@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.38

package/risk/npm/specs.js

@@ -0,0 +1,124 @@
+// Where npm installs a dependency from, read off its spec as npm-package-arg
+// reads one: the registry (a version, a range, a tag, an `npm:` alias), a
+// path, a repository on a host npm knows, a git URL or a tarball's.
+
+// The hosts npm takes a repository on (hosted-git-info, which npm-package-arg
+// reads a spec with): by name (`github:owner/repo`), or by its domain over
+// the protocols each takes, where its path names a repository, `[user,
+// project, committish]`, and not a tarball or a file.
+const trim = project => project?.replace(/\.git$/u, '')
+const GIT_HOSTS = new Map([
+  ['github', { label: 'GitHub', domain: 'github.com', protocols: ['git:', 'http:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'], repo({ pathname, hash }) {
+    const [, user, project, type, committish] = pathname.split('/', 5)
+    return (!type || type === 'tree') && user && trim(project) ? [user, trim(project), type ? committish : hash.slice(1)] : null
+  } }],
+  ['bitbucket', { label: 'Bitbucket', domain: 'bitbucket.org', protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'], repo({ pathname, hash }) {
+    const [, user, project, aux] = pathname.split('/', 4)
+    return aux !== 'get' && user && trim(project) ? [user, trim(project), hash.slice(1)] : null
+  } }],
+  ['gitlab', { label: 'GitLab', domain: 'gitlab.com', protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'], repo({ pathname, hash }) {
+    const path = pathname.slice(1)
+    const at = path.lastIndexOf('/')
+    if (path.includes('/-/') || path.includes('/archive.tar.gz')) return null
+    return path.slice(0, Math.max(at, 0)) && trim(path.slice(at + 1)) ? [path.slice(0, at), trim(path.slice(at + 1)), hash.slice(1)] : null
+  } }],
+  ['gist', { label: 'Gist', domain: 'gist.github.com', protocols: ['git:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'], repo({ pathname, hash }) {
+    const [, user, project, aux] = pathname.split('/', 4)
+    return aux !== 'raw' && (user || project) ? [project ? user : null, trim(project || user), hash.slice(1)] : null
+  } }],
+  ['sourcehut', { label: 'SourceHut', domain: 'git.sr.ht', protocols: ['git+ssh:', 'https:'], repo({ pathname, hash }) {
+    const [, user, project, aux] = pathname.split('/', 4)
+    return aux !== 'archive' && user && trim(project) ? [user, trim(project), hash.slice(1)] : null
+  } }],
+])
+const BY_DOMAIN = new Map([...GIT_HOSTS.values()].map(host => [host.domain, host]))
+// The protocols hosted-git-info reads a URL by as it is, the hosts' names too.
+const PROTOCOLS = new Set(['git+ssh:', 'ssh:', 'git+https:', 'git:', 'http:', 'https:', 'git+http:', ...[...GIT_HOSTS.keys()].map(name => `${name}:`)])
+
+// GitHub's `owner/repo` shorthand, before a commit, branch or tag
+// (`#v1.0.0`) or not, as hosted-git-info tells it: a slash, not first, nor
+// last before any `#`; no `.` first; and no space, `@`, `:` or second slash
+// before any `#`.
+function githubShorthand(spec) {
+  const hash = spec.indexOf('#'), slash = spec.indexOf('/')
+  const beforeHash = at => at > -1 && !(hash > -1 && at > hash)
+  return slash > 0 && !spec.startsWith('.') && (hash > -1 ? spec[hash - 1] !== '/' : !spec.endsWith('/'))
+    && ![/\s/u.exec(spec)?.index ?? -1, spec.indexOf('@'), spec.indexOf(':'), spec.indexOf('/', slash + 1)].some(beforeHash)
+}
+
+// A URL as hosted-git-info parses one: a protocol it doesn't know put
+// before a `git@host:path` (as `git+ssh://`) or given its `//`, and else
+// `host:path` read as `host/path`.
+const safeUrl = text => { try { return new URL(text) } catch { return null } }
+function hostedUrl(spec) {
+  const at = spec.indexOf('@'), colon = spec.indexOf(':')
+  const corrected = PROTOCOLS.has(spec.slice(0, colon + 1)) || at > -1 && at < colon ? spec : at > -1 ? `git+ssh://${spec}`
