === 'admin' || user.role === 'manage'
-      const rows = await stmts.selectTeamReportAccessStmt.all(user.id, teamId, whole ? 1 : 0) as {
+      const rows = await stmts.selectTeamReportAccessStmt.all(user.id, teamId, whole ? 1 : 0, reportId) as {
         id: string; filename: string; byteSize: number; sha256: string; repoDirectory: string
-        repoFullName: string | null; dependencies: number; security: number
+        repoFullName: string | null; dependencies: number; security: number; visible: number
       }[]
+      // Only privileged callers can receive a hidden row from this query. Give
+      // that individual preview its own capacity; published report selections
+      // still use the complete workspace for cross-report classification.
+      const hidden = rows.find(row => row.id === reportId && row.visible === 0)
+      const selected = hidden ? [hidden] : rows
       const repositories = await stmts.selectTeamRepositoriesStmt.all(teamId) as TeamReportAccessSnapshot['repositories']
-      return { user, teamId, repositories, reports: rows.map(row => ({
+      return { user, teamId, reportId, hiddenReportId: hidden?.id ?? null, repositories, linkRevision: await linkRevision(db), reports: selected.map(row => ({
         id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
         repo: { github: row.repoFullName, directory: row.repoDirectory },
         permissions: { dependencies: whole || row.dependencies === 1, security: whole || row.security === 1 },
@@ -1035,7 +1123,7 @@ function reportMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
         id: string; filename: string; byteSize: number; sha256: string; repoDirectory: string
         repoFullName: string | null; dependencies: number; security: number
       }[]
-      return { user, reports: rows.map(row => ({
+      return { user, linkRevision: await linkRevision(db), reports: rows.map(row => ({
         id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
         repo: { github: row.repoFullName, directory: row.repoDirectory },
         permissions: { dependencies: admin || manage || row.dependencies === 1, security: admin || manage || row.security === 1 },
@@ -1102,6 +1190,8 @@ function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit
       return JSON.stringify([
         await stmts.annotationTriageRevisionStmt.all(ids),
         await stmts.annotationCommentRevisionStmt.all(ids),
+        await db.prepare(`SELECT finding_id, issue_url, auto_fix_url FROM managed_finding_issue
+          WHERE finding_id IN (SELECT value FROM json_each(?)) AND issue_url IS NOT NULL ORDER BY finding_id`).all(ids),
       ])
     },
     async deleteTriage(findingIds: readonly string[]): Promise<number> {
@@ -1183,18 +1273,23 @@ function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit
 }
 
 type BundleRow = {
+  visible: number
   id: string; slug: string; integrity: string; filename: string; kind: string | null; byteSize: number
-  uploadedBy: string | null; repoId: number | null; repoDirectory: string; uploadedAt: number
+  uploadedBy: string | null; repoId: number | null; repoDirectory: string; uploadedAt: number; provenance: BundleProvenance | null
+  buildConditions: string | null
 }
 type BundleListRow = {
+  visible: number
   id: string; slug: string; integrity: string; filename: string; kind: string | null; byteSize: number
   uploadedByLogin: string | null; repoId: number | null; repoFullName: string | null; repoDirectory: string; uploadedAt: number
+  provenance: BundleProvenance | null
 }
 
 function mapBundle(r: BundleRow): ManagedBundle {
   return {
     id: r.id, slug: r.slug, integrity: r.integrity, filename: r.filename, kind: r.kind,
-    byteSize: r.byteSize, uploadedBy: r.uploadedBy, repoId: r.repoId, repoDirectory: r.repoDirectory, uploadedAt: r.uploadedAt,
+    byteSize: r.byteSize, uploadedBy: r.uploadedBy, repoId: r.repoId, repoDirectory: r.repoDirectory, uploadedAt: r.uploadedAt, visible: r.visible === 1,
+    provenance: r.provenance, buildConditions: r.buildConditions == null ? null : JSON.parse(r.buildConditions) as BundleBuildConditions,
   }
 }
 
