@preventive/triage 1.0.0-alpha.37 → 1.0.0-alpha.39

package/server-managed/http.ts

@@ -25,6 +25,8 @@
 //   GET /api/admin/repositories/impact → admin attached data summary
 //   GET /api/admin/repositories/{browsable,refs,contents} → admin|manage + GitHub read access
 //   POST /api/admin/repositories/remove → admin permanently removes a repo
+//   GET  /api/admin/repositories/risk[?team=|?repo=] → admin: each connected repo's npm lockfiles, or a team's or one repo's,
+//        their packages and what risk tells of each, Brotli-encoded ndjson as each is found; the reader leaving stops it | 400/401/403/404
 //   GET  /api/admin/reports      → admin|manage list of uploaded reports | 401/403
 //   POST /api/admin/reports      → admin|manage uploads a report (raw body) | 401/403/413
 //   GET  /api/admin/reports/<id> → admin|manage downloads a stored report | 401/403/404
@@ -34,11 +36,21 @@
 //   GET  /api/bundles/<id>/{metadata,contents} → authorized encoded bytes | 401/404/422
 //   GET  /api/bundles/<id>/advisories → published dependency advisories (security access) | 401/403/404
 //   GET  /api/bundles/<id>/download → authorized original upload | 401/404
+//   GET  /api/bundles/<id>/pretty?path=&hash= → one of its files pretty-printed, Brotli-encoded | 400/401/404/409/413/422/429
+//   GET  /api/bundles/<id>/pretty?other= → the files that changed between it and another bundle, both sides' pretty-printed,
+//        Brotli-encoded ndjson | 400/401/404/422/503
+//   GET  /api/bundles/<id>/rename-diff?path=&hash=&other=&otherPath=&otherHash= → a JavaScript file diffed with another
+//        bundle's, both pretty-printed, renamed names hidden, whitespace changes shown and hidden | 400/401/404/409/413/422/429/504
+//   GET  /api/bundles/<id>/rename-diff?other=&scope= → every pair of its JavaScript files and another bundle's the viewer
+//        diffs so, within a reason scope where given, Brotli-encoded ndjson | 400/401/404/422/503
+//   GET  /api/bundles/<id>/type-only?other=&scope= → the files that changed between it and another bundle in types alone, as
+//        @preventive/compare proves them, within a reason scope where given, Brotli-encoded ndjson | 400/401/404/422/503
 //   GET  /api/admin/bundles      → admin all bundles; managers own/team bundles | 401/403
 //   POST /api/admin/bundles      → admin|manage uploads a bundle (raw body) | 401/403/413
 //   GET  /api/admin/bundles/<id> → admin|manage downloads a stored bundle | 401/403/404
 //   DELETE /api/admin/bundles/<id> → admin|manage deletes a bundle | 401/403/404
 //   POST /api/admin/bundles/set-repo → admin|manage attaches/detaches a bundle's repo | 401/403/404
+//   GET  /api/admin/uploads/key  → admin|manage public key for sealed upload bodies | 401/403
 //   GET  /api/admin/teams        → admin teams (+ members/repos) + pickers | 401/403
 //   POST /api/admin/teams        → admin creates a team | 401/403/409
 //   POST /api/admin/teams/rename → admin renames a team | 401/403/404/409
@@ -46,23 +58,53 @@
 //   POST /api/admin/teams/delete → admin deletes a team | 401/403/404
 //   POST /api/admin/teams/{set,remove}-repo   → admin links/unlinks a repo (+path) | 401/403/404
 //   POST /api/admin/teams/{set,remove}-member → admin links/unlinks a user (+perms) | 401/403/404
-//   POST /api/auth/logout        → same-origin + CSRF, drops the session
+//   POST /api/admin/teams/set-dependency-review → admin toggles dependency review publication for a team | 400/401/403/404
+//   POST /api/admin/teams/set-npm-scopes → admin replaces a team's npm scopes | 400/401/403/404
+//   GET/POST /api/npm/reviews → read private/team reviews; save, publish, revoke or continue a set | 400/401/403/404/409
+//   POST /api/npm/reviews/discard → author discards an unpublished review and its file rows | 400/401/403/409
+//   GET /api/npm/reviews/latest → latest own review for exact target bytes, across all bases | 400/401/403
+//   GET  /api/npm/package?name=&version= → a published version's manifest and files | 400/401/404/413/429/502
+//   GET  /api/npm/versions?name= → its dist-tags, versions, when each was published and its first was, and whether a team lists its scope | 400/401/404/429/502
+//   GET  /api/npm/download?name=&version= → its tarball | 400/401/404/413/429/502
+//   GET  /api/npm/stats?name= → its downloads over the last year and its GitHub repository's figures | 400/401/404/429/502
+//   GET  /api/npm/advisories?name= → its advisories across every published version, npm's and its repository's | 400/401/404/429/502
+//   GET  /api/npm/tags?name=&version= → the tags pointing to its publish commit | 400/401/404/429/502
+//   GET  /api/npm/socket?name=&version= → Socket's scores and alerts for a public version | 400/401/404/429/502
+//   GET  /api/npm/provenance?name=&version= → npm's provenance for a public version | 400/401/404/429/502
+//   GET  /api/npm/pretty?name=&version= → every one of its files that needs it pretty-printed, Brotli-encoded ndjson | 400/401/404/413/429/502/503
+//   GET  /api/npm/pretty?name=&version=&otherVersion= → the files that changed between it and another version, both sides'
+//        pretty-printed, Brotli-encoded ndjson | 400/401/404/413/429/502/503
+//   GET  /api/npm/pretty?name=&version=&path=&hash= → one of its files pretty-printed, Brotli-encoded | 400/401/404/409/413/422/429/502/503
+//   GET  /api/npm/rename-diff?name=&version=&path=&hash=&otherVersion=&otherPath=&otherHash= → a JavaScript file diffed with
+//        another version's, both pretty-printed, renamed names hidden, whitespace changes shown and hidden | 400/401/404/409/413/422/429/502/503/504
+//   GET  /api/npm/rename-diff?name=&version=&otherVersion= → every pair of their JavaScript files the viewer diffs so,
+//        Brotli-encoded ndjson | 400/401/404/413/429/502/503
+//   GET  /api/npm/type-only?name=&version=&otherVersion= → the files that changed between two versions in types alone,
+//        Brotli-encoded ndjson | 400/401/404/413/429/502/503
+//   GET  /api/npm/risk?name=&version=&otherVersion= → what calls for a look at a version, as risk tells it, against another where given | 400/401/404/413/429/502
+//   POST /api/auth/logout        → same-origin + CSRF, drops the session (and any view)
+//   POST /api/auth/view-as       → admin opens a read-only view as another user | 400/401/403/404
+//   DELETE /api/auth/view-as     → ends the view (the view's CSRF token)
 import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
+import { npmVersionStore, riskLineStore } from './npm-kept.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
-import { auditCache } from './upstream-cache.ts'
+import { auditCache, auditedRepos, lastListing } from './upstream-cache.ts'
 import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
-import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, putUploadPart, readUpload, validUpload, validUploadPart } from './uploads.ts'
+import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, newUploadKey, openSessionUpload, putUploadPart, readUpload, uploadPublicKey, validUpload, validUploadPart } from './uploads.ts'
+import { UPLOAD_SEAL_HEADER, maxSealedBytes } from '../common/managed/upload-seal.ts'
 import { type BundleCache, type BundleCachePart, MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
+import type { CacheStorage } from './cache-storage.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
+import { type CatalogCommit, backfillBundleCommits, bundleCommits, cacheCommitDetails } from './bundle-commits.ts'
 import { contentAccess } from './content-access.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { Buffer } from 'node:buffer'
 import { createHash, randomUUID } from 'node:crypto'
 import type { AvatarStore } from './avatar-store.ts'
-import type { BlobStore } from './blob-store.ts'
+import type { BlobStore, OpenedBlob } from './blob-store.ts'
 import { bundleFilePrefix, bundleIntegrity, bundleKind, bundleRepo, reportBundleHashes } from './bundle.ts'
 import { resolveRepositoryImportLocation } from './repository-aliases.ts'
 import type { ManagedConfig } from './config.ts'
@@ -79,13 +121,18 @@ import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 import { DEFAULT_MANAGED_SCAN_MODEL, MANAGED_SCAN_MODELS } from '../common/managed/scan-models.ts'
 import { CONFIG_PATH, type ServerInfo } from '../common/server-info.ts'
+import { bundleCommitHash } from '../common/bundle-commit.js'
 import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, publicRepositoryName, repositoryInstallation } from './github-app.ts'
+import { upstreamGithub } from './github-errors.ts'
+import { createClient } from '@preventive/upstream/github.js'
 import type { ConnectedRepo } from './github-app.ts'
 import { canAddAnyPublicRepository, canAddRepositories, passesPublicRepositorySafeguard } from './repository-policy.ts'
 import { RepositoryDiscovery } from './repository-discovery.ts'
+import { RISK_KEPT_MS, repositoryRiskLines } from './repository-risk.ts'
 import { type RepositoryEntry, createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
 import { clearCookie, endSession, readSession } from './session.ts'
+import { VIEW_AS_PATH, VIEW_ONLY_ERROR, clearViewCookie, endViewSession, runViewing, startViewSession, viewToken } from './view-as.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
 import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
@@ -95,14 +142,28 @@ import { lookupIssueLinks } from './github-issue-links.ts'
 import { visibleManagedIssues } from './managed-issues.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
-import { attachmentDisposition, sendJson, writeResponse } from './http-response.ts'
+import { attachmentDisposition, sendJson, sendLines, writeResponse } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
+import { teamAppKey, teamAppStates } from './team-app.ts'
 import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
+import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
+import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
+import { computeBundleDiff } from '../common/bundle-compare-diff.js'
+import type { ReviewChange, ReviewContext, ReviewInput } from './dependency-reviews.ts'
+import { allowedReviewVerdicts, isReviewableFile, npmReviewVerdictLimit, npmTakenDown } from '../common/dependency-reviews.js'
+import { type NpmAdvisoryOptions, npmAdvisories, npmCommitTags, npmDownloads, npmGithubStats, npmKnown, npmLatestRepo, npmSocketReport } from './npm-insights.ts'
+import { npmProvenance } from './npm-provenance.ts'
+import { npmRisk, npmRiskRemoved } from './npm-risk.ts'
+import { NpmRiskError } from '../risk/index.js'
+import { type PrettyCache, PrettyError, type PrettyRequest, compared, prettyRequest, prettyText } from './pretty-print.ts'
+import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
+import { typeOnlyFiles } from './type-only.ts'
+import { isNpmPackageName, isNpmPackageSpec, npmPackageScope } from '../common/managed/npm-packages.js'
 
