@preventive/triage 1.0.0-alpha.47 → 1.0.0-alpha.48

package/server-managed/repository-issues.ts

@@ -6,9 +6,11 @@
 // review and its checks, which GraphQL alone gives, so it needs a token; an
 // open one's, and its popup's, whether it changes a lockfile whose new
 // packages are told (pull-dependencies.ts touchesLockfile), and its reviews
-// (pull-reviews.ts), each reviewer's. A nonpublic repository's are read with
-// its GitHub App's installation, which reads pull requests only with their
-// own permission (README).
+// (pull-reviews.ts), each reviewer's; and an open one's base's and head's
+// commits, kept with its page but never told, by which what its lockfiles
+// add is read (http.ts teamRepositoryDependencies). A nonpublic repository's
+// are read with its GitHub App's installation, which reads pull requests only
+// with their own permission (doc/code-viewer.md).
 import { GithubApiError } from './github-app.ts'
 import { touchesLockfile } from './pull-dependencies.ts'
 import { ACTOR, type GraphAccount, type GraphqlError, actorOf, githubGraphql } from './repository-history.ts'
@@ -16,11 +18,12 @@ import { ITEM_THREADS, type ReviewNode, TILE_THREADS, pullReviews, reviewFields,
 
 export const ISSUES_PAGE = 50
 // What a kept page or item was read as: kept ones read before differ.
-export const ISSUES_READ_VERSION = 3
+export const ISSUES_READ_VERSION = 4
 const MAX_LABELS = 20
 const MAX_TITLE = 1000
 const MAX_NAME = 256
 const COLOR = /^[a-f\d]{6}$/iu
+const SHA = /^[a-f\d]{40}$/u
 // A page's cursor as GitHub gives it, to read on from: opaque, base64 or
 // base64url as it is now (`…rOrK_u7Q==`), passed back to GitHub alone, so any
 // printable one is, but none with spaces or control characters.
@@ -43,21 +46,22 @@ const connection = { issues: 'issues', pulls: 'pullRequests' }
 const states = { issues: { open: '[OPEN]', closed: '[CLOSED]' }, pulls: { open: '[OPEN]', closed: '[CLOSED, MERGED]' } }
 
 // A page of `kind`, those in `state`, after the page `after` ends, and how
-// many of each state there are; open pull requests with their reviews.
+// many of each state there are; open pull requests with their commits and
+// their reviews.
 const pageQuery = (kind: IssuesKind, state: IssuesState) => `query($owner: String!, $name: String!, $after: String) {
   repository(owner: $owner, name: $name) {
     open: ${connection[kind]}(states: ${states[kind].open}) { totalCount }
     closed: ${connection[kind]}(states: ${states[kind].closed}) { totalCount }
     page: ${connection[kind]}(states: ${states[kind][state]}, first: ${ISSUES_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
       pageInfo { hasNextPage endCursor }
-      nodes { ${fields[kind]}${kind === 'pulls' && state === 'open' ? ` ${files} ${reviewFields(TILE_THREADS, false)}` : ''} }
+      nodes { ${fields[kind]}${kind === 'pulls' && state === 'open' ? ` baseRefOid headRefOid ${files} ${reviewFields(TILE_THREADS, false)}` : ''} }
     }
   }
 }`
 
 type Node = ReviewNode & { number?: unknown; title?: unknown; createdAt?: unknown; updatedAt?: unknown; closedAt?: unknown; mergedAt?: unknown; author?: GraphAccount
   comments?: { totalCount?: unknown }; labels?: { totalCount?: unknown; nodes?: { name?: unknown; color?: unknown }[] }; state?: unknown; stateReason?: unknown
-  isDraft?: unknown; reviewDecision?: unknown; additions?: unknown; deletions?: unknown; headRefName?: unknown; baseRefName?: unknown
+  isDraft?: unknown; reviewDecision?: unknown; additions?: unknown; deletions?: unknown; headRefName?: unknown; baseRefName?: unknown; baseRefOid?: unknown
   commits?: { nodes?: { commit?: { statusCheckRollup?: { state?: unknown } | null } | null }[] }
   files?: { totalCount?: unknown; nodes?: ({ path?: unknown } | null)[] } | null }
 type Page = { repository?: { open?: { totalCount?: unknown }; closed?: { totalCount?: unknown }
@@ -159,9 +163,17 @@ export async function repositoryItem(fullName: string, token: string, number: nu
       mergedBy: merger.login, mergedById: merger.id, reviews: pullReviews(node, tile.author, true) }
 }
 
