@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.51

package/server-managed/locked-packages.ts

@@ -0,0 +1,152 @@
+// The packages a lockfile of npm's ecosystem locks, as @preventive/lockfile
+// reads package-lock.json and npm-shrinkwrap.json of `lockfileVersion: 3`,
+// pnpm-lock.yaml of pnpm 9 to 12 and Yarn 1's yarn.lock, each with where it
+// is installed from and whether only devDependencies need it
+// (repository-risk.ts).
+import { LockfileError, parseNpmLockfile } from '@preventive/lockfile/npm.js'
+import { parsePnpmLockfile } from '@preventive/lockfile/pnpm.js'
+import { parseYarn1Lockfile } from '@preventive/lockfile/yarn1.js'
+import type { LockfileFormat } from '@preventive/upstream/github.js'
+import type { ReviewedLockfile } from './reviewed-dependencies.ts'
+
+export interface LockedPackage {
+  name: string
+  // None for a git dependency whose package.json has none.
+  version: string | null
+  // Where it is installed from: npm's registry, another host's tarball with
+  // an integrity, such as a company's mirror of npm's, a git repository, a
+  // tarball with none, or a file of the project.
+  source: 'registry' | 'mirror' | 'git' | 'tarball' | 'file'
+  // Where one from elsewhere than npm's registry comes from, without any
+  // credentials its URL has.
+  from?: string
+  // As the lockfile has it: a mirror's tarball's, npm's package of its name
+  // and version only where npm's integrity is among it; and, where its
+  // reviews ask (`review`), npm's registry's too.
+  integrity?: string
+  // Where its reviews ask: the sha1 Yarn 1 writes after a tarball's `#`, in
+  // hex (`shasum`); the hash of the patch pnpm applies to it
+  // (`patchHash`, its patchedDependencies'), and the patch's file, where the
+  // lockfile names one (`patchPath`, pnpm 9's and 10's): from the lockfile's
+  // directory as read, from the repository's root once that is known
+  // (patchedIn); and the lockfile's format.
+  shasum?: string
+  patchHash?: string
+  patchPath?: string
+  lockfile?: ReviewedLockfile
+  // Where only the importers' devDependencies reach it, as npm's `dev` flag
+  // says, and an install of no devDependencies leaves it out: in npm's and
+  // pnpm's lockfiles. Yarn 1's says nothing of it, which only the
+  // package.json files do, and none of its are.
+  dev?: true
+}
+
+// A package as each reader resolves one, its name the one it is published
+// under, and a registry tarball's URL held to its name and version.
+type Resolution =
+  | { type: 'tarball'; tarball: string | undefined; integrity: string | undefined; sha1?: string | undefined; gitHosted?: boolean }
+  | { type: 'git'; repo: string }
+  | { type: 'directory' }
+interface ReadPackage { name: string; version: string | undefined; resolution: Resolution | undefined; dev?: boolean | undefined; patchHash?: string | undefined
+  patchPath?: string | undefined }
+
+// The packages of a lockfile of `format`, as its reader resolves them, a
+// patched one of pnpm's with its patch's file where the lockfile names it.
+// Versions go unchecked against ranges, as only what is locked is asked for.
+function packagesOf(format: LockfileFormat, text: string): ReadPackage[] {
+  if (format === 'npm') return Object.values(parseNpmLockfile(text, { checkVersions: false }).packages)
+  if (format === 'pnpm') {
+    const { lockfile, env } = parsePnpmLockfile(text)
+    const files = new Map(Object.values(lockfile?.patchedDependencies ?? {}).flatMap(({ hash, path }) => path ? [[hash, path] as const] : []))
+    return [...Object.values(env?.packages ?? {}), ...Object.values(lockfile?.packages ?? {})]
+      .map(pkg => pkg.patchHash !== undefined && files.has(pkg.patchHash) ? { ...pkg, patchPath: files.get(pkg.patchHash) } : pkg)
+  }
+  if (format !== 'yarn') throw new TypeError(`lockedPackages: ${format} lockfiles are not read`)
+  // Yarn 2 and later write another format, which only the text tells apart.
+  if (/^__metadata:/mu.test(text)) throw new LockfileError('a yarn.lock of Yarn 2 or later, which is not read')
+  // Yarn 1 names an alias, `my-q@npm:q@^1.5.1`, by its own name.
+  return Object.values(parseYarn1Lockfile(text, { checkVersions: false }).packages)
+    .map(pkg => ({ ...pkg, name: /@npm:((?:@[^/@]+\/)?[^/@]+)/u.exec(pkg.patterns[0] ?? '')?.[1] ?? pkg.name }))
+}
+
+// npm's registry, by either of its names, and yarn's mirror of it, as
+// @preventive/lockfile holds their tarballs to a package's name and version:
+// its link to one, as it names it, a hash after it alone (Yarn 1's sha1).
