@preventive/triage 1.0.0-alpha.53 → 1.0.0-alpha.54

package/server-managed/package-entry-points.ts

@@ -1,5 +1,7 @@
 import { Buffer } from 'node:buffer'
+import { buildableEntry } from './bundle-build.ts'
 import { normalizeTeamPath } from './repo-path.ts'
+import { MAX_STASIS_CONFIG_BYTES, parseStasisConfig } from './stasis-config.ts'
 
 export const MAX_PACKAGE_BYTES = 256 * 1024
 const MAX_ENTRY_POINTS = 100
@@ -33,19 +35,45 @@ export function packageEntryPoints(manifest: unknown, directory: string): string
   return [...paths]
 }
 
+// The entries a stasis.config.json in `directory` lists, as repository paths:
+// the ones a server build takes, which it builds with their options there.
+export function configEntryPoints(text: string, directory: string): string[] {
+  const paths: string[] = []
+  for (const key of parseStasisConfig(text, directory) ?? []) {
+    const path = directory ? `${directory}/${key}` : key
+    if (buildableEntry(path) && paths.length < MAX_ENTRY_POINTS) paths.push(path)
+  }
+  return paths
+}
+
 // Use the immutable blob from the authorized listing, never download_url or a
-// resolved symlink target. Malformed or oversized manifests are optional.
+// resolved symlink target. A malformed or oversized blob is none (null).
+async function readBlobText(sha: string, read: (suffix: string) => Promise<unknown>, maxBytes: number): Promise<string | null> {
+  const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
+  if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
+    || blob.size < 0 || blob.size > maxBytes || blob.content.length > maxBytes * 2) return null
+  const bytes = Buffer.from(blob.content, 'base64')
+  return bytes.length !== blob.size || bytes.length > maxBytes ? null : bytes.toString('utf8')
+}
+
+// Manifests are optional: suggestions must not prevent browsing. The handler
+// still rechecks GitHub and managed access after these optional upstream reads.
 export async function readPackageEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
   try {
-    const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
-    if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
-      || blob.size < 0 || blob.size > MAX_PACKAGE_BYTES || blob.content.length > MAX_PACKAGE_BYTES * 2) return []
-    const bytes = Buffer.from(blob.content, 'base64')
-    if (bytes.length !== blob.size || bytes.length > MAX_PACKAGE_BYTES) return []
-    return packageEntryPoints(JSON.parse(bytes.toString('utf8')), directory)
+    const text = await readBlobText(sha, read, MAX_PACKAGE_BYTES)
+    return text === null ? [] : packageEntryPoints(JSON.parse(text), directory)
+  } catch {
+    return []
+  }
+}
+
+// A stasis.config.json whose entries Stasis can't tell lists none here;
+// building them reports why (config-invalid), as it does options Stasis refuses.
+export async function readConfigEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
+  try {
+    const text = await readBlobText(sha, read, MAX_STASIS_CONFIG_BYTES)
+    return text === null ? [] : configEntryPoints(text, directory)
   } catch {
-    // Suggestions must not prevent browsing. The handler still rechecks
-    // GitHub and managed access after this optional upstream read.
     return []
   }
 }

