@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.46

package/server-managed/index.ts

@@ -22,7 +22,8 @@ import { setCacheDir } from '@preventive/upstream/npm.js'
 const REAP_INTERVAL_MS = 3_600_000
 const REAP_RETRY_MS = 60_000
 
-type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown' | 'reviewedDependencies'>>
+// `ui: false` serves only the API: `out/` is never read.
+type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown' | 'reviewedDependencies'>> & { ui?: boolean }
 
 export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
   // Audits keep upstream's records on disk where the config has a cache
@@ -41,7 +42,7 @@ export async function createManagedApp(config: ManagedConfig, options: ManagedAp
   return await initializeApp(rollback => assembleManagedApp(config, assembled, rollback, waitUntil))
 }
 
-async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
+async function assembleManagedApp(config: ManagedConfig, { ui = true, ...options }: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
   const storage = await openManagedStorage(config)
   const { db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, prettyCache, npmCacheStorage } = storage
   rollback.defer(() => db.close())
@@ -55,12 +56,12 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
     p.finally(() => inFlight.delete(p)).catch(() => {})
   }
 
-  const serveStatic = loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
+  const serveStatic = ui ? loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
     indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
-  })
+  }) : () => false
   const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, prettyCache, npmCacheStorage, originGate, serveStatic,
-    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}),
+    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}), ...(waitUntil ? { waitUntil } : {}),
     isShuttingDown, track,
   })
 
@@ -137,8 +138,8 @@ export function logManagedStartup(config: ManagedConfig, port: number, mode = 'm
   ].join('\n'))
 }
 
-export async function init(config = loadManagedConfig()): Promise<Server> {
-  const app = await createManagedApp(config)
+export async function init(config = loadManagedConfig(), options: Pick<ManagedAppOptions, 'ui'> = {}): Promise<Server> {
+  const app = await createManagedApp(config, options)
   const server = createServer(withReap(app.handleRequest, { managed: app.reap }, { isShuttingDown: app.isShuttingDown }))
   let disposal: Promise<void> | undefined
   function dispose(): Promise<void> {

package/server-managed/kept-briefly.ts

@@ -0,0 +1,37 @@
+// What was lately worked out, kept a little while in memory for whoever asks
+// for it next, by key: each for `keptMs` from when it was kept, the least
+// lately read going first past `maxEntries` of them or `maxBytes` between
+// them, and one that alone takes more than `maxBytes` not kept at all.
+// Whoever reads one is the caller's to check, as they would one worked out.
+export function keptBriefly<T>({ keptMs, maxBytes, maxEntries = Infinity }: { keptMs: number; maxBytes: number; maxEntries?: number }) {
+  const held = new Map<string, { value: T; bytes: number; timer: ReturnType<typeof setTimeout> }>()
+  let heldBytes = 0
+  const forget = (key: string) => {
+    const entry = held.get(key)
+    if (!entry) return
+    clearTimeout(entry.timer)
+    held.delete(key)
+    heldBytes -= entry.bytes
+  }
+  return {
+    get(key: string): T | undefined {
+      const entry = held.get(key)
+      if (!entry) return undefined
+      held.delete(key)
+      held.set(key, entry)
+      return entry.value
+    },
+    keep(key: string, value: T, bytes: number) {
+      if (bytes > maxBytes) return
+      forget(key)
+      for (const old of held.keys()) {
+        if (held.size < maxEntries && heldBytes + bytes <= maxBytes) break
+        forget(old)
+      }
+      const timer = setTimeout(() => { forget(key) }, keptMs)
+      timer.unref()
+      held.set(key, { value, bytes, timer })
+      heldBytes += bytes
+    },
+  }
+}

