@preventive/triage 1.0.0-alpha.52 → 1.0.0-alpha.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.52",
+  "version": "1.0.0-alpha.54",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -105,8 +105,10 @@
     "server-managed/bundle-build-diagnostics.d.ts",
     "server-managed/bundle-catalog.ts",
     "server-managed/bundle-commits.ts",
+    "server-managed/bundle-dependency-reviews.ts",
     "server-managed/bundle-store.ts",
     "server-managed/bundle-summary-cache.ts",
+    "server-managed/bundle-validation.ts",
     "server-managed/bundle.ts",
     "server-managed/cache-storage.ts",
     "server-managed/cli.js",
@@ -141,6 +143,7 @@
     "server-managed/github-oauth.ts",
     "server-managed/github-pulls.ts",
     "server-managed/github-requests.ts",
+    "server-managed/history-windows.ts",
     "server-managed/http-response.ts",
     "server-managed/http.ts",
     "server-managed/link-reports.ts",
@@ -213,6 +216,7 @@
     "server-managed/solidity-entry-points.ts",
     "server-managed/sql-postgres.ts",
     "server-managed/sql.ts",
+    "server-managed/stasis-config.ts",
     "server-managed/static.ts",
     "server-managed/storage.ts",
     "server-managed/storage-command.ts",
@@ -225,6 +229,7 @@
     "server-managed/team-feed.ts",
     "server-managed/team-npm-scopes.ts",
     "server-managed/team-app.ts",
+    "server-managed/team-app-summaries.ts",
     "server-managed/team-reports.ts",
     "server-managed/triage-response.ts",
     "server-managed/type-only.ts",
@@ -414,16 +419,16 @@
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@exodus/stasis": "1.0.0-beta.11",
-    "@exodus/stasis-core": "1.0.0-beta.11",
-    "@preventive/archive": "^1.2.0",
+    "@exodus/stasis": "1.0.0-beta.15",
+    "@exodus/stasis-core": "1.0.0-beta.15",
+    "@preventive/archive": "^1.4.0",
     "@preventive/compare": "^1.2.11",
     "@preventive/diff": "^1.1.0",
-    "@preventive/lockfile": "^1.2.0",
+    "@preventive/lockfile": "^1.3.0",
     "@preventive/publishers": "^1.1.0",
-    "@preventive/report": "^1.0.0",
+    "@preventive/report": "^1.0.1",
     "@preventive/sourcemap": "1.0.0-alpha.1",
-    "@preventive/upstream": "^1.3.0",
+    "@preventive/upstream": "^1.7.0",
     "css-tree": "^3.2.1",
     "oxc-minify": "^0.152.0",
     "oxc-parser": "^0.152.0",

package/risk/actions/resolve.js

@@ -1,5 +1,6 @@
 // A reference resolved on GitHub (`source`, index.d.ts ActionsSource): its
-// repository, its ref's commit and its own code's findings (README.md).
+// repository, its ref's commit, its advisories and its own code's findings
+// (README.md).
 import { YamlError } from '@preventive/lockfile/yaml.js'
 import { readWorkflow } from './workflow.js'
 import { workflowFindings, workflowUses } from './findings.js'
@@ -168,7 +169,34 @@ async function pinnedOf(uses, info, source, tags) {
     else if (tags) findings.push({ id: 'untagged-commit', severity: 'moderate', on: where })
   }
   if (uses.comment && !commentHolds(uses.comment, named)) findings.push({ id: 'comment-mismatch', severity: 'high', comment: uses.comment, tags: named })
-  return { commit, at: 'sha', findings }
+  return { commit, at: 'sha', named, findings }
+}
+
+// The versions a reference's advisories are asked of, as upstream's `github`
+// packages take them: the releases on the commit it runs (`v4.2.1`, not the
+// `v4` moving with it), else a commit by its tags, or as any release where
+// none names it, and a tag or a branch as named (a moving tag its whole line).
+function advisedVersions(at, ref, commit, named) {
+  const releases = named.filter(tag => isRelease(tagVersion(tag)))
+  if (releases.length > 0) return releases
+  if (at === 'sha') return named.length > 0 ? named : [commit]
+  return [ref]
+}
+
+const RATED = new Set(['critical', 'high', 'moderate', 'low'])
+
+// A repository's advisories at `versions` (`source.advisories`), each a
+// finding: malware red, else as its source rates it, one unrated yellow. One
+// not known public is `internal`, asked of its own advisories alone, its name
+// sent to no other source; why not (`advisories-unavailable`) where they
+// couldn't be had, the rest resolved all the same.
+async function advisoryFindings(source, info, versions) {
+  if (source.advisories === undefined) return []
+  try {
+    return (await source.advisories(info.fullName, versions, info.private ?? true)).map(({ id, title, url, severity, malware, versions: affected }) => ({
+      id: 'advisory', severity: malware ? 'critical' : RATED.has(severity) ? severity : 'moderate', advisory: id, ...title && { title }, ...url && { url },
+      ...malware && { malware: true }, versions: affected }))
+  } catch { return [{ id: 'advisories-unavailable', severity: 'notice' }] }
 }
 