package/server-managed/pretty-print.ts

@@ -13,7 +13,7 @@ import { brotliDecompress } from 'node:zlib'
 import { format } from '@preventive/compare/pretty.js'
 import { computeFileHash } from '@preventive/report'
 import { FILE_HASH, computeBundleFileHashes } from '../common/bundle-metadata.js'
-import { bundleCompareFiles } from '../common/bundle-compare-inputs.js'
+import { bundleCompareFiles, bundleCompareSideScopes } from '../common/bundle-compare-inputs.js'
 import { bundlePackageDirs, bundleSourcesAsMap } from '../common/bundle-sources.js'
 import { MAX_PRETTY_BYTES, needsPrettyPrint, prettyExtension } from '../common/pretty-print.js'
 import type { OpenedBlob } from './blob-store.ts'
@@ -413,12 +413,14 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     // before this resolves: for the files that changed between them
     // pretty-printed (compared), and their diffs with renamed names hidden
     // (rename-diff.ts renamedPairs); a bundle's within a reason `scope`
-    // where one is asked for, as Compare reads it then.
-    bundleSides(base: ManagedBundle, other: ManagedBundle, scope = ''): Promise<[ComparedSide, ComparedSide]> {
-      const sideOf = async (record: ManagedBundle, side: Side): Promise<ComparedSide> => ({ side, ...await bundleSide(await bundleDetails(record), scope),
+    // where one is asked for, as Compare reads it then (bundleCompareSideScopes).
+    async bundleSides(base: ManagedBundle, other: ManagedBundle, scope = ''): Promise<[ComparedSide, ComparedSide]> {
+      const [baseDetails, otherDetails] = await Promise.all([bundleDetails(base), bundleDetails(other)])
+      const [baseScope, otherScope] = bundleCompareSideScopes(baseDetails, otherDetails, scope)
+      const sideOf = async (record: ManagedBundle, details: typeof baseDetails, side: Side, within: string): Promise<ComparedSide> => ({ side, ...await bundleSide(details, within),
         kept: request => kept(() => bundles.open(record.id, prettyFile(request))),
         made: async (request, text) => opened(await bundleCopy(record, request, () => Promise.resolve(text))) })
-      return Promise.all([sideOf(base, 'base'), sideOf(other, 'other')])
+      return Promise.all([sideOf(base, baseDetails, 'base', baseScope), sideOf(other, otherDetails, 'other', otherScope)])
     },
     // A bundle's details, read in its turn, as Compare pairs them (comparison.ts).
     bundleDetails,

package/server-managed/public-workspace.ts

@@ -12,7 +12,7 @@ import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
-import { auditCache, auditedRepos } from './upstream-cache.ts'
+import { auditCache, auditedKeys } from './upstream-cache.ts'
 import { serveTeamFeed } from './team-feed.ts'
 import { type ComparedSide, PrettyError, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
@@ -207,7 +207,7 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
     const repoAdvisories = url.searchParams.get('repoAdvisories') === 'true'
     const result = await fetchBundleAdvisories(inventory.packages, signal, {
       debug: deps.config.debug, repoAdvisories, details: url.searchParams.get('details') === 'true',
-      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug, auditedRepos(inventory.packages, repoAdvisories)),
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug, auditedKeys(inventory.packages, repoAdvisories)),
     })
     await recheck()
     json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return

package/server-managed/repository-actions.ts

@@ -111,7 +111,8 @@ const isCommit = (text: string) => /^[\da-f]{40}$/u.test(text)
 
 // `source`, what it answers of a public repository kept for every scan, the
 // same whoever asks: of a commit while kept (but none, as one can be pushed
-// later), the rest for RISK_KEPT_MS. A private one's, or one missing, never.
+// later), the rest, its advisories too, for RISK_KEPT_MS. A private one's,
+// or one missing, never.
 export function sharedSource(source: ActionsSource, answers: ActionAnswers): ActionsSource {
   const keyOf = (what: string, name: string, ...more: string[]) => [what, name.toLowerCase(), ...more].join('\0')
   const kept = (key: string, lasting = false) => {
@@ -140,6 +141,8 @@ export function sharedSource(source: ActionsSource, answers: ActionAnswers): Act
     branches: name => shared(name, keyOf('branches', name), false, () => source.branches(name)),
     contains: (name, base, sha) => shared(name, keyOf('contains', name, base, sha), isCommit(base), () => source.contains(name, base, sha)),
     file: (name, path, commit) => shared(name, keyOf('file', name, path, commit), isCommit(commit), () => source.file(name, path, commit)),
+    ...source.advisories && { advisories: (name: string, versions: string[], internal: boolean) =>
+      shared(name, keyOf('advisories', name, ...versions), false, () => source.advisories!(name, versions, internal)) },
   }
 }
 
@@ -153,8 +156,8 @@ export interface ActionsResolving {
 }
 
 // A reference's line: kept (`stored`, as read of the store with others),
-// else resolved, and kept where it is a public repository's; why not, where
-// it couldn't be.
+// else resolved, and kept where it is a public repository's and its
+// advisories could be had; why not, where it couldn't be.
 async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef,
   stored = resolving.store?.read(key)): Promise<ActionLine | null> {
   const kept = resolving.memory.get(key) ?? await stored?.then(row => row && { at: row.at, line: row.value })
@@ -164,7 +167,7 @@ async function resolved(resolving: ActionsResolving, source: ActionsSource, { ke
   let found: ResolvedAction
   try { found = await resolveAction(uses, source, { owner }) } catch (error) { return resolving.signal.aborted ? null : { type: 'action', key, ...failureOf(error) } }
   const line: ActionLine = { type: 'action', ...found }
-  if (found.repository?.private === false) {
+  if (found.repository?.private === false && !found.findings.some(({ id }) => id === 'advisories-unavailable')) {
     const at = Date.now()
     resolving.memory.set(key, { at, line })
     await resolving.store?.write(key, line, at)

