@preventive/triage 1.0.0-alpha.46 → 1.0.0-alpha.47

package/server-managed/npm-risk.ts

@@ -14,8 +14,15 @@
 //   instance, or this one restarted, asks npm's downloads API, which answers
 //   some 40 lookups a minute, none of them again that week, each removed a
 //   day past it (npm-kept.ts pruneKept); a private one's in memory.
-// - `risk/npm/packages`, `risk/npm/public` and `risk/npm/advisories`, kept an
-//   hour or a day by risk itself: in memory.
+// - `risk/npm/packages`, `risk/npm/old-versions`, `risk/npm/public` and
+//   `risk/npm/advisories`, which risk asks again after an hour: a public
+//   package's in memory and in the database too, read from memory first, so
+//   that a cold instance, as a serverless one starts, reads no whole document
+//   of npm's again that one before it read within the hour; by a hash of
+//   their type and key, as a dependency's spec runs to any length, each
+//   removed a day on, and one past 256 KiB as JSON (a package's deprecated
+//   versions, its messages and all, run long) in memory alone. A private
+//   one's in memory.
 // - `npm/tarballs`: none asked, as tarballs are read as the viewer's loads
 //   read them, kept where they keep them (npm-loads.ts loadNpmTarball), and
 //   an assessment kept needs none.
@@ -69,11 +76,20 @@ function remember(key: string, value: unknown) {
   while (memory.size > MEMORY_ENTRIES || memoryLength > MEMORY_LENGTH) forget(memory.keys().next().value!)
 }
 
-const hashed = (type: string, key: string) => `risk/${createHash('sha256').update(`${type}\0${key}`).digest('hex')}`
-// What of a public package is kept in the database, and for how long its
-// downloads are: risk's week, and a day more.
+const digest = (type: string, key: string) => createHash('sha256').update(`${type}\0${key}`).digest('hex')
+const hashed = (type: string, key: string) => `risk/${digest(type, key)}`
+// What of a public package is kept in the database by its key, and for how
+// long its downloads are: risk's week, and a day more.
 const IN_DATABASE = new Set(['risk/npm/versions', 'risk/npm/downloads'])
 const DOWNLOADS_KEPT_MS = 8 * 24 * 60 * 60_000
+// What of a public package risk asks again after an hour, kept in memory and
+// in the database (HOURLY_PREFIX), each a day, none past HOURLY_LENGTH as
+// JSON there.
+const HOURLY = new Set(['risk/npm/packages', 'risk/npm/old-versions', 'risk/npm/public', 'risk/npm/advisories'])
+const HOURLY_PREFIX = 'risk/hourly/'
+const HOURLY_KEPT_MS = 24 * 60 * 60_000
+const HOURLY_LENGTH = 256 * 1024
+const databaseKey = (type: string, key: string) => HOURLY.has(type) ? `${HOURLY_PREFIX}${digest(type, key)}` : `${type}/${key}`
 
 export interface NpmRiskStores {
   db: UpstreamCacheStore
@@ -82,10 +98,13 @@ export interface NpmRiskStores {
 }
 