@@ -1214,9 +1309,14 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
       await validateStorageUpload(db, key, 'bundle', bundle.id, bundle.dataKey)
       await insertBundleStmt.run(
         bundle.id, preferredSlug(bundle.id), bundle.integrity, bundle.filename, bundle.kind,
-        bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', now, bundle.dataKey ?? null, bundle.dataKey ? 1 : 0,
+        bundle.byteSize, bundle.uploadedBy, bundle.uploadedByLogin ?? null, bundle.repoId, bundle.repoId == null ? '' : bundle.repoDirectory ?? '', bundle.visible === false ? 0 : 1, now, bundle.dataKey ?? null, bundle.dataKey ? 1 : 0,
+        bundle.provenance ?? null, bundle.buildConditions == null ? null : JSON.stringify(bundle.buildConditions),
       )
     },
+    async reuseBundle(id: string, { provenance, filename, kind, rename, buildConditions }: BundleReuse): Promise<boolean> {
+      return Number((await stmts.reuseBundleStmt.run({ id, provenance, filename, kind, rename: rename ? 1 : 0,
+        buildConditions: buildConditions == null ? null : JSON.stringify(buildConditions) })).changes) > 0
+    },
     getBundleByIntegrity,
     // The distinct method name selects a writer-locked reconciliation scope.
     resolveBundleUpload: getBundleByIntegrity,
@@ -1232,6 +1332,7 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
       const row = await selectBundleStmt.get(id) as BundleRow | undefined
       if (!row) return denied
       const manager = roleAtLeast(session.role, 'manage')
+      if (!manager && row.visible !== 1) return denied
       if (session.role !== 'admin') {
         const allowed = manager ? await selectBundleReadableStmt.get(id, session.uid, session.uid)
           : row.repoId !== null && await selectRepoPathReadableStmt.get(row.repoDirectory, row.repoId, session.uid)
@@ -1245,8 +1346,8 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
       const rows = (await selectBundlesStmt.all(userId ?? null, userId ?? null, userId ?? null)) as BundleListRow[]
       return rows.map((r) => ({
         id: r.id, slug: r.slug, integrity: r.integrity, filename: r.filename, kind: r.kind, byteSize: r.byteSize,
-        uploadedByLogin: r.uploadedByLogin, repoId: r.repoId, repoFullName: r.repoFullName, repoDirectory: r.repoDirectory,
-        uploadedAt: r.uploadedAt,
+        uploadedByLogin: r.uploadedByLogin, repoId: r.repoId, repoFullName: r.repoFullName, repoDirectory: r.repoDirectory, visible: r.visible === 1,
+        uploadedAt: r.uploadedAt, provenance: r.provenance,
       }))
     },
     async userCanReadBundle(userId: string, id: string): Promise<boolean> {
@@ -1266,6 +1367,9 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
     async deleteBundle(id: string): Promise<boolean> {
       return Number((await deleteBundleStmt.run(id)).changes) > 0
     },
+    async setBundleVisible(id: string, visible: boolean): Promise<boolean> {
+      return Number((await stmts.setBundleVisibleStmt.run(visible ? 1 : 0, id)).changes) > 0
+    },
     async setBundleRepo(id: string, repoId: number | null, directory?: string): Promise<boolean> {
       return Number((await setBundleRepoStmt.run(repoId, repoId == null ? '' : directory ?? '', id)).changes) > 0
     },
@@ -1275,7 +1379,7 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
   }
 }
 
-type TeamRow = { id: string; slug: string; name: string }
+type TeamRow = { id: string; slug: string; name: string; hidden: number }
 type TeamRepoRow = { teamId: string; repoId: number; fullName: string; path: string | null }
 type TeamMemberRow = { teamId: string; userId: string; login: string; viewDependencies: number; viewSecurity: number }
 