 const SESSION_PATH = '/api/auth/session'
 const AVATAR_PREFIX = '/api/avatar/'
@@ -120,6 +181,7 @@ const ADD_PUBLIC_REPO_PATH = '/api/admin/repositories/add-public'
 const CONNECT_REPO_APP_PATH = '/api/admin/repositories/connect-app'
 const REPO_IMPACT_PATH = '/api/admin/repositories/impact'
 const REMOVE_REPO_PATH = '/api/admin/repositories/remove'
+const REPO_RISK_PATH = '/api/admin/repositories/risk'
 const ADMIN_REPORTS_PATH = '/api/admin/reports'
 const REPORT_SET_REPO_PATH = '/api/admin/reports/set-repo'
 const REPORT_SET_VISIBLE_PATH = '/api/admin/reports/set-visible'
@@ -131,6 +193,7 @@ const BUNDLE_SET_VISIBLE_PATH = '/api/admin/bundles/set-visible'
 const BUNDLE_PREFIX = '/api/admin/bundles/'
 const MY_TEAMS_PATH = '/api/teams'
 const MY_REPORT_PREFIX = '/api/reports/'
+const REPORT_QUERY_PATH = '/api/reports/query'
 const MY_REPORT_TRIAGE_SUFFIX = '/triage'
 const MY_REPORT_TRIAGE_HISTORY_SUFFIX = '/triage/history'
 const ADMIN_TEAMS_PATH = '/api/admin/teams'
@@ -141,7 +204,41 @@ const TEAM_SET_REPO_PATH = '/api/admin/teams/set-repo'
 const TEAM_REMOVE_REPO_PATH = '/api/admin/teams/remove-repo'
 const TEAM_SET_MEMBER_PATH = '/api/admin/teams/set-member'
 const TEAM_REMOVE_MEMBER_PATH = '/api/admin/teams/remove-member'
+const TEAM_SET_NPM_SCOPES_PATH = '/api/admin/teams/set-npm-scopes'
+const NPM_PACKAGE_PATH = '/api/npm/package'
+const NPM_VERSIONS_PATH = '/api/npm/versions'
+const NPM_DOWNLOAD_PATH = '/api/npm/download'
+const NPM_STATS_PATH = '/api/npm/stats'
+const NPM_ADVISORIES_PATH = '/api/npm/advisories'
+const NPM_TAGS_PATH = '/api/npm/tags'
+const NPM_SOCKET_PATH = '/api/npm/socket'
+const NPM_PROVENANCE_PATH = '/api/npm/provenance'
+const NPM_PRETTY_PATH = '/api/npm/pretty'
+const NPM_RENAME_DIFF_PATH = '/api/npm/rename-diff'
+const NPM_TYPE_ONLY_PATH = '/api/npm/type-only'
+const NPM_RISK_PATH = '/api/npm/risk'
+// What risk's errors (risk/npm/registry.js NpmRiskError) are answered as: npm
+// having no such package or version, or a tarball unpacking past risk's
+// bounds; npm failing otherwise a 502.
+const NPM_RISK_STATUS: Partial<Record<string, number>> = { 'package-not-found': 404, 'version-not-found': 404, 'package-too-large': 413 }
+// A risk failure answered with its code alone, as risk's status for it (NPM_RISK_STATUS, else 502), its cause
+// logged where it is the server's or npm's, not the reader's (a 5xx), for the logs to say why.
+function sendRiskError(res: ServerResponse, err: NpmRiskError) {
+  const status = NPM_RISK_STATUS[err.code] ?? 502
+  if (status >= 500) console.error(`managed: npm risk failed (${err.code}):`, err.message)
+  sendJson(res, status, { error: err.code })
+}
+const NPM_PATHS = new Set([NPM_PACKAGE_PATH, NPM_VERSIONS_PATH, NPM_DOWNLOAD_PATH, NPM_STATS_PATH, NPM_ADVISORIES_PATH, NPM_TAGS_PATH, NPM_SOCKET_PATH, NPM_PROVENANCE_PATH, NPM_PRETTY_PATH,
+  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH])
+// How long an npm response may go unread before its connection is dropped.
+const NPM_RESPONSE_IDLE_MS = 60_000
 const MAX_TEAM_NAME = 100
+// Managed data routes, and with them the authentication routes, which an
+// admin's view as another user covers. Other paths fall through to a combined
+// e2e server, whose own authentication a view never touches.
+const MANAGED_DATA_PREFIXES = ['/api/admin', '/api/reports', '/api/bundles', '/api/teams', '/api/avatar', '/api/github', '/api/npm']
+const VIEW_PREFIXES = [...MANAGED_DATA_PREFIXES, '/api/auth', '/api/oauth']
+const underPrefix = (path: string, prefixes: readonly string[]) => prefixes.some(prefix => path === prefix || path.startsWith(prefix + '/'))
 
 async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, teamId: string, reportId: string | null): Promise<void> {
   const s = await readWorkspaceSession(res, deps, cookie)
@@ -242,6 +339,9 @@ export interface ManagedHttpDeps {
   bundleStore: BundleStore
   bundleCache?: BundleCache
   reportSourcesCache?: ReportSourcesCache
+  prettyCache?: PrettyCache
+  // The public npm cache, where risk keeps public packages' assessments (npm-risk.ts).
+  npmCacheStorage?: CacheStorage
   uploadStore?: BlobStore
   originGate: OriginGate
   isShuttingDown: () => boolean
@@ -293,11 +393,28 @@ async function readBodyBytes(req: IncomingMessage, maxBytes: number): Promise<Bu
   return Buffer.concat(chunks)
 }
 
-function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: string, kind: UploadKind) {
-  const maxBytes = kind === 'reports' ? deps.config.maxReportBytes : deps.config.maxBundleBytes
-  if (req.headers['x-upload-id'] == null) return readBodyBytes(req, maxBytes)
-  if (!deps.uploadStore) throw new Error('bad-upload')
-  return readUpload(deps.uploadStore, req, session, kind, maxBytes)
+// A file upload's content, opening a body the browser sealed to this session
+// (common/managed/upload-seal.ts). Link reports are never sent in parts.
+async function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: ManagedSession, kind: UploadKind | 'links'): Promise<Buffer> {
+  const maxBytes = kind === 'bundles' ? deps.config.maxBundleBytes : deps.config.maxReportBytes
+  const sealed = req.headers[UPLOAD_SEAL_HEADER] !== undefined
+  const limit = sealed ? maxSealedBytes(maxBytes) : maxBytes
+  let bytes
+  if (kind === 'links' || req.headers['x-upload-id'] == null) bytes = await readBodyBytes(req, limit)
+  else if (deps.uploadStore) bytes = await readUpload(deps.uploadStore, req, session.id, kind, limit)
+  else throw new Error('bad-upload')
+  return sealed ? await openSessionUpload(session.uploadKey, bytes, maxBytes) : bytes
+}
+
+// GET /api/admin/uploads/key — the session's upload public key, created on
+// first use. Only this session's server-side private key opens what is sealed to it.
+async function handleUploadKey(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  if (req.method !== 'GET') { send405(res, 'GET'); return }
+  const s = await readManageSession(res, deps, cookie)
+  if (!s) return
+  const key = s.session.uploadKey ?? await deps.db.ensureSessionUploadKey(s.session.id, newUploadKey())
+  if (!key) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  sendJson(res, 200, { key: uploadPublicKey(key) })
 }
 
 async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, path: string) {
@@ -324,7 +441,7 @@ async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps:
   }
   if (!validUploadPart(id, index, maxBytes)) { await discard(); sendJson(res, 400, { error: 'bad-upload' }); return }
   let bytes
-  try { bytes = await readBodyBytes(req, Math.min(UPLOAD_CHUNK_BYTES, maxBytes)) }
+  try { bytes = await readBodyBytes(req, Math.min(UPLOAD_CHUNK_BYTES, maxSealedBytes(maxBytes))) }
   catch { await discard(); sendJson(res, 413, { error: 'too-large' }); return }
   if (bytes.length === 0) { await discard(); sendJson(res, 400, { error: 'empty' }); return }
   if (await manageMutation(req, res, deps, cookie) == null) return
@@ -341,23 +458,70 @@ async function readJsonBody(req: IncomingMessage, maxBytes = MAX_JSON_BODY_BYTES
 
 // The router enforces same-origin for every request. A mutation also needs an
 // authenticated session whose CSRF token matches the X-CSRF-Token header.
-// Returns the session, or null after having already sent the 401/403.
-async function checkMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+// Returns the session, or null after having already sent the 401/403. An
+// admin's view as another user writes nothing; `view` admits only the
+// endpoints that end it.
+async function checkMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { view = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
   const csrf = firstHeader(req.headers['x-csrf-token'])
   if (csrf == null) { sendJson(res, 403, { error: 'csrf-missing' }); return null }
   if (!safeEqual(csrf, s.session.csrfToken)) { sendJson(res, 403, { error: 'csrf-mismatch' }); return null }
+  if (s.session.viewer && !view) { sendViewOnly(res); return null }
   return s
 }
 