+    : spec.indexOf('//') === colon + 1 ? spec : `${spec.slice(0, colon + 1)}//${spec.slice(colon + 1)}`
+  if (safeUrl(corrected)) return safeUrl(corrected)
+  const before = char => { const hash = corrected.indexOf('#'); return corrected.lastIndexOf(char, hash > -1 ? hash : Infinity) }
+  let scp = before(':') > before('@') ? `${corrected.slice(0, before(':'))}/${corrected.slice(before(':') + 1)}` : corrected
+  if (scp.lastIndexOf(':', scp.indexOf('#') > -1 ? scp.indexOf('#') : Infinity) === -1 && !scp.includes('//')) scp = `git+ssh://${scp}`
+  return safeUrl(scp)
+}
+
+// The host npm takes a spec's repository on (hosted-git-info's fromUrl), or
+// null: one by its name, whatever its path, or by its domain over a protocol
+// it takes, where its path names a repository; none whose parts don't
+// decode.
+function gitHost(spec) {
+  if (!spec) return null
+  const url = hostedUrl(githubShorthand(spec) ? `github:${spec}` : spec)
+  if (!url) return null
+  const named = GIT_HOSTS.get(url.protocol.slice(0, -1))
+  const host = named ?? BY_DOMAIN.get(url.hostname.replace(/^www\./u, ''))
+  const parts = named ? [url.pathname.replace(/^\/?[^@]*@|^\//u, ''), url.hash.slice(1)] : host?.protocols.includes(url.protocol) && host.repo(url)
+  try { return parts ? (parts.forEach(part => part && decodeURIComponent(part)), host) : null } catch { return null }
+}
+
+// Where npm installs a dependency's spec from, read once in
+// npm-package-arg's resolve order: `path` for a path (`./x`, `~/x`, `/x`,
+// `c:/x`, `file:`); `registry` for an `npm:` alias of a registry package,
+// or a spec with no `/` or `:` that names no tarball, which no later step
+// takes; a repository on a host npm knows (gitHost), named for it
+// (`GitHub`); for a URL, `git` for a repository's (`git:`, `git+https:`,
+// `git+ssh:`, `git+http:`, `git+rsync:`, `git+ftp:`, `git+file:`, and
+// `git+ssh://` to `user@host:path`), `URL` for a tarball's (`https:`,
+// `http:`), and null for one npm doesn't install (`workspace:`, `ssh:` on
+// another host); then `path` again for one with a `/` or a tarball's name
+// (`a/b/c`, `x.tgz`, `git@example.com:x/y`), and else `registry`: a
+// version, a range or a tag.
+function specFrom(spec) {
+  const value = String(spec ?? '').trim()
+  if (/^(?:[.]|~\/|\/|[a-z]:|file:)/iu.test(value)) return 'path'
+  if (/^npm:/iu.test(value) || !/[/:]|[.](?:tgz|tar\.gz|tar)$/iu.test(value)) return 'registry'
+  const host = gitHost(value)
+  if (host) return host.label
+  if (/^(?:git\+)?[a-z]+:/iu.test(value)) {
+    const scp = /^git\+ssh:\/\/([^:#]+:[^#]+(?:\.git)?)(?:#.*)?$/iu.exec(value)
+    if (value.startsWith('git+ssh:') && scp && !/:\d+(?:\/|$)/u.test(scp[1])) return 'git'
+    const protocol = safeUrl(value)?.protocol
+    return /^(?:git|git\+(?:https?|rsync|ftp|file|ssh)):$/u.test(protocol) ? 'git' : /^https?:$/u.test(protocol) ? 'URL' : null
+  }
+  return /\/|[.](?:tgz|tar\.gz|tar)$/iu.test(value) ? 'path' : 'registry'
+}
+
+// Where a dependency's spec has npm fetch it from, where that isn't its
+// registry (specFrom): a host's name (`GitHub`), `git` or `URL`. Null for
+// the registry's ranges and tags, a path, and what npm doesn't install.
+export function npmDependencySource(spec) {
+  const from = specFrom(spec)
+  return from === 'registry' || from === 'path' ? null : from
+}
+
+// The package and spec an `npm:` alias names (`npm:pkg@^1.2.3`), as
+// specFrom reads one; null for a spec that isn't one.
+export function npmAlias(spec) {
+  const [, name, range = ''] = /^npm:((?:@[^/@]+\/)?[^/@]+)(?:@(.*))?$/iu.exec(String(spec ?? '').trim()) ?? []
+  return name ? { name, spec: range } : null
+}
+
+// Whether npm installs a dependency's spec from its registry (specFrom):
+// not from a path, a repository or a URL, nor a scheme npm doesn't install
+// (`workspace:`), the registry's package of that name being what npm
+// installs for none of those.
+export const npmRegistrySpec = spec => specFrom(spec) === 'registry'