@@ -1284,7 +1388,7 @@ type TeamMemberRow = { teamId: string; userId: string; login: string; viewDepend
 // workspace has.
 function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql) {
   const {
-    insertTeamStmt, selectTeamByNameStmt, renameTeamStmt, deleteTeamStmt, selectTeamStmt,
+    insertTeamStmt, selectTeamByNameStmt, renameTeamStmt, setTeamHiddenStmt, deleteTeamStmt, selectTeamStmt,
     selectUserRepoScopesStmt, selectTeamsStmt, selectTeamsForUserStmt, selectUserTeamReportsStmt, selectUserTeamBundlesStmt, selectReportReadableStmt,
     selectReportPermsStmt, selectUserOptionsStmt, selectTeamReposStmt, selectTeamMembersStmt,
     upsertTeamRepoStmt, deleteTeamRepoStmt, deleteTeamRepoPathStmt, upsertTeamMemberStmt, deleteTeamMemberStmt,
@@ -1304,9 +1408,12 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
     async deleteTeam(id: string): Promise<boolean> {
       return Number((await deleteTeamStmt.run(id)).changes) > 0
     },
-    async getTeam(id: string): Promise<{ id: string; slug: string; name: string } | null> {
+    async setTeamHidden(id: string, hidden: boolean, now: number): Promise<boolean> {
+      return Number((await setTeamHiddenStmt.run(hidden ? 1 : 0, now, id)).changes) > 0
+    },
+    async getTeam(id: string): Promise<{ id: string; slug: string; name: string; hidden: boolean } | null> {
       const row = (await selectTeamStmt.get(id)) as TeamRow | undefined
-      return row == null ? null : { id: row.id, slug: row.slug, name: row.name }
+      return row == null ? null : { id: row.id, slug: row.slug, name: row.name, hidden: row.hidden === 1 }
     },
     async listUserOptions(): Promise<UserOption[]> {
       return ((await selectUserOptionsStmt.all()) as UserOption[]).map((u) => ({ id: u.id, login: u.login, name: u.name, role: u.role }))
@@ -1317,30 +1424,31 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
     async listTeamsForUser(userId: string): Promise<UserTeam[]> {
       const teams = (await selectTeamsForUserStmt.all(userId)) as { id: string; slug: string; name: string; dependencies: number; security: number }[]
       const scopes = await stmts.selectUserTeamScopesStmt.all(userId) as { teamId: string; repoId: number; path: string; fullName: string }[]
+      const links = await linkRevision(db)
       const reportsByTeam = new Map<string, UserTeamReport[]>()
       for (const r of (await selectUserTeamReportsStmt.all(userId)) as {
         teamId: string; id: string; slug: string; filename: string; analyzer: string | null; sha256: string; bundleId: string | null; repoId: number
-        repoDirectory: string; repoFullName: string | null; dependencies: number; security: number; role: string
+        repoDirectory: string; repoFullName: string | null; visible: number; dependencies: number; security: number; role: string
       }[]) {
         const list = reportsByTeam.get(r.teamId) ?? []
         const cacheKey = createHash('sha256').update(JSON.stringify([
-          r.sha256, r.bundleId, r.filename, r.repoId, r.repoDirectory, r.repoFullName, r.dependencies, r.security, r.role,
+          r.sha256, r.bundleId, r.filename, r.repoId, r.repoDirectory, r.repoFullName, r.dependencies, r.security, r.role, links,
         ])).digest('base64url')
-        list.push({ id: r.id, slug: r.slug, filename: r.filename, analyzer: r.analyzer, repoFullName: r.repoFullName, repoDirectory: r.repoDirectory, cacheKey })
+        list.push({ id: r.id, slug: r.slug, filename: r.filename, visible: r.visible === 1, analyzer: r.analyzer, repoFullName: r.repoFullName, repoDirectory: r.repoDirectory, cacheKey })
         reportsByTeam.set(r.teamId, list)
       }
       const bundlesByTeam = new Map<string, UserTeamBundle[]>()
-      for (const b of (await selectUserTeamBundlesStmt.all(userId)) as (UserTeamBundle & { teamId: string })[]) {
+      for (const b of (await selectUserTeamBundlesStmt.all(userId)) as (Omit<UserTeamBundle, 'visible'> & { teamId: string; visible: number })[]) {
         const list = bundlesByTeam.get(b.teamId) ?? []
-        list.push({ id: b.id, slug: b.slug, integrity: b.integrity, filename: b.filename,
-          kind: b.kind, byteSize: b.byteSize, repoId: b.repoId, repoDirectory: b.repoDirectory, repoFullName: b.repoFullName })
+        list.push({ id: b.id, slug: b.slug, integrity: b.integrity, filename: b.filename, visible: b.visible === 1,
+          kind: b.kind, byteSize: b.byteSize, repoId: b.repoId, repoDirectory: b.repoDirectory, repoFullName: b.repoFullName, provenance: b.provenance })
         bundlesByTeam.set(b.teamId, list)
       }
       return teams.map((t) => ({
         id: t.id, slug: t.slug, name: t.name,
         permissions: { dependencies: t.dependencies === 1, security: t.security === 1 },
         cacheKey: createHash('sha256').update(JSON.stringify([
-          t.dependencies, t.security, scopes.filter(scope => scope.teamId === t.id),
+          t.dependencies, t.security, links, scopes.filter(scope => scope.teamId === t.id),
         ])).digest('base64url'),
         reports: reportsByTeam.get(t.id) ?? [],
         bundles: bundlesByTeam.get(t.id) ?? [],
@@ -1386,6 +1494,7 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
       }
       return teams.map((t) => ({
         id: t.id, slug: t.slug, name: t.name,
+        hidden: t.hidden === 1,
         repos: reposByTeam.get(t.id) ?? [],
         members: membersByTeam.get(t.id) ?? [],
       }))
@@ -1431,7 +1540,10 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
 
   const methods: Omit<ManagedDb, keyof ManagementStore | keyof ManagementCatalogStore> = {
     ...storageMethods(db, key),
+    ...linkReportMethods(db, key),
+    ...repositoryAliasMethods(db),
     ...bundleBuildLeaseMethods(db),
+    ...upstreamCacheMethods(db),
     async claimMaintenanceLease(owner, now, until, migration = false) {
       return !!await db.prepare(`INSERT INTO managed_maintenance_lease (id, owner, expires_at) VALUES (?, ?, ?)
         ON CONFLICT(id) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at
@@ -1503,7 +1615,14 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...activity,
     ...comments,
     async getAnnotations(ids) {
-      return { triage: await triage.listTriage(ids), comments: await comments.listComments(ids) }
+      return { triage: await triage.listTriage(ids), comments: await comments.listComments(ids), issues: await methods.listManagedIssues(ids) }
+    },
+    async applyManagedIssueFixes(sessionId, snapshot, updates) {
+      // Recheck access inside the same write transaction as the derived field.
+      const current = await methods.getTeamReportAccessSnapshot(sessionId, Date.now(), snapshot.teamId!, snapshot.reportId)
+      if (!current?.teamId || JSON.stringify(current) !== JSON.stringify(snapshot)) return false
+      for (const update of updates) await methods.setManagedIssueAutoFix(update.findingId, update.issueUrl, update.previous, update.next, update.checkedAt)
+      return true
     },
     ...workspaceShareMethods(db),
     ...reports,