-// POST /api/auth/logout — drop the session (same-origin + CSRF).
+function sendViewOnly(res: ServerResponse): void {
+  sendJson(res, 403, { error: VIEW_ONLY_ERROR })
+}
+
+// Reads stay available while an admin views as another user. Everything else
+// is refused before dispatch, except ending the view or signing out, and the
+// batch report preview, a POST without effects. Issue authorization would
+// grant GitHub access on the viewed user's behalf.
+function viewAllows(method: string, path: string): boolean {
+  if (method === 'GET' || method === 'HEAD') return path !== ISSUE_LOGIN_PATH
+  return (method === 'DELETE' && path === VIEW_AS_PATH) || (method === 'POST' && (path === LOGOUT_PATH || path === REPORT_QUERY_PATH))
+}
+
+// POST /api/auth/logout — drop the session (same-origin + CSRF), which also
+// ends a view opened from it.
 async function handleLogout(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { view: true })
   if (s == null) return
   await endSession(deps.config, deps.db, cookie)
-  res.writeHead(204, { 'set-cookie': clearCookie(deps.config.sessionCookieName, deps.config.cookieSecure), 'cache-control': 'no-store' })
+  const cleared = clearCookie(deps.config.sessionCookieName, deps.config.cookieSecure)
+  res.writeHead(204, { 'set-cookie': s.session.viewer ? [cleared, clearViewCookie(deps.config)] : cleared, 'cache-control': 'no-store' })
+  res.end()
+}
+
+// POST /api/auth/view-as — an admin opens a read-only view as another user
+// (body { userId }); DELETE ends it. Viewing as oneself is refused.
+async function handleViewAs(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const method = req.method ?? 'GET'
+  if (method === 'DELETE') {
+    if (await checkMutation(req, res, deps, cookie, { view: true }) == null) return
+    await endViewSession(deps.config, deps.db, cookie)
+    res.writeHead(204, { 'set-cookie': clearViewCookie(deps.config), 'cache-control': 'no-store' })
+    res.end(); return
+  }
+  if (method !== 'POST') { send405(res, 'POST, DELETE'); return }
+  const s = await checkMutation(req, res, deps, cookie)
+  if (s == null) return
+  if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const userId = (body as { userId?: unknown } | null)?.userId
+  if (typeof userId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
+  if (userId === s.user.id) { sendJson(res, 400, { error: 'cannot-view-as-self' }); return }
+  const target = (await deps.db.listUsers()).find(user => user.id === userId)
+  if (!target) { sendJson(res, 404, { error: 'not-found' }); return }
+  // The insert itself rechecks the admin session and role.
+  const setCookie = await startViewSession(deps.config, deps.db, s.session, userId, Date.now())
+  if (setCookie == null) { sendJson(res, 403, { error: 'forbidden' }); return }
+  await activity(deps, s.user, 'access', `viewed as ${target.login}`)
+  res.writeHead(204, { 'set-cookie': setCookie, 'cache-control': 'no-store' })
   res.end()
 }
 
@@ -891,7 +1055,7 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   if (!requireManageRole(res, s.user)) return
   let bytes: Buffer
   try {
-    bytes = await readUploadBody(req, deps, s.session.id, 'reports')
+    bytes = await readUploadBody(req, deps, s.session, 'reports')
   } catch (err) {
     const tooLarge = err instanceof Error && err.message === 'too-large'
     sendJson(res, tooLarge ? 413 : 400, { error: tooLarge ? 'too-large' : 'bad-body' })
@@ -1050,6 +1214,18 @@ async function repositoryBrowserUser(deps: ManagedHttpDeps, userId: string) {
   return { githubUserId, token }
 }
 
+// After a catalog response: read the commit details it lacked with this
+// user's repository access, for the next catalog to send.
+async function backfillCatalogCommits(deps: ManagedHttpDeps, userId: string, missing: readonly CatalogCommit[]): Promise<void> {
+  let browser: ReturnType<typeof createRepositoryBrowser> | undefined
+  await backfillBundleCommits(deps.db, userId, missing, async repoId => {
+    const repo = (await deps.db.listAllRepos()).find(item => item.repoId === repoId)
+    if (!repo) return null
+    browser ??= createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, userId))
+    return browser.reader(repo)
+  }).catch(err => { console.warn('managed: commit backfill failed:', err) })
+}
+
 // Listing connected repository names uses managed access only. Verify GitHub
 // access after selection, before returning any refs or source directory data.
 async function handleBrowsableRepositories(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
@@ -1117,8 +1293,18 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
   try {
     const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id))
     const reader = await browser.reader(access.repo)
+    // Microseconds, so overlapping browses practically never share a listing time.
+    const observedUs = Math.round((performance.timeOrigin + performance.now()) * 1000)
     const revisions = refs ? await readRepositoryRefs(deps.db, reader, access.repo, withDefault, access.virtualEntries) : null
     const contents = refs ? null : await readRepositoryContents(reader, ref, path, access.virtualEntries)
+    const { tagCommits, tagsComplete, ...listed } = revisions ?? { tagCommits: [], tagsComplete: false }
+    // Create a bundle refreshes the tags bundle catalogs show, and keeps a tag
+    // its revision input resolves even when the listed page leaves it out.
+    // Like other GitHub caches, written before the access fence below.
+    const tags = refs ? tagCommits : ref.length > 5 && ref.startsWith('tags/') && contents ? [{ name: ref.slice(5), sha: contents.commit }] : []
+    if (refs || tags.length > 0) {
+      await deps.db.refreshGithubTags(access.repo.repoId, tags, refs && tagsComplete, observedUs).catch(err => { console.warn('managed: tag cache refresh failed:', err) })
+    }
     await reader.recheckAccess()
     const current = await authorize()
     if (!current) return
@@ -1127,7 +1313,7 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     if (JSON.stringify({ ...current.repo, cachedDefaultBranch: access.repo.cachedDefaultBranch }) !== JSON.stringify(access.repo)) {
       sendJson(res, 409, { error: 'repository-changed' }); return
     }
-    sendJson(res, 200, refs ? { ...revisions, ...(withDefault ? {
+    sendJson(res, 200, refs ? { ...listed, ...(withDefault ? {
       defaultContents: scopeRepositoryContents(revisions?.defaultContents ?? null, current.virtualEntries),
     } : {}) } : scopeRepositoryContents(contents, current.virtualEntries))
   } catch (err) {
@@ -1147,17 +1333,144 @@ function prebuildBundle(deps: ManagedHttpDeps, id: string) {
   })().catch(err => console.warn('managed: bundle cache build failed:', err)))
 }
 