 // A cache that reads and writes many of a type at once too, as risk's
-// readying of downloads asks (npmReadyDownloads): one read and one write of
-// the database each, not one a key, as a request's queries take turns on its
-// connection (db-neon.ts).
+// readying of downloads asks (npmReadyDownloads), and reads records of any
+// types at once, as risk reads a package's record and its versions'
+// (registry.js npmPackageFacts): one read and one write of the database each,
+// not one a key, as a request's queries take turns on its connection
+// (db-neon.ts).
 export interface NpmRiskCache extends CacheStore {
+  readEach(entries: [type: string, key: string][]): Promise<unknown[]>
   readMany(type: string, keys: string[]): Promise<Map<string, unknown>>
   writeMany(type: string, entries: [key: string, value: unknown][]): Promise<void>
 }
@@ -94,13 +113,32 @@ export interface NpmRiskCache extends CacheStore {
 // that what is kept of it can be shared.
 export function npmRiskCache({ db, npmCache, debug }: NpmRiskStores, isPublic: boolean): NpmRiskCache {
   const warn = (what: string, error: unknown) => { if (debug) console.warn(`managed: risk cache ${what} failed:`, error) }
+  const memoryKey = (type: string, key: string) => `${isPublic ? '' : 'private\0'}${type}\0${key}`
+  // Whether a record of `type` is read of the database: unless it is one
+  // kept in memory too (HOURLY) and there.
+  const ofDatabase = (type: string, key: string) => isPublic && (IN_DATABASE.has(type) || HOURLY.has(type) && !memory.has(memoryKey(type, key)))
+  // A record as the database keeps it, read: an hourly one kept in memory
+  // too, for the next to ask.
+  const readOf = (type: string, key: string, row: string | null | undefined) => {
+    const value: unknown = row == null ? null : JSON.parse(row)
+    if (value !== null && HOURLY.has(type)) remember(memoryKey(type, key), value)
+    return value
+  }
   const cache: NpmRiskCache = {
+    async readEach(entries) {
+      const asked = new Set(entries.flatMap(([type, key], i) => ofDatabase(type, key) ? [i] : []))
+      let rows = new Map<string, string>()
+      if (asked.size > 0) {
+        try { rows = await db.getUpstreamCacheEntries([...asked].map(i => databaseKey(...entries[i]!))) } catch (error) { warn('read', error) }
+      }
+      return Promise.all(entries.map(([type, key], i) => {
+        if (!asked.has(i)) return cache.read(type, key)
+        try { return readOf(type, key, rows.get(databaseKey(type, key))) } catch (error) { warn('read', error); return null }
+      }))
+    },
     async readMany(type, keys) {
-      if (!isPublic || !IN_DATABASE.has(type)) return new Map(await Promise.all(keys.map(async key => [key, await cache.read(type, key)] as const)))
-      try {
-        const found = await db.getUpstreamCacheEntries(keys.map(key => `${type}/${key}`))
-        return new Map(keys.map(key => { const value = found.get(`${type}/${key}`); return [key, value === undefined ? null : JSON.parse(value)] }))
-      } catch (error) { warn('read', error); return new Map() }
+      const values = await cache.readEach(keys.map(key => [type, key]))
+      return new Map(keys.map((key, i) => [key, values[i]]))
     },
     async writeMany(type, entries) {
       if (!isPublic || !IN_DATABASE.has(type)) { for (const [key, value] of entries) await cache.write(type, key, value); return }
@@ -112,22 +150,31 @@ export function npmRiskCache({ db, npmCache, debug }: NpmRiskStores, isPublic: b
       if (type === 'npm/tarballs') return null
       try {
         if (isPublic && type === 'risk/npm/assessments' && npmCache) return JSON.parse((await buffer((await npmCache.open(hashed(type, key))).stream)).toString('utf8'))
-        if (isPublic && IN_DATABASE.has(type)) { const value = await db.getUpstreamCacheEntry(`${type}/${key}`); return value === null ? null : JSON.parse(value) }
+        if (ofDatabase(type, key)) return readOf(type, key, await db.getUpstreamCacheEntry(databaseKey(type, key)))
       } catch (error) { if (!(error instanceof CacheMissError)) warn('read', error); return null }
-      return memory.get(`${isPublic ? '' : 'private\0'}${type}\0${key}`)?.value ?? null
+      return memory.get(memoryKey(type, key))?.value ?? null
     },
     async write(type, key, value) {
       if (type === 'npm/tarballs') return
+      if (isPublic && HOURLY.has(type)) remember(memoryKey(type, key), value)
       try {
         if (isPublic && type === 'risk/npm/assessments' && npmCache) { await npmCache.put(hashed(type, key), Buffer.from(JSON.stringify(value))); return }
         if (isPublic && IN_DATABASE.has(type)) {
           const at = Date.now()
-          await db.setUpstreamCacheEntry(`${type}/${key}`, JSON.stringify(value), at)
+          await db.setUpstreamCacheEntry(databaseKey(type, key), JSON.stringify(value), at)
           if (type === 'risk/npm/downloads') await pruneKept(db, `${type}/`, DOWNLOADS_KEPT_MS, at, error => { warn('prune', error) })
           return
         }
+        if (isPublic && HOURLY.has(type)) {
+          const json = JSON.stringify(value)
+          if (json.length > HOURLY_LENGTH) return
+          const at = Date.now()
+          await db.setUpstreamCacheEntry(databaseKey(type, key), json, at)
+          await pruneKept(db, HOURLY_PREFIX, HOURLY_KEPT_MS, at, error => { warn('prune', error) })
+          return
+        }
       } catch (error) { warn('write', error); return }
-      remember(`${isPublic ? '' : 'private\0'}${type}\0${key}`, value)
+      remember(memoryKey(type, key), value)
     },
   }
   return cache

package/server-managed/pretty-print.ts

@@ -45,6 +45,10 @@ const MAX_KEPT_DETAILS_BYTES = 256 * 1024 * 1024
 // Files hashed at once: one at a time, each waits its own round trip to the
 // thread pool; all at once, every one's job is held together.
 const HASHES_AT_ONCE = 32
+// Kept copies a stream reads ahead of the line it is sending (readAhead):
+// one at a time, each waits its own storage round trip; each read whole, as
+// its line will send it.
+const KEPT_AHEAD = 8
 
 export class PrettyError extends Error {
   status: number
@@ -166,6 +170,29 @@ async function prettyLine({ path, hash }: PrettyRequest, copy: () => Promise<Ope
   }
 }
 
