@preventive/triage 1.0.0-alpha.47 → 1.0.0-alpha.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.47",
+  "version": "1.0.0-alpha.49",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -130,6 +130,7 @@
     "server-managed/github-actions.ts",
     "server-managed/github-app.ts",
     "server-managed/github-errors.ts",
+    "server-managed/github-graphql.ts",
     "server-managed/github-metadata.ts",
     "server-managed/github-issue-oauth.ts",
     "server-managed/github-issues.ts",
@@ -187,9 +188,11 @@
     "server-managed/repository-changes.ts",
     "server-managed/repository-code.ts",
     "server-managed/repository-dependency-reviews.ts",
+    "server-managed/request-timing.ts",
     "server-managed/reviewed-dependencies.ts",
     "server-managed/repository-agents.ts",
     "server-managed/repository-history.ts",
+    "server-managed/repository-squashes.ts",
     "server-managed/repository-issues.ts",
     "server-managed/repository-pulse.ts",
     "server-managed/repository-aliases.ts",
@@ -401,16 +404,16 @@
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@exodus/stasis": "1.0.0-beta.9",
-    "@exodus/stasis-core": "1.0.0-beta.9",
-    "@preventive/archive": "^1.1.0",
+    "@exodus/stasis": "1.0.0-beta.11",
+    "@exodus/stasis-core": "1.0.0-beta.11",
+    "@preventive/archive": "^1.2.0",
     "@preventive/compare": "^1.2.11",
     "@preventive/diff": "^1.1.0",
     "@preventive/lockfile": "^1.2.0",
     "@preventive/publishers": "^1.1.0",
     "@preventive/report": "^1.0.0",
     "@preventive/sourcemap": "1.0.0-alpha.1",
-    "@preventive/upstream": "^1.2.0",
+    "@preventive/upstream": "^1.3.0",
     "css-tree": "^3.2.1",
     "oxc-minify": "^0.152.0",
     "oxc-parser": "^0.152.0",

package/risk/npm/score.js

@@ -7,7 +7,7 @@ import { DAY_MS } from './downloads.js'
 // How much each finding raises the score, by its severity: a version's
 // findings combined as independent chances are (1 − Π(1 − weight)), so that
 // each adds less the more there are, none past 100. One red finding alone is
-// 50; two, or one with two orange, past 75, as attacks show.
+// 50; two are 75, and one with two orange 68, as attacks show.
 const WEIGHTS = { critical: 0.5, high: 0.2, moderate: 0.08, low: 0.03, notice: 0 }
 // What the version's age tells instead (`too-new`), as exposure does below.
 const TOLD_BY_AGE = new Set(['too-new'])

package/server-managed/agent-merges.ts

@@ -4,10 +4,11 @@
 // pull request's branch alone naming it (app-agents.ts
 // AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
 // (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
-// its author, an account agents work as (github-agents.ts AGENT_OPERATED).
+// its author, an account agents work as (github-agents.ts AGENT_OPERATED),
+// or any GitHub App's bot.
 import { labelAgents } from '../common/managed/agent-tasks.ts'
 import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
-import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { AGENT_BRANCH_PREFIXES } from './app-agents.ts'
 import { type HistoryCommit, githubGraphql } from './repository-history.ts'
 
 // The merged pull requests read an answer, a page a query, as many queries
@@ -22,7 +23,7 @@ const MERGED_LABELS = 100
 // How long before or after a pull request rebased onto the branch was merged
 // its copies are committed.
 const REBASE_SKEW_MS = 10 * 60_000
-const LABEL_AGENTS = [...new Set([...Object.keys(GITHUB_AGENTS), ...APP_AGENTS.map(agent => agent.id)])]
+const LABEL_AGENTS = Object.keys(GITHUB_AGENTS)
 const SHA = /^[a-f\d]{40}$/u
 