package/server-managed/repository-browser.ts

@@ -2,7 +2,8 @@ import { createHash } from 'node:crypto'
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, type GithubIdentity, READ_PERMISSIONS, githubJson, githubRepoPermission, githubUserIdentity, onTokenRejected, repoAccessToken } from './github-app.ts'
-import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
+import { MAX_PACKAGE_BYTES, readConfigEntryPoints, readPackageEntryPoints } from './package-entry-points.ts'
+import { MAX_STASIS_CONFIG_BYTES, STASIS_CONFIG } from './stasis-config.ts'
 import { readSolidityEntryPoints } from './solidity-entry-points.ts'
 import { parseGithubCommit } from './bundle-commits.ts'
 import { appDependabotAlerts } from './dependabot-access.ts'
@@ -279,9 +280,15 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
         const type = item.submodule_git_url ? 'submodule' : item.type
         if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
       }
-      const manifestPath = path ? `${path}/package.json` : 'package.json'
-      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
-        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const listed = (name: string, maxBytes: number) => data.find(item => item?.path === (path ? `${path}/${name}` : name) && item.name === name
+        && item.type === 'file' && !item.submodule_git_url && typeof item.size === 'number' && item.size >= 0 && item.size <= maxBytes
+        && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      // The entries stasis.config.json lists are suggested before any guess:
+      // a build takes them alone, with their options there.
+      const config = listed(STASIS_CONFIG, MAX_STASIS_CONFIG_BYTES)
+      const configEntryPoints = config ? await readConfigEntryPoints(config.sha, path, read) : []
+      if (configEntryPoints.length > 0) return { entries, limited: data.length >= 1000, configEntryPoints }
+      const manifest = listed('package.json', MAX_PACKAGE_BYTES)
       // Both optional suggestions, read together: neither fails, each
       // answering none where its reads do.
       const [packageEntryPoints, solidity] = await Promise.all([manifest ? readPackageEntryPoints(manifest.sha, path, read) : undefined,

package/server-managed/repository-risk-audit.ts

@@ -1,19 +1,18 @@
 // A lockfile's advisories, as a repository risk scan asks them
 // (repository-risk.ts): npm's registry's of its packages of the registry or
 // a mirror, asked at once, as `npm audit` asks, each told with whether it is
-// of malware (risk's npmMalwareAdvisory); kept by the lockfile's blob, in the
-// instance's memory and the source's `audits`, for RISK_KEPT_MS, as npm
+// of malware, as upstream tells (`malware`); kept by the lockfile's blob, in
+// the instance's memory and the source's `audits`, for RISK_KEPT_MS, as npm
 // publishes advisories, or why they couldn't be had for AUDIT_FAILED_KEPT_MS.
 import type { Advisory } from '@preventive/upstream/advisories.js'
 import { isExactVersion } from '@preventive/upstream/semver.js'
-import { npmMalwareAdvisory } from '../risk/index.js'
 import { isNpmPackageName } from '../common/managed/npm-packages.js'
 import type { LockedPackage } from './locked-packages.ts'
 import type { Lru } from './lru.ts'
 import type { KeptStore } from './npm-kept.ts'
 import { RISK_KEPT_MS, type RiskFailure, failureOf } from './repository-risk-assess.ts'
 
-export type AdvisoryRow = Advisory & { malware: boolean }
+export type AdvisoryRow = Omit<Advisory, 'malware'> & { malware: boolean }
 // A lockfile's advisories, or why they couldn't be had.
 export type Audit = AdvisoryRow[] | RiskFailure
 
