@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-managed/http.ts

@@ -8,6 +8,11 @@
 //   GET  /api/oauth/github/login → 302 to GitHub (+ state cookie)
 //   GET  /api/oauth/github/callback → the OAuth hook (see github-oauth.ts)
 //   GET  /api/auth/session       → { user, csrfToken } | 401
+//   GET  /api/auth/profile       → { profile: { login, name, githubName, nameAccount, avatarAccount, accounts } }, the
+//        GitHub accounts linked to the user's and which of them the displayed name and avatar come from | 401/403
+//   POST /api/auth/profile       → CSRF, chooses those ({ name?, avatar? }: a linked account's id, null the sign-in one) | 400/401/403/404
+//   DELETE /api/auth/profile/accounts/<id> → CSRF, unlinks a linked GitHub account | 401/403/404
+//   GET  /api/oauth/github/link  → 302 to GitHub to link another account (+ state cookie); the callback lands on /my/profile
 //   GET  /api/teams              → the current user's teams + their reports and bundles | 401
 //   GET  /api/teams/<id>/fixes → PR/issue metadata from visible findings' stored Fix links
 //   GET  /api/teams/<id>/reports → all reports and links filtered through this team | 401/404
@@ -17,14 +22,49 @@
 //   GET  /api/reports/<id>/triage → triage entries (by finding id, shared across reports) for a viewable report's findings | 401/404
 //   POST /api/reports/<id>/triage → write triage entries: admin, or ≥triage role + membership | 401/403/404
 //   GET  /api/reports/<id>/triage/history?finding=<fid> → one visible finding's triage trail, newest first | 400/401/404
-//   GET  /api/avatar/<id>        → cached avatar bytes by user id | 401/404
+//   GET  /api/avatar/<id>[?own]  → cached avatar bytes by user id, of the account chosen on their profile (`own`: the
+//        sign-in account's), or by linked account id; `app-<id>` or `user-<id>`, an app agent's GitHub App's or account's (APP_AGENTS) | 401/404
 //   GET  /api/admin/users        → admin-only user list | 401/403
 //   GET  /api/admin/history      → paginated activity (admin), team content activity (manage) | 401/403
 //   POST /api/admin/set-role     → admin sets another user's role | 401/403/404
 //   GET  /api/admin/repositories → admin repo list (each flagged selected) | 401/403
 //   POST /api/admin/repositories/select → admin selects/deactivates a repo | 401/403
+//   POST /api/admin/repositories/dependency-review → admin sets a repo's dependency review: enabled, the reviews each
+//        version needs, and the commit its lockfiles' versions need none since | 400/401/403/404
 //   GET /api/admin/repositories/impact → admin attached data summary
-//   GET /api/admin/repositories/{browsable,refs,contents} → admin|manage + GitHub read access
+//   GET /api/admin/repositories/{browsable,refs,contents} → view or above, within the reader's team grants, + GitHub read access
+//        (browsable: the names alone; these and the reads below are the code viewer's, open to every team member)
+//   GET /api/admin/repositories/code?repoId=&ref=&path= → the files of a directory at a revision, within the reader's grants,
+//        Brotli-encoded | 400/401/403/404/409/413/429/502
+//   GET /api/admin/repositories/history?repoId=&ref=&path=&page=[&all=true[&from=]] → the commits a revision reaches, a page at a time,
+//        or across the most recently updated branches, with the branches and tags naming them, then on from the commits `from`
+//        names | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/changes?repoId=&path=&shas= → the files each of the commits `shas` names (fifty at most)
+//        adds, modifies, removes and renames within `path`, as `git log --name-status` lists them | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/tree?repoId=&path=&commit= → the files commit `commit` holds within `path`, as many as
+//        75,000, for Replay to start from | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/issues?repoId=&kind=issues|pulls&state=open|closed[&after=] → a page of the repository's issues
+//        or pull requests, the most recently updated first, with how many are open and closed | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/agents?repoId=[&pulls=&commits=] → a page of what agents left: pull requests and commits to
+//        the default branch no pull request merged, with issues, agents' branches and the app agents first | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/item?repoId=&number= → an issue or pull request, as its popup shows it, with its
+//        description's Markdown | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/pull-dependencies?repoId=&number= → the package versions a pull request's npm, pnpm and
+//        Yarn 1 lockfiles lock that they didn't at its merge base, an update's with those it was, by directory; with review=1, each's
+//        review, where its repository reviews dependencies; with numbers=1,2,3 (twenty at most) in place of number, those of each,
+//        { pulls }, one GitHub fails told { number, error } | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/branch-dependencies?repoId= → the versions the default branch's lockfiles lock that want review, where
+//        its review is in effect for the reader, GitHub not asked where it reviews none | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/lockfiles?repoId= → the lockfiles of the default branch its dependency review reads, by their
+//        paths, for its settings to name | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/pulse?repoId=&weeks=1|4|13|52 → the default branch's commits and lines a week and a day over
+//        the last year, its contributors and when in the period they commit, counted from its commits as Commits keeps them (how many are
+//        read while they are), and the pull requests
+//        merged and opened and the issues closed and opened in the last `weeks` weeks and the same days a period earlier | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/pulse/items?repoId=&weeks=&from=[&to=&authors=] → those pull requests and issues of the days
+//        `from` to `to` (YYYY-MM-DD, UTC; no `to`, on), and of any of `authors` (GitHub logins, comma-separated) | 400/401/403/404/409/429/502
+//        History, issues, item, agents and pulse each carry `users`: the app's users and agents the GitHub accounts they
+//        name are (github-users.ts), by login
 //   POST /api/admin/repositories/remove → admin permanently removes a repo
 //   GET  /api/admin/repositories/risk[?team=|?repo=] → admin: each connected repo's npm lockfiles, or a team's or one repo's,
 //        their packages and what risk tells of each, Brotli-encoded ndjson as each is found; the reader leaving stops it | 400/401/403/404
@@ -64,6 +104,8 @@
 //   GET/POST /api/npm/reviews → read private/team reviews; save, publish, revoke or continue a set | 400/401/403/404/409
 //   POST /api/npm/reviews/discard → author discards an unpublished review and its file rows | 400/401/403/409
 //   GET /api/npm/reviews/latest → latest own review for exact target bytes, across all bases | 400/401/403
+//   GET /api/npm/reviews/team?teamId=&beforeTime=&beforeId= → the reviews published to a team, the latest first, for one who
+//        reads them there | 400/401/404
 //   GET  /api/npm/package?name=&version= → a published version's manifest and files | 400/401/404/413/429/502
 //   GET  /api/npm/versions?name= → its dist-tags, versions, when each was published and its first was, and whether a team lists its scope | 400/401/404/429/502
 //   GET  /api/npm/download?name=&version= → its tarball | 400/401/404/413/429/502
@@ -82,6 +124,9 @@
 //        Brotli-encoded ndjson | 400/401/404/413/429/502/503
 //   GET  /api/npm/type-only?name=&version=&otherVersion= → the files that changed between two versions in types alone,
 //        Brotli-encoded ndjson | 400/401/404/413/429/502/503
+//   GET  /api/npm/delta?name=&version=&otherVersion= → the lines a version adds and removes against another, or `(empty)`, and
+//        those but for declaration files changed in types alone, where any are, and whether binary files changed
+//        | 400/401/404/413/422/429/502/503/504
 //   GET  /api/npm/risk?name=&version=&otherVersion= → what calls for a look at a version, as risk tells it, against another where given | 400/401/404/413/429/502
 //   POST /api/auth/logout        → same-origin + CSRF, drops the session (and any view)
 //   POST /api/auth/view-as       → admin opens a read-only view as another user | 400/401/403/404
@@ -90,7 +135,9 @@ import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { npmVersionStore, riskLineStore, scanReadStore } from './npm-kept.ts'
+import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmPublishTimeStore, npmVersionStore, pullDependencyStore,
+  repositoryReadStore, reviewBaselineStore, riskLineStore, scanReadStore } from './npm-kept.ts'
+import { type NpmDelta, npmDelta } from './npm-delta.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
 import { auditCache, auditedRepos, lastListing } from './upstream-cache.ts'
 import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
@@ -115,6 +162,7 @@ import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
 import { filterReportData } from '../common/managed/report-filter.ts'
 import type { TriageEntryPatch } from '../common/managed/triage.ts'
+import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
 import { MAX_FINDING_ID, MAX_TRIAGE_BODY_BYTES, MAX_TRIAGE_ENTRIES, MAX_TRIAGE_HISTORY, parseTriageEntryPatch } from '../common/managed/triage.ts'
 import { reportRepoGithub } from '@preventive/report'
 import { findingsRepository, loadManagedFindings, ownFileDirectory, readManagedReport } from '../common/managed/report-content.ts'
@@ -130,9 +178,11 @@ import type { ConnectedRepo } from './github-app.ts'
 import { canAddAnyPublicRepository, canAddRepositories, passesPublicRepositorySafeguard } from './repository-policy.ts'
 import { RepositoryDiscovery } from './repository-discovery.ts'
 import { RISK_KEPT_MS, SCAN_READ_KEPT_MS, type ScanProgress, repositoryRiskLines } from './repository-risk.ts'
-import { type RepositoryEntry, createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
-import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
-import { clearCookie, endSession, readSession } from './session.ts'
+import { WORKFLOWS_DIR } from './repository-actions.ts'
+import { githubActionsSource } from './github-actions.ts'
+import { type RepositoryEntry, createRepositoryBrowser, repositoryTreeFiles, scopedDirectory } from './repository-browser.ts'
+import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, cacheAvatar, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
+import { clearCookie, endSession, readSession, runRequestPresence } from './session.ts'
 import { VIEW_AS_PATH, VIEW_ONLY_ERROR, clearViewCookie, endViewSession, runViewing, startViewSession, viewToken } from './view-as.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
@@ -143,7 +193,11 @@ import { lookupIssueLinks } from './github-issue-links.ts'
 import { visibleManagedIssues } from './managed-issues.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
-import { attachmentDisposition, sendJson, sendLines, writeResponse } from './http-response.ts'
+import { LINK_LOGIN_PATH, isLinkOAuthCallback, linkLoginRedirect, linkOAuthCallback } from './github-link-oauth.ts'
+import type { ProfileChoice } from './github-links.ts'
+import { withAppUsers } from './github-users.ts'
+import { isBlobId } from './object-storage.ts'
+import { attachmentDisposition, sendJson, sendLines, writeResponse, writeResponseParts } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
@@ -152,8 +206,28 @@ import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
-import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
+import { NpmPackageError, type NpmReader, type NpmVersionDocument, type NpmVersionStore, canReadPrivateNpm, npmFileRows, npmPublishTime, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions,
+  readTogether } from './npm-packages.ts'
 import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
+import { loadRepositoryCodeBody, repositoryCodeFits } from './repository-code.ts'
+import { type ChangesStore, type CommitChanges, type CommitTree, TREES_READ, changesAsked, changesWithin, directoryFiles, repositoryChanges } from './repository-changes.ts'
+import { COAUTHORS_READ } from './commit-coauthors.ts'
+import { type AllHeads, type HistoryCommit, type HistoryPages, MAX_HISTORY_PAGE, type SquashedPull, type Squashes, historyFrom, historyStarts, openPullHeads,
+  repositoryAllHeads, repositoryAllHistory, repositoryHistory, repositoryRefTips, squashedPulls } from './repository-history.ts'
+import { AGENTS_READ_VERSION, APP_AGENTS, COMMITS_CURSOR, repositoryAgents } from './repository-agents.ts'
+import { ISSUES_CURSOR, ISSUES_READ_VERSION, repositoryIssues, repositoryItem } from './repository-issues.ts'
+import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependenciesAt } from './pull-dependencies.ts'
+import { type GithubAsked, lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
+import { MAX_REQUIRED_REVIEWS, SINCE_COMMIT } from './repository-dependency-reviews.ts'
+import { EVERY_LOCKFILE, heldTo, scopeOf } from './lockfile-scope.ts'
+import { type ReviewBaselineStore, baselineFor, heldDependencies, reviewedDependencies, reviewedPackages } from './pull-dependency-reviews.ts'
+import { formattedPull, withFormatted } from './dependency-review-comments.ts'
+import type { ReviewedDependencies } from './reviewed-dependencies.ts'
+import { commentReviews } from './pull-comment-reviews.ts'
+import { PULSE_WEEKS, PULSE_YEAR_VERSION, type PulseStats, StatsPending, commitStats, defaultHead, periodStats, pulseSince, repositoryActivity, repositoryLines,
+  repositoryStats, withLines, yearCommits } from './repository-pulse.ts'
+import { type AgentMerges, agentCommits, agentMerges, directCommits, sameMerges } from './agent-merges.ts'
+import { releaseCommits } from './release-commits.ts'
 import { computeBundleDiff } from '../common/bundle-compare-diff.js'
 import type { ReviewChange, ReviewContext, ReviewInput } from './dependency-reviews.ts'
 import { allowedReviewVerdicts, isReviewableFile, npmReviewVerdictLimit, npmTakenDown } from '../common/dependency-reviews.js'
@@ -168,6 +242,7 @@ import { comparisonBody, emptySide, npmComparedSide } from './comparison.ts'
 import { isNpmPackageName, isNpmPackageSpec, npmPackageScope } from '../common/managed/npm-packages.js'
 