package/server-managed/npm-delta.ts

@@ -10,11 +10,12 @@
 // leaving those out; and whether a binary file, which they count none of,
 // was added, removed or changed (`binary`), one moved as it was not. Worked
 // out in a worker, off the event loop, as many at once per process as
-// MAX_ACTIVE, their files read only once their turn has come, those waiting
-// past MAX_WAITING refused, each waiting a minute at most and counting in a
-// minute at most; one asked again meanwhile sharing the first's; and kept by
-// both sides' integrities, in this instance and beyond it (`kept`), what a
-// version holds never changing. Access is the caller's to check.
+// MAX_ACTIVE, both sides' files read together only once their turn has come,
+// those waiting past MAX_WAITING refused, each waiting a minute at most and
+// counting in a minute at most; one asked again meanwhile sharing the
+// first's; and kept by both sides' integrities, in this instance and beyond
+// it (`kept`), what a version holds never changing. Access is the caller's
+// to check.
 import { Worker } from 'node:worker_threads'
 import { createHash } from 'node:crypto'
 import type { KeptStore } from './npm-kept.ts'
@@ -160,7 +161,11 @@ async function worked(key: string, base: Side | null, other: Side, kept: KeptSto
   await turn(Date.now() + DELTA_TIMEOUT_MS)
   let binary, told
   try {
-    const [olds, news] = [texts(base ? await base.files() : null), texts(await other.files())]
+    // Its turn held till both sides are read, or have failed.
+    const [baseRead, otherRead] = await Promise.allSettled([base ? base.files() : Promise.resolve(null), other.files()])
+    if (baseRead.status === 'rejected') throw baseRead.reason
+    if (otherRead.status === 'rejected') throw otherRead.reason
+    const [olds, news] = [texts(baseRead.value), texts(otherRead.value)]
     if (olds.length + news.length > MAX_TEXT_LENGTH) throw new NpmPackageError(413, 'package-too-large')
     binary = binaryChanged(olds.binaries, news.binaries)
     told = await counted(olds.read, news.read, Date.now() + DELTA_TIMEOUT_MS)

package/server-managed/npm-kept.ts

@@ -4,7 +4,8 @@
 // instance: public versions' documents, of the fields read of them
 // (npm-manifest.ts npmVersionFields), for a day (readNpmVersion asks npm again
 // then, as a version can be deprecated, its package made private, or itself
-// removed); and, for scans, each package's risk line, for as long as a scan
+// removed), and when each was published, for a month (npmPublishTimeStore);
+// and, for scans, each package's risk line, for as long as a scan
 // keeps it, and what a scan read of GitHub, for a day, and of npm's
 // advisories, for an hour (repository-risk.ts); and what the code viewer read
 // of a repository's GitHub, its issues, pull requests and agents' work, for a
@@ -18,7 +19,7 @@
 // nothing.
 import { createHash } from 'node:crypto'
 import { plainObject } from './npm-manifest.ts'
-import { type NpmVersionStore, VERSION_KEPT_MS } from './npm-packages.ts'
+import { type NpmPublishTimeStore, type NpmVersionStore, VERSION_KEPT_MS } from './npm-packages.ts'
 import type { UpstreamCacheStore } from './upstream-cache.ts'
 
 // A value kept by key, as JSON, `at` when it was.
@@ -26,6 +27,9 @@ export interface KeptStore<T> {
   read(key: string): Promise<{ at: number; value: T } | null>
   // Those of `keys` kept, by key, in one read of the database.
   readMany(keys: string[]): Promise<Map<string, { at: number; value: T }>>
+  // Those of `first` kept; where none is, those of `then`, in one read of the
+  // database (`first` whether they are `first`'s).
+  readFirst(first: string[], then: string[]): Promise<{ first: boolean; found: Map<string, { at: number; value: T }> }>
   write(key: string, value: T, at: number): Promise<void>
   // Removes what is kept by `key`.
   remove(key: string): Promise<void>
@@ -66,6 +70,13 @@ function keptStore<T>(db: UpstreamCacheStore, type: string, keptMs: number, debu
         return new Map(keys.flatMap(key => { const kept = valueOf(rows.get(keyOf(key))); return kept ? [[key, kept] as const] : [] }))
       } catch (error) { warn('read', error); return new Map() }
     },
+    async readFirst(first, then) {
+      try {
+        const { first: answered, entries } = await db.getFirstUpstreamCacheEntries(first.map(keyOf), then.map(keyOf))
+        const asked = answered ? first : then
+        return { first: answered, found: new Map(asked.flatMap(key => { const kept = valueOf(entries.get(keyOf(key))); return kept ? [[key, kept] as const] : [] })) }
+      } catch (error) { warn('read', error); return { first: false, found: new Map() } }
+    },
     async write(key, value, at) {
       try { await db.setUpstreamCacheEntry(keyOf(key), JSON.stringify({ at, value }), at) } catch (error) { warn('write', error) }
       await prune(at)
@@ -83,10 +94,29 @@ export function npmVersionStore(db: UpstreamCacheStore, debug = false): NpmVersi
       const hit = await kept.read(`${name}@${version}`)
       return hit && plainObject(hit.value) ? { at: hit.at, json: hit.value } : null
     },
+    async readMany(versions) {
+      const hits = await kept.readMany(versions.map(({ name, version }) => `${name}@${version}`))
+      return new Map([...hits].flatMap(([key, hit]) => plainObject(hit.value) ? [[key, { at: hit.at, json: hit.value }] as const] : []))
+    },
     write: (name, version, json) => kept.write(`${name}@${version}`, json, Date.now()),
   }
 }
 
