@preventive/triage 1.0.0-alpha.33 → 1.0.0-alpha.35

package/server-managed/db-neon.ts

@@ -1,3 +1,5 @@
+import { LINK_REPORT_SCHEMA } from './link-reports.ts'
+import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
@@ -7,8 +9,9 @@ import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
+import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
-import { ACTIVITY_SCHEMA } from './activity.ts'
+import { ACTIVITY_SCHEMA, uploadAction } from './activity.ts'
 import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
@@ -31,7 +34,7 @@ async function currentSchema(db: PgConnection): Promise<boolean> {
   const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
   if (!exists) return false
   const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 14 }, (_, i) => i + 1).every(version => versions.has(version))
+  return Array.from({ length: 22 }, (_, i) => i + 1).every(version => versions.has(version))
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -53,6 +56,57 @@ async function migrateGithubMetadata(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (14) ON CONFLICT DO NOTHING')
 }
 
+async function migrateBundleVisibility(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 15')).rows.length === 0) {
+    await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS visible INTEGER NOT NULL DEFAULT 1')
+    await db.query('INSERT INTO managed_schema_version VALUES (15)')
+  }
+}
+
+async function migrateLinkReports(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(revisionSchema(true)))
+  await db.query('INSERT INTO managed_schema_version VALUES (16) ON CONFLICT DO NOTHING')
+}
+
+async function migrateRepositoryAliases(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(REPOSITORY_ALIAS_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (17) ON CONFLICT DO NOTHING')
+}
+
+async function migrateHiddenTeams(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 18')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_team ADD COLUMN IF NOT EXISTS hidden INTEGER NOT NULL DEFAULT 0')
+  await db.query('INSERT INTO managed_schema_version VALUES (18)')
+}
+
+async function migrateIssueFixes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 19')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_finding_issue ADD COLUMN IF NOT EXISTS auto_fix_url TEXT, ADD COLUMN IF NOT EXISTS auto_fix_checked_at BIGINT')
+  await db.query(postgresSchema(revisionSchema(true)))
+  await db.query('INSERT INTO managed_schema_version VALUES (19)')
+}
+
+// Existing rows stay NULL (unknown): some may have been built on the server.
+async function migrateBundleProvenance(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 20')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS provenance TEXT')
+  await createUploadTrigger(db, 'bundle', false)
+  await db.query('INSERT INTO managed_schema_version VALUES (20)')
+}
+
+async function migrateUpstreamCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 21')).rows.length > 0) return
+  await db.query(postgresSchema(UPSTREAM_CACHE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (21)')
+}
+
+// Existing builds stay NULL: their conditions were never recorded.
+async function migrateBundleBuildConditions(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 22')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS build_conditions TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (22)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -119,13 +173,14 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
       await db.query('INSERT INTO managed_schema_version VALUES (9)')
     }
+    await db.query(postgresSchema(LINK_REPORT_SCHEMA))
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 10')).rows.length === 0) {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (10)')
     }
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
-    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases]) await migrate(db)
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -139,7 +194,7 @@ async function createUploadTrigger(db: PgConnection, type: string, createTrigger
       INSERT INTO managed_activity (id, kind, actor, action, repo, report_id, report, at, bundle_id, actor_id)
       VALUES ('${type}-upload:' || NEW.id, 'upload',
         COALESCE(NEW.uploaded_by_login, (SELECT login FROM managed_user WHERE id = NEW.uploaded_by)),
-        'uploaded a ${type}', (SELECT full_name FROM managed_selected_repo WHERE repo_id = NEW.repo_id),
+        ${uploadAction(type, 'NEW')}, (SELECT full_name FROM managed_selected_repo WHERE repo_id = NEW.repo_id),
         ${type === 'report' ? 'NEW.id' : 'NULL'}, NEW.filename, NEW.uploaded_at,
         ${type === 'bundle' ? 'NEW.id' : 'NULL'}, NEW.uploaded_by);
       RETURN NEW;

package/server-managed/db-schema.ts

@@ -1,3 +1,5 @@
+import { LINK_REPORT_SCHEMA } from './link-reports.ts'
+import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
 
 export const MANAGED_SCHEMA = `
@@ -76,7 +78,13 @@ CREATE TABLE IF NOT EXISTS managed_bundle (
   uploaded_by_login TEXT,
   repo_id      INTEGER REFERENCES managed_selected_repo(repo_id) ON DELETE SET NULL,
   repo_directory  TEXT NOT NULL DEFAULT '',
-  uploaded_at  INTEGER NOT NULL
+  visible      INTEGER NOT NULL DEFAULT 1,
+  uploaded_at  INTEGER NOT NULL,
+  -- 'upload' or 'build' (generated on this server). A server build of bytes
+  -- already stored promotes the row to 'build'; NULL predates the column.
+  provenance   TEXT,
+  -- JSON {preset, conditions, platforms} of a JS/TS server build; NULL otherwise.
+  build_conditions TEXT
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS managed_bundle_uploaded_at_idx ON managed_bundle(uploaded_at);
@@ -168,12 +176,13 @@ CREATE TABLE IF NOT EXISTS managed_finding_triage_event (
 CREATE INDEX IF NOT EXISTS finding_triage_event_finding_idx ON managed_finding_triage_event(finding_id, seq);
 CREATE INDEX IF NOT EXISTS finding_triage_event_actor_at_idx ON managed_finding_triage_event(actor_id, at);
 
