@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/team-reports.ts

@@ -0,0 +1,307 @@
+// Team content is filtered as one workspace, with separate report envelopes.
+// Bounded snapshots retain filtered content and visibility for repeated reads.
+import { mergeLinkGroups } from './link-reports.ts'
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { backfillFindingIds, reportEntries, stampSecurityGroups } from '@preventive/report'
+import { managedFindingSourcePaths, readManagedReport } from '../common/managed/report-content.ts'
+import { filterReportData, projectFinding } from '../common/managed/report-filter.ts'
+import { revalidationLinks, securityLinks } from '../common/security-links.js'
+import { treeDependencyDirectory } from '../client/dependency-paths.js'
+import { liteReportData } from '../common/managed/finding-detail.js'
+import type { BlobStore } from './blob-store.ts'
+import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
+import { triageWireEntry } from './triage-response.ts'
+import { visibleManagedIssues } from './managed-issues.ts'
+import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
+
+type Finding = Record<string, unknown>
+type TeamReport = { id: string; filename: string; data: unknown; repo: { github: string | null; directory: string } }
+type ReportVisibility = { ids: Set<string>; sourcePaths: Set<string> }
+type Visibility = Map<string, ReportVisibility>
+const VISIBILITY_CACHE_MAX_ITEMS = 250_000
+const VISIBILITY_CACHE_MAX_SNAPSHOTS = 32
+const caches = new WeakMap<ManagedDb, Map<string, Visibility>>()
+const REPORT_CACHE_BYTES = 16 * 1024 * 1024
+// A workspace's encoded reports, the same without their findings' detail for
+// the board (`lite`), and its reports' file trees apart.
+type EncodedWorkspace = { reports: Buffer; lite: Buffer; trees: Buffer }
+export type TeamResponsePart = keyof EncodedWorkspace
+// The part a team's `reports` or `trees` route asks for.
+export const teamResponsePart = (route: string, url: URL): TeamResponsePart =>
+  route === 'trees' ? 'trees' : url.searchParams.get('lite') === '1' ? 'lite' : 'reports'
+const reportCaches = new WeakMap<ManagedDb, Map<string, EncodedWorkspace>>()
+const encodedBytes = ({ reports, lite, trees }: EncodedWorkspace) => reports.length + lite.length + trees.length
+// A workspace's report reads at once. Its reports' sizes are bounded together
+// before any is read, and each is held parsed till the build ends, so more at
+// once costs only the raw bytes in flight: a cold build of a team's reports
+// is so many storage round trips one after another.
+const WORKSPACE_READS_AT_ONCE = 16
+function retainReports(db: ManagedDb, key: string, encoded: EncodedWorkspace) {
+  if (encodedBytes(encoded) > REPORT_CACHE_BYTES) return
+  let cache = reportCaches.get(db)
+  if (!cache) { cache = new Map(); reportCaches.set(db, cache) }
+  cache.delete(key)
+  let total = encodedBytes(encoded) + [...cache.values()].reduce((sum, value) => sum + encodedBytes(value), 0)
+  for (const [oldest, value] of cache) {
+    if (total <= REPORT_CACHE_BYTES && cache.size < VISIBILITY_CACHE_MAX_SNAPSHOTS) break
+    cache.delete(oldest); total -= encodedBytes(value)
+  }
+  cache.set(key, encoded)
+}
+function visibilityWeight(visible: Visibility): number {
+  return [...visible.values()].reduce((sum, v) => sum + v.ids.size + v.sourcePaths.size, 0)
+}
+function retainVisibility(db: ManagedDb, key: string, visible: Visibility): void {
+  let cache = caches.get(db)
+  // Replacement contributes its weight once and does not evict a peer merely
+  // because the cache already holds the maximum number of snapshots.