 // A `$/path` (the repository's own at the commit running) as a reference.
@@ -202,9 +230,12 @@ export async function resolveAction(uses, source, { owner = null } = {}) {
   if (!info) return { ...at, repository: null, commit: null, at: null, tags: [], findings, uses: [] }
   const tags = await source.tags(info.fullName)
   const ref = uses.pin === 'sha' ? await pinnedOf(uses, info, source, tags) : await refOf(uses, info, source, tags)
-  const code = ref.commit && !ref.findings.some(({ id }) => id === 'commit-missing') ? await codeOf(uses, info, ref.commit, source) : null
+  const runs = ref.commit && !ref.findings.some(({ id }) => id === 'commit-missing')
+  // What it runs, and its advisories at the versions that is.
+  const [code, advised] = runs ? await Promise.all([codeOf(uses, info, ref.commit, source),
+    advisoryFindings(source, info, advisedVersions(ref.at, uses.ref, ref.commit, ref.named ?? tagsOn(tags, ref.commit)))]) : [null, []]
   return { ...at, repository: { fullName: info.fullName, private: Boolean(info.private) }, commit: ref.commit, at: ref.at, tags: tagsOn(tags, ref.commit),
-    findings: [...findings, ...ref.findings, ...code?.findings ?? []], uses: code?.uses ?? [] }
+    findings: [...findings, ...ref.findings, ...advised, ...code?.findings ?? []], uses: code?.uses ?? [] }
 }
 
 // `source` with its answers kept, by what was asked, while held: a scan's.
@@ -215,5 +246,5 @@ export function keptSource(source) {
     if (!kept.has(key)) kept.set(key, source[method](...args).catch(error => { kept.delete(key); throw error }))
     return kept.get(key)
   }
-  return Object.fromEntries(['repo', 'tags', 'tag', 'branch', 'branches', 'contains', 'file'].map(method => [method, keep(method)]))
+  return Object.fromEntries(['repo', 'tags', 'tag', 'branch', 'branches', 'contains', 'file', 'advisories'].filter(method => source[method]).map(method => [method, keep(method)]))
 }

package/risk/index.d.ts

@@ -68,7 +68,8 @@ export interface AssessNpmOptions {
   advisories?: boolean
   // Whether OSV's records of malware in the version are asked for too, where
   // `advisories` are: false for a private package, whose name OSV is never
-  // to be sent. True unless given.
+  // to be sent, as upstream sends it none npm's registry doesn't serve
+  // anyone. True unless given.
   osv?: boolean
   // Whether a package is the caller's own, as its own scopes take: a new
   // dependency on one is told no tier nor age, nor is npm asked of it. None
@@ -178,7 +179,8 @@ export function npmReadyDownload(name: string, options: { cache: CacheStore; sig
 // Whether an advisory is of malware rather than a vulnerability: OSV's of a
 // malicious package (`MAL-…`), or one such a record names (its `aliases`),
 // CWE-506, embedded malicious code, whatever its title, or a title naming
-// malware.
+// malware. The rule @preventive/upstream's advisories tell `malware` by, for
+// those it doesn't tell, as Dependabot's alerts.
 export function npmMalwareAdvisory(advisory: { id?: string | undefined; aliases?: readonly string[] | undefined; cwe?: readonly string[] | undefined; title?: string | undefined }): boolean
 
 export function npmFileRisk(path: string, text: string | null, bytes?: number, script?: boolean): unknown
@@ -235,6 +237,22 @@ export interface ActionsSource {
   // commits, it holds for good.
   contains(name: string, base: string, sha: string): Promise<boolean | null>
   file(name: string, path: string, commit: string): Promise<string | null>
+  // A repository's advisories at `versions`, as upstream's `advisories`
+  // tells those of a `github` package: its own published ones, and but for
+  // one `internal` (not known public), OSV's of it as an Action. Without it,
+  // none are asked.
+  advisories?(name: string, versions: string[], internal: boolean): Promise<ActionAdvisory[]>
+}
+
+// An advisory of a repository, as upstream's `advisories` tells one.
+export interface ActionAdvisory {
+  id: string
+  url?: string | undefined
+  title?: string | undefined
+  severity?: string | undefined
+  malware?: boolean | undefined
+  // The versions asked that it affects.
+  versions: string[]
 }
 