--- Teams group users + repos for access scoping. A team has just a name here;
+-- Teams group users + repos for access scoping. Hidden teams grant no access;
 -- the two link tables below carry the many-many relations.
 CREATE TABLE IF NOT EXISTS managed_team (
   id          TEXT PRIMARY KEY,
   slug        TEXT NOT NULL,
   name        TEXT NOT NULL UNIQUE,
+  hidden      INTEGER NOT NULL DEFAULT 0,
   created_at  INTEGER NOT NULL,
   updated_at  INTEGER NOT NULL
 ) STRICT;
@@ -203,4 +212,4 @@ CREATE TABLE IF NOT EXISTS managed_team_user (
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
-` + WORKSPACE_SHARE_SCHEMA
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA

package/server-managed/db.ts

@@ -12,6 +12,7 @@ import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
 import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
+import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { createSqliteDriver, scopeManagedMethods } from './sql.ts'
@@ -68,7 +69,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     db.exec('PRAGMA synchronous = FULL;')
     db.exec('PRAGMA foreign_keys = ON;')
     migrateManagedTableNames(db)
-    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA + UPSTREAM_CACHE_SCHEMA)
     ensureColumn(db, 'managed_selected_repo', 'cached_default_branch', 'TEXT')
     for (const table of ['managed_report', 'managed_bundle']) {
       ensureColumn(db, table, 'data_key', 'TEXT')
@@ -103,6 +104,13 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     if (addedVisible) db.prepare('UPDATE managed_report SET visible = 1 WHERE visible = 0').run()
     ensureColumn(db, 'managed_bundle', 'uploaded_by_login', 'TEXT')
     ensureColumn(db, 'managed_bundle', 'repo_directory', "TEXT NOT NULL DEFAULT ''")
+    ensureColumn(db, 'managed_bundle', 'visible', 'INTEGER NOT NULL DEFAULT 1')
+    // Existing rows stay NULL (unknown): some may have been built on the server.
+    ensureColumn(db, 'managed_bundle', 'provenance', 'TEXT')
+    ensureColumn(db, 'managed_bundle', 'build_conditions', 'TEXT')
+    ensureColumn(db, 'managed_team', 'hidden', 'INTEGER NOT NULL DEFAULT 0')
+    ensureColumn(db, 'managed_finding_issue', 'auto_fix_url', 'TEXT')
+    ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')