+// When public versions were published (npm-packages.ts npmPublishTime), which
+// never changes once they are: kept a month, and kept again by the next view
+// of the version past it.
+const PUBLISH_TIME_KEPT_MS = 30 * 24 * 60 * 60_000
+export function npmPublishTimeStore(db: UpstreamCacheStore, debug = false): NpmPublishTimeStore {
+  const kept = keptStore<string>(db, 'npm/publish-times', PUBLISH_TIME_KEPT_MS, debug)
+  return {
+    async read(name, version) {
+      const hit = await kept.read(`${name}@${version}`)
+      return typeof hit?.value === 'string' ? hit.value : null
+    },
+    write: (name, version, at) => kept.write(`${name}@${version}`, at, Date.now()),
+  }
+}
+
 // Risk lines, each kept `keptMs`, for good where Infinity, a scan telling one
 // past RISK_KEPT_MS as stale (repository-risk.ts).
 export const riskLineStore = <T>(db: UpstreamCacheStore, keptMs: number, debug = false): KeptStore<T> => keptStore<T>(db, 'repository-risk/lines', keptMs, debug)

package/server-managed/npm-loads.ts

@@ -1,12 +1,14 @@
 // Loading a published version for the npm package viewer (npm-packages.ts):
 // its tarball, kept on disk as bundle builds keep theirs, else read from the
-// registry, and the viewer's response built from it, each shared by the
-// readers asking for it meanwhile and held to a few at once per process.
+// registry, its files unpacked from it, and the viewer's response built from
+// them, each shared by the readers asking for it meanwhile and held to a few
+// versions at once per process; its files kept a little while after.
 import { Buffer } from 'node:buffer'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { CompressionError, decompress } from '@preventive/archive/compression.js'
 import { encodeBrotli } from './brotli.ts'
+import { keptBriefly } from './kept-briefly.ts'
 import { MAX_NPM_PACKAGE_BYTES, MAX_NPM_PACKAGE_FILES, NPM_REGISTRY, NpmPackageError, type NpmPackageFile, type NpmVersionDocument, askUpstream,
   npmFileRows, npmPublishTime, npmToken, readNpmTar } from './npm-packages.ts'
 import { keepFile, readKeptFile, upstreamCachePath } from './upstream-cache.ts'
@@ -16,20 +18,30 @@ import { keepFile, readKeptFile, upstreamCachePath } from './upstream-cache.ts'
 // arrives.
 export const MAX_TAR_BYTES = 96 * 1024 * 1024
 const TARBALL_TIMEOUT_MS = 120_000
-// Loads in flight per process; each can hold a tarball, its tar, its files
-// and their encoded JSON.
+// Loads in flight per process, those of one version (its tarball, its files,
+// its response) as one, as they read its tarball and unpack it once between
+// them; each can hold a tarball, its tar, its files and their encoded JSON.
 const MAX_ACTIVE_LOADS = 4
+// How long a public version's files are kept once unpacked, and what they
+// may take between them, the least lately read going first past it:
+// Compare's requests for a pair of versions, and the Code tab's, come one
+// after another, each loading the same files. A private version's are never
+// kept, as nothing else of it is past its readers.
+const UNPACKED_KEPT_MS = 60_000
+const MAX_UNPACKED_BYTES = 128 * 1024 * 1024
 
 // A load's result, shared by its readers, and a reader's release of it.
 export interface NpmLoad<T> { result: Promise<T>; release: () => void }
 
-interface Load { job: Promise<unknown>; readers: number; settled: boolean }
+interface Load { job: Promise<unknown>; readers: number; settled: boolean; slot: string }
 