 // A reference resolved: its repository as GitHub has it now, its ref's

package/risk/npm/malware.js

@@ -9,7 +9,9 @@
 // files its malware advisories as CWE-506, embedded malicious code, whatever
 // their title ("Critical severity vulnerability that affects event-stream
 // and flatmap-stream"); and its title may say so where its CWE doesn't
-// (@solana/web3.js's GHSA-jcxm-7wvp-g6p5, CWE-200 alone).
+// (@solana/web3.js's GHSA-jcxm-7wvp-g6p5, CWE-200 alone). The rule upstream
+// tells its own advisories' `malware` by, for those it doesn't tell, as
+// Dependabot's alerts.
 export const npmMalwareAdvisory = ({ id, aliases, cwe, title }) => [id, ...aliases ?? []].some(name => (name ?? '').startsWith('MAL-'))
   || (cwe ?? []).includes('CWE-506') || /\bmalware\b/iu.test(title ?? '')
 
@@ -27,10 +29,10 @@ export function npmPlaceholder(json) {
 
 // The `malware` finding of a version, critical: its package taken down by npm
 // (`takenDown`, its latest version npm's placeholder), and the advisories of
-// malware among `advisories` (`{ id, url?, title?, cwe }`), each `{ id, url?,
-// title? }` once; null for neither.
+// malware among `advisories` (`{ id, url?, title?, malware }`, as upstream
+// tells it), each `{ id, url?, title? }` once; null for neither.
 export function npmMalwareFinding({ takenDown, advisories }) {
-  const named = new Map(advisories.filter(npmMalwareAdvisory).map(({ id, url, title }) => [id, { id, ...url ? { url } : {}, ...title ? { title } : {} }]))
+  const named = new Map(advisories.filter(({ malware }) => malware).map(({ id, url, title }) => [id, { id, ...url ? { url } : {}, ...title ? { title } : {} }]))
   if (!takenDown && named.size === 0) return null
   return { id: 'malware', severity: 'critical', ...takenDown ? { takenDown: true } : {}, ...named.size > 0 ? { advisories: [...named.values()] } : {} }
 }

package/risk/npm/registry.js

@@ -211,10 +211,12 @@ export async function npmPackageFacts(name, version, oldVersion, context) {
 // npm's advisories of `version` of a package, as `npm audit` asks them, and
 // where `osv`, OSV's records npm's registry hasn't, as the malicious
 // packages' of nx's versions are (MAL-2025-41443, of GHSA-cxm3-wv7p-598c,
-// which npm's registry hasn't): upstream's `advisories` and its `osv`, an
-// advisory of npm's an OSV record names taking the record's ids among its
-// `aliases`. Each `{ id, url?, title?, cwe, aliases }`, kept ADVISORIES_MS,
-// and given up on once `signal` aborts.
+// which npm's registry hasn't): upstream's `advisories` and its `osv`, which
+// sends OSV the name only where npm's registry serves it anyone. Each `{ id,
+// url?, title?, malware }`, whether it is of malware as upstream tells it, an
+// advisory of npm's an OSV record of malware names among them; kept
+// ADVISORIES_MS, those kept with no `malware` asked again, and given up on
+// once `signal` aborts.
 export async function npmVersionAdvisories(name, version, osv, context) {
   const what = `${name}@${version}`
   const { rows } = await kept(context, 'risk/npm/advisories', what, async () => {
@@ -222,8 +224,8 @@ export async function npmVersionAdvisories(name, version, osv, context) {
     const asked = await untilAborted(advisories([{ ecosystem: 'npm', name, versions: [version] }], { cache: false, osv }), context.signal).catch(error => {
       throw context.signal?.aborted ? error : new NpmRiskError(error?.status === 429 ? 'upstream-busy' : 'upstream-unavailable', `advisories of ${what} couldn't be had: ${error.message}`)
     })
-    return { at: context.now, osv, rows: asked.map(({ id, url, title, cwe, aliases }) => ({ id, ...url ? { url } : {}, ...title ? { title } : {}, cwe, aliases })) }
-  }, hit => context.now - hit.at < ADVISORIES_MS && hit.osv === osv)
+    return { at: context.now, osv, rows: asked.map(({ id, url, title, malware }) => ({ id, ...url ? { url } : {}, ...title ? { title } : {}, malware: malware === true })) }
+  }, hit => context.now - hit.at < ADVISORIES_MS && hit.osv === osv && hit.rows.every(row => typeof row.malware === 'boolean'))
   return rows
 }
 

