@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.41

package/server-managed/activity.ts

@@ -0,0 +1,245 @@
+// Persistent workspace activity. Uploads are recorded in the same transaction
+// as their metadata; triage reuses its existing immutable trail, including
+// legacy entries. Never copy annotation bodies or credentials into this feed.
+import { randomUUID } from 'node:crypto'
+import type { DatabaseSync } from 'node:sqlite'
+import type { ManagedSql } from './sql.ts'
+
+export interface ActivityInput {
+  kind: 'access' | 'repository' | 'visibility' | 'delete'
+  actor: string
+  actorId?: string | null
+  action: string
+  repo?: string | null
+  reportId?: string | null
+  bundleId?: string | null
+  repoId?: number | null
+  repoDirectory?: string | null
+  report?: string | null
+}
+
+export interface ActivityContext {
+  finding: string
+  reportId: string
+  report: string
+  repo: string | null
+}
+
+export type ActivityEntry = {
+  id: string; kind: string; actor: string | null; action: string
+  repo: string | null; reportId: string | null; report: string | null
+  finding: string | null; at: number
+}
+
+export interface ActivityQuery {
+  page: number
+  limit: number
+  kind: string
+  query: string
+  repo?: string
+  actor?: string
+  // null = admin; [] = no accessible findings. Context is supplied by the
+  // server, never by the client. It also replaces potentially private context
+  // from an old report carrying the same globally shared finding.
+  contexts: ActivityContext[] | null
+  userId?: string
+}
+
+export interface ActivityFilters {
+  repos: string[]
+  users: { id: string; login: string; detail: string | null }[]
+}
+
+export interface ActivityStore {
+  recordActivity(entry: ActivityInput, at: number): Promise<void>
+  listActivityReports(userId: string): Promise<Omit<ActivityContext, 'finding'>[]>
+  listActivity(query: ActivityQuery): Promise<{ history: ActivityEntry[]; total: number; page: number; limit: number; filters: ActivityFilters }>
+}
+
+const triageFields = `'triage:' || e.seq AS id, 'triage' AS kind,
+  COALESCE(u.login, e.actor_login) AS actor, e.actor_id AS actorId,
+  CASE WHEN e.color IS NULL AND e.triage IS NULL AND e.comment IS NULL AND e.fix IS NULL AND e.flagged IS NULL
+    THEN 'cleared triage' ELSE 'updated triage' END AS action`
+const triage = `SELECT ${triageFields}, e.repo, e.report_id AS reportId, e.report, e.finding_id AS finding, e.at
+  FROM managed_finding_triage_event e LEFT JOIN managed_user u ON u.id = e.actor_id`
+const commentFields = `'comment:' || e.seq AS id, 'triage' AS kind,
+  COALESCE(u.login, e.actor_login) AS actor, e.actor_id AS actorId, e.action`
+const comments = `SELECT ${commentFields}, e.repo, e.report_id AS reportId, e.report, e.finding_id AS finding, e.at
+  FROM managed_finding_comment_event e LEFT JOIN managed_user u ON u.id = e.actor_id`
+const adminSource = `${triage} UNION ALL ${comments} UNION ALL
+  SELECT id, kind, actor, actor_id AS actorId, action, repo, report_id AS reportId, report, NULL AS finding, at FROM managed_activity`
+// Keep the finite set of accessible findings outside the indexed event
+// lookup. Scanning all events against json_each for every row is quadratic.
+const managerSource = `SELECT ${triageFields},
+  json_extract(c.value, '$.repo') AS repo, json_extract(c.value, '$.reportId') AS reportId,
+  json_extract(c.value, '$.report') AS report, e.finding_id AS finding, e.at
+  FROM json_each(:contexts) c
+  CROSS JOIN managed_finding_triage_event e ON e.finding_id = json_extract(c.value, '$.finding')
+  LEFT JOIN managed_user u ON u.id = e.actor_id
+  UNION ALL SELECT ${commentFields},
+    json_extract(c.value, '$.repo') AS repo, json_extract(c.value, '$.reportId') AS reportId,
+    json_extract(c.value, '$.report') AS report, e.finding_id AS finding, e.at
+  FROM json_each(:contexts) c
+  CROSS JOIN managed_finding_comment_event e ON e.finding_id = json_extract(c.value, '$.finding')
+  LEFT JOIN managed_user u ON u.id = e.actor_id
+  UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId,
+    CASE WHEN a.kind = 'repository' THEN 'changed a report repository assignment' ELSE a.action END AS action,
+    p.full_name AS repo, r.id AS reportId, r.filename AS report, NULL AS finding, a.at
+  FROM managed_activity a JOIN managed_report r ON r.id = a.report_id
+  LEFT JOIN managed_selected_repo p ON p.repo_id = r.repo_id
+  WHERE EXISTS (
+    SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+    JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+    WHERE tu.user_id = :userId AND tr.repo_id = r.repo_id AND ${withinTeamPath('r.repo_directory')}
+  )
+  UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId,
+    CASE WHEN a.kind = 'repository' THEN 'changed a bundle repository assignment' ELSE a.action END AS action,
