@preventive/triage 1.0.0-alpha.33 → 1.0.0-alpha.35

package/server-managed/index.ts

@@ -12,6 +12,7 @@ import { type ManagedConfig, loadManagedConfig } from './config.ts'
 import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
 import { loadManagedStatic } from './static.ts'
 import { openManagedStorage } from './storage.ts'
+import { setCacheDir } from '@preventive/upstream/npm.js'
 
 // Housekeeping runs on ordinary traffic too, including serverless instances
 // without a timer or cron. Failed sweeps retry on later traffic after a minute.
@@ -21,6 +22,9 @@ const REAP_RETRY_MS = 60_000
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
 export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
+  // Audits keep upstream's records on disk where the config has a cache
+  // directory; bundle builds set it in their own worker.
+  setCacheDir(config.upstreamCacheDir ?? false)
   // Load the optional peer only for serverless managed deployments. Embedding
   // hosts can discard listener promises, so retain maintenance inside the app.
   const waitUntil = config.serverless ? (await import('@vercel/functions')).waitUntil : undefined

package/server-managed/link-reports.ts

@@ -0,0 +1,158 @@
+// Global deduplication reports live entirely in SQL. The payload is authenticated
+// ciphertext bound to its row, using the deployment's existing storage key.
+import { Buffer } from 'node:buffer'
+import { createHash, randomUUID } from 'node:crypto'
+import { type StorageKey, unwrapStorageValue, wrapStorageValue } from '../server-common/storage-crypto.ts'
+import { parseLinkedFindings } from '../client/linked-findings.js'
+import type { ManagedSql } from './sql.ts'
+import { ManagedMutationError } from './management.ts'
+
+export const LINK_REPORT_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_link_report (
+  id TEXT PRIMARY KEY, filename TEXT NOT NULL, sha256 TEXT NOT NULL UNIQUE,
+  encrypted_groups TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 1,
+  group_count INTEGER NOT NULL, finding_count INTEGER NOT NULL,
+  uploaded_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  uploaded_by_login TEXT, uploaded_at INTEGER NOT NULL
+) STRICT;
+`
+export interface LinkReport {
+  id: string; filename: string; enabled: boolean; groupCount: number; findingCount: number
+  uploadedByLogin: string | null; uploadedAt: number
+}
+export interface LinkReportStore {
+  listLegacyLinkReports(): Promise<{ id: string; filename: string }[]>
+  migrateLinkReport(id: string, content: string): Promise<boolean>
+  listLinkReports(): Promise<LinkReport[]>
+  getLinkReport(sessionId: string, id: string): Promise<LinkReport & { groups: string[][] }>
+  getLinkRevision(): Promise<string>
+  getEnabledLinkGroups(revision: string): Promise<string[][]>
+  importLinkReport(sessionId: string, filename: string, content: string): Promise<{ report: LinkReport; reused: boolean }>
+  setLinkReportEnabled(sessionId: string, id: string, enabled: boolean): Promise<void>
+}
+const columns = `id, filename, enabled, group_count AS groupCount, finding_count AS findingCount,
+  uploaded_by_login AS uploadedByLogin, uploaded_at AS uploadedAt`
+const identity = (id: string) => `managed_link_report.encrypted_groups:${id}`
+function decryptGroups(key: StorageKey | null, id: string, payload: string): string[][] {
+  if (!key) throw new ManagedMutationError(503, 'storage-encryption-required')
+  const plain = unwrapStorageValue(key, identity(id), payload)
+  try { return JSON.parse(plain.toString('utf8')) as string[][] } finally { plain.fill(0) }
+}