package/risk/npm/tarball.js

@@ -0,0 +1,113 @@
+// A package's files from its tarball, as npm installs them: gunzipped, read as
+// a tar archive (ustar, pax and GNU long names), each file by the path npm
+// installs it at, its first component dropped, none escaping the package; a
+// text where it is UTF-8 with no NUL, else null. Held to the npm viewer's
+// bounds (server-managed/npm-packages.ts readNpmTar).
+const MAX_PACKAGE_FILES = 20_000
+export const MAX_PACKAGE_BYTES = 64 * 1024 * 1024
+// What its tar stream may unpack to, its headers and padding beside its
+// files, as npm-loads.ts bounds it (MAX_TAR_BYTES).
+export const MAX_TAR_BYTES = 96 * 1024 * 1024
+
+const latin1 = new TextDecoder('latin1')
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true })
+const utf8Lenient = bytes => new TextDecoder().decode(bytes)
+// A header's text field, to its first NUL.
+const textOf = (bytes, start, length) => {
+  const field = bytes.subarray(start, start + length)
+  const end = field.indexOf(0)
+  return utf8Lenient(end === -1 ? field : field.subarray(0, end))
+}
+
+// A header's size field: octal, or GNU base-256 past its 11 digits.
+function sizeOf(bytes, offset) {
+  if (bytes[offset] & 0x80) {
+    let size = bytes[offset] & 0x7f
+    for (let i = 1; i < 12; i++) size = size * 256 + bytes[offset + i]
+    return size
+  }
+  const text = textOf(bytes, offset, 12).trim()
+  return /^[0-7]+$/u.test(text) ? Number.parseInt(text, 8) : Number.NaN
+}
+
+// A pax header's path: records `<length> <key>=<value>\n`, their lengths in
+// bytes.
+function paxPath(data) {
+  let at = 0, path = null
+  while (at < data.length) {
+    const space = data.indexOf(0x20, at)
+    const length = Number.parseInt(latin1.decode(data.subarray(at, space)), 10)
+    if (space === -1 || !Number.isSafeInteger(length) || length <= 0) break
+    const record = utf8Lenient(data.subarray(space + 1, at + length - 1))
+    if (record.startsWith('path=')) path = record.slice(5)
+    at += length
+  }
+  return path
+}
+
+const packagePath = raw => {
+  const parts = raw.split('/').slice(1).filter(part => part !== '' && part !== '.')
+  return parts.length === 0 || parts.includes('..') ? null : parts.join('/')
+}
+
+// The files of a tar archive, by path: their bytes.
+function npmTarFiles(tar) {
+  const files = new Map()
+  let longName = null, offset = 0, total = 0
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512)
+    if (header.every(byte => byte === 0)) break
+    const size = sizeOf(header, 124), start = offset + 512, type = String.fromCodePoint(header[156])
+    if (!Number.isSafeInteger(size) || size < 0 || start + size > tar.length) throw new Error('bad-tarball')
+    const data = tar.subarray(start, start + size)
+    offset = start + Math.ceil(size / 512) * 512
+    if (type === 'x' || type === 'L') { longName = type === 'x' ? paxPath(data) : textOf(data, 0, data.length); continue }
+    if (type === 'g' || type === 'K') continue
+    const prefix = textOf(header, 257, 6) === 'ustar' ? textOf(header, 345, 155) : ''
+    const name = longName ?? (prefix ? `${prefix}/${textOf(header, 0, 100)}` : textOf(header, 0, 100))
+    longName = null
+    const path = ['0', '\0', '7'].includes(type) ? packagePath(name) : null
+    if (path === null) continue
+    total += size - (files.get(path)?.length ?? 0)
+    files.set(path, data)
+    if (files.size > MAX_PACKAGE_FILES || total > MAX_PACKAGE_BYTES) throw new Error('package-too-large')
+  }
+  return files
+}
+
+// A file's text: UTF-8 with no NUL, else null.
+export function npmFileText(bytes) {
+  if (bytes.includes(0)) return null
+  try { return utf8.decode(bytes) } catch { return null }
+}
+
+// A gzipped tarball's tar stream, given up on as `package-too-large` once it