 const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
@@ -36,14 +37,18 @@ const timeOf = (value: unknown) => {
 // rebased onto the branch by their last commit there, when merged, and
 // their commits' subjects, the oldest first (agentCommits); when the newest
 // read was last updated, those updated since read again (`through`, null
-// till all are read once); and a read not finished: where it goes on
-// (`after`), when the newest it began with was updated (`from`), the oldest
-// it reads to (`stop`) and how many it has read (`read`). And of every pull
+// till all are read once), and where those read reach back no further than
+// a period needed, when the oldest of them was updated (`reach`), every
+// pull request merged since read (one is updated when merged, or after);
+// and a read not finished: where it goes on (`after`), when the newest it
+// began with was updated (`from`), the oldest it reads to (`stop`), how many
+// it has read (`read`) and when the oldest of them was updated (`to`). And
+// of every pull
 // request merged, an agent's or not, its merge commit and when (`pulls`),
 // and one rebased so (`pullRebases`), for the commits pushed to the branch
 // directly to be told (directCommits).
-export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null
-  next: { after: string; from: number; stop: number; read: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
+export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null; reach?: number
+  next: { after: string; from: number; stop: number; read: number; to?: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
 // A pull request rebased onto the branch: its last commit there, when it was
 // merged, its latest commits' subjects, the oldest first, and how many more
 // it had than those read (`more`).
@@ -53,14 +58,14 @@ const MERGED_QUERY = `query($owner: String!, $name: String!, $after: String) {
   repository(owner: $owner, name: $name) {
     pullRequests(states: MERGED, first: ${MERGED_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
       pageInfo { hasNextPage endCursor }
-      nodes { updatedAt mergedAt headRefName author { login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
+      nodes { updatedAt mergedAt headRefName author { __typename login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
         mergeCommit { oid parents { totalCount } }
         commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
     }
   }
 }`
 type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }
-  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { login?: unknown; databaseId?: unknown } | null
+  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { __typename?: unknown; login?: unknown; databaseId?: unknown } | null
     labels?: { nodes?: ({ name?: unknown } | null)[] } | null
     mergeCommit?: { oid?: unknown; parents?: { totalCount?: unknown } | null } | null
     commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null
@@ -68,9 +73,10 @@ type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: u
 const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
 type MergedNode = NonNullable<NonNullable<NonNullable<NonNullable<MergedPage['repository']>['pullRequests']>['nodes']>[number]>
 // Whether a pull request is an agent's: by its branch, a label naming one,
-// or its author, an account agents work as.
+// or its author, an account agents work as or a bot (GitHub's GraphQL API
+// naming a bot by its app's login alone, its type telling it).
 const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(headRefName)
-  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0
+  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0 || author?.__typename === 'Bot'
   || agentOperated(typeof author?.login === 'string' ? author.login : null, Number.isSafeInteger(author?.databaseId) ? author!.databaseId as number : null)
 
 // The commits the pull requests merged since `since` from an agent's branch,
@@ -84,20 +90,24 @@ const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(h
 // first (a pull request is updated when merged, or after), on from what was
 // `kept`: till one updated before the year, or before the newest read before
 // was, as many queries an answer as MERGED_QUERIES, a read not finished
-// going on from where it was left by the next; one read again whose label
-// no longer names an agent, what it was read to bring forgotten.
+// going on from where it was left by the next, or once those merged since
+// `need` are all read; one read again whose label no longer names an agent,
+// what it was read to bring forgotten.
 export async function agentMerges(fullName: string, token: string, since: number, kept: AgentMerges | null,
-  fetchImpl: typeof fetch = globalThis.fetch): Promise<AgentMerges> {
+  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<AgentMerges> {
   const [owner, name] = fullName.split('/') as [string, string]
   const merges = new Map((kept?.merges ?? []).filter(([, at]) => at >= since))
   const rebases = new Map((kept?.rebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
   const pulls = new Map((kept?.pulls ?? []).filter(([, at]) => at >= since))
   const pullRebases = new Map((kept?.pullRebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
-  const stop = kept?.next?.stop ?? Math.max(since, kept?.through ?? since)
+  // Those read reaching back no further than they needed, and `need`
+  // further: read again from the newest on, as far back as it needs.
+  const further = !kept?.next && kept?.reach !== undefined && kept.reach >= need
+  const stop = kept?.next?.stop ?? (further ? since : Math.max(since, kept?.through ?? since))
   const listed = (map: typeof rebases) => [...map].map(([sha, [at, subjects, more]]): Rebase => more > 0 ? [sha, at, subjects, more] : [sha, at, subjects])
-  const result = (through: number | null, next: AgentMerges['next']): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through, next,
-    pulls: [...pulls], pullRebases: listed(pullRebases) })
-  let { after = null, from = null, read = 0 }: { after?: string | null; from?: number | null; read?: number } = kept?.next ?? {}
+  const result = (through: number | null, next: AgentMerges['next'], reach?: number): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through,
+    ...reach === undefined ? {} : { reach }, next, pulls: [...pulls], pullRebases: listed(pullRebases) })
+  let { after = null, from = null, read = 0, to = null }: { after?: string | null; from?: number | null; read?: number; to?: number | null } = kept?.next ?? {}
   for (let queries = 0; queries < MERGED_QUERIES; queries++) {
     const page = (await githubGraphql(MERGED_QUERY, { owner, name, after }, token, fetchImpl) as MergedPage | null)?.repository?.pullRequests
     let done = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
@@ -106,6 +116,7 @@ export async function agentMerges(fullName: string, token: string, since: number
       if (updated === null) continue
       if (updated < stop) { done = true; break }
       from ??= updated
+      to = updated
       read++
       const [merged, merge] = [timeOf(node?.mergedAt), node?.mergeCommit?.oid]
       if (!node || merged === null || merged < since || typeof merge !== 'string' || !SHA.test(merge)) continue
@@ -129,10 +140,15 @@ export async function agentMerges(fullName: string, token: string, since: number
       for (const oid of brought) merges.set(oid, merged)
       if (subjects) rebases.set(merge, [merged, subjects, more])
     }
-    if (done) return result(from ?? stop, null)
+    // Read as far back as it reads to: the year's start, every one since
+    // read; else as far as those read before reached.
+    if (done) return result(from ?? stop, null, stop > since ? kept?.reach : undefined)
     after = page!.pageInfo!.endCursor as string
+    // Read as far back as `need`: finished, so far back, those updated
+    // since read by the next as ever.
+    if (need > since && to !== null && to < need) return result(Math.max(from ?? stop, kept?.through ?? Number.NEGATIVE_INFINITY), null, to)
   }
-  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read })
+  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read, ...to === null ? {} : { to } }, kept?.reach)
 }
 