-// GET /api/bundles/:id/{metadata,contents}. Source/cache bytes are already encoded;
-// the browser's HTTP stack decompresses them without a Brotli JS dependency.
-async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, part: BundleCachePart) {
+// Brotli-encoded bytes as they are: the browser's HTTP stack decompresses
+// them without a Brotli JS dependency.
+async function sendEncoded(req: IncomingMessage, res: ServerResponse, blob: OpenedBlob, contentType: string, headers: Record<string, string> = {}) {
+  res.writeHead(200, {
+    ...headers, 'content-type': contentType, 'content-encoding': 'br',
+    ...(blob.size == null ? {} : { 'content-length': String(blob.size) }), 'cache-control': 'private, no-store',
+    'x-content-type-options': 'nosniff',
+  })
+  if (req.method === 'HEAD') { blob.stream.destroy(); res.end(); return }
+  try { await pipeline(blob.stream, res) } catch { res.destroy() }
+}
+
+
+// How often a scan of repositories' risk checks again that its reader is
+// still an admin, between the lines it sends; and how long its connection may
+// go idle, unread or with no line to send, before the scan is stopped.
+const REPO_RISK_RECHECK_MS = 10_000
+const REPO_RISK_IDLE_MS = 5 * 60_000
+
+// The repositories a scan of risk reads, by its query: every connected one;
+// a team's (`team`, its id), each in the team's directories of it; or one
+// (`repo`, its id). Null for a team or repository there is none of, or a
+// query naming both.
+async function riskRepositories(db: ManagedDb, query: URLSearchParams): Promise<(SelectedRepo & { paths?: string[] })[] | null> {
+  const connected = await db.listSelectedRepos()
+  const repoId = query.get('repo'), teamId = query.get('team')
+  if (teamId !== null && repoId !== null) return null
+  if (repoId !== null) {
+    const repo = connected.find(item => String(item.repoId) === repoId)
+    return repo ? [repo] : null
+  }
+  if (teamId === null) return connected
+  const team = (await db.listTeams()).find(item => item.id === teamId)
+  if (!team) return null
+  // By repository, its directories; null for the whole of it.
+  const paths = new Map<number, string[] | null>()
+  for (const { repoId: id, path } of team.repos) {
+    const kept = paths.get(id)
+    paths.set(id, path === null || kept === null ? null : [...kept ?? [], path])
+  }
+  return connected.flatMap(repo => {
+    const of = paths.get(repo.repoId)
+    return of === undefined ? [] : [of === null ? repo : { ...repo, paths: of }]
+  })
+}
+
+// GET /api/admin/repositories/risk: every connected repository's npm
+// packages, or a team's or one repository's (riskRepositories), as its
+// lockfiles lock them at its default branch's head, each assessed by risk
+// (repository-risk.ts), a line as each is found. A
+// repository is read with the admin's own GitHub access, as browsing it is
+// (repository-browser.ts), and that access checked again once it is read,
+// before any of it is told; packages as the npm viewer's admins read them, in
+// spare assessments (npm-risk.ts), trusted however new where a team lists
+// their scope, and each lockfile's asked of npm's advisories at once. The
+// reader leaving, losing their admin role or the server shutting down stops
+// it.
+async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const s = await readAdminSession(res, deps, cookie)
+  if (!s) return
+  const repos = await riskRepositories(deps.db, query)
+  if (!repos) {
+    const both = query.has('team') && query.has('repo')
+    sendJson(res, both ? 400 : 404, { error: both ? 'bad-scope' : 'no-repository' })
+    return
+  }
+  const controller = new AbortController()
+  res.on('close', () => { controller.abort() })
+  res.setTimeout(REPO_RISK_IDLE_MS, () => res.destroy())
+  const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, s.user.id))
+  const scopes = new Map<string, Promise<boolean>>()
+  const versions = npmVersionStore(deps.db, deps.config.debug)
+  const lines = repositoryRiskLines({
+    repos: () => Promise.resolve(repos),
+    async open(repo) {
+      const reader = await browser.reader(repo)
+      const commit = await reader.commit('')
+      const client = createClient({ token: reader.readToken() })
+      return {
+        commit,
+        lockfiles: async () => (await upstreamGithub(() => client.findRepoLockfiles({ repo: repo.fullName, sha: commit }))).lockfiles,
+        file: path => upstreamGithub(() => client.getRepoFile({ repo: repo.fullName, path, ref: commit })),
+        recheck: async () => { await reader.recheckAccess() },
+      }
+    },
+    teamScoped(name) {
+      const scope = npmPackageScope(name)
+      if (scope === null) return Promise.resolve(false)
+      if (!scopes.has(scope)) scopes.set(scope, deps.db.hasTeamNpmScope(scope))
+      return scopes.get(scope)!
+    },
+    // Public versions' documents kept in the database (npm-kept.ts), as the
+    // viewer keeps them: whether npm still has one, its whole document tells
+    // risk.
+    version: async (name, version, signal) => found(await readNpmVersion(name, version, true, signal, versions)),
+    assess: (doc, teamScoped, signal) => npmRisk(doc, 'pick', { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug,
+      teamScoped, privileged: true, signal, spare: true }),
+    removed: (name, version, teamScoped, signal) => npmRiskRemoved(name, version, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug,
+      teamScoped, privileged: true, signal }),
+    risks: riskLineStore(deps.db, RISK_KEPT_MS, deps.config.debug),
+    // As a bundle's advisories are asked (bundle-advisories.ts), npm's registry
+    // and, for packages anyone may read, OSV: no repository's. Each lockfile's
+    // audit is bounded on its own, for one npm doesn't answer to fail alone and
+    // the scan to carry on.
+    async advisories(packages, scanning) {
+      const signal = AbortSignal.any([scanning, AbortSignal.timeout(ADVISORIES_TIMEOUT_MS)])
+      const audited = await fetchBundleAdvisories(packages.map(pkg => ({ ecosystem: 'npm' as const, ...pkg })), signal,
+        { debug: deps.config.debug, cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug) })
+      if (audited.status !== 200) throw new NpmPackageError(502, audited.body.error)
+      return audited.body
+    },
+  }, controller.signal)
+  let checked = Date.now()
+  await sendLines(res, lines, async () => {
+    if (deps.isShuttingDown()) return false
+    if (Date.now() - checked < REPO_RISK_RECHECK_MS) return true
+    if ((await readSession(deps.config, deps.db, cookie, Date.now()))?.user.role !== 'admin') return false
+    checked = Date.now()
+    return true
+  })
+}
+
+// A pretty-printed copy names the file it was formatted from, by the hash it
+// was asked for and its source was found to have, for the viewer to check.
+const prettySource = ({ hash }: PrettyRequest): Record<string, string> => ({ 'x-source-hash': hash })
+
+// GET /api/bundles/:id/{metadata,contents,pretty}: what `open` reads of the
+// bundle, already encoded; it is absent where its cache is.
+async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string,
+  open: ((rec: ManagedBundle) => Promise<OpenedBlob>) | undefined, contentType = 'application/json', headers: Record<string, string> = {}) {
   const access = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id)
   if (!access) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   const rec = access.bundle
   if (!rec) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (!deps.bundleCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+  if (!open) { sendJson(res, 503, { error: 'unavailable' }); return }
   let cached
-  try { cached = await deps.bundleCache.open(rec, part) }
-  catch { sendJson(res, 422, { error: 'bundle-unavailable' }); return }
+  try { cached = await open(rec) }
+  catch (err) { sendJson(res, err instanceof PrettyError ? err.status : 422, { error: err instanceof PrettyError ? err.message : 'bundle-unavailable' }); return }
   // A cold build can outlast a session or membership change.
   const current = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id)
   if (!current?.bundle) {
@@ -1165,13 +1478,55 @@ async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps
     sendJson(res, current ? 404 : 401, { error: current ? 'no-bundle' : 'unauthenticated' })
     return
   }
-  res.writeHead(200, {
-    'content-type': 'application/json', 'content-encoding': 'br',
-    ...(cached.size == null ? {} : { 'content-length': String(cached.size) }), 'cache-control': 'private, no-store',
-    'x-content-type-options': 'nosniff',
-  })
-  if (req.method === 'HEAD') { cached.stream.destroy(); res.end(); return }
-  try { await pipeline(cached.stream, res) } catch { res.destroy() }
+  await sendEncoded(req, res, cached, contentType, headers)
+}
+
+// GET /api/bundles/:id/rename-diff: one of its JavaScript files diffed with
+// one of the `other` bundle's, both pretty-printed, renamed names hidden
+// (rename-diff.ts), for a reader of both, checked again once it is worked out.
+async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
+  const otherId = params.get('other') ?? '', request = renameDiffRequest(params)
+  if (!request || !/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-file' }); return }
+  const readable = async () => {
+    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
+    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
+    return [base.bundle, other.bundle] as const
+  }
+  const records = await readable()
+  if (!records) return
+  const { prettyCache } = deps
+  if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+  let diff
+  try {
+    diff = await renameDiffOf(request, async () => [await prettyText(await prettyCache.bundle(records[0], request.base)),
+      await prettyText(await prettyCache.bundle(records[1], request.other))])
+  } catch (err) {
+    sendJson(res, err instanceof PrettyError ? err.status : 422, { error: err instanceof PrettyError ? err.message : 'bundle-unavailable' }); return
+  }
+  if (await readable()) await sendEncoded(req, res, diff, 'application/json')
+  else diff.stream.destroy()
+}
+
+// GET /api/bundles/:id/pretty?other=: the files that changed between it and
+// the `other` bundle, both sides' pretty-printed (pretty-print.ts compared), a
+// line each as it is found kept or formatted; GET
+// /api/bundles/:id/rename-diff?other=, the pairs of them its viewer diffs
+// with renamed names hidden (rename-diff.ts renamedPairs), a line each as it
+// is worked out; GET /api/bundles/:id/type-only?other=, those that changed in
+// types alone (type-only.ts). For a reader of both, checked again before each.
+async function handleBundleChanges(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, otherId: string,
+  linesOf: (cache: PrettyCache, base: ManagedBundle, other: ManagedBundle) => Promise<AsyncIterable<unknown>>) {
+  if (!/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-bundle' }); return }
+  const access = () => Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
+  const [base, other] = await access()
+  if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return }
+  if (!deps.prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+  let lines
+  try { lines = await linesOf(deps.prettyCache, base.bundle, other.bundle) }
+  catch (err) { sendJson(res, err instanceof PrettyError ? err.status : 422, { error: err instanceof PrettyError ? err.message : 'bundle-unavailable' }); return }
+  await sendLines(res, lines, async () => (await access()).every(snapshot => snapshot?.bundle))
 }
 
 // Published dependency advisories require security access, independently of access to
@@ -1200,7 +1555,8 @@ async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
-  const timer = setTimeout(() => controller.abort(), ADVISORIES_TIMEOUT_MS)
+  // Its deadline aborts as AbortSignal.timeout does, for a failure it leaves to be told from the reader's leaving.
+  const timer = setTimeout(() => controller.abort(new DOMException('advisories took too long', 'TimeoutError')), ADVISORIES_TIMEOUT_MS)
   try {
     if (res.destroyed) return
     const needsGithub = inventory.packages.some(pkg => repoAdvisories || pkg.ecosystem === 'github' || pkg.ecosystem === 'soldeer')
@@ -1209,7 +1565,8 @@ async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps
     })) : null
     if (res.destroyed || (needsGithub && !(await authorize()))) return
     const result = await fetchBundleAdvisories(inventory.packages, controller.signal, {
-      debug: deps.config.debug, repoAdvisories, details, githubToken, cache: auditCache(deps.config.upstreamCacheDir, deps.db, controller.signal, deps.config.debug),
+      debug: deps.config.debug, repoAdvisories, details, githubToken,
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, controller.signal, deps.config.debug, auditedRepos(inventory.packages, repoAdvisories)),
     })
     if (res.destroyed || !(await authorize())) return
     // Return just inventory and public advisories, never source or report data.
@@ -1226,16 +1583,18 @@ async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps
 async function handleListBundles(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession): Promise<void> {
   const before = await deps.db.getBundleCatalog(session.id, Date.now())
   const summaries = await bundleSummaries(before.bundles, deps.bundleCache)
-  // Even cached storage reads may outlast changes to access or locations.
+  const commits = await bundleCommits(deps.db, before.bundles, summaries)
+  // Even cached storage and commit reads may outlast changes to access or locations.
   const catalog = await deps.db.getBundleCatalog(session.id, Date.now())
   sendJson(res, 200, {
     ...catalog,
     bundles: catalog.bundles.map(bundle => ({
-      ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }),
+      ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }), commitInfo: commits.commitInfo(bundle),
     })),
     maxBytes: deps.config.maxBundleBytes,
   })
   await backfillBundleSummaries(catalog.bundles, deps.bundleCache)
+  await backfillCatalogCommits(deps, session.userId, commits.missing)
 }
 