+// An open pull request's base's and head's commits, by its number, as GitHub
+// has them now: those its REST API names `base.sha` and `head.sha`
+// (pull-dependencies.ts pullCommits). None where either isn't a commit's id.
+const commitsOf = (number: number, { baseRefOid: base, headRefOid: head }: Node) =>
+  typeof base === 'string' && SHA.test(base) && typeof head === 'string' && SHA.test(head) ? [{ number, base, head }] : []
+
 // A page of the repository's issues or pull requests in `state`, after the
 // page `after` ended (null for the first): its `items`, how many are open and
-// closed (`counts`), and, where more follow, the cursor reading them (`after`).
+// closed (`counts`), and, where more follow, the cursor reading them
+// (`after`); open pull requests' commits (`commits`, commitsOf) too, which
+// the code viewer is never told (http.ts handleRepositoryIssues).
 export async function repositoryIssues(fullName: string, token: string, kind: IssuesKind, state: IssuesState, after: string | null, fetchImpl: typeof fetch = globalThis.fetch) {
   const [owner, name] = fullName.split('/') as [string, string]
   const data = await githubGraphql(pageQuery(kind, state), { owner, name, after }, token, fetchImpl, partRefused) as Page
@@ -169,13 +181,15 @@ export async function repositoryIssues(fullName: string, token: string, kind: Is
   if (!repository) throw new GithubApiError(404, 'github-not-found')
   const info = repository.page?.pageInfo
   const next = info?.hasNextPage === true && typeof info.endCursor === 'string' && ISSUES_CURSOR.test(info.endCursor) ? info.endCursor : null
+  const open = kind === 'pulls' && state === 'open'
+  const tiles = (repository.page?.nodes ?? []).flatMap(node => {
+    const tile = item(kind, node)
+    return tile && node ? [{ node, tile }] : []
+  })
   return {
-    items: (repository.page?.nodes ?? []).flatMap(node => {
-      const tile = item(kind, node)
-      if (!tile) return []
-      return kind === 'pulls' && state === 'open' && node ? [{ ...tile, reviews: pullReviews(node, tile.author) }] : [tile]
-    }),
+    items: tiles.map(({ node, tile }) => open ? { ...tile, reviews: pullReviews(node, tile.author) } : tile),
     counts: { open: count(repository.open?.totalCount), closed: count(repository.closed?.totalCount) },
     more: next !== null, after: next,
+    ...open ? { commits: tiles.flatMap(({ node, tile }) => commitsOf(tile.number, node)) } : {},
   }
 }

package/server-managed/repository-pulse.ts

@@ -20,7 +20,7 @@ import { ACTOR, type GraphAccount, type HistoryCommit, type HistoryPages, accoun
 export const PULSE_WEEKS = [1, 4, 13, 52]
 // What a year counted from its commits holds, its version: kept years of
 // another are counted again.
-export const PULSE_YEAR_VERSION = 9
+export const PULSE_YEAR_VERSION = 11
 const WEEK_MS = 7 * 24 * 60 * 60_000
 const DAY_MS = 24 * 60 * 60_000
 const MAX_CONTRIBUTORS = 100
@@ -227,15 +227,21 @@ export async function yearCommits(fullName: string, token: string, head: string,
   return { complete: true, commits: [...found.values()].filter(dated), passed: [...found.values()].filter(commit => !dated(commit) && within(commit)) }
 }
 
+// Whether an author is a GitHub App's bot: by its login (`<app>[bot]`, as a
+// commit's no-reply address names it, github-accounts.ts commitAccount),
+// else, for one GitHub names no account for, by the name it commits as.
+const bot = (login: string | null | undefined, name: string | null | undefined) => /\[bot\]$/iu.test(login ?? name ?? '')
+
 // Whether an agent made `commit` or co-authored it: its author one of
 // GitHub's agents (common/managed/github-agents.ts githubAgent), or any of
 // its co-authors an agent (commit-coauthors.ts coauthorsOf), as Commits
-// marks them; or one an agent's pull request brought (`merges`,
+// marks them, or any bot, whichever GitHub App's; or one an agent's pull request brought (`merges`,
 // agent-merges.ts agentCommits); or one an account agents work as pushed to
 // the branch directly (`direct`, github-agents.ts agentOperated).
 const withAgent = (commit: HistoryCommit, merges: ReadonlySet<string>, direct: ReadonlySet<string>) => merges.has(commit.sha)
   || (direct.has(commit.sha) && agentOperated(commit.authorLogin, commit.authorId ?? null))
-  || githubAgent(commit.authorLogin, commit.authorId ?? null, commit.authorName) !== null || (commit.coauthors ?? []).some(coauthor => coauthor.agent)
+  || githubAgent(commit.authorLogin, commit.authorId ?? null, commit.authorName) !== null || bot(commit.authorLogin, commit.authorName)
+  || (commit.coauthors ?? []).some(coauthor => Boolean(coauthor.agent) || bot(coauthor.login, coauthor.name))
 
