@preventive/triage 1.0.0-alpha.47 → 1.0.0-alpha.49

package/server-managed/repository-squashes.ts

@@ -0,0 +1,145 @@
+// The pull requests squashed into a repository's commits, as the code
+// viewer's Commits tab draws them (repository-history.ts), each looked up
+// with GraphQL once and kept by its commit.
+import { linkNoreplyUsers } from './github-accounts.ts'
+import { type GraphqlError, githubGraphql } from './github-graphql.ts'
+import { COMMIT_FRAGMENT, type GraphCommit, type HistoryCommit, commitActors, graphCommit, inBatches, variablesOf } from './repository-history.ts'
+
+const SHA = /^[a-f\d]{40}$/u
+
+// A pull request squashed into a commit of the default branch's history
+// (`merge`): its number, the commit its head was at when merged (`head`,
+// GitHub's own of it, which a branch reused or pushed over since never
+// moves), and its own commits, the latest MAX_SQUASHED of them, `more`
+// where it had more. Drawn as the merge it was, its commits on a lane of
+// their own (repository-history.js).
+export interface SquashedPull { merge: string; number: number; head: string; commits: HistoryCommit[]; more: boolean }
+// The pull requests squashed into commits, kept by each commit (a merged pull
+// request's commits never change); null for a commit none was.
+export interface Squashes {
+  read(shas: string[]): Promise<Map<string, SquashedPull | null>>
+  write(sha: string, pull: SquashedPull | null): Promise<void>
+}
+
+const MAX_SQUASHED = 100
+// Looked up of an answer's commits not yet kept, at most, the newest first;
+// in queries of as many commits, or pull requests (their commits' lines
+// counted, as a history's are), as many at once.
+export const MAX_SQUASH_LOOKUPS = 500
+const SQUASH_COMMITS = 100
+const SQUASH_PULLS = 5
+const SQUASH_PARALLEL = 4
+
+// The merged pull request that brought each commit in, `c<n>` the `n`th's.
+const mergedPullsQuery = (count: number) => `query($owner: String!, $name: String!, ${variablesOf('o', count, 'GitObjectID!')}) {
+  repository(owner: $owner, name: $name) {
+    ${Array.from({ length: count }, (_, at) => `c${at}: object(oid: $o${at}) { ... on Commit { associatedPullRequests(first: 1) { nodes { number mergeCommit { oid } } } } }`).join('\n    ')}
+  }
+}`
+// Each pull request's head when merged and its latest commits, `p<n>` the `n`th's.
+const squashedQuery = (count: number) => `query($owner: String!, $name: String!, ${variablesOf('n', count, 'Int!')}) {
+  repository(owner: $owner, name: $name) {
+    ${Array.from({ length: count }, (_, at) => `p${at}: pullRequest(number: $n${at}) { headRefOid commits(last: ${MAX_SQUASHED}) { totalCount nodes { commit { ...historyCommit } } } }`).join('\n    ')}
+  }
+}
+${COMMIT_FRAGMENT}`
+
+type MergedPulls = { repository?: Record<string, { associatedPullRequests?: { nodes?: ({ number?: unknown; mergeCommit?: { oid?: unknown } | null } | null)[] } } | null> | null }
+type SquashedPage = { repository?: Record<string, { headRefOid?: unknown; commits?: { totalCount?: unknown; nodes?: ({ commit?: GraphCommit | null } | null)[] } } | null> | null }
+
+// A pull request or commit GitHub has none of, as one deleted: its field null.
+const notFound = (error: GraphqlError) => error?.type === 'NOT_FOUND'
+
+// Each repository's lookup of squashed pull requests going on, by its full
+// name: one at a time, those asking meanwhile waiting on it, and their
+// commits it doesn't look up looked up once it is done.
+const lookingUp = new Map<string, Promise<void>>()
+
+// Whether `promise` settles within `ms`, waited on that long at most.
+const within = (promise: Promise<unknown>, ms: number) => ms === Number.POSITIVE_INFINITY ? promise
+  : new Promise<void>(resolve => {
+    const timer = setTimeout(resolve, ms)
+    void promise.finally(() => { clearTimeout(timer); resolve() })
+  })
+
+// The pull requests squashed into `commits`, a merged pull request's merge
+// commit of one parent, not one rebased (its commits copied onto the branch,
+// told by their subjects), kept by each commit (`squashes`), those not yet
+// kept looked up with GraphQL, as many as MAX_SQUASH_LOOKUPS an answer, each
+// kept as it is found (lookUpSquashes). Answered with those kept once the
+// repository's lookup is done, or `waitMs` on, that lookup going on behind:
+// `behind`, one this started, for the caller to keep alive, and `pending`
+// while one does. Another's lookup done within it, but not of all of these,
+// those it left are looked up as this one's, within what is left of it.
+export async function squashedPulls(fullName: string, token: string, commits: HistoryCommit[], squashes: Squashes,
+  waitMs = Number.POSITIVE_INFINITY, fetchImpl: typeof fetch = globalThis.fetch): Promise<{ pulls: SquashedPull[]; pending: boolean; behind: Promise<void> | null }> {
