@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.46

package/server-managed/http.ts

@@ -51,9 +51,10 @@
 //        description's Markdown | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/pull-dependencies?repoId=&number= → the package versions a pull request's npm, pnpm and
 //        Yarn 1 lockfiles lock that they didn't at its merge base, an update's with those it was, by directory; with review=1, each's
-//        review, where its repository reviews dependencies | 400/401/403/404/409/429/502
+//        review, where its repository reviews dependencies; with numbers=1,2,3 (twenty at most) in place of number, those of each,
+//        { pulls }, one GitHub fails told { number, error } | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/branch-dependencies?repoId= → the versions the default branch's lockfiles lock that want review, where
-//        its review is in effect for the reader | 400/401/403/404/409/429/502
+//        its review is in effect for the reader, GitHub not asked where it reviews none | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/lockfiles?repoId= → the lockfiles of the default branch its dependency review reads, by their
 //        paths, for its settings to name | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/pulse?repoId=&weeks=1|4|13|52 → the default branch's commits and lines a week and a day over
@@ -134,7 +135,7 @@ import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmVersionStore, pullDependencyStore,
+import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmPublishTimeStore, npmVersionStore, pullDependencyStore,
   repositoryReadStore, reviewBaselineStore, riskLineStore, scanReadStore } from './npm-kept.ts'
 import { type NpmDelta, npmDelta } from './npm-delta.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
@@ -181,7 +182,7 @@ import { WORKFLOWS_DIR } from './repository-actions.ts'
 import { githubActionsSource } from './github-actions.ts'
 import { type RepositoryEntry, createRepositoryBrowser, repositoryTreeFiles, scopedDirectory } from './repository-browser.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, cacheAvatar, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
-import { clearCookie, endSession, readSession } from './session.ts'
+import { clearCookie, endSession, readSession, runRequestPresence } from './session.ts'
 import { VIEW_AS_PATH, VIEW_ONLY_ERROR, clearViewCookie, endViewSession, runViewing, startViewSession, viewToken } from './view-as.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
@@ -196,7 +197,7 @@ import { LINK_LOGIN_PATH, isLinkOAuthCallback, linkLoginRedirect, linkOAuthCallb
 import type { ProfileChoice } from './github-links.ts'
 import { withAppUsers } from './github-users.ts'
 import { isBlobId } from './object-storage.ts'
-import { attachmentDisposition, sendJson, sendLines, writeResponse } from './http-response.ts'
+import { attachmentDisposition, sendJson, sendLines, writeResponse, writeResponseParts } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
@@ -205,7 +206,8 @@ import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
-import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
+import { NpmPackageError, type NpmReader, type NpmVersionDocument, type NpmVersionStore, canReadPrivateNpm, npmFileRows, npmPublishTime, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions,
+  readTogether } from './npm-packages.ts'
 import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
 import { loadRepositoryCodeBody, repositoryCodeFits } from './repository-code.ts'
 import { type ChangesStore, type CommitChanges, type CommitTree, TREES_READ, changesAsked, changesWithin, directoryFiles, repositoryChanges } from './repository-changes.ts'
@@ -214,8 +216,8 @@ import { type AllHeads, type HistoryCommit, type HistoryPages, MAX_HISTORY_PAGE,
   repositoryAllHeads, repositoryAllHistory, repositoryHistory, repositoryRefTips, squashedPulls } from './repository-history.ts'
 import { AGENTS_READ_VERSION, APP_AGENTS, COMMITS_CURSOR, repositoryAgents } from './repository-agents.ts'
 import { ISSUES_CURSOR, ISSUES_READ_VERSION, repositoryIssues, repositoryItem } from './repository-issues.ts'
-import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependencies } from './pull-dependencies.ts'
-import { lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
+import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependenciesAt } from './pull-dependencies.ts'
+import { type GithubAsked, lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
 import { MAX_REQUIRED_REVIEWS, SINCE_COMMIT } from './repository-dependency-reviews.ts'
 import { EVERY_LOCKFILE, heldTo, scopeOf } from './lockfile-scope.ts'
 import { type ReviewBaselineStore, baselineFor, heldDependencies, reviewedDependencies, reviewedPackages } from './pull-dependency-reviews.ts'
@@ -335,7 +337,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
   if (!s) return
   const snapshot = await teamSnapshot(deps.db, s.session.id, teamId, reportId)
   const ids = [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)]
-  const manualUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const manualUrls = storedFixUrls(await deps.db.listTriageFixes(ids))
   const storedIssues = await deps.db.listManagedIssues(ids)
   const issues = visibleManagedIssues(storedIssues, snapshot)
   const visibleIds = new Set(issues.map(issue => issue.findingId))
@@ -346,7 +348,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
     : { fixes: await lookupFixes(deps.config, deps.db, snapshot, urls), updates: [] }
   // Cold report reads, token refresh and upstream batches can outlive changes
   // to security/links, team grants, publication, sessions or the Fix links.