 // Whether two reads of the pull requests merged (agentMerges) bring the
@@ -152,7 +168,7 @@ const headed = (subject: string, headline: string) => headline.endsWith('…') ?
 // (`read`, agentMerges): those it names, and of one rebased, its commits'
 // copies, the last and those below it on their first parents, as long as
 // each one's subject is that of one of its commits older than the last
-// matched, as Commits tells a rebase (repository-history.ts squashedPulls),
+// matched, as Commits tells a rebase (repository-squashes.ts squashedPulls),
 // past those of its commits the rebase left none of (an empty one GitHub
 // counted no files of), and, past them all, as many more as it had before
 // its latest read; a squash merge's one commit alone, its subject the pull

package/server-managed/app-agents.ts

@@ -6,14 +6,12 @@ import { GITHUB_AGENTS, type GithubAgent } from '../common/managed/github-agents
 
 // The agents known by their GitHub Apps or accounts, beside Claude and
 // Codex: those of GITHUB_AGENTS with branches of their own, in its order
-// (common/managed/github-agents.ts, where each is told), each its id and
-// name, its avatar (its mark, served by /api/avatar/<avatar>, a GitHub
-// App's, `app-<id>`), the fingerprint it leaves, the account its work is
-// authored by (its id and the logins GitHub names it by, told by both, or by
-// its id alone where it names none), and its branches' prefix.
-export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = (Object.entries(GITHUB_AGENTS) as [string, GithubAgent][])
-  .flatMap(([id, { name, avatar, accounts: [account], prefix, fingerprint }]) => prefix ? [{ id, name, prefix, ...avatar ? { avatar } : {},
-    ...account?.id === undefined ? {} : { account: { id: account.id, logins: account.logins } }, ...fingerprint ? { fingerprint } : {} }] : [])
+// (common/managed/github-agents.ts, where each is told, its accounts among
+// it), each its id and name, its avatar (its mark, served by
+// /api/avatar/<avatar>, a GitHub App's, `app-<id>`), the fingerprint it
+// leaves, and its branches' prefix.
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = Object.entries<GithubAgent>(GITHUB_AGENTS)
+  .flatMap(([id, { name, avatar, prefix, fingerprint }]) => prefix ? [{ id, name, prefix, ...avatar ? { avatar } : {}, ...fingerprint ? { fingerprint } : {} }] : [])
 // The prefixes of the branches agents work on: Claude Code's and Codex's,
 // and the app agents'.
 export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/cache-storage.ts

@@ -5,12 +5,13 @@ export class CacheMissError extends Error {
   constructor() { super('Managed cache unavailable') }
 }
 