+// unpacks past MAX_TAR_BYTES, before any more of it is held.
+async function gunzip(gzipped) {
+  const reader = new Blob([gzipped]).stream().pipeThrough(new DecompressionStream('gzip')).getReader()
+  const chunks = []
+  let size = 0
+  for (let read = await reader.read(); !read.done; read = await reader.read()) {
+    size += read.value.byteLength
+    if (size > MAX_TAR_BYTES) { await reader.cancel(); throw new Error('package-too-large') }
+    chunks.push(read.value)
+  }
+  return new Uint8Array(await new Blob(chunks).arrayBuffer())
+}
+
+// A file's bytes' digest, as the managed server gives one of a file that
+// isn't text (server-managed/npm-packages.ts).
+const sha256 = async bytes => `sha256-${btoa(String.fromCodePoint(...new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))))}`
+
+// A gzipped tarball's files as a version holds them for risk, as the npm
+// viewer holds a version (ui/view/npm-package.js npmPackageDetails), a source
+// map listing them (`kind: 'sourcemap'`): `json.sources` their paths, sorted,
+// `json.sourcesContent` their texts, `fileSizes` by path, and `npmBinaries`,
+// those that aren't text, `{ size, digest }` by path, which compare.js and
+// diff.js tell them by.
+export async function npmTarballVersion(gzipped) {
+  const files = [...npmTarFiles(await gunzip(gzipped))].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+  const texts = files.map(([, bytes]) => npmFileText(bytes))
+  const binaries = await Promise.all(files.filter((_, at) => texts[at] === null).map(async ([path, bytes]) => [path, { size: bytes.length, digest: await sha256(bytes) }]))
+  return { kind: 'sourcemap', json: { version: 3, sources: files.map(([path]) => path), sourcesContent: texts }, fileSizes: new Map(files.map(([path, bytes]) => [path, bytes.length])), npmBinaries: new Map(binaries) }
+}

package/server-e2e/http.ts

@@ -26,7 +26,7 @@ export const WS_UPGRADE_PATH = '/api/sync'
 // here commits + broadcasts WITHOUT taking over the client's SSE event-stream
 // (each in-band POST forces a stream takeover; see sse-server.ts). Sibling of
 // the WS upgrade path so one nginx `/api/*` block routes both.
-export const SAVE_REST_PATH = '/api/sync/save'
+const SAVE_REST_PATH = '/api/sync/save'
 function isUpgradePath(url: string | undefined): boolean {
   if (typeof url !== 'string') return false
   // Strip `?…` so clients can carry build / debug tags. Exact match
@@ -174,12 +174,12 @@ export function createHttpServer(deps: HttpServerDeps): Server {
       // REST handlers go through a separate path and must mirror it.
       // Without this, a REST PUT arriving on an existing keep-alive
       // socket AFTER SIGTERM but BEFORE `httpServer.close()` finishes
-      // draining could land in `withCommitLock`, acquire a lease, and
-      // finish its `finally { release() }` AFTER the shutdown's
-      // `heldLeaseCount` snapshot — leaving an orphan lock row that pins
-      // the key until TTL expiry. The 503 + `shutting-down` reason tells
-      // the client to retry against a different replica. Transport
-      // audit + multi-replica shutdown ordering review.
+      // draining could start a fresh upload + commit for the drain to
+      // outwait — or, landing after the drain's in-flight snapshot
+      // (lifecycle.ts `drain`), run on against the closed DB, the race
+      // ws-server.ts gates on the WS plane. The 503 + `shutting-down`
+      // reason tells the client to retry against a different replica.
+      // Transport audit + multi-replica shutdown ordering review.
       if (isShuttingDown()) {
         res.writeHead(503, { 'content-type': 'application/json', 'connection': 'close' })
         res.end(JSON.stringify({ error: 'shutting-down' }))