 // Loads by what they read; readers asking for the same share one. A load
 // keeps its place among the active ones until its work is done and each
 // reader has released it, as a reader does once its response is written or
-// abandoned, so what responses still hold counts too.
+// abandoned, so what responses still hold counts too. Places by the slot
+// their loads share, with how many hold each.
 const loads = new Map<string, Load>()
+const slots = new Map<string, number>()
 
 const refused = <T>(status: number, code: string): NpmLoad<T> => {
   const result = Promise.reject(new NpmPackageError(status, code))
@@ -37,26 +49,30 @@ const refused = <T>(status: number, code: string): NpmLoad<T> => {
   return { result, release() {} }
 }
 
-function shared<T>(key: string, doc: NpmVersionDocument, work: () => Promise<T>): NpmLoad<T> {
+// What names a version's tarball, and so its files: its integrity and URL,
+// and whether it is read with the token.
+const tarballKey = (doc: NpmVersionDocument) => `${doc.dist.integrity} ${doc.dist.tarball} ${doc.private}`
+
+function shared<T>(what: string, doc: NpmVersionDocument, work: () => Promise<T>): NpmLoad<T> {
   const { unpackedSize, fileCount } = doc.dist
   if ((unpackedSize ?? 0) > MAX_NPM_PACKAGE_BYTES || (fileCount ?? 0) > MAX_NPM_PACKAGE_FILES) return refused(413, 'package-too-large')
-  return sharedLoad(key, work, 'npm-busy')
+  const slot = tarballKey(doc)
+  return sharedLoad(`${what} ${slot}`, work, 'npm-busy', slot)
 }
 
 // A load among the active ones, by `key`, refused as `busy` past them: a
 // repository directory's (repository-code.ts) as a package's, each holding
-// alike a tarball, its tar, its files and their encoded JSON.
-export function sharedLoad<T>(key: string, work: () => Promise<T>, busy: string): NpmLoad<T> {
+// alike a tarball, its tar, its files and their encoded JSON. Loads of one
+// `slot` take one place between them.
+export function sharedLoad<T>(key: string, work: () => Promise<T>, busy: string, slot = key): NpmLoad<T> {
   let load = loads.get(key)
   if (!load) {
-    if (loads.size >= MAX_ACTIVE_LOADS) return refused(429, busy)
-    const created: Load = { job: work(), readers: 0, settled: false }
-    const settle = () => {
-      created.settled = true
-      if (created.readers === 0 && loads.get(key) === created) loads.delete(key)
-    }
-    created.job.then(settle, settle)
+    if (!slots.has(slot) && slots.size >= MAX_ACTIVE_LOADS) return refused(429, busy)
+    const created: Load = { job: work(), readers: 0, settled: false, slot }
+    const finish = () => { settle(key, created) }
+    created.job.then(finish, finish)
     loads.set(key, created)
+    slots.set(slot, (slots.get(slot) ?? 0) + 1)
     load = created
   }
   const held = load
@@ -67,11 +83,27 @@ export function sharedLoad<T>(key: string, work: () => Promise<T>, busy: string)
     release() {
       if (released) return
       released = true
-      if (--held.readers === 0 && held.settled && loads.get(key) === held) loads.delete(key)
+      held.readers--
+      done(key, held)
     },
   }
 }
 
+function settle(key: string, load: Load) {
+  load.settled = true
+  done(key, load)
+}
+
+// A load gone from the active ones, and its place with it, once its work is
+// done and its readers have released it.
+function done(key: string, load: Load) {
+  if (load.readers !== 0 || !load.settled || loads.get(key) !== load) return
+  loads.delete(key)
+  const holding = slots.get(load.slot)! - 1
+  if (holding === 0) slots.delete(load.slot)
+  else slots.set(load.slot, holding)
+}
+
 // The sha512 an integrity names, in base64, or null where it names none.
 const sha512Of = (integrity: string) => /(?:^|\s)sha512-([\d+/A-Za-z]{86}==)(?=\s|$)/u.exec(integrity)?.[1] ?? null
 // Hashed off the event loop: a tarball runs to tens of MiB.
@@ -129,6 +161,44 @@ async function readTarball(doc: NpmVersionDocument): Promise<Uint8Array> {
   return bytes
 }
 