 const SESSION_PATH = '/api/auth/session'
+const PROFILE_PATH = '/api/auth/profile'
 const AVATAR_PREFIX = '/api/avatar/'
 const LOGOUT_PATH = '/api/auth/logout'
 const ADMIN_USERS_PATH = '/api/admin/users'
@@ -178,7 +253,20 @@ const ADMIN_REPOS_PATH = '/api/admin/repositories'
 const BROWSABLE_REPOS_PATH = '/api/admin/repositories/browsable'
 const REPO_REFS_PATH = '/api/admin/repositories/refs'
 const REPO_CONTENTS_PATH = '/api/admin/repositories/contents'
+const REPO_CODE_PATH = '/api/admin/repositories/code'
+const REPO_HISTORY_PATH = '/api/admin/repositories/history'
+const REPO_CHANGES_PATH = '/api/admin/repositories/changes'
+const REPO_TREE_PATH = '/api/admin/repositories/tree'
+const REPO_ISSUES_PATH = '/api/admin/repositories/issues'
+const REPO_AGENTS_PATH = '/api/admin/repositories/agents'
+const REPO_ITEM_PATH = '/api/admin/repositories/item'
+const REPO_PULL_DEPENDENCIES_PATH = '/api/admin/repositories/pull-dependencies'
+const REPO_BRANCH_DEPENDENCIES_PATH = '/api/admin/repositories/branch-dependencies'
+const REPO_LOCKFILES_PATH = '/api/admin/repositories/lockfiles'
+const REPO_PULSE_PATH = '/api/admin/repositories/pulse'
+const REPO_PULSE_ITEMS_PATH = '/api/admin/repositories/pulse/items'
 const SELECT_REPO_PATH = '/api/admin/repositories/select'
+const REPO_DEPENDENCY_REVIEW_PATH = '/api/admin/repositories/dependency-review'
 const ADD_PUBLIC_REPO_PATH = '/api/admin/repositories/add-public'
 const CONNECT_REPO_APP_PATH = '/api/admin/repositories/connect-app'
 const REPO_IMPACT_PATH = '/api/admin/repositories/impact'
@@ -220,6 +308,7 @@ const NPM_RENAME_DIFF_PATH = '/api/npm/rename-diff'
 const NPM_TYPE_ONLY_PATH = '/api/npm/type-only'
 const NPM_COMPARISON_PATH = '/api/npm/comparison'
 const NPM_RISK_PATH = '/api/npm/risk'
+const NPM_DELTA_PATH = '/api/npm/delta'
 // What risk's errors (risk/npm/registry.js NpmRiskError) are answered as: npm
 // having no such package or version, or a tarball unpacking past risk's
 // bounds; npm failing otherwise a 502.
@@ -232,7 +321,7 @@ function sendRiskError(res: ServerResponse, err: NpmRiskError) {
   sendJson(res, status, { error: err.code })
 }
 const NPM_PATHS = new Set([NPM_PACKAGE_PATH, NPM_VERSIONS_PATH, NPM_DOWNLOAD_PATH, NPM_STATS_PATH, NPM_ADVISORIES_PATH, NPM_TAGS_PATH, NPM_SOCKET_PATH, NPM_PROVENANCE_PATH, NPM_PRETTY_PATH,
-  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH, NPM_COMPARISON_PATH])
+  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH, NPM_COMPARISON_PATH, NPM_DELTA_PATH])
 // How long an npm response may go unread before its connection is dropped.
 const NPM_RESPONSE_IDLE_MS = 60_000
 const MAX_TEAM_NAME = 100
@@ -248,7 +337,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
   if (!s) return
   const snapshot = await teamSnapshot(deps.db, s.session.id, teamId, reportId)
   const ids = [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)]
-  const manualUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const manualUrls = storedFixUrls(await deps.db.listTriageFixes(ids))
   const storedIssues = await deps.db.listManagedIssues(ids)
   const issues = visibleManagedIssues(storedIssues, snapshot)
   const visibleIds = new Set(issues.map(issue => issue.findingId))
@@ -259,7 +348,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
     : { fixes: await lookupFixes(deps.config, deps.db, snapshot, urls), updates: [] }
   // Cold report reads, token refresh and upstream batches can outlive changes
   // to security/links, team grants, publication, sessions or the Fix links.
-  const currentUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const currentUrls = storedFixUrls(await deps.db.listTriageFixes(ids))
   if (await readWorkspaceSession(res, deps, cookie) == null) return
   await recheckTeam(deps.db, s.session.id, snapshot)
   if (JSON.stringify(currentUrls) !== JSON.stringify(manualUrls)) {
@@ -298,9 +387,8 @@ function activity(deps: ManagedHttpDeps, user: StoredUser, kind: ActivityInput['
   return deps.db.recordActivity({ kind, actor: user.login, actorId: user.id, action, ...context }, Date.now())
 }
 
-async function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined): Promise<string | null> {
-  if (repoId == null) return null
-  return (await deps.db.listAllRepos()).find(repo => repo.repoId === repoId)?.fullName ?? null
+function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined): Promise<string | null> {
+  return repoId == null ? Promise.resolve(null) : deps.db.getRepoFullName(repoId)
 }
 
 // Workspace history is authorized BEFORE filtering, counting, or paging.
@@ -324,8 +412,14 @@ async function handleHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie:
   if (s.user.role !== 'admin') {
     const findings = new Map<string, ActivityContext>()
     const reports = kind === 'all' || kind === 'triage' ? await deps.db.listActivityReports(s.user.id) : []
+    // Every report's record in one read, as visibleFindingIds reads each one's.
+    const snapshot = reports.length > 0 ? await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), reports.map(report => report.reportId)) : { reports: [] }
+    if (snapshot == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+    const records = new Map(snapshot.reports.map(record => [record.id, record]))
     for (const report of reports) {
-      for (const finding of await visibleFindingIds(deps, s.user, report.reportId, s.session.id, null)) {
+      const record = records.get(report.reportId)
+      if (record == null) continue
+      for (const finding of await reportFindingIds(deps, record, record.repo.github)) {
         if (!findings.has(finding)) findings.set(finding, { finding, ...report })
       }
     }
@@ -349,10 +443,16 @@ export interface ManagedHttpDeps {
   originGate: OriginGate
   isShuttingDown: () => boolean
   track: (p: Promise<unknown>) => void
+  // Serverless (Vercel's): keeps the invocation alive for work that goes on
+  // past its answer, as a kept read read again behind it does.
+  waitUntil?: (p: Promise<unknown>) => void
   // Combined boot delegates unmatched paths to e2e and overrides discovery.
   serveStatic?: (req: IncomingMessage, res: ServerResponse) => boolean
   next?: Handler
   serverInfo?: ServerInfo
+  // The reviewed dependencies the host registered, as the server was
+  // assembled (reviewed-dependencies.ts).
+  reviewedDependencies?: ReviewedDependencies
 }
 
 type Handler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>
@@ -367,8 +467,9 @@ function firstHeader(v: string | string[] | undefined): string | null {
   return null
 }
 
-async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, userId: string): Promise<void> {
-  const avatar = await avatarStore.get(userId)
+// `key` is the image chosen for `id`; one not cached falls back to `id`'s own.
+async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id): Promise<void> {
+  const avatar = await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id))
   if (avatar == null) { sendJson(res, 404, { error: 'no-avatar' }); return }
   res.writeHead(200, {
     'content-type': avatar.contentType,
@@ -379,6 +480,26 @@ async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, userId
   res.end(avatar.bytes)
 }
 
+// The avatars `/api/avatar/app-<id>` and `/api/avatar/user-<id>` serve, these
+// alone: the agents' known by their GitHub Apps or accounts (APP_AGENTS),
+// each its mark on the Agents tab, and those the app draws agents' accounts
+// by (GITHUB_AGENTS). Each is fetched from GitHub once and
+// kept, under a key no user's, a v4 UUID, can be: an app's, `…-0000-<id>`,
+// an account's, `…-0001-<id>`.
+const AGENT_AVATARS: ReadonlySet<string> = new Set([...APP_AGENTS, ...Object.values(GITHUB_AGENTS)]
+  .flatMap(agent => 'avatar' in agent && agent.avatar ? [agent.avatar] : []))
+const AGENT_AVATAR = /^(app|user)-([1-9]\d{0,11})$/u
+
+async function serveAgentAvatar(res: ServerResponse, avatarStore: AvatarStore, avatar: string): Promise<void> {
+  const [, kind, id] = AGENT_AVATAR.exec(avatar)!
+  const key = `00000000-0000-0000-000${kind === 'app' ? 0 : 1}-${id!.padStart(12, '0')}`
+  if (await avatarStore.get(key) == null) {
+    await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
+      .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
+  }
+  await serveAvatar(res, avatarStore, key)
+}
+
 const MAX_JSON_BODY_BYTES = 4096
 
 // Buffer the request body, aborting (and throwing 'too-large') once it exceeds
@@ -481,9 +602,10 @@ function sendViewOnly(res: ServerResponse): void {
 // Reads stay available while an admin views as another user. Everything else
 // is refused before dispatch, except ending the view or signing out, and the
 // batch report preview, a POST without effects. Issue authorization would
-// grant GitHub access on the viewed user's behalf.
+// grant GitHub access on the viewed user's behalf, and linking an account
+// would link it to the viewed user.
 function viewAllows(method: string, path: string): boolean {
-  if (method === 'GET' || method === 'HEAD') return path !== ISSUE_LOGIN_PATH
+  if (method === 'GET' || method === 'HEAD') return path !== ISSUE_LOGIN_PATH && path !== LINK_LOGIN_PATH
   return (method === 'DELETE' && path === VIEW_AS_PATH) || (method === 'POST' && (path === LOGOUT_PATH || path === REPORT_QUERY_PATH))
 }
 
@@ -528,6 +650,65 @@ async function handleViewAs(req: IncomingMessage, res: ServerResponse, deps: Man
   res.end()
 }
 