+export async function linkRevision(db: ManagedSql): Promise<string> {
+  const rows = await db.prepare('SELECT id, sha256 FROM managed_link_report WHERE enabled = 1 ORDER BY id').all()
+  return rows.length > 0 ? createHash('sha256').update(JSON.stringify(rows)).digest('base64url') : ''
+}
+function parseLinkReport(content: string) {
+  const parsed = parseLinkedFindings(content)
+  if (parsed) return parsed
+  // Older managed exports may carry the normalized links envelope.
+  try {
+    const data = JSON.parse(content)
+    if (data?.source !== 'links' || !Array.isArray(data.links) || !Array.isArray(data.findings) || data.findings.length > 0) return null
+    return data.links.length === 0 ? { groups: [], skipped: 0 } : parseLinkedFindings(JSON.stringify(data.links))
+  } catch { return null }
+}
+export function linkReportMethods(db: ManagedSql, key: StorageKey | null): LinkReportStore {
+  const map = (row: Omit<LinkReport, 'enabled'> & { enabled: number }): LinkReport => ({ ...row, enabled: row.enabled === 1 })
+  async function authorize(sessionId: string) {
+    const user = await db.prepare(`SELECT u.id, u.login, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { id: string; login: string; role: string } | undefined
+    if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+    if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+    return user
+  }
+  return {
+    async listLegacyLinkReports() {
+      return await db.prepare("SELECT id, filename FROM managed_report WHERE analyzer = 'links' ORDER BY id").all() as { id: string; filename: string }[]
+    },
+    async migrateLinkReport(id, content) {
+      const row = await db.prepare(`SELECT filename, sha256, visible, uploaded_by AS uploadedBy,
+        uploaded_by_login AS uploadedByLogin, uploaded_at AS uploadedAt FROM managed_report WHERE id = ? AND analyzer = 'links'`).get(id) as {
+        filename: string; sha256: string; visible: number; uploadedBy: string | null; uploadedByLogin: string | null; uploadedAt: number
+      } | undefined
+      if (!row) return false
+      if (!key) throw new Error('Managed link reports require MANAGED_STORAGE_ENCRYPTION_KEY')
+      if (createHash('sha256').update(content).digest('base64url') !== row.sha256) throw new Error('Legacy link report content changed')
+      const parsed = parseLinkReport(content)
+      if (!parsed) throw new Error('Invalid legacy link report')
+      const plain = Buffer.from(JSON.stringify(parsed.groups))
+      try {
+        const sha256 = createHash('sha256').update(plain).digest('base64url')
+        await db.prepare(`INSERT INTO managed_link_report
+          (id, filename, sha256, encrypted_groups, enabled, group_count, finding_count, uploaded_by, uploaded_by_login, uploaded_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(sha256) DO NOTHING`).run(
+          id, row.filename, sha256, wrapStorageValue(key, identity(id), plain), row.visible,
+          parsed.groups.length, new Set(parsed.groups.flat()).size, row.uploadedBy, row.uploadedByLogin, row.uploadedAt)
+        await db.prepare('DELETE FROM managed_report WHERE id = ?').run(id)
+      } finally { plain.fill(0) }
+      return true
+    },
+    async listLinkReports() {
+      return (await db.prepare(`SELECT ${columns} FROM managed_link_report ORDER BY uploaded_at DESC, id`).all() as Parameters<typeof map>[0][]).map(map)
+    },
+    async getLinkReport(sessionId, id) {
+      await authorize(sessionId)
+      const row = await db.prepare(`SELECT ${columns}, encrypted_groups AS payload FROM managed_link_report WHERE id = ?`).get(id) as (Parameters<typeof map>[0] & { payload: string }) | undefined