package/server-managed/github-issue-links.ts

@@ -0,0 +1,127 @@
+import { type GithubFixResult, githubIssueClosedReason, isGithubRepoName, parseGithubFixUrl } from '../common/github-pr.ts'
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
+import type { ManagedIssue } from './managed-issues.ts'
+import { ensureUserAccessToken } from './github-oauth.ts'
+import { lookupFixes } from './github-pulls.ts'
+
+export type IssueFixUpdate = { findingId: string; issueUrl: string; previous: string | null; next: string | null; checkedAt: number }
+type Pull = { number: number; title: string; body: string | null; state: string; isDraft: boolean; createdAt: string;
+  repository: { databaseId: number; nameWithOwner: string } }
+type Connection = { nodes: Pull[]; pageInfo: { hasNextPage: boolean; endCursor: string | null } }
+type Issue = { number: number; title: string; body: string | null; state: string; stateReason: string | null; closedByPullRequestsReferences?: Connection }
+type Repository = TeamReportAccessSnapshot['repositories'][number]
+type Job = { repo: Repository; kind: 'pull' | 'issue'; number: number; aliases: string[];
+  linked: boolean; cursor: string | null; pulls: Pull[]; complete: boolean }
+type Metadata = Exclude<GithubFixResult, { error: string }>
+const pullFields = 'number title body state isDraft createdAt repository { databaseId nameWithOwner }'
+
+function metadataQuery(jobs: Job[]) {
+  return `{ ${jobs.map((job, index) => {
+    const [owner, name] = job.repo.github.split('/')
+    const fields = job.kind === 'pull' ? pullFields : `number title body state stateReason ${job.linked
+      ? `closedByPullRequestsReferences(first: 100, includeClosedPrs: true, after: ${JSON.stringify(job.cursor)}) { nodes { ${pullFields} } pageInfo { hasNextPage endCursor } }` : ''}`
+    return `r${index}: repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(name)}) { databaseId nameWithOwner item: ${job.kind === 'pull' ? 'pullRequest' : 'issue'}(number: ${job.number}) { ${fields} } }`
+  }).join('\n')} }`
+}
+
+function itemMetadata(item: Issue | Pull, kind: Job['kind']): Omit<Metadata, 'url'> | null {
+  if (!item || typeof item.title !== 'string' || !item.title.trim() || item.title.length > 1024
+    || item.body != null && typeof item.body !== 'string' || !['OPEN', 'CLOSED', ...(kind === 'pull' ? ['MERGED'] : [])].includes(item.state)) return null
+  const status = item.state === 'MERGED' ? 'merged' : item.state === 'CLOSED' ? 'closed' : 'isDraft' in item && item.isDraft === true ? 'draft' : 'open'
+  const stateReason = kind === 'issue' && status === 'closed' ? githubIssueClosedReason(String((item as Issue).stateReason).toLowerCase()) : null
+  return { title: item.title, description: item.body ?? null, status, stateReason }
+}
+
+function readPage(job: Job, item: Issue | Pull, metadata: Map<string, Metadata>): boolean {
+  const details = itemMetadata(item, job.kind)
+  if (!details || item.number !== job.number) return false
+  for (const url of job.aliases) metadata.set(url, { url, ...details })
+  if (!job.linked) return false
+  const connection = (item as Issue).closedByPullRequestsReferences
+  if (!connection || !Array.isArray(connection.nodes) || typeof connection.pageInfo?.hasNextPage !== 'boolean'
+    || connection.nodes.some(pr => !pr || !Number.isSafeInteger(pr.number) || pr.number <= 0 || typeof pr.createdAt !== 'string'
+      || !Number.isFinite(Date.parse(pr.createdAt)) || !itemMetadata(pr, 'pull') || typeof pr.isDraft !== 'boolean'
+      || !Number.isSafeInteger(pr.repository?.databaseId) || typeof pr.repository?.nameWithOwner !== 'string' || !isGithubRepoName(pr.repository.nameWithOwner))) return false
+  job.pulls.push(...connection.nodes)
+  if (!connection.pageInfo.hasNextPage) { job.complete = true; return false }
+  if (typeof connection.pageInfo.endCursor !== 'string' || !connection.pageInfo.endCursor || connection.pageInfo.endCursor === job.cursor) return false
+  job.cursor = connection.pageInfo.endCursor
+  return true
+}
+
+function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string, Repository>, checkedAt: number, metadata: Map<string, Metadata>) {
+  const updates: IssueFixUpdate[] = []
+  for (const job of jobs) {
+    if (!job.linked || !job.complete) continue
+    // "Last" means the newest PR by creation time, never its latest comment.
+    const latest = job.pulls.filter(pr => pr.state !== 'CLOSED').toSorted((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || b.number - a.number)[0]
+    const repo = latest && allowed.get(latest.repository.nameWithOwner.toLowerCase())
+    // The viewer's token can have broader access than this workspace. Never
+    // persist or disclose a PR from outside the workspace repository grants.
+    if (latest && (!repo || repo.repoId !== latest.repository.databaseId)) continue
+    const next = latest ? `https://github.com/${repo!.github}/pull/${latest.number}` : null
+    if (latest && next) metadata.set(next, { url: next, ...itemMetadata(latest, 'pull')! })
+    for (const issue of issues) {
+      const ref = parseGithubFixUrl(issue.issueUrl)
+      if (ref?.kind === 'issue' && ref.number === job.number && issue.repoId === job.repo.repoId) {
+        updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
+      }
+    }
+  }
+  return updates
+}
+
+// Fetch issue details, linked PR states and manual Fix metadata in one batch.
+// Pagination and workspaces with over 200 distinct links need further batches.
+// Live GraphQL results prove this viewer's access; never publish them into the
+// REST shared cache under an older public-visibility grant.
+export async function lookupIssueLinks(config: ManagedConfig, db: ManagedDb, snapshot: TeamReportAccessSnapshot,
+  urls: string[], issues: ManagedIssue[], fetchImpl: typeof fetch = fetch): Promise<{ fixes: GithubFixResult[]; updates: IssueFixUpdate[] }> {
+  const checkedAt = Date.now(), signal = AbortSignal.timeout(10_000)
+  const allowed = new Map(snapshot.repositories.filter(repo => isGithubRepoName(repo.github)).map(repo => [repo.github.toLowerCase(), repo]))
+  const jobs = new Map<string, Job>()
+  const linked = new Set(issues.filter(issue => issue.issueUrl).map(issue => {
+    const ref = parseGithubFixUrl(issue.issueUrl)
+    return ref?.kind === 'issue' ? `${issue.repoId}:issue:${ref.number}` : ''
+  }))
+  for (const url of urls) {
+    const ref = parseGithubFixUrl(url), repo = ref && allowed.get(ref.repo.toLowerCase())
+    if (!ref || !repo) continue
+    const key = `${repo.repoId}:${ref.kind}:${ref.number}`, previous = jobs.get(key)
+    if (previous) { previous.aliases.push(url); continue }
+    jobs.set(key, { repo, kind: ref.kind, number: ref.number, aliases: [url], linked: linked.has(key), cursor: null, pulls: [], complete: false })
+  }
+  if (jobs.size === 0) return { fixes: [], updates: [] }
+  const withinDeadline: typeof fetch = (input, init) => { signal.throwIfAborted(); return fetchImpl(input, { ...init, signal }) }
+  const token = await ensureUserAccessToken(config, db, snapshot.user.id, checkedAt, withinDeadline)
+  if (!token) return { fixes: await lookupFixes(config, db, snapshot, urls, withinDeadline), updates: [] }
+  const metadata = new Map<string, Metadata>(), selected = [...jobs.values()]
+  let pending = selected
+  for (let page = 0; pending.length > 0 && page < 100 && !signal.aborted; page++) {
+    const batch = pending.slice(0, 200), query = metadataQuery(batch)
+    let data: Record<string, { databaseId: number; nameWithOwner: string; item: Issue | Pull } | null>
+    try {
+      const response = await withinDeadline('https://api.github.com/graphql', {
+        method: 'POST', redirect: 'error',
+        headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json', 'user-agent': 'deepview-triage' }, body: JSON.stringify({ query }),
+      })
+      if (!response.ok) break
+      const body = await response.json() as { data?: typeof data; errors?: { path?: unknown[] }[] }
+      // Errors attached to an alias invalidate that whole job, including its
+      // connection. Other aliases can succeed even if one issue was deleted.
+      if (!body?.data || body.errors != null && (!Array.isArray(body.errors)
+        || body.errors.some(error => typeof error?.path?.[0] !== 'string' || !/^r\d+$/u.test(error.path[0])))) break
+      data = body.data
+      for (const error of body.errors ?? []) data[error.path![0] as string] = null
+    } catch { break }
+    pending = pending.slice(batch.length)
+    for (const [index, job] of batch.entries()) {
+      const repository = data[`r${index}`]
+      if (repository?.databaseId !== job.repo.repoId || typeof repository.nameWithOwner !== 'string' || repository.nameWithOwner.toLowerCase() !== job.repo.github.toLowerCase()) continue
+      if (readPage(job, repository.item, metadata)) pending.push(job)
+    }
+  }
+  const updates = issueUpdates(selected, issues, allowed, checkedAt, metadata)
+  return { fixes: [...metadata.values()], updates }
+}