+const REGISTRY_HOSTS = new Set(['registry.npmjs.org', 'registry.npmjs.com', 'registry.yarnpkg.com'])
+const isRegistry = (url: URL) => url.protocol === 'https:' && !url.port && !url.username && !url.password && !url.search
+  && REGISTRY_HOSTS.has(url.hostname.replace(/\.+$/u, ''))
+// Where a URL is, as it may be shown: its credentials, query and fragment
+// left out.
+const shown = (url: URL | null) => url ? { from: `${url.protocol}//${url.host}${url.pathname}` } : {}
+
+// Where a package read comes from (LockedPackage), with npm's registry's
+// integrity where `review`; null for one a package bundles, with no
+// resolution, or one of the project's own directories.
+function located({ name, version, resolution }: ReadPackage, review: boolean): LockedPackage | null {
+  const at = { name, version: version ?? null }
+  if (resolution === undefined || resolution.type === 'directory') return null
+  if (resolution.type === 'git') return { ...at, source: 'git', ...shown(URL.parse(resolution.repo)) }
+  const { tarball, integrity } = resolution
+  if (resolution.gitHosted) return { ...at, source: 'git', ...shown(URL.parse(tarball ?? '')) }
+  const registry = { ...at, source: 'registry' as const, ...review && integrity ? { integrity } : {} }
+  if (tarball === undefined) return registry
+  if (tarball.startsWith('file:')) return { ...at, source: 'file' }
+  const url = URL.parse(tarball)
+  if (url && isRegistry(url)) return registry
+  return integrity ? { ...at, ...shown(url), source: 'mirror', integrity } : { ...at, ...shown(url), source: 'tarball' }
+}
+// As above, and with what its reviews ask (LockedPackage `shasum`,
+// `patchHash`, `patchPath`, `lockfile`) where `review`.
+function locked(pkg: ReadPackage, format: LockfileFormat, review: boolean): LockedPackage | null {
+  const one = located(pkg, review)
+  if (!one || !review) return one
+  const sha1 = pkg.resolution?.type === 'tarball' ? pkg.resolution.sha1 : undefined
+  return { ...one, ...sha1 ? { shasum: sha1 } : {}, ...pkg.patchHash ? { patchHash: pkg.patchHash, ...pkg.patchPath ? { patchPath: pkg.patchPath } : {} } : {},
+    lockfile: format === 'yarn' ? 'yarn1' : format as ReviewedLockfile }
+}
+
+// The packages a lockfile of `format` (npm, pnpm or yarn, as
+// findRepoLockfiles names them) locks, each once, in the lockfile's order:
+// `dev` only where it is wherever it is installed, at each path of npm's
+// tree, and with each of pnpm's peers; with `review`, each with what its
+// reviews hold it to (LockedPackage `integrity`, `shasum`, `patchHash`),
+// each patch of it apart. Throws the reader's LockfileError or YamlError for
+// one it refuses.
+export function lockedPackages(format: LockfileFormat, text: string, { review = false } = {}): LockedPackage[] {
+  const found = new Map<string, LockedPackage>()
+  for (const pkg of packagesOf(format, text)) {
+    const one = locked(pkg, format, review)
+    if (!one) continue
+    if (pkg.dev === true) one.dev = true
+    const key = `${one.source}\0${one.name}@${one.version ?? ''}\0${one.from ?? ''}\0${one.integrity ?? ''}\0${one.shasum ?? ''}\0${one.patchHash ?? ''}`
+    const had = found.get(key)
+    if (!had) found.set(key, one)
+    else if (had.dev && !one.dev) delete had.dev
+  }
+  return [...found.values()]
+}
+
+// `pkg` as a lockfile at `path` locks it, read with its patch's file from
+// the lockfile's directory (LockedPackage `patchPath`): that file from the
+// repository's root, none where it names one outside it.
+export function patchedIn<T extends LockedPackage>(path: string, pkg: T): T {
+  if (pkg.patchPath === undefined) return pkg
+  const { patchPath, ...rest } = pkg
+  const parts = path.split('/').slice(0, -1)
+  for (const part of patchPath.split('/')) {
+    if (part === '..') { if (parts.pop() === undefined) return rest as T }
+    else if (part !== '.' && part !== '') parts.push(part)
+  }
+  return parts.length > 0 ? { ...rest, patchPath: parts.join('/') } as T : rest as T
+}
+
+// Whether a lockfile at `path` is a test's fixture or example: under a
+// directory of tests (`test`, `tests`, `__tests__` and such), in one of
+// fixtures or examples (`fixture`, `fixtures`, `example`, `examples`) inside
+// it, as a test may keep one its readers refuse on purpose.
+const FIXTURES_DIR = /^(?:fixture|example)s?$/u, TESTS_DIR = /^_*tests?_*$/u
+export function isTestFixture(path: string) {
+  const dirs = path.split('/').slice(0, -1)
+  const tests = dirs.findIndex(dir => TESTS_DIR.test(dir))
+  return tests !== -1 && dirs.slice(tests + 1).some(dir => FIXTURES_DIR.test(dir))
+}

