@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.41

package/server-managed/db-neon.ts

@@ -0,0 +1,367 @@
+import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { LINK_REPORT_SCHEMA } from './link-reports.ts'
+import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
+import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { WebSocket } from 'ws'
+import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
+import { revisionSchema } from './revisions.ts'
+import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { STORAGE_SCHEMA } from './storage-db.ts'
+import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
+import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
+import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
+import { COMMENT_SCHEMA } from './comments.ts'
+import { ACTIVITY_SCHEMA, uploadAction } from './activity.ts'
+import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { postgresSchema, postgresSql } from './sql-postgres.ts'
+import { managedTableRenames } from './db-table-names.ts'
+import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
+import { allocateMissingSlugs } from './slugs.ts'
+
+export interface PgConnection {
+  query(sql: string, params?: unknown[]): Promise<{
+    rows: Record<string, unknown>[]; rowCount?: number | null
+    fields?: { name: string; dataTypeID: number }[]
+  }>
+  release(): Promise<void>
+}
+export type PgConnect = () => Promise<PgConnection>
+// Content/access mutations cooperate on this transaction-scoped lock. Reads,
+// presence updates, and maintenance leases do not take it. Also fences migrations.
+const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
+
+async function currentSchema(db: PgConnection): Promise<boolean> {
+  const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
+  if (!exists) return false
+  const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
+  return Array.from({ length: 27 }, (_, i) => i + 1).every(version => versions.has(version))
+}
+
+async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 12')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_selected_repo ADD COLUMN IF NOT EXISTS cached_default_branch TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (12)')
+}
+
+async function migrateBundleBuildLeases(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 13')).rows.length > 0) return
+  await db.query(postgresSchema(BUNDLE_BUILD_LEASE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (13)')
+}
+
+async function migrateGithubMetadata(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA))
+  await db.query(`ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS state_reason ${GITHUB_STATE_REASON_COLUMN}`)
+  await db.query('ALTER TABLE managed_github_metadata ADD COLUMN IF NOT EXISTS attempted_at BIGINT')
+  await db.query('INSERT INTO managed_schema_version VALUES (14) ON CONFLICT DO NOTHING')
+}
+
+async function migrateBundleVisibility(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 15')).rows.length === 0) {
+    await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS visible INTEGER NOT NULL DEFAULT 1')
+    await db.query('INSERT INTO managed_schema_version VALUES (15)')
+  }
+}
+
+async function migrateLinkReports(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(revisionSchema(true)))
+  await db.query('INSERT INTO managed_schema_version VALUES (16) ON CONFLICT DO NOTHING')
+}
+
+async function migrateRepositoryAliases(db: PgConnection): Promise<void> {
+  await db.query(postgresSchema(REPOSITORY_ALIAS_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (17) ON CONFLICT DO NOTHING')
+}
+
+async function migrateHiddenTeams(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 18')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_team ADD COLUMN IF NOT EXISTS hidden INTEGER NOT NULL DEFAULT 0')
+  await db.query('INSERT INTO managed_schema_version VALUES (18)')
+}
+
+async function migrateIssueFixes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 19')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_finding_issue ADD COLUMN IF NOT EXISTS auto_fix_url TEXT, ADD COLUMN IF NOT EXISTS auto_fix_checked_at BIGINT')
+  await db.query(postgresSchema(revisionSchema(true)))
+  await db.query('INSERT INTO managed_schema_version VALUES (19)')
+}
+
+// Existing rows stay NULL (unknown): some may have been built on the server.
+async function migrateBundleProvenance(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 20')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS provenance TEXT')
+  await createUploadTrigger(db, 'bundle', false)
+  await db.query('INSERT INTO managed_schema_version VALUES (20)')
+}
+
+async function migrateUpstreamCache(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 21')).rows.length > 0) return
+  await db.query(postgresSchema(UPSTREAM_CACHE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (21)')
+}
+
+// Existing builds stay NULL: their conditions were never recorded.
+async function migrateBundleBuildConditions(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 22')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS build_conditions TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (22)')
+}
+
+// Existing sessions create their upload key on first use.