+      if (!row) throw new ManagedMutationError(404, 'no-link-report')
+      const { payload, ...report } = row
+      return { ...map(report), groups: decryptGroups(key, id, payload) }
+    },
+    getLinkRevision: () => linkRevision(db),
+    async getEnabledLinkGroups(revision) {
+      if (await linkRevision(db) !== revision) throw new ManagedMutationError(409, 'deduplication-changed')
+      const rows = await db.prepare('SELECT id, encrypted_groups AS payload FROM managed_link_report WHERE enabled = 1 ORDER BY id').all() as { id: string; payload: string }[]
+      if (rows.length > 0 && !key) throw new Error('Managed link reports require MANAGED_STORAGE_ENCRYPTION_KEY')
+      return rows.flatMap(row => decryptGroups(key, row.id, row.payload))
+    },
+    async importLinkReport(sessionId, filename, content) {
+      const user = await authorize(sessionId)
+      if (!key) throw new ManagedMutationError(503, 'storage-encryption-required')
+      const parsed = parseLinkReport(content)
+      if (!parsed || parsed.skipped) throw new ManagedMutationError(400, 'invalid-link-report')
+      const plain = Buffer.from(JSON.stringify(parsed.groups))
+      const sha256 = createHash('sha256').update(plain).digest('base64url')
+      try {
+        const existing = await db.prepare(`SELECT ${columns} FROM managed_link_report WHERE sha256 = ?`).get(sha256) as Parameters<typeof map>[0] | undefined
+        if (existing) return { report: map(existing), reused: true }
+        const id = randomUUID(), uploadedAt = Date.now()
+        const findingCount = new Set(parsed.groups.flat()).size, groupCount = parsed.groups.length
+        await db.prepare(`INSERT INTO managed_link_report
+          (id, filename, sha256, encrypted_groups, group_count, finding_count, uploaded_by, uploaded_by_login, uploaded_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, filename, sha256, wrapStorageValue(key, identity(id), plain), groupCount, findingCount, user.id, user.login, uploadedAt)
+        return { report: { id, filename, enabled: true, groupCount, findingCount, uploadedByLogin: user.login, uploadedAt }, reused: false }
+      } finally { plain.fill(0) }
+    },
+    async setLinkReportEnabled(sessionId, id, enabled) {
+      await authorize(sessionId)
+      if (!(await db.prepare('UPDATE managed_link_report SET enabled = ? WHERE id = ?').run(+enabled, id)).changes) throw new ManagedMutationError(404, 'no-link-report')
+    },
+  }
+}
+
+// Merge complete components BEFORE projecting them onto the response. An ID
+// absent from every returned report can still bridge two visible findings.
+export function mergeLinkGroups(groups: readonly string[][], present?: ReadonlySet<string>): string[][] {
+  const parents = new Map<string, string>()
+  const root = (id: string): string => {
+    if (!parents.has(id)) parents.set(id, id)
+    let value = id
+    while (parents.get(value) !== value) {
+      parents.set(value, parents.get(parents.get(value)!)!)
+      value = parents.get(value)!
+    }
+    return value
+  }
+  for (const ids of groups) {
+    if (ids.length === 0) continue
+    const first = root(ids[0]!)
+    for (const id of ids.slice(1)) { const other = root(id); if (other !== first) parents.set(other, first) }
+  }
+  const merged = new Map<string, string[]>()
+  for (const id of parents.keys()) {
+    if (present && !present.has(id)) continue
+    const key = root(id)
+    const ids = merged.get(key) ?? []
+    ids.push(id); merged.set(key, ids)
+  }
+  return [...merged.values()].filter(ids => ids.length >= 2)
+}