+// A file's line from its kept copy, `open` opening it, or null where none is
+// kept.
+async function keptLine(request: PrettyRequest, open: () => Promise<OpenedBlob | null>): Promise<PrettyLine | null> {
+  const copy = await open()
+  return copy && prettyLine(request, () => Promise.resolve(copy))
+}
+
+// Each of `items` with what `read` reads of it, in their order, up to
+// KEPT_AHEAD of them read at once ahead of the one iterated, each answered
+// (or failing) in its turn. One iterated no further starts no more; those
+// under way settle unread.
+async function* readAhead<T, R>(items: readonly T[], read: (item: T) => Promise<R>): AsyncGenerator<[T, R]> {
+  const reads: Promise<R>[] = []
+  for (const [i, item] of items.entries()) {
+    while (reads.length < Math.min(items.length, i + KEPT_AHEAD)) {
+      const reading = read(items[reads.length]!)
+      reading.catch(() => {})
+      reads.push(reading)
+    }
+    yield [item, await reads[i]!]
+  }
+}
+
 // The files that changed between two sides, pretty-printed: each side's
 // formattable files the other has another text at the path of, or, where it
 // has none there, none of their text at a path of its own (a file renamed, or
@@ -174,8 +201,9 @@ async function prettyLine({ path, hash }: PrettyRequest, copy: () => Promise<Ope
 // the viewer diffs but where it pairs files otherwise (among copies of one
 // text, across packages), whose copies it asks for alone. As they are
 // iterated, in path order, the base's first where both have one: those kept,
-// at once; then the rest, formatted one after another, the minified before
-// the others (needsPrettyPrint), as the viewer prints those unasked.
+// at once, a few read ahead (readAhead); then the rest, formatted one after
+// another, the minified before the others (needsPrettyPrint), as the viewer
+// prints those unasked.
 export function compared(sides: readonly [ComparedSide, ComparedSide]): AsyncGenerator<ComparedLine> {
   // Each side's texts at the paths the other hasn't: where a file moved has its own.
   const moved = sides.map((own, i) => new Set([...own.hashes].filter(([path]) => !sides[1 - i]!.hashes.has(path)).map(([, hash]) => hash)))
@@ -185,9 +213,8 @@ export function compared(sides: readonly [ComparedSide, ComparedSide]): AsyncGen
   }).toSorted((a, b) => (a.file.path < b.file.path ? -1 : a.file.path > b.file.path ? 1 : 0))
   return (async function* () {
     const unkept: typeof changed = []
-    for (const { own, file } of changed) {
-      const copy = await own.kept(file)
-      if (copy) yield { side: own.side, ...await prettyLine(file, () => Promise.resolve(copy)) }
+    for await (const [{ own, file }, line] of readAhead(changed, item => keptLine(item.file, () => item.own.kept(item.file)))) {
+      if (line) yield { side: own.side, ...line }
       else unkept.push({ own, file })
     }
     const minified = new Map(unkept.map(({ file }) => [file, needsPrettyPrint(file.path, file.text)]))
@@ -325,15 +352,18 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
       return body
     })
   }
+  // The copy kept for a public version's file, or null where none is (and
+  // for a private version's, which none is kept for).
+  const npmKept = (doc: NpmVersionDocument, request: PrettyRequest) => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request))))
   // A version's file pretty-printed, `read` reading its text (and checking
   // it is the file named): from the copy kept for a public version, else
   // made, and kept for a public one.
   async function npmCopy(doc: NpmVersionDocument, request: PrettyRequest, read: () => Promise<string>): Promise<OpenedBlob> {
+    return await npmKept(doc, request) ?? npmMade(doc, request, read)
+  }
+  // The file pretty-printed from the text `read` reads, kept for a public version.
+  async function npmMade(doc: NpmVersionDocument, request: PrettyRequest, read: () => Promise<string>): Promise<OpenedBlob> {
     const file = prettyFile(request)
-    if (!doc.private) {
-      try { return await npm.open(file) }
-      catch (err) { if (!(err instanceof CacheMissError)) throw err }
-    }
     return opened(await shared(doc.private ? `npm ${doc.dist.integrity} ${file}` : `npm ${file}`, async () => {
       const body = await prettyBody(await read(), request.extension)
       if (!doc.private) await keep(() => npm.put(file, body))
@@ -369,11 +399,14 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     },
     // Every file of the version that needs pretty-printing (npmPrintable),
     // read before this resolves; then, as they are iterated, each
-    // pretty-printed as `npm` has it, one after another.
+    // pretty-printed as `npm` has it, one after another, those kept a few
+    // read ahead (readAhead).
     async npmAll(doc: NpmVersionDocument): Promise<AsyncGenerator<PrettyLine>> {
       const files = await npmPrintable(doc)
       return (async function* () {
-        for (const { text, ...request } of files) yield await prettyLine(request, () => npmCopy(doc, request, () => Promise.resolve(text)))
+        for await (const [file, line] of readAhead(files, request => keptLine(request, () => npmKept(doc, request)))) {
+          yield line ?? await prettyLine(file, () => npmMade(doc, file, () => Promise.resolve(file.text)))
+        }
       })()
     },
     // Two bundles' sides, or two versions', as a comparison reads them, read
@@ -392,7 +425,7 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     npmSides(base: NpmVersionDocument, other: NpmVersionDocument): Promise<[ComparedSide, ComparedSide]> {
       const sideOf = async (doc: NpmVersionDocument, side: Side): Promise<ComparedSide> => ({ side, ...await sideFiles(await npmFiles(doc), (_, bytes) => npmFileHash(bytes)),
         packageDirs: null,
-        kept: request => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request)))),
+        kept: request => npmKept(doc, request),
         made: (request, text) => npmCopy(doc, request, () => Promise.resolve(text)) })
       return Promise.all([sideOf(base, 'base'), sideOf(other, 'other')])
     },

package/server-managed/report-store.ts

@@ -32,9 +32,7 @@ export function createReportStore(legacy: BlobStore, compressed: BlobStore,
     if (compressedOnly.size >= COMPRESSED_ONLY_MAX) compressedOnly.delete(compressedOnly.values().next().value!)
     compressedOnly.add(id)
   }
-  async function openCompressed(id: string): Promise<OpenedBlob | null> {
-    const stored = await compressed.open(id)
-    if (!stored) return null
+  function decoded(stored: OpenedBlob): OpenedBlob {
     const stream = createBrotliDecompress()
     // pipeline carries storage/authentication errors into the decoded stream
     // and closes the stored source when a reader leaves before EOF.
@@ -43,22 +41,29 @@ export function createReportStore(legacy: BlobStore, compressed: BlobStore,
   }
   async function open(id: string): Promise<OpenedBlob | null> {
     if (compressedOnly.has(id)) {
-      const stored = await openCompressed(id)
-      if (stored) return stored
+      const stored = await compressed.open(id)
+      if (stored) return decoded(stored)
       compressedOnly.delete(id)
     }
     // Keep the original available until conversion succeeds. Concurrent reads
     // can finish using an already-open stream while another reader converts it.
-    const original = await legacy.open(id)
-    if (original) {
-      const bytes = await readBytes(original)
+    // Both copies are asked for at once, the original answering where it is
+    // still there: one round trip of storage for a report not known yet, as
+    // a cold instance knows none.
+    const [original, stored] = await Promise.allSettled([legacy.open(id), compressed.open(id)])
+    const unused = (copy: PromiseSettledResult<OpenedBlob | null>) => { if (copy.status === 'fulfilled') copy.value?.stream.destroy() }
+    if (original.status === 'rejected') { unused(stored); throw original.reason }
+    if (original.value) {
+      unused(stored)
+      const bytes = await readBytes(original.value)
       await replaceLegacy(id, await encodeBrotli(bytes, 9))
       remember(id)
       return { size: bytes.length, stream: Readable.from([bytes]) }
     }
-    const stored = await openCompressed(id)
-    if (stored) remember(id)
-    return stored
+    if (stored.status === 'rejected') throw stored.reason
+    if (!stored.value) return null
+    remember(id)
+    return decoded(stored.value)
   }
   return {
     async put(id, bytes) {