-// Keys are internal relative paths; delete removes a whole directory of variants.
+// Keys are internal relative paths; delete removes a whole directory of
+// variants, but for one directory within it where `keep` names one.
 export interface CacheStorage {
   exists(key: string): Promise<boolean>
   put(key: string, bytes: Buffer): Promise<void>
   open(key: string): Promise<OpenedBlob>
-  delete(prefix: string): Promise<void>
+  delete(prefix: string, keep?: string): Promise<void>
 }
 
 export function validateCacheKey(key: string): string {

package/server-managed/commit-coauthors.ts

@@ -10,7 +10,7 @@ export const MAX_COAUTHORS = 3
 // The rules co-authors are read by, the agents' addresses and names among
 // them: what was kept read by others (history pages, squashed pull requests)
 // read again by these, once raised.
-export const COAUTHORS_READ = 3
+export const COAUTHORS_READ = 4
 const MAX_NAME = 256
 const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
 
@@ -30,6 +30,11 @@ const FINGERPRINTED = APP_AGENTS.filter(agent => agent.fingerprint)
 // commit gives (where it is read), and account.
 export type Maker = { name: unknown; email?: unknown; account: NamedAccount }
 
+// Those a commit's message names in its `Co-authored-by:` trailers
+// (agent-tasks.ts trailerBlock), each by name and address.
+export const coauthorTrailers = (message: unknown) => typeof message === 'string'
+  ? [...trailerBlock(message.replaceAll('\r\n', '\n')).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name: name!, email: email! })) : []
+
 // The agent one who made a commit is: by their account, else the address
 // their commit names them by; else, GitHub naming no account for them, by
 // their name.
@@ -50,7 +55,7 @@ const makerAgent = ({ name, email, account }: Maker): GithubAgentId | null => gi
 // two people of one name with accounts or addresses of their own two.
 export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | null = null): Coauthor[] {
   const text = typeof message === 'string' ? message.replaceAll('\r\n', '\n') : ''
-  const named = listed ?? [...trailerBlock(text).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name, email, account: commitAccount({ email }) }))
+  const named = listed ?? coauthorTrailers(text).map(({ name, email }) => ({ name, email, account: commitAccount({ email }) }))
   const signals = agentSignals([text], FINGERPRINTED)
   const marked = [...signals.claude || signals.sessions.length > 0 ? ['claude'] : [], ...signals.tasks.length > 0 || signals.codex ? ['codex'] : [],
     ...CURSOR_AGENT.test(text) ? ['cursor'] : [], ...signals.agents]

package/server-managed/commit-lockfiles.ts

@@ -1,51 +1,52 @@
 // The versions a repository's lockfiles of npm's ecosystem lock at a commit,
 // as their review reads them (pull-dependency-reviews.ts): every lockfile
 // there (findRepoLockfiles) a review holds to (`held`, lockfile-scope.ts),
-// read as a pull request's are (pull-dependencies.ts readLockfile, kept in
-// this instance by the commit and path), as many as MAX_LOCKFILES of those,
-// each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
-// past MAX_LOCKFILES (`unread`), as many read at once as READ_AT_ONCE; and
-// those of some of them (lockedIn), each version once by what its reviews
-// are held to (lockedWith), dev only where it is wherever it is locked.
-// GitHub having none of a lockfile it lists there fails the whole, as it
-// would for any file.
+// read as a pull request's are (pull-dependencies.ts readLockfile), but kept
+// by its blob, in this instance and beyond it (`kept`), as many as
+// MAX_LOCKFILES of those, each's versions (`lockfiles`), and those its reader
+// refuses, of Bun's, or past MAX_LOCKFILES (`unread`), as many read at once
+// as READ_AT_ONCE; and those of some of them (lockedIn), each version once by
+// what its reviews are held to (lockedWith), dev only where it is wherever it
+// is locked. GitHub having none of a lockfile it lists there fails the
+// whole, as it would for any file.
 import { createClient } from '@preventive/upstream/github.js'
 import { upstreamGithub } from './github-errors.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { type Lru, lru } from './lru.ts'
-import { eachOf, lockedWith, lockfileFormat, lockfileHeld, readLockfile } from './pull-dependencies.ts'
+import { type GithubAsked, type ListedLockfile, type LockfileStore, eachOf, lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
 
 export const MAX_LOCKFILES = 100
 const READ_AT_ONCE = 4
 
 export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
-// Set where GitHub was asked for what a read reads (`github`), not all of it
-// held in this instance.
-export interface GithubAsked { github: boolean }
 