+// GET /api/auth/profile — the user's profile (github-links.ts). POST chooses
+// the accounts their displayed name and avatar come from. Workspace access is
+// required: the accounts a user links are reserved for them.
+async function handleProfile(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const method = req.method ?? 'GET'
+  if (method === 'GET') {
+    const s = await readWorkspaceSession(res, deps, cookie)
+    if (s) await sendProfile(res, deps, s.user.id)
+    return
+  }
+  if (method !== 'POST') { send405(res, 'GET, POST'); return }
+  const s = await profileMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const choice = parseProfileChoice(body)
+  if (choice == null) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await deps.db.setProfileChoice(s.session.id, choice, Date.now())
+  await sendProfile(res, deps, s.user.id)
+}
+
+// DELETE /api/auth/profile/accounts/<id> — unlink one of the user's linked
+// GitHub accounts, which may then sign in or register again.
+async function handleUnlinkAccount(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
+  if ((req.method ?? 'GET') !== 'DELETE') { send405(res, 'DELETE'); return }
+  const s = await profileMutation(req, res, deps, cookie)
+  if (s == null) return
+  const link = await deps.db.unlinkGithubAccount(s.session.id, id, Date.now())
+  if (link == null) { sendJson(res, 404, { error: 'no-account' }); return }
+  await deps.avatarStore.delete(link.id).catch((err) => { console.warn('managed: linked avatar removal failed:', err) })
+  await activity(deps, s.user, 'access', `unlinked GitHub account @${link.login}`)
+  await sendProfile(res, deps, s.user.id)
+}
+
+async function profileMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await checkMutation(req, res, deps, cookie)
+  if (s != null && !roleAtLeast(s.user.role, 'view')) { sendJson(res, 403, { error: 'forbidden' }); return null }
+  return s
+}
+
+async function sendProfile(res: ServerResponse, deps: ManagedHttpDeps, userId: string): Promise<void> {
+  const profile = await deps.db.getProfile(userId)
+  if (profile == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  sendJson(res, 200, { profile })
+}
+
+// { name?, avatar? }, each a linked account's id or null; at least one.
+function parseProfileChoice(body: unknown): ProfileChoice | null {
+  if (body == null || typeof body !== 'object' || Array.isArray(body)) return null
+  const choice: ProfileChoice = {}
+  for (const key of ['name', 'avatar'] as const) {
+    if (!Object.hasOwn(body, key)) continue
+    const value = (body as Record<string, unknown>)[key]
+    if (value !== null && (typeof value !== 'string' || !isBlobId(value))) return null
+    choice[key] = value
+  }
+  return Object.keys(choice).length > 0 ? choice : null
+}
+
 // POST /api/admin/set-role — an admin sets ANOTHER user's role. Admin-only, and
 // refused for the caller's own id so an admin can't drop their own admin (keeps
 // at least one admin).
@@ -587,16 +768,19 @@ async function readWorkspaceSession(res: ServerResponse, deps: ManagedHttpDeps,
 // Who am I? While an admin views as another user, that user, plus the admin
 // as `viewer`. A view that has ended (with the admin's session or role, or the
 // viewed account) is cleared, returning to the own session. Null signed out.
+// `dependencyReview` where they publish dependency reviews to some team.
 async function currentSession(config: ManagedConfig, db: ManagedDb, cookie: string | undefined): Promise<{ body: ManagedSessionInfo | null; headers: Record<string, string> }> {
   const now = Date.now()
   let s = await readSession(config, db, cookie, now)
   const ended = s == null && viewToken(config, cookie) != null
   if (ended) s = await readSession(config, db, cookie, now, { own: true })
+  const reviews = s != null && (await db.listDependencyReviewTeams(s.user.id)).length > 0
   return {
     body: s && {
       user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
       csrfToken: s.session.csrfToken,
       ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
+      ...(reviews ? { dependencyReview: true as const } : {}),
     },
     headers: ended ? { 'set-cookie': clearViewCookie(config) } : {},
   }
@@ -644,9 +828,13 @@ async function handleListRepositories(req: IncomingMessage, res: ServerResponse,
   let tokenMissing = false
   let repositories
   if (scope === 'connected') {
+    const reviews = await deps.db.listRepoDependencyReviews()
+    const reviewTeams = await deps.db.listRepoReviewTeams()
     repositories = allRows.map((r) => ({
       id: r.repoId, fullName: r.fullName, private: r.private, htmlUrl: r.htmlUrl,
       installed: r.installationId != null, selected: r.active, active: r.active,
+      dependencyReview: reviews.get(r.repoId) ?? { enabled: false, required: 1, since: null, lockfiles: EVERY_LOCKFILE },
+      reviewTeams: reviewTeams.get(r.repoId) ?? [],
     }))
   } else {
     const showAll = scope === 'installed' && url.searchParams.get('showAll') === 'true'
@@ -676,6 +864,7 @@ async function handleListRepositories(req: IncomingMessage, res: ServerResponse,
     inactiveCount: allRows.filter((r) => !r.active).length,
     total,
     tokenMissing,
+    ...deps.reviewedDependencies ? { reviewedDependencies: true } : {},
   })
 }
 
@@ -810,6 +999,39 @@ async function handleSelectRepository(req: IncomingMessage, res: ServerResponse,
   await selectRepository(res, deps, s.user, repoId, cookie)
 }
 
+// POST /api/admin/repositories/dependency-review — a repository's dependency
+// review (repository-dependency-reviews.ts): `enabled`, the published reviews
+// each version its pull requests' lockfiles lock needs (`required`, 1 to
+// MAX_REQUIRED_REVIEWS), and the commit whose lockfiles' versions need none
+// (`since`, a full commit id, or null; where the host registered reviewed
+// dependencies, which replace it, none, `400 since-unsupported`, the one
+// stored kept as it is). Answers the setting then. Admin, CSRF.
+async function handleRepositoryDependencyReview(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
+  const s = await adminMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: Record<string, unknown> | null
+  try { body = await readJsonBody(req) as Record<string, unknown> | null } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const repoId = body?.['repoId']
+  const enabled = body?.['enabled']
+  const required = body?.['required']
+  const since = body?.['since'] ?? null
+  // The lockfiles it holds to, kept as they are where none is sent.
+  const lockfiles = body?.['lockfiles'] === undefined ? undefined : scopeOf(body['lockfiles'])
+  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId) || typeof enabled !== 'boolean'
+    || typeof required !== 'number' || !Number.isSafeInteger(required) || required < 1 || required > MAX_REQUIRED_REVIEWS
+    || (since !== null && (typeof since !== 'string' || !SINCE_COMMIT.test(since))) || lockfiles === null) {
+    sendJson(res, 400, { error: 'bad-request' }); return
+  }
+  if (since !== null && deps.reviewedDependencies) { sendJson(res, 400, { error: 'since-unsupported' }); return }
+  const repo = (await deps.db.listAllRepos()).find(row => row.repoId === repoId)
+  const setting = repo ? await deps.db.setRepoDependencyReview(repoId, { enabled, required, ...deps.reviewedDependencies ? {} : { since: since as string | null },
+    ...lockfiles ? { lockfiles } : {} }) : null
+  if (!repo || !setting) { sendJson(res, 404, { error: 'no-repository' }); return }
+  await activity(deps, s.user, 'repository', enabled ? 'enabled dependency review' : 'disabled dependency review', { repo: repo.fullName })
+  sendJson(res, 200, { ok: true, dependencyReview: setting })
+}
+
 async function repositoryFindingIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[]): Promise<Set<string>> {
   const ids = new Set<string>()
   for (const report of reports) {
@@ -1249,8 +1471,10 @@ async function backfillCatalogCommits(deps: ManagedHttpDeps, userId: string, mis
 
 // Listing connected repository names uses managed access only. Verify GitHub
 // access after selection, before returning any refs or source directory data.
+// Any team member (view or above) lists those their teams reach, for the code
+// viewer as for Create a bundle, whose builds stay admin|manage.
 async function handleBrowsableRepositories(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readWorkspaceSession(res, deps, cookie)
   if (!s) return
   sendJson(res, 200, { repos: selectableRepos(await bundleRepos(deps, s.user)) })
 }
@@ -1289,25 +1513,54 @@ function scopeRepositoryContents(contents: RepositoryContents | null, virtualEnt
   } : {}) }
 }
 