package/server-managed/repository-agents.ts

@@ -175,7 +175,7 @@ async function agentBranches(owner: string, name: string, prefix: string, token:
 // What its answers are kept by, with their cursors (http.ts
 // handleRepositoryAgents): bumped as what a page reads, or how it tells an
 // agent, changes, so that no answer an older server kept is sent for a day.
-export const AGENTS_READ_VERSION = 5
+export const AGENTS_READ_VERSION = 6
 
 // A cursor of the default branch's commits: GitHub names one by a commit
 // and how many on from it, `<oid> <offset>`, a space between.

package/server-managed/repository-browser.ts

@@ -272,8 +272,10 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       const manifestPath = path ? `${path}/package.json` : 'package.json'
       const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
         && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
-      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
-      const solidity = await readSolidityEntryPoints(path, data, read)
+      // Both optional suggestions, read together: neither fails, each
+      // answering none where its reads do.
+      const [packageEntryPoints, solidity] = await Promise.all([manifest ? readPackageEntryPoints(manifest.sha, path, read) : undefined,
+        readSolidityEntryPoints(path, data, read)])
       return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
         ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
       }

package/server-managed/repository-code.ts

@@ -7,24 +7,36 @@
 // active ones (npm-loads.ts sharedLoad).
 import { Buffer } from 'node:buffer'
 import { encodeBrotli } from './brotli.ts'
-import { MAX_NPM_PACKAGE_BYTES, MAX_NPM_PACKAGE_FILES, NpmPackageError, npmFileRows } from './npm-packages.ts'
-import { type NpmLoad, readTarballFiles, sharedLoad } from './npm-loads.ts'
+import { MAX_NPM_JSON_LENGTH, NpmPackageError, npmFileRows } from './npm-packages.ts'
+import { type NpmLoad, loadPlaces, readTarballFiles, sharedLoad } from './npm-loads.ts'
 
-// As much as a package may hold: the viewer holds every file in memory.
-export const MAX_REPOSITORY_CODE_FILES = MAX_NPM_PACKAGE_FILES
-export const MAX_REPOSITORY_CODE_BYTES = MAX_NPM_PACKAGE_BYTES
+// What a directory may hold, bounded apart from a package's (npm-packages.ts),
+// as the viewer holds every file in memory: its files' count and bytes.
+export const MAX_REPOSITORY_CODE_FILES = 80_000
+export const MAX_REPOSITORY_CODE_BYTES = 256 * 1024 * 1024
+// The tarball they come in, bounded in proportion as a package's is: its tar
+// stream, headers and padding included, and its entries, as many again as
+// files, as GitHub's has one for each directory too.
+const REPOSITORY_TAR = { maxFiles: MAX_REPOSITORY_CODE_FILES, maxBytes: MAX_REPOSITORY_CODE_BYTES, maxEntries: 2 * MAX_REPOSITORY_CODE_FILES, maxTarBytes: 384 * 1024 * 1024 }
+// What the files may take as the viewer's JSON, written as one string: short
+// of the longest V8 holds (2^29 - 24 characters).
+const MAX_REPOSITORY_CODE_JSON_LENGTH = 384 * 1024 * 1024
 
 // Whether a directory's files fit, by GitHub's listing of its tree and every
 // tree under it (repository-browser.ts repositoryTreeFiles): asked before
 // its tarball is, which may run to hundreds of MiB. One GitHub cut short
 // (null) has too many.
-export function repositoryCodeFits(files: { files: number; bytes: number } | null): boolean {
+export function repositoryCodeFits(files: RepositoryCodeFiles | null): files is RepositoryCodeFiles {
   return files !== null && files.files <= MAX_REPOSITORY_CODE_FILES && files.bytes <= MAX_REPOSITORY_CODE_BYTES
 }
 
+// A directory's files' count and bytes, as GitHub lists its tree.
+export interface RepositoryCodeFiles { files: number; bytes: number }
+
 // The directory read: the repository by its id and name, the commit, the
-// directory (`''` for the root) and its tree's id.
-export interface RepositoryCodeInput { repoId: number; repo: string; commit: string; path: string; tree: string }
+// directory (`''` for the root), its tree's id, and its files as listed,
+// which weigh its load among the active ones.
+export interface RepositoryCodeInput { repoId: number; repo: string; commit: string; path: string; tree: string; listed: RepositoryCodeFiles }
 