package/server-e2e/npm-proxy.ts

@@ -141,7 +141,7 @@ async function readRequestBody(req: IncomingMessage): Promise<Buffer | null> {
   return Buffer.concat(chunks)
 }
 
-export async function handleNpmAdvisories(
+async function handleNpmAdvisories(
   deps: NpmProxyDeps,
   req: IncomingMessage,
   res: ServerResponse,

package/server-e2e/objstore/fetch-mint-guard.ts

@@ -35,8 +35,8 @@ export type FetchMintGuard = {
   size: () => number
 }
 
-export const DEFAULT_FETCH_MINT_WINDOW_MS = 60_000
-export const DEFAULT_FETCH_MINT_MAX_ENTRIES = 50_000
+const DEFAULT_FETCH_MINT_WINDOW_MS = 60_000
+const DEFAULT_FETCH_MINT_MAX_ENTRIES = 50_000
 
 export function createFetchMintGuard(
   { windowMs = DEFAULT_FETCH_MINT_WINDOW_MS, maxEntries = DEFAULT_FETCH_MINT_MAX_ENTRIES }:

package/server-e2e/objstore/handlers.ts

@@ -229,7 +229,7 @@ async function handleFetch(deps: ObjstoreDeps, socket: WebSocket, msg: ObjstoreF
 // the reaper's TTL pass within `STAGING_TTL_MS_DEFAULT` — no per-
 // socket bookkeeping is needed on disconnect today. If that ever
 // changes, wire a `cleanupSocket(socket)` into both this bundle and
-// server-e2e/index.ts's close handler.
+// server-e2e/ws-server.ts's per-socket close handler.
 
 export type ObjstoreHandlers = {
   handlePutBegin: (s: WebSocket, m: ObjstorePutBeginMsg) => Promise<void>

package/server-e2e/objstore/tokens.ts

@@ -24,7 +24,7 @@
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
 import { Buffer } from 'node:buffer'
 
-export const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000
+const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000
 
 export type PutTokenPayload = {
   op: 'put'

package/server-e2e/sign.ts

@@ -157,7 +157,7 @@ export async function verifyEd25519(
 // `{ ok: false, canonical: null }` on bad shape / bad sig;
 // `{ ok: true, canonical: <bytes> }` on success.
 //
-// NOT used by `server-e2e/index.ts handleSave`. Production composes
+// NOT used by `server-e2e/sync-handlers.ts handleSave`. Production composes
 // the smaller helpers (`canonicalSave`, `computeRevisionIdFromCanonical`,
 // `verifyEd25519`) separately so the dup-precheck via
 // `revisionExists` can fire BEFORE Ed25519-verify and skip the

package/server-managed/bundle-advisories.ts

@@ -1,23 +1,70 @@
 import { type Advisory, type CacheStore, type Package, advisories } from '@preventive/upstream/advisories.js'
 import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
+import { isNpmPackageName, npmPackageScope } from '../common/managed/npm-packages.js'
+import { NPM_REGISTRY, askUpstream } from './npm-packages.ts'
 