+async function migrateSessionUploadKeys(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 23')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_session ADD COLUMN IF NOT EXISTS upload_key TEXT')
+  await db.query('INSERT INTO managed_schema_version VALUES (23)')
+}
+
+async function migrateViewSessions(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 24')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_session ADD COLUMN IF NOT EXISTS viewer_session TEXT REFERENCES managed_session(id) ON DELETE CASCADE')
+  await db.query(VIEW_SESSION_INDEX)
+  await db.query('INSERT INTO managed_schema_version VALUES (24)')
+}
+
+async function migrateGithubCommits(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 25')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_COMMIT_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (25)')
+}
+
+async function migrateTeamNpmScopes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 26')).rows.length > 0) return
+  await db.query(postgresSchema(TEAM_NPM_SCOPE_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (26)')
+}
+
+async function migrateDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 27')).rows.length > 0) return
+  await db.query('ALTER TABLE managed_team ADD COLUMN IF NOT EXISTS dependency_review INTEGER NOT NULL DEFAULT 0')
+  await db.query(postgresSchema(DEPENDENCY_REVIEW_SCHEMA))
+  await db.query('INSERT INTO managed_schema_version VALUES (27)')
+}
+
+async function initialize(db: PgConnection): Promise<void> {
+  if (await currentSchema(db)) return
+  await db.query('BEGIN')
+  try {
+    await db.query(LOCK)
+    await db.query('CREATE TABLE IF NOT EXISTS managed_schema_version (version INTEGER PRIMARY KEY)')
+    const initialized = (await db.query('SELECT version FROM managed_schema_version WHERE version = 1')).rows.length > 0
+    const prefixed = (await db.query('SELECT version FROM managed_schema_version WHERE version = 3')).rows.length > 0
+    if (initialized && !prefixed) {
+      const { rows } = await db.query("SELECT relname AS name FROM pg_class WHERE relkind IN ('r', 'p') AND pg_table_is_visible(oid)")
+      for (const [from, to] of managedTableRenames(new Set(rows.map(row => String(row['name']))))) {
+        await db.query(`ALTER TABLE ${from} RENAME TO ${to}`)
+      }
+      // PL/pgSQL function bodies retain literal table names after ALTER TABLE.
+      for (const type of ['report', 'bundle']) await createUploadTrigger(db, type, false)
+    }
+    if (!initialized) {
+      await db.query(postgresSchema(MANAGED_SCHEMA + COMMENT_SCHEMA + ACTIVITY_SCHEMA))
+      await db.query(`ALTER TABLE managed_finding_triage_event ADD COLUMN report_id TEXT, ADD COLUMN report TEXT, ADD COLUMN repo TEXT;
+        CREATE UNIQUE INDEX managed_team_slug_idx ON managed_team(slug);
+        CREATE UNIQUE INDEX managed_report_slug_idx ON managed_report(slug);
+        CREATE INDEX managed_activity_actor_at_idx ON managed_activity(actor_id, at);`)
+      for (const type of ['report', 'bundle']) await createUploadTrigger(db, type)
+      await db.query('INSERT INTO managed_schema_version VALUES (1)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 2')).rows.length === 0) {
+      await db.query('CREATE INDEX IF NOT EXISTS managed_report_bundle_hash_idx ON managed_report(bundle_id, sha256)')
+      await db.query('INSERT INTO managed_schema_version VALUES (2)')
+    }
+    if (!prefixed) await db.query('INSERT INTO managed_schema_version VALUES (3)')
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 4')).rows.length === 0) {
+      await db.query(postgresSchema(WORKSPACE_SHARE_SCHEMA))
+      await db.query('INSERT INTO managed_schema_version VALUES (4)')
+    }
+    await migrateGithubMetadata(db)
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 5')).rows.length === 0) {
+      await db.query(`ALTER TABLE managed_workspace_share ADD COLUMN IF NOT EXISTS dependencies INTEGER NOT NULL DEFAULT 0,
+        ADD COLUMN IF NOT EXISTS security INTEGER NOT NULL DEFAULT 0`)