 // The year from `first` (pulseSince(52, …)) of `commits`, as GitHub's
 // statistics count them, merges left out: a week a row, its commits each day

package/server-managed/repository-squashes.ts

@@ -0,0 +1,145 @@
+// The pull requests squashed into a repository's commits, as the code
+// viewer's Commits tab draws them (repository-history.ts), each looked up
+// with GraphQL once and kept by its commit.
+import { linkNoreplyUsers } from './github-accounts.ts'
+import { type GraphqlError, githubGraphql } from './github-graphql.ts'
+import { COMMIT_FRAGMENT, type GraphCommit, type HistoryCommit, commitActors, graphCommit, inBatches, variablesOf } from './repository-history.ts'
+
+const SHA = /^[a-f\d]{40}$/u
+
+// A pull request squashed into a commit of the default branch's history
+// (`merge`): its number, the commit its head was at when merged (`head`,
+// GitHub's own of it, which a branch reused or pushed over since never
+// moves), and its own commits, the latest MAX_SQUASHED of them, `more`
+// where it had more. Drawn as the merge it was, its commits on a lane of
+// their own (repository-history.js).
+export interface SquashedPull { merge: string; number: number; head: string; commits: HistoryCommit[]; more: boolean }
+// The pull requests squashed into commits, kept by each commit (a merged pull
+// request's commits never change); null for a commit none was.
+export interface Squashes {
+  read(shas: string[]): Promise<Map<string, SquashedPull | null>>
+  write(sha: string, pull: SquashedPull | null): Promise<void>
+}
+
+const MAX_SQUASHED = 100
+// Looked up of an answer's commits not yet kept, at most, the newest first;
+// in queries of as many commits, or pull requests (their commits' lines
+// counted, as a history's are), as many at once.
+export const MAX_SQUASH_LOOKUPS = 500
+const SQUASH_COMMITS = 100
+const SQUASH_PULLS = 5
+const SQUASH_PARALLEL = 4
+
+// The merged pull request that brought each commit in, `c<n>` the `n`th's.
+const mergedPullsQuery = (count: number) => `query($owner: String!, $name: String!, ${variablesOf('o', count, 'GitObjectID!')}) {
+  repository(owner: $owner, name: $name) {
+    ${Array.from({ length: count }, (_, at) => `c${at}: object(oid: $o${at}) { ... on Commit { associatedPullRequests(first: 1) { nodes { number mergeCommit { oid } } } } }`).join('\n    ')}
+  }
+}`
+// Each pull request's head when merged and its latest commits, `p<n>` the `n`th's.
+const squashedQuery = (count: number) => `query($owner: String!, $name: String!, ${variablesOf('n', count, 'Int!')}) {
+  repository(owner: $owner, name: $name) {
+    ${Array.from({ length: count }, (_, at) => `p${at}: pullRequest(number: $n${at}) { headRefOid commits(last: ${MAX_SQUASHED}) { totalCount nodes { commit { ...historyCommit } } } }`).join('\n    ')}
+  }
+}
+${COMMIT_FRAGMENT}`
+
+type MergedPulls = { repository?: Record<string, { associatedPullRequests?: { nodes?: ({ number?: unknown; mergeCommit?: { oid?: unknown } | null } | null)[] } } | null> | null }
+type SquashedPage = { repository?: Record<string, { headRefOid?: unknown; commits?: { totalCount?: unknown; nodes?: ({ commit?: GraphCommit | null } | null)[] } } | null> | null }
+
+// A pull request or commit GitHub has none of, as one deleted: its field null.
+const notFound = (error: GraphqlError) => error?.type === 'NOT_FOUND'
+
+// Each repository's lookup of squashed pull requests going on, by its full
+// name: one at a time, those asking meanwhile waiting on it, and their
+// commits it doesn't look up looked up once it is done.
+const lookingUp = new Map<string, Promise<void>>()
+
+// Whether `promise` settles within `ms`, waited on that long at most.
+const within = (promise: Promise<unknown>, ms: number) => ms === Number.POSITIVE_INFINITY ? promise
+  : new Promise<void>(resolve => {
+    const timer = setTimeout(resolve, ms)
+    void promise.finally(() => { clearTimeout(timer); resolve() })
+  })
+
+// The pull requests squashed into `commits`, a merged pull request's merge
+// commit of one parent, not one rebased (its commits copied onto the branch,
+// told by their subjects), kept by each commit (`squashes`), those not yet
+// kept looked up with GraphQL, as many as MAX_SQUASH_LOOKUPS an answer, each
+// kept as it is found (lookUpSquashes). Answered with those kept once the
+// repository's lookup is done, or `waitMs` on, that lookup going on behind:
+// `behind`, one this started, for the caller to keep alive, and `pending`
+// while one does. Another's lookup done within it, but not of all of these,
+// those it left are looked up as this one's, within what is left of it.
+export async function squashedPulls(fullName: string, token: string, commits: HistoryCommit[], squashes: Squashes,