+  const single = commits.filter(commit => commit.parents.length === 1)
+  const kept = await squashes.read(single.map(commit => commit.sha))
+  let unknown = single.filter(commit => !kept.has(commit.sha))
+  if (unknown.length === 0) return { pulls: single.flatMap(commit => kept.get(commit.sha) ?? []), pending: false, behind: null }
+  const listed = new Map(commits.map(commit => [commit.sha, commit]))
+  const deadline = Date.now() + waitMs
+  const found = new Map<string, SquashedPull | null>()
+  // Waited on, as long as is left, and those of `unknown` it kept found.
+  const settle = async (looking: Promise<void>) => {
+    await within(looking, Math.max(0, deadline - Date.now()))
+    for (const [sha, pull] of await squashes.read(unknown.map(commit => commit.sha))) found.set(sha, pull)
+    unknown = unknown.filter(commit => !found.has(commit.sha))
+  }
+  const another = lookingUp.get(fullName)
+  if (another) await settle(another)
+  let behind: Promise<void> | null = null
+  if (!another || (unknown.length > 0 && !lookingUp.has(fullName))) {
+    const lookup = lookUpSquashes(fullName, token, unknown.slice(0, MAX_SQUASH_LOOKUPS), listed, squashes, fetchImpl)
+    const done: Promise<void> = lookup.catch(() => {}).finally(() => { if (lookingUp.get(fullName) === done) lookingUp.delete(fullName) })
+    lookingUp.set(fullName, done)
+    behind = lookup
+    await settle(done)
+  }
+  return { pulls: single.flatMap(commit => kept.get(commit.sha) ?? found.get(commit.sha) ?? []), pending: lookingUp.has(fullName), behind }
+}
+
+// The pull requests squashed into `unknown`, of the commits `listed`, looked
+// up, each kept as it is found (squashedPulls).
+async function lookUpSquashes(fullName: string, token: string, unknown: HistoryCommit[], listed: Map<string, HistoryCommit>, squashes: Squashes,
+  fetchImpl: typeof fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const merged: { commit: HistoryCommit; number: number }[] = []
+  await inBatches(unknown, SQUASH_COMMITS, SQUASH_PARALLEL, async batch => {
+    const data = await githubGraphql(mergedPullsQuery(batch.length), { owner, name, ...Object.fromEntries(batch.map((commit, at) => [`o${at}`, commit.sha])) },
+      token, fetchImpl, notFound) as MergedPulls
+    for (const [at, commit] of batch.entries()) {
+      const node = data?.repository?.[`c${at}`]
+      if (!node) continue
+      const pull = node.associatedPullRequests?.nodes?.[0]
+      const number = pull?.mergeCommit?.oid === commit.sha && Number.isSafeInteger(pull.number) && (pull.number as number) > 0 ? pull.number as number : null
+      if (number === null) await squashes.write(commit.sha, null)
+      else merged.push({ commit, number })
+    }
+  })
+  await inBatches(merged, SQUASH_PULLS, SQUASH_PARALLEL, async batch => {
+    const data = await githubGraphql(squashedQuery(batch.length), { owner, name, ...Object.fromEntries(batch.map(({ number }, at) => [`n${at}`, number])) },
+      token, fetchImpl, notFound) as SquashedPage
+    await linkNoreplyUsers(Object.values(data?.repository ?? {}).flatMap(pull => (pull?.commits?.nodes ?? []).flatMap(item => commitActors(item?.commit))), token, fetchImpl)
+    for (const [at, { commit, number }] of batch.entries()) {
+      const node = data?.repository?.[`p${at}`]
+      if (!node) continue
+      const own = (node.commits?.nodes ?? []).flatMap(item => graphCommit(item?.commit) ?? [])
+      const head = typeof node.headRefOid === 'string' && SHA.test(node.headRefOid) ? node.headRefOid : own.at(-1)?.sha
+      // Fast-forwarded, its last commit the merge's own; or rebased, its
+      // commits, more than one, copied onto the branch: the merge and those
+      // below it on their first parents, by their subjects, its commits'
+      // (one squashed is told by its commit's title too, by default, and
+      // drawn as it was either way).
+      const below = [commit]
+      for (let next = listed.get(commit.parents[0] ?? ''); next && below.length < own.length; next = listed.get(next.parents[0] ?? '')) below.push(next)
+      const copies = own.toReversed().slice(0, below.length).every((item, step) => below[step]!.subject === item.subject)
+      // Its commits' copies as far as those listed go, but not all of them
+      // listed: told, and kept, once they are.
+      if (own.length > 1 && copies && below.length < own.length) continue
+      const rebased = own.length > 1 && copies
+      const squashed = head !== undefined && head !== commit.sha && own.length > 0 && !own.some(item => item.sha === commit.sha) && !rebased
+      await squashes.write(commit.sha, squashed ? { merge: commit.sha, number, head, commits: own, more: Number(node.commits?.totalCount) > own.length } : null)
+    }
+  })
+}