+    p.full_name AS repo, NULL AS reportId, b.filename AS report, NULL AS finding, a.at
+  FROM managed_activity a JOIN managed_bundle b ON b.id = a.bundle_id
+  LEFT JOIN managed_selected_repo p ON p.repo_id = b.repo_id
+  WHERE a.report_id IS NULL AND EXISTS (
+    SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+    JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+    WHERE tu.user_id = :userId AND tr.repo_id = b.repo_id AND ${withinTeamPath('b.repo_directory')}
+  )
+  UNION ALL SELECT a.id, a.kind, a.actor, a.actor_id AS actorId, a.action, a.repo, a.report_id AS reportId,
+    a.report, NULL AS finding, a.at FROM managed_activity a
+  WHERE a.kind = 'delete' AND (a.report_id IS NOT NULL OR a.bundle_id IS NOT NULL)
+    AND NOT EXISTS (SELECT 1 FROM managed_report WHERE id = a.report_id)
+    AND NOT EXISTS (SELECT 1 FROM managed_bundle WHERE id = a.bundle_id)
+    AND EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+      JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+      WHERE tu.user_id = :userId AND tr.repo_id = a.repo_id
+      AND ${withinTeamPath('a.repo_directory')})`
+
+export const ACTIVITY_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS managed_activity (
+      id TEXT PRIMARY KEY, kind TEXT NOT NULL, actor TEXT, action TEXT NOT NULL,
+      repo TEXT, report_id TEXT, report TEXT, at INTEGER NOT NULL,
+      bundle_id TEXT, repo_id INTEGER, repo_directory TEXT, actor_id TEXT
+    ) STRICT;
+    CREATE INDEX IF NOT EXISTS managed_activity_at_idx ON managed_activity(at, id);
+    CREATE INDEX IF NOT EXISTS finding_triage_event_at_idx ON managed_finding_triage_event(at, seq);
+`
+
+export function initActivityMethods(db: DatabaseSync): void {
+  db.exec(ACTIVITY_SCHEMA)
+  migrateActivityScope(db)
+  db.exec('CREATE INDEX IF NOT EXISTS managed_activity_actor_at_idx ON managed_activity(actor_id, at)')
+  // Stable upload IDs make backfill idempotent, including after restarts.
+  // Snapshots deliberately have no cascading FKs: deletion is itself activity.
+  // CREATE TRIGGER IF NOT EXISTS keeps an older body; replace the one that
+  // predates server-built bundles so builds are not recorded as uploads.
+  const bundleTrigger = db.prepare("SELECT sql FROM sqlite_schema WHERE type = 'trigger' AND name = 'managed_bundle_activity'").get() as { sql: string } | undefined
+  if (bundleTrigger && !bundleTrigger.sql.includes('provenance')) db.exec('DROP TRIGGER managed_bundle_activity')
+  for (const type of ['report', 'bundle']) {
+    const columns = `id, kind, actor, action, repo, report_id, report, at, bundle_id, actor_id`
+    const values = (alias: string) => `'${type}-upload:' || ${alias}.id, 'upload',
+      COALESCE(${alias}.uploaded_by_login, (SELECT login FROM managed_user WHERE id = ${alias}.uploaded_by)), ${uploadAction(type, alias)},
+      (SELECT full_name FROM managed_selected_repo WHERE repo_id = ${alias}.repo_id),
+      ${type === 'report' ? `${alias}.id` : 'NULL'}, ${alias}.filename, ${alias}.uploaded_at,
+      ${type === 'bundle' ? `${alias}.id` : 'NULL'}, ${alias}.uploaded_by`
+    db.exec(`
+      CREATE TRIGGER IF NOT EXISTS managed_${type}_activity AFTER INSERT ON managed_${type}
+      BEGIN INSERT INTO managed_activity (${columns}) SELECT ${values('NEW')}; END;
+      INSERT OR IGNORE INTO managed_activity (${columns}) SELECT ${values('source')} FROM managed_${type} source;
+    `)
+  }
+}
+
+// The creation entry for a stored report or bundle. Shared with the Postgres
+// trigger function; `alias` is the trigger row (NEW) or a backfill alias.
+export function uploadAction(type: string, alias: string): string {
+  return type === 'bundle' ? `CASE WHEN ${alias}.provenance = 'build' THEN 'built a bundle' ELSE 'uploaded a bundle' END` : `'uploaded a ${type}'`
+}
+
+export function activityMethods(db: ManagedSql): ActivityStore {
+  const insert = db.prepare(`INSERT INTO managed_activity (id, kind, actor, action, repo, report_id, report, at, bundle_id, repo_id, repo_directory, actor_id)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+  const admin = activityStatements(db, adminSource)
+  const manager = activityStatements(db, managerSource)
+  const reports = db.prepare(`SELECT r.id AS reportId, r.filename AS report, p.full_name AS repo
+    FROM managed_report r JOIN managed_selected_repo p ON p.repo_id = r.repo_id
+    WHERE EXISTS (SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+      JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+      WHERE tu.user_id = ? AND tr.repo_id = r.repo_id AND ${withinTeamPath('r.repo_directory')})
+    ORDER BY r.uploaded_at DESC, r.id`)
+  return {
+    async recordActivity(entry, at) {