+      await db.query('INSERT INTO managed_schema_version VALUES (5)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 6')).rows.length === 0) {
+      await db.query('ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS slug TEXT')
+      const { rows } = await db.query('SELECT id, slug FROM managed_bundle ORDER BY id')
+      for (const row of allocateMissingSlugs(rows as { id: string; slug: string | null }[])) {
+        await db.query('UPDATE managed_bundle SET slug = $1 WHERE id = $2', [row.slug, row.id])
+      }
+      await db.query(`ALTER TABLE managed_bundle ALTER COLUMN slug SET NOT NULL;
+        CREATE UNIQUE INDEX IF NOT EXISTS managed_bundle_slug_idx ON managed_bundle(slug);
+        INSERT INTO managed_schema_version VALUES (6)`)
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 7')).rows.length === 0) {
+      await db.query("ALTER TABLE managed_bundle ADD COLUMN IF NOT EXISTS repo_directory TEXT NOT NULL DEFAULT ''")
+      await db.query('INSERT INTO managed_schema_version VALUES (7)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 8')).rows.length === 0) {
+      await db.query('CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id)')
+      await db.query('INSERT INTO managed_schema_version VALUES (8)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 9')).rows.length === 0) {
+      await db.query(postgresSchema(STORAGE_SCHEMA))
+      for (const table of ['managed_report', 'managed_bundle']) {
+        await db.query(`ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS data_key TEXT, ADD COLUMN IF NOT EXISTS storage_encrypted INTEGER NOT NULL DEFAULT 0`)
+      }
+      await db.query('ALTER TABLE managed_user ADD COLUMN IF NOT EXISTS gh_tokens_encrypted INTEGER NOT NULL DEFAULT 0')
+      await db.query('INSERT INTO managed_schema_version VALUES (9)')
+    }
+    await db.query(postgresSchema(LINK_REPORT_SCHEMA))
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 10')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (10)')
+    }
+    if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
+      await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
+    }
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews]) await migrate(db)
+    await db.query('COMMIT')
+  } catch (err) {
+    await db.query('ROLLBACK')
+    throw err
+  }
+}
+
+async function createUploadTrigger(db: PgConnection, type: string, createTrigger = true): Promise<void> {
+  await db.query(`CREATE OR REPLACE FUNCTION managed_${type}_activity_insert() RETURNS trigger LANGUAGE plpgsql AS $$
+    BEGIN
+      INSERT INTO managed_activity (id, kind, actor, action, repo, report_id, report, at, bundle_id, actor_id)
+      VALUES ('${type}-upload:' || NEW.id, 'upload',
+        COALESCE(NEW.uploaded_by_login, (SELECT login FROM managed_user WHERE id = NEW.uploaded_by)),
+        ${uploadAction(type, 'NEW')}, (SELECT full_name FROM managed_selected_repo WHERE repo_id = NEW.repo_id),
+        ${type === 'report' ? 'NEW.id' : 'NULL'}, NEW.filename, NEW.uploaded_at,
+        ${type === 'bundle' ? 'NEW.id' : 'NULL'}, NEW.uploaded_by);
+      RETURN NEW;
+    END $$;`)
+  if (createTrigger) {
+    await db.query(`CREATE TRIGGER managed_${type}_activity AFTER INSERT ON managed_${type}
+      FOR EACH ROW EXECUTE FUNCTION managed_${type}_activity_insert();`)
+  }
+}
+
+function requestConnections(connect: PgConnect) {
+  const requests = new AsyncLocalStorage<{ connection?: PgConnection; queue: Promise<unknown>; ended: boolean }>()
+  async function withConnection<T>(work: (db: PgConnection) => Promise<T>): Promise<T> {
+    const request = requests.getStore()
+    if (!request || request.ended) {
+      const connection = await connect()
+      let result: T
+      try { result = await work(connection) }
+      catch (error) { await connection.release().catch(() => {}); throw error }
+      await connection.release()
+      return result
+    }
+    // Serialize transactions on the leased connection, never interleave BEGINs
+    // from concurrent Blob/catalog tasks. Remote Blob reads remain concurrent.