package/server-managed/request-timing.ts

@@ -0,0 +1,63 @@
+// Where a request's time goes, told back in its Server-Timing header, which
+// DevTools shows beside the request: the database's statements and the time
+// spent in its operations (sql.ts), new pooled connections and their
+// handshakes (db-neon.ts), GitHub's calls (github-app.ts githubJson), and
+// the whole, from the handler's start to its answer's head; an instance's
+// first request marked cold. Counts and durations alone, nothing of what was
+// asked; a streamed answer's head tells what was known as it was written.
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { ServerResponse } from 'node:http'
+
+interface Timing {
+  started: number
+  cold: boolean
+  statements: number
+  db: number; dbMs: number
+  conn: number; connMs: number
+  gh: number; ghMs: number
+}
+const requests = new AsyncLocalStorage<Timing>()
+let served = false
+
+// `work` timed, its response's head carrying what it spent where; a test's
+// stand-in for a response, not a ServerResponse, is left as it is.
+export function runTimed<T>(res: ServerResponse, work: () => T): T {
+  const timing: Timing = { started: performance.now(), cold: !served, statements: 0, db: 0, dbMs: 0, conn: 0, connMs: 0, gh: 0, ghMs: 0 }
+  served = true
+  if (res instanceof ServerResponse) {
+    const writeHead = res.writeHead
+    res.writeHead = function (this: ServerResponse, ...args: Parameters<ServerResponse['writeHead']>) {
+      if (!this.headersSent) this.setHeader('server-timing', header(timing))
+      return writeHead.apply(this, args)
+    } as ServerResponse['writeHead']
+  }
+  return requests.run(timing, work)
+}
+
+// `work`, its time counted as `kind`'s where a request is timed.
+export async function timed<T>(kind: 'db' | 'conn' | 'gh', work: () => Promise<T>): Promise<T> {
+  const timing = requests.getStore()
+  if (!timing) return work()
+  const start = performance.now()
+  try { return await work() } finally {
+    timing[kind]++
+    timing[`${kind}Ms`] += performance.now() - start
+  }
+}
+
+// A statement sent to the database, where a request is timed.
+export function countStatement(): void {
+  const timing = requests.getStore()
+  if (timing) timing.statements++
+}
+
+function header(timing: Timing): string {
+  const ms = (value: number) => value.toFixed(1)
+  return [
+    ...timing.db > 0 || timing.statements > 0 ? [`db;dur=${ms(timing.dbMs)};desc="${timing.statements} statements"`] : [],
+    ...timing.conn > 0 ? [`conn;dur=${ms(timing.connMs)}`] : [],
+    ...timing.gh > 0 ? [`gh;dur=${ms(timing.ghMs)};desc="${timing.gh} calls"`] : [],
+    ...timing.cold ? ['cold;desc="first request of this instance"'] : [],
+    `app;dur=${ms(performance.now() - timing.started)}`,
+  ].join(', ')
+}

package/server-managed/reviewed-dependencies.ts

@@ -64,8 +64,9 @@ export interface CommentReview {
   dependencies: { ecosystem?: 'npm'; name: string; version: string; integrity: string; patchHash?: string; status: ReviewVerdict }[]
 }
 // A version a dependency review is of, or compared it with: its package's
-// name, its version and integrity, and its tarball's shasum and its patch's
-// hash where they are known (a lockfile's, pnpm's patched dependencies').
+// name, its version, the integrity and, where npm tells one, the shasum of
+// its tarball, each held to the tarball reviewed, and its patch's hash where
+// it is known (pnpm's patched dependencies').
 export interface ReviewedVersion { name: string; version: string; integrity: string; shasum?: string; patchHash?: string }
 // One of one's own published dependency reviews, as `formatDependencyReviews`
 // is given it: the version it is of (`new`) and the one it compared it with

package/server-managed/session.ts

@@ -77,29 +77,51 @@ export async function createSession(
 // A request's sign-in, whose presence its first read to find it records.
 // Every read after it in that request (the rechecks after its reads of
 // storage, GitHub or npm among them) only reads: last_seen_at was written a
-// moment before, by the read that let the request in.
-const requests = new AsyncLocalStorage<{ seen: boolean }>()
+// moment before, by the read that let the request in. What the router's
+// gate read is handed to the read after it that says nothing was read
+// between them (`handed`), asking nothing again; once only, and to none
+// once another read came first.
+type SessionRead = { session: ManagedSession; user: StoredUser }
+const requests = new AsyncLocalStorage<{ seen: boolean; handed: { cookieHeader: string | undefined; read: SessionRead } | null }>()
 export function runRequestPresence<T>(work: () => T): T {
-  return requests.run({ seen: false }, work)
+  return requests.run({ seen: false, handed: null }, work)
+}
+export function handOverSession(cookieHeader: string | undefined, read: SessionRead): void {
+  const request = requests.getStore()
+  if (request) request.handed = { cookieHeader, read }
 }
 