+  cache?.delete(key)
+  const incoming = visibilityWeight(visible)
+  if (incoming > VISIBILITY_CACHE_MAX_ITEMS) return
+  if (!cache) { cache = new Map(); caches.set(db, cache) }
+  let total = incoming + [...cache.values()].reduce((sum, entry) => sum + visibilityWeight(entry), 0)
+  for (const [oldest, entry] of cache) {
+    if (cache.size < VISIBILITY_CACHE_MAX_SNAPSHOTS && total <= VISIBILITY_CACHE_MAX_ITEMS) break
+    cache.delete(oldest)
+    total -= visibilityWeight(entry)
+  }
+  cache.set(key, visible)
+}
+export class TeamReportsError extends Error {
+  status: number
+  constructor(status: number, error: string) { super(error); this.status = status }
+}
+export function teamSnapshotKey(snapshot: TeamReportAccessSnapshot): string {
+  return JSON.stringify([snapshot.user.id, snapshot.user.role, snapshot.teamId, snapshot.hiddenReportId ?? null, snapshot.reports, snapshot.repositories, snapshot.linkRevision])
+}
+// What a built workspace is kept by: everything its build reads, and nothing
+// of who asked. A user's role and grants decide which reports (and which
+// hidden preview) their snapshot holds and each one's permissions, all of it
+// in the key, so members whose snapshots agree share one build.
+function workspaceKey(snapshot: TeamReportAccessSnapshot): string {
+  return JSON.stringify([snapshot.teamId, snapshot.hiddenReportId ?? null, snapshot.reports, snapshot.repositories, snapshot.linkRevision])
+}
+export async function teamSnapshot(db: ManagedDb, sessionId: string, teamId: string, reportId: string | null = null): Promise<TeamReportAccessSnapshot> {
+  const snapshot = await db.getTeamReportAccessSnapshot(sessionId, Date.now(), teamId, reportId)
+  if (!snapshot) throw new TeamReportsError(401, 'unauthenticated')
+  if (!snapshot.teamId) throw new TeamReportsError(404, 'no-team')
+  if (reportId !== null && !snapshot.reports.some(report => report.id === reportId)) throw new TeamReportsError(404, 'no-report')
+  return snapshot
+}
+export async function recheckTeam(db: ManagedDb, sessionId: string, snapshot: TeamReportAccessSnapshot): Promise<void> {
+  if (teamSnapshotKey(await teamSnapshot(db, sessionId, snapshot.teamId!, snapshot.reportId)) !== teamSnapshotKey(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
+}
+function groupsOf(data: unknown): Finding[][] {
+  return (reportEntries(data) ?? []).map(entry => (Array.isArray(entry) ? entry : [entry]).filter(
+    (finding): finding is Finding => finding !== null && typeof finding === 'object' && !Array.isArray(finding),
+  ))
+}
+function linksOf(data: unknown): string[][] | null {
+  const record = data as { source?: string; links?: string[][] }
+  if (record?.source !== 'links' || !Array.isArray(record.links)) return null
+  if (!record.links.every(ids => Array.isArray(ids) && ids.every(id => typeof id === 'string'))) throw new TeamReportsError(422, 'unreadable-links')
+  return record.links
+}
+// A report's file tree goes apart, asked for by its graph or Files alone
+// (loadTeamTreesResponse). The report tells in its place how many files it
+// holds (`treeFiles`) and the dependency directory it names
+// (`treeDependencies`), which classifies findings as the tree itself would
+// (client/dependency-paths.js). Each file's is sent without the hash of its
+// tree (`treeHash`), which no team view reads.
+function withoutTree(report: TeamReport): string | null {
+  const tree = (report.data as { tree?: unknown } | null)?.tree
+  if (!tree || typeof tree !== 'object' || Array.isArray(tree)) return null
+  const { tree: _tree, ...data } = report.data as Finding
+  const named = treeDependencyDirectory(tree)
+  report.data = { ...data, treeFiles: Object.keys(tree).length, ...(named ? { treeDependencies: named } : {}) }
+  const files = Object.entries(tree).map(([file, entry]) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return [file, entry]
+    const { treeHash: _treeHash, ...kept } = entry as Finding
+    return [file, kept]
+  })
+  return `${JSON.stringify(report.id)}:${JSON.stringify(Object.fromEntries(files))}`
+}
+async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<EncodedWorkspace & { visible: Visibility }> {
+  if (snapshot.reports.length > MAX_REPORT_QUERY_COUNT || snapshot.reports.reduce((n, r) => n + r.byteSize, 0) > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+  const reports: TeamReport[] = []
+  let inputBytes = 0, next = 0
+  // Bound both remote reads and raw buffers, retaining stable report order for
+  // the cross-report classification that follows. Finish workers on failure.