 // A package's refusals, as a directory's: past the bounds, or an archive
 // @preventive/archive refuses, as it does one holding a symlink that climbs
@@ -39,14 +51,19 @@ const directoryError = (err: unknown) => {
 // repo, commit, path, tree, files }`, its files as npmFileRows gives them,
 // by their paths in the directory, from `tarball`, the tree's.
 export function loadRepositoryCodeBody(input: RepositoryCodeInput, tarball: () => Promise<Uint8Array>): NpmLoad<Buffer> {
-  const { repoId, repo, commit, path, tree } = input
+  const { repoId, repo, commit, path, tree, listed } = input
+  // Its places among the active loads, by its files as listed, hold their
+  // JSON too, which the listing cannot tell, as escaping may grow a text
+  // sixfold: as much as a package's may take for each.
+  const places = loadPlaces(listed)
+  const maxLength = Math.min(MAX_REPOSITORY_CODE_JSON_LENGTH, places * MAX_NPM_JSON_LENGTH)
   return sharedLoad(`repository ${repoId} ${repo} ${commit} ${path} ${tree}`, async () => {
     let files
     // A symlink may reach the repository's root, as a monorepo package's
     // LICENSE links the root's, and no further: the directory's depth, less
     // the level the archive's root already stands above its top directory.
-    try { files = npmFileRows(await readTarballFiles(await tarball(), { symlinksAbove: path.split('/').length - 1 })) }
+    try { files = npmFileRows(await readTarballFiles(await tarball(), { ...REPOSITORY_TAR, symlinksAbove: path.split('/').length - 1 }), maxLength) }
     catch (err) { throw directoryError(err) }
     return encodeBrotli(Buffer.from(JSON.stringify({ repoId, repo, commit, path, tree, files })))
-  }, 'repository-busy')
+  }, 'repository-busy', { places })
 }

package/server-managed/repository-pulse.ts

@@ -20,7 +20,7 @@ import { ACTOR, type GraphAccount, type HistoryCommit, type HistoryPages, accoun
 export const PULSE_WEEKS = [1, 4, 13, 52]
 // What a year counted from its commits holds, its version: kept years of
 // another are counted again.
-export const PULSE_YEAR_VERSION = 8
+export const PULSE_YEAR_VERSION = 9
 const WEEK_MS = 7 * 24 * 60 * 60_000
 const DAY_MS = 24 * 60 * 60_000
 const MAX_CONTRIBUTORS = 100

package/server-managed/solidity-entry-points.ts

@@ -49,10 +49,12 @@ export async function readSolidityEntryPoints(directory: string, listing: unknow
   for (const entry of entries) {
     if (entry.type === 'file' && sourcePath(entry.path) && addSoliditySuggestion(paths, entry.path)) limited = true
   }
-  for (const root of roots) {
-    if (!sourcePath(`${root.path}/Contract.sol`)) continue
+  // Both roots' listings asked together, then read in order.
+  const listings = roots.map(root => Promise.resolve().then(() => (sourcePath(`${root.path}/Contract.sol`) ? read(`/git/trees/${root.sha}?recursive=1`) : null)))
+  for (const listed of listings) listed.catch(() => {})
+  for (const [i, root] of roots.entries()) {
     try {
-      const data = await read(`/git/trees/${root.sha}?recursive=1`) as { tree?: unknown; truncated?: unknown }
+      const data = await listings[i] as { tree?: unknown; truncated?: unknown } | null
       if (!Array.isArray(data?.tree)) continue
       limited ||= data.truncated === true
       for (const entry of data.tree) {

package/server-managed/sql-postgres.ts

@@ -10,6 +10,9 @@ export function postgresSql(source: string): { sql: string; names: string[] } {
     .replaceAll('INSERT OR IGNORE INTO', 'INSERT INTO')
     .replaceAll('CROSS JOIN', 'JOIN')
     .replaceAll(/\binstr\(/gu, 'strpos(')
+    // Rows gathered as one JSON array value, NULL (not '[]') where none are.
+    .replaceAll(/\bjson_group_array\(/gu, 'json_agg(')
+    .replaceAll(/\bjson_object\(/gu, 'json_build_object(')
   // Quoted literals (including ':') are never placeholders or identifiers.
   sql = sql.split(/('(?:''|[^'])*')/u).map((part, i) => i % 2 ? part : part
     .replaceAll(/\?|(?<!:):([a-zA-Z]\w*)/gu, (_match, name: string | undefined) => {

package/server-managed/sql.ts

@@ -21,8 +21,9 @@ export interface ManagedSqlDriver extends ManagedSql {
 // Lease and cache writes coordinate through their conditional UPSERT/UPDATE alone.
 const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption', 'getTeam', 'getComment',
   'userCanReadReport', 'userCanReadRepo', 'userCanReadRepoPath', 'userCanReadBundle', 'reportPermissionsFor', 'listComments', 'listManagedIssues',
-  'listTriageHistory', 'listUsers', 'listUserOptions', 'listActivityReports', 'getRepoFullName', 'getSessionWithUser', 'getViewSessionWithUser',
+  'listTriageHistory', 'listUsers', 'listUserOptions', 'listActivityReports', 'getRepoFullName', 'getUser', 'getSessionWithUser', 'getViewSessionWithUser',
   'listTriageFixes',
+  'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getUserTokens',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'getFirstUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',

package/server-managed/storage-db.ts

@@ -47,10 +47,18 @@ export function unwrapDataKey(key: StorageKey, type: StorageRowKind, row: Pick<S
   return value
 }
 