 // Resolve the current session (+ user) from the request's cookies, or null.
 // A view cookie resolves only to that admin's view as another user: a view
 // that has ended never falls back to the admin's own session. `own` skips the
-// view and reads the signed-in session itself.
+// view and reads the signed-in session itself. `handed` takes the gate's
+// read, where it is this read's first since (handOverSession).
 export async function readSession(
-  config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined, now: number, { own = false } = {},
-): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined, now: number, { own = false, handed = false } = {},
+): Promise<SessionRead | null> {
+  const request = requests.getStore()
+  const given = request?.handed
+  if (request) request.handed = null
+  if (handed && !own && given && given.cookieHeader === cookieHeader) return given.read
+  const ids = sessionIds(config, cookieHeader, { own })
+  if (!ids) return null
+  const seen = request?.seen === true
+  const s = ids.viewer === null
+    ? await (seen ? db.getSessionWithUser : db.sessionWithUser)(ids.id, now)
+    : await (seen ? db.getViewSessionWithUser : db.viewSessionWithUser)(ids.id, ids.viewer, now)
+  if (s && request) request.seen = true
+  return s
+}
+
+// The sessions the request's cookies name, as readSession reads them: the
+// one acting (`id`), a view where an admin views as another user, with the
+// admin's own it is a view of (`viewer`); none signed out.
+export function sessionIds(config: ManagedConfig, cookieHeader: string | undefined, { own = false } = {}): { id: string; viewer: string | null } | null {
   const cookies = parseCookies(cookieHeader)
   const token = cookies.get(config.sessionCookieName)
   if (token == null || token === '') return null
   const view = own ? undefined : cookies.get(cookieName(config, VIEW_COOKIE))
-  const request = requests.getStore(), seen = request?.seen === true
-  const s = view != null && view !== ''
-    ? await (seen ? db.getViewSessionWithUser : db.viewSessionWithUser)(hashToken(view), hashToken(token), now)
-    : await (seen ? db.getSessionWithUser : db.sessionWithUser)(hashToken(token), now)
-  if (s && request) request.seen = true
-  return s
+  return view != null && view !== '' ? { id: hashToken(view), viewer: hashToken(token) } : { id: hashToken(token), viewer: null }
 }
 
 // Drop the session named by the request's cookie (logout). The caller also

package/server-managed/sql.ts

@@ -2,6 +2,7 @@
 // its single connection across awaits; Neon can reuse a request-owned connection.
 import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
 import type { ManagedDb } from './db-methods.ts'
+import { countStatement, timed } from './request-timing.ts'
 
 type MaybePromise<T> = T | Promise<T>
 export interface ManagedSql {
@@ -22,8 +23,12 @@ export interface ManagedSqlDriver extends ManagedSql {
 const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption', 'getTeam', 'getComment',
   'userCanReadReport', 'userCanReadRepo', 'userCanReadRepoPath', 'userCanReadBundle', 'reportPermissionsFor', 'listComments', 'listManagedIssues',
   'listTriageHistory', 'listUsers', 'listUserOptions', 'listActivityReports', 'getRepoFullName', 'getUser', 'getSessionWithUser', 'getViewSessionWithUser',
-  'listTriageFixes',
-  'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getUserTokens',
+  'listTriageFixes', 'getRepoDependencyReviews', 'listTeamDependencyReviews', 'getNpmReviewReader',
+  'listDependencyReviewTeams', 'listDependencyReviewEnabledTeams', 'listUserNpmScopes', 'listTeamNpmScopes', 'hasTeamNpmScope',
+  'listGithubMetadata', 'listGithubRepositoryVisibility', 'setGithubMetadata', 'recordGithubMetadataAttempts', 'setGithubRepositoryVisibility',
+  'listLinkReports', 'listLegacyLinkReports', 'listReportFilenamesWithBundleHash', 'listReportsForRepo', 'listBundlesForRepo',
+  'listFindingCatalogReports', 'userCanReadBundleAdvisories',
+  'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getBundleAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getAnnotationRevision', 'getUserTokens',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'getFirstUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
@@ -34,12 +39,13 @@ const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensu
 export function scopeManagedMethods(methods: ManagedDb, driver: ManagedSqlDriver): ManagedDb {
   const entries = Object.entries(methods).map(([name, method]) => {
     if (name === 'close') return [name, async () => { await driver.close() }]
-    const write = !/^(?:get|list|userCanRead|reportPermissionsFor)/u.test(name)
-    return [name, (...args: unknown[]) => driver.scope(write, () => method(...args), {
+    const write = !/^(?:get|list|has|userCanRead|reportPermissionsFor)/u.test(name)
+    // Each operation's time told in its request's Server-Timing (request-timing.ts).
+    return [name, (...args: unknown[]) => timed('db', () => driver.scope(write, () => method(...args), {
       // Presence writes only one user's timestamp; they need no application
       // writer lock. Keep the session/user read and timestamp in one transaction.
       lock: write && !UNLOCKED_WRITES.has(name), statement: SINGLE_STATEMENTS.has(name),
-    })]
+    }))]
   })
   return Object.fromEntries(entries) as ManagedDb
 }
@@ -56,17 +62,19 @@ export function createSqliteDriver(db: DatabaseSync): ManagedSqlDriver {
     prepare(sql) {
       const stmt = db.prepare(sql)
       return {
-        get: (...args) => stmt.get(...args as SQLInputValue[]),
-        all: (...args) => stmt.all(...args as SQLInputValue[]),
-        run: (...args) => stmt.run(...args as SQLInputValue[]),
+        get: (...args) => { countStatement(); return stmt.get(...args as SQLInputValue[]) },
+        all: (...args) => { countStatement(); return stmt.all(...args as SQLInputValue[]) },
+        run: (...args) => { countStatement(); return stmt.run(...args as SQLInputValue[]) },
       }
     },
     scope(write, work) {
       if (closed) return Promise.reject(new Error('Managed database is closed'))
       return enqueue(async () => {
+        countStatement()
         db.exec(write ? 'BEGIN IMMEDIATE' : 'BEGIN')
         try {
           const result = await work()
+          countStatement()
           db.exec('COMMIT')
           return result
         } catch (err) {