-// Recheck repository/path grants after upstream reads, before returning names.
-async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams, refs: boolean): Promise<void> {
+// A browse's repository, revision and directory, as its query names them;
+// null, answered, where it names none.
+function repositoryQuery(res: ServerResponse, query: URLSearchParams) {
   const repoId = Number(query.get('repoId'))
   const normalized = normalizeTeamPath(query.get('path') ?? '')
   const ref = query.get('ref') ?? ''
   if (!Number.isSafeInteger(repoId) || repoId <= 0 || !normalized.ok || ref.length > 1024 || /\p{Cc}/u.test(ref)) {
-    sendJson(res, 400, { error: 'bad-request' }); return
+    sendJson(res, 400, { error: 'bad-request' }); return null
   }
+  return { repoId, ref, path: normalized.path ?? '' }
+}
+
+// The repository `repoId` as the reader may browse it at `path`: one of their
+// bundle repositories, and what their grants show of that directory
+// (`virtualEntries`, null where they reach all of it: scopedDirectory). Null,
+// answered, where it is none of theirs. Every team member (view or above)
+// reads the repositories their teams reach; the reader then checks their own
+// GitHub read permission (repository-browser.ts), on each read.
+async function authorizeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number, path: string) {
+  const s = await readWorkspaceSession(res, deps, cookie)
+  if (!s) return null
+  const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
+  if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
+  const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
+  return { repo, virtualEntries: scopedDirectory(path, scopes), user: s.user }
+}
+
+// The repository as it was authorized, but for the shared default branch hint,
+// which a read may refresh meanwhile: that changes none of its identity,
+// credentials or managed grants.
+const sameRepository = (current: SelectedRepo, authorized: SelectedRepo) =>
+  JSON.stringify({ ...current, cachedDefaultBranch: authorized.cachedDefaultBranch }) === JSON.stringify(authorized)
+
+function sendGithubError(res: ServerResponse, err: GithubApiError) {
+  sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
+}
+
+// Recheck repository/path grants after upstream reads, before returning names.
+async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams, refs: boolean): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, ref } = asked
   const withDefault = refs && query.get('withDefault') === 'true'
-  const path = refs ? '' : normalized.path ?? ''
+  const path = refs ? '' : asked.path
   const authorize = async () => {
-    const s = await readManageSession(res, deps, cookie)
-    if (!s) return null
-    const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
-    if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
-    const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
-    const virtualEntries = scopedDirectory(path, scopes)
-    if ((!refs || withDefault) && virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
-    return { repo, virtualEntries, user: s.user }
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && (!refs || withDefault) && access.virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
   }
   const access = await authorize()
   if (!access) return
@@ -1329,23 +1582,783 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     await reader.recheckAccess()
     const current = await authorize()
     if (!current) return
-    // This request (or another reader) may have refreshed the shared hint. It
-    // does not change repository identity, credentials, or managed grants.
-    if (JSON.stringify({ ...current.repo, cachedDefaultBranch: access.repo.cachedDefaultBranch }) !== JSON.stringify(access.repo)) {
-      sendJson(res, 409, { error: 'repository-changed' }); return
-    }
-    sendJson(res, 200, refs ? { ...listed, ...(withDefault ? {
+    // This request (or another reader) may have refreshed the shared hint.
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, refs ? { ...listed, tagCommits, ...(withDefault ? {
       defaultContents: scopeRepositoryContents(revisions?.defaultContents ?? null, current.virtualEntries),
     } : {}) } : scopeRepositoryContents(contents, current.virtualEntries))
   } catch (err) {
-    if (err instanceof GithubApiError) {
-      sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/code: the files of a directory of a repository
+// at a revision, for the code viewer (repository-code.ts), read as browsing
+// it is, with the reader's own GitHub access, and only where their grants
+// reach the whole directory: one they reach only the ancestor of is none to
+// read. Its tree's listing says first whether its files fit, before its
+// tarball is asked for; the reader's access is checked again once it is
+// read, before any of it is sent. The load stays held until this response is
+// written or abandoned, and a reader who stops reading it gives it up after
+// a while.
+async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, ref, path } = asked
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const commit = await reader.commit(ref)
+    const repo = access.repo.fullName
+    const client = createClient({ token: reader.readToken() })
+    // A directory the commit has none at is none to read, as browsing it says.
+    const tree = await upstreamGithub(() => client.getRepoTreeId({ repo, sha: commit, ...(path ? { directory: path } : {}) }).catch((err: unknown) => {
+      throw err instanceof Error && err.name === 'AssertionError' && err.message.includes(' has no directory at ') ? new GithubApiError(404, 'no-directory') : err
+    }))
+    // Access still held, and the same repository, before anything read is sent.
+    const fenced = async () => {
+      await reader.recheckAccess()
+      const current = await authorize()
+      if (!current) return false
+      if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return false }
+      return true
+    }
+    // Too large names the commit it was read at, for History to read.
+    if (!repositoryCodeFits(await repositoryTreeFiles(repo, reader.readToken(), tree))) {
+      if (await fenced()) sendJson(res, 413, { error: 'directory-too-large', commit })
       return
     }
+    if (res.destroyed) return
+    const load = loadRepositoryCodeBody({ repoId, repo, commit, path, tree }, () => upstreamGithub(() => client.getRepoTreeTarball({ repo, tree })))
+    res.once('close', load.release)
+    const bytes = await load.result
+    if (!(await fenced()) || res.destroyed) return
+    res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+    res.writeHead(200, {
+      'content-type': 'application/json', 'content-encoding': 'br', 'content-length': String(bytes.byteLength),
+      'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff',
+    })
+    writeResponse(res, bytes)
+  } catch (err) {
+    if (res.headersSent || res.destroyed) return
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    if (err instanceof NpmPackageError) { sendJson(res, err.status, { error: err.message }); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/history: what the code viewer's History tab
+// draws (repository-history.ts), read as browsing is, with the reader's own
+// GitHub access, within their grants as the code is. From a revision (`ref`),
+// a page at a time (`page`), the commits touching `path` where it names a
+// directory, with the branches and tags naming commits on the first page; or,
+// with `all`, across the repository's most recently updated branches, which
+// needs a GitHub token. A whole repository's history, from a revision or all
+// branches, is read from commits a page each, kept by the commit each starts
+// at, and those kept glued on (historyFrom); a later page reads on from the
+// commits `from` names. The branches and tags naming commits are kept as an
+// issue's page is (keptAnswer). Access is checked again once it is read,
+// before any of it is sent, with the app's users its authors are
+// (github-users.ts).
+async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, ref, path } = asked
+  const page = Number(query.get('page') ?? '1')
+  const all = query.get('all') === 'true'
+  // Every branch's heads read now, not as kept: the client asks so where
+  // they miss the commit shown, as a branch moved since may.
+  const fresh = query.get('fresh') === 'true'
+  // A whole repository's later pages read on from where those before stop:
+  // all branches', always; a revision's, where the client names them.
+  const from = query.get('from')
+  const starts = from === null ? null : historyStarts(from)
+  if (!Number.isSafeInteger(page) || page < 1 || page > MAX_HISTORY_PAGE || (all && (path !== '' || (page > 1) !== (starts !== null)))
+    || (from !== null && (starts === null || path !== '' || page === 1))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  let readingPulls: Promise<{ number: number; sha: string }[] | null> = Promise.resolve(null)
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const repo = access.repo.fullName
+    const token = reader.readToken()
+    // With a token, as GraphQL reads them.
+    const pages = historyPages(deps, repoId, token !== null)
+    const quiet = <T>(fallback: T) => (err: unknown) => {
+      if (deps.config.debug) console.warn('managed: history pull requests read failed:', err)
+      return fallback
+    }
+    // Open pull heads do not depend on the commit history. Start them with
+    // it, handling failures immediately even if the history fails first.
+    if (token && path === '' && page === 1) {
+      readingPulls = keptAnswer(deps, `${repoId}\0openPulls`, () => openPullHeads(repo, token), undefined, fresh).then(answer => answer.value.pulls, quiet(null))
+    }
+    let body: object
+    if (all) {
+      if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
+      // What a later page reads on from, the client knows; whether one may
+      // follow, the deepest page says.
+      // Asked for afresh, those kept answered as just read: how long till
+      // they may be read again (`retryIn`), for the client to ask then.
+      const heads = starts ? null : await keptAnswer<AllHeads>(deps, `${repoId}\0heads`, () => repositoryAllHeads(repo, token), undefined, fresh)
+      const retryIn = heads && fresh && heads.kept ? heads.at + REPOSITORY_READ_FLOOR_MS - Date.now() : 0
+      body = starts ? { all: true, page, commits: (await historyFrom(repo, token, starts, pages)).commits, more: page < MAX_HISTORY_PAGE }
+        : { all: true, ...await repositoryAllHistory(repo, token, heads!.value, pages), ...retryIn > 0 ? { retryIn } : {} }
+    } else {
+      const commit = await reader.commit(ref)
+      // The branches and tags naming commits: with a token, every branch All
+      // branches reads and the latest tags, kept for both; without, GitHub's
+      // first page of each.
+      const naming = () => token
+        ? keptAnswer<AllHeads>(deps, `${repoId}\0heads`, () => repositoryAllHeads(repo, token)).then(({ value }) => ({
+          branches: value.heads.map(({ name, sha }) => ({ name, sha })), tags: value.tags }))
+        : keptAnswer(deps, `${repoId}\0refs`, () => repositoryRefTips(repo, token)).then(answer => answer.value)
+      const tips = page === 1 ? naming() : null
+      // A whole repository's from its commit, or on from those `from` names
+      // (a page by its number where none are, as GitHub lists them); a
+      // directory's by its number.
+      const history = path !== '' || (page > 1 && !starts) ? repositoryHistory(repo, token, commit, path, page)
+        : historyFrom(repo, token, starts ?? [commit], pages).then(read => ({ commits: read.commits, more: (starts !== null || read.more) && page < MAX_HISTORY_PAGE }))
+      const [read, named] = await Promise.all([history, tips])
+      body = { commit, path, page, ...read, ...named }
+    }
+    // The pull requests squashed into a whole repository's commits, drawn as
+    // the merges they were, and on its first page the open ones' heads,
+    // naming commits: with a token, as far as GitHub answers them, the
+    // history sent all the same where it doesn't.
+    const listed = (body as { commits: HistoryCommit[] }).commits
+    const [pulls, openPulls] = token && path === '' ? await Promise.all([
+      squashedPulls(repo, token, listed, historySquashes(deps, repoId)).catch(quiet<SquashedPull[]>([])),
+      readingPulls,
+    ]) : [[], null]
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    // Each commit as the tab draws it, its co-authors with it: what Pulse
+    // counts of it (its lines, its author's time) not sent.
+    const shown = ({ sha, parents, subject, authorName, authorLogin, authorId, coauthors, committedAt }: HistoryCommit) =>
+      ({ sha, parents, subject, authorName, authorLogin, authorId: authorId ?? null, coauthors: coauthors ?? [], committedAt })
+    sendJson(res, 200, await withAppUsers(deps.db, { ...body, commits: listed.map(shown),
+      ...pulls.length > 0 ? { pulls: pulls.map(pull => ({ ...pull, commits: pull.commits.map(shown) })) } : {}, ...openPulls?.length ? { openPulls } : {} }))
+  } catch (err) {
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  } finally {
+    // A failed history must not release the request's database lease while
+    // its independent pull read is still writing to the cache.
+    await readingPulls
+  }
+}
+
+// GET /api/admin/repositories/changes: the files each commit `shas` names
+// changes, as the code viewer's Replay plays them (repository-changes.ts),
+// within `path`, each commit's kept whole by the commit (historyChanges);
+// read as Replay's reads are (readForReplay).
+async function handleRepositoryChanges(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const shas = changesAsked(query.get('shas'))
+  if (!shas) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await readForReplay(res, deps, cookie, query, async (fullName, token, repoId, path) => {
+    const changes = await repositoryChanges(fullName, token, shas, historyChanges(deps, repoId))
+    return { path, changes: [...changes].map(([sha, read]) => read ? { sha, ...changesWithin(read, path) } : { sha, files: null, more: false }) }
+  })
+}
+
+// GET /api/admin/repositories/tree: the files commit `commit` holds within
+// `path` and their bytes (`sizes`), which Replay starts from and the Treemap
+// of a directory too large to open draws (repository-changes.ts
+// directoryFiles: the directory's own tree where the commit's is cut short),
+// kept whole by the commit and the rules it is read by (historyTreeStore,
+// TREES_READ); none (null) for one GitHub has none of. Read as Replay's
+// reads are (readForReplay).
+async function handleRepositoryTree(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const commit = query.get('commit') ?? ''
+  if (!/^[a-f\d]{40}$/u.test(commit)) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const store = historyTreeStore<CommitTree>(deps.db, deps.config.debug)
+  await readForReplay(res, deps, cookie, query, async (fullName, token, repoId, path) => {
+    const kept = { read: async (sha: string) => {
+      const value = (await store.read(`${repoId}\0${TREES_READ}\0${sha}`))?.value
+      return value && Array.isArray(value.files) && Array.isArray(value.sizes) && value.sizes.length === value.files.length ? value : null
+    }, write: (sha: string, tree: CommitTree) => store.write(`${repoId}\0${TREES_READ}\0${sha}`, tree, Date.now()) }
+    const tree = await directoryFiles(fullName, token, commit, path, kept)
+    return { commit, path, ...tree ?? { files: null, sizes: null, cut: false } }
+  })
+}
+
+// What Replay reads of repository `repoId` within `path` (`read`, with its
+// name and the reader's token), as the history is read: with the reader's
+// own GitHub access, within their grants as the code is, a directory they
+// reach all of, and sent once access is checked again.
+async function readForReplay(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams,
+  read: (fullName: string, token: string | null, repoId: number, path: string) => Promise<object>): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, path } = asked
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const body = await read(access.repo.fullName, reader.readToken(), repoId, path)
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, body)
+  } catch (err) {
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// The files repository `repoId`'s commits change, kept by each commit
+// (historyChangeStore, repository-changes.ts repositoryChanges).
+function historyChanges(deps: ManagedHttpDeps, repoId: number): ChangesStore {
+  const store = historyChangeStore<CommitChanges>(deps.db, deps.config.debug)
+  const keyOf = (sha: string) => `${repoId}\0${sha}`
+  return {
+    async read(shas) {
+      const kept = await store.readMany(shas.map(keyOf))
+      return new Map(shas.flatMap(sha => {
+        const value = kept.get(keyOf(sha))?.value
+        return value && Array.isArray(value.files) ? [[sha, value] as const] : []
+      }))
+    },
+    write: (sha, changes) => store.write(keyOf(sha), changes, Date.now()),
+  }
+}
+
+// How long what readWholeRepository read is answered as kept, unread again;
+// and how long one read is answered as kept even where it is asked for afresh.
+const REPOSITORY_READ_FRESH_MS = 2 * 60_000
+const REPOSITORY_READ_FLOOR_MS = 10_000
+// The repositories' reads being read again, behind a kept answer or as asked
+// for afresh, by key: one at a time, those asking meanwhile answered by it.
+const repositoryRereads = new Map<string, Promise<unknown>>()
+// A read GitHub refused, not failed: its credential or the GitHub App's
+// permission for it withdrawn (Issues, Pull requests, Checks), the
+// repository or what was asked of it gone. What was kept of it goes too.
+const refusedRead = (err: unknown) => err instanceof GithubApiError
+  && (err.status === 401 || err.status === 403 || err.status === 404 || err.message === 'github-status-403')
+
+// What `read` answers of a repository, kept by `key` (its id first) for every
+// reader (repositoryReadStore), each one's access checked as they ask before
+// this: answered as kept for REPOSITORY_READ_FRESH_MS, then, while it is
+// kept, answered at once and read again behind it for the next to ask, the
+// read tracked (serverless, its invocation kept alive till it settles,
+// deps.waitUntil); `kept` where it was, or where reading it again
+// failed as `keepThrough` lets it. One asked for afresh (`fresh`) is read
+// now, unless it was read REPOSITORY_READ_FLOOR_MS since, what was kept
+// answered where that read fails. One GitHub refuses to read again is no
+// longer kept: the next to ask is refused as GitHub refused it. `at` is when
+// what it answers was read.
+async function keptAnswer<T extends object>(deps: ManagedHttpDeps, key: string, read: () => Promise<T>,
+  keepThrough: (err: unknown) => boolean = () => false, fresh = false): Promise<{ value: T; kept: boolean; at: number }> {
+  const store = repositoryReadStore(deps.db, deps.config.debug)
+  // One kept longer than a day, not yet removed (pruneKept removes them as
+  // others are written), is none.
+  const stored = await store.read(key)
+  const held = stored && Date.now() - stored.at < REPOSITORY_READ_KEPT_MS ? stored : null
+  // Read, and kept as read when it was, which it is said read at.
+  const readKept = async () => {
+    try {
+      const value = await read()
+      const at = Date.now()
+      await store.write(key, value, at)
+      return { value, at }
+    } catch (err) {
+      if (refusedRead(err)) await store.remove(key)
+      throw err
+    }
+  }
+  const reread = () => {
+    let reading = repositoryRereads.get(key)
+    if (!reading) {
+      reading = readKept().finally(() => repositoryRereads.delete(key))
+      repositoryRereads.set(key, reading)
+    }
+    return reading as Promise<{ value: T; at: number }>
+  }
+  const age = held ? Date.now() - held.at : Infinity
+  const now = fresh && age >= REPOSITORY_READ_FLOOR_MS
+  if (held && !now) {
+    if (age >= REPOSITORY_READ_FRESH_MS && !repositoryRereads.has(key)) {
+      // Its failure leaves the kept answer sent until it is a day old, so it is said.
+      const behind = reread().catch((err: unknown) => { console.warn('managed: repository read failed:', err) })
+      deps.track(behind)
+      deps.waitUntil?.(behind)
+    }
+    return { value: held.value as T, kept: true, at: held.at }
+  }
+  try {
+    return { ...now ? await reread() : await readKept(), kept: false }
+  } catch (err) {
+    if (held && ((now && !refusedRead(err)) || keepThrough(err))) return { value: held.value as T, kept: true, at: held.at }
     throw err
   }
 }
 