+      await insert.run(randomUUID(), entry.kind, entry.actor, entry.action, entry.repo ?? null, entry.reportId ?? null, entry.report ?? null, at,
+        entry.bundleId ?? null, entry.repoId ?? null, entry.repoDirectory ?? null, entry.actorId ?? null)
+    },
+    async listActivityReports(userId) {
+      return (await reports.all(userId)) as Omit<ActivityContext, 'finding'>[]
+    },
+    async listActivity({ page, limit, kind, query, repo = '', actor = '', contexts, userId }) {
+      const stmts = contexts == null ? admin : manager
+      const scope = contexts == null ? {} : { contexts: JSON.stringify(contexts), userId: userId ?? '' }
+      const params = { ...scope, kind, query, repo, actor }
+      const { total } = (await stmts.count.get(params)) as { total: number }
+      const currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
+      const history = (await stmts.rows.all({ ...params, limit, offset: (currentPage - 1) * limit })) as ActivityEntry[]
+      const filters: ActivityFilters = {
+        repos: ((await stmts.repos.all(scope)) as { repo: string }[]).map(row => row.repo),
+        users: ((await stmts.users.all(scope)) as ActivityFilters['users']).map(row => ({ id: row.id, login: row.login, detail: row.detail })),
+      }
+      return { history, total, page: currentPage, limit, filters }
+    },
+  }
+}
+
+// Both rows and selector choices come from the authorized source. Keep legacy
+// login-only actors separate: a historical login is not proof of user identity.
+function activityStatements(db: ManagedSql, source: string) {
+  const activity = `WITH events AS (${source}), activity AS (
+    SELECT events.*, COALESCE('user:' || actorId, 'legacy:' || actor) AS actorKey FROM events
+  )`
+  const filtered = `${activity} SELECT id, kind, actor, action, repo, reportId, report, finding, at FROM activity
+    WHERE (:kind = 'all' OR kind = :kind)
+    AND (:repo = '' OR repo = :repo) AND (:actor = '' OR actorKey = :actor)
+    AND (:query = '' OR instr(lower(coalesce(actor, '') || ' ' || action || ' ' ||
+      coalesce(repo, '') || ' ' || coalesce(report, '') || ' ' || coalesce(finding, '')), lower(:query)) > 0)`
+  return {
+    count: db.prepare(`SELECT count(*) AS total FROM (${filtered}) AS filtered`),
+    rows: db.prepare(`${filtered} ORDER BY at DESC,
+      CASE WHEN kind = 'triage' THEN CAST(substr(id, instr(id, ':') + 1) AS INTEGER) ELSE 0 END DESC,
+      id DESC LIMIT :limit OFFSET :offset`),
+    repos: db.prepare(`${activity} SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '' ORDER BY repo`),
+    users: db.prepare(`${activity} SELECT a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
+      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail FROM (
+        SELECT actorKey, actorId, actor, ROW_NUMBER() OVER (PARTITION BY actorKey ORDER BY at DESC, id DESC) AS position
+        FROM activity WHERE actorKey IS NOT NULL AND actorKey <> 'legacy:'
+      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1 ORDER BY login, a.actorKey`),
+  }
+}
+
+// Literal path comparison preserves separators, case and SQL wildcard chars.
+function withinTeamPath(path: string): string {
+  return `(tr.path IS NULL OR tr.path = '' OR ${path} = tr.path OR substr(${path}, 1, length(tr.path) + 1) = tr.path || '/')`
+}
+
+function migrateActivityScope(db: DatabaseSync): void {
+  const columns = new Set((db.prepare('PRAGMA table_info(managed_activity)').all() as { name: string }[]).map(column => column.name))
+  const missing = [['bundle_id', 'TEXT'], ['repo_id', 'INTEGER'], ['repo_directory', 'TEXT'], ['actor_id', 'TEXT']].filter(([name]) => !columns.has(name!))
+  if (missing.length === 0) return
+  db.exec('BEGIN')
+  try {
+    for (const [name, type] of missing) db.exec(`ALTER TABLE managed_activity ADD COLUMN ${name} ${type}`)
+    if (!columns.has('bundle_id') || !columns.has('actor_id')) {
+      db.exec('DROP TRIGGER IF EXISTS managed_report_activity; DROP TRIGGER IF EXISTS managed_bundle_activity;')
+    }
+    if (!columns.has('bundle_id')) db.exec("UPDATE managed_activity SET bundle_id = substr(id, 15) WHERE id LIKE 'bundle-upload:%'")
+    if (!columns.has('actor_id')) {
+      // Existing upload targets retain a reliable uploader identity. Do not
+      // guess identities from historical logins: names can change or be reused.
+      for (const type of ['report', 'bundle']) {
+        db.exec(`UPDATE managed_activity SET actor_id = (
+          SELECT uploaded_by FROM managed_${type} WHERE id = substr(managed_activity.id, 15)
+        ) WHERE id LIKE '${type}-upload:%'`)
+      }
+    }
+    // Legacy deletions/assignments without a durable target/scope remain
+    // admin-only; neither filenames nor repository names authorize access.
+    db.exec('COMMIT')
+  } catch (err) { db.exec('ROLLBACK'); throw err }
+}