+  const results = await Promise.allSettled(Array.from({ length: Math.min(WORKSPACE_READS_AT_ONCE, snapshot.reports.length) }, async () => {
+    while (next < snapshot.reports.length) {
+      const index = next++
+      const access = snapshot.reports[index]!
+
+      const bytes = await store.get(access.id)
+      if (!bytes) throw new TeamReportsError(503, 'unavailable')
+      inputBytes += bytes.length
+      if (inputBytes > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+      const parsed = readManagedReport(bytes.toString('utf8'), access.filename)
+      if (!parsed.data) throw new TeamReportsError(422, 'unreadable-report')
+      // Backfill before filtering so links, annotations and the client agree on
+      // IDs even when hiding a component would change the original row shape.
+      await backfillFindingIds(groupsOf(parsed.data).flat())
+      reports[index] = { id: access.id, filename: access.filename, data: parsed.data, repo: access.repo }
+    }
+  }))
+  for (const result of results) if (result.status === 'rejected') throw result.reason
+  const globalLinks = snapshot.linkRevision ? await db.getEnabledLinkGroups(snapshot.linkRevision) : []
+  const groups = reports.flatMap(report => groupsOf(report.data).map(group => group.map(f => projectFinding(f, report.data as Finding)!)))
+  // Unknown IDs can connect known findings. App findings link to the inputs
+  // they revalidated in other reports, as the App view counts them.
+  stampSecurityGroups(groups, { linkedIds: securityLinks([
+    ...globalLinks, ...reports.flatMap(report => linksOf(report.data) ?? []), ...revalidationLinks(groups.flat()),
+  ]).linkedIds })
+  const securityIds = new Set(groups.flat().filter(f => f['isSecurity'] === true).map(f => String(f['id'])))
+  const allIds = new Set<string>(), visible: Visibility = new Map()
+  for (let i = 0; i < reports.length; i++) {
+    const access = snapshot.reports[i]!, report = reports[i]!
+    report.data = filterReportData(report.data, access.permissions, access.repo, securityIds)
+    const ids = new Set<string>()
+    for (const finding of groupsOf(report.data).flat()) {
+      // Preserve linked security classification for the UI lens, including a
+      // linked component that a dependency permission will hide from the UI.
+      finding['isSecurity'] = securityIds.has(String(finding['id']))
+      // The hash of its file's tree, which nothing a team view shows reads.
+      delete finding['treeHash']
+      if (typeof finding['id'] === 'string') { ids.add(finding['id']); allIds.add(finding['id']) }
+    }
+    visible.set(report.id, { ids, sourcePaths: managedFindingSourcePaths(groupsOf(report.data).flat()) })
+  }
+  for (const report of reports) {
+    const links = linksOf(report.data)
+    // Hidden previews are independently authorized; preserve a hidden links
+    // document even though its referenced findings are outside this response.
+    if (links && !snapshot.hiddenReportId) report.data = { source: 'links', findings: [], links: links.map(ids => [...new Set(ids.filter(id => allIds.has(id)))]).filter(ids => ids.length >= 2) }
+  }
+  const trees = Buffer.from(`{"trees":{${reports.map(withoutTree).filter(tree => tree !== null).join(',')}}}`)
+  const links = mergeLinkGroups(globalLinks, allIds)
+  const encoded = {
+    // Bounded together, as when the trees were sent with their reports.
+    reports: encodeReports(reports, links, trees.length),
+    // The board's, its findings without their detail (common/managed/finding-detail.js).
+    lite: encodeReports(reports.map(report => ({ ...report, data: liteReportData(report.data) })), links, 0),
+    trees,
+  }
+  retainVisibility(db, workspaceKey(snapshot), visible)
+  retainReports(db, workspaceKey(snapshot), encoded)
+  return { ...encoded, visible }
+}
+// `{ reports, links }` as a response sends them, `spent` bytes already
+// counted against the bound.