+  waitMs = Number.POSITIVE_INFINITY, fetchImpl: typeof fetch = globalThis.fetch): Promise<{ pulls: SquashedPull[]; pending: boolean; behind: Promise<void> | null }> {
+  const single = commits.filter(commit => commit.parents.length === 1)
+  const kept = await squashes.read(single.map(commit => commit.sha))
+  let unknown = single.filter(commit => !kept.has(commit.sha))
+  if (unknown.length === 0) return { pulls: single.flatMap(commit => kept.get(commit.sha) ?? []), pending: false, behind: null }
+  const listed = new Map(commits.map(commit => [commit.sha, commit]))
+  const deadline = Date.now() + waitMs
+  const found = new Map<string, SquashedPull | null>()
+  // Waited on, as long as is left, and those of `unknown` it kept found.
+  const settle = async (looking: Promise<void>) => {
+    await within(looking, Math.max(0, deadline - Date.now()))
+    for (const [sha, pull] of await squashes.read(unknown.map(commit => commit.sha))) found.set(sha, pull)
+    unknown = unknown.filter(commit => !found.has(commit.sha))
+  }
+  const another = lookingUp.get(fullName)
+  if (another) await settle(another)
+  let behind: Promise<void> | null = null
+  if (!another || (unknown.length > 0 && !lookingUp.has(fullName))) {
+    const lookup = lookUpSquashes(fullName, token, unknown.slice(0, MAX_SQUASH_LOOKUPS), listed, squashes, fetchImpl)
+    const done: Promise<void> = lookup.catch(() => {}).finally(() => { if (lookingUp.get(fullName) === done) lookingUp.delete(fullName) })
+    lookingUp.set(fullName, done)
+    behind = lookup
+    await settle(done)
+  }
+  return { pulls: single.flatMap(commit => kept.get(commit.sha) ?? found.get(commit.sha) ?? []), pending: lookingUp.has(fullName), behind }
+}
+
+// The pull requests squashed into `unknown`, of the commits `listed`, looked
+// up, each kept as it is found (squashedPulls).
+async function lookUpSquashes(fullName: string, token: string, unknown: HistoryCommit[], listed: Map<string, HistoryCommit>, squashes: Squashes,
+  fetchImpl: typeof fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const merged: { commit: HistoryCommit; number: number }[] = []
+  await inBatches(unknown, SQUASH_COMMITS, SQUASH_PARALLEL, async batch => {
+    const data = await githubGraphql(mergedPullsQuery(batch.length), { owner, name, ...Object.fromEntries(batch.map((commit, at) => [`o${at}`, commit.sha])) },
+      token, fetchImpl, notFound) as MergedPulls
+    for (const [at, commit] of batch.entries()) {
+      const node = data?.repository?.[`c${at}`]
+      if (!node) continue
+      const pull = node.associatedPullRequests?.nodes?.[0]
+      const number = pull?.mergeCommit?.oid === commit.sha && Number.isSafeInteger(pull.number) && (pull.number as number) > 0 ? pull.number as number : null
+      if (number === null) await squashes.write(commit.sha, null)
+      else merged.push({ commit, number })
+    }
+  })
+  await inBatches(merged, SQUASH_PULLS, SQUASH_PARALLEL, async batch => {
+    const data = await githubGraphql(squashedQuery(batch.length), { owner, name, ...Object.fromEntries(batch.map(({ number }, at) => [`n${at}`, number])) },
+      token, fetchImpl, notFound) as SquashedPage
+    await linkNoreplyUsers(Object.values(data?.repository ?? {}).flatMap(pull => (pull?.commits?.nodes ?? []).flatMap(item => commitActors(item?.commit))), token, fetchImpl)
+    for (const [at, { commit, number }] of batch.entries()) {
+      const node = data?.repository?.[`p${at}`]
+      if (!node) continue
+      const own = (node.commits?.nodes ?? []).flatMap(item => graphCommit(item?.commit) ?? [])
+      const head = typeof node.headRefOid === 'string' && SHA.test(node.headRefOid) ? node.headRefOid : own.at(-1)?.sha
+      // Fast-forwarded, its last commit the merge's own; or rebased, its
+      // commits, more than one, copied onto the branch: the merge and those
+      // below it on their first parents, by their subjects, its commits'
+      // (one squashed is told by its commit's title too, by default, and
+      // drawn as it was either way).
+      const below = [commit]
+      for (let next = listed.get(commit.parents[0] ?? ''); next && below.length < own.length; next = listed.get(next.parents[0] ?? '')) below.push(next)
+      const copies = own.toReversed().slice(0, below.length).every((item, step) => below[step]!.subject === item.subject)
+      // Its commits' copies as far as those listed go, but not all of them
+      // listed: told, and kept, once they are.
+      if (own.length > 1 && copies && below.length < own.length) continue
+      const rebased = own.length > 1 && copies
+      const squashed = head !== undefined && head !== commit.sha && own.length > 0 && !own.some(item => item.sha === commit.sha) && !rebased
+      await squashes.write(commit.sha, squashed ? { merge: commit.sha, number, head, commits: own, more: Number(node.commits?.totalCount) > own.length } : null)
+    }
+  })
+}