-  const currentUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const currentUrls = storedFixUrls(await deps.db.listTriageFixes(ids))
   if (await readWorkspaceSession(res, deps, cookie) == null) return
   await recheckTeam(deps.db, s.session.id, snapshot)
   if (JSON.stringify(currentUrls) !== JSON.stringify(manualUrls)) {
@@ -385,9 +387,8 @@ function activity(deps: ManagedHttpDeps, user: StoredUser, kind: ActivityInput['
   return deps.db.recordActivity({ kind, actor: user.login, actorId: user.id, action, ...context }, Date.now())
 }
 
-async function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined): Promise<string | null> {
-  if (repoId == null) return null
-  return (await deps.db.listAllRepos()).find(repo => repo.repoId === repoId)?.fullName ?? null
+function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined): Promise<string | null> {
+  return repoId == null ? Promise.resolve(null) : deps.db.getRepoFullName(repoId)
 }
 
 // Workspace history is authorized BEFORE filtering, counting, or paging.
@@ -411,8 +412,14 @@ async function handleHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie:
   if (s.user.role !== 'admin') {
     const findings = new Map<string, ActivityContext>()
     const reports = kind === 'all' || kind === 'triage' ? await deps.db.listActivityReports(s.user.id) : []
+    // Every report's record in one read, as visibleFindingIds reads each one's.
+    const snapshot = reports.length > 0 ? await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), reports.map(report => report.reportId)) : { reports: [] }
+    if (snapshot == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+    const records = new Map(snapshot.reports.map(record => [record.id, record]))
     for (const report of reports) {
-      for (const finding of await visibleFindingIds(deps, s.user, report.reportId, s.session.id, null)) {
+      const record = records.get(report.reportId)
+      if (record == null) continue
+      for (const finding of await reportFindingIds(deps, record, record.repo.github)) {
         if (!findings.has(finding)) findings.set(finding, { finding, ...report })
       }
     }
@@ -436,6 +443,9 @@ export interface ManagedHttpDeps {
   originGate: OriginGate
   isShuttingDown: () => boolean
   track: (p: Promise<unknown>) => void
+  // Serverless (Vercel's): keeps the invocation alive for work that goes on
+  // past its answer, as a kept read read again behind it does.
+  waitUntil?: (p: Promise<unknown>) => void
   // Combined boot delegates unmatched paths to e2e and overrides discovery.
   serveStatic?: (req: IncomingMessage, res: ServerResponse) => boolean
   next?: Handler
@@ -1679,12 +1689,22 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
   }
   const access = await authorize()
   if (!access) return
+  let readingPulls: Promise<{ number: number; sha: string }[] | null> = Promise.resolve(null)
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
     const repo = access.repo.fullName
     const token = reader.readToken()
     // With a token, as GraphQL reads them.
     const pages = historyPages(deps, repoId, token !== null)
+    const quiet = <T>(fallback: T) => (err: unknown) => {
+      if (deps.config.debug) console.warn('managed: history pull requests read failed:', err)
+      return fallback
+    }
+    // Open pull heads do not depend on the commit history. Start them with
+    // it, handling failures immediately even if the history fails first.
+    if (token && path === '' && page === 1) {
+      readingPulls = keptAnswer(deps, `${repoId}\0openPulls`, () => openPullHeads(repo, token), undefined, fresh).then(answer => answer.value.pulls, quiet(null))
+    }
     let body: object
     if (all) {
       if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
@@ -1719,13 +1739,9 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
     // naming commits: with a token, as far as GitHub answers them, the
     // history sent all the same where it doesn't.
     const listed = (body as { commits: HistoryCommit[] }).commits
-    const quiet = <T>(fallback: T) => (err: unknown) => {
-      if (deps.config.debug) console.warn('managed: history pull requests read failed:', err)
-      return fallback
-    }
     const [pulls, openPulls] = token && path === '' ? await Promise.all([
       squashedPulls(repo, token, listed, historySquashes(deps, repoId)).catch(quiet<SquashedPull[]>([])),
-      page === 1 ? keptAnswer(deps, `${repoId}\0openPulls`, () => openPullHeads(repo, token), undefined, fresh).then(answer => answer.value.pulls, quiet(null)) : null,
+      readingPulls,
     ]) : [[], null]
     await reader.recheckAccess()
     const current = await authorize()
@@ -1740,6 +1756,10 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
   } catch (err) {
     if (err instanceof GithubApiError) { sendGithubError(res, err); return }
     throw err
+  } finally {
+    // A failed history must not release the request's database lease while
+    // its independent pull read is still writing to the cache.