package/server-managed/avatar-store.ts

@@ -0,0 +1,12 @@
+// Shared avatar cache interface, implemented by storage-stores.ts.
+import type { Buffer } from 'node:buffer'
+
+export interface CachedAvatar {
+  contentType: string
+  bytes: Buffer
+}
+
+export interface AvatarStore {
+  put(id: string, contentType: string, bytes: Buffer): Promise<void>
+  get(id: string): Promise<CachedAvatar | null>
+}

package/server-managed/blob-store.ts

@@ -0,0 +1,17 @@
+// Logical upload-store interfaces shared by disk and Vercel storage.
+import type { Buffer } from 'node:buffer'
+import type { Readable } from 'node:stream'
+
+export interface OpenedBlob {
+  // Remote streams may omit their size; callers then omit Content-Length.
+  size: number | null
+  stream: Readable
+}
+
+export interface BlobStore {
+  // Encrypted upload stores return the wrapped data key for the SQL insert.
+  put(id: string, bytes: Buffer): Promise<string | null>
+  get(id: string): Promise<Buffer | null>
+  open(id: string): Promise<OpenedBlob | null>
+  delete(id: string): Promise<void>
+}

package/server-managed/brotli.ts

@@ -0,0 +1,10 @@
+import { brotliCompress, constants } from 'node:zlib'
+import { promisify } from 'node:util'
+import type { Buffer } from 'node:buffer'
+
+const compress = promisify(brotliCompress)
+
+// Bundles and cold caches use quality 4; stored reports use quality 9.
+export function encodeBrotli(bytes: Uint8Array, quality = 4): Promise<Buffer> {
+  return compress(bytes, { params: { [constants.BROTLI_PARAM_QUALITY]: quality } })
+}