@@ -67,7 +66,7 @@ export async function auditLockfile(source: AuditSource, memory: Lru<{ at: numbe
   let audit: Audit
   try {
     audit = (await source.advisories([...asked].map(([name, versions]) => ({ name, versions: [...versions] })), signal))
-      .map(advisory => ({ ...advisory, malware: npmMalwareAdvisory(advisory) }))
+      .map(advisory => ({ ...advisory, malware: advisory.malware === true }))
   } catch (error) {
     if (signal.aborted) return null
     audit = failureOf(error)

package/server-managed/repository-risk.ts

@@ -18,8 +18,8 @@
 // that locks them (LockedPackage `dev`) once all the rest are, as an install
 // of no devDependencies leaves them out. A lockfile's packages of npm's
 // registry or a mirror are asked of npm's advisories all at once, as `npm
-// audit` asks, each advisory told with whether it is of malware (risk's
-// npmMalwareAdvisory), which alone is a supply chain's risk; the rest are
+// audit` asks, each advisory told with whether it is of malware (upstream's
+// `malware`), which alone is a supply chain's risk; the rest are
 // vulnerabilities, told beside. A repository's Dependabot alerts of npm's, open or dismissed,
 // are told once its lockfiles' advisories are, each with the versions its
 // lockfile locks that it covers, for the page to blend them into npm's; one
@@ -94,8 +94,8 @@ export interface RepositoryRiskSource<R extends RepositoryRiskRepo> extends Audi
 
 // A Dependabot alert as a scan tells it: with the versions of its package
 // the lockfile it is of locks that it covers, none where it is of none read
-// (a package.json, bun's lockfile), and whether it is of malware, as an
-// advisory's is told.
+// (a package.json, bun's lockfile), and whether it is of malware, by the rule
+// upstream tells an advisory's by (risk's npmMalwareAdvisory).
 export type DependabotAlertRow = DependabotAlert & { versions: string[]; malware: boolean }
 
 // A risk line is of npm's package of its name and version, or, with an

package/server-managed/sql.ts

@@ -26,12 +26,13 @@ const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'g
   'listTriageFixes', 'getRepoDependencyReviews', 'listTeamDependencyReviews', 'getNpmReviewReader',
   'listDependencyReviewTeams', 'listDependencyReviewEnabledTeams', 'listUserNpmScopes', 'listTeamNpmScopes', 'hasTeamNpmScope',
   'listGithubMetadata', 'listGithubRepositoryVisibility', 'setGithubMetadata', 'recordGithubMetadataAttempts', 'setGithubRepositoryVisibility',
-  'listLinkReports', 'listLegacyLinkReports', 'listReportFilenamesWithBundleHash', 'listReportsForRepo', 'listBundlesForRepo',
+  'listLinkReports', 'listLegacyLinkReports', 'listReportFilenamesWithBundleHash', 'listReportsForBundle', 'listReportsForRepo', 'listBundlesForRepo',
   'listFindingCatalogReports', 'userCanReadBundleAdvisories',
   'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getBundleAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getAnnotationRevision', 'getUserTokens',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'getFirstUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
+  'getTeamAppSummaries', 'setTeamAppSummary', 'deleteTeamAppSummaries',
   'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits', 'getAvatarKey', 'listUsersByAccount'])
 // Session presence and upload keys change only their own rows.
 const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensureSessionUploadKey'])

package/server-managed/stasis-config.ts

@@ -0,0 +1,46 @@
+// stasis.config.json's `entries`, as Stasis reads them (src/cmd/bundle-options.js's
+// readConfigEntries, which is not a public package export): the entries it
+// names, each a path relative to the file's directory. Their options are
+// Stasis's: buildGitHubBundle builds the entries the stasis.config.json in its
+// directory names with their options there, and refuses what it can't build.
+export const STASIS_CONFIG = 'stasis.config.json'
+export const MAX_STASIS_CONFIG_BYTES = 256 * 1024
+
+const plainObject = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value)
+
+// `entry` as a path from `directory` ('.' for it), as `stasis bundle` run
+// there resolves it; null where that is outside it.
+export function configEntryKey(directory: string, entry: string): string | null {
+  if (entry.startsWith('/')) return null
+  const base = directory ? directory.split('/') : []
+  const parts = [...base]
+  for (const part of entry.split('/')) {
+    if (part === '' || part === '.') continue
+    if (part !== '..') parts.push(part)
+    else if (parts.pop() === undefined) return null
+  }
+  if (base.some((part, i) => parts[i] !== part)) return null
+  return parts.slice(base.length).join('/') || '.'
+}
+
+// The entries the stasis.config.json in `directory` whose text is `text`
+// names, each as a path from there; null where it has no `entries`. One whose
+// entries Stasis can't tell throws.
+export function parseStasisConfig(text: string, directory = ''): Set<string> | null {
+  const file = directory ? `${directory}/${STASIS_CONFIG}` : STASIS_CONFIG
+  let config: unknown
+  try { config = JSON.parse(text) } catch (cause) { throw new Error(`${file} is not valid JSON`, { cause }) }
+  const entries = plainObject(config) ? config['entries'] : undefined
+  if (entries === undefined) return null
+  if (!plainObject(entries)) throw new Error(`${file}: entries must be an object of each entry's stasis bundle options`)
+  const named = new Map<string, string>()
+  for (const entry of Object.keys(entries)) {
+    const what = `${file}: entries ${JSON.stringify(entry)}`
+    const key = configEntryKey(directory, entry)
+    if (key === null) throw new Error(`${what}: an entry must be a path relative to the directory of ${STASIS_CONFIG}, within it`)
+    if (named.has(key)) throw new Error(`${what} names the same entry as ${JSON.stringify(named.get(key))}`)
+    named.set(key, entry)
+  }
+  return new Set(named.keys())
+}