+    await readingPulls
   }
 }
 
@@ -1840,9 +1860,9 @@ const refusedRead = (err: unknown) => err instanceof GithubApiError
 // What `read` answers of a repository, kept by `key` (its id first) for every
 // reader (repositoryReadStore), each one's access checked as they ask before
 // this: answered as kept for REPOSITORY_READ_FRESH_MS, then, while it is
-// kept, answered at once and read again behind it for the next to ask, where
-// the instance outlives its answer (not serverless, where it is read again
-// before it is answered); `kept` where it was, or where reading it again
+// kept, answered at once and read again behind it for the next to ask, the
+// read tracked (serverless, its invocation kept alive till it settles,
+// deps.waitUntil); `kept` where it was, or where reading it again
 // failed as `keepThrough` lets it. One asked for afresh (`fresh`) is read
 // now, unless it was read REPOSITORY_READ_FLOOR_MS since, what was kept
 // answered where that read fails. One GitHub refuses to read again is no
@@ -1877,10 +1897,12 @@ async function keptAnswer<T extends object>(deps: ManagedHttpDeps, key: string,
   }
   const age = held ? Date.now() - held.at : Infinity
   const now = fresh && age >= REPOSITORY_READ_FLOOR_MS
-  if (held && !now && (age < REPOSITORY_READ_FRESH_MS || !deps.config.serverless)) {
+  if (held && !now) {
     if (age >= REPOSITORY_READ_FRESH_MS && !repositoryRereads.has(key)) {
       // Its failure leaves the kept answer sent until it is a day old, so it is said.
-      deps.track(reread().catch((err: unknown) => { console.warn('managed: repository read failed:', err) }))
+      const behind = reread().catch((err: unknown) => { console.warn('managed: repository read failed:', err) })
+      deps.track(behind)
+      deps.waitUntil?.(behind)
     }
     return { value: held.value as T, kept: true, at: held.at }
   }
@@ -1902,14 +1924,16 @@ async function keptAnswer<T extends object>(deps: ManagedHttpDeps, key: string,
 function historyPages(deps: ManagedHttpDeps, repoId: number, graphql = false): HistoryPages {
   const store = historyPageStore<HistoryCommit[]>(deps.db, deps.config.debug)
   const keyOf = (top: string) => `${repoId}\0${COAUTHORS_READ}\0${top}`
+  const told = (tops: string[], kept: Map<string, { value: HistoryCommit[] }>) => new Map(tops.flatMap(top => {
+    const page = kept.get(keyOf(top))?.value
+    return Array.isArray(page) && page.every(commit => Array.isArray(commit.coauthors)) && (!graphql || page.every(commit => commit.additions != null))
+      ? [[top, page] as const] : []
+  }))
   return {
-    async read(tops) {
-      const kept = await store.readMany(tops.map(keyOf))
-      return new Map(tops.flatMap(top => {
-        const page = kept.get(keyOf(top))?.value
-        return Array.isArray(page) && page.every(commit => Array.isArray(commit.coauthors)) && (!graphql || page.every(commit => commit.additions != null))
-          ? [[top, page] as const] : []
-      }))
+    read: async tops => told(tops, await store.readMany(tops.map(keyOf))),
+    async readFirst(first, then) {
+      const kept = await store.readFirst(first.map(keyOf), then.map(keyOf))
+      return { first: kept.first, pages: told(kept.first ? first : then, kept.found) }
     },
     write: (top, commits) => store.write(keyOf(top), commits, Date.now()),
   }
@@ -1955,9 +1979,11 @@ async function readWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, c
 // What `answer` gives of the whole of repository `repoId` (with its name and
 // a token), as readWholeRepository reads it: sent at once where it was kept,
 // else once access is checked again, with the app's users it names
-// (github-users.ts), never kept with it.
+// (github-users.ts), never kept with it; or what `unread` tells of it, the
+// app's alone, once the app's access is checked, GitHub then never asked.
 async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
-  answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>): Promise<void> {
+  answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>,
+  unread: () => Promise<object | null> = () => Promise.resolve(null)): Promise<void> {
   const authorize = async () => {
     const access = await authorizeRepository(res, deps, cookie, repoId, '')
     if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
@@ -1965,6 +1991,8 @@ async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps,
   }
   const access = await authorize()
   if (!access) return
+  const told = await unread()
+  if (told) { sendJson(res, 200, await withAppUsers(deps.db, told)); return }
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
     const token = reader.readToken()
@@ -2033,72 +2061,108 @@ function itemNumber(query: URLSearchParams): number | null {
 // GET /api/admin/repositories/pull-dependencies: the package versions pull
 // request `number`'s lockfiles add (pull-dependencies.ts), what its base's and head's
 // commits tell kept by them (pullDependencyKept), its `number` with them.