+function encodeReports(reports: readonly TeamReport[], links: readonly string[][], spent: number): Buffer {
+  let outputBytes = spent + 14
+  const parts = [Buffer.from('{"reports":[')]
+  for (const [index, report] of reports.entries()) {
+    const bytes = Buffer.from(JSON.stringify(report))
+    outputBytes += bytes.length + 1
+    if (outputBytes > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+    if (index) parts.push(Buffer.from(','))
+    parts.push(bytes)
+  }
+  const suffix = Buffer.from(links.length > 0 ? `],"links":${JSON.stringify(links)}}` : ']}')
+  if (outputBytes + suffix.length > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
+  parts.push(suffix)
+  return Buffer.concat(parts)
+}
+const pendingWorkspaces = new WeakMap<ManagedDb, Map<string, ReturnType<typeof buildTeamWorkspace>>>()
+async function loadTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot) {
+  let pending = pendingWorkspaces.get(db)
+  if (!pending) { pending = new Map(); pendingWorkspaces.set(db, pending) }
+  const key = workspaceKey(snapshot)
+  const existing = pending.get(key)
+  if (existing) return existing
+  const job = buildTeamWorkspace(db, store, snapshot)
+  pending.set(key, job)
+  try { return await job } finally { pending.delete(key) }
+}
+// Treat the encoded body as immutable and recheck access before sending it.
+// Warm HTTP reads need neither a parsed copy nor another serialization pass.
+// Its `lite` reports and its `trees`, by report ID (withoutTree), are of the
+// same snapshot and take the same recheck.
+export async function loadTeamReportsResponse(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot,
+  part: TeamResponsePart = 'reports'): Promise<Buffer> {
+  const cached = reportCaches.get(db)?.get(workspaceKey(snapshot))
+  return cached?.[part] ?? (await loadTeamWorkspace(db, store, snapshot))[part]
+}
+export async function loadTeamReports(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<TeamReport[]> {
+  // Object consumers get their own copy, including when sharing a cold load.
+  const body = await loadTeamReportsResponse(db, store, snapshot)
+  return (JSON.parse(body.toString('utf8')) as { reports: TeamReport[] }).reports
+}
+async function teamVisibility(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Visibility> {
+  let visible = caches.get(db)?.get(workspaceKey(snapshot))
+  if (!visible) {
+    // A large snapshot may deliberately remain uncached, or be evicted by
+    // another request. Authorization uses this load's result in either case.
+    visible = (await loadTeamWorkspace(db, store, snapshot)).visible
+  }
+  return visible
+}
+export async function teamWorkspaceFindingIds(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Set<string>> {
+  const ids = new Set<string>()
+  for (const report of (await teamVisibility(db, store, snapshot)).values()) for (const id of report.ids) ids.add(id)
+  return ids
+}
+
+// What a focused team's annotations are at, for the snapshot reading them, as
+// its feed tells it (team-feed.ts serveUserTeamFeed) and its annotations
+// answer it (loadTeamAnnotations): the snapshot's key and the revision of
+// every visible finding's annotations (getAnnotationRevision), its workspace's
+// findings being `ids` (teamWorkspaceFindingIds).
+export async function teamAnnotationRevision(db: ManagedDb, snapshot: TeamReportAccessSnapshot, ids: readonly string[]): Promise<string> {
+  return JSON.stringify([teamSnapshotKey(snapshot), await db.getAnnotationRevision(ids)])
+}
+
+// A revision as the client is told it: a digest, telling only whether what it
+// covers changed, none of the finding IDs, batches or issues it is read from.
+export const annotationRevisionDigest = (revision: string): string => createHash('sha256').update(revision).digest('base64url')
+export async function teamReportVisibility(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot, reportId: string): Promise<ReportVisibility> {
+  if (!snapshot.reports.some(r => r.id === reportId)) throw new TeamReportsError(404, 'no-report')
+  const visible = await teamVisibility(db, store, snapshot)
+  return visible.get(reportId)!
+}
+// A report's visibility for the session's current snapshot. A workspace built
+// (or waited for) here outlives that snapshot's read, so the team's access is
+// read again after it; one kept is answered with no read in between, which
+// leaves nothing for another snapshot read to guard.