package/server-managed/team-app-summaries.ts

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto'
+import type { ManagedSql } from './sql.ts'
+
+// Each team's catalog summary (team-app.ts), kept for every instance: working
+// one out builds the team's whole workspace, which an instance would otherwise
+// do for the first catalog it serves. Keyed by the catalog's own content key
+// (team-app.ts teamAppKey), hashed: the published reports, their content and
+// what the reader is allowed of each (its role, its dependency and security
+// permissions, the team's scopes and links), so readers whose workspaces
+// differ never share one. A change to any of them is a new key, as is a new
+// deployment; one no longer asked for goes once it is old (index.ts reap).
+export const TEAM_APP_SUMMARY_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_team_app_summary (
+  summary_key TEXT PRIMARY KEY,
+  summary     TEXT NOT NULL,
+  stored_at   INTEGER NOT NULL
+) STRICT;
+`
+
+export interface TeamAppSummaryStore {
+  // Hashed key (teamAppSummaryKey) → summary for those of `keys` kept.
+  getTeamAppSummaries(keys: string[]): Promise<Map<string, string>>
+  setTeamAppSummary(key: string, summary: string, storedAt: number): Promise<void>
+  // Removes those stored before `before`; how many.
+  deleteTeamAppSummaries(before: number): Promise<number>
+}
+
+// How a summary is worked out (common/workspace-app.js, team-app.js), which a
+// deployment may change: one stored by another deployment, or before this
+// is raised, is worked out again.
+const SUMMARY_VERSION = 1
+const DEPLOYMENT = process.env['VERCEL_DEPLOYMENT_ID'] ?? null
+
+export const teamAppSummaryKey = (key: string): string => createHash('sha256').update(JSON.stringify([SUMMARY_VERSION, DEPLOYMENT, key])).digest('base64url')
+
+export function teamAppSummaryMethods(db: ManagedSql): TeamAppSummaryStore {
+  const getMany = db.prepare('SELECT summary_key, summary FROM managed_team_app_summary WHERE summary_key IN (SELECT value FROM json_each(?))')
+  const set = db.prepare(`INSERT INTO managed_team_app_summary (summary_key, summary, stored_at) VALUES (?, ?, ?)
+    ON CONFLICT (summary_key) DO UPDATE SET summary = excluded.summary, stored_at = excluded.stored_at`)
+  const remove = db.prepare('DELETE FROM managed_team_app_summary WHERE stored_at < ?')
+  return {
+    async getTeamAppSummaries(keys) {
+      if (keys.length === 0) return new Map()
+      const rows = await getMany.all(JSON.stringify(keys)) as { summary_key: string; summary: string }[]
+      return new Map(rows.map(row => [row.summary_key, row.summary]))
+    },
+    async setTeamAppSummary(key, summary, storedAt) {
+      await set.run(key, summary, storedAt)
+    },
+    async deleteTeamAppSummaries(before) {
+      return Number((await remove.run(before)).changes)
+    },
+  }
+}