 // The lockfiles at commit `sha` its review reads, by their paths, each with
-// its format (pull-dependencies.ts lockfileFormat), kept by the commit;
-// `asked` told where GitHub was.
-const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
-export async function lockfilesAt(fullName: string, token: string, sha: string, asked?: GithubAsked) {
+// its format (pull-dependencies.ts lockfileFormat) and its blob's id, kept by
+// the commit, in this instance and beyond it (`kept`); `asked` told where
+// GitHub was.
+const listings: Lru<ListedLockfile[]> = lru(20_000, listed => listed.length + 1)
+export async function lockfilesAt(fullName: string, token: string, sha: string, kept: LockfileStore | null, asked?: GithubAsked) {
   const key = `${fullName}\0${sha}`
   const known = listings.get(key)
   if (known) return known
+  const stored = await kept?.listings.read(sha)
+  if (stored) { listings.set(key, stored); return stored }
   if (asked) asked.github = true
   const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
-  const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
+  const listed = lockfiles.flatMap(({ path, sha: blob }) => { const format = lockfileFormat(path); return format ? [{ path, format, sha: blob }] : [] })
   listings.set(key, listed)
+  await kept?.listings.write(sha, listed)
   return listed
 }
 
-export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true, asked?: GithubAsked): Promise<CommitLockfiles> {
-  const listed = (await lockfilesAt(fullName, token, sha, asked)).filter(({ path }) => held(path))
+export async function lockedAt(fullName: string, token: string, sha: string, kept: LockfileStore | null, held: (path: string) => boolean = () => true,
+  asked?: GithubAsked): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha, kept, asked)).filter(({ path }) => held(path))
   const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
   const lockfiles: CommitLockfiles['lockfiles'] = []
   const reading = listed.slice(0, MAX_LOCKFILES)
-  if (asked && reading.some(lockfile => !lockfileHeld(fullName, sha, lockfile))) asked.github = true
-  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile))
+  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile, kept, asked))
   for (const [at, lockfile] of reading.entries()) {
     const read = reads[at]!
     if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')