package/server-managed/request-timing.ts

@@ -0,0 +1,63 @@
+// Where a request's time goes, told back in its Server-Timing header, which
+// DevTools shows beside the request: the database's statements and the time
+// spent in its operations (sql.ts), new pooled connections and their
+// handshakes (db-neon.ts), GitHub's calls (github-app.ts githubJson), and
+// the whole, from the handler's start to its answer's head; an instance's
+// first request marked cold. Counts and durations alone, nothing of what was
+// asked; a streamed answer's head tells what was known as it was written.
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { ServerResponse } from 'node:http'
+
+interface Timing {
+  started: number
+  cold: boolean
+  statements: number
+  db: number; dbMs: number
+  conn: number; connMs: number
+  gh: number; ghMs: number
+}
+const requests = new AsyncLocalStorage<Timing>()
+let served = false
+
+// `work` timed, its response's head carrying what it spent where; a test's
+// stand-in for a response, not a ServerResponse, is left as it is.
+export function runTimed<T>(res: ServerResponse, work: () => T): T {
+  const timing: Timing = { started: performance.now(), cold: !served, statements: 0, db: 0, dbMs: 0, conn: 0, connMs: 0, gh: 0, ghMs: 0 }
+  served = true
+  if (res instanceof ServerResponse) {
+    const writeHead = res.writeHead
+    res.writeHead = function (this: ServerResponse, ...args: Parameters<ServerResponse['writeHead']>) {
+      if (!this.headersSent) this.setHeader('server-timing', header(timing))
+      return writeHead.apply(this, args)
+    } as ServerResponse['writeHead']
+  }
+  return requests.run(timing, work)
+}
+
+// `work`, its time counted as `kind`'s where a request is timed.
+export async function timed<T>(kind: 'db' | 'conn' | 'gh', work: () => Promise<T>): Promise<T> {
+  const timing = requests.getStore()
+  if (!timing) return work()
+  const start = performance.now()
+  try { return await work() } finally {
+    timing[kind]++
+    timing[`${kind}Ms`] += performance.now() - start
+  }
+}
+
+// A statement sent to the database, where a request is timed.
+export function countStatement(): void {
+  const timing = requests.getStore()
+  if (timing) timing.statements++
+}
+
+function header(timing: Timing): string {
+  const ms = (value: number) => value.toFixed(1)
+  return [
+    ...timing.db > 0 || timing.statements > 0 ? [`db;dur=${ms(timing.dbMs)};desc="${timing.statements} statements"`] : [],
+    ...timing.conn > 0 ? [`conn;dur=${ms(timing.connMs)}`] : [],
+    ...timing.gh > 0 ? [`gh;dur=${ms(timing.ghMs)};desc="${timing.gh} calls"`] : [],
+    ...timing.cold ? ['cold;desc="first request of this instance"'] : [],
+    `app;dur=${ms(performance.now() - timing.started)}`,
+  ].join(', ')
+}

package/server-managed/reviewed-dependencies.ts

@@ -64,8 +64,9 @@ export interface CommentReview {
   dependencies: { ecosystem?: 'npm'; name: string; version: string; integrity: string; patchHash?: string; status: ReviewVerdict }[]
 }
 // A version a dependency review is of, or compared it with: its package's
-// name, its version and integrity, and its tarball's shasum and its patch's
-// hash where they are known (a lockfile's, pnpm's patched dependencies').
+// name, its version, the integrity and, where npm tells one, the shasum of
+// its tarball, each held to the tarball reviewed, and its patch's hash where
+// it is known (pnpm's patched dependencies').
 export interface ReviewedVersion { name: string; version: string; integrity: string; shasum?: string; patchHash?: string }
 // One of one's own published dependency reviews, as `formatDependencyReviews`
 // is given it: the version it is of (`new`) and the one it compared it with

package/server-managed/session.ts

@@ -77,29 +77,51 @@ export async function createSession(
 // A request's sign-in, whose presence its first read to find it records.
 // Every read after it in that request (the rechecks after its reads of
 // storage, GitHub or npm among them) only reads: last_seen_at was written a
-// moment before, by the read that let the request in.
-const requests = new AsyncLocalStorage<{ seen: boolean }>()
+// moment before, by the read that let the request in. What the router's
+// gate read is handed to the read after it that says nothing was read
+// between them (`handed`), asking nothing again; once only, and to none
+// once another read came first.
+type SessionRead = { session: ManagedSession; user: StoredUser }
+const requests = new AsyncLocalStorage<{ seen: boolean; handed: { cookieHeader: string | undefined; read: SessionRead } | null }>()
 export function runRequestPresence<T>(work: () => T): T {
-  return requests.run({ seen: false }, work)
+  return requests.run({ seen: false, handed: null }, work)
+}
+export function handOverSession(cookieHeader: string | undefined, read: SessionRead): void {
+  const request = requests.getStore()
+  if (request) request.handed = { cookieHeader, read }
 }
 