package/server-managed/team-app.ts

@@ -15,13 +15,12 @@
 // reports stays expanded, and so does one whose reports each open as App but
 // whose combined workspace does not (contradicting verdicts, say): it has App
 // findings, and only expanded does it show that they fail to combine.
-import { reportEntries } from '@preventive/report'
-import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
-import { expandFindingValues } from '../common/managed/finding-values.js'
+import type { TeamAppMetadata } from '../common/managed/team-app.js'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot, UserTeam } from './db.ts'
 import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
-import { TeamReportsError, loadTeamReportsResponse } from './team-reports.ts'
+import { TeamReportsError, loadTeamSummary } from './team-reports.ts'
+import { teamAppSummaryKey } from './team-app-summaries.ts'
 
 export type { TeamAppMetadata }
 export interface TeamWorkspaceSummary { app: TeamAppMetadata; empty: readonly string[] }
@@ -56,50 +55,68 @@ function remember(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): Te
   return summary
 }
 
-function isLinks(data: unknown): boolean {
-  const record = data as { source?: unknown; links?: unknown } | null
-  return record?.source === 'links' && Array.isArray(record.links)
+// Summaries kept in the database for every instance (team-app-summaries.ts),
+// by key; a failed read is a miss, never a failed catalog, and an unreadable
+// summary one to work out again.
+async function storedSummaries(db: ManagedDb, keys: readonly string[]): Promise<Map<string, TeamWorkspaceSummary>> {
+  const hashed = new Map(keys.map(key => [teamAppSummaryKey(key), key]))
+  let rows: Map<string, string>
+  try { rows = await db.getTeamAppSummaries([...hashed.keys()]) } catch (error) {
+    console.warn('managed: stored team App classification read failed:', error)
+    return new Map()
+  }
+  const summaries = new Map<string, TeamWorkspaceSummary>()
+  for (const [hash, text] of rows) {
+    const key = hashed.get(hash), summary = readSummary(text)
+    if (summary && key !== undefined) summaries.set(key, summary)
+  }
+  return summaries
 }
 
-// A links document counts by its links, every other report by its findings.
-function hasContent(data: unknown): boolean {
-  if (isLinks(data)) return (data as { links: unknown[] }).links.length > 0
-  return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
+function readSummary(text: string): TeamWorkspaceSummary | null {
+  try {
+    const summary = JSON.parse(text) as TeamWorkspaceSummary
+    return typeof summary?.app?.appMode === 'boolean' && Array.isArray(summary.empty) && summary.empty.every(id => typeof id === 'string') ? summary : null
+  } catch { return null }
+}
+
+// One worked out, remembered and stored for every instance.
+async function settle(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): Promise<TeamWorkspaceSummary> {
+  remember(db, key, summary)
+  try { await db.setTeamAppSummary(teamAppSummaryKey(key), JSON.stringify(summary), Date.now()) } catch (error) {
+    console.warn('managed: storing team App classification failed:', error)
+  }
+  return summary
 }
 