+async function sessionReportVisibility(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<ReportVisibility> {
+  const snapshot = await teamSnapshot(db, sessionId, teamId, reportId)
+  const kept = caches.get(db)?.get(workspaceKey(snapshot))?.get(reportId)
+  if (kept) return kept
+  const visible = await teamReportVisibility(db, store, snapshot, reportId)
+  await recheckTeam(db, sessionId, snapshot)
+  return visible
+}
+export async function teamFindingIds(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
+  return (await sessionReportVisibility(db, store, sessionId, teamId, reportId)).ids
+}
+export async function teamSourcePaths(db: ManagedDb, store: BlobStore, sessionId: string, teamId: string, reportId: string): Promise<Set<string>> {
+  return (await sessionReportVisibility(db, store, sessionId, teamId, reportId)).sourcePaths
+}
+
+// Serialize shared annotation bodies once. Reports carry only the annotated
+// finding IDs visible in that report; callers revalidate access before sending.
+// With them, the digest of the revision the whole workspace's are at, as the
+// team's feed tells it (`revision`), read before them: a write between leaves
+// it older than what is sent, so the feed's next differs and the client reads
+// again, never the reverse.
+export async function loadTeamAnnotations(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot, reportId: string | null = null) {
+  // Restrict annotation reads only after classifying the complete workspace:
+  // links and findings in other reports can affect this report's visibility.
+  if (reportId !== null && !snapshot.reports.some(r => r.id === reportId)) throw new TeamReportsError(404, 'no-report')
+  const workspace = await teamVisibility(db, store, snapshot)
+  const visible = reportId === null ? workspace : new Map([[reportId, workspace.get(reportId)!]])
+  const all = new Set<string>(), ids = new Set<string>()
+  for (const report of visible.values()) for (const id of report.ids) ids.add(id)
+  for (const report of workspace.values()) for (const id of report.ids) all.add(id)
+  const revision = await teamAnnotationRevision(db, snapshot, [...all])
+  const { triage, comments, issues: savedIssues } = await db.getAnnotations([...ids])
+  const issues = Object.fromEntries(visibleManagedIssues(savedIssues, snapshot)
+    .map(issue => [issue.findingId, { url: issue.issueUrl!, autoFix: issue.autoFixUrl }]))
+  const entries = Object.fromEntries(triage.map(row => [row.findingId, triageWireEntry(row)]))
+  const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId), ...Object.keys(issues)])
+  const reports = Object.fromEntries([...visible].map(([id, report]) => [id, [...report.ids].filter(finding => annotated.has(finding))]))
+  return { reports, entries, comments, issues, revision: annotationRevisionDigest(revision) }
+}

package/server-managed/triage-response.ts

@@ -0,0 +1,16 @@
+import type { TriageRow } from './db.ts'
+import { type TriageEntryPatch, isTriageBucket } from '../common/managed/triage.ts'
+
+// A stored triage row (current state or a trail event) → its wire entry: only
+// set fields present, `false` kept for flagged (the explicit un-flag tombstone
+// must round-trip), and null for the row of a cleared entry (every field
+// null) — the reader adopts the clear.
+export function triageWireEntry(row: Pick<TriageRow, 'color' | 'triage' | 'comment' | 'fix' | 'flagged'>, legacyHistory = false): TriageEntryPatch | null {
+  const e: TriageEntryPatch = {}
+  if (row.color != null) e.color = row.color
+  if (isTriageBucket(row.triage)) e.triage = row.triage
+  if (legacyHistory && row.comment != null) e.comment = row.comment
+  if (row.fix != null) e.fix = row.fix
+  if (row.flagged != null) e.flagged = row.flagged
+  return Object.keys(e).length > 0 ? e : null
+}

package/server-managed/type-only-worker.js

@@ -0,0 +1,19 @@
+// Which of a comparison's pairs of files changed in types alone (type-only.ts),
+// as @preventive/compare's compareTrees stamps a change `typeOnly`, off the
+// server's event loop: each pair a tree of a file a side, a side not there
+// none, its paths as they are, which say what a file is. Two paths pair as one
+// change wherever compareTrees takes them for a rename at all; where it
+// doesn't, the pair is types only where each of its two changes is: the file
+// gone erasing whole, and the one come erasing whole or leaving a single bare
+// `export {}`, which nothing loaded before. `[true, false, ...]` by pair.