 // Resolve the current session (+ user) from the request's cookies, or null.
 // A view cookie resolves only to that admin's view as another user: a view
 // that has ended never falls back to the admin's own session. `own` skips the
-// view and reads the signed-in session itself.
+// view and reads the signed-in session itself. `handed` takes the gate's
+// read, where it is this read's first since (handOverSession).
 export async function readSession(
-  config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined, now: number, { own = false } = {},
-): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined, now: number, { own = false, handed = false } = {},
+): Promise<SessionRead | null> {
+  const request = requests.getStore()
+  const given = request?.handed
+  if (request) request.handed = null
+  if (handed && !own && given && given.cookieHeader === cookieHeader) return given.read
+  const ids = sessionIds(config, cookieHeader, { own })
+  if (!ids) return null
+  const seen = request?.seen === true
+  const s = ids.viewer === null
+    ? await (seen ? db.getSessionWithUser : db.sessionWithUser)(ids.id, now)
+    : await (seen ? db.getViewSessionWithUser : db.viewSessionWithUser)(ids.id, ids.viewer, now)
+  if (s && request) request.seen = true
+  return s
+}
+
+// The sessions the request's cookies name, as readSession reads them: the
+// one acting (`id`), a view where an admin views as another user, with the
+// admin's own it is a view of (`viewer`); none signed out.
+export function sessionIds(config: ManagedConfig, cookieHeader: string | undefined, { own = false } = {}): { id: string; viewer: string | null } | null {
   const cookies = parseCookies(cookieHeader)
   const token = cookies.get(config.sessionCookieName)
   if (token == null || token === '') return null
   const view = own ? undefined : cookies.get(cookieName(config, VIEW_COOKIE))
-  const request = requests.getStore(), seen = request?.seen === true
-  const s = view != null && view !== ''
-    ? await (seen ? db.getViewSessionWithUser : db.viewSessionWithUser)(hashToken(view), hashToken(token), now)
-    : await (seen ? db.getSessionWithUser : db.sessionWithUser)(hashToken(token), now)
-  if (s && request) request.seen = true
-  return s
+  return view != null && view !== '' ? { id: hashToken(view), viewer: hashToken(token) } : { id: hashToken(token), viewer: null }
 }
 
 // Drop the session named by the request's cookie (logout). The caller also

package/server-managed/sql.ts

@@ -2,6 +2,7 @@
 // its single connection across awaits; Neon can reuse a request-owned connection.
 import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
 import type { ManagedDb } from './db-methods.ts'
+import { countStatement, timed } from './request-timing.ts'
 
 type MaybePromise<T> = T | Promise<T>
 export interface ManagedSql {
@@ -22,8 +23,12 @@ export interface ManagedSqlDriver extends ManagedSql {
 const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption', 'getTeam', 'getComment',
   'userCanReadReport', 'userCanReadRepo', 'userCanReadRepoPath', 'userCanReadBundle', 'reportPermissionsFor', 'listComments', 'listManagedIssues',
   'listTriageHistory', 'listUsers', 'listUserOptions', 'listActivityReports', 'getRepoFullName', 'getUser', 'getSessionWithUser', 'getViewSessionWithUser',
-  'listTriageFixes',
-  'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getUserTokens',
+  'listTriageFixes', 'getRepoDependencyReviews', 'listTeamDependencyReviews', 'getNpmReviewReader',
+  'listDependencyReviewTeams', 'listDependencyReviewEnabledTeams', 'listUserNpmScopes', 'listTeamNpmScopes', 'hasTeamNpmScope',
+  'listGithubMetadata', 'listGithubRepositoryVisibility', 'setGithubMetadata', 'recordGithubMetadataAttempts', 'setGithubRepositoryVisibility',
+  'listLinkReports', 'listLegacyLinkReports', 'listReportFilenamesWithBundleHash', 'listReportsForRepo', 'listBundlesForRepo',
+  'listFindingCatalogReports', 'userCanReadBundleAdvisories',
+  'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getBundleAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getAnnotationRevision', 'getUserTokens',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'getFirstUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
@@ -34,12 +39,13 @@ const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensu
 export function scopeManagedMethods(methods: ManagedDb, driver: ManagedSqlDriver): ManagedDb {
   const entries = Object.entries(methods).map(([name, method]) => {
     if (name === 'close') return [name, async () => { await driver.close() }]
-    const write = !/^(?:get|list|userCanRead|reportPermissionsFor)/u.test(name)
-    return [name, (...args: unknown[]) => driver.scope(write, () => method(...args), {
+    const write = !/^(?:get|list|has|userCanRead|reportPermissionsFor)/u.test(name)
+    // Each operation's time told in its request's Server-Timing (request-timing.ts).
+    return [name, (...args: unknown[]) => timed('db', () => driver.scope(write, () => method(...args), {
       // Presence writes only one user's timestamp; they need no application
       // writer lock. Keep the session/user read and timestamp in one transaction.
       lock: write && !UNLOCKED_WRITES.has(name), statement: SINGLE_STATEMENTS.has(name),
-    })]
+    }))]
   })
   return Object.fromEntries(entries) as ManagedDb
 }
@@ -56,17 +62,19 @@ export function createSqliteDriver(db: DatabaseSync): ManagedSqlDriver {
     prepare(sql) {
       const stmt = db.prepare(sql)
       return {
-        get: (...args) => stmt.get(...args as SQLInputValue[]),
-        all: (...args) => stmt.all(...args as SQLInputValue[]),
-        run: (...args) => stmt.run(...args as SQLInputValue[]),
+        get: (...args) => { countStatement(); return stmt.get(...args as SQLInputValue[]) },
+        all: (...args) => { countStatement(); return stmt.all(...args as SQLInputValue[]) },
+        run: (...args) => { countStatement(); return stmt.run(...args as SQLInputValue[]) },
       }
     },
     scope(write, work) {
       if (closed) return Promise.reject(new Error('Managed database is closed'))
       return enqueue(async () => {
+        countStatement()
         db.exec(write ? 'BEGIN IMMEDIATE' : 'BEGIN')
         try {
           const result = await work()
+          countStatement()
           db.exec('COMMIT')
           return result
         } catch (err) {