+// What storageState reads of managed_storage_encryption, as `alias` names it,
+// for a statement reading it with more (storageStateOf).
+export const storageStateColumns = (alias: string) => `${alias}.test_value AS testValue, ${alias}.enabled_at AS enabledAt,
+  ${alias}.cursor AS cursor, ${alias}.complete AS complete, ${alias}.migrated AS migrated, ${alias}.cleanup_cursor AS cleanupCursor,
+  ${alias}.cleanup_found AS cleanupFound, ${alias}.cleanup_complete AS cleanupComplete`
 export async function storageState(db: ManagedSql, key: StorageKey | null): Promise<StorageEncryptionState | null> {
-  const row = await db.prepare(`SELECT test_value AS testValue, enabled_at AS enabledAt, cursor, complete, migrated,
-    cleanup_cursor AS cleanupCursor, cleanup_found AS cleanupFound, cleanup_complete AS cleanupComplete
-    FROM managed_storage_encryption WHERE id = 1`).get() as (StorageEncryptionState & { testValue: string }) | undefined
+  return storageStateOf(await db.prepare(`SELECT ${storageStateColumns('e')} FROM managed_storage_encryption e WHERE e.id = 1`).get() as StoredState | undefined, key)
+}
+type StoredState = StorageEncryptionState & { testValue: string }
+// The state storageStateColumns read, none where its row is missing, its
+// test value checked against `key`.
+export function storageStateOf(row: StoredState | undefined, key: StorageKey | null): StorageEncryptionState | null {
   if (!row) return null
   if (!key) throw new Error('Managed storage requires its configured encryption key')
   const plain = unwrapStorageValue(key, 'managed_storage_encryption:1', row.testValue)

package/server-managed/storage-encryption.ts

@@ -180,8 +180,10 @@ async function convertStoredReport(raw: RawObjectStorage, db: StorageDb, key: St
 
 // Startup enables encryption before constructing stores; validate the persisted
 // requirement even when this adapter is opened without a key.
-async function storagePolicy(db: StorageDb, key: StorageKey | null) {
-  let enabled = await db.getStorageEncryption()
+// `known` is the state the caller read a moment before, where it found it
+// enabled, so a cold start reads it once.
+async function storagePolicy(db: StorageDb, key: StorageKey | null, known: StorageEncryptionState | null) {
+  let enabled = known ?? await db.getStorageEncryption()
   let checkedAt = Date.now()
   return async (fresh = false) => {
     // Enabled is irreversible. Keyless instances cache "off" briefly, while
@@ -196,8 +198,9 @@ async function storagePolicy(db: StorageDb, key: StorageKey | null) {
   }
 }
 
-export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: StorageDb, key: StorageKey | null): Promise<ObjectStorage> {
-  const mode = await storagePolicy(db, key)
+export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: StorageDb, key: StorageKey | null,
+  known: StorageEncryptionState | null = null): Promise<ObjectStorage> {
+  const mode = await storagePolicy(db, key, known)
   async function open(identity: string): ReturnType<ObjectStorage['open']> {
     logicalKey(identity)
     const state = await mode()

package/server-managed/storage.ts

@@ -31,11 +31,13 @@ export async function openManagedStorage(config: ManagedConfig) {
     const raw = config.neonUrl ? await openVercelObjectStorage(config.blobToken!) : createDiskObjectStorage(dirname(config.dbPath))
     // Enable before exposing stores or token writers. Concurrent first starts
     // serialize activation in the database and validate the winning key.
-    if (key && !await db.getStorageEncryption()) {
+    const enabled = key ? await db.getStorageEncryption() : null
+    if (key && !enabled) {
       if (config.vercelPreview) throw new Error('Storage encryption must be enabled outside a Vercel preview deployment')
       await db.enableStorageEncryption()
     }
-    const objects = await createEncryptedObjectStorage(raw, db, key)
+    // Enabled already: that state, not read again.
+    const objects = await createEncryptedObjectStorage(raw, db, key, enabled)
     const storage = createManagedStores(objects, !config.neonUrl)
     // Move legacy team link uploads into encrypted SQL before serving catalogs.
     // The DB transaction commits first; a failed blob cleanup cannot lose links.

package/server-managed/team-feed.ts

@@ -74,7 +74,9 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
     }
     const catalog = await deps.db.getUserTeamFeedSnapshot(sessionId, Date.now())
     checkUser(catalog)
-    checkUser(await deps.db.getReportAccessSnapshot(sessionId, Date.now(), []))
+    // The session read again after the catalog, as the catalog is published
+    // next: one statement, as the poll's own check is.
+    checkUser(await deps.db.getFeedState(sessionId, Date.now()))
     // Publish catalog state before loading any report blobs. A slow or broken
     // focused report must not hide membership/content changes from the client.
     if (!publish('teams', catalog!.revision)) return

package/server-managed/team-reports.ts

@@ -21,6 +21,11 @@ const VISIBILITY_CACHE_MAX_SNAPSHOTS = 32
 const caches = new WeakMap<ManagedDb, Map<string, Visibility>>()
 const REPORT_CACHE_BYTES = 16 * 1024 * 1024
 const reportCaches = new WeakMap<ManagedDb, Map<string, Buffer>>()
+// A workspace's report reads at once. Its reports' sizes are bounded together
+// before any is read, and each is held parsed till the build ends, so more at
+// once costs only the raw bytes in flight: a cold build of a team's reports
+// is so many storage round trips one after another.
+const WORKSPACE_READS_AT_ONCE = 16
 function retainReports(db: ManagedDb, key: string, bytes: Buffer) {
   if (bytes.length > REPORT_CACHE_BYTES) return
   let cache = reportCaches.get(db)
@@ -93,7 +98,7 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   let inputBytes = 0, next = 0
   // Bound both remote reads and raw buffers, retaining stable report order for
   // the cross-report classification that follows. Finish workers on failure.
-  const results = await Promise.allSettled(Array.from({ length: Math.min(4, snapshot.reports.length) }, async () => {
+  const results = await Promise.allSettled(Array.from({ length: Math.min(WORKSPACE_READS_AT_ONCE, snapshot.reports.length) }, async () => {
     while (next < snapshot.reports.length) {
       const index = next++
       const access = snapshot.reports[index]!

package/server-managed/uploads.ts

@@ -45,25 +45,45 @@ export async function putUploadPart(store: BlobStore, session: string, kind: Upl
   await store.put(partId(session, kind, id, index), bytes)
 }
 