package/server-managed/lockfile-scope.ts

@@ -0,0 +1,49 @@
+// The lockfiles a repository's dependency review holds to, as an admin sets
+// it (repository-dependency-reviews.ts): every one but those it names
+// (`exclude`, naming none for all of them), or those it names alone
+// (`include`). Each is named by its path in the repository, or, ending in
+// `/`, by a directory, every lockfile under it. A directory of a pull
+// request's lockfiles (pull-dependencies.ts) is reviewed where one of its
+// lockfiles is held to; one none of whose are, not at all (`excluded`), nor
+// failing the review where it couldn't be read.
+export interface LockfileScope { mode: 'exclude' | 'include'; paths: string[] }
+export const EVERY_LOCKFILE: LockfileScope = { mode: 'exclude', paths: [] }
+export const MAX_SCOPED_LOCKFILES = 100
+const MAX_PATH = 300
+
+// A path as one is named: relative, of `/`-separated names none of which is
+// empty, `.` or `..`, nor holding a backslash or a control character; a
+// directory's ending in `/`.
+function namedPath(path: unknown): path is string {
+  if (typeof path !== 'string' || path.length === 0 || path.length > MAX_PATH || path.startsWith('/')) return false
+  if (/[\\\p{Cc}]/u.test(path)) return false
+  const names = path.endsWith('/') ? path.slice(0, -1).split('/') : path.split('/')
+  return names.every(name => name !== '' && name !== '.' && name !== '..')
+}
+
+// A scope as a request sends it, each path once, in order; null for one
+// that isn't one.
+export function scopeOf(value: unknown): LockfileScope | null {
+  const { mode, paths } = (value ?? {}) as { mode?: unknown; paths?: unknown }
+  if ((mode !== 'exclude' && mode !== 'include') || !Array.isArray(paths) || paths.length > MAX_SCOPED_LOCKFILES || !paths.every(namedPath)) return null
+  return { mode, paths: [...new Set(paths as string[])].toSorted() }
+}
+
+// A scope as stored (JSON, none for every lockfile), every lockfile where
+// it can't be read.
+export function storedScope(text: string | null): LockfileScope {
+  if (!text) return EVERY_LOCKFILE
+  try { return scopeOf(JSON.parse(text)) ?? EVERY_LOCKFILE } catch { return EVERY_LOCKFILE }
+}
+export const scopeText = (scope: LockfileScope) => isEvery(scope) ? null : JSON.stringify({ mode: scope.mode, paths: scope.paths })
+export const isEvery = (scope: LockfileScope) => scope.mode === 'exclude' && scope.paths.length === 0
+
+const names = (path: string, named: string) => named.endsWith('/') ? path.startsWith(named) : path === named
+// Whether the lockfile at `path` is held to.
+export function heldTo(scope: LockfileScope, path: string) {
+  const named = scope.paths.some(one => names(path, one))
+  return scope.mode === 'include' ? named : !named
+}
+// Whether a directory of lockfiles at `paths` is reviewed: where one is
+// held to, or it names none.
+export const reviewedIn = (scope: LockfileScope, paths: string[]) => paths.length === 0 || paths.some(path => heldTo(scope, path))