package/server-managed/storage-encryption.ts

@@ -4,7 +4,7 @@ import { Readable } from 'node:stream'
 import { type StorageKey, decryptStorageStream, encryptStorageStream, wrapStorageValue } from '../server-common/storage-crypto.ts'
 import { ENCRYPTED_CACHE_PREFIX, type ObjectStorage, type RawObject, type RawObjectStorage, deleteObjects, objectPath, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageRow, type StorageRowKind, dataKeyIdentity, unwrapDataKey } from './storage-db.ts'
-import { PUBLIC_CACHE_PREFIX, inspectStorageObject, storageOwner, storageRowPaths, verifyStoragePayload } from './storage-payload.ts'
+import { PUBLIC_CACHE_PREFIX, inspectStorageObject, masterKeyCache, storageOwner, storageRowPaths, verifyStoragePayload } from './storage-payload.ts'
 
 const STORAGE_WRITE_MS = 180_000
 export const STORAGE_UPLOAD_TTL_MS = 86_400_000
@@ -68,6 +68,12 @@ async function decryptOwned(stored: RawObject, key: StorageKey, type: StorageRow
 async function openEncrypted(raw: RawObjectStorage, db: StorageDb, key: StorageKey, identity: string, state: StorageEncryptionState): ReturnType<ObjectStorage['open']> {
   const owner = storageOwner(identity)
   if (!owner) {
+    // A cache no row owns: its ciphertext alone, what was kept as plaintext
+    // before activation never read.
+    if (masterKeyCache(identity)) {
+      const stored = await raw.open(encryptedCachePath(identity))
+      return stored && decryptStorageStream(stored.stream, key.bytes, identity)
+    }
     if (!identity.startsWith('uploads/')) throw new Error('Unknown managed storage owner')
     const stored = await raw.open(identity)
     if (!stored) return null
@@ -229,7 +235,7 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
         if (!row || (owner.cache ? !row.dataKey : !storageRowPaths(owner.type, row).includes(identity))) return false
       }
       // Existence is metadata only; open() authenticates the actual bytes.
-      return await raw.head(state && owner?.cache ? encryptedCachePath(identity) : identity) !== null
+      return await raw.head(state && (owner?.cache || masterKeyCache(identity)) ? encryptedCachePath(identity) : identity) !== null
     },
     async put(identity, bytes, { replaceReport = false } = {}) {
       logicalKey(identity)
@@ -248,10 +254,10 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
         dataKey = randomBytes(32)
         wrapped = wrapStorageValue(key!, dataKeyIdentity(owner.type, owner.id), dataKey)
       } else {
-        if (!identity.startsWith('uploads/')) throw new Error('Unknown managed storage owner')
+        if (!identity.startsWith('uploads/') && !masterKeyCache(identity)) throw new Error('Unknown managed storage owner')
         dataKey = Buffer.from(key!.bytes)
       }
-      const target = owner?.cache ? encryptedCachePath(identity) : identity
+      const target = owner?.cache || masterKeyCache(identity) ? encryptedCachePath(identity) : identity
       const encrypted = encryptStorageStream(Readable.from([bytes]), dataKey, identity, bytes.length)
       try {
         await raw.put(target, encrypted, AbortSignal.timeout(STORAGE_WRITE_MS), undefined, bytes.length)
@@ -268,13 +274,15 @@ export async function createEncryptedObjectStorage(raw: RawObjectStorage, db: St
       // when migration is disabled or another instance has just enabled it.
       for (const target of deletionPaths(identity)) await raw.delete(target)
     },
-    async deletePrefix(prefix) {
+    async deletePrefix(prefix, keep) {
       logicalKey(`${prefix}validate`)
-      if (!prefix.endsWith('/')) throw new Error('Invalid storage prefix')
+      if (!prefix.endsWith('/') || (keep !== undefined && (!keep.startsWith(prefix) || !keep.endsWith('/')))) throw new Error('Invalid storage prefix')
       await mode()
       const signal = AbortSignal.timeout(STORAGE_WRITE_MS)
-      for (const target of deletionPaths(prefix)) {
-        await deleteObjects(raw, target, signal)
+      // What is kept, in the same generation as each removed.
+      const kept = keep === undefined ? [] : deletionPaths(keep)
+      for (const [i, target] of deletionPaths(prefix).entries()) {
+        await deleteObjects(raw, target, signal, undefined, kept[i])
         await raw.prune?.(target, signal)
       }
     },