+// The pages of repository `repoId`'s history kept (historyPageStore), each by
+// the commit it starts at (repository-history.ts historyFrom) and the rules
+// its co-authors were read by (commit-coauthors.ts COAUTHORS_READ), those
+// telling each commit's co-authors (kept since they are read), and with
+// `graphql`, only those read with GraphQL, telling its lines and the accounts
+// its co-authors' addresses are (a page GitHub's REST API listed tells
+// neither); the rest read again.
+function historyPages(deps: ManagedHttpDeps, repoId: number, graphql = false): HistoryPages {
+  const store = historyPageStore<HistoryCommit[]>(deps.db, deps.config.debug)
+  const keyOf = (top: string) => `${repoId}\0${COAUTHORS_READ}\0${top}`
+  const told = (tops: string[], kept: Map<string, { value: HistoryCommit[] }>) => new Map(tops.flatMap(top => {
+    const page = kept.get(keyOf(top))?.value
+    return Array.isArray(page) && page.every(commit => Array.isArray(commit.coauthors)) && (!graphql || page.every(commit => commit.additions != null))
+      ? [[top, page] as const] : []
+  }))
+  return {
+    read: async tops => told(tops, await store.readMany(tops.map(keyOf))),
+    async readFirst(first, then) {
+      const kept = await store.readFirst(first.map(keyOf), then.map(keyOf))
+      return { first: kept.first, pages: told(kept.first ? first : then, kept.found) }
+    },
+    write: (top, commits) => store.write(keyOf(top), commits, Date.now()),
+  }
+}
+
+// The pull requests squashed into repository `repoId`'s commits, kept by
+// each commit and the rules their commits' co-authors were read by
+// (COAUTHORS_READ), null for one none was (repository-history.ts
+// squashedPulls); one kept before its commits' co-authors were read, read
+// again.
+function historySquashes(deps: ManagedHttpDeps, repoId: number): Squashes {
+  const store = historySquashStore<SquashedPull | null>(deps.db, deps.config.debug)
+  const keyOf = (sha: string) => `${repoId}\0${COAUTHORS_READ}\0${sha}`
+  return {
+    async read(shas) {
+      const kept = await store.readMany(shas.map(keyOf))
+      return new Map(shas.flatMap(sha => {
+        const entry = kept.get(keyOf(sha))
+        return entry && (entry.value === null || (Array.isArray(entry.value.commits) && entry.value.commits.every(commit => Array.isArray(commit.coauthors))))
+          ? [[sha, entry.value] as const] : []
+      }))
+    },
+    write: (sha, pull) => store.write(keyOf(sha), pull, Date.now()),
+  }
+}
+
+// What the whole of repository `repoId` gives in GraphQL (`read`, with its
+// name and a token), read as browsing is, with the reader's own GitHub
+// access: only by a reader whose grants reach all of it, with a token, and
+// sent once access is checked again after it is read; what `key` names kept
+// (keptAnswer), sent as kept, its reader's access checked as they ask; with
+// `readAt`, when it was read from GitHub, one kept as old as it was kept, so
+// that a reader holding two reads of the same can tell the later.
+async function readWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
+  read: (fullName: string, token: string) => Promise<object>, key: string | null = null, readAt = false): Promise<void> {
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const { value, kept, at } = key === null ? { value: await read(fullName, token), kept: false, at: Date.now() }
+      : await keptAnswer(deps, `${repoId}\0${key}`, () => read(fullName, token))
+    return { value: readAt ? { ...value, readAt: at } : value, kept }
+  })
+}
+
+// What `answer` gives of the whole of repository `repoId` (with its name and
+// a token), as readWholeRepository reads it: sent at once where it was kept,
+// else once access is checked again, with the app's users it names
+// (github-users.ts), never kept with it; or what `unread` tells of it, the
+// app's alone, once the app's access is checked, GitHub then never asked.
+async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
+  answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>,
+  unread: () => Promise<object | null> = () => Promise.resolve(null)): Promise<void> {
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, '')
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  const told = await unread()
+  if (told) { sendJson(res, 200, await withAppUsers(deps.db, told)); return }
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const token = reader.readToken()
+    if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
+    const answered = await answer(access.repo.fullName, token, access.user)
+    if (answered.kept) { sendJson(res, 200, await withAppUsers(deps.db, answered.value)); return }
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, await withAppUsers(deps.db, answered.value))
+  } catch (err) {
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/issues: what the code viewer's Issues and Pull
+// requests tabs show (repository-issues.ts): `kind`'s open or closed
+// (`state`), a page at a time, on from the cursor `after` names. They are
+// the whole repository's (readWholeRepository).
+async function handleRepositoryIssues(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const kind = query.get('kind')
+  const state = query.get('state') ?? 'open'
+  const after = query.get('after')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || (kind !== 'issues' && kind !== 'pulls') || (state !== 'open' && state !== 'closed')
+    || (after !== null && !ISSUES_CURSOR.test(after))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await readWholeRepository(res, deps, cookie, repoId, async (fullName, token) => ({ kind, state, ...await repositoryIssues(fullName, token, kind, state, after) }),
+    `issues\0${ISSUES_READ_VERSION}\0${kind}\0${state}\0${after ?? ''}`, true)
+}
+
+// GET /api/admin/repositories/agents: what the code viewer's Agents tab
+// reconstructs agents' sessions from (repository-agents.ts): a page
+// of pull requests on from the cursor `pulls` names, and of the default
+// branch's commits on from `commits`, the first page, naming neither, with
+// issues and branches. They are the whole repository's (readWholeRepository).
+async function handleRepositoryAgents(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const cursors = { pulls: query.get('pulls'), commits: query.get('commits') }
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || (cursors.pulls !== null && !ISSUES_CURSOR.test(cursors.pulls))
+    || (cursors.commits !== null && !COMMITS_CURSOR.test(cursors.commits))) {
+    sendJson(res, 400, { error: 'bad-request' }); return
+  }
+  await readWholeRepository(res, deps, cookie, repoId, (fullName, token) => repositoryAgents(fullName, token, cursors),
+    `agents\0${AGENTS_READ_VERSION}\0${cursors.pulls ?? ''}\0${cursors.commits ?? ''}`)
+}
+
+// GET /api/admin/repositories/item: the issue or pull request numbered
+// `number`, as the code viewer's popup for it shows it (repository-issues.ts
+// repositoryItem). It is the whole repository's (readWholeRepository).
+async function handleRepositoryItem(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const number = itemNumber(query)
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || number === null) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await readWholeRepository(res, deps, cookie, repoId, (fullName, token) => repositoryItem(fullName, token, number), `item\0${ISSUES_READ_VERSION}\0${number}`, true)
+}
+
+// The issue's or pull request's number a request names, as GraphQL takes one
+// (an Int, at most 2³¹ − 1); null for none.
+function itemNumber(query: URLSearchParams): number | null {
+  const number = Number(query.get('number'))
+  return /^[1-9]\d{0,9}$/u.test(query.get('number') ?? '') && number <= 2 ** 31 - 1 ? number : null
+}
+
+// GET /api/admin/repositories/pull-dependencies: the package versions pull
+// request `number`'s lockfiles add (pull-dependencies.ts), what its base's and head's
+// commits tell kept by them (pullDependencyKept), its `number` with them.
+// They are the whole repository's (answerWholeRepository), the commits they
+// are of kept by its number as its popup's item is, its head moving with each
+// push, what they tell kept by them alone, not again. With `review=1`,
+// as an open one's are asked, where the repository reviews dependencies,
+// each version's review (pull-dependency-reviews.ts), read afresh as each
+// asks, reviews being published meanwhile; its baseline kept, where the host
+// registered no reviewed dependencies, which are asked in its place.
+// Up to MAX_ASKED_PULLS pull requests asked together (`numbers=1,2,3`) are
+// answered together, as many read at once as PULLS_AT_ONCE, `{ pulls }`,
+// each's answer, else `{ number, error }` where GitHub fails it, with one
+// check of its access before and one after, but where each was kept.
+const MAX_ASKED_PULLS = 20
+const PULLS_AT_ONCE = 3
+async function handleRepositoryPullDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const review = query.get('review') === '1'
+  const listed = query.get('numbers')
+  const numbers = listed === null ? [itemNumber(query)] : listed.split(',').map(text => itemNumber(new URLSearchParams({ number: text })))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || numbers.length > MAX_ASKED_PULLS || numbers.some(number => number === null) || new Set(numbers).size < numbers.length
+    || !['1', null].includes(query.get('review'))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
+    if (listed === null) return pullDependencyAnswer(deps, fullName, token, user, repoId, numbers[0]!, review)
+    const answers = await eachOf(numbers as number[], PULLS_AT_ONCE, number => pullDependencyAnswer(deps, fullName, token, user, repoId, number, review).catch((err: unknown) => {
+      // GitHub asked, though it failed: its access asked again after.
+      if (err instanceof GithubApiError) return { value: { number, error: err.message }, kept: false }
+      throw err
+    }))
+    return { value: { pulls: answers.map(({ value }) => value) }, kept: answers.every(({ kept }) => kept) }
+  })
+}
+
+// Pull request `number`'s answer, as the endpoint gives it, and whether all
+// of it was kept, GitHub asked for none of it.
+async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, token: string, user: StoredUser, repoId: number, number: number, review: boolean) {
+  const kept = pullDependencyKept(deps, repoId)
+  const reading: { told?: PullDependencies } = {}
+  const answered = await keptAnswer(deps, `${repoId}\0pull-commits\0${PULL_DEPENDENCIES_READ}\0${number}`, async () => {
+    const { commits, told } = await pullDependenciesAt(fullName, token, number, kept)
+    reading.told = told
+    return { commits }
+  })
+  // What its commits tell, as read, else as kept by them, else, no longer
+  // kept, read again.
+  const held = reading.told ?? (typeof answered.value.commits === 'string' ? await kept.read(answered.value.commits) : null)
+  const pulled = { number, ...held ?? (await pullDependenciesAt(fullName, token, number, kept)).told }
+  // Where its review is on, those of lockfiles it leaves out told to none,
+  // whoever asks.
+  const setting = await deps.db.repoDependencyReview(repoId)
+  const scoped = setting?.enabled ? heldDependencies(pulled, setting.lockfiles) : pulled
+  const now = review ? await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(scoped)) : null
+  // Its review by the lockfiles they were told by, though they have changed
+  // since; turned off meanwhile, all of them, as where it is off.
+  const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
+  const told = review && !now && setting?.enabled && !(await deps.db.repoDependencyReview(repoId))?.enabled ? pulled : scoped
+  const reviewed = deps.reviewedDependencies ?? null
+  const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
+  // Its comments read for reviews, where the host reads them, while it is
+  // open (pull-comment-reviews.ts reads whether it is with them).
+  const parse = reviewed?.parseComments
+  const comments = state && parse ? commentReviews({ fullName, number, token, parse, reviewers: accounts => repoReviewers(deps, repoId, accounts) }) : null
+  // The comment the host formats of the reader's reviews of its versions, for its copy button.
+  const formatted = await formattedPull(reviewed, deps.db, user.id, told, state, { repository: fullName, number })
+  return { value: { number: told.number, ...await reviewedDependencies(told, state, { baseline, baselineUnread: unread, baselineError: error, reviewed, commentReviews: comments }),
+    ...formatted ? { formatted } : {} }, kept: answered.kept && held !== null }
+
+}
+
+// GET /api/admin/repositories/branch-dependencies: what the lockfiles of the
+// repository's default branch lock that wants review, where its review is in
+// effect for the reader (`review`, else none, told without asking GitHub
+// where it reviews none), as a team's Dependencies tab shows it: its head, as
+// its pulse reads it, kept a while; every lockfile there its review holds to
+// (lockfile-scope.ts, commit-lockfiles.ts) as one directory, its versions as
+// a pull request's others are (pull-dependency-reviews.ts), each left unread
+// a directory of its own failing the review, as a pull request's are. Kept,
+// its access not asked again, where its head was kept and its lockfiles and
+// baseline held, GitHub asked for none of them.
+async function handleRepositoryBranchDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
+    const headRead = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
+    const head = headRead.value.sha
+    if (!head) return { value: { head: null, review: null }, kept: false }
+    const asked: GithubAsked = { github: !headRead.kept }
+    // Those its review holds to alone read, as many as are read of them.
+    const setting = await deps.db.repoDependencyReview(repoId)
+    if (!setting?.enabled) return { value: { head, review: null }, kept: false }
+    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path), asked)
+    const { packages, paths } = lockedIn(read)
+    const told = { base: head, head, cut: false, lockfiles: [{ paths, added: [], more: 0, locked: packages.slice(0, MAX_LOCKED), moreLocked: Math.max(0, packages.length - MAX_LOCKED) },
+      ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' }))] }
+    const now = await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(told))
+    if (!now) return { value: { head, review: null }, kept: !asked.github }
+    // Told by the lockfiles it held to as they were read, though they have
+    // changed since.
+    const state = { ...now, lockfiles: setting.lockfiles }
+    const reviewed = deps.reviewedDependencies ?? null
+    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null }
+      : await baselineFor(fullName, token, repoId, state, baselineKept(deps), asked)
+    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: !asked.github }
+  }, async () => (await deps.db.repoDependencyReview(repoId))?.enabled ? null : { review: null })
+}
+
+// GET /api/admin/repositories/lockfiles: the lockfiles of the repository's