package/server-managed/bundle-advisories.ts

@@ -0,0 +1,120 @@
+import { type Advisory, type CacheStore, type Package, advisories } from '@preventive/upstream/advisories.js'
+import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
+import { isNpmPackageName, npmPackageScope } from '../common/managed/npm-packages.js'
+import { NPM_REGISTRY, askUpstream } from './npm-packages.ts'
+
+export const ADVISORIES_TIMEOUT_MS = 30_000
+const PUBLIC_AT_ONCE = 16
+const order = (a: string, b: string) => Number(a > b) - Number(a < b)
+
+// Whether anyone may read a package, so that its name may go to a service
+// other than npm (OSV): an unscoped one always, npm's private packages
+// always being scoped; a scoped one where npm answers it anonymously, asked
+// by a HEAD, which reads nothing of it. One npm can't be asked of is taken
+// as private, and not kept; the rest are, for PUBLIC_MS, PUBLIC_NAMES at
+// most, as a package may be made private, or public. A name npm can't have
+// is asked of no one, upstream refusing it.
+const PUBLIC_MS = 60 * 60_000
+const PUBLIC_NAMES = 10_000
+const publicNames = new Map<string, { at: number; open: boolean }>()
+async function isPublicNpmPackage(name: string, signal: AbortSignal): Promise<boolean> {
+  if (!isNpmPackageName(name)) return false
+  if (npmPackageScope(name) === null) return true
+  const kept = publicNames.get(name)
+  if (kept && Date.now() - kept.at < PUBLIC_MS) return kept.open
+  let open
+  try { open = await askUpstream(`${NPM_REGISTRY}/${name}`, { method: 'HEAD', limit: Number.MAX_SAFE_INTEGER, signal, absent: [401, 403, 404] }) !== null } catch { return false }
+  publicNames.delete(name)
+  publicNames.set(name, { at: Date.now(), open })
+  while (publicNames.size > PUBLIC_NAMES) publicNames.delete(publicNames.keys().next().value!)
+  return open
+}
+
+// The npm packages anyone may read (isPublicNpmPackage), a few asked at a
+// time, within PUBLIC_BUDGET_MS, a third of the audit's: a scoped one npm
+// hasn't told of by then is taken as private, asked of npm alone, for the
+// audit to keep the rest of its time.
+const PUBLIC_BUDGET_MS = 10_000
+async function publicNpmNames(packages: Package[], signal: AbortSignal): Promise<Set<string>> {
+  const names = [...new Set(packages.filter(pkg => pkg.ecosystem === 'npm').map(pkg => pkg.name))]
+  const open = new Set<string>()
+  const budget = new AbortController()
+  const timer = setTimeout(() => { budget.abort(new Error('public-check-budget')) }, PUBLIC_BUDGET_MS)
+  const asking = AbortSignal.any([signal, budget.signal])
+  try {
+    for (let at = 0; at < names.length; at += PUBLIC_AT_ONCE) {
+      const chunk = names.slice(at, at + PUBLIC_AT_ONCE)
+      const checked = await Promise.all(chunk.map(name => isPublicNpmPackage(name, asking)))
+      for (const [i, name] of chunk.entries()) if (checked[i]) open.add(name)
+    }
+  } finally { clearTimeout(timer) }
+  return open
+}
+
+function advisoryGithubClient(token: string | null, signal: AbortSignal): Client {
+  const authenticated = createClient({ token, userAgent: 'deepview-triage' })
+  let client = authenticated
+  return {
+    ...authenticated,
+    async listRepoAdvisories(options) {
+      const current = client
+      try { return await current.listRepoAdvisories(options) } catch (error) {
+        if (token === null || current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
+        signal.throwIfAborted()
+        // Published advisories remain readable after a token is revoked. Reuse