 export const ADVISORIES_TIMEOUT_MS = 30_000
+const PUBLIC_AT_ONCE = 16
+const order = (a: string, b: string) => Number(a > b) - Number(a < b)
+
+// Whether anyone may read a package, so that its name may go to a service
+// other than npm (OSV): an unscoped one always, npm's private packages
+// always being scoped; a scoped one where npm answers it anonymously, asked
+// by a HEAD, which reads nothing of it. One npm can't be asked of is taken
+// as private, and not kept; the rest are, for PUBLIC_MS, PUBLIC_NAMES at
+// most, as a package may be made private, or public. A name npm can't have
+// is asked of no one, upstream refusing it.
+const PUBLIC_MS = 60 * 60_000
+const PUBLIC_NAMES = 10_000
+const publicNames = new Map<string, { at: number; open: boolean }>()
+async function isPublicNpmPackage(name: string, signal: AbortSignal): Promise<boolean> {
+  if (!isNpmPackageName(name)) return false
+  if (npmPackageScope(name) === null) return true
+  const kept = publicNames.get(name)
+  if (kept && Date.now() - kept.at < PUBLIC_MS) return kept.open
+  let open
+  try { open = await askUpstream(`${NPM_REGISTRY}/${name}`, { method: 'HEAD', limit: Number.MAX_SAFE_INTEGER, signal, absent: [401, 403, 404] }) !== null } catch { return false }
+  publicNames.delete(name)
+  publicNames.set(name, { at: Date.now(), open })
+  while (publicNames.size > PUBLIC_NAMES) publicNames.delete(publicNames.keys().next().value!)
+  return open
+}
+
+// The npm packages anyone may read (isPublicNpmPackage), a few asked at a
+// time, within PUBLIC_BUDGET_MS, a third of the audit's: a scoped one npm
+// hasn't told of by then is taken as private, asked of npm alone, for the
+// audit to keep the rest of its time.
+const PUBLIC_BUDGET_MS = 10_000
+async function publicNpmNames(packages: Package[], signal: AbortSignal): Promise<Set<string>> {
+  const names = [...new Set(packages.filter(pkg => pkg.ecosystem === 'npm').map(pkg => pkg.name))]
+  const open = new Set<string>()
+  const budget = new AbortController()
+  const timer = setTimeout(() => { budget.abort(new Error('public-check-budget')) }, PUBLIC_BUDGET_MS)
+  const asking = AbortSignal.any([signal, budget.signal])
+  try {
+    for (let at = 0; at < names.length; at += PUBLIC_AT_ONCE) {
+      const chunk = names.slice(at, at + PUBLIC_AT_ONCE)
+      const checked = await Promise.all(chunk.map(name => isPublicNpmPackage(name, asking)))
+      for (const [i, name] of chunk.entries()) if (checked[i]) open.add(name)
+    }
+  } finally { clearTimeout(timer) }
+  return open
+}
 
 function advisoryGithubClient(token: string | null, signal: AbortSignal): Client {
   const authenticated = createClient({ token, userAgent: 'deepview-triage' })
-  if (token === null) return authenticated
   let client = authenticated
   return {
     ...authenticated,
     async listRepoAdvisories(options) {
       const current = client
       try { return await current.listRepoAdvisories(options) } catch (error) {
-        if (current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
+        if (token === null || current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
         signal.throwIfAborted()
         // Published advisories remain readable after a token is revoked. Reuse
         // anonymous access for subsequent repositories in this audit as well.
         if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
-        return client.listRepoAdvisories(options)
+        return await client.listRepoAdvisories(options)
       }
     },
   }
@@ -25,11 +72,15 @@ function advisoryGithubClient(token: string | null, signal: AbortSignal): Client
 