package/server-managed/lru.ts

@@ -0,0 +1,30 @@
+// Values by key, the least recently used going first once their weights
+// (`weight`, 1 each unless given) are past `limit`.
+export interface Lru<V> { get(key: string): V | undefined; set(key: string, value: V): void }
+export function lru<V>(limit: number, weight: (value: V) => number = () => 1): Lru<V> {
+  const kept = new Map<string, V>()
+  let total = 0
+  const forget = (key: string) => {
+    const value = kept.get(key)
+    if (value === undefined) return
+    kept.delete(key)
+    total -= weight(value)
+  }
+  return {
+    get(key) {
+      const value = kept.get(key)
+      if (value !== undefined) { kept.delete(key); kept.set(key, value) }
+      return value
+    },
+    set(key, value) {
+      forget(key)
+      if (weight(value) > limit) return
+      kept.set(key, value)
+      total += weight(value)
+      for (const first of kept.keys()) {
+        if (total <= limit) break
+        forget(first)
+      }
+    },
+  }
+}

package/server-managed/managed-issues.ts

@@ -0,0 +1,78 @@
+import type { ManagedSql } from './sql.ts'
+import type { TeamReportAccessSnapshot } from './db.ts'
+import { parseGithubPrUrl } from '../common/github-pr.ts'
+
+// One immutable reference per finding, shared across reports and teams. Keep
+// reservations across crashes/uncertain GitHub responses to prevent duplicates.
+// No triage/import/admin patch accepts these fields.
+export const MANAGED_ISSUE_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_finding_issue (
+  finding_id TEXT PRIMARY KEY,
+  repo_id INTEGER NOT NULL,
+  repository TEXT NOT NULL,
+  request_id TEXT NOT NULL,
+  issue_url TEXT,
+  auto_fix_url TEXT,
+  auto_fix_checked_at INTEGER,
+  created_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  created_at INTEGER NOT NULL
+) STRICT;
+`
+export interface ManagedIssue {
+  findingId: string
+  repoId: number
+  repository: string
+  requestId: string
+  issueUrl: string | null
+  autoFixUrl: string | null
+  autoFixCheckedAt: number | null
+  createdBy: string | null
+  createdAt: number
+}
+export interface ManagedIssueStore {
+  getManagedIssue(findingId: string): Promise<ManagedIssue | null>
+  listManagedIssues(findingIds: readonly string[]): Promise<ManagedIssue[]>
+  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl' | 'autoFixUrl' | 'autoFixCheckedAt'>): Promise<boolean>
+  finishManagedIssue(findingId: string, requestId: string, url: string): Promise<boolean>
+  releaseManagedIssue(findingId: string, requestId: string): Promise<void>
+  setManagedIssueAutoFix(findingId: string, issueUrl: string, previous: string | null, next: string | null, checkedAt: number): Promise<boolean>
+}
+
+// A repeated finding ID never grants access to another team's repository.
+export function visibleManagedIssues(issues: ManagedIssue[], snapshot: TeamReportAccessSnapshot) {
+  if (snapshot.user.id.startsWith('share:')) return []
+  const repos = new Set(snapshot.repositories.map(repo => repo.repoId))
+  const names = new Set(snapshot.repositories.map(repo => repo.github.toLowerCase()))
+  return issues.filter(issue => issue.issueUrl && repos.has(issue.repoId)).map(issue => {
+    const ref = parseGithubPrUrl(issue.autoFixUrl)
+    return { ...issue, autoFixUrl: ref && names.has(ref.repo.toLowerCase()) ? issue.autoFixUrl : null }
+  })
+}
+export function managedIssueMethods(db: ManagedSql): ManagedIssueStore {
+  const fields = `finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
+    issue_url AS issueUrl, auto_fix_url AS autoFixUrl, auto_fix_checked_at AS autoFixCheckedAt, created_by AS createdBy, created_at AS createdAt`
+  const get = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id = ?`)
+  const list = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY finding_id`)
+  // A lookup's derived Fix replaces the one it read, unless one started later
+  // changed it since: the check time, which only changes stamp
+  // (github-issue-links.ts issueUpdates), orders them.
+  const autoFix = db.prepare(`UPDATE managed_finding_issue SET auto_fix_url = ?, auto_fix_checked_at = ?
+    WHERE finding_id = ? AND issue_url = ? AND COALESCE(auto_fix_url, '') = COALESCE(?, '')
+      AND (auto_fix_checked_at IS NULL OR auto_fix_checked_at <= ?)`)
+  const claim = db.prepare(`INSERT INTO managed_finding_issue (finding_id, repo_id, repository, request_id, created_by, created_at)
+    VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (finding_id) DO NOTHING`)
+  const finish = db.prepare(`UPDATE managed_finding_issue SET issue_url = ? WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
+  const release = db.prepare(`DELETE FROM managed_finding_issue WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
+  return {
+    async getManagedIssue(findingId) { return (await get.get(findingId) as ManagedIssue | undefined) ?? null },
+    async listManagedIssues(ids) { return await list.all(JSON.stringify(ids)) as ManagedIssue[] },
+    async setManagedIssueAutoFix(findingId, issueUrl, previous, next, checkedAt) {
+      return Number((await autoFix.run(next, checkedAt, findingId, issueUrl, previous, checkedAt)).changes) > 0
+    },
+    async claimManagedIssue(issue) {
+      return Number((await claim.run(issue.findingId, issue.repoId, issue.repository, issue.requestId, issue.createdBy, issue.createdAt)).changes) > 0
+    },
+    async finishManagedIssue(findingId, requestId, url) { return Number((await finish.run(url, findingId, requestId)).changes) > 0 },
+    async releaseManagedIssue(findingId, requestId) { await release.run(findingId, requestId) },
+  }
+}