+        // anonymous access for subsequent repositories in this audit as well.
+        if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
+        return await client.listRepoAdvisories(options)
+      }
+    },
+  }
+}
+
+// The managed caller supplies its user's token when available; public shares
+// remain anonymous. Upstream sends this credential only to GitHub and returns
+// published advisories, matching versions across npm, OSV and repository rows:
+// OSV's for npm packages anyone may read too, the malicious packages' records
+// among them, which npm's registry hasn't.
+// `cache` keeps each repository's listing (upstream-cache.ts) across audits;
+// `github`, a client of the caller's, asks GitHub in place of one with
+// `githubToken`.
+export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
+  { debug = false, repoAdvisories = false, details = false, githubToken = null, github, cache }: {
+    debug?: boolean; repoAdvisories?: boolean; details?: boolean; githubToken?: string | null; github?: Client; cache?: CacheStore | undefined
+  } = {}): Promise<
+  { status: 200; body: Advisory[] } | { status: 502; body: { error: string } }
+> {
+  let onAbort: (() => void) | undefined
+  try {
+    signal.throwIfAborted()
+    if (packages.length === 0) return { status: 200, body: [] }
+    // Upstream owns each transport's timeout and exposes no cancellation
+    // option. Bound the caller's wait for the multi-request audit as well.
+    const deadline = new Promise<never>((_resolve, reject) => {
+      onAbort = () => reject(signal.reason)
+      signal.addEventListener('abort', onAbort, { once: true })
+    })
+    // npm packages anyone may read are asked of OSV too (upstream's `osv`),
+    // for the malicious packages' records npm's registry hasn't; a private
+    // one's name never leaves for OSV, as it never does for Socket. A package
+    // is wholly in one ask or the other, so upstream's order holds.
+    const open = await Promise.race([publicNpmNames(packages, signal), deadline])
+    const toOsv = (pkg: Package) => pkg.ecosystem === 'npm' && open.has(pkg.name)
+    // Kept in the caller's store, or without one in upstream's disk cache,
+    // where the server set one (auditCache).
+    const options = { github: github ?? advisoryGithubClient(githubToken, signal), repoAdvisories, details, ...(cache && { cache }) }
+    const asked = [{ part: packages.filter(toOsv), osv: true }, { part: packages.filter(pkg => !toOsv(pkg)), osv: false }]
+    const result = await Promise.race([Promise.all(asked.map(({ part, osv }) => part.length === 0 ? Promise.resolve([]) : advisories(part, { ...options, osv }))), deadline])
+    return { status: 200, body: result.flat().toSorted((a, b) => order(a.ecosystem, b.ecosystem) || order(a.name, b.name)) }
+  } catch (error) {
+    // Answered as upstream's failure alone: logged, its message, or with
+    // `debug` the whole error, but for a request its client gave up on. One
+    // past its deadline (aborted with a TimeoutError, as AbortSignal.timeout
+    // and the bundle route's timer abort) is the server giving up: logged.
+    const cancelled = signal.aborted && (signal.reason as { name?: unknown } | undefined)?.name !== 'TimeoutError'
+    if (!cancelled) console.warn('managed: advisories failed:', debug || !(error instanceof Error) ? error : error.message)
+    return { status: 502, body: { error: 'upstream-unavailable' } }
+  } finally {
+    if (onAbort) signal.removeEventListener('abort', onAbort)
+  }
+}