package/server-managed/bundle-advisories.ts

@@ -1,83 +1,67 @@
 import { type Advisory, type CacheStore, type Package, advisories } from '@preventive/upstream/advisories.js'
 import { type Client, HttpError, createClient } from '@preventive/upstream/github.js'
-import { isNpmPackageName, npmPackageScope } from '../common/managed/npm-packages.js'
-import { NPM_REGISTRY, askUpstream } from './npm-packages.ts'
 
 export const ADVISORIES_TIMEOUT_MS = 30_000
-const PUBLIC_AT_ONCE = 16
-const order = (a: string, b: string) => Number(a > b) - Number(a < b)
-
-// Whether anyone may read a package, so that its name may go to a service
-// other than npm (OSV): an unscoped one always, npm's private packages
-// always being scoped; a scoped one where npm answers it anonymously, asked
-// by a HEAD, which reads nothing of it. One npm can't be asked of is taken
-// as private, and not kept; the rest are, for PUBLIC_MS, PUBLIC_NAMES at
-// most, as a package may be made private, or public. A name npm can't have
-// is asked of no one, upstream refusing it.
-const PUBLIC_MS = 60 * 60_000
-const PUBLIC_NAMES = 10_000
-const publicNames = new Map<string, { at: number; open: boolean }>()
-async function isPublicNpmPackage(name: string, signal: AbortSignal): Promise<boolean> {
-  if (!isNpmPackageName(name)) return false
-  if (npmPackageScope(name) === null) return true
-  const kept = publicNames.get(name)
-  if (kept && Date.now() - kept.at < PUBLIC_MS) return kept.open
-  let open
-  try { open = await askUpstream(`${NPM_REGISTRY}/${name}`, { method: 'HEAD', limit: Number.MAX_SAFE_INTEGER, signal, absent: [401, 403, 404] }) !== null } catch { return false }
-  publicNames.delete(name)
-  publicNames.set(name, { at: Date.now(), open })
-  while (publicNames.size > PUBLIC_NAMES) publicNames.delete(publicNames.keys().next().value!)
-  return open
-}
-
-// The npm packages anyone may read (isPublicNpmPackage), a few asked at a
-// time, within PUBLIC_BUDGET_MS, a third of the audit's: a scoped one npm
-// hasn't told of by then is taken as private, asked of npm alone, for the
-// audit to keep the rest of its time.
-const PUBLIC_BUDGET_MS = 10_000
-async function publicNpmNames(packages: Package[], signal: AbortSignal): Promise<Set<string>> {
-  const names = [...new Set(packages.filter(pkg => pkg.ecosystem === 'npm').map(pkg => pkg.name))]
-  const open = new Set<string>()
-  const budget = new AbortController()
-  const timer = setTimeout(() => { budget.abort(new Error('public-check-budget')) }, PUBLIC_BUDGET_MS)
-  const asking = AbortSignal.any([signal, budget.signal])
-  try {
-    for (let at = 0; at < names.length; at += PUBLIC_AT_ONCE) {
-      const chunk = names.slice(at, at + PUBLIC_AT_ONCE)
-      const checked = await Promise.all(chunk.map(name => isPublicNpmPackage(name, asking)))
-      for (const [i, name] of chunk.entries()) if (checked[i]) open.add(name)
-    }
-  } finally { clearTimeout(timer) }
-  return open
-}
 