package/server-managed/storage-maintenance.ts

@@ -3,7 +3,7 @@ import { type StorageKey, decryptStorageStream, encryptStorageStream } from '../
 import { ENCRYPTED_CACHE_PREFIX, type RawObjectStorage, deleteObjects, isBlobId, openObjectVersion } from './object-storage.ts'
 import { type StorageDb, type StorageEncryptionState, type StorageMigrationRow, type StorageRow, type StorageRowKind, unwrapDataKey } from './storage-db.ts'
 import { STORAGE_UPLOAD_TTL_MS } from './storage-encryption.ts'
-import { StoragePayloadError, inspectStorageObject, storageOwner, storageRowPaths, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
+import { StoragePayloadError, inspectStorageObject, masterKeyCache, storageOwner, storageRowPaths, verifiedStoragePayload, verifyStoragePayload } from './storage-payload.ts'
 
 async function replacementFailure(raw: RawObjectStorage, identity: string, version: string, signal: AbortSignal): Promise<string> {
   const format = (value: string) => value.startsWith('W/') ? 'weak' : value.startsWith('"') && value.endsWith('"') ? 'quoted' : 'unquoted'
@@ -113,7 +113,10 @@ function cleanupTarget(identity: string) {
   const path = temporary ? temp![1]! : identity
   const encryptedCache = path.startsWith(ENCRYPTED_CACHE_PREFIX)
   if (encryptedCache && !temporary) return null
-  const owner = storageOwner(encryptedCache ? `cache/${path.slice(ENCRYPTED_CACHE_PREFIX.length)}` : path)
+  const logical = encryptedCache ? `cache/${path.slice(ENCRYPTED_CACHE_PREFIX.length)}` : path
+  // A cache no row owns is a cache all the same: its plaintext legacy, and
+  // its temporary files removed past the staging window.
+  const owner = storageOwner(logical) ?? (masterKeyCache(logical) ? { cache: true as const } : null)
   return owner ? { owner, temporary } : null
 }
 

package/server-managed/storage-payload.ts

@@ -19,6 +19,24 @@ export function storageRowPaths(type: StorageRowKind, row: Pick<StorageRow, 'id'
 // are: public npm versions' pretty-printed files (pretty-print.ts).
 export const PUBLIC_CACHE = 'npm'
 export const PUBLIC_CACHE_PREFIX = `cache/${PUBLIC_CACHE}/`
+// A cache of private content no row owns: the code viewer's directories at
+// repositories' default branches' heads (repository-code.ts
+// repositoryCodeKept), by repository. Plaintext while storage is not
+// encrypted, as other caches are; once it is, kept apart under
+// ENCRYPTED_CACHE_PREFIX as a bundle's caches are, so that what was kept
+// before is never read and legacy cleanup removes it, and encrypted with the
+// master key, as upload parts are, each write's key derived from its path,
+// so that one path's ciphertext fails to authenticate at another. No storage
+// row holds a repository's code for a data key of its own to be wrapped in:
+// its selection is none, and stays as it is deactivated. A key of its own
+// would add a column and its migration only for its deletion to make what is
+// left unreadable at once, as a deleted bundle's caches are; here deletion
+// is physical, by the repository's prefix, at best, as an upload part's is,
+// and what a failed one leaves is a directory as GitHub has it at a commit,
+// read only by a reader GitHub lets read that repository.
+export const REPOSITORY_CODE_CACHE = 'repository-code'
+const REPOSITORY_CODE_CACHE_PREFIX = `cache/${REPOSITORY_CODE_CACHE}/`
+export const masterKeyCache = (identity: string) => identity.startsWith(REPOSITORY_CODE_CACHE_PREFIX)
 export function storageOwner(identity: string): { type: StorageRowKind; id: string; cache: boolean } | null {
   const match = /^(reports|bundles)\/([^/]+)$/u.exec(identity)
   if (match) {

package/server-managed/storage-stores.ts

@@ -8,7 +8,7 @@ import { createBundleStore } from './bundle-store.ts'
 import { createReportStore } from './report-store.ts'
 import { CacheMissError, type CacheStorage, validateCacheKey } from './cache-storage.ts'
 import { type ObjectStorage, isBlobId } from './object-storage.ts'
-import { PUBLIC_CACHE } from './storage-payload.ts'
+import { PUBLIC_CACHE, REPOSITORY_CODE_CACHE } from './storage-payload.ts'
 
 function id(value: string): string {
   if (!isBlobId(value)) throw new Error('Invalid managed blob id')
@@ -35,7 +35,7 @@ function cacheStore(objects: ObjectStorage, name: string): CacheStorage {
       if (!value) throw new CacheMissError()
       return value
     },
-    delete: prefix => objects.deletePrefix(`${path(prefix)}/`),
+    delete: (prefix, keep) => objects.deletePrefix(`${path(prefix)}/`, keep === undefined ? undefined : `${path(`${prefix}/${keep}`)}/`),
   }
 }
 