-// They are the whole repository's (answerWholeRepository), kept by its number
-// as its popup's item is, its head moving with each push. With `review=1`,
+// They are the whole repository's (answerWholeRepository), the commits they
+// are of kept by its number as its popup's item is, its head moving with each
+// push, what they tell kept by them alone, not again. With `review=1`,
 // as an open one's are asked, where the repository reviews dependencies,
 // each version's review (pull-dependency-reviews.ts), read afresh as each
 // asks, reviews being published meanwhile; its baseline kept, where the host
 // registered no reviewed dependencies, which are asked in its place.
+// Up to MAX_ASKED_PULLS pull requests asked together (`numbers=1,2,3`) are
+// answered together, as many read at once as PULLS_AT_ONCE, `{ pulls }`,
+// each's answer, else `{ number, error }` where GitHub fails it, with one
+// check of its access before and one after, but where each was kept.
+const MAX_ASKED_PULLS = 20
+const PULLS_AT_ONCE = 3
 async function handleRepositoryPullDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const repoId = Number(query.get('repoId'))
-  const number = itemNumber(query)
   const review = query.get('review') === '1'
-  if (!Number.isSafeInteger(repoId) || repoId <= 0 || number === null || !['1', null].includes(query.get('review'))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const listed = query.get('numbers')
+  const numbers = listed === null ? [itemNumber(query)] : listed.split(',').map(text => itemNumber(new URLSearchParams({ number: text })))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || numbers.length > MAX_ASKED_PULLS || numbers.some(number => number === null) || new Set(numbers).size < numbers.length
+    || !['1', null].includes(query.get('review'))) { sendJson(res, 400, { error: 'bad-request' }); return }
   await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
-    const answered = await keptAnswer(deps, `${repoId}\0pull-dependencies\0${PULL_DEPENDENCIES_READ}\0${number}`,
-      async () => ({ number, ...await pullDependencies(fullName, token, number, pullDependencyKept(deps, repoId)) }))
-    // Where its review is on, those of lockfiles it leaves out told to none,
-    // whoever asks.
-    const setting = (await deps.db.listRepoDependencyReviews()).get(repoId)
-    const held = setting?.enabled ? heldDependencies(answered.value, setting.lockfiles) : answered.value
-    const now = review ? await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(held)) : null
-    // Its review by the lockfiles they were told by, though they have changed
-    // since; turned off meanwhile, all of them, as where it is off.
-    const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
-    const told = review && !now && setting?.enabled && !(await deps.db.listRepoDependencyReviews()).get(repoId)?.enabled ? answered.value : held
-    const reviewed = deps.reviewedDependencies ?? null
-    const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
-    // Its comments read for reviews, where the host reads them, while it is
-    // open (pull-comment-reviews.ts reads whether it is with them).
-    const parse = reviewed?.parseComments
-    const comments = state && parse ? commentReviews({ fullName, number, token, parse, reviewers: accounts => repoReviewers(deps, repoId, accounts) }) : null
-    // The comment the host formats of the reader's reviews of its versions, for its copy button.
-    const formatted = await formattedPull(reviewed, deps.db, user.id, told, state, { repository: fullName, number })
-    return { value: { number: told.number, ...await reviewedDependencies(told, state, { baseline, baselineUnread: unread, baselineError: error, reviewed, commentReviews: comments }),
-      ...formatted ? { formatted } : {} }, kept: answered.kept }
+    if (listed === null) return pullDependencyAnswer(deps, fullName, token, user, repoId, numbers[0]!, review)
+    const answers = await eachOf(numbers as number[], PULLS_AT_ONCE, number => pullDependencyAnswer(deps, fullName, token, user, repoId, number, review).catch((err: unknown) => {
+      // GitHub asked, though it failed: its access asked again after.
+      if (err instanceof GithubApiError) return { value: { number, error: err.message }, kept: false }
+      throw err
+    }))
+    return { value: { pulls: answers.map(({ value }) => value) }, kept: answers.every(({ kept }) => kept) }
   })
 }
 
+// Pull request `number`'s answer, as the endpoint gives it, and whether all
+// of it was kept, GitHub asked for none of it.
+async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, token: string, user: StoredUser, repoId: number, number: number, review: boolean) {
+  const kept = pullDependencyKept(deps, repoId)
+  const reading: { told?: PullDependencies } = {}
+  const answered = await keptAnswer(deps, `${repoId}\0pull-commits\0${PULL_DEPENDENCIES_READ}\0${number}`, async () => {
+    const { commits, told } = await pullDependenciesAt(fullName, token, number, kept)
+    reading.told = told
+    return { commits }
+  })
+  // What its commits tell, as read, else as kept by them, else, no longer
+  // kept, read again.