 // Null when the team cannot be classified right now: its catalog went stale,
 // the access snapshot is gone, or storage failed. The sidebar then keeps the
 // team expanded and lists every report, and a later catalog asks again.
 // Oversized and unreadable workspaces never have an App view, so they are
-// remembered as such, hiding nothing.
+// remembered as such, hiding nothing. One kept in memory, or stored (`read`,
+// where the caller has not asked already), is not worked out again.
 async function classify(db: ManagedDb, store: BlobStore, key: string, team: UserTeam,
-  snapshot: () => Promise<TeamReportAccessSnapshot | null>): Promise<TeamWorkspaceSummary | null> {
+  snapshot: () => Promise<TeamReportAccessSnapshot | null>, read = true): Promise<TeamWorkspaceSummary | null> {
   const cached = caches.get(db)?.get(key)
   if (cached) return remember(db, key, cached)
-  const ids = new Set(published(team).map(report => report.id))
-  if (ids.size === 0) return remember(db, key, NO_APP)
+  const keys = new Map(published(team).map(report => [report.id, report.cacheKey]))
+  if (keys.size === 0) return remember(db, key, NO_APP)
+  const stored = read ? (await storedSummaries(db, [key])).get(key) : undefined
+  if (stored) return remember(db, key, stored)
   let jobs = pendingJobs.get(db)
   if (!jobs) { jobs = new Map(); pendingJobs.set(db, jobs) }
   const existing = jobs.get(key)
   if (existing) return existing
   const job = (async () => {
     const access = await snapshot()
-    // A catalog read before a concurrent publication names another report set.
-    if (!access?.teamId || access.reports.length !== ids.size || access.reports.some(report => !ids.has(report.id))) return null
-    const body = JSON.parse((await loadTeamReportsResponse(db, store, access)).toString('utf8')) as {
-      reports: { id: string; filename: string; data: unknown }[]; links?: string[][]; values?: unknown[]
-    }
-    for (const report of body.reports) expandFindingValues(report.data, body.values)
-    const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
-    const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
-    const links = body.links ?? []
-    const app = managedTeamAppMetadata(Object.assign(body.reports, { links }), { countFindings: true })
-    if (app.appMode) return remember(db, key, { app, empty })
-    const appReports = body.reports.filter(report => !isLinks(report.data)
-      && managedTeamAppMetadata(Object.assign([report], { links })).appMode).length
-    return remember(db, key, { app: { ...app, appReports }, empty })
+    // A catalog read before a concurrent change names other reports, or
+    // other content or access of them: what is read now is no workspace of
+    // its key, so nothing is kept under it.
+    if (!access?.teamId || access.reports.length !== keys.size || access.reports.some(report => access.catalogKeys?.[report.id] !== keys.get(report.id))) return null
+    // Worked out as the workspace is built (team-reports.ts).
+    return settle(db, key, await loadTeamSummary(db, store, access))
   })().catch((error: unknown) => {
-    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, NO_APP)
+    if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return settle(db, key, NO_APP)
     if (!(error instanceof TeamReportsError)) console.warn('managed: team App classification failed:', error)
     return null
   })
@@ -120,11 +137,15 @@ export async function teamAppStates(db: ManagedDb, store: BlobStore, sessionId:
   known: ReadonlyMap<string, TeamWorkspaceSummary | null> = new Map()): Promise<Map<string, TeamWorkspaceSummary | null>> {
   const states = new Map(known)
   const missing = [...new Map(teams.map(team => [teamAppKey(team), team])).entries()].filter(([key]) => !states.has(key))
+  // Those kept in no memory of this instance's are read of the database at
+  // once, in one statement.
+  const unknown = missing.filter(([key, team]) => !caches.get(db)?.has(key) && published(team).length > 0).map(([key]) => key)
+  for (const [key, summary] of unknown.length > 0 ? await storedSummaries(db, unknown) : []) remember(db, key, summary)
   let next = 0
   await Promise.all(Array.from({ length: Math.min(CLASSIFY_CONCURRENCY, missing.length) }, async () => {
     while (next < missing.length) {
       const [key, team] = missing[next++]!
-      states.set(key, await classify(db, store, key, team, () => db.getTeamReportAccessSnapshot(sessionId, Date.now(), team.id)))
+      states.set(key, await classify(db, store, key, team, () => db.getTeamReportAccessSnapshot(sessionId, Date.now(), team.id), false))
     }
   }))
   return states