package/server-managed/db-methods.ts

@@ -494,7 +494,7 @@ export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyRe
   getBundleByIntegrity(integrity: string): Promise<ManagedBundle | null>
   resolveBundleUpload(integrity: string): Promise<ManagedBundle | null>
   getBundle(id: string): Promise<ManagedBundle | null>
-  // One read snapshot of the live session, bundle and grants. Passing a team
+  // One statement reads the live session, bundle and grants. Passing a team
   // (or null for any team) also checks advisory security access; omission skips it.
   getBundleAccessSnapshot(sessionId: string, now: number, id: string, advisoriesTeamId?: string | null): Promise<{
     bundle: ManagedBundle | null; canReadAdvisories: boolean
@@ -697,13 +697,6 @@ function prepareStatements(db: ManagedSql) {
     insertSessionStmt: db.prepare(
       `INSERT INTO managed_session (id, user_id, csrf_token, created_at, expires_at) VALUES (?, ?, ?, ?, ?)`,
     ),
-    selectSessionStmt: db.prepare(
-      `SELECT s.id AS id, s.csrf_token AS csrf, s.expires_at AS exp, s.upload_key AS uploadKey,
-              u.id AS uid, u.login AS login, u.name AS name, u.avatar_url AS avatar, u.role AS role
-         FROM managed_session s
-         JOIN managed_user u ON u.id = s.user_id
-        WHERE s.id = ? AND s.expires_at > ?`,
-    ),
     selectOwnSessionStmt: db.prepare(
       `SELECT s.id AS id, s.csrf_token AS csrf, s.expires_at AS exp, s.upload_key AS uploadKey,
               u.id AS uid, u.login AS login, u.name AS name, u.avatar_url AS avatar, u.role AS role
@@ -994,15 +987,18 @@ function prepareStatements(db: ManagedSql) {
     ),
     selectTriageFixesStmt: db.prepare(`SELECT DISTINCT fix FROM managed_finding_triage
       WHERE finding_id IN (SELECT value FROM json_each(?)) AND fix IS NOT NULL ORDER BY fix`),
-    annotationTriageRevisionStmt: db.prepare(`
-      SELECT t.finding_id AS id,
-        (SELECT e.batch_id FROM managed_finding_triage_event e
-          WHERE e.finding_id = t.finding_id ORDER BY e.seq DESC LIMIT 1) AS revision
-      FROM managed_finding_triage t WHERE t.finding_id IN (SELECT value FROM json_each(?))
-      ORDER BY t.finding_id`),
-    annotationCommentRevisionStmt: db.prepare(`
-      SELECT id, version FROM managed_finding_comment
-      WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY id`),
+    // Each finding's latest triage batch, comment versions and linked issues,
+    // in one statement.
+    annotationRevisionStmt: db.prepare(
+      `WITH requested AS (SELECT value AS id FROM json_each(?))
+       SELECT (SELECT json_group_array(json_object('id', t.finding_id, 'revision', (SELECT e.batch_id FROM managed_finding_triage_event e
+                        WHERE e.finding_id = t.finding_id ORDER BY e.seq DESC LIMIT 1)) ORDER BY t.finding_id)
+                 FROM managed_finding_triage t WHERE t.finding_id IN (SELECT id FROM requested)) AS triage,
+              (SELECT json_group_array(json_object('id', c.id, 'version', c.version) ORDER BY c.id)
+                 FROM managed_finding_comment c WHERE c.finding_id IN (SELECT id FROM requested)) AS comments,
+              (SELECT json_group_array(json_object('findingId', i.finding_id, 'issueUrl', i.issue_url, 'autoFixUrl', i.auto_fix_url) ORDER BY i.finding_id)
+                 FROM managed_finding_issue i WHERE i.finding_id IN (SELECT id FROM requested) AND i.issue_url IS NOT NULL) AS issues`,
+    ),
     insertBundleStmt: db.prepare(
       `WITH candidate(id, slug) AS (VALUES (?, ?))
        INSERT INTO managed_bundle (id, slug, integrity, filename, kind, byte_size, uploaded_by, uploaded_by_login, repo_id, repo_directory, visible, uploaded_at, data_key, storage_encrypted, provenance, build_conditions)
@@ -1157,6 +1153,32 @@ function prepareStatements(db: ManagedSql) {
         WHERE b.id = ? AND tu.user_id = ? AND tu.view_security = 1
           AND (? IS NULL OR tr.team_id = ?) LIMIT 1`,
     ),
+    // A bundle access snapshot's reads in one statement, so one snapshot of
+    // the database answers them all: the session's user, view sessions
+    // included; the bundle, NULL where there is none; whether one of the
+    // user's team scopes contains it, the grant both selectBundleReadableStmt
+    // (a manager's, beside their own uploads) and selectRepoPathReadableStmt
+    // (a reader's, of its repository directory) ask for; and, where the flag
+    // asks, whether one in the team (any, where NULL) shows them its
+    // advisories (selectBundleSecurityStmt).
+    selectBundleAccessStmt: db.prepare(
+      `WITH viewer AS (
+         SELECT u.id AS uid, u.role AS role
+           FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+          WHERE s.id = ? AND s.expires_at > ?
+       )
+       SELECT v.uid AS uid, v.role AS role, b.id AS id, b.slug AS slug, b.integrity AS integrity, b.filename AS filename, b.kind AS kind,
+              b.byte_size AS byteSize, b.uploaded_by AS uploadedBy, b.repo_id AS repoId, b.repo_directory AS repoDirectory, b.visible AS visible,
+              b.uploaded_at AS uploadedAt, b.provenance AS provenance, b.build_conditions AS buildConditions,
+              EXISTS(SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+                       JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+                      WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = v.uid) AS granted,
+              (? = 1 AND EXISTS(SELECT 1 FROM managed_team_repo tr JOIN managed_team_user tu ON tu.team_id = tr.team_id
+                       JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0
+                      WHERE tr.repo_id = b.repo_id AND ${BUNDLE_IN_TEAM_PATH_SQL} AND tu.user_id = v.uid AND tu.view_security = 1
+                        AND (? IS NULL OR tr.team_id = ?))) AS security
+         FROM viewer v LEFT JOIN managed_bundle b ON b.id = ?`,
+    ),
     // The viewer's effective visibility permissions for a report: OR'd (MAX over
     // 0/1) across memberships whose repository path contains the report. NULLs
     // (no such membership) read as 0 = no permission.
@@ -1439,15 +1461,10 @@ function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit
   return {
     async getAnnotationRevision(findingIds: readonly string[]): Promise<string> {
       if (findingIds.length === 0) return '[]'
-      const ids = JSON.stringify(findingIds)
       // Batch UUIDs survive history trimming and distinguish same-timestamp
       // writes, even if SQLite reuses a sequence after an annotation purge.
-      return JSON.stringify([
-        await stmts.annotationTriageRevisionStmt.all(ids),
-        await stmts.annotationCommentRevisionStmt.all(ids),
-        await db.prepare(`SELECT finding_id, issue_url, auto_fix_url FROM managed_finding_issue
-          WHERE finding_id IN (SELECT value FROM json_each(?)) AND issue_url IS NOT NULL ORDER BY finding_id`).all(ids),
-      ])
+      const row = await stmts.annotationRevisionStmt.get(JSON.stringify(findingIds)) as { triage: unknown; comments: unknown; issues: unknown }
+      return JSON.stringify([jsonRows(row.triage), jsonRows(row.comments), jsonRows(row.issues)])
     },
     async deleteTriage(findingIds: readonly string[]): Promise<number> {
       if (findingIds.length === 0) return 0
@@ -1579,22 +1596,19 @@ function bundleMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedS
       return row == null ? null : mapBundle(row)
     },
     async getBundleAccessSnapshot(sessionId: string, now: number, id: string, advisoriesTeamId?: string | null) {
-      const session = await stmts.selectSessionStmt.get(sessionId, now) as SessionRow | undefined
-      if (!session) return null
+      // One statement, shared by SQLite and Postgres; the advisories grant is
+      // read only where a team (or null, any) is passed.
+      const team = advisoriesTeamId ?? null
+      const row = await stmts.selectBundleAccessStmt.get(sessionId, now, advisoriesTeamId === undefined ? 0 : 1, team, team, id) as
+        { uid: string; role: Role; granted: unknown; security: unknown } & (BundleRow | { id: null }) | undefined
+      if (!row) return null
       const denied = { bundle: null, canReadAdvisories: false }
-      if (!roleAtLeast(session.role, 'view')) return denied
-      const row = await selectBundleStmt.get(id) as BundleRow | undefined
-      if (!row) return denied
-      const manager = roleAtLeast(session.role, 'manage')
+      if (!roleAtLeast(row.role, 'view') || row.id === null) return denied
+      const manager = roleAtLeast(row.role, 'manage')
       if (!manager && row.visible !== 1) return denied
-      if (session.role !== 'admin') {
-        const allowed = manager ? await selectBundleReadableStmt.get(id, session.uid, session.uid)
-          : row.repoId !== null && await selectRepoPathReadableStmt.get(row.repoDirectory, row.repoId, session.uid)
-        if (!allowed) return denied
-      }
-      const canReadAdvisories = manager || (advisoriesTeamId !== undefined
-        && await stmts.selectBundleSecurityStmt.get(id, session.uid, advisoriesTeamId, advisoriesTeamId) != null)
-      return { bundle: mapBundle(row), canReadAdvisories }
+      // Admins read every bundle, managers their own uploads too.
+      if (row.role !== 'admin' && !(row.granted || (manager && row.uploadedBy === row.uid))) return denied
+      return { bundle: mapBundle(row), canReadAdvisories: manager || Boolean(row.security) }
     },
     async listBundles(userId?: string): Promise<AdminBundle[]> {
       const rows = (await selectBundlesStmt.all(userId ?? null, userId ?? null, userId ?? null)) as BundleListRow[]