+  const held = reading.told ?? (typeof answered.value.commits === 'string' ? await kept.read(answered.value.commits) : null)
+  const pulled = { number, ...held ?? (await pullDependenciesAt(fullName, token, number, kept)).told }
+  // Where its review is on, those of lockfiles it leaves out told to none,
+  // whoever asks.
+  const setting = await deps.db.repoDependencyReview(repoId)
+  const scoped = setting?.enabled ? heldDependencies(pulled, setting.lockfiles) : pulled
+  const now = review ? await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(scoped)) : null
+  // Its review by the lockfiles they were told by, though they have changed
+  // since; turned off meanwhile, all of them, as where it is off.
+  const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
+  const told = review && !now && setting?.enabled && !(await deps.db.repoDependencyReview(repoId))?.enabled ? pulled : scoped
+  const reviewed = deps.reviewedDependencies ?? null
+  const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
+  // Its comments read for reviews, where the host reads them, while it is
+  // open (pull-comment-reviews.ts reads whether it is with them).
+  const parse = reviewed?.parseComments
+  const comments = state && parse ? commentReviews({ fullName, number, token, parse, reviewers: accounts => repoReviewers(deps, repoId, accounts) }) : null
+  // The comment the host formats of the reader's reviews of its versions, for its copy button.
+  const formatted = await formattedPull(reviewed, deps.db, user.id, told, state, { repository: fullName, number })
+  return { value: { number: told.number, ...await reviewedDependencies(told, state, { baseline, baselineUnread: unread, baselineError: error, reviewed, commentReviews: comments }),
+    ...formatted ? { formatted } : {} }, kept: answered.kept && held !== null }
+
+}
+
 // GET /api/admin/repositories/branch-dependencies: what the lockfiles of the
 // repository's default branch lock that wants review, where its review is in
-// effect for the reader (`review`, else none), as a team's Dependencies tab
-// shows it: its head, as its pulse reads it, kept a while; every lockfile
-// there its review holds to (lockfile-scope.ts, commit-lockfiles.ts) as one
-// directory, its versions as a pull request's others are
-// (pull-dependency-reviews.ts), each left unread a directory of its own
-// failing the review, as a pull request's are.
+// effect for the reader (`review`, else none, told without asking GitHub
+// where it reviews none), as a team's Dependencies tab shows it: its head, as
+// its pulse reads it, kept a while; every lockfile there its review holds to
+// (lockfile-scope.ts, commit-lockfiles.ts) as one directory, its versions as
+// a pull request's others are (pull-dependency-reviews.ts), each left unread
+// a directory of its own failing the review, as a pull request's are. Kept,
+// its access not asked again, where its head was kept and its lockfiles and
+// baseline held, GitHub asked for none of them.
 async function handleRepositoryBranchDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const repoId = Number(query.get('repoId'))
   if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
   await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
-    const head = (await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))).value.sha
+    const headRead = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
+    const head = headRead.value.sha
     if (!head) return { value: { head: null, review: null }, kept: false }
+    const asked: GithubAsked = { github: !headRead.kept }
     // Those its review holds to alone read, as many as are read of them.
-    const setting = (await deps.db.listRepoDependencyReviews()).get(repoId)
+    const setting = await deps.db.repoDependencyReview(repoId)
     if (!setting?.enabled) return { value: { head, review: null }, kept: false }
-    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path))
+    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path), asked)
     const { packages, paths } = lockedIn(read)
     const told = { base: head, head, cut: false, lockfiles: [{ paths, added: [], more: 0, locked: packages.slice(0, MAX_LOCKED), moreLocked: Math.max(0, packages.length - MAX_LOCKED) },
       ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' }))] }
     const now = await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(told))
-    if (!now) return { value: { head, review: null }, kept: false }
+    if (!now) return { value: { head, review: null }, kept: !asked.github }
     // Told by the lockfiles it held to as they were read, though they have
     // changed since.
     const state = { ...now, lockfiles: setting.lockfiles }
     const reviewed = deps.reviewedDependencies ?? null
-    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null } : await baselineFor(fullName, token, repoId, state, baselineKept(deps))
-    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: false }
-  })
+    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null }
+      : await baselineFor(fullName, token, repoId, state, baselineKept(deps), asked)
+    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: !asked.github }
+  }, async () => (await deps.db.repoDependencyReview(repoId))?.enabled ? null : { review: null })
 }
 
 // GET /api/admin/repositories/lockfiles: the lockfiles of the repository's
@@ -3205,7 +3269,7 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
   if (outputBytes > MAX_REPORT_QUERY_BYTES) { sendJson(res, 413, { error: 'batch-too-large' }); return }
   parts.push(suffix)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
-  writeResponse(res, Buffer.concat(parts, outputBytes))
+  writeResponseParts(res, parts, outputBytes)
 }
 
 // The server selects the complete published workspace for classification.