+// default branch its dependency review reads (commit-lockfiles.ts), by their
+// paths, with their formats, at its head, as its pulse reads it, for its
+// settings to name those it holds to (lockfile-scope.ts).
+async function handleRepositoryLockfiles(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const head = (await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))).value.sha
+    return { value: { head, lockfiles: head ? (await lockfilesAt(fullName, token, head)).map(({ path, format }) => ({ path, format })) : [] }, kept: false }
+  })
+}
+
+// The app's users `accounts` are, by their logins in lower case, of those
+// who publish reviews to a team counting for repository `repoId`.
+async function repoReviewers(deps: ManagedHttpDeps, repoId: number, accounts: { login: string; githubId: number | null }[]) {
+  const users = await deps.db.listUsersByAccount(accounts)
+  const counted = await deps.db.listRepoReviewers(repoId, [...new Set(Object.values(users).map(user => user.id))])
+  return new Map(Object.entries(users).flatMap(([login, user]) => counted.has(user.id) ? [[login.toLowerCase(), user.id] as const] : []))
+}
+
+// The versions repository lockfiles locked at the commits their dependencies
+// are reviewed since, kept by each (reviewBaselineStore).
+function baselineKept(deps: ManagedHttpDeps): ReviewBaselineStore {
+  const store = reviewBaselineStore(deps.db, deps.config.debug)
+  return {
+    async read(key) {
+      const value = (await store.read(key))?.value
+      const strings = (list: unknown) => Array.isArray(list) && list.every(item => typeof item === 'string')
+      return strings(value?.versions) && strings(value?.unread) ? value : null
+    },
+    write: (key, baseline) => store.write(key, baseline, Date.now()),
+  }
+}
+
+// What repository `repoId`'s pull requests' lockfiles add, kept by the
+// commits of each's base and head and the rules they were told by
+// (PULL_DEPENDENCIES_READ, pullDependencyStore).
+function pullDependencyKept(deps: ManagedHttpDeps, repoId: number): PullDependencyStore {
+  const store = pullDependencyStore<PullDependencies>(deps.db, deps.config.debug)
+  const keyOf = (commits: string) => `${repoId}\0${PULL_DEPENDENCIES_READ}\0${commits}`
+  return {
+    async read(commits) {
+      const value = (await store.read(keyOf(commits)))?.value
+      return value && Array.isArray(value.lockfiles) ? value : null
+    },
+    write: (commits, told) => store.write(keyOf(commits), told, Date.now()),
+  }
+}
+
+// GET /api/admin/repositories/pulse: what the code viewer's Pulse tab shows
+// (repository-pulse.ts): the default branch's year, counted from its commits
+// (pulseCommits), and the pull requests and issues of the last `weeks`
+// weeks, each kept apart. A year not read whole yet answers how many of its
+// commits are (`reading`), or of the pull requests merged in it (`pulls`);
+// one GitHub's statistics count, while it is still computing them,
+// `pending`, for the client to ask again. They are the whole repository's
+// (readWholeRepository).
+async function handleRepositoryPulse(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const weeks = Number(query.get('weeks') ?? '4')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || !PULSE_WEEKS.includes(weeks)) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const [period, year] = await Promise.all([
+      keptAnswer(deps, `${repoId}\0pulse\0${weeks}`, () => repositoryActivity(fullName, token, weeks)),
+      pulseCommits(deps, repoId, fullName, token),
+    ])
+    return { value: { weeks, ...period.value, stats: year.stats && periodStats(year.stats, weeks), reading: year.reading, pulls: year.pulls,
+      pending: year.pending }, kept: period.kept && year.kept }
+  })
+}
+
+// The default branch's year (repository-pulse.ts commitStats), counted from
+// its commits as the Commits tab keeps them, with their lines
+// (yearCommits): kept by the head it was read from (repositoryReadStore),
+// that head kept as an issue's page is; its commits merged from an agent's
+// pull request told by those merged (agentMerges), kept as read, the rest
+// read on by the next answer as the year's commits are, and read again as
+// an answer kept is, a label changing whose a pull request is without
+// moving the head, the year counted again where what they bring changed.
+// A year not read whole yet is how many of its commits are (`reading`), or
+// of the pull requests merged (`pulls`), beside the year last counted from
+// an earlier head over the same weeks, where one is kept, so that a head
+// moved on shows the year as it was till it is counted again; one past
+// YEAR_COMMITS is GitHub's statistics' (repositoryStats, repositoryLines),
+// kept together as an issue's page is and through GitHub computing them
+// again, `pending` while it first computes them, the year last counted
+// beside it so too.
+// A day as a pulse's items are narrowed by (YYYY-MM-DD, UTC), when it starts;
+// a GitHub login, as many of them as PULSE_AUTHORS.
+const PULSE_DAY = /^\d{4}-\d{2}-\d{2}$/u
+const GITHUB_LOGIN = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}(?:\[bot\])?$/iu
+const PULSE_AUTHORS = 10
+const pulseDay = (value: string | null) => {
+  const at = value !== null && PULSE_DAY.test(value) ? Date.parse(`${value}T00:00:00Z`) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// GET /api/admin/repositories/pulse/items: the Pulse tab's pull requests and
+// issues narrowed to a picked day or week (`from` to `to`, else on from
+// `from`) and the GitHub accounts a picked contributor committed as
+// (`authors`), as repositoryActivity reads them, kept apart for each.
+async function handleRepositoryPulseItems(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const weeks = Number(query.get('weeks') ?? '4')
+  const [from, to] = [pulseDay(query.get('from')), query.has('to') ? pulseDay(query.get('to')) : null]
+  const logins = (query.get('authors') ?? '').split(',').filter(Boolean)
+  // Each once, whatever its case, as GitHub matches logins.
+  const authors = [...new Set(logins.map(login => login.toLowerCase()))].toSorted()
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || !PULSE_WEEKS.includes(weeks) || from === null || (query.has('to') && (to === null || to < from))
+    || authors.length > PULSE_AUTHORS || !logins.every(login => GITHUB_LOGIN.test(login))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const narrowing = { from, to, authors }
+    const items = await keptAnswer(deps, `${repoId}\0pulse-items\0${weeks}\0${from}\0${to ?? ''}\0${narrowing.authors.join(',')}`,
+      () => repositoryActivity(fullName, token, weeks, Date.now(), globalThis.fetch, narrowing))
+    return { value: { weeks, ...items.value }, kept: items.kept }
+  })
+}
+
+async function pulseCommits(deps: ManagedHttpDeps, repoId: number, fullName: string, token: string) {
+  const first = pulseSince(52, Date.now())
+  const head = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
+  if (!head.value.sha) return { stats: commitStats([], first), reading: null, pulls: null, pending: false, kept: head.kept }
+  const store = repositoryReadStore(deps.db, deps.config.debug)
+  const key = `${repoId}\0pulse-year\0${PULSE_YEAR_VERSION}\0${head.value.sha}\0${first}`
+  const lastKey = `${repoId}\0pulse-year-last`
+  const mergesKey = `${repoId}\0pulse-merges\0${PULSE_YEAR_VERSION}`
+  const last = async () => {
+    const kept = (await store.read(lastKey))?.value as { first: number; stats: PulseStats } | undefined
+    return kept?.first === first ? kept.stats : null
+  }
+  const sha = head.value.sha
+  // What tells whose the year's commits are, kept as read: the agents' pull
+  // requests merged (agentMerges), and the commits that release the
+  // repository (`releases`, release-commits.ts releaseCommits).
+  type Attribution = AgentMerges & { releases?: string[] }
+  const keptAttribution = async () => ((await store.read(mergesKey))?.value as Attribution | undefined) ?? null
+  const attribution = async (kept: Attribution | null): Promise<Attribution> => {
+    const [merges, releases] = await Promise.all([agentMerges(fullName, token, first, kept), releaseCommits(fullName, token, first, historyChanges(deps, repoId))])
+    return { ...merges, releases }
+  }
+  // The year counted from its `commits` as `read` tells whose they are and
+  // which were pushed directly, the branch followed through those it was
+  // read on past (`passed`, yearCommits) too; kept by its head and as the
+  // year last counted.
+  const count = async ({ commits, passed }: { commits: HistoryCommit[]; passed: HistoryCommit[] }, read: Attribution) => {
+    const walked = [...commits, ...passed]
+    const stats = commitStats(commits, first, agentCommits(read, walked), new Set(read.releases), directCommits(read, walked, sha))
+    await Promise.all([store.write(key, stats, Date.now()), store.write(lastKey, { first, stats }, Date.now())])
+    return stats
+  }
+  // A year kept by its head, what tells whose its commits are read again as
+  // an answer kept is (keptAnswer), a label or a tag changing it without
+  // moving the head: counted again from its pages kept where what agents'
+  // pull requests bring, or the releases, changed, or a read of the pull
+  // requests left unfinished is finished; the year as kept answered
+  // meanwhile, and where reading them fails.
+  const relabelled = async (stats: PulseStats) => {
+    const recounted: { stats?: PulseStats } = {}
+    await keptAnswer(deps, mergesKey, async () => {
+      const kept = await keptAttribution()
+      const read = await attribution(kept)
+      const same = kept && !kept.next && sameMerges(read, kept) && read.releases!.join() === (kept.releases ?? []).join()
+      if (read.next || same) return read
+      const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true))
+      if (year.complete) recounted.stats = await count(year, read)
+      return read
+    }, () => true).catch((err: unknown) => { console.warn('managed: pulse attribution read failed:', err) })
+    return recounted.stats ?? stats
+  }
+  const held = (await store.read(key))?.value as PulseStats | { tooMany: true } | undefined
+  if (held && !('tooMany' in held)) return { stats: await relabelled(held), reading: null, pulls: null, pending: false, kept: head.kept }
+  if (!held) {
+    const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true))
+    if (year.complete) {
+      const read = await attribution(await keptAttribution())
+      await store.write(mergesKey, read, Date.now())
+      if (read.next) return { stats: await last(), reading: null, pulls: read.next.read, pending: false, kept: false }
+      return { stats: await count(year, read), reading: null, pulls: null, pending: false, kept: false }
+    }
+    if (!year.tooMany) return { stats: await last(), reading: year.read, pulls: null, pending: false, kept: false }
+    await store.write(key, { tooMany: true }, Date.now())
+  }
+  // Its commits and lines read together, kept as one: never the one GitHub
+  // has counted since a push beside the other kept from before it.
+  const computing = (err: unknown) => err instanceof StatsPending
+  const counted = await keptAnswer(deps, `${repoId}\0pulse-stats`, async () => {
+    const [stats, lines] = await Promise.all([repositoryStats(fullName, token), repositoryLines(fullName, token, first)])
+    return withLines(stats, lines)
+  }, computing).catch((err: unknown) => { if (computing(err)) return null; throw err })
+  if (counted) return { stats: counted.value, reading: null, pulls: null, pending: false, kept: counted.kept }
+  return { stats: await last(), reading: null, pulls: null, pending: true, kept: false }
+}
+
 function prebuildBundle(deps: ManagedHttpDeps, id: string) {
   if (!deps.bundleCache || deps.config.serverless) return
   deps.track((async () => {
@@ -1420,9 +2433,13 @@ function scanProgress(deps: ManagedHttpDeps, key: string, scan: string | null) {
 // (repository-browser.ts), and that access checked again once it is read,
 // before any of it is told; packages as the npm viewer's admins read them, in
 // spare assessments (npm-risk.ts), trusted however new where a team lists
-// their scope, and each lockfile's asked of npm's advisories at once. The
-// reader leaving, losing their admin role or the server shutting down stops
-// it.
+// their scope, and each lockfile's asked of npm's advisories at once; each
+// repository's Dependabot alerts, open or dismissed, read with the App's
+// installation token where the admin's own access to it lets them see them on
+// GitHub (dependabot-access.ts); and its GitHub Actions, the references they
+// make resolved with the admin's own GitHub token (github-actions.ts). The
+// reader leaving, losing their admin role or
+// the server shutting down stops it.
 async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const s = await readAdminSession(res, deps, cookie)
   if (!s) return
@@ -1435,7 +2452,8 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
   const controller = new AbortController()
   res.on('close', () => { controller.abort() })
   res.setTimeout(REPO_RISK_IDLE_MS, () => res.destroy())
-  const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, s.user.id))
+  const user = await repositoryBrowserUser(deps, s.user.id)
+  const browser = createRepositoryBrowser(deps.config, user)
   const scopes = new Map<string, Promise<boolean>>()
   const teamScoped = (name: string) => {
     const scope = npmPackageScope(name)
@@ -1460,8 +2478,15 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
         lockfiles: async () => (await upstreamGithub(() => client.findRepoLockfiles({ repo: repo.fullName, sha: commit }))).lockfiles,
         file: path => upstreamGithub(() => client.getRepoFile({ repo: repo.fullName, path, ref: commit })),
         recheck: async () => { await reader.recheckAccess() },
+        // As GitHub has them now, where the admin's own access lets them see them.
+        dependabot: () => reader.dependabotAlerts(),
+        workflows: () => reader.directory(WORKFLOWS_DIR, commit).then(({ entries }) => entries.filter(entry => entry.type === 'file' && /\.ya?ml$/iu.test(entry.name)).map(entry => entry.path),
+          (error: unknown) => { if (error instanceof GithubApiError && error.status === 404) return []; throw error }),
       }
     },
+    actions: githubActionsSource(user.token),
+    actionFiles: scanReadStore(deps.db, 'action-files', SCAN_READ_KEPT_MS, deps.config.debug),
+    actionLines: scanReadStore(deps.db, 'actions', RISK_KEPT_MS, deps.config.debug),
     teamScoped,
     // Each package's downloads readied before it is assessed
     // (scan-downloads.ts), so that none waits on npm's downloads API; a
@@ -2244,7 +3269,7 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
   if (outputBytes > MAX_REPORT_QUERY_BYTES) { sendJson(res, 413, { error: 'batch-too-large' }); return }
   parts.push(suffix)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
-  writeResponse(res, Buffer.concat(parts, outputBytes))
+  writeResponseParts(res, parts, outputBytes)
 }
 