+    const result = request.queue.then(async () => {
+      const connection = request.connection ??= await connect()
+      try { return await work(connection) }
+      catch (error) {
+        delete request.connection
+        await connection.release().catch(() => {})
+        throw error
+      }
+    })
+    request.queue = result.catch(() => {})
+    return result
+  }
+  async function withRequest<T>(work: () => Promise<T>): Promise<T> {
+    if (requests.getStore()) return work()
+    const request: { connection?: PgConnection; queue: Promise<unknown>; ended: boolean } = { queue: Promise.resolve(), ended: false }
+    let failed = false
+    try { return await requests.run(request, work) }
+    catch (error) { failed = true; throw error }
+    finally {
+      request.ended = true
+      await request.queue
+      if (failed) await request.connection?.release().catch(() => {})
+      else await request.connection?.release()
+    }
+  }
+  return { withConnection, withRequest }
+}
+
+// Exposed for parity tests against real PostgreSQL semantics via PGlite.
+export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
+  const initial = await connect()
+  try { await initialize(initial) } finally { await initial.release() }
+  const { withConnection, withRequest } = requestConnections(connect)
+  const context = new AsyncLocalStorage<PgConnection>()
+  let closed = false
+  const driver: ManagedSqlDriver = {
+    prepare(source) {
+      const { sql, names } = postgresSql(source)
+      async function query(args: unknown[]) {
+        const db = context.getStore()
+        if (!db) throw new Error('Managed query outside transaction')
+        const values = names.length > 0 ? names.map(name => (args[0] as Record<string, unknown>)[name])
+          : args.length === 1 && typeof args[0] === 'object' && args[0] !== null ? [] : args
+        const result = await db.query(sql, values)
+        // Postgres int8 is returned as text by node-postgres/Neon. All store
+        // numbers are JS safe integers (timestamps, IDs, sizes and sequences).
+        for (const field of result.fields ?? []) {
+          if (field.dataTypeID !== 20) continue
+          for (const row of result.rows) {
+            if (row[field.name] == null) continue
+            const value = Number(row[field.name])
+            if (!Number.isSafeInteger(value)) throw new Error('Managed integer exceeds safe range')
+            row[field.name] = value
+          }
+        }
+        return result
+      }
+      return {
+        get: async (...args) => (await query(args)).rows[0],
+        all: async (...args) => (await query(args)).rows,
+        run: async (...args) => ({ changes: (await query(args)).rowCount ?? 0 }),
+      }
+    },
+    async scope(write, work, { lock = write, statement = false } = {}) {
+      if (closed) throw new Error('Managed database is closed')
+      let committed = false
+      try { return await withConnection(async db => {
+        if (statement) return context.run(db, work)
+        let commitAttempted = false
+        try {
+          await db.query(write ? 'BEGIN' : 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
+          if (lock) await db.query(LOCK)
+          const result = await context.run(db, work)
+          commitAttempted = true
+          await db.query('COMMIT')
+          committed = true
+          return result
+        } catch (err) {
+          await db.query('ROLLBACK').catch(() => {})
+          if (write && commitAttempted) throw new Error('Managed commit outcome is uncertain', { cause: err })
+          throw err
+        }
+      }) } catch (error) {
+        if (write && committed) throw new Error('Managed commit outcome is uncertain', { cause: error })
+        throw error
+      }
+    },
+    close() { closed = true },
+  }
+  const methods = scopeManagedMethods(createManagedMethods(driver, options), driver)
+  if (reuseConnections) methods.withRequest = withRequest
+  return methods
+}
+
+export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}): Promise<ManagedDb> {
+  // Reuse the e2e optional-driver boundary. Requests lease one connection and
+  // close it before returning; no socket must survive a frozen invocation.
+  const { Client, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
+    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query']; on?(event: 'error', listener: (error: Error) => void): void }
+    neonConfig: { webSocketConstructor: typeof WebSocket }
+  }
+  neonConfig.webSocketConstructor = WebSocket
+  return openPostgresManagedDb(async () => {
+    const client = new Client(url)
+    // A remote disconnect between operations must reject the next query, not
+    // become an unhandled EventEmitter error while the request is reading Blob.
+    client.on?.('error', () => {})
+    try { await client.connect() } catch (err) { await client.end().catch(() => {}); throw err }
+    return { query: (sql, params) => client.query(sql, params), release: () => client.end() }
+  }, options, true)
+}

package/server-managed/db-schema.ts

@@ -0,0 +1,227 @@
+import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { LINK_REPORT_SCHEMA } from './link-reports.ts'
+import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
+import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
+import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+
+// Created after the column migration, which predates it on older databases.