 // The managed caller supplies its user's token when available; public shares
 // remain anonymous. Upstream sends this credential only to GitHub and returns
-// published advisories, matching versions across npm, OSV and repository rows.
-// `cache` keeps each repository's listing (upstream-cache.ts) across audits.
+// published advisories, matching versions across npm, OSV and repository rows:
+// OSV's for npm packages anyone may read too, the malicious packages' records
+// among them, which npm's registry hasn't.
+// `cache` keeps each repository's listing (upstream-cache.ts) across audits;
+// `github`, a client of the caller's, asks GitHub in place of one with
+// `githubToken`.
 export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
-  { debug = false, repoAdvisories = false, details = false, githubToken = null, cache }: {
-    debug?: boolean; repoAdvisories?: boolean; details?: boolean; githubToken?: string | null; cache?: CacheStore | undefined
+  { debug = false, repoAdvisories = false, details = false, githubToken = null, github, cache }: {
+    debug?: boolean; repoAdvisories?: boolean; details?: boolean; githubToken?: string | null; github?: Client; cache?: CacheStore | undefined
   } = {}): Promise<
   { status: 200; body: Advisory[] } | { status: 502; body: { error: string } }
 > {
@@ -43,12 +94,18 @@ export async function fetchBundleAdvisories(packages: Package[], signal: AbortSi
       onAbort = () => reject(signal.reason)
       signal.addEventListener('abort', onAbort, { once: true })
     })
+    // npm packages anyone may read are asked of OSV too (upstream's `osv`),
+    // for the malicious packages' records npm's registry hasn't; a private
+    // one's name never leaves for OSV, as it never does for Socket. A package
+    // is wholly in one ask or the other, so upstream's order holds.
+    const open = await Promise.race([publicNpmNames(packages, signal), deadline])
+    const toOsv = (pkg: Package) => pkg.ecosystem === 'npm' && open.has(pkg.name)
     // Kept in the caller's store, or without one in upstream's disk cache,
     // where the server set one (auditCache).
-    const result = await Promise.race([
-      advisories(packages, { github: advisoryGithubClient(githubToken, signal), repoAdvisories, details, ...(cache && { cache }) }), deadline,
-    ])
-    return { status: 200, body: result }
+    const options = { github: github ?? advisoryGithubClient(githubToken, signal), repoAdvisories, details, ...(cache && { cache }) }
+    const asked = [{ part: packages.filter(toOsv), osv: true }, { part: packages.filter(pkg => !toOsv(pkg)), osv: false }]
+    const result = await Promise.race([Promise.all(asked.map(({ part, osv }) => part.length === 0 ? Promise.resolve([]) : advisories(part, { ...options, osv }))), deadline])
+    return { status: 200, body: result.flat().toSorted((a, b) => order(a.ecosystem, b.ecosystem) || order(a.name, b.name)) }
   } catch (error) {
     if (debug) console.warn('managed: advisories failed:', error)
     return { status: 502, body: { error: 'upstream-unavailable' } }

package/server-managed/bundle-cache.ts

@@ -3,8 +3,10 @@
 import { Buffer } from 'node:buffer'
 import { brotliDecompress } from 'node:zlib'
 import { promisify } from 'node:util'
-import { BUNDLE_METADATA_VERSION, type BundleDetails, createBundleMetadata, createBundleSummary, parseBundleContents } from '../common/bundle-metadata.js'
+import { bundleEdges } from '@preventive/sourcemap/edges.js'
+import { BUNDLE_METADATA_VERSION, type BundleDetails, createBundleMetadata, createBundleSummary, parseBundleContents, parseBundleMetadata } from '../common/bundle-metadata.js'
 import { bundleReasons } from '../common/bundle-reasons.js'
+import { sourcemapEdges } from '../common/bundle-sourcemap.js'
 import { type BundleAdvisoryInventory, bundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
 import { decodeUtf8 } from '../common/utf8.js'
 import type { OpenedBlob } from './blob-store.ts'
@@ -19,7 +21,7 @@ const MAX_DECODED_BYTES = 512 * 1024 * 1024
 export const MAX_PACKAGE_INVENTORY_BYTES = 1024 * 1024
 export type BundleCachePart = 'metadata' | 'contents'
 export type BundleCacheRecord = Pick<ManagedBundle, 'id' | 'integrity' | 'filename' | 'kind' | 'byteSize'>
-export interface BundleSummary { files: number; codeFiles: number; lines: number; commit?: string }
+export interface BundleSummary { files: number; codeFiles: number; lines: number; commit?: string; stasisVersion?: number; versionedPackages?: number }
 
 export async function readBundleDetails(record: BundleCacheRecord, store: BundleStore) {
   const bytes = await store.get(record.id, record.kind)
@@ -76,15 +78,36 @@ function encodePackageInventory(details: BundleDetails): Buffer {
   return Buffer.from(parts.join(''))
 }
 