package/server-managed/team-reports.ts

@@ -9,9 +9,11 @@ import { filterReportData, projectFinding } from '../common/managed/report-filte
 import { revalidationLinks, securityLinks } from '../common/security-links.js'
 import { treeDependencyDirectory } from '../client/dependency-paths.js'
 import { liteWorkspace } from '../common/managed/finding-detail.js'
+import { managedTeamView } from '../common/managed/team-app.js'
 import { expandFindingValues, findingValueIndex } from '../common/managed/finding-values.js'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
+import type { TeamWorkspaceSummary } from './team-app.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { visibleManagedIssues } from './managed-issues.ts'
 import { MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
@@ -25,9 +27,10 @@ const VISIBILITY_CACHE_MAX_SNAPSHOTS = 32
 const caches = new WeakMap<ManagedDb, Map<string, Visibility>>()
 const REPORT_CACHE_BYTES = 16 * 1024 * 1024
 // A workspace's encoded reports, the same without their findings' detail for
-// the board (`lite`), and its reports' file trees apart.
-type EncodedWorkspace = { reports: Buffer; lite: Buffer; trees: Buffer }
-export type TeamResponsePart = keyof EncodedWorkspace
+// the board (`lite`), its reports' file trees apart, and its team's catalog
+// summary (team-app.ts).
+type EncodedWorkspace = { reports: Buffer; lite: Buffer; trees: Buffer; summary: TeamWorkspaceSummary }
+export type TeamResponsePart = 'reports' | 'lite' | 'trees'
 // The part a team's `reports` or `trees` route asks for.
 export const teamResponsePart = (route: string, url: URL): TeamResponsePart =>
   route === 'trees' ? 'trees' : url.searchParams.get('lite') === '1' ? 'lite' : 'reports'
@@ -98,6 +101,12 @@ function groupsOf(data: unknown): Finding[][] {
     (finding): finding is Finding => finding !== null && typeof finding === 'object' && !Array.isArray(finding),
   ))
 }
+// A links document counts by its links, every other report by its findings.
+function hasContent(data: unknown): boolean {
+  const links = linksOf(data)
+  if (links) return links.length > 0
+  return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
+}
 function linksOf(data: unknown): string[][] | null {
   const record = data as { source?: string; links?: string[][] }
   if (record?.source !== 'links' || !Array.isArray(record.links)) return null
@@ -188,14 +197,21 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   }
   const trees = Buffer.from(`{"trees":{${reports.map(withoutTree).filter(tree => tree !== null).join(',')}}}`)
   const links = mergeLinkGroups(globalLinks, allIds)
-  // The board's: its findings without their detail, and in App mode its rows
-  // as the App view shows them (common/managed/finding-detail.js).
-  const lite = liteWorkspace(reports, links)
+  // Its rows read once (common/managed/team-app.js managedTeamView) for both
+  // what its catalog entry tells and the board's copy: its findings without
+  // their detail, and in App mode its rows as the App view shows them
+  // (common/managed/finding-detail.js).
+  const view = managedTeamView(Object.assign(reports.map(({ filename, data }) => ({ filename, data })), { links }))
+  const lite = liteWorkspace(reports, links, view)
+  const restricted = snapshot.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
   const encoded = {
     // Bounded together, as when the trees were sent with their reports.
     reports: encodeReports(reports, links, trees.length),
     lite: encodeReports(lite.reports, links, 0, { folded: lite.folded, lens: lite.lens }),
     trees,
+    // Its App classification, and the reports a restricted reader finds
+    // nothing in, which its catalog leaves out.
+    summary: { app: view.app, empty: restricted ? reports.filter(report => !hasContent(report.data)).map(report => report.id) : [] },
   }
   retainVisibility(db, workspaceKey(snapshot), visible)
   retainReports(db, workspaceKey(snapshot), encoded)
@@ -244,6 +260,10 @@ export async function loadTeamReportsResponse(db: ManagedDb, store: BlobStore, s
   const cached = reportCaches.get(db)?.get(workspaceKey(snapshot))
   return cached?.[part] ?? (await loadTeamWorkspace(db, store, snapshot))[part]
 }
+// A team's catalog summary (team-app.ts), as its workspace was built.
+export async function loadTeamSummary(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<TeamWorkspaceSummary> {
+  return reportCaches.get(db)?.get(workspaceKey(snapshot))?.summary ?? (await loadTeamWorkspace(db, store, snapshot)).summary
+}
 export async function loadTeamReports(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<TeamReport[]> {
   // Object consumers get their own copy, including when sharing a cold load.
   const body = JSON.parse((await loadTeamReportsResponse(db, store, snapshot)).toString('utf8')) as { reports: TeamReport[]; values?: unknown[] }
@@ -319,7 +339,7 @@ export async function loadTeamAnnotations(db: ManagedDb, store: BlobStore, snaps
   const revision = await teamAnnotationRevision(db, snapshot, [...all])
   const { triage, comments, issues: savedIssues } = await db.getAnnotations([...ids])
   const issues = Object.fromEntries(visibleManagedIssues(savedIssues, snapshot)
-    .map(issue => [issue.findingId, { url: issue.issueUrl!, autoFix: issue.autoFixUrl }]))
+    .map(issue => [issue.findingId, { url: issue.issueUrl!, autoFix: issue.autoFixUrl, duplicateOf: issue.duplicateOfUrl }]))
   const entries = Object.fromEntries(triage.map(row => [row.findingId, triageWireEntry(row)]))
   const annotated = new Set([...triage.map(row => row.findingId), ...comments.map(comment => comment.findingId), ...Object.keys(issues)])
   const reports = Object.fromEntries([...visible].map(([id, report]) => [id, [...report.ids].filter(finding => annotated.has(finding))]))