+export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
+
+export const MANAGED_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_user (
+  id             TEXT PRIMARY KEY,
+  github_user_id INTEGER NOT NULL UNIQUE,
+  login          TEXT NOT NULL,
+  name           TEXT,
+  avatar_url     TEXT,
+  role           TEXT NOT NULL DEFAULT 'none',
+  -- GitHub user-to-server token, persisted so the repositories page can list
+  -- the user's repos (GET /user/repos) on demand. Refresh token + expiry are
+  -- null for non-expiring tokens (GitHub App with expiring tokens disabled).
+  gh_access_token      TEXT,
+  gh_refresh_token     TEXT,
+  gh_token_expires_at  INTEGER,
+  created_at     INTEGER NOT NULL,
+  updated_at     INTEGER NOT NULL,
+  -- Presence is independent of admin edits and background token refreshes.
+  -- NULL for legacy accounts until a known session authenticates them.
+  last_seen_at   INTEGER
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS managed_session (
+  id         TEXT PRIMARY KEY,
+  user_id    TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
+  csrf_token TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  -- Private X25519 JWK that this session's uploads are sealed to (see
+  -- common/managed/upload-seal.ts). Created on first use.
+  upload_key TEXT,
+  -- An administrator's read-only view as user_id: the admin's own session,
+  -- which must stay valid. Ending that session ends the view.
+  viewer_session TEXT REFERENCES managed_session(id) ON DELETE CASCADE
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_session_user_idx ON managed_session(user_id);
+CREATE INDEX IF NOT EXISTS managed_session_expires_idx ON managed_session(expires_at);
+
+-- Repositories selected to operate on. Keyed by GitHub's numeric repo id
+-- (stable across renames). The row carries everything needed to read the repo's
+-- contents server-side later: installation_id mints an App installation token
+-- (Contents: Read) for PRIVATE repos — NULL means a PUBLIC repo readable without
+-- the App — and full_name + default_branch locate the contents. added_by is the
+-- selector, nulled (not cascaded) if that user is removed so the selection
+-- survives.
+CREATE TABLE IF NOT EXISTS managed_selected_repo (
+  repo_id         INTEGER PRIMARY KEY,
+  full_name       TEXT NOT NULL,
+  is_private      INTEGER NOT NULL,
+  installation_id INTEGER,
+  default_branch  TEXT NOT NULL,
+  -- Live browser hint; independent of the default discovered at selection.
+  cached_default_branch TEXT,
+  html_url        TEXT NOT NULL,
+  added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  added_at        INTEGER NOT NULL,
+  updated_at      INTEGER NOT NULL,
+  active          INTEGER NOT NULL DEFAULT 1
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS selected_repo_full_name_idx ON managed_selected_repo(full_name);
+
+-- Bundles uploaded to the server (the "Manage bundles" page). Like reports, the
+-- bytes are stored in the clear (blob-store, keyed by this opaque uuid id) for
+-- the server to operate on. integrity is the content hash (sha512-<base64>,
+-- byte-identical to the client's) so re-uploading the same bytes dedupes (UNIQUE);
+-- it is also the key a report's bundleHashes match to auto-link.
+-- uploaded_by / repo_id are the (nullable) user + repo links, both nulled (not
+-- cascaded) when the referenced user / selected repo goes away.
+CREATE TABLE IF NOT EXISTS managed_bundle (
+  id           TEXT PRIMARY KEY,
+  slug         TEXT NOT NULL,
+  integrity    TEXT NOT NULL UNIQUE,
+  filename     TEXT NOT NULL,
+  kind         TEXT,
+  byte_size    INTEGER NOT NULL,
+  uploaded_by  TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  -- Durable snapshot of the uploader's login at upload time, so "who uploaded
+  -- this" survives the uploader being removed (when uploaded_by nulls out).
+  uploaded_by_login TEXT,
+  repo_id      INTEGER REFERENCES managed_selected_repo(repo_id) ON DELETE SET NULL,
+  repo_directory  TEXT NOT NULL DEFAULT '',
+  visible      INTEGER NOT NULL DEFAULT 1,
+  uploaded_at  INTEGER NOT NULL,
+  -- 'upload' or 'build' (generated on this server). A server build of bytes
+  -- already stored promotes the row to 'build'; NULL predates the column.