+// What a catalog sends of a bundle before it opens. A Stasis bundle's
+// `versionedPackages` counts the name@version pairs its unscoped advisory
+// audit covers, audited or skipped: with none, Advisories has nothing to show.
+export function bundleSummary(details: BundleDetails, metadata?: Parameters<typeof createBundleSummary>[1]): BundleSummary {
+  const summary = createBundleSummary(details, metadata)
+  if (details.kind !== 'stasis') return summary
+  const { packages, skipped } = bundleAdvisoryInventory(details)
+  return { ...summary, versionedPackages: packages.reduce((count, pkg) => count + pkg.versions.length, 0) + skipped.length }
+}
+
+// A sourcemap's edges, read with the parser (edges.js) that the client goes
+// without: every map's, where the client reads Metro's alone. Without it,
+// the metadata keeps what the client would read. A map with no
+// sourcesContent has no source to read them from.
+function readSourcemapEdges(details: BundleDetails) {
+  if (details.kind !== 'sourcemap' || !details.map?.files.some(file => file.content !== null)) return
+  try { details.edges = sourcemapEdges(details.map, bundleEdges) }
+  catch (err) { console.warn('managed: sourcemap edges failed:', err) }
+}
+
 async function build(record: BundleCacheRecord, storage: BundleCacheStorage, db: ManagedDb, store: BundleStore) {
   const details = await readBundleDetails(record, store)
   if (!details) throw new Error('Bundle bytes unavailable')
+  readSourcemapEdges(details)
   const metadata = { ...await createBundleMetadata(details), id: record.id, filename: record.filename }
   const body = await encodeBrotli(Buffer.from(JSON.stringify(metadata)))
   if (!(await db.getBundle(record.id))) throw new Error('Bundle deleted')
   await storage.put(record.id, filename, body)
   if (record.kind === 'stasis') await storage.put(record.id, packagesFilename, encodePackageInventory(details))
-  const summary = createBundleSummary(details, metadata)
+  const summary = bundleSummary(details, metadata)
   await storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary)))
   // A different instance may have deleted the row while these writes ran.
   // Reconcile after publishing so its cleanup cannot be undone by us.
@@ -102,7 +125,7 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
   const summaries = createBundleSummaryCache(storage, async record => {
     const details = await readBundleDetails(record, store)
     if (!details) throw new Error('Bundle bytes unavailable')
-    return createBundleSummary(details)
+    return bundleSummary(details)
   }, id => db.getBundle(id))
   let queue = Promise.resolve()
   async function ensure(record: BundleCacheRecord): Promise<void> {
@@ -137,6 +160,16 @@ export function createBundleCache(storage: BundleCacheStorage, db: ManagedDb, st
       }
       return openCached(record, filename)
     },
+    // A sourcemap's edges as its metadata keeps them, read with the parser
+    // once, for a derivative that reads the bundle itself (report previews).
+    async sourcemapEdges(record: ManagedBundle): Promise<BundleDetails['edges']> {
+      const cached = await openCached(record, filename)
+      const chunks: Buffer[] = []
+      try { for await (const chunk of cached.stream) chunks.push(Buffer.from(chunk)) }
+      finally { cached.stream.destroy() }
+      const decoded = await decompress(Buffer.concat(chunks), { maxOutputLength: MAX_DECODED_BYTES })
+      return parseBundleMetadata(JSON.parse(decodeUtf8(decoded)), record.integrity).edges
+    },
     async advisoryInventory(record: ManagedBundle, reason = ''): Promise<BundleAdvisoryInventory | null | undefined> {
       if (record.kind !== 'stasis') return { packages: [], skipped: [] }
       const cached = await openCached(record, packagesFilename)