package/server-managed/managed-issues.ts

@@ -1,4 +1,6 @@
 import type { ManagedSql } from './sql.ts'
+import type { TeamReportAccessSnapshot } from './db.ts'
+import { parseGithubPrUrl } from '../common/github-pr.ts'
 
 // One immutable reference per finding, shared across reports and teams. Keep
 // reservations across crashes/uncertain GitHub responses to prevent duplicates.
@@ -10,6 +12,8 @@ CREATE TABLE IF NOT EXISTS managed_finding_issue (
   repository TEXT NOT NULL,
   request_id TEXT NOT NULL,
   issue_url TEXT,
+  auto_fix_url TEXT,
+  auto_fix_checked_at INTEGER,
   created_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   created_at INTEGER NOT NULL
 ) STRICT;
@@ -20,24 +24,48 @@ export interface ManagedIssue {
   repository: string
   requestId: string
   issueUrl: string | null
+  autoFixUrl: string | null
+  autoFixCheckedAt: number | null
   createdBy: string | null
   createdAt: number
 }
 export interface ManagedIssueStore {
   getManagedIssue(findingId: string): Promise<ManagedIssue | null>
-  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl'>): Promise<boolean>
+  listManagedIssues(findingIds: readonly string[]): Promise<ManagedIssue[]>
+  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl' | 'autoFixUrl' | 'autoFixCheckedAt'>): Promise<boolean>
   finishManagedIssue(findingId: string, requestId: string, url: string): Promise<boolean>
   releaseManagedIssue(findingId: string, requestId: string): Promise<void>
+  setManagedIssueAutoFix(findingId: string, issueUrl: string, previous: string | null, next: string | null, checkedAt: number): Promise<boolean>
+}
+
+// A repeated finding ID never grants access to another team's repository.
+export function visibleManagedIssues(issues: ManagedIssue[], snapshot: TeamReportAccessSnapshot) {
+  if (snapshot.user.id.startsWith('share:')) return []
+  const repos = new Set(snapshot.repositories.map(repo => repo.repoId))
+  const names = new Set(snapshot.repositories.map(repo => repo.github.toLowerCase()))
+  return issues.filter(issue => issue.issueUrl && repos.has(issue.repoId)).map(issue => {
+    const ref = parseGithubPrUrl(issue.autoFixUrl)
+    return { ...issue, autoFixUrl: ref && names.has(ref.repo.toLowerCase()) ? issue.autoFixUrl : null }
+  })
 }
 export function managedIssueMethods(db: ManagedSql): ManagedIssueStore {
-  const get = db.prepare(`SELECT finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
-    issue_url AS issueUrl, created_by AS createdBy, created_at AS createdAt FROM managed_finding_issue WHERE finding_id = ?`)
+  const fields = `finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
+    issue_url AS issueUrl, auto_fix_url AS autoFixUrl, auto_fix_checked_at AS autoFixCheckedAt, created_by AS createdBy, created_at AS createdAt`
+  const get = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id = ?`)
+  const list = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY finding_id`)
+  const autoFix = db.prepare(`UPDATE managed_finding_issue SET auto_fix_url = ?, auto_fix_checked_at = ?
+    WHERE finding_id = ? AND issue_url = ? AND COALESCE(auto_fix_url, '') = COALESCE(?, '')
+      AND (auto_fix_checked_at IS NULL OR auto_fix_checked_at <= ?)`)
   const claim = db.prepare(`INSERT INTO managed_finding_issue (finding_id, repo_id, repository, request_id, created_by, created_at)
     VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (finding_id) DO NOTHING`)
   const finish = db.prepare(`UPDATE managed_finding_issue SET issue_url = ? WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
   const release = db.prepare(`DELETE FROM managed_finding_issue WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
   return {
     async getManagedIssue(findingId) { return (await get.get(findingId) as ManagedIssue | undefined) ?? null },
+    async listManagedIssues(ids) { return await list.all(JSON.stringify(ids)) as ManagedIssue[] },
+    async setManagedIssueAutoFix(findingId, issueUrl, previous, next, checkedAt) {
+      return Number((await autoFix.run(next, checkedAt, findingId, issueUrl, previous, checkedAt)).changes) > 0
+    },
     async claimManagedIssue(issue) {
       return Number((await claim.run(issue.findingId, issue.repoId, issue.repository, issue.requestId, issue.createdBy, issue.createdAt)).changes) > 0
     },

package/server-managed/management.ts

@@ -1,4 +1,4 @@
-import type { AdminReport, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
+import type { AdminReport, BundleReuse, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
 import { roleAtLeast } from '../common/managed/roles.ts'
 
 export class ManagedMutationError extends Error {
@@ -6,20 +6,23 @@ export class ManagedMutationError extends Error {
   constructor(status: number, message: string) { super(message); this.status = status }
 }
 