 type UploadedBundle = Pick<ManagedBundle, 'id' | 'slug' | 'integrity' | 'filename' | 'byteSize' | 'repoId' | 'repoDirectory'>
@@ -1283,10 +1642,13 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
     await withBundleBuildLease(deps.db, access.user.id, controller.signal, async signal => {
       const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
       signal.throwIfAborted()
+      // Catalogs then show the built bundle's commit details from the cache.
+      const commitCached = cacheCommitDetails(deps.db, reader, input.repoId, input.commit)
       const built = await buildRepositoryBundle(access.user.id, {
         input, github: access.repo.fullName, token: reader.readToken(), maxBytes: deps.config.maxBundleBytes, scopes: access.scopes,
         cacheDir: deps.config.upstreamCacheDir ?? null,
       }, signal)
+      await commitCached
       signal.throwIfAborted()
       await reader.recheckAccess()
       const current = await authorize(built.directory)
@@ -1325,7 +1687,7 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   if (!requireManageRole(res, s.user)) return
   let bytes: Buffer
   try {
-    bytes = await readUploadBody(req, deps, s.session.id, 'bundles')
+    bytes = await readUploadBody(req, deps, s.session, 'bundles')
   } catch (err) {
     const tooLarge = err instanceof Error && err.message === 'too-large'
     sendJson(res, tooLarge ? 413 : 400, { error: tooLarge ? 'too-large' : 'bad-body' })
@@ -1480,10 +1842,16 @@ async function adminMutation(req: IncomingMessage, res: ServerResponse, deps: Ma
 // GET /api/teams — the CURRENT user's teams, each with the reports and bundles
 // attached to the team's repos, for the sidebar's per-user Teams section. Any approved
 // user (not just admin|manage); a user only ever sees their own teams.
+// Each team carries `app`, its App classification (team-app.ts), so the
+// sidebar's first paint already shows App teams collapsed.
 async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession): Promise<void> {
   let snapshot = await deps.db.getUserTeamFeedSnapshot(session.id, Date.now())
   if (!snapshot) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  const summaries = await bundleSummaries(snapshot.teams.flatMap(team => team.bundles), deps.bundleCache)
+  const [summaries, classified] = await Promise.all([
+    bundleSummaries(snapshot.teams.flatMap(team => team.bundles), deps.bundleCache),
+    teamAppStates(deps.db, deps.reportStore, session.id, snapshot.teams),
+  ])
+  const commits = await bundleCommits(deps.db, snapshot.teams.flatMap(team => team.bundles), summaries)
   const current = await deps.db.getFeedState(session.id, Date.now())
   if (!current) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   // Keep the post-storage authorization fence, but reload the catalog only
@@ -1493,11 +1861,16 @@ async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session
     if (!snapshot) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   }
   const { teams, revision } = snapshot
+  // The revision sent is the reloaded catalog's, so classify what changed now.
+  const apps = await teamAppStates(deps.db, deps.reportStore, session.id, teams, classified)
   sendJson(res, 200, {
-    teams: teams.map(team => ({ ...team, bundles: team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })) })),
+    teams: teams.map(team => ({ ...team, app: apps.get(teamAppKey(team)) ?? null,
+      bundles: team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }),
+        commitInfo: commits.commitInfo(bundle) })) })),
     revision,
   })
   await backfillBundleSummaries(teams.flatMap(team => team.bundles), deps.bundleCache)
+  await backfillCatalogCommits(deps, session.userId, commits.missing)
 }
 
 // Admins read all reports. Managers read their uploads or reports inside their
@@ -1574,7 +1947,7 @@ async function handleDeduplication(req: IncomingMessage, res: ServerResponse, de
     sendJson(res, 200, { ok: true }); return
   }
   let bytes: Buffer
-  try { bytes = await readBodyBytes(req, deps.config.maxReportBytes) }
+  try { bytes = await readUploadBody(req, deps, s.session, 'links') }
   catch (error) { const large = error instanceof Error && error.message === 'too-large'; sendJson(res, large ? 413 : 400, { error: large ? 'too-large' : 'bad-body' }); return }
   const filename = sanitizeFilename(firstHeader(req.headers['x-report-filename']), 'report.link.json')
   const result = await deps.db.importLinkReport(s.session.id, filename, bytes.toString('utf8'))
@@ -2050,8 +2423,10 @@ async function handleReportComments(req: IncomingMessage, res: ServerResponse, d
 async function handleListTeams(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   const s = await readAdminSession(res, deps, cookie)
   if (s == null) return
+  const scopes = await deps.db.listTeamNpmScopes()
+  const reviewTeams = new Set(await deps.db.listDependencyReviewEnabledTeams())
   sendJson(res, 200, {
-    teams: await deps.db.listTeams(),
+    teams: (await deps.db.listTeams()).map(team => ({ ...team, npmScopes: scopes[team.id] ?? [], dependencyReview: reviewTeams.has(team.id) })),
     users: await deps.db.listUserOptions(),
     repos: selectableRepos(await deps.db.listSelectedRepos()),
     permissions: VISIBILITY_PERMISSIONS,
@@ -2212,6 +2587,445 @@ async function handleRemoveTeamMember(req: IncomingMessage, res: ServerResponse,
   sendJson(res, 200, { ok: true })
 }
 