+  provenance   TEXT,
+  -- JSON {preset, conditions, platforms} of a JS/TS server build; NULL otherwise.
+  build_conditions TEXT
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_bundle_uploaded_at_idx ON managed_bundle(uploaded_at);
+
+-- Reports uploaded to the server (the "Manage reports" page). A managed server
+-- is TRUSTED, so the bytes are stored in the clear (blob-store, keyed by this
+-- opaque uuid id) for the server to operate on later; this row carries the
+-- metadata + attribution. uploaded_by / repo_id are the (nullable) user + repo
+-- links, nulled (not cascaded) when the user / selected repo goes away. bundle_id
+-- is the (nullable) auto-resolved link to a stored bundle; bundle_integrity is
+-- the report's declared primary bundle (from its bundleHashes), kept so a later
+-- bundle upload of that integrity can re-link.
+CREATE TABLE IF NOT EXISTS managed_report (
+  id               TEXT PRIMARY KEY,
+  slug             TEXT NOT NULL,
+  filename         TEXT NOT NULL,
+  content_type     TEXT NOT NULL,
+  byte_size        INTEGER NOT NULL,
+  sha256           TEXT NOT NULL,
+  uploaded_by      TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  -- Durable snapshot of the uploader's login (see managed_bundle).
+  uploaded_by_login TEXT,
+  repo_id          INTEGER REFERENCES managed_selected_repo(repo_id) ON DELETE SET NULL,
+  repo_directory   TEXT NOT NULL DEFAULT '',
+  repo_embedded    INTEGER NOT NULL DEFAULT 0,
+  analyzer         TEXT,
+  visible          INTEGER NOT NULL DEFAULT 0,
+  bundle_id        TEXT REFERENCES managed_bundle(id) ON DELETE SET NULL,
+  bundle_integrity TEXT,
+  uploaded_at      INTEGER NOT NULL
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS managed_report_uploaded_at_idx ON managed_report(uploaded_at);
+CREATE INDEX IF NOT EXISTS managed_report_hash_idx ON managed_report(sha256, uploaded_at, id);
+CREATE INDEX IF NOT EXISTS managed_report_bundle_integrity_idx ON managed_report(bundle_integrity);
+CREATE INDEX IF NOT EXISTS managed_report_bundle_hash_idx ON managed_report(bundle_id, sha256);
+
+-- Per-finding triage annotations — the managed (trusted-plaintext) counterpart
+-- of the client's localStorage triage map, keyed the same way: by finding id
+-- alone, not by report. Reports mostly repeat one another (a re-scan of the
+-- same code carries the same finding ids) and a finding's triage is shared by
+-- every report that carries it; which ids a viewer may read or write is
+-- decided per report at the endpoint, not here. The wire shape lives in
+-- common/managed/triage.ts. Whole-entry replace, NULL columns are unset;
+-- flagged is tri-state: NULL unset / 1 flagged / 0 an explicit un-flag
+-- tombstone. A cleared entry keeps its row with every field NULL — a
+-- tombstone a reader adopts as "cleared", where a missing row means "never
+-- annotated" (so a stale client copy can't resurrect a teammate's clear).
+-- updated_by is the last writer (nulled when that user is removed);
+-- updated_by_login is the durable login snapshot (see managed_bundle).
+CREATE TABLE IF NOT EXISTS managed_finding_triage (
+  finding_id       TEXT PRIMARY KEY,
+  color            TEXT,
+  triage           TEXT,
+  comment          TEXT,
+  fix              TEXT,
+  flagged          INTEGER,
+  updated_by       TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  updated_by_login TEXT,
+  updated_at       INTEGER NOT NULL
+) STRICT;
+
+-- The trail behind managed_finding_triage: one row per write that CHANGED an entry,
+-- holding the entry as written (every field NULL = a clear), who wrote it and
+-- when. managed_finding_triage stays the current-state projection reads hit; this is
+-- walked only for a finding's history. The wire is whole-entry replace, so a
+-- snapshot per write is exactly what arrived and "what changed" is the diff
+-- against the previous row for the same id, computed on read. batch_id groups
+-- the rows of one request. seq is the rowid: a total order that breaks ties
+-- on at. actor_id / actor_login follow the uploaded_by / uploaded_by_login
+-- convention (live account, durable login snapshot). Everything is kept by
+-- default — the trail is the record; an operator may bound it per finding
+-- (TRIAGE_HISTORY_LIMIT), in which case a finding's older events are trimmed
+-- as new ones land. An id no report carries any more is the tombstone GC's
+-- concern.