package/server-managed/storage-encryption.ts

@@ -4,7 +4,7 @@ import { Readable } from 'node:stream'
 import { type StorageKey, decryptStorageStream, encryptStorageStream, wrapStorageValue } from '../server-common/storage-crypto.ts'
 import { ENCRYPTED_CACHE_PREFIX, type ObjectStorage, type RawObject, type RawObjectStorage, deleteObjects, objectPath, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageRow, type StorageRowKind, dataKeyIdentity, unwrapDataKey } from './storage-db.ts'
-import { PUBLIC_CACHE_PREFIX, inspectStorageObject, storageOwner, storageRowPaths, verifyStoragePayload } from './storage-payload.ts'
+import { PUBLIC_CACHE_PREFIX, inspectStorageObject, masterKeyCache, storageOwner, storageRowPaths, verifyStoragePayload } from './storage-payload.ts'
 
 const STORAGE_WRITE_MS = 180_000
 export const STORAGE_UPLOAD_TTL_MS = 86_400_000
@@ -68,6 +68,12 @@ async function decryptOwned(stored: RawObject, key: StorageKey, type: StorageRow
 async function openEncrypted(raw: RawObjectStorage, db: StorageDb, key: StorageKey, identity: string, state: StorageEncryptionState): ReturnType<ObjectStorage['open']> {
   const owner = storageOwner(identity)
   if (!owner) {
+    // A cache no row owns: its ciphertext alone, what was kept as plaintext
+    // before activation never read.
+    if (masterKeyCache(identity)) {
+      const stored = await raw.open(encryptedCachePath(identity))
+      return stored && decryptStorageStream(stored.stream, key.bytes, identity)
+    }
     if (!identity.startsWith('uploads/')) throw new Error('Unknown managed storage owner')
     const stored = await raw.open(identity)
     if (!stored) return null
@@ -229,7 +235,7 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
         if (!row || (owner.cache ? !row.dataKey : !storageRowPaths(owner.type, row).includes(identity))) return false
       }
       // Existence is metadata only; open() authenticates the actual bytes.
-      return await raw.head(state && owner?.cache ? encryptedCachePath(identity) : identity) !== null
+      return await raw.head(state && (owner?.cache || masterKeyCache(identity)) ? encryptedCachePath(identity) : identity) !== null
     },
     async put(identity, bytes, { replaceReport = false } = {}) {
       logicalKey(identity)
@@ -248,10 +254,10 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
         dataKey = randomBytes(32)
         wrapped = wrapStorageValue(key!, dataKeyIdentity(owner.type, owner.id), dataKey)
       } else {
-        if (!identity.startsWith('uploads/')) throw new Error('Unknown managed storage owner')
+        if (!identity.startsWith('uploads/') && !masterKeyCache(identity)) throw new Error('Unknown managed storage owner')
         dataKey = Buffer.from(key!.bytes)
       }
-      const target = owner?.cache ? encryptedCachePath(identity) : identity
+      const target = owner?.cache || masterKeyCache(identity) ? encryptedCachePath(identity) : identity
       const encrypted = encryptStorageStream(Readable.from([bytes]), dataKey, identity, bytes.length)
       try {
         await raw.put(target, encrypted, AbortSignal.timeout(STORAGE_WRITE_MS), undefined, bytes.length)
@@ -268,13 +274,15 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
       // when migration is disabled or another instance has just enabled it.
       for (const target of deletionPaths(identity)) await raw.delete(target)
     },
-    async deletePrefix(prefix) {
+    async deletePrefix(prefix, keep) {
       logicalKey(`${prefix}validate`)
-      if (!prefix.endsWith('/')) throw new Error('Invalid storage prefix')
+      if (!prefix.endsWith('/') || (keep !== undefined && (!keep.startsWith(prefix) || !keep.endsWith('/')))) throw new Error('Invalid storage prefix')
       await mode()
       const signal = AbortSignal.timeout(STORAGE_WRITE_MS)
-      for (const target of deletionPaths(prefix)) {
-        await deleteObjects(raw, target, signal)
+      // What is kept, in the same generation as each removed.
+      const kept = keep === undefined ? [] : deletionPaths(keep)
+      for (const [i, target] of deletionPaths(prefix).entries()) {
+        await deleteObjects(raw, target, signal, undefined, kept[i])
         await raw.prune?.(target, signal)
       }
     },