@@ -3235,24 +3299,23 @@ async function visibleFindingIds(deps: ManagedHttpDeps, user: StoredUser, report
   }
   const rec = await deps.db.getReport(reportId)
   if (rec == null) return new Set()
-  const repo = { github: await repositoryName(deps, rec.repoId) }
-  const key = JSON.stringify([reportId, rec.sha256, rec.filename, repo])
+  return reportFindingIds(deps, rec, await repositoryName(deps, rec.repoId))
+}
+// A whole report's finding ids, kept by its content, name and repository,
+// the one read least recently dropped first.
+async function reportFindingIds(deps: ManagedHttpDeps, rec: { id: string; sha256: string; filename: string }, github: string | null): Promise<Set<string>> {
+  const key = JSON.stringify([rec.id, rec.sha256, rec.filename, { github }])
   let cache = visibleIdsCaches.get(deps)
   if (cache == null) { cache = new Map(); visibleIdsCaches.set(deps, cache) }
   const hit = cache.get(key)
-  if (hit != null) return hit
-  const ids = new Set<string>()
-  const bytes = await deps.reportStore.get(reportId)
-  if (bytes == null) return ids
-  const text = bytes.toString('utf8')
-  const { data } = readManagedReport(text, rec.filename)
-  if (data == null) return ids
-  const report = await loadManagedFindings(JSON.stringify(data), rec.filename)
-  if (report == null) return ids
-  for (const f of report.findings) {
-    const id = (f as { id?: unknown }).id
-    if (typeof id === 'string' && id !== '') ids.add(id)
-  }
+  if (hit != null) { cache.delete(key); cache.set(key, hit); return hit }
+  const bytes = await deps.reportStore.get(rec.id)
+  if (bytes == null) return new Set()
+  const { data } = readManagedReport(bytes.toString('utf8'), rec.filename)
+  if (data == null) return new Set()
+  // The ids the team workspace derives (teamFindingIds), from the one parse.
+  const ids = await reportIds(data)
+  ids.delete('')
   while (cache.size >= VISIBLE_IDS_CACHE_MAX) {
     const oldest = cache.keys().next().value
     if (oldest === undefined) break
@@ -3663,8 +3726,12 @@ async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse,
 // Null for none.
 async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined, names: readonly string[]): Promise<NpmReader | null> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (s == null || !roleAtLeast(s.user.role, 'view')) return null
-  return { role: s.user.role, scopes: new Set(npmScopesCount(s.user.role, names) ? await deps.db.listUserNpmScopes(s.user.id) : []), userId: s.user.id }
+  return s == null ? null : npmReaderOf(deps, s.user, names)
+}
+// The same of `user`, as a session the request read just now tells them.
+async function npmReaderOf(deps: ManagedHttpDeps, user: { id: string; role: NpmReader['role'] }, names: readonly string[]): Promise<NpmReader | null> {
+  if (!roleAtLeast(user.role, 'view')) return null
+  return { role: user.role, scopes: new Set(npmScopesCount(user.role, names) ? await deps.db.listUserNpmScopes(user.id) : []), userId: user.id }
 }
 
 // What a registry read found, or a 404 for the package (handleNpm's catch
@@ -3680,20 +3747,25 @@ function found<T>(value: T | null | undefined): T {
 const REVIEW_READS_AT_ONCE = 8
 
 // Lists must enforce the same target and base access as the review itself,
-// including permission changes while the registry requests are in flight.
-async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[]): Promise<T[] | null> {
+// including permission changes while the registry requests are in flight;
+// first as `session`, the one the request read just now, where given.
+async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[],
+  session?: { id: string; role: NpmReader['role'] }): Promise<T[] | null> {
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
   try {
-    const reader = await npmReader(deps, cookie, reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []]))
+    const names = reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []])
+    const reader = session ? await npmReaderOf(deps, session, names) : await npmReader(deps, cookie, names)
     if (!reader || reader.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
     // Public versions' documents as the viewer keeps them (npm-kept.ts), a
-    // day: a list asks npm for none it read within it. Each version once, as
-    // many at once as REVIEW_READS_AT_ONCE.