@@ -86,5 +86,6 @@ export function createManagedStores(objects: ObjectStorage, avatarSidecar: boole
     cacheStorage,
     reportSourcesStorage: cacheStore(objects, 'report-sources'),
     npmCacheStorage: cacheStore(objects, PUBLIC_CACHE),
+    repositoryCodeStorage: cacheStore(objects, REPOSITORY_CODE_CACHE),
   }
 }

package/server-managed/team-feed.ts

@@ -2,7 +2,7 @@ import type { ServerResponse } from 'node:http'
 import { setTimeout as delay } from 'node:timers/promises'
 import type { ManagedHttpDeps } from './http.ts'
 import type { StoredUser, TeamReportAccessSnapshot } from './db.ts'
-import { TeamReportsError, teamSnapshotKey, teamWorkspaceFindingIds } from './team-reports.ts'
+import { TeamReportsError, annotationRevisionDigest, teamAnnotationRevision, teamSnapshotKey, teamWorkspaceFindingIds } from './team-reports.ts'
 import type { WorkspaceShareFeedState } from './workspace-shares.ts'
 
 // Short database reads work across instances without pinning a Neon connection.
@@ -49,7 +49,7 @@ export async function serveTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
 export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDeps,
   sessionId: string, user: StoredUser, teamId: string | null, options: FeedOptions & { reportId?: string | null } = {}): Promise<void> {
   let ids: string[] = [], visibilityKey: string | undefined
-  let focusedKey: string | undefined
+  let focused: TeamReportAccessSnapshot | undefined
   let previousState: { catalog: number; annotations: number } | undefined
   const checkUser = (current: { user: Pick<StoredUser, 'id' | 'role'> } | null) => {
     if (!current) throw new TeamReportsError(401, 'unauthenticated')
@@ -61,10 +61,10 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
     const state = await deps.db.getFeedState(sessionId, Date.now())
     checkUser(state)
     if (state!.catalog === previousState?.catalog && (!teamId || state!.annotations === previousState?.annotations)) return
-    if (teamId && focusedKey !== undefined && state!.catalog === previousState?.catalog) {
+    if (teamId && focused !== undefined && state!.catalog === previousState?.catalog) {
       // Annotation changes cannot change visibility. Read only this workspace's
       // IDs, then fence against concurrent access/content changes before sending.
-      const triage = JSON.stringify([focusedKey, await deps.db.getAnnotationRevision(ids)])
+      const triage = await teamAnnotationRevision(deps.db, focused, ids)
       const after = await deps.db.getFeedState(sessionId, Date.now())
       checkUser(after)
       if (after!.catalog !== state!.catalog) return
@@ -103,29 +103,34 @@ export async function serveUserTeamFeed(res: ServerResponse, deps: ManagedHttpDe
         return
       }
     }
-    if (snapshot.teamId) triage = JSON.stringify([key, await deps.db.getAnnotationRevision(ids)])
+    // As GET /api/teams/:id/annotations answers it, so that a client holding
+    // that answer knows this tells nothing new.
+    if (snapshot.teamId) triage = await teamAnnotationRevision(deps.db, snapshot, ids)
     const current = await deps.db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, options.reportId)
     // A concurrent access/content change discards only the annotation read.
     checkUser(current)
     if (!current || teamSnapshotKey(current) !== key) return
     publish('triage', triage)
-    focusedKey = snapshot.teamId ? key : undefined
+    focused = snapshot.teamId ? snapshot : undefined
     const after = await deps.db.getFeedState(sessionId, Date.now())
     checkUser(after)
     if (after!.catalog === state!.catalog && after!.annotations === state!.annotations) previousState = state!
-  }, options)
+  }, { ...options, triageRevision: true })
 }
 
+// With `triageRevision`, a triage event tells its revision's digest, as the
+// focused team's annotations answer it; else none, as a public share's.
 async function serveFeed(res: ServerResponse, deps: ManagedHttpDeps, read: (publish: Publish) => Promise<void>,
-  { pollMs = TEAM_FEED_POLL_MS, lifetimeMs = TEAM_FEED_LIFETIME_MS }: FeedOptions): Promise<void> {
+  { pollMs = TEAM_FEED_POLL_MS, lifetimeMs = TEAM_FEED_LIFETIME_MS, triageRevision = false }: FeedOptions & { triageRevision?: boolean }): Promise<void> {
   const controller = new AbortController()
   const close = () => controller.abort()
   res.once('close', close)
   const deadline = setTimeout(close, lifetimeMs)
   const stopped = () => controller.signal.aborted || res.destroyed || deps.isShuttingDown()
   // Notifications carry no annotation bodies, finding IDs, or global cursors.
-  // The catalog's opaque version lets clients reuse an identical REST snapshot;
-  // every connection still confirms current access, including after reconnects.
+  // The catalog's opaque version, and a focused team's annotation revision's
+  // digest, let clients reuse an identical REST snapshot; every connection
+  // still confirms current access, including after reconnects.
   function write(frame: string): boolean {
     if (stopped()) return false
     if (res.write(frame)) return true
@@ -145,7 +150,7 @@ async function serveFeed(res: ServerResponse, deps: ManagedHttpDeps, read: (publ
       if (stopped()) return false
       if (revision === undefined) { previous.delete(event); return true }
       if (revision === previous.get(event)) return true
-      const data = event === 'teams' ? JSON.stringify({ revision }) : '{}'
+      const data = event === 'teams' ? JSON.stringify({ revision }) : triageRevision ? JSON.stringify({ revision: annotationRevisionDigest(revision) }) : '{}'
       if (!write(`event: ${event}\ndata: ${data}\n\n`)) return false
       previous.set(event, revision)
       heartbeat = Date.now()