package/server-managed/db-neon.ts

@@ -1,4 +1,4 @@
-import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS, DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
@@ -17,6 +17,7 @@ import { UPSTREAM_CACHE_SCHEMA } from './upstream-cache.ts'
 import { COMMENT_SCHEMA } from './comments.ts'
 import { ACTIVITY_SCHEMA, uploadAction } from './activity.ts'
 import { type ManagedSqlDriver, scopeManagedMethods } from './sql.ts'
+import { countStatement, timed } from './request-timing.ts'
 import { postgresSchema, postgresSql } from './sql-postgres.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
@@ -38,7 +39,7 @@ const LOCK = 'SELECT pg_advisory_xact_lock(1937006964, 1835101793)'
 // Whether every version up to the latest is recorded, in one round trip at
 // a cold start: a database with no versions table yet (undefined_table) has
 // none. Outside a transaction, so the failed read aborts nothing.
-const SCHEMA_VERSIONS = 31
+const SCHEMA_VERSIONS = 32
 async function currentSchema(db: PgConnection): Promise<boolean> {
   try {
     const { rows } = await db.query(`SELECT count(*) AS n FROM managed_schema_version WHERE version BETWEEN 1 AND ${SCHEMA_VERSIONS}`)
@@ -183,6 +184,14 @@ async function migrateRepoUploadIndexes(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (31)')
 }
 