+async function handleSetTeamDependencyReview(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const s = await adminMutation(req, res, deps, cookie)
+  if (!s) return
+  let body
+  try { body = await readJsonBody(req) as { teamId?: unknown; enabled?: unknown } } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  if (typeof body?.teamId !== 'string' || typeof body?.enabled !== 'boolean') { sendJson(res, 400, { error: 'bad-request' }); return }
+  if (!await deps.db.setTeamDependencyReview(s.session.id, body.teamId, body.enabled)) { sendJson(res, 404, { error: 'no-team' }); return }
+  sendJson(res, 200, { ok: true })
+}
+
+// POST /api/admin/teams/set-npm-scopes — replace the npm scopes whose private
+// packages the team's members may read. Body { teamId, scopes: ['@scope'] }.
+async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const s = await adminMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const teamId = (body as { teamId?: unknown } | null)?.teamId
+  if (typeof teamId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
+  const team = await deps.db.getTeam(teamId)
+  const changed = await deps.db.setTeamNpmScopes(s.session.id, teamId, (body as { scopes?: unknown }).scopes)
+  if (changed == null) { sendJson(res, 404, { error: 'no-team' }); return }
+  const parts = [changed.added.length > 0 ? `added ${changed.added.join(', ')}` : '', changed.removed.length > 0 ? `removed ${changed.removed.join(', ')}` : ''].filter(Boolean)
+  if (parts.length > 0) await activity(deps, s.user, 'access', `changed team ${team?.name ?? teamId}'s npm scopes: ${parts.join('; ')}`)
+  sendJson(res, 200, { ok: true, scopes: (await deps.db.listTeamNpmScopes())[teamId] ?? [] })
+}
+
+// Who reads npm packages now: a session with workspace access, its role and
+// the npm scopes of its visible teams. Null for none.
+async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined): Promise<NpmReader | null> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+  if (s == null || !roleAtLeast(s.user.role, 'view')) return null
+  return { role: s.user.role, scopes: new Set(await deps.db.listUserNpmScopes(s.user.id)), userId: s.user.id }
+}
+
+// What a registry read found, or a 404 for the package (handleNpm's catch
+// answers it) where it found none.
+function found<T>(value: T | null | undefined): T {
+  if (value == null) throw new NpmPackageError(404, 'package-not-found')
+  return value
+}
+
+// Lists must enforce the same target and base access as the review itself,
+// including permission changes while the registry requests are in flight.
+async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[]): Promise<T[] | null> {
+  const controller = new AbortController()
+  const onClose = () => { if (!res.writableEnded) controller.abort() }
+  res.on('close', onClose)
+  try {
+    const reader = await npmReader(deps, cookie)
+    if (!reader || reader.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    const documents = new Map<string, Promise<NpmVersionDocument | null>>()
+    // Public versions' documents as the viewer keeps them (npm-kept.ts), a
+    // day: a list asks npm for none it read within it.
+    const kept = npmVersionStore(deps.db, deps.config.debug)
+    const read = (name: string, version: string) => {
+      const key = `${name}@${version}`
+      if (!documents.has(key)) documents.set(key, readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
+      return documents.get(key)!
+    }
+    const packages = await Promise.all(reviews.map(review => Promise.all([
+      read(review.package, review.version), ...(review.basePackage ? [read(review.basePackage, review.baseVersion!)] : []),
+    ])))
+    const current = await npmReader(deps, cookie)
+    if (!current || current.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    return reviews.filter((_, index) => packages[index]!.every(doc => doc && (!doc.private || canReadPrivateNpm(current, doc.name))))
+  } catch (error) {
+    if (controller.signal.aborted) return null
+    if (error instanceof NpmPackageError) { sendJson(res, error.status, { error: error.message }); return null }
+    throw error
+  } finally { res.off('close', onClose) }
+}
+
+const githubRepoOf = (doc: NpmVersionDocument) => (doc.manifest['github'] as { github?: string } | undefined)?.github ?? null
+
+function npmAdvisoryOptions(deps: ManagedHttpDeps, githubToken: NpmAdvisoryOptions['githubToken'], latestDoc: () => Promise<NpmVersionDocument | null>): NpmAdvisoryOptions {
+  return {
+    githubToken,
+    repo: async () => { const doc = await latestDoc(); return doc && githubRepoOf(doc) },
+    cache: signal => auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug),
+    lastListing: repo => lastListing(deps.config.upstreamCacheDir, deps.db, repo, deps.config.debug),
+    debug: deps.config.debug,
+  }
+}
+
+// Read the same target-version evidence as the viewer. Missing upstream
+// reports impose no extra verdict restriction; detected findings do.
+async function npmReviewPublicationLimit(deps: ManagedHttpDeps, reader: NpmReader, doc: NpmVersionDocument, signal: AbortSignal) {
+  if (npmTakenDown({ npm: doc })) return 'reject' as const
+  const privileged = canReadPrivateNpm(reader, doc.name)
+  const advisories = async () => {
+    const versions = await readNpmVersions(doc.name, privileged, signal)
+    if (!versions) return null
+    return npmAdvisories(doc.name, versions.versions, npmAdvisoryOptions(deps,
+      () => ensureUserAccessToken(deps.config, deps.db, reader.userId, Date.now()).catch(() => null),
+      () => readNpmVersion(doc.name, 'latest', privileged, signal)))
+  }
+  const [list, socket, risk] = await Promise.all([advisories().catch(() => null), doc.private ? null : npmSocketReport(doc.name, doc.version).catch(() => null),
+    npmRisk(doc, null, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug, teamScoped: true, privileged, signal })])
+  return npmReviewVerdictLimit(doc, list, socket, risk)
+}
+
+// Reviews are scoped to the bytes actually displayed, including the base.
+// Access to both versions is rechecked before returning or saving annotations.
+async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, params: URLSearchParams): Promise<void> {
+  const method = req.method ?? 'GET'
+  if (!['GET', 'POST'].includes(method)) { send405(res, 'GET, POST'); return }
+  const mutation = method !== 'GET'
+  const session = mutation ? await checkMutation(req, res, deps, cookie) : await readSession(deps.config, deps.db, cookie, Date.now())
+  if (!session) { if (!mutation) sendJson(res, 401, { error: 'unauthenticated' }); return }
+  if (!roleAtLeast(session.user.role, mutation ? 'triage' : 'view')) { sendJson(res, 403, { error: 'forbidden' }); return }
+  let body: Record<string, unknown> = {}
+  if (mutation) {
+    try {
+      const raw = await readJsonBody(req, 128 * 1024)
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('bad-body')
+      body = raw as Record<string, unknown>
+    } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  }
+  const field = (key: string) => mutation ? body[key] : params.get(key)
+  const name = field('package')
+  const version = field('version')
+  const integrity = field('integrity')
+  const basePackage = field('basePackage') ?? null
+  const baseVersion = field('baseVersion') ?? null
+  const baseIntegrity = field('baseIntegrity') ?? null
+  const validIntegrity = (value: unknown): value is string => typeof value === 'string' && value.length > 0 && value.length <= 1024
+  if (field('ecosystem') !== 'npm' || !isNpmPackageName(name) || !isNpmPackageSpec(version) || !validIntegrity(integrity)
+    || (basePackage !== null || baseVersion !== null || baseIntegrity !== null)
+      && (!isNpmPackageName(basePackage) || !isNpmPackageSpec(baseVersion) || !validIntegrity(baseIntegrity))) {
+    sendJson(res, 400, { error: 'bad-review-context' }); return
+  }
+  const context: ReviewContext = { ecosystem: 'npm', package: name, version, integrity,
+    basePackage: basePackage as string | null, baseVersion: baseVersion as string | null, baseIntegrity: baseIntegrity as string | null }
+  let change: ReviewChange | null = null
+  if (mutation) {
+    const action = body['action'], reviewId = body['reviewId'] ?? null, revision = body['revision'] ?? null
+    if (typeof action !== 'string' || !['start', 'save', 'publish', 'continue', 'revoke'].includes(action)
+      || (reviewId !== null && (typeof reviewId !== 'string' || reviewId.length === 0 || reviewId.length > 100 || !Number.isSafeInteger(revision) || Number(revision) < 1))
+      || (!['save', 'start'].includes(action) && reviewId === null) || (action === 'start' && reviewId !== null)) { sendJson(res, 400, { error: 'bad-review' }); return }
+    if (action === 'start') change = { action, reviewId: null, revision: null }
+    else if (action === 'publish') {
+      const teamIds = body['teamIds']
+      if (!Array.isArray(teamIds) || teamIds.length === 0 || teamIds.length > 100 || teamIds.some(id => typeof id !== 'string' || id.length > 100)) {
+        sendJson(res, 400, { error: 'bad-review-teams' }); return
+      }
+      const finalComment = body['finalComment'] ?? '', finalStatus = body['finalStatus'] ?? null
+      if (typeof finalComment !== 'string' || finalComment.length > 20000 || finalStatus !== null
+        && (typeof finalStatus !== 'string' || !['accept', 'accept-with-nits', 'request-changes', 'reject'].includes(finalStatus))) {
+        sendJson(res, 400, { error: 'bad-final-verdict' }); return
+      }
+      change = { action, reviewId: reviewId as string, revision: revision as number, teamIds, files: [], nonTextFiles: [],
+        final: finalStatus === null ? null : { status: finalStatus as ReviewInput['status'] & string, comment: finalComment } }
+    } else if (action === 'continue' || action === 'revoke') change = { action, reviewId: reviewId as string, revision: revision as number }
+    else {
+      const file = body['file']
+      const comment = body['comment']
+      const status = body['status'] ?? null
+      const entryId = body['entryId'] ?? null
+      if (typeof file !== 'string' || !file || file.length > 4096 || file.includes('\0')
+        || (entryId !== null && (typeof entryId !== 'string' || entryId.length === 0 || entryId.length > 100))
+        || typeof comment !== 'string' || comment.length > 20000
+        || (status !== null && (typeof status !== 'string' || !['accept', 'accept-with-nits', 'request-changes', 'reject'].includes(status))) || (status === null && entryId === null)) {
+        sendJson(res, 400, { error: 'bad-review' }); return
+      }
+      change = { action: 'save', reviewId: reviewId as string | null, revision: revision as number | null, entryId: entryId as string | null,
+        entry: { file, comment, status: status as ReviewInput['status'] } }
+    }
+  }
+  const controller = new AbortController()
+  const onClose = () => { if (!res.writableEnded) controller.abort() }
+  res.on('close', onClose)
+  try {
+    const reader = await npmReader(deps, cookie)
+    if (!reader || reader.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+    const kept = npmVersionStore(deps.db, deps.config.debug)
+    const read = (pkg: string, spec: string) => readNpmVersion(pkg, spec, canReadPrivateNpm(reader, pkg), controller.signal, kept)
+    const [doc, base] = await Promise.all([read(name, version), context.basePackage ? read(context.basePackage, context.baseVersion!) : null])
+    if (!doc || (context.basePackage && !base)) { sendJson(res, 404, { error: 'package-not-found' }); return }
+    if (doc.version !== version || doc.dist.integrity !== integrity
+      || (base && (base.version !== baseVersion || base.dist.integrity !== baseIntegrity))) {
+      sendJson(res, 409, { error: 'review-content-changed' }); return
+    }
+    if (change?.action === 'publish' || change?.action === 'save') {
+      const loads = [doc, ...base ? [base] : []].map(loadNpmFiles)
+      try {
+        const files = await Promise.all(loads.map(load => load.result))
+        const maps = files.map(list => new Map<string, unknown>(npmFileRows(list).map(([path, size, text, digest]) => [path, text ?? { format: 'digest', size, digest }])))
+        const after = maps[0]!, before = maps[1] ?? new Map<string, unknown>()
+        const diff = computeBundleDiff(before, after, () => '.')
+        const changed: { path: string; basePath?: string }[] = [...diff.files.onlyBase, ...diff.files.onlyOther, ...diff.files.changed]
+        const reviewable = (file: typeof changed[number]) => isReviewableFile(before.get(file.basePath ?? file.path), after.get(file.path))
+        const reviewedPath = change.action === 'save' ? change.entry.file : null
+        const reviewedFile = changed.find(file => file.path === reviewedPath)
+        if (change.action === 'save' && !reviewedFile) { sendJson(res, 400, { error: 'unknown-review-file' }); return }
+        if (change.action === 'save' && change.entry.status !== null && reviewedFile && !reviewable(reviewedFile)) { sendJson(res, 400, { error: 'non-text-review-file' }); return }
+        if (change.action === 'publish') {
+          change.files = changed.map(file => file.path)
+          change.nonTextFiles = changed.filter(file => !reviewable(file)).map(file => file.path)
+        }
+      } finally { loads.forEach(load => load.release()) }
+    }
+    const limit = change?.action === 'publish' && change.final && change.final.status !== 'reject'
+      ? await npmReviewPublicationLimit(deps, reader, doc, controller.signal) : 'accept'
+    const current = await npmReader(deps, cookie)
+    if (!current || current.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+    if ([doc, base].some(item => item?.private && !canReadPrivateNpm(current, item.name))) { sendJson(res, 404, { error: 'package-not-found' }); return }
+    if (!change) {
+      const allBases = params.get('allBases') === 'true'
+      const rows = await deps.db.listDependencyReviews(context, current.userId, allBases)
+      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows) : rows
+      if (reviews) sendJson(res, 200, { reviews, teams: await deps.db.listDependencyReviewTeams(current.userId) })
+      return
+    }
+    const checked = await checkMutation(req, res, deps, cookie)
+    if (!checked) return
+    if (checked.user.id !== current.userId || !roleAtLeast(checked.user.role, 'triage')) { sendJson(res, 403, { error: 'forbidden' }); return }
+    if (change.action === 'publish' && change.final && !allowedReviewVerdicts([], limit).includes(change.final.status)) {