package/server-managed/bundle-advisory-inventory.ts

@@ -0,0 +1,77 @@
+import { isEvidenceFile } from '@exodus/stasis/audit-corrections'
+import { packageRepo } from '@exodus/stasis-core/bundle-util'
+import type { Package } from '@preventive/upstream/advisories.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+
+export interface SkippedAdvisoryPackage {
+  ecosystem: string
+  name: string
+  version: string
+  because: string
+}
+export interface BundleAdvisoryInventory { packages: Package[]; skipped: SkippedAdvisoryPackage[] }
+interface BundleModule { ecosystem?: string; name?: string; version?: string; repo?: { github?: Package['github'] }; files: Record<string, unknown> }
+
+// The GitHub repository a bundled package.json's text names, read as Stasis
+// records a dependency's (packageRepo) and as Node reads the file, past a byte
+// order mark the bundle keeps. Undefined where it names none or doesn't parse.
+function manifestRepo(text: unknown): Package['github'] {
+  if (typeof text !== 'string') return undefined
+  try { return packageRepo(JSON.parse(text.replace(/^\uFEFF/u, '')))?.github } catch { return undefined }
+}
+
+function supported(ecosystem: string): ecosystem is Package['ecosystem'] {
+  return ['npm', 'cargo', 'composer', 'soldeer', 'github'].includes(ecosystem)
+}
+
+function skipReason(ecosystem: string, version: string): string | undefined {
+  if (ecosystem === 'cargo-git') return 'Crate vendored from git; its identity is not a crates.io package.'
+  if (ecosystem === 'cargo-unknown') return 'Crate source is unknown because .cargo-checksum.json is missing.'
+  if (ecosystem === 'composer' && /^dev-|-dev$/iu.test(version.replace(/#.*$/su, ''))) return 'Composer dev versions cannot be matched against release advisories.'
+  return undefined
+}
+
+// Package and reason presence both require a recorded evidence file, by Stasis's
+// audit rule (server-only, as its semver uses Node's npm). Entry and manually
+// added files count even when they have no incoming import edge.
+export function bundleAdvisoryInventory(details: BundleDetails, paths: Iterable<string> | null = null): BundleAdvisoryInventory {
+  const modules = (details.bundle as { modules?: ReadonlyMap<string, BundleModule> } | undefined)?.modules
+  if (details.kind !== 'stasis' || !modules) return { packages: [], skipped: [] }
+  const selected = paths === null ? null : new Set(paths)
+  const packages = new Map<string, { ecosystem: Package['ecosystem']; name: string; versions: Set<string>; github?: Package['github'] | null }>()
+  const skipped = new Map<string, SkippedAdvisoryPackage>()
+  for (const [dir, info] of modules) {
+    if (dir === '.') continue
+    const ecosystem = info.ecosystem ?? (/(?:^|\/)node_modules\//u.test(dir) ? 'npm' : undefined)
+    const { name, version } = info
+    if (ecosystem === undefined || typeof name !== 'string' || !name || typeof version !== 'string' || !version) continue
+    if (!Object.keys(info.files).some(file => (!selected || selected.has(`${dir}/${file}`)) && isEvidenceFile(name, version, file, ecosystem))) continue
+    const because = skipReason(ecosystem, version)
+    if (!supported(ecosystem) || because !== undefined) {
+      skipped.set(JSON.stringify([ecosystem, name, version]), { ecosystem, name, version, because: because ?? `No advisory source is supported for ${ecosystem}.` })
+      continue
+    }
+    // Foundry's branch '.' means the superproject's branch. As in Stasis,
+    // 0.0.0 tells upstream its actual version is unknown, so every range covers it.
+    const auditedVersion = ecosystem === 'github' && version === '.' ? '0.0.0' : version
+    const key = JSON.stringify([ecosystem, ecosystem === 'github' ? name.toLowerCase() : name])
+    if (!packages.has(key)) packages.set(key, { ecosystem, name, versions: new Set() })
+    const pkg = packages.get(key)!
+    pkg.versions.add(auditedVersion)
+    // A bundle from before Stasis recorded `repo` may still carry the npm
+    // package's package.json; ask the repository it names, as Stasis does.
+    let github = ecosystem === 'github' ? undefined : info.repo?.github
+    if (github === undefined && ecosystem === 'npm') github = manifestRepo(info.files['package.json'])
+    if (github !== undefined) {
+      // Upstream accepts one repository per package. Conflicting hints (for
+      // example, versions from before and after a move) use registry discovery.
+      if (pkg.github === undefined) pkg.github = github
+      else if (pkg.github !== null && pkg.github.toLowerCase() !== github.toLowerCase()) pkg.github = null
+    }
+  }
+  const byPackage = (a: { ecosystem: string; name: string }, b: { ecosystem: string; name: string }) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name)
+  return {
+    packages: [...packages.values()].map(({ github, ...pkg }) => ({ ...pkg, versions: [...pkg.versions].toSorted(), ...(github ? { github } : {}) })).toSorted(byPackage),
+    skipped: [...skipped.values()].toSorted((a, b) => byPackage(a, b) || a.version.localeCompare(b.version)),
+  }
+}

package/server-managed/bundle-build-diagnostics.d.ts

@@ -0,0 +1,10 @@
+export interface BundleBuildDiagnostic {
+  message: string
+  name?: string
+  code?: string
+  status?: number
+  stack?: string
+  cause?: BundleBuildDiagnostic
+}
+export function bundleBuildDiagnostic(error: unknown, token: string | null): BundleBuildDiagnostic
+export type BundleBuildStage = 'worker-start' | 'build' | 'scope' | 'serialize' | 'compress'