-export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string }
-export type ReportMutation = ContentMutation | { type: 'visibility'; visible: boolean }
+export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string } | { type: 'visibility'; visible: boolean }
+export type ReportMutation = ContentMutation
 type RemovalRepo = Pick<ManagedRepo, 'repoId' | 'fullName' | 'addedAt'>
 type RemovalAnnotations = { reports: string; ids: string[] }
 export interface ManagementStore {
   mutateReport(sessionId: string, id: string, change: ReportMutation): Promise<{ report: ReportRecord; user: StoredUser }>
   mutateBundle(sessionId: string, id: string, change: ContentMutation): Promise<{ bundle: ManagedBundle; user: StoredUser }>
+  // A repeated upload/build of stored bytes (see reuseBundle). Renames need the
+  // access other bundle mutations need; a server build labels the row anyway.
+  reuseBundleUpload(sessionId: string, id: string, reuse: Omit<BundleReuse, 'rename'>): Promise<boolean>
   removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null): Promise<{
     reports: RepoReportItem[]; bundles: RepoDataItem[]; deletedReports: number; deletedBundles: number; deletedTriage: number
   }>
 }
 type ManagementDb = Pick<ManagedDb, 'sessionWithUser' | 'getReport' | 'getBundle' | 'listReports' | 'listReportsForRepo'
   | 'listBundlesForRepo' | 'listAllRepos' | 'listSelectedRepos' | 'userCanReadReport' | 'userCanReadBundle' | 'userCanReadRepoPath'
-  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo'
+  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo' | 'setBundleVisible' | 'reuseBundle'
   | 'deleteReportsForRepo' | 'deleteBundlesForRepo' | 'deleteRepo' | 'deleteTriage' | 'recordActivity'>
 
 // Only immutable bytes/format and repository membership affect the overlap
@@ -63,9 +66,19 @@ export function managementMethods(db: ManagementDb): ManagementStore {
       if (user.role !== 'admin' && bundle.repoId !== null && !await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)) throw new ManagedMutationError(403, 'repo-forbidden')
       await destination(user, change)
       if (change.type === 'delete') await db.deleteBundle(id)
+      else if (change.type === 'visibility') await db.setBundleVisible(id, change.visible)
       else await db.setBundleRepo(id, change.repoId, change.directory)
       return { bundle, user }
     },
+    async reuseBundleUpload(sessionId: string, id: string, reuse: Omit<BundleReuse, 'rename'>) {
+      const user = await authorize(sessionId, 'manage')
+      const bundle = await db.getBundle(id)
+      if (!bundle) return false
+      const rename = user.role === 'admin' || (await db.userCanReadBundle(user.id, id)
+        && (bundle.repoId === null || await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)))
+      if (!rename && reuse.provenance !== 'build') return false
+      return db.reuseBundle(id, { ...reuse, rename })
+    },
     async removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null) {
       const user = await authorize(sessionId, 'admin')
       const repo = (await db.listAllRepos()).find(r => r.repoId === expected.repoId)

package/server-managed/public-workspace.ts

@@ -12,6 +12,7 @@ import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
+import { auditCache } from './upstream-cache.ts'
 import { serveTeamFeed } from './team-feed.ts'
 
 function json(res: ServerResponse, status: number, body: unknown): void {
@@ -114,8 +115,10 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
     if (inventory === null) { json(res, 413, { error: 'payload-too-large' }); return }
     if (inventory === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
     if (Buffer.byteLength(JSON.stringify(inventory)) > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
-    const result = await fetchBundleAdvisories(inventory.packages, AbortSignal.timeout(ADVISORIES_TIMEOUT_MS), {
-      debug: deps.config.debug, repoAdvisories: url.searchParams.get('repoAdvisories') === 'true',
+    const signal = AbortSignal.timeout(ADVISORIES_TIMEOUT_MS)
+    const result = await fetchBundleAdvisories(inventory.packages, signal, {
+      debug: deps.config.debug, repoAdvisories: url.searchParams.get('repoAdvisories') === 'true', details: url.searchParams.get('details') === 'true',
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug),
     })
     await recheck()
     json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return

package/server-managed/report-sources.ts

@@ -3,8 +3,8 @@ import { createHash } from 'node:crypto'
 import { extname } from 'node:path'
 import { promisify } from 'node:util'
 import { gzip } from 'node:zlib'
-import { bundleSourcesAsMap } from '../common/bundle-sources.js'
-import { bundleSourceImports } from '../common/bundle-source-links.js'
+import { bundlePackageDirs, bundleSourcesAsMap } from '../common/bundle-sources.js'
+import { bundleSourceLinkImports } from '../common/bundle-source-links.js'
 import type { BundleDetails } from '../common/bundle-metadata.js'
 import { loadManagedFindings, managedFindingSourcePaths } from '../common/managed/report-content.ts'
 import { type ViewerPermissions, filterReportContent } from '../common/managed/report-filter.ts'
@@ -29,7 +29,7 @@ function formatDirectory(bundleId: string, sha256: string, name: string) {
 }
 function sourceCacheFilename(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
   const key = createHash('sha256').update(JSON.stringify([
-    'finding-access-v6', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
+    'finding-access-v8', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
   ])).digest('hex')
   return `${formatDirectory(bundle.id, report.sha256, report.filename)}/${key}.json.gz`
 }
@@ -63,10 +63,11 @@ function selectSources(sourcePaths: Set<string>, sources: Map<string, string>) {
 