package/server-managed/storage-maintenance.ts

@@ -3,7 +3,7 @@ import { type StorageKey, decryptStorageStream, encryptStorageStream } from '../
 import { ENCRYPTED_CACHE_PREFIX, type RawObjectStorage, deleteObjects, isBlobId, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, type StorageRow, type StorageRowKind, unwrapDataKey } from './storage-db.ts'
 import { STORAGE_UPLOAD_TTL_MS } from './storage-encryption.ts'
-import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPaths, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
+import { StoragePayloadError, inspectStorageObject, masterKeyCache, storageOwner, storageRowPaths, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
 
 async function replacementFailure(raw: RawObjectStorage, identity: string, version: string, signal: AbortSignal): Promise<string> {
   const format = (value: string) => value.startsWith('W/') ? 'weak' : value.startsWith('"') && value.endsWith('"') ? 'quoted' : 'unquoted'
@@ -113,7 +113,10 @@ function cleanupTarget(identity: string) {
   const path = temporary ? temp![1]! : identity
   const encryptedCache = path.startsWith(ENCRYPTED_CACHE_PREFIX)
   if (encryptedCache && !temporary) return null
-  const owner = storageOwner(encryptedCache ? `cache/${path.slice(ENCRYPTED_CACHE_PREFIX.length)}` : path)
+  const logical = encryptedCache ? `cache/${path.slice(ENCRYPTED_CACHE_PREFIX.length)}` : path
+  // A cache no row owns is a cache all the same: its plaintext legacy, and
+  // its temporary files removed past the staging window.
+  const owner = storageOwner(logical) ?? (masterKeyCache(logical) ? { cache: true as const } : null)
   return owner ? { owner, temporary } : null
 }
 

package/server-managed/storage-payload.ts

@@ -19,6 +19,24 @@ export function storageRowPaths(type: StorageRowKind, row: Pick<StorageRow, 'id'
 // are: public npm versions' pretty-printed files (pretty-print.ts).
 export const PUBLIC_CACHE = 'npm'
 export const PUBLIC_CACHE_PREFIX = `cache/${PUBLIC_CACHE}/`
+// A cache of private content no row owns: the code viewer's directories at
+// repositories' default branches' heads (repository-code.ts
+// repositoryCodeKept), by repository. Plaintext while storage is not
+// encrypted, as other caches are; once it is, kept apart under
+// ENCRYPTED_CACHE_PREFIX as a bundle's caches are, so that what was kept
+// before is never read and legacy cleanup removes it, and encrypted with the
+// master key, as upload parts are, each write's key derived from its path,
+// so that one path's ciphertext fails to authenticate at another. No storage
+// row holds a repository's code for a data key of its own to be wrapped in:
+// its selection is none, and stays as it is deactivated. A key of its own
+// would add a column and its migration only for its deletion to make what is
+// left unreadable at once, as a deleted bundle's caches are; here deletion
+// is physical, by the repository's prefix, at best, as an upload part's is,
+// and what a failed one leaves is a directory as GitHub has it at a commit,
+// read only by a reader GitHub lets read that repository.
+export const REPOSITORY_CODE_CACHE = 'repository-code'
+const REPOSITORY_CODE_CACHE_PREFIX = `cache/${REPOSITORY_CODE_CACHE}/`
+export const masterKeyCache = (identity: string) => identity.startsWith(REPOSITORY_CODE_CACHE_PREFIX)
 export function storageOwner(identity: string): { type: StorageRowKind; id: string; cache: boolean } | null {
   const match = /^(reports|bundles)\/([^/]+)$/u.exec(identity)
   if (match) {

package/server-managed/storage-stores.ts

@@ -8,7 +8,7 @@ import { createBundleStore } from './bundle-store.ts'
 import { createReportStore } from './report-store.ts'
 import { CacheMissError, type CacheStorage, validateCacheKey } from './cache-storage.ts'
 import { type ObjectStorage, isBlobId } from './object-storage.ts'
-import { PUBLIC_CACHE } from './storage-payload.ts'
+import { PUBLIC_CACHE, REPOSITORY_CODE_CACHE } from './storage-payload.ts'
 
 function id(value: string): string {
   if (!isBlobId(value)) throw new Error('Invalid managed blob id')
@@ -35,7 +35,7 @@ function cacheStore(objects: ObjectStorage, name: string): CacheStorage {
       if (!value) throw new CacheMissError()
       return value
     },
-    delete: prefix => objects.deletePrefix(`${path(prefix)}/`),
+    delete: (prefix, keep) => objects.deletePrefix(`${path(prefix)}/`, keep === undefined ? undefined : `${path(`${prefix}/${keep}`)}/`),
   }
 }
 
@@ -86,5 +86,6 @@ export function createManagedStores(objects: ObjectStorage, avatarSidecar: boole
     cacheStorage,
     reportSourcesStorage: cacheStore(objects, 'report-sources'),
     npmCacheStorage: cacheStore(objects, PUBLIC_CACHE),
+    repositoryCodeStorage: cacheStore(objects, REPOSITORY_CODE_CACHE),
   }
 }