package/server-managed/team-npm-scopes.ts

@@ -2,6 +2,8 @@
 // scope's private packages in the npm viewer (npm-packages.ts), as admins and
 // managers may read any. Hidden teams grant nothing, as for their content.
 import { MAX_TEAM_NPM_SCOPES, normalizeNpmScope } from '../common/managed/npm-packages.js'
+import type { Role } from '../common/managed/roles.ts'
+import { gathered, reviewsIn } from './dependency-reviews.ts'
 import { ManagedMutationError } from './management.ts'
 import type { ManagedSql } from './sql.ts'
 
@@ -23,7 +25,15 @@ export interface TeamNpmScopeStore {
   // Whether any visible team lists the scope: whoever reads its packages,
   // they are the instance's own, whose new releases aren't flagged (http.ts).
   hasTeamNpmScope(scope: string): Promise<boolean>
+  // Who session `sessionId` names now, as readSession reads it, their own
+  // or, where `viewerSessionId` names an admin's own one, a view of it: their
+  // role, the scopes their teams list (listUserNpmScopes), and whether they
+  // read the dependency reviews published to team `teamId`
+  // (dependency-reviews.ts reviewsIn); in one statement, as a list of a
+  // team's reviews asks again once npm is read. Null where it names none.
+  getNpmReviewReader(sessionId: string, viewerSessionId: string | null, now: number, teamId: string): Promise<NpmReviewReader | null>
 }
+export interface NpmReviewReader { id: string; role: Role; scopes: string[]; readsTeam: boolean }
 
 // Each distinct scope, normalized; a list with one npm could not publish
 // under, or too many, is refused whole.
@@ -68,6 +78,7 @@ export function teamNpmScopeMethods(db: ManagedSql): TeamNpmScopeStore {
         WHERE tu.user_id = ? ORDER BY ns.scope`).all(userId) as { scope: string }[]
       return rows.map(row => row.scope)
     },
+    getNpmReviewReader: (sessionId, viewerSessionId, now, teamId) => npmReviewReader(db, sessionId, viewerSessionId, now, teamId),
     async hasTeamNpmScope(scope) {
       return !!await db.prepare(`SELECT 1 AS listed FROM managed_team_npm_scope ns
         JOIN managed_team t ON t.id = ns.team_id AND t.hidden = 0
@@ -75,3 +86,21 @@ export function teamNpmScopeMethods(db: ManagedSql): TeamNpmScopeStore {
     },
   }
 }
+
+// getNpmReviewReader's statement, its session held to what readSession's
+// own are (db-methods.ts selectOwnSessionStmt, selectViewSessionStmt).
+async function npmReviewReader(db: ManagedSql, sessionId: string, viewerSessionId: string | null, now: number, teamId: string): Promise<NpmReviewReader | null> {
+  const row = await db.prepare(`WITH reader AS (
+      SELECT u.id AS id, u.role AS role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ? AND ((? IS NULL AND s.viewer_session IS NULL) OR (s.viewer_session = ? AND EXISTS (
+        SELECT 1 FROM managed_session p JOIN managed_user a ON a.id = p.user_id
+        WHERE p.id = s.viewer_session AND p.expires_at > ? AND p.viewer_session IS NULL AND a.role = 'admin')))
+    )
+    SELECT v.id AS id, v.role AS role,
+      (SELECT json_group_array(x.scope ORDER BY x.scope) FROM (SELECT DISTINCT ns.scope AS scope FROM managed_team_user tu
+        JOIN managed_team t ON t.id = tu.team_id AND t.hidden = 0 JOIN managed_team_npm_scope ns ON ns.team_id = tu.team_id
+        WHERE tu.user_id = v.id) x) AS scopes,
+      CASE WHEN EXISTS (SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = v.id WHERE t.id = ? AND ${reviewsIn(false)}) THEN 1 ELSE 0 END AS readsTeam
+    FROM reader v`).get(sessionId, now, viewerSessionId, viewerSessionId, now, teamId) as { id: string; role: Role; scopes: unknown; readsTeam: unknown } | undefined
+  return row ? { id: row.id, role: row.role, scopes: gathered<string>(row.scopes), readsTeam: Number(row.readsTeam) === 1 } : null
+}