 function encodeSources(integrity: string, details: BundleDetails, selection: ReturnType<typeof selectSources>) {
   const sources = new Map(selection.files)
-  const imports = [...bundleSourceImports(details, sources)].map(([parent, targets]) => [parent, [...targets]])
+  const imports = [...bundleSourceLinkImports(details, sources)].map(([parent, targets]) => [parent, [...targets]])
   const bundle = details.kind === 'stasis' ? details.bundle as { formats: Map<string, string> } : null
   const formats = [...(bundle?.formats ?? [])].filter(([file]) => sources.has(file))
-  return compress(Buffer.from(JSON.stringify({ integrity, ...selection, imports, formats })), { level: 6 })
+  const packageDirs = [...(bundlePackageDirs(details) ?? [])].filter(([file]) => sources.has(file))
+  return compress(Buffer.from(JSON.stringify({ integrity, ...selection, imports, formats, packageDirs })), { level: 6 })
 }
 
 // Immutable report hashes share a derivative across duplicate uploads. Bundle

package/server-managed/repository-aliases.ts

@@ -0,0 +1,91 @@
+import { randomUUID } from 'node:crypto'
+import { reportRepoGithub } from '@preventive/report'
+import { type RepositoryAliasInput, matchRepositoryAlias, repositoryAliasNeedsFilePrefix } from '../common/managed/repository-alias.ts'
+import type { ManagedDb } from './db.ts'
+import { ManagedMutationError } from './management.ts'
+import { normalizeTeamPath } from './repo-path.ts'
+import type { ManagedSql } from './sql.ts'
+
+export const REPOSITORY_ALIAS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_repository_alias (
+  id TEXT PRIMARY KEY,
+  old_repo TEXT NOT NULL,
+  old_path TEXT NOT NULL DEFAULT '',
+  repo_id INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  new_path TEXT NOT NULL DEFAULT '',
+  UNIQUE(old_repo, old_path)
+) STRICT;
+`
+export interface RepositoryAlias extends RepositoryAliasInput { id: string }
+export interface RepositoryAliasStore {
+  listRepositoryAliases(): Promise<RepositoryAlias[]>
+  saveRepositoryAlias(sessionId: string, id: string | null, input: unknown): Promise<RepositoryAlias>
+  deleteRepositoryAlias(sessionId: string, id: string): Promise<void>
+  getRepositoryImportLocation(github: string, directory: string, filePrefix?: string): Promise<{ repoId: number | null; directory: string }>
+}
+
+// Keep expensive inventory reads outside database transactions and skip them
+// unless a currently connected alias can use the bundle's existing paths.
+export async function resolveRepositoryImportLocation(db: ManagedDb, github: string, directory: string, loadFilePrefix: () => Promise<string>) {
+  const aliases = await db.listRepositoryAliases()
+  let filePrefix = ''
+  if (repositoryAliasNeedsFilePrefix(github, directory, aliases)) {
+    const active = new Set((await db.listSelectedRepos()).map(repo => repo.repoId))
+    if (repositoryAliasNeedsFilePrefix(github, directory, aliases.filter(alias => active.has(alias.repoId)))) filePrefix = await loadFilePrefix()
+  }
+  return db.getRepositoryImportLocation(github, directory, filePrefix)
+}
+
+function parseAlias(input: unknown): RepositoryAliasInput {
+  if (!input || typeof input !== 'object') throw new ManagedMutationError(400, 'bad-alias')
+  const { oldRepo, oldPath, repoId, newPath } = input as RepositoryAliasInput
+  const github = typeof oldRepo === 'string' ? reportRepoGithub({ repo: { github: oldRepo.trim() } }) : null