package/server-managed/github-issues.ts

@@ -60,7 +60,7 @@ function issueDetails(raw: unknown, url: string, number: number, fallback: { tit
 // Report filtering also supplies the full row/link isSecurity classification.
 export async function prepareGithubIssue(config: ManagedConfig, db: ManagedDb, store: BlobStore,
   session: ManagedSession, teamId: string, context: Context, fetchImpl: typeof fetch = fetch) {
-  const snapshot = await teamSnapshot(db, session.id, teamId)
+  const snapshot = await teamSnapshot(db, session.id, teamId, context.reportId)
   if (!snapshot.reports.some(report => report.id === context.reportId)) throw new TeamReportsError(404, 'no-report')
   const reports = await loadTeamReports(db, store, snapshot)
   const report = reports.find(item => item.id === context.reportId)!

package/server-managed/http-response.ts

@@ -2,6 +2,13 @@ import type { ServerResponse } from 'node:http'
 import { Buffer } from 'node:buffer'
 import { UPLOAD_CHUNK_BYTES } from './uploads.ts'
 
+// Keep the header ASCII while filename* carries the original UTF-8 name.
+export function attachmentDisposition(filename: string): string {
+  const fallback = filename.replaceAll(/[^\u0020-\u007E]|["\\%]/gu, '_')
+  const encoded = encodeURIComponent(filename.toWellFormed()).replaceAll(/['()*]/gu, ch => `%${ch.codePointAt(0)!.toString(16).toUpperCase()}`)
+  return `attachment; filename="${fallback}"; filename*=UTF-8''${encoded}`
+}
+
 // Writing body chunks enables the function's streamed-response path. Data is
 // already materialized by the authorization/filtering layer before we get here.
 export function writeResponse(res: ServerResponse, body: string | Buffer): void {
@@ -15,4 +22,3 @@ export function sendJson(res: ServerResponse, status: number, body: unknown, hea
   res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store', ...headers })
   writeResponse(res, JSON.stringify(body))
 }
-