+CREATE TABLE IF NOT EXISTS managed_finding_triage_event (
+  seq          INTEGER PRIMARY KEY,
+  finding_id   TEXT NOT NULL,
+  batch_id     TEXT NOT NULL,
+  color        TEXT,
+  triage       TEXT,
+  comment      TEXT,
+  fix          TEXT,
+  flagged      INTEGER,
+  actor_id     TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  actor_login  TEXT,
+  at           INTEGER NOT NULL
+) STRICT;
+CREATE INDEX IF NOT EXISTS finding_triage_event_finding_idx ON managed_finding_triage_event(finding_id, seq);
+CREATE INDEX IF NOT EXISTS finding_triage_event_actor_at_idx ON managed_finding_triage_event(actor_id, at);
+
+-- Teams group users + repos for access scoping. Hidden teams grant no access;
+-- the two link tables below carry the many-many relations.
+CREATE TABLE IF NOT EXISTS managed_team (
+  id          TEXT PRIMARY KEY,
+  slug        TEXT NOT NULL,
+  name        TEXT NOT NULL UNIQUE,
+  hidden      INTEGER NOT NULL DEFAULT 0,
+  dependency_review INTEGER NOT NULL DEFAULT 0,
+  created_at  INTEGER NOT NULL,
+  updated_at  INTEGER NOT NULL
+) STRICT;
+
+-- Team <-> repo, many-many, with an OPTIONAL path (a subpath of the repo the
+-- team is scoped to; empty path = the whole repo). Distinct paths can coexist;
+-- adding the whole repo replaces them. CASCADE removes links with either side. repo_id
+-- references the selected (operate-on) repos.
+CREATE TABLE IF NOT EXISTS managed_team_repo (
+  team_id  TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  repo_id  INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  path     TEXT NOT NULL DEFAULT '',
+  PRIMARY KEY (team_id, repo_id, path)
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS team_repo_repo_idx ON managed_team_repo(repo_id);
+
+-- Team <-> user, many-many, with per-membership visibility permissions (see
+-- common/managed/permissions.ts) — view_dependencies / view_security, both
+-- default 0 (off). CASCADE so the membership dies with either side.
+CREATE TABLE IF NOT EXISTS managed_team_user (
+  team_id           TEXT NOT NULL REFERENCES managed_team(id) ON DELETE CASCADE,
+  user_id           TEXT NOT NULL REFERENCES managed_user(id) ON DELETE CASCADE,
+  view_dependencies INTEGER NOT NULL DEFAULT 0,
+  view_security     INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (team_id, user_id)
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA

package/server-managed/db-table-names.ts

@@ -0,0 +1,22 @@
+// Table identifiers are code constants. Renames retain rows and foreign keys;
+// an ambiguous old/new pair must be resolved before the server can start.
+const MANAGED_TABLE_RENAMES = [
+  ['selected_repo', 'managed_selected_repo'],
+  ['team_repo', 'managed_team_repo'],
+  ['team_user', 'managed_team_user'],
+  ['finding_triage', 'managed_finding_triage'],
+  ['finding_triage_event', 'managed_finding_triage_event'],
+  ['finding_comment', 'managed_finding_comment'],
+  ['finding_comment_event', 'managed_finding_comment_event'],
+] as const
+
+export function managedTableRenames(tables: Set<string>) {
+  // A fresh installation must not claim similarly named unrelated tables in
+  // a shared database. managed_user anchors an existing managed installation.
+  if (!tables.has('managed_user')) return []
+  const renames = MANAGED_TABLE_RENAMES.filter(([from]) => tables.has(from))
+  for (const [from, to] of renames) {
+    if (tables.has(to)) throw new Error(`Cannot migrate managed tables: both ${from} and ${to} exist`)
+  }
+  return renames
+}