+// The shasums of the tarballs a dependency review reads, none known of
+// those written before.
+async function migrateDependencyReviewShasums(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 32')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_dependency_review ${DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (32)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -257,7 +266,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
     for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
-      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes]) await migrate(db)
+      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes, migrateDependencyReviewShasums]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -325,7 +334,12 @@ function requestConnections(connect: PgConnect) {
 }
 
 // Exposed for parity tests against real PostgreSQL semantics via PGlite.
-export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
+export async function openPostgresManagedDb(leased: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
+  // Each statement told in its request's Server-Timing (request-timing.ts).
+  const connect: PgConnect = async () => {
+    const connection = await leased()
+    return { query: (sql, params) => { countStatement(); return connection.query(sql, params) }, release: discard => connection.release(discard) }
+  }
   const initial = await connect()
   try { await initialize(initial) } catch (err) { await initial.release(true).catch(() => {}); throw err }
   await initial.release()
@@ -431,7 +445,9 @@ export async function openNeonManagedDb(url: string, options: ManagedDbOptions =
   let db: ManagedDb
   try {
     db = await openPostgresManagedDb(async () => {
-      const client = await pool.connect()
+      // A lease's wait told in its request's Server-Timing: a new connection's
+      // TLS, WebSocket and Postgres handshake, where the pool had none idle.
+      const client = await timed('conn', () => pool.connect())
       if (!watched.has(client)) { watched.add(client); client.on('error', () => { failed.add(client) }) }
       return { query: (sql, params) => client.query(sql, params),
         release: discard => Promise.try(() => client.release(discard === true || failed.has(client))) }

package/server-managed/db.ts

@@ -10,6 +10,7 @@ import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
 import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
+import { DEPENDENCY_REVIEW_COLUMNS } from './dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -124,6 +125,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
     for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
+    for (const [column, type] of DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_dependency_review', column, type)
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')

package/server-managed/dependabot-access.ts

@@ -1,6 +1,6 @@
 // A repository's Dependabot alerts for a repository risk scan, read with the
 // App's installation token where the admin's own access lets them see them on
-// GitHub, as the README's repository risk section tells.
+// GitHub, as doc/bundles.md's repository risk scan section tells.
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { type DependabotAlert, dependabotAlerts } from './dependabot-alerts.ts'

package/server-managed/dependency-review-comments.ts

@@ -18,11 +18,14 @@ const MAX_FORMATTED = 1_000_000
 // read after, every one formatted.
 const REVIEWS_AT_ONCE = 200
 
-// `review` as the hook is given it, the version it is of as `locked`, a
-// pull request's lockfile, locks it where it is one's.
+// `review` as the hook is given it: each version with the integrity and
+// shasum the review keeps of the tarball it read, and the version it is of
+// with the patch `locked`, a pull request's lockfile, locks it with, where it
+// is one's.
 function entryOf(review: DependencyReview, locked?: AddedPackage | undefined): DependencyReviewEntry {
-  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '' },
-    new: { name: review.package, version: review.version, integrity: review.integrity, ...locked?.shasum ? { shasum: locked.shasum } : {},
+  return { ecosystem: 'npm', old: review.basePackage === null ? null : { name: review.basePackage, version: review.baseVersion ?? '', integrity: review.baseIntegrity ?? '',
+      ...review.baseShasum ? { shasum: review.baseShasum } : {} },
+    new: { name: review.package, version: review.version, integrity: review.integrity, ...review.shasum ? { shasum: review.shasum } : {},
       ...locked?.patchHash ? { patchHash: locked.patchHash } : {} },
     status: review.status!, coverage: review.coverage === 'full' ? 'full' : 'partial', comment: review.comment,
     files: review.entries.filter(entry => entry.status !== null || entry.comment.trim() !== '').map(entry => ({ path: entry.file, status: entry.status, comment: entry.comment })),