package/server-managed/management-catalog.ts

@@ -0,0 +1,45 @@
+import { roleAtLeast } from '../common/managed/roles.ts'
+import { type RepoScope, contentAccess } from './content-access.ts'
+import type { AdminBundle, AdminReport, ManagedDb } from './db-methods.ts'
+import { ManagedMutationError } from './management.ts'
+
+type CatalogAccess = { repos: { repoId: number; fullName: string }[]; repoScopes: RepoScope[] | null }
+export interface ManagementCatalogStore {
+  getReportCatalog(sessionId: string, now: number): Promise<CatalogAccess & { reports: (AdminReport & { canChangeRepo: boolean })[] }>
+  getBundleCatalog(sessionId: string, now: number): Promise<CatalogAccess & { bundles: (AdminBundle & { canChangeRepo: boolean })[] }>
+}
+type CatalogDb = Pick<ManagedDb, 'getReportAccessSnapshot' | 'listRepoScopesForUser' | 'listSelectedRepos'
+  | 'listReports' | 'listBundles' | 'listReadableBundleIds'>
+
+// The outer store method owns one read snapshot. Use raw methods here so the
+// session, grants, rows and action flags agree without per-row transactions.
+export function managementCatalogMethods(db: CatalogDb): ManagementCatalogStore {
+  async function access(sessionId: string, now: number) {
+    const snapshot = await db.getReportAccessSnapshot(sessionId, now, [])
+    if (!snapshot) throw new ManagedMutationError(401, 'unauthenticated')
+    if (!roleAtLeast(snapshot.user.role, 'manage')) throw new ManagedMutationError(403, 'forbidden')
+    const scope = await contentAccess(db, snapshot.user)
+    const repos = (await db.listSelectedRepos()).filter(scope.bundle).map(({ repoId, fullName }) => ({ repoId, fullName }))
+    return { userId: snapshot.user.role === 'admin' ? undefined : snapshot.user.id, scope, repos }
+  }
+  return {
+    async getReportCatalog(sessionId, now) {
+      const { userId, scope, repos } = await access(sessionId, now)
+      const reports = await db.listReports(userId)
+      const linked = reports.flatMap(report => report.bundleId ? [report.bundleId] : [])
+      const readable = userId === undefined ? new Set(linked) : new Set(await db.listReadableBundleIds(userId, linked))
+      return { repos, repoScopes: scope.scopes, reports: reports.map(report => ({ ...report,
+        canChangeRepo: report.repoId === null || scope.report(report),
+        bundleId: report.bundleId && readable.has(report.bundleId) ? report.bundleId : null,
+        bundleFilename: report.bundleId && readable.has(report.bundleId) ? report.bundleFilename : null,
+      })) }
+    },
+    async getBundleCatalog(sessionId, now) {
+      const { userId, scope, repos } = await access(sessionId, now)
+      const bundles = await db.listBundles(userId)
+      return { repos, repoScopes: scope.scopes, bundles: bundles.map(bundle => ({ ...bundle,
+        canChangeRepo: bundle.repoId === null || scope.report(bundle),
+      })) }
+    },
+  }
+}