package/server-managed/bundle-build-diagnostics.js

@@ -0,0 +1,23 @@
+// Whitelist diagnostic fields; never inspect/serialize an entire upstream
+// error, request, response, or workerData (which contains the GitHub token).
+export function bundleBuildDiagnostic(error, token, depth = 0) {
+  const redact = value => {
+    let text = String(value)
+    if (token) text = text.replaceAll(token, '[redacted]')
+    return text.replaceAll(/\b(?:github_pat_|gh[pousr]_)[\w]+/gu, '[redacted]')
+      .replaceAll(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gu, '$1[redacted]@')
+      .replaceAll(/([?&](?:access_token|token|key)=)[^\s&#]*/giu, '$1[redacted]')
+  }
+  if (!error || typeof error !== 'object') return { message: redact(error).slice(0, 2048) }
+  // Upstream HttpError messages append the response body after the status.
+  // Keep the method, URL and status, but omit that body from message and stack.
+  const raw = typeof error.message === 'string' ? error.message : 'Unknown error'
+  const message = error.name === 'HttpError' ? raw.replace(/(\s\d{3}):[\s\S]*$/u, '$1') : raw
+  const result = { message: redact(message).slice(0, 2048) }
+  if (typeof error.name === 'string') result.name = redact(error.name).slice(0, 128)
+  if (typeof error.code === 'string') result.code = redact(error.code).slice(0, 128)
+  if (typeof error.status === 'number') result.status = error.status
+  if (typeof error.stack === 'string') result.stack = redact(error.stack.replace(raw, message)).slice(0, 8192)
+  if (error.cause && depth < 3) result.cause = bundleBuildDiagnostic(error.cause, token, depth + 1)
+  return result
+}

package/server-managed/bundle-build-leases.ts

@@ -0,0 +1,41 @@
+import type { ManagedSql } from './sql.ts'
+
+export const BUNDLE_BUILD_TIMEOUT_MS = 180_000
+// Leave time to terminate a timed-out worker before a crashed owner's slot
+// becomes reusable. Expiration uses the database clock, not an instance's clock.
+const LEASE_MS = BUNDLE_BUILD_TIMEOUT_MS + 60_000
+export const BUNDLE_BUILD_LEASE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_bundle_build_lease (
+  slot INTEGER PRIMARY KEY CHECK (slot IN (1, 2)),
+  owner TEXT NOT NULL UNIQUE,
+  user_id TEXT NOT NULL UNIQUE,
+  expires_at INTEGER NOT NULL
+) STRICT;
+`
+
+export interface BundleBuildLeaseStore {
+  claimBundleBuildLease(userId: string, owner: string): Promise<boolean>
+  releaseBundleBuildLease(owner: string): Promise<void>
+}
+
+export function bundleBuildLeaseMethods(db: ManagedSql): BundleBuildLeaseStore {
+  return {
+    // scopeManagedMethods holds SQLite's write transaction / PostgreSQL's
+    // advisory transaction lock across cleanup, inspection, and admission.
+    async claimBundleBuildLease(userId, owner) {
+      const { now } = await db.prepare("SELECT CAST(unixepoch('subsec') * 1000 AS INTEGER) AS now").get() as { now: number }
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE expires_at <= ?').run(now)
+      const leases = await db.prepare('SELECT slot, user_id AS userId FROM managed_bundle_build_lease').all() as { slot: number; userId: string }[]
+      if (leases.length >= 2 || leases.some(lease => lease.userId === userId)) return false
+      const slot = leases.some(lease => lease.slot === 1) ? 2 : 1
+      await db.prepare('INSERT INTO managed_bundle_build_lease (slot, owner, user_id, expires_at) VALUES (?, ?, ?, ?)')
+        .run(slot, owner, userId, now + LEASE_MS)
+      return true
+    },
+    // No user FK: deleting an account must not free a still-running worker's
+    // slot. A delayed/crashed owner's cleanup cannot release its successor.
+    async releaseBundleBuildLease(owner) {
+      await db.prepare('DELETE FROM managed_bundle_build_lease WHERE owner = ?').run(owner)
+    },
+  }
+}