 function advisoryGithubClient(token: string | null, signal: AbortSignal): Client {
   const authenticated = createClient({ token, userAgent: 'deepview-triage' })
   let client = authenticated
+  // Published advisories, and whether a repository is public, remain
+  // readable after a token is revoked. Reuse anonymous access for subsequent
+  // repositories in this audit as well.
+  async function retried<T>(ask: (current: Client) => Promise<T>): Promise<T> {
+    const current = client
+    try { return await ask(current) } catch (error) {
+      if (token === null || current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
+      signal.throwIfAborted()
+      if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
+      return await ask(client)
+    }
+  }
   return {
     ...authenticated,
-    async listRepoAdvisories(options) {
-      const current = client
-      try { return await current.listRepoAdvisories(options) } catch (error) {
-        if (token === null || current !== authenticated || !(error instanceof HttpError) || error.status !== 401) throw error
-        signal.throwIfAborted()
-        // Published advisories remain readable after a token is revoked. Reuse
-        // anonymous access for subsequent repositories in this audit as well.
-        if (client === authenticated) client = createClient({ token: null, userAgent: 'deepview-triage' })
-        return await client.listRepoAdvisories(options)
-      }
-    },
+    listRepoAdvisories: options => retried(current => current.listRepoAdvisories(options)),
+    getRepo: options => retried(current => current.getRepo(options)),
+  }
+}
+
+// How many repositories GitHub is asked at once whether they are public, as
+// upstream asks for their listings.
+const REPOS_AT_ONCE = 4
+
+// Whether GitHub says anyone may read `repo`: not one private, nor one it
+// has none of for this client (gone, or not the caller's to read). Any other
+// failure is thrown, as the audit then fails.
+async function isPublicRepo(github: Client, repo: string): Promise<boolean> {
+  try { return (await github.getRepo({ repo, followRedirect: true }) as { private?: unknown } | null)?.private === false } catch (error) {
+    if (error instanceof HttpError && [404, 410, 451].includes(error.status)) return false
+    throw error
+  }
+}
+
+// The packages as upstream is asked of them. Upstream asks OSV of every
+// `github` package by its name, as an Action, but of one `internal`: each is
+// internal but where GitHub says its repository is public, so a private one,
+// or one GitHub has none of, has its own published advisories read alone, as
+// a private npm package's name never reaches OSV either. One that says
+// (`internal`, as its caller knows) is taken as it says.
+async function markInternal(packages: Package[], github: Client): Promise<Package[]> {
+  const internal = new Set(packages.flatMap(pkg => pkg.ecosystem === 'github' && pkg.internal === undefined ? [pkg.name] : []))
+  const repos = [...internal]
+  for (let at = 0; at < repos.length; at += REPOS_AT_ONCE) {
+    await Promise.all(repos.slice(at, at + REPOS_AT_ONCE).map(async repo => { if (await isPublicRepo(github, repo)) internal.delete(repo) }))
   }
+  return packages.map(pkg => pkg.ecosystem === 'github' && internal.has(pkg.name) ? { ...pkg, internal: true } : pkg)
 }
 
 // The managed caller supplies its user's token when available; public shares
 // remain anonymous. Upstream sends this credential only to GitHub and returns
 // published advisories, matching versions across npm, OSV and repository rows:
 // OSV's for npm packages anyone may read too, the malicious packages' records
-// among them, which npm's registry hasn't.
-// `cache` keeps each repository's listing (upstream-cache.ts) across audits;
-// `github`, a client of the caller's, asks GitHub in place of one with
-// `githubToken`.
+// among them, which npm's registry hasn't, each row of malware told so
+// (`malware`). `cache` keeps each repository's listing, and the npm packages
+// anyone may read (upstream-cache.ts), across audits; `github`, a client of
+// the caller's, asks GitHub in place of one with `githubToken`.
 export async function fetchBundleAdvisories(packages: Package[], signal: AbortSignal,
   { debug = false, repoAdvisories = false, details = false, githubToken = null, github, cache }: {
     debug?: boolean; repoAdvisories?: boolean; details?: boolean; githubToken?: string | null; github?: Client; cache?: CacheStore | undefined
@@ -95,17 +79,15 @@ export async function fetchBundleAdvisories(packages: Package[], signal: AbortSi
       signal.addEventListener('abort', onAbort, { once: true })
     })
     // npm packages anyone may read are asked of OSV too (upstream's `osv`),
-    // for the malicious packages' records npm's registry hasn't; a private
-    // one's name never leaves for OSV, as it never does for Socket. A package
-    // is wholly in one ask or the other, so upstream's order holds.
-    const open = await Promise.race([publicNpmNames(packages, signal), deadline])
-    const toOsv = (pkg: Package) => pkg.ecosystem === 'npm' && open.has(pkg.name)
-    // Kept in the caller's store, or without one in upstream's disk cache,
-    // where the server set one (auditCache).
-    const options = { github: github ?? advisoryGithubClient(githubToken, signal), repoAdvisories, details, ...(cache && { cache }) }
-    const asked = [{ part: packages.filter(toOsv), osv: true }, { part: packages.filter(pkg => !toOsv(pkg)), osv: false }]
-    const result = await Promise.race([Promise.all(asked.map(({ part, osv }) => part.length === 0 ? Promise.resolve([]) : advisories(part, { ...options, osv }))), deadline])
-    return { status: 200, body: result.flat().toSorted((a, b) => order(a.ecosystem, b.ecosystem) || order(a.name, b.name)) }
+    // for the malicious packages' records npm's registry hasn't: upstream
+    // sends OSV only the names npm's registry serves without a token, so a
+    // private one's never leaves for OSV, as it never does for Socket; nor an
+    // internal `github` package's (markInternal). Kept
+    // in the caller's store, or without one in upstream's disk cache, where
+    // the server set one (auditCache).
+    const client = github ?? advisoryGithubClient(githubToken, signal)
+    const options = { github: client, repoAdvisories, details, osv: true, ...(cache && { cache }) }
+    return { status: 200, body: await Promise.race([markInternal(packages, client).then(asked => advisories(asked, options)), deadline]) }
   } catch (error) {
     // Answered as upstream's failure alone: logged, its message, or with
     // `debug` the whole error, but for a request its client gave up on. One