-    const kept = npmVersionStore(deps.db, deps.config.debug)
+    // day, all read of the database at once: a list asks npm for none it read
+    // within it. Each version once, as many at once as REVIEW_READS_AT_ONCE.
     const versionsOf = (review: T) => [[review.package, review.version], ...review.basePackage ? [[review.basePackage, review.baseVersion!]] : []] as [string, string][]
     const asked = new Map(reviews.flatMap(versionsOf).map(([name, version]) => [`${name}\0${version}`, [name, version] as const]))
+    const store = npmVersionStore(deps.db, deps.config.debug)
+    const held = await store.readMany?.([...asked.values()].map(([name, version]) => ({ name, version }))) ?? new Map()
+    const kept: NpmVersionStore = { read: (name, version) => Promise.resolve(held.get(`${name}@${version}`) ?? null), write: store.write }
     const read = await eachOf([...asked], REVIEW_READS_AT_ONCE, ([, [name, version]]) => readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
     const documents = new Map([...asked.keys()].map((key, at) => [key, read[at] ?? null]))
     const packages = reviews.map(review => versionsOf(review).map(([name, version]) => documents.get(`${name}\0${version}`) ?? null))
@@ -3809,7 +3881,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   try {
     const reader = await npmReader(deps, cookie, [context.package, ...context.basePackage ? [context.basePackage] : []])
     if (!reader || reader.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-    const kept = npmVersionStore(deps.db, deps.config.debug)
+    const kept = readTogether(npmVersionStore(deps.db, deps.config.debug), [{ name, version }, ...context.basePackage ? [{ name: context.basePackage, version: context.baseVersion! }] : []])
     const read = (pkg: string, spec: string) => readNpmVersion(pkg, spec, canReadPrivateNpm(reader, pkg), controller.signal, kept)
     const [doc, base] = await Promise.all([read(name, version), context.basePackage ? read(context.basePackage, context.baseVersion!) : null])
     if (!doc || (context.basePackage && !base)) { sendJson(res, 404, { error: 'package-not-found' }); return }
@@ -3844,7 +3916,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
     if (!change) {
       const allBases = params.get('allBases') === 'true'
       const rows = await deps.db.listDependencyReviews(context, current.userId, allBases)
-      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows) : rows
+      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows, { id: current.userId, role: current.role }) : rows
       if (reviews) sendJson(res, 200, { reviews: await withFormatted(deps.reviewedDependencies ?? null, current.userId, reviews), teams: await deps.db.listDependencyReviewTeams(current.userId) })
       return
     }
@@ -3949,7 +4021,17 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       await reply(doc.private, { name, downloads, github })
       return
     }
-    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptVersions))
+    // The version it is compared with, where its route names one, read
+    // beside it, the two read of those kept at once.
+    const against: [string, string, boolean] | null = (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)') || (path === NPM_DELTA_PATH && otherSpec !== '(empty)')
+      || ((path === NPM_TYPE_ONLY_PATH || path === NPM_RENAME_DIFF_PATH || (path === NPM_PRETTY_PATH && !params.has('path'))) && otherSpec !== '')
+      ? [name, otherSpec, privileged]
+      : path === NPM_COMPARISON_PATH && otherSpec !== '(empty)' ? [otherName, otherSpec, canReadPrivateNpm(reader, otherName)] : null
+    const keptTogether = against ? readTogether(keptVersions, [{ name, version: spec }, { name: against[0], version: against[1] }]) : keptVersions
+    const otherAsked = against && readNpmVersion(against[0], against[1], against[2], controller.signal, keptTogether)
+    otherAsked?.catch(() => {})
+    const otherDoc = async () => found(await otherAsked!)
+    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptTogether))
     if (spec === 'latest') latest = Promise.resolve(doc)
     const repo = githubRepoOf(doc), sha = bundleCommitHash(doc.manifest['gitHead'])
     // What the viewer asks about a version beside its files, by its route,
@@ -3972,7 +4054,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // new and however few download it where a team lists its scope, its own
     // packages, as a new dependency on a package of such a scope is.
     if (path === NPM_RISK_PATH) {
-      const old = otherSpec === '' || otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const old = otherSpec === '' || otherSpec === '(empty)' ? null : await otherDoc()
       const scope = npmPackageScope(name)
       const teamScoped = scope !== null && await deps.db.hasTeamNpmScope(scope)
       const assessment = await npmRisk(doc, otherSpec === '' ? 'pick' : old, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug, teamScoped, fromEmpty: otherSpec === '(empty)',
@@ -3987,7 +4069,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // package's, and those but for declaration files changed in types alone
     // (npm-delta.ts), as a list of versions wanting reviews tells them.