+      sendJson(res, 400, { error: limit === 'reject' ? 'review-malware' : 'review-critical-vulnerability' }); return
+    }
+    const review = await deps.db.changeDependencyReview(context, checked.session.id, change, Date.now())
+    sendJson(res, 200, { review })
+  } catch (err) {
+    if (controller.signal.aborted) return
+    if (err instanceof NpmPackageError) { sendJson(res, err.status, { error: err.message }); return }
+    if (err instanceof NpmRiskError) { sendRiskError(res, err); return }
+    throw err
+  } finally { res.off('close', onClose) }
+}
+
+// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only}. Only readers with private access
+// (canReadPrivateNpm) can be answered from the server's npm token; the rest get
+// what the registry answers anonymously, every time (see npm-packages.ts).
+// Access is checked again after the registry's answer.
+async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, path: string, params: URLSearchParams): Promise<void> {
+  if (req.method !== 'GET') { send405(res, 'GET'); return }
+  const name = params.get('name'), spec = params.get('version') ?? 'latest'
+  // All but the package's own (its versions, figures and advisories) are a version's.
+  const versioned = path !== NPM_VERSIONS_PATH && path !== NPM_STATS_PATH && path !== NPM_ADVISORIES_PATH
+  const otherSpec = params.get('otherVersion') ?? ''
+  if (!isNpmPackageName(name) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
+    || (path === NPM_PRETTY_PATH && otherSpec !== '' && !isNpmPackageSpec(otherSpec))
+    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
+    sendJson(res, 400, { error: 'bad-package' }); return
+  }
+  const diffed = path === NPM_RENAME_DIFF_PATH && params.has('path') ? renameDiffRequest(params) : null
+  if (path === NPM_RENAME_DIFF_PATH && params.has('path') && !diffed) { sendJson(res, 400, { error: 'bad-file' }); return }
+  const reader = await npmReader(deps, cookie)
+  if (reader == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  const controller = new AbortController()
+  const onClose = () => { if (!res.writableEnded) controller.abort() }
+  res.on('close', onClose)
+  // A reader who lost their session, or their private access to an answer
+  // that needed it, while the registry was asked gets nothing.
+  const recheck = async (isPrivate: boolean) => {
+    const current = await npmReader(deps, cookie)
+    if (current == null) { sendJson(res, 401, { error: 'unauthenticated' }); return false }
+    if (isPrivate && !canReadPrivateNpm(current, name)) { sendJson(res, 404, { error: 'package-not-found' }); return false }
+    return !res.destroyed
+  }
+  const reply = async (isPrivate: boolean, body: Record<string, unknown>) => { if (await recheck(isPrivate)) sendJson(res, 200, body) }
+  // The reader's GitHub token, for GitHub's rate limits and never for what it
+  // shows: asked for once, and only where an answer isn't kept (npm-insights.ts).
+  let token: Promise<string | null> | undefined
+  const githubToken = () => token ??= ensureUserAccessToken(deps.config, deps.db, reader.userId, Date.now()).catch(() => null)
+  const privileged = canReadPrivateNpm(reader, name)
+  // Public versions' documents, kept in the database (npm-kept.ts), as
+  // repository risk scans keep them: an exact version's, read on every view,
+  // asked of npm once a day.
+  const keptVersions = npmVersionStore(deps.db, deps.config.debug)
+  // The latest version, read once a request: the package's figures and
+  // advisories go by the repository it names.
+  let latest: Promise<NpmVersionDocument | null> | undefined
+  const latestDoc = () => latest ??= readNpmVersion(name, 'latest', privileged, controller.signal, keptVersions)
+  const advisoryOptions = npmAdvisoryOptions(deps, githubToken, latestDoc)
+  // The figures of the repository the latest version names, noted as its
+  // repository for npmKnown; null where it names none, or they can't be had.
+  const githubFigures = (doc: NpmVersionDocument) => {
+    const repo = githubRepoOf(doc)
+    npmLatestRepo(name, repo)
+    return repo === null ? null : npmGithubStats(repo, githubToken).catch(() => null)
+  }
+  try {
+    // With whether a visible team lists its scope (`teamScoped`): its own
+    // releases, which the viewer doesn't flag as just published.
+    if (path === NPM_VERSIONS_PATH) {
+      const scope = npmPackageScope(name)
+      const [versions, teamScoped] = await Promise.all([readNpmVersions(name, privileged, controller.signal, { times: true }),
+        scope !== null && deps.db.hasTeamNpmScope(scope)])
+      await reply(found(versions).private, { ...versions, teamScoped })
+      return
+    }
+    // Across every published version, as the version list has them, which
+    // each advisory's `affected` indexes; those of the repository its latest
+    // version names, where GitHub says it is public, asked with the reader's
+    // GitHub token, its listing kept as bundle advisories keep it.
+    if (path === NPM_ADVISORIES_PATH) {
+      const versions = found(await readNpmVersions(name, privileged, controller.signal))
+      await reply(versions.private, { name, ...await npmAdvisories(name, versions.versions, advisoryOptions) })
+      return
+    }
+    // The package's, with the repository its latest version names; either
+    // is null where it can't be had.
+    if (path === NPM_STATS_PATH) {
+      // npm's downloads, which need nothing of the version, are asked at once;
+      // none is answered before the package's access is.
+      const downloadsAsked = npmDownloads(name).catch(() => null)
+      const doc = found(await latestDoc())
+      const [downloads, github] = await Promise.all([downloadsAsked, githubFigures(doc)])
+      await reply(doc.private, { name, downloads, github })
+      return
+    }
+    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptVersions))
+    if (spec === 'latest') latest = Promise.resolve(doc)
+    const repo = githubRepoOf(doc), sha = bundleCommitHash(doc.manifest['gitHead'])
+    // What the viewer asks about a version beside its files, by its route,
+    // and asks for meanwhile below. Its publish commit's tags, where its
+    // repository is public on GitHub and the reader has a token to ask with.
+    // Socket's report, asked only where npm answers for the version without a
+    // token: a private package's name never leaves for Socket. npm's
+    // provenance, asked only where its version says npm keeps one, and npm
+    // answers for the version without a token.
+    const tagsOf = () => repo === null || sha === null ? Promise.resolve([]) : npmCommitTags(repo, sha, doc.version, githubToken)
+    const socketOf = () => doc.private ? Promise.resolve(null) : npmSocketReport(name, doc.version)
+    const provenanceOf = () => doc.private || doc.manifest['provenance'] !== true ? Promise.resolve(null) : npmProvenance(name, doc.version, doc.dist.integrity)
+    // None where tags or Socket's report can't be had; a failure to have
+    // provenance is answered as one, for the viewer to ask again.
+    if (path === NPM_TAGS_PATH) { await reply(doc.private, { name, version: doc.version, tags: await tagsOf().catch(() => []) }); return }
+    if (path === NPM_SOCKET_PATH) { await reply(doc.private, { name, version: doc.version, socket: await socketOf().catch(() => null) }); return }
+    // What calls for a look at the version, as risk tells it (npm-risk.ts),
+    // against `otherVersion` where given, as Compare asks, else against the
+    // one risk picks of its versions, as the Overview asks; trusted however
+    // new and however few download it where a team lists its scope, its own
+    // packages, as a new dependency on a package of such a scope is.
+    if (path === NPM_RISK_PATH) {
+      const old = otherSpec === '' || otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const scope = npmPackageScope(name)
+      const teamScoped = scope !== null && await deps.db.hasTeamNpmScope(scope)
+      const assessment = await npmRisk(doc, otherSpec === '' ? 'pick' : old, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug, teamScoped, fromEmpty: otherSpec === '(empty)',
+        ownScope: listed => deps.db.hasTeamNpmScope(listed), privileged, signal: controller.signal })
+      // What it tells is read of both versions: private where either is.
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      await reply(doc.private || old?.private === true, { ...assessment })
+      return
+    }
+    if (path === NPM_PROVENANCE_PATH) { await reply(doc.private, { name, version: doc.version, provenance: await provenanceOf() }); return }
+    // Every one of its files that needs it pretty-printed (pretty-print.ts
+    // npmAll), or, against another version, the files that changed between
+    // them, both sides' (compared), a line each as it is formatted, or found
+    // kept for a public version; its files read before anything is answered.
+    // A reader who lost their session, or their access, meanwhile has the
+    // rest cut short.
+    if (path === NPM_PRETTY_PATH && params.has('path')) {
+      // One of its files pretty-printed, as one of a bundle's is.
+      const file = prettyRequest(params)
+      if (!file) { sendJson(res, 400, { error: 'bad-file' }); return }
+      if (!deps.prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+      const copy = await deps.prettyCache.npm(doc, file)
+      if (!(await recheck(doc.private))) { copy.stream.destroy(); return }
+      await sendEncoded(req, res, copy, 'text/plain; charset=utf-8', prettySource(file))
+      return
+    }
+    // Against another version, the pairs of its files that changed that the
+    // viewer diffs with renamed names hidden (rename-diff.ts renamedPairs), a
+    // line each as it is worked out, as Compare's pretty-printed files are;
+    // and those that changed in types alone (type-only.ts).
+    if (path === NPM_PRETTY_PATH || path === NPM_TYPE_ONLY_PATH || (path === NPM_RENAME_DIFF_PATH && !diffed)) {
+      if (!deps.prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+      const other = otherSpec === '' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const sides = other && await deps.prettyCache.npmSides(doc, other)
+      const lines = path === NPM_RENAME_DIFF_PATH ? renamedPairs(sides!, !doc.private && !other!.private)
+        : path === NPM_TYPE_ONLY_PATH ? typeOnlyFiles(sides!) : sides ? compared(sides) : await deps.prettyCache.npmAll(doc)
+      const isPrivate = doc.private || other?.private === true
+      if (!(await recheck(isPrivate))) return
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      await sendLines(res, lines, async () => {
+        const current = await npmReader(deps, cookie)
+        return current != null && (!isPrivate || canReadPrivateNpm(current, name))
+      })
+      return
+    }
+    // One of its JavaScript files diffed with another version's, both
+    // pretty-printed, renamed names hidden (rename-diff.ts).
+    if (diffed) {
+      const { prettyCache } = deps
+      if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+      const other = found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const diff = await renameDiffOf(diffed, async () => [await prettyText(await prettyCache.npm(doc, diffed.base)),
+        await prettyText(await prettyCache.npm(other, diffed.other))], !doc.private && !other.private)
+      if (!(await recheck(doc.private || other.private))) { diff.stream.destroy(); return }
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      await sendEncoded(req, res, diff, 'application/json')
+      return
+    }
+    // The load stays held until this response is written or abandoned, and
+    // a reader who stops reading it gives it up after a while. One already
+    // gone takes none, as its close has passed.
+    if (res.destroyed) return
+    const download = path === NPM_DOWNLOAD_PATH
+    // A version's files take longest to load: what the viewer asks for beside
+    // them is asked for meanwhile, so that what is answered by the time they
+    // are encoded comes with them (npmKnown), and the rest is on its way when
+    // the viewer asks. Nothing waits on it, and a failure is left for the
+    // viewer's own request to meet. Its whole document, read for its
+    // advisories' version list and the time each version was published
+    // (npmPublishTime), is read only where registry reads leave room for
+    // readers'.
+    if (!download) {
+      const quiet = (asked: Promise<unknown>) => { asked.catch(() => {}) }
+      quiet(npmDownloads(name))
+      quiet(latestDoc().then(newest => newest && githubFigures(newest)))
+      quiet(readNpmVersions(name, privileged, controller.signal, { times: true, spare: true })
+        .then(versions => versions && npmAdvisories(name, versions.versions, advisoryOptions)))
+      quiet(tagsOf())
+      quiet(socketOf())
+      quiet(provenanceOf())
+    }
+    const load = download ? loadNpmTarball(doc) : loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha))
+    res.once('close', load.release)
+    const bytes = await load.result
+    if (!(await recheck(doc.private))) return
+    res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+    res.writeHead(200, {
+      ...download
+        ? { 'content-type': 'application/gzip', 'content-disposition': attachmentDisposition(npmTarballFilename(doc.name, doc.version)) }
+        : { 'content-type': 'application/json', 'content-encoding': 'br' },
+      'content-length': String(bytes.byteLength), 'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff',
+    })
+    writeResponse(res, Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))
+  } catch (err) {
+    if (err instanceof NpmPackageError || err instanceof PrettyError) { if (!res.headersSent && !res.destroyed) sendJson(res, err.status, { error: err.message }); return }
+    if (err instanceof NpmRiskError) { if (!res.headersSent && !res.destroyed) sendRiskError(res, err); return }
+    if (controller.signal.aborted) return
+    throw err
+  } finally {
+    res.off('close', onClose)
+  }
+}
+
 async function handleWorkspaceShare(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, teamId: string, id?: string) {
   if (!deps.config.allowShare) { sendJson(res, 404, { error: 'sharing-disabled' }); return }
   const method = req.method ?? 'GET'
@@ -2252,6 +3066,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const path = url.pathname
     const method = req.method ?? 'GET'
     const cookie = req.headers.cookie
+    const viewing = viewToken(config, cookie) != null
 