+import { parentPort, workerData } from 'node:worker_threads'
+import { compareTrees } from '@preventive/compare'
+
+const tree = file => (file ? [{ name: file.path, data: file.text }] : [])
+const answer = workerData.pairs.map(([from, to]) => {
+  const changes = compareTrees(tree(from), tree(to), { paths: 'keys', lines: false, renames: Number.MIN_VALUE })
+  return changes.length > 0 && changes.every(change => change.typeOnly === true)
+})
+// Node worker messages have no browser target origin.
+// oxlint-disable-next-line unicorn/require-post-message-target-origin
+parentPort.postMessage(answer)

package/server-managed/type-only.ts

@@ -0,0 +1,105 @@
+// Compare's changes to TypeScript declaration files in types alone (GET
+// /api/bundles/:id/type-only?other=, GET /api/npm/type-only): every file
+// that changed between a comparison's two sides, added and removed ones too,
+// paired as its viewer pairs them (rename-diff.ts comparedFiles), whose
+// change @preventive/compare's compareTrees stamps
+// `typeOnly` -- each side there a file named as a declaration file and
+// proven to hold types alone but for a runtime, the module loads and
+// `export {}` its stripping leaves, that the change leaves as it was, an
+// added one's empty or a single bare `export {}` (proveTypeOnly) -- and
+// nothing else. Proven in a worker, off the event loop, a comparison at a
+// time per process, for at most a minute; told a line each, `{ path, hash,
+// otherPath, otherHash }`, a side not there null, which the viewer checks
+// name the files it shows. Access is the caller's to check.
+import { Worker } from 'node:worker_threads'
+import { type ComparedSide, PrettyError, type PrettyRequest } from './pretty-print.ts'
+import { comparedFiles } from './rename-diff.ts'
+
+// TypeScript files, by extension as the pretty-print cache reads them: none
+// other is asked about.
+const TYPESCRIPT = new Set(['ts', 'mts', 'cts'])
+// Comparisons proven at once per process, and those waiting their turn past
+// them, any more refused; the longest one may take, its wait included.
+const MAX_ACTIVE_PROOFS = 1
+const MAX_WAITING_PROOFS = 16
+const PROOF_TIMEOUT_MS = 60_000
+
+type File = PrettyRequest & { text: string }
+export interface TypeOnlyLine { path: string | null; hash: string | null; otherPath: string | null; otherHash: string | null }
+
+let active = 0
+const waiting: Array<() => void> = []
+
+async function turn(deadline: number): Promise<void> {
+  if (active < MAX_ACTIVE_PROOFS) { active++; return }
+  if (waiting.length >= MAX_WAITING_PROOFS) throw new PrettyError(429, 'proof-busy')
+  await new Promise<void>((resolve, reject) => {
+    const next = () => { clearTimeout(timer); resolve() }
+    const timer = setTimeout(() => {
+      waiting.splice(waiting.indexOf(next), 1)
+      reject(new PrettyError(504, 'proof-timeout'))
+    }, deadline - Date.now())
+    waiting.push(next)
+  })
+}
+function done() {
+  const next = waiting.shift()
+  if (next) next()
+  else active--
+}
+
+// Which of `pairs` compareTrees stamps types only, by index, in a worker
+// settled once it is gone; none where it fails, as no proof should.
+function proven(pairs: Array<[File | null, File | null]>, deadline: number): Promise<boolean[]> {
+  let worker: Worker
+  try {
+    worker = new Worker(new URL('./type-only-worker.js', import.meta.url), {
+      workerData: { pairs: pairs.map(sides => sides.map(file => file && { path: file.path, text: file.text })) },
+      // Node's type stripping, which the proof holds oxc's tree to, warns it is experimental.
+      execArgv: ['--disable-warning=ExperimentalWarning'], resourceLimits: { maxOldGenerationSizeMb: 1024 },
+    })
+  } catch (err) {
+    console.warn('managed: a type-only proof could not start:', err)
+    throw new PrettyError(503, 'unavailable')
+  }
+  return new Promise((resolve, reject) => {
+    let answer: boolean[] | null = null, failure = new PrettyError(422, 'unproven')
+    const timer = setTimeout(() => { failure = new PrettyError(504, 'proof-timeout'); void worker.terminate() }, deadline - Date.now())
+    worker.once('message', (told: unknown) => {
+      if (Array.isArray(told) && told.length === pairs.length && told.every(one => typeof one === 'boolean')) answer = told
+      void worker.terminate()
+    })
+    worker.once('error', err => { console.warn('managed: a type-only proof failed:', err) })
+    worker.once('exit', () => {
+      clearTimeout(timer)
+      if (answer) resolve(answer)
+      else reject(failure)
+    })
+  })
+}
+
+// The files that changed between a comparison's two sides in types alone,
+// as the viewer pairs them, a line each once all are proven, in path order.