+  if (!github) throw new ManagedMutationError(400, 'bad-old-repo')
+  if (typeof oldPath !== 'string' || typeof newPath !== 'string') throw new ManagedMutationError(400, 'bad-directory')
+  const old = normalizeTeamPath(oldPath), target = normalizeTeamPath(newPath)
+  if (!old.ok || !target.ok) throw new ManagedMutationError(400, 'bad-directory')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) throw new ManagedMutationError(400, 'bad-repo')
+  return { oldRepo: github.toLowerCase(), oldPath: old.path ?? '', repoId, newPath: target.path ?? '' }
+}
+
+export function repositoryAliasMethods(db: ManagedSql): RepositoryAliasStore {
+  async function authorize(sessionId: string) {
+    const user = await db.prepare(`SELECT u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { role: string } | undefined
+    if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+    if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+  }
+  async function listRepositoryAliases() {
+    return await db.prepare(`SELECT id, old_repo AS oldRepo, old_path AS oldPath, repo_id AS repoId, new_path AS newPath
+      FROM managed_repository_alias ORDER BY old_repo, old_path, id`).all() as RepositoryAlias[]
+  }
+  return {
+    listRepositoryAliases,
+    async saveRepositoryAlias(sessionId, id, input) {
+      await authorize(sessionId)
+      const alias = parseAlias(input)
+      if (!await db.prepare('SELECT repo_id FROM managed_selected_repo WHERE repo_id = ? AND active = 1').get(alias.repoId)) throw new ManagedMutationError(400, 'bad-repo')
+      if (id && !await db.prepare('SELECT id FROM managed_repository_alias WHERE id = ?').get(id)) throw new ManagedMutationError(404, 'no-alias')
+      const duplicate = await db.prepare('SELECT id FROM managed_repository_alias WHERE old_repo = ? AND old_path = ?').get(alias.oldRepo, alias.oldPath) as { id: string } | undefined
+      if (duplicate && duplicate.id !== id) throw new ManagedMutationError(409, 'alias-exists')
+      const key = id ?? randomUUID()
+      await db.prepare(`INSERT INTO managed_repository_alias (id, old_repo, old_path, repo_id, new_path) VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET old_repo = excluded.old_repo, old_path = excluded.old_path, repo_id = excluded.repo_id, new_path = excluded.new_path`)
+        .run(key, alias.oldRepo, alias.oldPath, alias.repoId, alias.newPath)
+      return { id: key, ...alias }
+    },
+    async deleteRepositoryAlias(sessionId, id) {
+      await authorize(sessionId)
+      if (!(await db.prepare('DELETE FROM managed_repository_alias WHERE id = ?').run(id)).changes) throw new ManagedMutationError(404, 'no-alias')
+    },
+    async getRepositoryImportLocation(github, directory, filePrefix = '') {
+      const alias = matchRepositoryAlias(github, directory, await listRepositoryAliases(), filePrefix)
+      const normalized = normalizeTeamPath(alias?.directory ?? directory)
+      if (!normalized.ok) throw new ManagedMutationError(400, 'bad-directory')
+      const repo = await (alias
+        ? db.prepare('SELECT repo_id AS repoId FROM managed_selected_repo WHERE active = 1 AND repo_id = ?').get(alias.repoId)
+        : db.prepare('SELECT repo_id AS repoId FROM managed_selected_repo WHERE active = 1 AND LOWER(full_name) = ?').get(github.toLowerCase())) as { repoId: number } | undefined
+      return { repoId: repo?.repoId ?? null, directory: normalized.path ?? '' }
+    },
+  }
+}