 // The server selects the complete published workspace for classification.
@@ -2274,24 +3299,23 @@ async function visibleFindingIds(deps: ManagedHttpDeps, user: StoredUser, report
   }
   const rec = await deps.db.getReport(reportId)
   if (rec == null) return new Set()
-  const repo = { github: await repositoryName(deps, rec.repoId) }
-  const key = JSON.stringify([reportId, rec.sha256, rec.filename, repo])
+  return reportFindingIds(deps, rec, await repositoryName(deps, rec.repoId))
+}
+// A whole report's finding ids, kept by its content, name and repository,
+// the one read least recently dropped first.
+async function reportFindingIds(deps: ManagedHttpDeps, rec: { id: string; sha256: string; filename: string }, github: string | null): Promise<Set<string>> {
+  const key = JSON.stringify([rec.id, rec.sha256, rec.filename, { github }])
   let cache = visibleIdsCaches.get(deps)
   if (cache == null) { cache = new Map(); visibleIdsCaches.set(deps, cache) }
   const hit = cache.get(key)
-  if (hit != null) return hit
-  const ids = new Set<string>()
-  const bytes = await deps.reportStore.get(reportId)
-  if (bytes == null) return ids
-  const text = bytes.toString('utf8')
-  const { data } = readManagedReport(text, rec.filename)
-  if (data == null) return ids
-  const report = await loadManagedFindings(JSON.stringify(data), rec.filename)
-  if (report == null) return ids
-  for (const f of report.findings) {
-    const id = (f as { id?: unknown }).id
-    if (typeof id === 'string' && id !== '') ids.add(id)
-  }
+  if (hit != null) { cache.delete(key); cache.set(key, hit); return hit }
+  const bytes = await deps.reportStore.get(rec.id)
+  if (bytes == null) return new Set()
+  const { data } = readManagedReport(bytes.toString('utf8'), rec.filename)
+  if (data == null) return new Set()
+  // The ids the team workspace derives (teamFindingIds), from the one parse.
+  const ids = await reportIds(data)
+  ids.delete('')
   while (cache.size >= VISIBLE_IDS_CACHE_MAX) {
     const oldest = cache.keys().next().value
     if (oldest === undefined) break
@@ -2702,8 +3726,12 @@ async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse,
 // Null for none.
 async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined, names: readonly string[]): Promise<NpmReader | null> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (s == null || !roleAtLeast(s.user.role, 'view')) return null
-  return { role: s.user.role, scopes: new Set(npmScopesCount(s.user.role, names) ? await deps.db.listUserNpmScopes(s.user.id) : []), userId: s.user.id }
+  return s == null ? null : npmReaderOf(deps, s.user, names)
+}
+// The same of `user`, as a session the request read just now tells them.
+async function npmReaderOf(deps: ManagedHttpDeps, user: { id: string; role: NpmReader['role'] }, names: readonly string[]): Promise<NpmReader | null> {
+  if (!roleAtLeast(user.role, 'view')) return null
+  return { role: user.role, scopes: new Set(npmScopesCount(user.role, names) ? await deps.db.listUserNpmScopes(user.id) : []), userId: user.id }
 }
 