package/server-managed/bundle-build-worker.js

@@ -7,8 +7,53 @@ import { brotliOptions } from '@exodus/stasis-core/brotli'
 import { HttpError, createClient } from '@preventive/upstream/github.js'
 import { githubBundleFilename } from './bundle-build.ts'
 import { bundleBuildDiagnostic } from './bundle-build-diagnostics.js'
+import { MAX_STASIS_CONFIG_BYTES, STASIS_CONFIG, parseStasisConfig } from './stasis-config.ts'
 
 const regularFile = entry => entry.type === 'blob' && ['100644', '100755'].includes(entry.mode)
+const parentOf = path => posix.dirname(path).replace(/^\.$/u, '')
+
+// The entries the stasis.config.json in `directory` names (parseStasisConfig's),
+// null where it has none. One whose entries Stasis can't tell is config-invalid.
+async function directoryConfig(input, github, directory, client) {
+  const listing = await client.listRepoDir({ repo: github, sha: input.commit, directory: directory || undefined })
+  if (!listing.some(entry => entry.path === STASIS_CONFIG && regularFile(entry))) return null
+  const path = posix.join(directory, STASIS_CONFIG)
+  const text = await client.getRepoFile({ repo: github, path, ref: input.commit })
+  try {
+    if (Buffer.byteLength(text) > MAX_STASIS_CONFIG_BYTES) throw new Error(`${path} is larger than ${MAX_STASIS_CONFIG_BYTES} bytes`)
+    return parseStasisConfig(text, directory)
+  } catch (error) {
+    throw new Error('config-invalid', { cause: error })
+  }
+}
+
+// The directory of the stasis.config.json listing the selected entries: for
+// each entry, the nearest one at or above it whose `entries` names it. null
+// where none lists any. Stasis reads the one in the directory it builds from
+// alone, and builds the entries it lists alone: with others, or with another
+// file's, they are config-mixed.
+async function listingConfig(input, github, client) {
+  const configs = new Map()
+  const configAt = directory => {
+    if (!configs.has(directory)) configs.set(directory, directoryConfig(input, github, directory, client))
+    return configs.get(directory)
+  }
+  const found = await Promise.all(input.entries.map(async entry => {
+    for (let directory = parentOf(entry); ; directory = parentOf(directory)) {
+      const config = await configAt(directory)
+      if (config?.has(posix.relative(`/${directory}`, `/${entry}`))) return { entry, directory }
+      if (!directory) return { entry, directory: null }
+    }
+  }))
+  const listed = found.find(at => at.directory !== null)
+  if (!listed) return null
+  const other = found.find(at => at.directory !== listed.directory)
+  if (other) {
+    const where = at => at.directory === null ? 'none' : posix.join(at.directory, STASIS_CONFIG)
+    throw new Error('config-mixed', { cause: new Error(`${listed.entry} is listed in ${where(listed)}, ${other.entry} in ${where(other)}`) })
+  }
+  return listed.directory
+}
 
 async function projectDirectory(input, github, client) {
   // Input validation permits either JS/TS entries or Solidity entries, never a mix.
@@ -61,7 +106,13 @@ export async function buildStasisBundle({ input, github, token, maxBytes, scopes
   // disk. This fresh worker inherits no application credentials but NPM_TOKEN.
   setCacheDir(cacheDir ?? false)
   progress('build')
-  const project = await projectDirectory(input, github, buildClient)
+  // Entries stasis.config.json lists are built from its directory, where
+  // Stasis builds each with its options there, taking no conditions; others,
+  // from their project with the conditions chosen.
+  const configured = await listingConfig(input, github, buildClient)
+  if (configured !== null && input.conditions !== null) throw new Error('config-conditions')
+  if (configured === null && input.conditions === null && !input.entries[0].endsWith('.sol')) throw new Error('bad-conditions')
+  const project = configured ?? await projectDirectory(input, github, buildClient)
   if (!allowed(project)) throw new Error('build-scope')
   const generate = await prismaGenerate(input, github, project, buildClient)
   const { bundle } = await buildGitHubBundle({
@@ -86,10 +137,16 @@ export async function buildStasisBundle({ input, github, token, maxBytes, scopes
 