package/server-managed/revisions.ts

@@ -1,7 +1,7 @@
 // Internal invalidation counters. Never expose these global values to clients:
 // feeds still publish only the existing user/visibility-scoped revisions.
-const catalogTables = ['managed_team', 'managed_team_user', 'managed_team_repo', 'managed_report', 'managed_bundle', 'managed_selected_repo']
-const annotationTables = ['managed_finding_triage', 'managed_finding_triage_event', 'managed_finding_comment']
+const catalogTables = ['managed_link_report', 'managed_team', 'managed_team_user', 'managed_team_repo', 'managed_report', 'managed_bundle', 'managed_selected_repo']
+const annotationTables = ['managed_finding_triage', 'managed_finding_triage_event', 'managed_finding_comment', 'managed_finding_issue']
 export function revisionSchema(postgres = false): string {
   let sql = `CREATE TABLE IF NOT EXISTS managed_maintenance_lease (
     id INTEGER PRIMARY KEY, owner TEXT NOT NULL, expires_at INTEGER NOT NULL

package/server-managed/sql.ts

@@ -18,10 +18,11 @@ export interface ManagedSqlDriver extends ManagedSql {
 
 // These operations execute exactly one SQL statement. Postgres already gives
 // that statement an atomic snapshot; an explicit BEGIN/COMMIT adds only trips.
-// Lease writes coordinate through their conditional UPSERT/UPDATE alone.
+// Lease and cache writes coordinate through their conditional UPSERT/UPDATE alone.
 const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
-  'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease'])
+  'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
+  'getUpstreamCacheEntry', 'setUpstreamCacheEntry'])
 
 export function scopeManagedMethods(methods: ManagedDb, driver: ManagedSqlDriver): ManagedDb {
   const entries = Object.entries(methods).map(([name, method]) => {

package/server-managed/storage.ts

@@ -34,6 +34,23 @@ export async function openManagedStorage(config: ManagedConfig) {
     }
     const objects = await createEncryptedObjectStorage(raw, db, key)
     const storage = createManagedStores(objects, !config.neonUrl)
+    // Move legacy team link uploads into encrypted SQL before serving catalogs.
+    // The DB transaction commits first; a failed blob cleanup cannot lose links.
+    for (const report of await db.listLegacyLinkReports()) {
+      if (!key) throw new Error('Migrating managed link reports requires MANAGED_STORAGE_ENCRYPTION_KEY')
+      let bytes
+      try { bytes = await storage.reportStore.get(report.id) } catch (error) {
+        if (!await db.getReport(report.id)) continue // another instance completed migration
+        throw error
+      }
+      if (!bytes) {
+        if (!await db.getReport(report.id)) continue
+        throw new Error(`Missing legacy link report: ${report.id}`)
+      }
+      if (await db.migrateLinkReport(report.id, bytes.toString('utf8'))) {
+        await storage.reportStore.delete(report.id).catch(error => console.warn('managed: legacy link cleanup failed:', error))
+      }
+    }
     return { ...storage, db, uploadStore: config.neonUrl ? storage.uploadStore : undefined,
       bundleCache: createBundleCache(storage.cacheStorage, db, storage.bundleStore),
       reportSourcesCache: createReportSourcesCache(storage.reportSourcesStorage, db, storage.reportStore, storage.bundleStore),

package/server-managed/team-feed.ts

@@ -47,7 +47,7 @@ export async function serveTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
 // the focused team needs report parsing or annotation reads; null is the
 // catalog-only subscription used on landing and management pages.
 export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
-  sessionId: string, user: StoredUser, teamId: string | null, options: FeedOptions = {}): Promise<void> {
+  sessionId: string, user: StoredUser, teamId: string | null, options: FeedOptions & { reportId?: string | null } = {}): Promise<void> {
   let ids: string[] = [], visibilityKey: string | undefined
   let focusedKey: string | undefined
   let previousState: { catalog: number; annotations: number } | undefined
@@ -86,7 +86,7 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
       return
     }
     let triage: string | undefined
-    const snapshot = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId)
+    const snapshot = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
     if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
     checkUser(snapshot)
     const key = teamSnapshotKey(snapshot)
@@ -102,7 +102,7 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
       }
     }
     if (snapshot.teamId) triage = JSON.stringify([key, await deps.db.getAnnotationRevision(ids)])
-    const current = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId)
+    const current = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
     // A concurrent access/content change discards only the annotation read.
     checkUser(current)
     if (!current || teamSnapshotKey(current) !== key) return