     if (req.headers['x-deepview-share'] !== undefined || path.startsWith('/api/shares/')) {
       await handlePublicWorkspace(req, res, deps, url); return
@@ -2267,6 +3082,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         } : {}) } })
       return
     }
+    if (viewing && underPrefix(path, VIEW_PREFIXES) && !viewAllows(method, path)) { sendViewOnly(res); return }
     // OAuth: start → redirect to GitHub with the CSRF state cookie.
     if (path === LOGIN_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
@@ -2280,6 +3096,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       try {
         if (isIssueOAuthCallback(config, url.searchParams, cookie)) {
+          if (viewing) { sendViewOnly(res); return }
           const s = await readWorkspaceSession(res, deps, cookie)
           if (!s) return
           const result = await issueOAuthCallback(config, db, s.session, url.searchParams, cookie)
@@ -2287,7 +3104,9 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
           res.end(); return
         }
         const result = await handleCallback(url.searchParams, cookie, { config, db, avatarStore })
-        res.writeHead(302, { location: result.location, 'set-cookie': result.setCookies, 'cache-control': 'no-store' })
+        // A new sign-in never resumes an earlier view.
+        const setCookies = viewing ? [...result.setCookies, clearViewCookie(config)] : result.setCookies
+        res.writeHead(302, { location: result.location, 'set-cookie': setCookies, 'cache-control': 'no-store' })
         res.end()
       } catch (err) {
         if (err instanceof OAuthError) sendJson(res, err.status, { error: err.message })
@@ -2303,22 +3122,29 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
       res.end(); return
     }
-    // Who am I?
+    // Who am I? While an admin views as another user, that user, plus the
+    // admin as `viewer`. A view that has ended (with the admin's session or
+    // role, or the viewed account) is cleared, returning to the own session.
     if (path === SESSION_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readSession(config, db, cookie, Date.now())
-      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+      const now = Date.now()
+      let s = await readSession(config, db, cookie, now)
+      const ended = s == null && viewing
+      if (ended) s = await readSession(config, db, cookie, now, { own: true })
+      const headers: Record<string, string> = ended ? { 'set-cookie': clearViewCookie(config) } : {}
+      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
       sendJson(res, 200, {
         user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
         csrfToken: s.session.csrfToken,
-      })
+        ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
+      }, headers)
       return
     }
+    if (path === VIEW_AS_PATH) { await handleViewAs(req, res, deps, cookie); return }
     // Authentication is not workspace access. Keep bootstrap/session/logout
     // available so blocked accounts can see their role and sign out, but deny
     // every managed data route before reading bodies or looking up resources.
-    const managedDataPath = ['/api/admin', '/api/reports', '/api/bundles', '/api/teams', '/api/avatar', '/api/github']
-      .some(prefix => path === prefix || path.startsWith(prefix + '/'))
+    const managedDataPath = underPrefix(path, MANAGED_DATA_PREFIXES)
     const workspaceSession = managedDataPath ? await readWorkspaceSession(res, deps, cookie) : null
     if (managedDataPath && !workspaceSession) return
     const issueRoute = /^\/api\/teams\/([^/]+)\/issues$/u.exec(path)
@@ -2343,6 +3169,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (shareRoute) {
       await handleWorkspaceShare(req, res, deps, cookie, shareRoute[1]!, shareRoute[2]); return
     }
+    if (path === '/api/admin/uploads/key') { await handleUploadKey(req, res, deps, cookie); return }
     if (path.startsWith('/api/admin/uploads/')) { await handleUploadPart(req, res, deps, cookie, path); return }
     // Cached avatar by user id, served same-origin (the page CSP forbids the
     // github CDN). The id in the path keys the browser cache per user, so a user
@@ -2380,6 +3207,10 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleRemoveRepository(req, res, deps, cookie); return
     }
+    if (path === REPO_RISK_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryRisk(res, deps, cookie, url.searchParams); return
+    }
     if (path === BROWSABLE_REPOS_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       await handleBrowsableRepositories(res, deps, cookie); return
@@ -2434,12 +3265,22 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true', url.searchParams.get('details') === 'true')
       return
     }
-    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download)$/iu.exec(path)
+    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only)$/iu.exec(path)
     if (bundleRead) {
+      const id = bundleRead[1]!, part = bundleRead[2]!, { session } = workspaceSession!, { bundleCache, prettyCache } = deps
+      if (part === 'rename-diff' || part === 'type-only' || (part === 'pretty' && url.searchParams.has('other'))) {
+        if (method !== 'GET') { send405(res, 'GET'); return }
+        if (part === 'rename-diff' && url.searchParams.has('path')) { await handleBundleRenameDiff(req, res, deps, session, id, url.searchParams); return }
+        // The pairs a scoped Compare diffs, of the files it compares within its scope.
+        const [linesOf, scope] = part === 'pretty' ? [compared, ''] : [part === 'type-only' ? typeOnlyFiles : renamedPairs, url.searchParams.get('scope') ?? '']
+        await handleBundleChanges(res, deps, session, id, url.searchParams.get('other') ?? '', async (cache, base, other) => linesOf(await cache.bundleSides(base, other, scope))); return
+      }
       if (method !== 'GET' && method !== 'HEAD') { send405(res, 'GET, HEAD'); return }
-      const id = bundleRead[1]!
-      if (bundleRead[2] === 'download') await handleGetBundle(req, res, deps, workspaceSession!.session, id)
-      else await handleBundleCache(req, res, deps, workspaceSession!.session, id, bundleRead[2] as BundleCachePart)
+      if (part === 'download') { await handleGetBundle(req, res, deps, session, id); return }
+      if (part !== 'pretty') { await handleBundleCache(req, res, deps, session, id, bundleCache && (rec => bundleCache.open(rec, part as BundleCachePart))); return }
+      const file = prettyRequest(url.searchParams)
+      if (!file) { sendJson(res, 400, { error: 'bad-file' }); return }
+      await handleBundleCache(req, res, deps, session, id, prettyCache && (rec => prettyCache.bundle(rec, file)), 'text/plain; charset=utf-8', prettySource(file))
       return
     }
     if (path === BUNDLE_CREATE_PATH) {
@@ -2493,7 +3334,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       await handleTeamReports(res, deps, workspaceSession!.session, teamReports[1]!, url.searchParams.get('reportId')); return
     }
-    if (path === '/api/reports/query') {
+    if (path === REPORT_QUERY_PATH) {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleQueryReports(req, res, deps, cookie); return
     }
@@ -2549,6 +3390,63 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (path === TEAM_SET_MEMBER_PATH) { await handleSetTeamMember(req, res, deps, cookie); return }
       await handleRemoveTeamMember(req, res, deps, cookie); return
     }
+    if (path === '/api/admin/teams/set-dependency-review') {
+      if (method !== 'POST') { send405(res, 'POST'); return }
+      await handleSetTeamDependencyReview(req, res, deps, cookie); return
+    }
+    if (path === TEAM_SET_NPM_SCOPES_PATH) {
+      if (method !== 'POST') { send405(res, 'POST'); return }
+      await handleSetTeamNpmScopes(req, res, deps, cookie); return
+    }
+    if (path === '/api/npm/reviews/latest') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const integrity = url.searchParams.get('integrity'), name = url.searchParams.get('package'), version = url.searchParams.get('version')
+      if (!isNpmPackageName(name) || !isNpmPackageSpec(version) || !integrity || integrity.length > 1024) {
+        sendJson(res, 400, { error: 'bad-review-context' }); return
+      }
+      const review = await deps.db.getLatestOwnDependencyReview(s.user.id, { ecosystem: 'npm', package: name, version, integrity })
+      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [])
+      if (visible) sendJson(res, 200, { review: visible[0] ?? null })
+      return
+    }
+    if (path === '/api/npm/reviews/discard') {
+      if (method !== 'POST') { send405(res, 'POST'); return }
+      const s = await checkMutation(req, res, deps, cookie)
+      if (!s) return
+      let body: Record<string, unknown>
+      try {
+        const raw = await readJsonBody(req, 4096)
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('bad-body')
+        body = raw as Record<string, unknown>
+      } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+      const id = body['reviewId'], revision = body['revision']
+      if (typeof id !== 'string' || !id || id.length > 100 || !Number.isSafeInteger(revision) || Number(revision) < 1) {
+        sendJson(res, 400, { error: 'bad-review' }); return
+      }
+      await deps.db.discardDependencyReview(s.session.id, id, revision as number)
+      sendJson(res, 200, { ok: true }); return
+    }
+    if (path === '/api/npm/reviews/mine') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const id = url.searchParams.get('beforeId'), time = url.searchParams.get('beforeTime')
+      if ((time !== null || id !== null) && (time === null || !/^\d+$/u.test(time) || !Number.isSafeInteger(Number(time)) || !id || id.length > 100)) {
+        sendJson(res, 400, { error: 'bad-review-cursor' }); return
+      }
+      const page = await deps.db.listOwnDependencyReviews(s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
+      if (reviews) sendJson(res, 200, { ...page, reviews })
+      return
+    }
+    if (path === '/api/npm/reviews') {
+      await handleNpmReviews(req, res, deps, cookie, url.searchParams); return
+    }
+    if (NPM_PATHS.has(path)) {
+      await handleNpm(req, res, deps, cookie, path, url.searchParams); return
+    }
     if (path === LOGOUT_PATH) { await handleLogout(req, res, deps, cookie); return }
     if (deps.serveStatic?.(req, res)) return
     if (deps.next) { deps.next(req, res); return }
@@ -2561,7 +3459,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // Feeds lease a connection per poll, never across streaming sleeps. This
     // also covers capability-authenticated feeds handled by public-workspace.
     const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '')
-    const work = (db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res)).catch((err) => {
+    const serve = () => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res)
+    const work = runViewing(viewToken(config, req.headers.cookie) != null, serve).catch((err) => {
       if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)
       if (res.headersSent) { try { res.destroy() } catch {} }