+export function typeOnlyFiles([base, other]: readonly [ComparedSide, ComparedSide]): AsyncGenerator<TypeOnlyLine> {
+  const typescript = ({ files }: ComparedSide) => new Map(files.filter(file => TYPESCRIPT.has(file.extension)).map(file => [file.path, file]))
+  const [olds, news] = [typescript(base), typescript(other)]
+  const { changed, onlyBase, onlyOther } = comparedFiles([base, other])
+  // A side there not a TypeScript file this reads leaves its pair out; one not there is null.
+  const pairs = [...changed.map(({ path, basePath = path }) => [olds.get(basePath), news.get(path)]),
+    ...onlyBase.map(({ path, basePath = path }) => [olds.get(basePath), null]), ...onlyOther.map(({ path }) => [null, news.get(path)])]
+    .filter((sides): sides is [File | null, File | null] => sides.every(file => file !== undefined) && sides.some(file => file !== null) && sides[0]?.hash !== sides[1]?.hash)
+    .toSorted(([a, b], [c, d]) => {
+      const [x, y] = [(b ?? a)!.path, (d ?? c)!.path]
+      return x < y ? -1 : x > y ? 1 : 0
+    })
+  return (async function* () {
+    if (pairs.length === 0) return
+    const deadline = Date.now() + PROOF_TIMEOUT_MS
+    await turn(deadline)
+    let stamped
+    try { stamped = await proven(pairs, deadline) } finally { done() }
+    for (const [i, [from, to]] of pairs.entries()) {
+      if (stamped[i]) yield { path: from?.path ?? null, hash: from?.hash ?? null, otherPath: to?.path ?? null, otherHash: to?.hash ?? null }
+    }
+  })()
+}

package/server-managed/uploads.ts

@@ -0,0 +1,106 @@
+// Staging is shared storage, never process memory. Each part is bound to the
+// authenticated session, destination and random upload ID. No bearer URL is
+// exposed; all reads/writes still pass the managed role/origin/CSRF gates.
+import { Buffer } from 'node:buffer'
+import { createHash, generateKeyPairSync } from 'node:crypto'
+import type { IncomingMessage } from 'node:http'
+import type { BlobStore } from './blob-store.ts'
+import { maxSealedBytes, openUpload } from '../common/managed/upload-seal.ts'
+
+export const UPLOAD_CHUNK_BYTES = 3 * 1024 * 1024
+export const MAX_UPLOAD_BYTES = 1024 * 1024 * 1024
+// Staged parts may carry a sealed body, slightly larger than its content.
+const MAX_STAGED_BYTES = maxSealedBytes(MAX_UPLOAD_BYTES)
+const MAX_UPLOAD_PARTS = Math.ceil(MAX_STAGED_BYTES / UPLOAD_CHUNK_BYTES)
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u
+export type UploadKind = 'reports' | 'bundles'
+
+function partId(session: string, kind: UploadKind, id: string, index: number): string {
+  const hash = createHash('sha256').update(JSON.stringify([session, kind, id, index])).digest('hex').slice(0, 32)
+  return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20)}`
+}
+
+export function validUploadPart(id: string, index: number, maxBytes: number): boolean {
+  return UUID.test(id) && Number.isSafeInteger(index) && index >= 0 && index < Math.ceil(Math.min(maxSealedBytes(maxBytes), MAX_STAGED_BYTES) / UPLOAD_CHUNK_BYTES)
+}
+
+export function validUpload(id: string, count: number): boolean {
+  return UUID.test(id) && Number.isSafeInteger(count) && count > 0
+}
+
+// Limit cleanup to indices that any configured server could have accepted,
+// even if the request advertises an enormous count or the limit was lowered.