-export async function readUpload(store: BlobStore, req: IncomingMessage, session: string, kind: UploadKind, maxBytes: number): Promise<Buffer> {
+// Parts read at once while an upload is put together.
+const PARTS_READ_AT_ONCE = 6
+
+// The staged upload `req` names, its parts read a few at a time into the one
+// buffer it fills, each as long as its place in it. Its parts are deleted
+// once read, or once it fails: awaited, unless `behind` takes that cleanup to
+// go on past the response (http.ts), which staging maintenance backs up.
+export async function readUpload(store: BlobStore, req: IncomingMessage, session: string, kind: UploadKind, maxBytes: number,
+  behind?: (cleanup: Promise<void>) => void): Promise<Buffer> {
   const id = req.headers['x-upload-id']
   const count = Number(req.headers['x-upload-parts']), size = Number(req.headers['x-upload-size'])
   if (typeof id !== 'string' || !validUpload(id, count)) throw new Error('bad-upload')
   try {
     if (!Number.isSafeInteger(size) || size <= 0 || count !== Math.ceil(size / UPLOAD_CHUNK_BYTES)) throw new Error('bad-upload')
     if (size > maxBytes || size > MAX_STAGED_BYTES) throw new Error('too-large')
-    const parts: Buffer[] = []
-    for (let index = 0; index < count; index++) {
-      const bytes = await store.get(partId(session, kind, id, index))
-      const expected = Math.min(UPLOAD_CHUNK_BYTES, size - index * UPLOAD_CHUNK_BYTES)
-      if (!bytes || bytes.length !== expected) throw new Error('bad-upload')
-      parts.push(bytes)
+    // Every byte of it is written below before it is returned: each part
+    // must fill its place exactly, or the upload fails.
+    const body = Buffer.allocUnsafe(size)
+    let failed = false, next = 0
+    const readParts = async () => {
+      while (!failed && next < count) {
+        const index = next++
+        const bytes = await store.get(partId(session, kind, id, index))
+        const expected = Math.min(UPLOAD_CHUNK_BYTES, size - index * UPLOAD_CHUNK_BYTES)
+        if (!bytes || bytes.length !== expected) { failed = true; throw new Error('bad-upload') }
+        bytes.copy(body, index * UPLOAD_CHUNK_BYTES)
+      }
     }
-    return Buffer.concat(parts, size)
+    // Each read settled before its parts are deleted.
+    const results = await Promise.allSettled(Array.from({ length: Math.min(PARTS_READ_AT_ONCE, count) }, readParts))
+    const rejected = results.find(result => result.status === 'rejected')
+    if (rejected) throw rejected.reason
+    return body
   } finally {
     // These bytes can no longer be finalized. Failed/abandoned chunk uploads
     // are also covered by automatic staging maintenance.
-    await deleteUpload(store, session, kind, id, count).catch(err => console.warn('managed: upload cleanup failed:', err))
+    const cleanup = deleteUpload(store, session, kind, id, count).catch(err => console.warn('managed: upload cleanup failed:', err))
+    if (behind) behind(cleanup)
+    else await cleanup
   }
 }
 