package/server-managed/management.ts

@@ -0,0 +1,99 @@
+import type { AdminReport, BundleReuse, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
+import { roleAtLeast } from '../common/managed/roles.ts'
+
+export class ManagedMutationError extends Error {
+  status: number
+  constructor(status: number, message: string) { super(message); this.status = status }
+}
+
+export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string } | { type: 'visibility'; visible: boolean }
+export type ReportMutation = ContentMutation
+type RemovalRepo = Pick<ManagedRepo, 'repoId' | 'fullName' | 'addedAt'>
+type RemovalAnnotations = { reports: string; ids: string[] }
+export interface ManagementStore {
+  mutateReport(sessionId: string, id: string, change: ReportMutation): Promise<{ report: ReportRecord; user: StoredUser }>
+  mutateBundle(sessionId: string, id: string, change: ContentMutation): Promise<{ bundle: ManagedBundle; user: StoredUser }>
+  // A repeated upload/build of stored bytes (see reuseBundle). Renames need the
+  // access other bundle mutations need; a server build labels the row anyway.
+  reuseBundleUpload(sessionId: string, id: string, reuse: Omit<BundleReuse, 'rename'>): Promise<boolean>
+  removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null): Promise<{
+    reports: RepoReportItem[]; bundles: RepoDataItem[]; deletedReports: number; deletedBundles: number; deletedTriage: number
+  }>
+}
+type ManagementDb = Pick<ManagedDb, 'sessionWithUser' | 'getReport' | 'getBundle' | 'listReports' | 'listReportsForRepo'
+  | 'listBundlesForRepo' | 'listAllRepos' | 'listSelectedRepos' | 'userCanReadReport' | 'userCanReadBundle' | 'userCanReadRepoPath'
+  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo' | 'setBundleVisible' | 'reuseBundle'
+  | 'deleteReportsForRepo' | 'deleteBundlesForRepo' | 'deleteRepo' | 'deleteTriage' | 'recordActivity'>
+
+// Only immutable bytes/format and repository membership affect the overlap
+// scan. Ignore publication, user display names, and unrelated bundle links.
+export function reportReferenceSnapshot(reports: readonly Pick<AdminReport, 'id' | 'sha256' | 'filename' | 'repoId'>[]): string {
+  return JSON.stringify(reports.map(r => [r.id, r.sha256, r.filename, r.repoId]).toSorted((a, b) => String(a[0]).localeCompare(String(b[0]))))
+}
+
+// These methods are wrapped by scopeManagedMethods: authorization, comparison,
+// metadata changes (and repository-removal audit) share the writer transaction. Blob reads
+// and deletes stay outside it. Use the raw store here, never nested scopes.
+export function managementMethods(db: ManagementDb): ManagementStore {
+  async function authorize(sessionId: string, role: 'admin' | 'manage') {
+    const s = await db.sessionWithUser(sessionId, Date.now())
+    if (!s) throw new ManagedMutationError(401, 'unauthenticated')
+    if (!roleAtLeast(s.user.role, role)) throw new ManagedMutationError(403, 'forbidden')
+    return s.user
+  }
+  async function destination(user: { id: string; role: string }, change: ContentMutation) {
+    if (change.type !== 'repo' || change.repoId === null) return
+    if (!(await db.listSelectedRepos()).some(repo => repo.repoId === change.repoId)) throw new ManagedMutationError(400, 'bad-repo')
+    if (user.role !== 'admin' && !await db.userCanReadRepoPath(user.id, change.repoId, change.directory)) throw new ManagedMutationError(403, 'repo-forbidden')
+  }
+  return {
+    async mutateReport(sessionId: string, id: string, change: ReportMutation) {
+      const user = await authorize(sessionId, 'manage')
+      const report = await db.getReport(id)
+      if (!report || (user.role !== 'admin' && report.uploadedBy !== user.id && !await db.userCanReadReport(user.id, id))) throw new ManagedMutationError(404, 'no-report')
+      if (user.role !== 'admin' && report.repoId !== null && !await db.userCanReadReport(user.id, id)) throw new ManagedMutationError(403, 'repo-forbidden')
+      if (change.type === 'repo' && report.repoEmbedded) throw new ManagedMutationError(409, 'repo-in-report')
+      if (change.type !== 'visibility') await destination(user, change)
+      if (change.type === 'delete') await db.deleteReport(id)
+      else if (change.type === 'visibility') await db.setReportVisible(id, change.visible)
+      else await db.setReportRepo(id, change.repoId, change.directory)
+      return { report, user }
+    },
+    async mutateBundle(sessionId: string, id: string, change: ContentMutation) {
+      const user = await authorize(sessionId, 'manage')
+      const bundle = await db.getBundle(id)
+      if (!bundle || (user.role !== 'admin' && !await db.userCanReadBundle(user.id, id))) throw new ManagedMutationError(404, 'no-bundle')
+      if (user.role !== 'admin' && bundle.repoId !== null && !await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)) throw new ManagedMutationError(403, 'repo-forbidden')
+      await destination(user, change)
+      if (change.type === 'delete') await db.deleteBundle(id)
+      else if (change.type === 'visibility') await db.setBundleVisible(id, change.visible)
+      else await db.setBundleRepo(id, change.repoId, change.directory)
+      return { bundle, user }
+    },
+    async reuseBundleUpload(sessionId: string, id: string, reuse: Omit<BundleReuse, 'rename'>) {
+      const user = await authorize(sessionId, 'manage')
+      const bundle = await db.getBundle(id)
+      if (!bundle) return false
+      const rename = user.role === 'admin' || (await db.userCanReadBundle(user.id, id)
+        && (bundle.repoId === null || await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)))
+      if (!rename && reuse.provenance !== 'build') return false
+      return db.reuseBundle(id, { ...reuse, rename })
+    },
+    async removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null) {
+      const user = await authorize(sessionId, 'admin')
+      const repo = (await db.listAllRepos()).find(r => r.repoId === expected.repoId)
+      if (!repo) throw new ManagedMutationError(404, 'no-repo')
+      if (repo.fullName !== expected.fullName || repo.addedAt !== expected.addedAt) throw new ManagedMutationError(409, 'repository-changed')
+      if (annotations && reportReferenceSnapshot(await db.listReports()) !== annotations.reports) throw new ManagedMutationError(409, 'repository-changed')
+      const reports = await db.listReportsForRepo(repo.repoId)
+      const bundles = await db.listBundlesForRepo(repo.repoId)
+      const deletedReports = await db.deleteReportsForRepo(repo.repoId)
+      const deletedBundles = await db.deleteBundlesForRepo(repo.repoId)
+      const deletedTriage = await db.deleteTriage(annotations?.ids ?? [])
+      await db.deleteRepo(repo.repoId)
+      await db.recordActivity({ kind: 'delete', actor: user.login, actorId: user.id, repo: repo.fullName,
+        action: `removed a repository (${deletedReports} reports, ${deletedBundles} bundles, ${deletedTriage} triage entries)` }, Date.now())
+      return { reports, bundles, deletedReports, deletedBundles, deletedTriage }
+    },
+  }
+}