 // What a registry read found, or a 404 for the package (handleNpm's catch
@@ -2713,27 +3741,34 @@ function found<T>(value: T | null | undefined): T {
   return value
 }
 
+// Version documents a list of reviews reads at once: each holds a version
+// document's room in what npm's reads may hold at once (npm-packages.ts),
+// which refuses past thirty-two of them.
+const REVIEW_READS_AT_ONCE = 8
+
 // Lists must enforce the same target and base access as the review itself,
-// including permission changes while the registry requests are in flight.
-async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[]): Promise<T[] | null> {
+// including permission changes while the registry requests are in flight;
+// first as `session`, the one the request read just now, where given.
+async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[],
+  session?: { id: string; role: NpmReader['role'] }): Promise<T[] | null> {
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
   try {
-    const reader = await npmReader(deps, cookie, reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []]))
+    const names = reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []])
+    const reader = session ? await npmReaderOf(deps, session, names) : await npmReader(deps, cookie, names)
     if (!reader || reader.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
-    const documents = new Map<string, Promise<NpmVersionDocument | null>>()
     // Public versions' documents as the viewer keeps them (npm-kept.ts), a
-    // day: a list asks npm for none it read within it.
-    const kept = npmVersionStore(deps.db, deps.config.debug)
-    const read = (name: string, version: string) => {
-      const key = `${name}@${version}`
-      if (!documents.has(key)) documents.set(key, readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
-      return documents.get(key)!
-    }
-    const packages = await Promise.all(reviews.map(review => Promise.all([
-      read(review.package, review.version), ...(review.basePackage ? [read(review.basePackage, review.baseVersion!)] : []),
-    ])))
+    // day, all read of the database at once: a list asks npm for none it read
+    // within it. Each version once, as many at once as REVIEW_READS_AT_ONCE.
+    const versionsOf = (review: T) => [[review.package, review.version], ...review.basePackage ? [[review.basePackage, review.baseVersion!]] : []] as [string, string][]
+    const asked = new Map(reviews.flatMap(versionsOf).map(([name, version]) => [`${name}\0${version}`, [name, version] as const]))
+    const store = npmVersionStore(deps.db, deps.config.debug)
+    const held = await store.readMany?.([...asked.values()].map(([name, version]) => ({ name, version }))) ?? new Map()
+    const kept: NpmVersionStore = { read: (name, version) => Promise.resolve(held.get(`${name}@${version}`) ?? null), write: store.write }
+    const read = await eachOf([...asked], REVIEW_READS_AT_ONCE, ([, [name, version]]) => readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
+    const documents = new Map([...asked.keys()].map((key, at) => [key, read[at] ?? null]))
+    const packages = reviews.map(review => versionsOf(review).map(([name, version]) => documents.get(`${name}\0${version}`) ?? null))
     const current = await npmReader(deps, cookie, packages.flat().flatMap(doc => doc?.private ? [doc.name] : []))
     if (!current || current.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
     return reviews.filter((_, index) => packages[index]!.every(doc => doc && (!doc.private || canReadPrivateNpm(current, doc.name))))
@@ -2846,7 +3881,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   try {
     const reader = await npmReader(deps, cookie, [context.package, ...context.basePackage ? [context.basePackage] : []])
     if (!reader || reader.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-    const kept = npmVersionStore(deps.db, deps.config.debug)
+    const kept = readTogether(npmVersionStore(deps.db, deps.config.debug), [{ name, version }, ...context.basePackage ? [{ name: context.basePackage, version: context.baseVersion! }] : []])
     const read = (pkg: string, spec: string) => readNpmVersion(pkg, spec, canReadPrivateNpm(reader, pkg), controller.signal, kept)
     const [doc, base] = await Promise.all([read(name, version), context.basePackage ? read(context.basePackage, context.baseVersion!) : null])
     if (!doc || (context.basePackage && !base)) { sendJson(res, 404, { error: 'package-not-found' }); return }
@@ -2881,8 +3916,8 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
     if (!change) {
       const allBases = params.get('allBases') === 'true'
       const rows = await deps.db.listDependencyReviews(context, current.userId, allBases)
-      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows) : rows
-      if (reviews) sendJson(res, 200, { reviews, teams: await deps.db.listDependencyReviewTeams(current.userId) })
+      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows, { id: current.userId, role: current.role }) : rows
+      if (reviews) sendJson(res, 200, { reviews: await withFormatted(deps.reviewedDependencies ?? null, current.userId, reviews), teams: await deps.db.listDependencyReviewTeams(current.userId) })
       return
     }
     const checked = await checkMutation(req, res, deps, cookie)
@@ -2892,7 +3927,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
       sendJson(res, 400, { error: limit === 'reject' ? 'review-malware' : 'review-critical-vulnerability' }); return
     }
     const review = await deps.db.changeDependencyReview(context, checked.session.id, change, Date.now())
-    sendJson(res, 200, { review })
+    sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, current.userId, [review]))[0] })
   } catch (err) {
     if (controller.signal.aborted) return
     if (err instanceof NpmPackageError) { sendJson(res, err.status, { error: err.message }); return }
@@ -2916,7 +3951,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
   if (!isNpmPackageName(name) || !isNpmPackageName(otherName) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
     || (path === NPM_PRETTY_PATH && otherSpec !== '' && !isNpmPackageSpec(otherSpec))
     || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))
-    || (path === NPM_COMPARISON_PATH && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
+    || ((path === NPM_COMPARISON_PATH || path === NPM_DELTA_PATH) && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
     sendJson(res, 400, { error: 'bad-package' }); return
   }
   const diffed = path === NPM_RENAME_DIFF_PATH && params.has('path') ? renameDiffRequest(params) : null
@@ -2986,7 +4021,17 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       await reply(doc.private, { name, downloads, github })
       return
     }
-    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptVersions))
+    // The version it is compared with, where its route names one, read
+    // beside it, the two read of those kept at once.
+    const against: [string, string, boolean] | null = (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)') || (path === NPM_DELTA_PATH && otherSpec !== '(empty)')
+      || ((path === NPM_TYPE_ONLY_PATH || path === NPM_RENAME_DIFF_PATH || (path === NPM_PRETTY_PATH && !params.has('path'))) && otherSpec !== '')
+      ? [name, otherSpec, privileged]
+      : path === NPM_COMPARISON_PATH && otherSpec !== '(empty)' ? [otherName, otherSpec, canReadPrivateNpm(reader, otherName)] : null
+    const keptTogether = against ? readTogether(keptVersions, [{ name, version: spec }, { name: against[0], version: against[1] }]) : keptVersions
+    const otherAsked = against && readNpmVersion(against[0], against[1], against[2], controller.signal, keptTogether)
+    otherAsked?.catch(() => {})
+    const otherDoc = async () => found(await otherAsked!)
+    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptTogether))
     if (spec === 'latest') latest = Promise.resolve(doc)
     const repo = githubRepoOf(doc), sha = bundleCommitHash(doc.manifest['gitHead'])
     // What the viewer asks about a version beside its files, by its route,
@@ -3009,7 +4054,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // new and however few download it where a team lists its scope, its own
     // packages, as a new dependency on a package of such a scope is.
     if (path === NPM_RISK_PATH) {
-      const old = otherSpec === '' || otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const old = otherSpec === '' || otherSpec === '(empty)' ? null : await otherDoc()
       const scope = npmPackageScope(name)
       const teamScoped = scope !== null && await deps.db.hasTeamNpmScope(scope)
       const assessment = await npmRisk(doc, otherSpec === '' ? 'pick' : old, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug, teamScoped, fromEmpty: otherSpec === '(empty)',
@@ -3020,13 +4065,27 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       return
     }
     if (path === NPM_PROVENANCE_PATH) { await reply(doc.private, { name, version: doc.version, provenance: await provenanceOf() }); return }
+    // The lines it changes against `otherVersion`, or `(empty)`, its whole
+    // package's, and those but for declaration files changed in types alone
+    // (npm-delta.ts), as a list of versions wanting reviews tells them.
+    if (path === NPM_DELTA_PATH) {
+      const old = otherSpec === '(empty)' ? null : await otherDoc()
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      const side = (version: NpmVersionDocument) => ({ integrity: version.dist.integrity, files: async () => {
+        const load = loadNpmFiles(version)
+        try { return await load.result } finally { load.release() }
+      } })
+      const delta = await npmDelta(old ? side(old) : null, side(doc), npmDeltaStore<NpmDelta>(deps.db, deps.config.debug))
+      await reply(doc.private || old?.private === true, { name, version: doc.version, otherVersion: old?.version ?? null, ...delta })
+      return
+    }
     // Its files paired with those of `otherVersion` (of `otherName`, else the
     // same package), as Compare and Review pair them, with what their
     // Overview reads beside them (comparison.ts): the version shown against
     // the one compared with, or `(empty)`, none, as Review reads a first
     // version. Read of both, each package's access checked again once worked out.
     if (path === NPM_COMPARISON_PATH) {
-      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(otherName, otherSpec, canReadPrivateNpm(reader, otherName), controller.signal, keptVersions))
+      const old = otherSpec === '(empty)' ? null : await otherDoc()
       res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
       const loads = [doc, ...old ? [old] : []].map(loadNpmFiles)
       let body
@@ -3064,7 +4123,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // and those that changed in types alone (type-only.ts).
     if (path === NPM_PRETTY_PATH || path === NPM_TYPE_ONLY_PATH || (path === NPM_RENAME_DIFF_PATH && !diffed)) {
       if (!deps.prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-      const other = otherSpec === '' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const other = otherSpec === '' ? null : await otherDoc()
       const sides = other && await deps.prettyCache.npmSides(doc, other)
       const lines = path === NPM_RENAME_DIFF_PATH ? renamedPairs(sides!, !doc.private && !other!.private)
         : path === NPM_TYPE_ONLY_PATH ? typeOnlyFiles(sides!) : sides ? compared(sides) : await deps.prettyCache.npmAll(doc)
@@ -3082,7 +4141,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     if (diffed) {
       const { prettyCache } = deps
       if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-      const other = found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const other = await otherDoc()
       const diff = await renameDiffOf(diffed, async () => [await prettyText(await prettyCache.npm(doc, diffed.base)),
         await prettyText(await prettyCache.npm(other, diffed.other))], !doc.private && !other.private)
       if (!(await recheck(doc.private || other.private))) { diff.stream.destroy(); return }
@@ -3102,18 +4161,20 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // viewer's own request to meet. Its whole document, read for its
     // advisories' version list and the time each version was published
     // (npmPublishTime), is read only where registry reads leave room for
-    // readers'.
-    if (!download) {
+    // readers'; a public version's time is then kept in the database
+    // (npm-kept.ts), to come with the version on any instance.
+    const published = download ? undefined : npmPublishTime(doc, npmPublishTimeStore(deps.db, deps.config.debug))
+    if (published) {
       const quiet = (asked: Promise<unknown>) => { asked.catch(() => {}) }
       quiet(npmDownloads(name))
       quiet(latestDoc().then(newest => newest && githubFigures(newest)))
       quiet(readNpmVersions(name, privileged, controller.signal, { times: true, spare: true })
-        .then(versions => versions && npmAdvisories(name, versions.versions, advisoryOptions)))
+        .then(versions => versions && Promise.all([published.keep(), npmAdvisories(name, versions.versions, advisoryOptions)])))
       quiet(tagsOf())
       quiet(socketOf())
       quiet(provenanceOf())
     }
-    const load = download ? loadNpmTarball(doc) : loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha))
+    const load = published ? loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha), published.read) : loadNpmTarball(doc)
     res.once('close', load.release)
     const bytes = await load.result
     if (!(await recheck(doc.private))) return
@@ -3207,6 +4268,15 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path === CALLBACK_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       try {
+        if (isLinkOAuthCallback(config, url.searchParams, cookie)) {
+          if (viewing) { sendViewOnly(res); return }
+          const s = await readWorkspaceSession(res, deps, cookie)
+          if (!s) return
+          const result = await linkOAuthCallback(config, db, s.session, url.searchParams, cookie, { avatarStore })
+          if (result.linked != null) await activity(deps, s.user, 'access', `linked GitHub account @${result.linked}`)
+          res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
+          res.end(); return
+        }
         if (isIssueOAuthCallback(config, url.searchParams, cookie)) {
           if (viewing) { sendViewOnly(res); return }
           const s = await readWorkspaceSession(res, deps, cookie)
@@ -3234,6 +4304,17 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
       res.end(); return
     }
+    if (path === LINK_LOGIN_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const result = linkLoginRedirect(config, s.session)
+      res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
+      res.end(); return
+    }
+    if (path === PROFILE_PATH) { await handleProfile(req, res, deps, cookie); return }
+    const unlink = /^\/api\/auth\/profile\/accounts\/([a-f\d-]{36})$/iu.exec(path)
+    if (unlink) { await handleUnlinkAccount(req, res, deps, cookie, unlink[1]!); return }
     if (path === SESSION_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const { body, headers } = await currentSession(config, db, cookie)
@@ -3274,12 +4355,16 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path.startsWith('/api/admin/uploads/')) { await handleUploadPart(req, res, deps, cookie, path); return }
     // Cached avatar by user id, served same-origin (the page CSP forbids the
     // github CDN). The id in the path keys the browser cache per user, so a user
-    // switch never serves a stale avatar. Workspace access is required.
+    // switch never serves a stale avatar. Workspace access is required. A user's
+    // is that of the account chosen on their profile; `own` asks for the
+    // sign-in account's. A linked account's is served by its own id.
     if (path.startsWith(AVATAR_PREFIX)) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const s = await readSession(config, db, cookie, Date.now())
       if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-      await serveAvatar(res, avatarStore, path.slice(AVATAR_PREFIX.length))
+      const id = path.slice(AVATAR_PREFIX.length)
+      if (AGENT_AVATARS.has(id) && AGENT_AVATAR.test(id)) { await serveAgentAvatar(res, avatarStore, id); return }
+      await serveAvatar(res, avatarStore, id, url.searchParams.has('own') ? id : await db.getAvatarKey(id))
       return
     }
     // Admin: list users (admin-only).
@@ -3320,8 +4405,57 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       await handleRepositoryBrowser(res, deps, cookie, url.searchParams, path === REPO_REFS_PATH); return
     }
+    if (path === REPO_CODE_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryCode(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_HISTORY_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryHistory(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_CHANGES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryChanges(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_TREE_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryTree(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_ISSUES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryIssues(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_AGENTS_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryAgents(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_ITEM_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryItem(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_PULL_DEPENDENCIES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryPullDependencies(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_BRANCH_DEPENDENCIES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryBranchDependencies(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_LOCKFILES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryLockfiles(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_PULSE_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryPulse(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_PULSE_ITEMS_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryPulseItems(res, deps, cookie, url.searchParams); return
+    }
     if (path === ADMIN_REPOS_PATH) { await handleListRepositories(req, res, deps, cookie, repositoryDiscovery); return }
     if (path === SELECT_REPO_PATH) { await handleSelectRepository(req, res, deps, cookie); return }
+    if (path === REPO_DEPENDENCY_REVIEW_PATH) { await handleRepositoryDependencyReview(req, res, deps, cookie); return }
     if (path === ADD_PUBLIC_REPO_PATH) { await handleAddPublicRepository(req, res, deps, cookie); return }
     if (path === CONNECT_REPO_APP_PATH) { await handleConnectRepositoryApp(req, res, deps, cookie); return }
     // Reports: list / upload on the exact path, download / delete per-id on the
@@ -3512,8 +4646,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         sendJson(res, 400, { error: 'bad-review-context' }); return
       }
       const review = await deps.db.getLatestOwnDependencyReview(s.user.id, { ecosystem: 'npm', package: name, version, integrity })
-      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [])
-      if (visible) sendJson(res, 200, { review: visible[0] ?? null })
+      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [], s.user)
+      if (visible) sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, s.user.id, visible))[0] ?? null })
       return
     }
     if (path === '/api/npm/reviews/discard') {
@@ -3542,8 +4676,28 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         sendJson(res, 400, { error: 'bad-review-cursor' }); return
       }
       const page = await deps.db.listOwnDependencyReviews(s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
-      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
-      if (reviews) sendJson(res, 200, { ...page, reviews })
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
+      if (reviews) sendJson(res, 200, { ...page, reviews: await withFormatted(deps.reviewedDependencies ?? null, s.user.id, reviews) })
+      return
+    }
+    // Those published to a team, of one who reads them there, as its
+    // Dependencies tab lists them, fifty a page.
+    if (path === '/api/npm/reviews/team') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const id = url.searchParams.get('beforeId'), teamId = url.searchParams.get('teamId'), time = url.searchParams.get('beforeTime')
+      if (!teamId || teamId.length > 100) { sendJson(res, 400, { error: 'bad-team' }); return }
+      if ((time !== null || id !== null) && (time === null || !/^\d+$/u.test(time) || !Number.isSafeInteger(Number(time)) || !id || id.length > 100)) {
+        sendJson(res, 400, { error: 'bad-review-cursor' }); return
+      }
+      const page = await deps.db.listTeamDependencyReviews(teamId, s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
+      if (!page) { sendJson(res, 404, { error: 'no-team' }); return }
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
+      if (!reviews) return
+      // Its access asked again, as it may have been taken while npm was read.
+      if (!await deps.db.readsTeamDependencyReviews(teamId, s.user.id)) { sendJson(res, 404, { error: 'no-team' }); return }
+      sendJson(res, 200, { ...page, reviews })
       return
     }
     if (path === '/api/npm/reviews') {
@@ -3564,7 +4718,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // Feeds lease a connection per poll, never across streaming sleeps. This
     // also covers capability-authenticated feeds handled by public-workspace.
     const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '')
-    const serve = () => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res)
+    const serve = () => runRequestPresence(() => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res))
     const work = runViewing(viewToken(config, req.headers.cookie) != null, serve).catch((err) => {
       if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)