 // The code a failed build answers with. Never upstream bodies or paths outside
 // the caller's grants: those stay in the diagnostic. A missing or ambiguous
-// lockfile, or the named one missing, is the lockfile's.
+// lockfile, or the named one missing, is the lockfile's. Stasis refuses a
+// stasis.config.json entry setting an option that runs a program, whatever
+// is given (nothing of the repo runs); one it can't build with its options
+// is the config's.
 export function buildErrorCode(error, message) {
-  if (['build-scope', 'too-large'].includes(message)) return message
+  if (['build-scope', 'too-large', 'bad-conditions', 'config-invalid', 'config-mixed', 'config-conditions'].includes(message)) return message
   if (error instanceof HttpError) return error.status === 429 ? 'github-rate-limited' : 'github-build-failed'
+  if (/, which runs .+, and nothing of the project runs here$/u.test(message)) return 'config-runs-code'
+  if (message.endsWith(': bundle either the entries it names or others, not both')) return 'config-mixed'
+  if (/\bstasis\.config\.json(?: is not valid JSON|: entries)/u.test(message)) return 'config-invalid'
   return /no packageManager given|lockfile installs|no (?:pnpm-lock\.yaml|yarn\.lock|package-lock\.json|soldeer\.lock) found in /u.test(message) ? 'build-lockfile' : 'build-failed'
 }
 
@@ -110,6 +167,6 @@ if (parentPort && workerData?.type === 'managed-bundle-build') {
   } catch (error) {
     const diagnostic = bundleBuildDiagnostic(error, workerData.token)
     const code = buildErrorCode(error, diagnostic.message)
-    send({ error: code, status: code === 'too-large' ? 413 : code === 'build-scope' ? 403 : 422, diagnostic })
+    send({ error: code, status: code === 'too-large' ? 413 : code === 'build-scope' ? 403 : code === 'bad-conditions' ? 400 : 422, diagnostic })
   }
 }

package/server-managed/bundle-build.ts

@@ -18,7 +18,9 @@ export interface BundleBuildInput {
   entries: string[]
   directory: string
   options: { conditions?: string[]; mainFields?: string[]; metro?: boolean; platforms?: string[]; jsx?: boolean; packageManager?: 'soldeer' }
-  // What the stored bundle records; null for Solidity, which takes no conditions.
+  // What the stored bundle records; null for Solidity, which takes no
+  // conditions, and for entries given none, which stasis.config.json must
+  // then list (the build checks: bundle-build-worker.js).
   conditions: BundleBuildConditions | null
 }
 
@@ -27,6 +29,13 @@ function path(value: unknown): value is string {
     && value.split('/').every(part => part !== '' && part !== '.' && part !== '..')
 }
 
+const isScript = (entry: string) => /\.[cm]?[tj]sx?$/iu.test(entry)
+
+// Whether a build takes `value` as an entry point, with others in its language.
+export function buildableEntry(value: unknown): value is string {
+  return path(value) && (isScript(value) || value.endsWith('.sol'))
+}
+
 export function parseBundleBuild(value: unknown): BundleBuildInput {
   const fail = (code = 'bad-request'): never => { throw new BundleBuildError(400, code) }
   if (value == null || typeof value !== 'object' || Array.isArray(value)) return fail()
@@ -35,7 +44,7 @@ export function parseBundleBuild(value: unknown): BundleBuildInput {
     || typeof commit !== 'string' || !/^[a-f\d]{40}$/u.test(commit)
     || !Array.isArray(entries) || entries.length === 0 || entries.length > 100 || !entries.every(path)) return fail()
   const selected = [...new Set(entries as string[])]
-  const scripts = selected.every(entry => /\.[cm]?[tj]sx?$/iu.test(entry))
+  const scripts = selected.every(isScript)
   if (!scripts && !selected.every(entry => entry.endsWith('.sol'))) return fail('unsupported-entries')
   const parts = posix.dirname(selected[0]!).split('/').filter(part => part !== '.')
   for (const entry of selected) {
@@ -46,8 +55,8 @@ export function parseBundleBuild(value: unknown): BundleBuildInput {
   // above the project no longer leaves it unable to tell which one installs it.
   const options: BundleBuildInput['options'] = scripts ? {} : { packageManager: 'soldeer' }
   let recorded: BundleBuildConditions | null = null
-  if (scripts) {
-    if (conditions == null || typeof conditions !== 'object' || Array.isArray(conditions)) return fail('bad-conditions')
+  if (scripts && conditions != null) {
+    if (typeof conditions !== 'object' || Array.isArray(conditions)) return fail('bad-conditions')
     const { preset, conditions: names, platforms } = conditions as Record<string, unknown>
     if (typeof preset !== 'string' || !['node', 'browser', 'metro'].includes(preset) || !Array.isArray(names) || names.length > 16
       || !names.every(name => typeof name === 'string' && name.length > 0 && name.length <= 64