package/out/chunk-4UFAMJAX.js

@@ -1 +0,0 @@
-import{z as e}from"./chunk-S6GIXWQW.js";import{m as t,p as n,u as r}from"./chunk-JKGQ3O7O.js";import{a as i}from"./chunk-3PS4KWD2.js";import{b as a}from"./chunk-IYPY47MC.js";import{D as o,J as s,L as c,q as l}from"./chunk-SXV2T5C4.js";function u(e){let{data:t}=c(e);return t&&d(t)>0?t:null}function d(e){return(s(e)??[]).filter(t=>(Array.isArray(t)?t:[t]).some(t=>t&&typeof t==`object`&&l(t,t.source??e.source))).length}function f(e,t){let n=[],r=new Map;for(let{name:t,content:i,fallbackRepo:a}of e){if(typeof i!=`string`)continue;let e=u(i);if(!e)continue;let c=s(e),l=o(e)??o({repo:{github:a}}),f=new Set(l?[l]:[]);if(!l)for(let e of c.flat()){if(/(?:^|\/)(?:node_modules|dependencies)\//u.test(e?.file??``))continue;let t=o(e);t&&f.add(t)}for(let e of f)r.set(e,{id:e,label:e});n.push({id:t,filename:t,repoIds:[...f],analyzer:e.source,appFindings:d(e)})}let i=new Set(n.map(e=>e.id));return{merge:{bundles:[],results:[]},link:{reports:n,repositories:[...r.values()],workspaces:t.map(e=>({id:e.id,label:e.name,reports:e.reports.filter(e=>i.has(e))})).filter(e=>e.reports.length>0)}}}function p(e,t){let n=(e.reports??[]).filter(e=>e.visible&&e.repoId!=null).flatMap(e=>{let t=u(e.content??``);return t?[{id:e.id,filename:e.filename,repoIds:[e.repoId],repo:e.repoFullName,directory:e.repoDirectory,analyzer:e.analyzer,appFindings:d(t)}]:[]}),r=new Map((e.repos??[]).map(e=>[e.repoId,{id:e.repoId,label:e.fullName}]));for(let e of n)r.has(e.repoIds[0])||r.set(e.repoIds[0],{id:e.repoIds[0],label:e.repo??String(e.repoIds[0])});let a=t.results??[],o=new Set(a.map(e=>e.bundleId));return{merge:{bundles:(t.bundles??[]).filter(e=>o.has(e.id)).map(e=>({...e,size:i(e.byteSize)})),results:a},link:{repositories:[...r.values()].filter(e=>n.some(t=>t.repoIds.includes(e.id))),reports:n}}}var m=new Map([[`openai/gpt-6-astra`,`GPT-6 Astra`],[`openai/gpt-6-astra-pro`,`GPT-6 Astra Pro`],[`openai/gpt-5.6-sol`,`GPT-5.6 Sol`],[`openai/gpt-5.6-terra`,`GPT-5.6 Terra`],[`openai/gpt-5.6-luna`,`GPT-5.6 Luna`],[`anthropic/claude-fable-5.1`,`Claude Fable 5.1`],[`anthropic/claude-opus-5`,`Claude Opus 5`],[`anthropic/claude-sonnet-5`,`Claude Sonnet 5`],[`moonshotai/kimi-k3`,`Kimi K3`],[`z-ai/glm-5.3`,`GLM 5.3`],[`qwen/qwen3.8-max`,`Qwen3.8 Max`],[`deepseek/deepseek-v4.1-flash`,`DeepSeek V4.1 Flash`],[`deepseek/deepseek-v4-pro`,`DeepSeek V4 Pro`]]),h=new Map([[`openai`,`OpenAI`],[`anthropic`,`Anthropic`],[`moonshotai`,`Moonshot AI`],[`google`,`Google`],[`nvidia`,`NVIDIA`],[`qwen`,`Qwen`],[`deepseek`,`DeepSeek`],[`x-ai`,`xAI`],[`z-ai`,`Z.ai`],[`mistralai`,`Mistral AI`],[`meta`,`Meta`],[`unbiased`,`Unbiased`]]),g=new Map([[`meta-llama`,`meta`]]),_=new Map([[`gpt`,`GPT`],[`gptoss`,`GPT OSS`],[`oss`,`OSS`],[`o`,`O`],[`ai`,`AI`],[`api`,`API`],[`4o`,`4o`],[`k3`,`K3`],[`k4`,`K4`],[`qwen`,`Qwen`],[`kimi`,`Kimi`],[`mimo`,`MiMo`],[`gemini`,`Gemini`],[`claude`,`Claude`],[`fable`,`Fable`],[`opus`,`Opus`],[`sonnet`,`Sonnet`],[`astra`,`Astra`],[`terra`,`Terra`],[`luna`,`Luna`],[`codex`,`Codex`],[`deepseek`,`DeepSeek`],[`nemotron`,`Nemotron`],[`gemma`,`Gemma`]]);function v(e){let t=e.replace(/:free$/u,``).replaceAll(`_`,`-`).split(`-`).filter(Boolean),n=[];for(let e=0;e<t.length;e++){let r=t[e],i=t[e+1];if(/^\d+$/u.test(r)&&/^\d+$/u.test(i??``)){n.push(`${r}.${i}`),e++;continue}let a=_.get(r.toLowerCase());n.push(a??(/^(?:[a-z]+\d+|\d+[a-z]+)$/iu.test(r)?r.toUpperCase():r[0]?.toUpperCase()+r.slice(1)))}return n.join(` `).replace(/^GPT (\d)/u,`GPT-$1`)}function y(e){return m.get(e)??v(e.includes(`/`)?e.slice(e.indexOf(`/`)+1):e)}function b(e){let t=e.includes(`/`)?e.split(`/`)[0].replace(/^~/u,``):`other`,n=g.get(t)??t;return{key:n,name:h.get(n)??(n===`other`?`Other`:v(n))}}function x(e){return e===`xhigh`?`Extra high`:e?e[0].toUpperCase()+e.slice(1):`Unavailable`}function S(e){return e.efforts.includes(`max`)?`max`:e.efforts.at(-1)??null}async function C(e,t=fetch){let n=await t(`/api/admin/scan/models`,{credentials:`same-origin`,headers:{accept:`application/json`},signal:e});if(!n.ok)throw Error(`HTTP ${n.status}`);return w(await n.json())}function w(e){if(!Array.isArray(e?.models))throw Error(`No model catalogue returned`);let t=e.models.filter(e=>typeof e?.id==`string`&&e.id.length>0).map(e=>({id:e.id,efforts:Array.isArray(e.efforts)?[...new Set(e.efforts.filter(e=>typeof e==`string`&&e.length>0))]:[]}));if(t.length===0)throw Error(`No models available`);return{models:t,defaultModel:t.find(t=>t.id===e.defaultModel)?.id??t[0].id}}function T(e,t=[]){let n=new Map,r=e.flatMap(e=>{let r=t.filter(t=>t.bundles?.includes(e.integrity));return(r.length>0?r.map(e=>({id:e.id,label:e.name})):[{id:`unattached`,label:`Unattached`}]).map(t=>(n.set(t.id,t),{id:e.integrity,integrity:e.integrity,filename:e.name,repoId:t.id,repo:t.label,files:null,reasons:[],size:`—`}))});return{repositories:[...n.values()],bundles:r,reports:[],scans:[]}}function E(o,s){if(s.error)throw Error(s.error);let c=n(s),l=s.kind===`stasis`?s.bundle?.formats:null,u=r(s),d=[...t(s)].filter(([,e])=>e!=null).map(([e,t])=>({path:e,format:l?.get(e)??null,bytes:t,lines:u.get(e)??0,size:i(t),module:a(e,{packageDir:c?.get(e)})})),f=[{id:`all`,label:`All`,filePaths:null},...[...e(s,d.map(e=>e.path))].map(([e,t])=>({id:`reason:${e}`,label:e,filePaths:[...t]}))];return{...o,files:d,reasons:f,size:i(s.size)}}export{T as a,E as b,f as c,p as d,y as e,b as f,x as g,S as h,C as i,w as j};