     if (path === NPM_DELTA_PATH) {
-      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const old = otherSpec === '(empty)' ? null : await otherDoc()
       res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
       const side = (version: NpmVersionDocument) => ({ integrity: version.dist.integrity, files: async () => {
         const load = loadNpmFiles(version)
@@ -4003,7 +4085,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // the one compared with, or `(empty)`, none, as Review reads a first
     // version. Read of both, each package's access checked again once worked out.
     if (path === NPM_COMPARISON_PATH) {
-      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(otherName, otherSpec, canReadPrivateNpm(reader, otherName), controller.signal, keptVersions))
+      const old = otherSpec === '(empty)' ? null : await otherDoc()
       res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
       const loads = [doc, ...old ? [old] : []].map(loadNpmFiles)
       let body
@@ -4041,7 +4123,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // and those that changed in types alone (type-only.ts).
     if (path === NPM_PRETTY_PATH || path === NPM_TYPE_ONLY_PATH || (path === NPM_RENAME_DIFF_PATH && !diffed)) {
       if (!deps.prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-      const other = otherSpec === '' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const other = otherSpec === '' ? null : await otherDoc()
       const sides = other && await deps.prettyCache.npmSides(doc, other)
       const lines = path === NPM_RENAME_DIFF_PATH ? renamedPairs(sides!, !doc.private && !other!.private)
         : path === NPM_TYPE_ONLY_PATH ? typeOnlyFiles(sides!) : sides ? compared(sides) : await deps.prettyCache.npmAll(doc)
@@ -4059,7 +4141,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     if (diffed) {
       const { prettyCache } = deps
       if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-      const other = found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const other = await otherDoc()
       const diff = await renameDiffOf(diffed, async () => [await prettyText(await prettyCache.npm(doc, diffed.base)),
         await prettyText(await prettyCache.npm(other, diffed.other))], !doc.private && !other.private)
       if (!(await recheck(doc.private || other.private))) { diff.stream.destroy(); return }
@@ -4079,18 +4161,20 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // viewer's own request to meet. Its whole document, read for its
     // advisories' version list and the time each version was published
     // (npmPublishTime), is read only where registry reads leave room for
-    // readers'.
-    if (!download) {
+    // readers'; a public version's time is then kept in the database
+    // (npm-kept.ts), to come with the version on any instance.
+    const published = download ? undefined : npmPublishTime(doc, npmPublishTimeStore(deps.db, deps.config.debug))
+    if (published) {
       const quiet = (asked: Promise<unknown>) => { asked.catch(() => {}) }
       quiet(npmDownloads(name))
       quiet(latestDoc().then(newest => newest && githubFigures(newest)))
       quiet(readNpmVersions(name, privileged, controller.signal, { times: true, spare: true })
-        .then(versions => versions && npmAdvisories(name, versions.versions, advisoryOptions)))
+        .then(versions => versions && Promise.all([published.keep(), npmAdvisories(name, versions.versions, advisoryOptions)])))
       quiet(tagsOf())
       quiet(socketOf())
       quiet(provenanceOf())
     }
-    const load = download ? loadNpmTarball(doc) : loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha))
+    const load = published ? loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha), published.read) : loadNpmTarball(doc)
     res.once('close', load.release)
     const bytes = await load.result
     if (!(await recheck(doc.private))) return
@@ -4562,7 +4646,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         sendJson(res, 400, { error: 'bad-review-context' }); return
       }
       const review = await deps.db.getLatestOwnDependencyReview(s.user.id, { ecosystem: 'npm', package: name, version, integrity })
-      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [])
+      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [], s.user)
       if (visible) sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, s.user.id, visible))[0] ?? null })
       return
     }
@@ -4592,7 +4676,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         sendJson(res, 400, { error: 'bad-review-cursor' }); return
       }
       const page = await deps.db.listOwnDependencyReviews(s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
-      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
       if (reviews) sendJson(res, 200, { ...page, reviews: await withFormatted(deps.reviewedDependencies ?? null, s.user.id, reviews) })
       return
     }
@@ -4609,7 +4693,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       }
       const page = await deps.db.listTeamDependencyReviews(teamId, s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
       if (!page) { sendJson(res, 404, { error: 'no-team' }); return }
-      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
       if (!reviews) return
       // Its access asked again, as it may have been taken while npm was read.
       if (!await deps.db.readsTeamDependencyReviews(teamId, s.user.id)) { sendJson(res, 404, { error: 'no-team' }); return }
@@ -4634,7 +4718,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // Feeds lease a connection per poll, never across streaming sleeps. This
     // also covers capability-authenticated feeds handled by public-workspace.
     const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '')
-    const serve = () => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res)
+    const serve = () => runRequestPresence(() => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res))
     const work = runViewing(viewToken(config, req.headers.cookie) != null, serve).catch((err) => {
       if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)