package/server-managed/bundle-dependency-reviews.ts

@@ -0,0 +1,74 @@
+// What a bundle's npm dependencies want of review, in a repository that
+// reviews dependencies (repository-dependency-reviews.ts), as its Overview
+// tells it: the package versions it bundles (bundle-advisory-inventory.ts),
+// each as the lockfiles that install it lock it at the commit it was built
+// from, whence their integrities, sources and patches, which reviews are held
+// to (pull-dependency-reviews.ts), judged as the other versions a pull
+// request's lockfiles lock are: by reviews of them whole or compared with any
+// version of their package, else passed by the commit it is reviewed since
+// or the host's reviewed dependencies.
+//
+// Its lockfiles are those its review holds to (lockfile-scope.ts) in its
+// directory or a directory above it, as an install of it reads one there, a
+// workspace's at its root; each version as the nearest of their directories
+// that locks it locks it, every integrity and patch it locks it with. One no
+// lockfile there locks (`unlocked`) can't be reviewed, as there is nothing to
+// hold its reviews to: it fails the review, as one that can't be reviewed
+// does. Where its review holds to none of the lockfiles there, but there are
+// some, its dependencies aren't reviewed (`reviewedIn`).
+import { type CommitLockfiles, lockedIn } from './commit-lockfiles.ts'
+import type { LockedPackage } from './locked-packages.ts'
+import { MAX_LOCKED, type PullDependencies, lockedWith, lockfileFormat } from './pull-dependencies.ts'
+import { MAX_UNREVIEWED } from './pull-dependency-reviews.ts'
+
+// A version a bundle holds: its package's name and its version.
+export interface BundledVersion { name: string; version: string }
+
+// The directory a lockfile at `path` is in, '' for the repository's root.
+const directoryOf = (path: string) => path.includes('/') ? path.slice(0, path.lastIndexOf('/')) : ''
+// A bundle's directory as one is compared: without the slashes either end.
+const bundleDirectory = (directory: string) => directory.replaceAll(/^\/+|\/+$/gu, '')
+const depth = (dir: string) => dir === '' ? 0 : dir.split('/').length
+
+// Whether the lockfile at `path` may install the bundle in `directory`: one
+// in it, or in a directory above it.
+export function installsBundle(path: string, directory: string): boolean {
+  const at = bundleDirectory(directory), dir = directoryOf(path)
+  return dir === '' || at === dir || at.startsWith(`${dir}/`)
+}
+
+// The versions `bundled` as `read`'s lockfiles (those installing the bundle,
+// read at `commit`) lock them, as one directory of a pull request's
+// lockfiles (pull-dependencies.ts) whose versions it adds none of, each as
+// the nearest of their directories locking it locks it, those past
+// MAX_LOCKED counted (`moreLocked`), and each lockfile left unread a
+// directory of its own failing the review; with those none lock
+// (`unlocked`, as many as MAX_UNREVIEWED, how many more `moreUnlocked`) and
+// how many versions it bundles (`versions`), each once.
+export function bundleDependencies(bundled: BundledVersion[], read: CommitLockfiles, commit: string) {
+  const versions = [...new Map(bundled.map(one => [`${one.name}@${one.version}`, one])).values()]
+  const byDirectory = new Map<string, string[]>()
+  for (const { path } of read.lockfiles) byDirectory.set(directoryOf(path), [...byDirectory.get(directoryOf(path)) ?? [], path])
+  // Each directory's versions by their name and version, the nearest first.
+  const nearest = [...byDirectory].toSorted(([a], [b]) => depth(b) - depth(a)).map(([dir, paths]) => {
+    const locked = new Map<string, LockedPackage[]>()
+    for (const pkg of lockedIn(read, path => directoryOf(path) === dir).packages) {
+      const key = `${pkg.name}@${pkg.version ?? ''}`
+      locked.set(key, [...locked.get(key) ?? [], pkg])
+    }
+    return { paths, locked }
+  })
+  const found = new Map<string, LockedPackage>()
+  const unlocked: BundledVersion[] = []
+  for (const one of versions) {
+    const variants = nearest.find(({ locked }) => locked.has(`${one.name}@${one.version}`))?.locked.get(`${one.name}@${one.version}`)
+    if (!variants) { unlocked.push(one); continue }
+    for (const pkg of variants) if (!found.has(lockedWith(pkg))) found.set(lockedWith(pkg), pkg)
+  }
+  const locked = [...found.values()]
+  const told: PullDependencies = { base: commit, head: commit, cut: false, lockfiles: [
+    { paths: nearest.flatMap(({ paths }) => paths), added: [], more: 0, locked: locked.slice(0, MAX_LOCKED), moreLocked: Math.max(0, locked.length - MAX_LOCKED) },
+    ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' })),
+  ] }
+  return { told, versions: versions.length, unlocked: unlocked.slice(0, MAX_UNREVIEWED), moreUnlocked: Math.max(0, unlocked.length - MAX_UNREVIEWED) }
+}