+export async function deleteUpload(store: BlobStore, session: string, kind: UploadKind, id: string, count: number): Promise<void> {
+  if (!validUpload(id, count)) throw new Error('bad-upload')
+  const end = Math.min(count, MAX_UPLOAD_PARTS), errors = []
+  for (let start = 0; start < end; start += 8) {
+    const results = await Promise.allSettled(Array.from({ length: Math.min(8, end - start) },
+      (_, index) => store.delete(partId(session, kind, id, start + index))))
+    for (const result of results) if (result.status === 'rejected') errors.push(result.reason)
+  }
+  if (errors.length > 0) throw new AggregateError(errors, 'Upload cleanup failed')
+}
+
+export async function putUploadPart(store: BlobStore, session: string, kind: UploadKind, id: string, index: number, bytes: Buffer): Promise<void> {
+  await store.put(partId(session, kind, id, index), bytes)
+}
+
+// Parts read at once while an upload is put together.
+const PARTS_READ_AT_ONCE = 6
+
+// The staged upload `req` names, its parts read a few at a time into the one
+// buffer it fills, each as long as its place in it. Its parts are deleted
+// once read, or once it fails: awaited, unless `behind` takes that cleanup to
+// go on past the response (http.ts), which staging maintenance backs up.
+export async function readUpload(store: BlobStore, req: IncomingMessage, session: string, kind: UploadKind, maxBytes: number,
+  behind?: (cleanup: Promise<void>) => void): Promise<Buffer> {
+  const id = req.headers['x-upload-id']
+  const count = Number(req.headers['x-upload-parts']), size = Number(req.headers['x-upload-size'])
+  if (typeof id !== 'string' || !validUpload(id, count)) throw new Error('bad-upload')
+  try {
+    if (!Number.isSafeInteger(size) || size <= 0 || count !== Math.ceil(size / UPLOAD_CHUNK_BYTES)) throw new Error('bad-upload')
+    if (size > maxBytes || size > MAX_STAGED_BYTES) throw new Error('too-large')
+    // Every byte of it is written below before it is returned: each part
+    // must fill its place exactly, or the upload fails.
+    const body = Buffer.allocUnsafe(size)
+    let failed = false, next = 0
+    const readParts = async () => {
+      while (!failed && next < count) {
+        const index = next++
+        const bytes = await store.get(partId(session, kind, id, index))
+        const expected = Math.min(UPLOAD_CHUNK_BYTES, size - index * UPLOAD_CHUNK_BYTES)
+        if (!bytes || bytes.length !== expected) { failed = true; throw new Error('bad-upload') }
+        bytes.copy(body, index * UPLOAD_CHUNK_BYTES)
+      }
+    }
+    // Each read settled before its parts are deleted.
+    const results = await Promise.allSettled(Array.from({ length: Math.min(PARTS_READ_AT_ONCE, count) }, readParts))
+    const rejected = results.find(result => result.status === 'rejected')
+    if (rejected) throw rejected.reason
+    return body
+  } finally {
+    // These bytes can no longer be finalized. Failed/abandoned chunk uploads
+    // are also covered by automatic staging maintenance.
+    const cleanup = deleteUpload(store, session, kind, id, count).catch(err => console.warn('managed: upload cleanup failed:', err))
+    if (behind) behind(cleanup)
+    else await cleanup
+  }
+}
+
+// A session's upload key pair, stored as its private JWK.
+export function newUploadKey(): string {
+  const { privateKey } = generateKeyPairSync('x25519')
+  const { kty, crv, x, d } = privateKey.export({ format: 'jwk' })
+  return JSON.stringify({ kty, crv, x, d })
+}
+
+// The raw public key (base64url) browsers seal this session's uploads to.
+export function uploadPublicKey(key: string): string {
+  return (JSON.parse(key) as { x: string }).x
+}
+
+export async function openSessionUpload(key: string | null | undefined, sealed: Buffer, maxBytes: number): Promise<Buffer> {
+  if (!key) throw new Error('bad-upload')
+  const bytes = await openUpload(new Uint8Array(sealed.buffer as ArrayBuffer, sealed.byteOffset, sealed.byteLength), JSON.parse(key) as JsonWebKey, maxBytes)
+  return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+}