package/server-managed/npm-delta-worker.js

@@ -0,0 +1,23 @@
+// The lines a package's files change from one side to another (npm-delta.ts),
+// as @preventive/compare's compareTrees counts them (git's --numstat), off
+// the server's event loop: of its text files, renames found as git finds
+// them, a side not there empty; and, apart, those of its changes it stamps
+// `typeOnly`, declaration files changed in types alone.
+import { parentPort, workerData } from 'node:worker_threads'
+import { compareTrees } from '@preventive/compare'
+
+const tree = files => files.map(([name, data]) => ({ name, data }))
+const changes = compareTrees(tree(workerData.base), tree(workerData.other), { paths: 'keys', lines: true, renames: true })
+const answer = { additions: 0, deletions: 0, typeAdditions: 0, typeDeletions: 0, typeFiles: 0 }
+for (const change of changes) {
+  if (change.binary) continue
+  answer.additions += change.insertions ?? 0
+  answer.deletions += change.deletions ?? 0
+  if (change.typeOnly !== true) continue
+  answer.typeAdditions += change.insertions ?? 0
+  answer.typeDeletions += change.deletions ?? 0
+  answer.typeFiles++
+}
+// Node worker messages have no browser target origin.
+// oxlint-disable-next-line unicorn/require-post-message-target-origin
+parentPort.postMessage(answer)