+// Tarballs being read, and versions' files being unpacked, by what names
+// them (tarballKey): readers asking for one meanwhile share it, its bytes
+// those each one's own document names.
+const reading = new Map<string, Promise<Uint8Array>>()
+const unpacking = new Map<string, Promise<Unpacked>>()
+
+function sharedRead<T>(pending: Map<string, Promise<T>>, key: string, read: () => Promise<T>): Promise<T> {
+  let job = pending.get(key)
+  if (!job) {
+    const started = read().finally(() => { if (pending.get(key) === started) pending.delete(key) })
+    pending.set(key, job = started)
+  }
+  return job
+}
+
+const sharedTarball = (doc: NpmVersionDocument) => sharedRead(reading, tarballKey(doc), () => readTarball(doc))
+
+// A version's files, and the size of the tarball they came in.
+interface Unpacked { files: NpmPackageFile[]; tarballSize: number }
+
+// Public versions' files lately unpacked, by tarballKey.
+const unpacked = keptBriefly<Unpacked>({ keptMs: UNPACKED_KEPT_MS, maxBytes: MAX_UNPACKED_BYTES })
+
+// The version's files, kept from a load of them a little while since, else
+// unpacked from its tarball (and kept, a public version's): bytes its
+// reader's own document names, as its tarball's are.
+function unpackedOf(doc: NpmVersionDocument): Promise<Unpacked> {
+  const key = tarballKey(doc)
+  const kept = unpacked.get(key)
+  if (kept) return Promise.resolve(kept)
+  return sharedRead(unpacking, key, async () => {
+    const tarball = await sharedTarball(doc)
+    const value = { files: await readTarballFiles(tarball), tarballSize: tarball.byteLength }
+    if (!doc.private) unpacked.keep(key, value, value.files.reduce((sum, file) => sum + file.path.length + file.bytes.byteLength, 0))
+    return value
+  })
+}
+
 // A gzipped tarball's files, its top directory left out, as npm extracts
 // a package's: a repository tree's as GitHub archives it, too, its symlinks
 // let climb as readNpmTar's `symlinksAbove` says.
@@ -144,31 +214,31 @@ export async function readTarballFiles(tarball: Uint8Array, options: { symlinksA
 
 // The version's tarball, for download.
 export function loadNpmTarball(doc: NpmVersionDocument): NpmLoad<Uint8Array> {
-  return shared(`tarball ${doc.dist.integrity} ${doc.dist.tarball}`, doc, () => readTarball(doc))
+  return shared('tarball', doc, () => sharedTarball(doc))
 }
 
 // The version's files, for one of them to be pretty-printed (pretty-print.ts).
 export function loadNpmFiles(doc: NpmVersionDocument): NpmLoad<NpmPackageFile[]> {
-  return shared(`files ${doc.dist.integrity} ${doc.dist.tarball}`, doc, async () => readTarballFiles(await readTarball(doc)))
+  return shared('files', doc, async () => (await unpackedOf(doc)).files)
 }
 
 // The version as the viewer reads it, as brotli-encoded JSON: `{ name,
 // version, private, integrity, tarballSize, published, manifest, files,
 // known }`, its files as npmFileRows gives them, and with them, as its files
-// are encoded, when it was published where that is kept (npmPublishTime,
-// else null) and what `known` gives: what is kept about its package
+// are encoded, when it was published where that is kept (`published`, asked
+// then, else null) and what `known` gives: what is kept about its package
 // (npm-insights.ts npmKnown), which the viewer need not then ask for. Encoding
 // is where a load holds the most, so it takes its place among the active
 // loads until its body is done, and readers asking meanwhile share that body,
-// the first one's manifest and `known` in it; nothing is kept once its readers
-// are done.
-export function loadNpmPackageBody(doc: NpmVersionDocument, known: () => object = () => ({})): NpmLoad<Buffer> {
-  return shared(`package ${doc.dist.integrity} ${doc.dist.tarball} ${doc.private}`, doc, async () => {
-    const tarball = await readTarball(doc)
-    const files = await readTarballFiles(tarball)
+// the first one's manifest, `published` and `known` in it; the body is not
+// kept once its readers are done, its files a little while (unpackedOf).
+export function loadNpmPackageBody(doc: NpmVersionDocument, known: () => object = () => ({}),
+  published: () => Promise<string | null> = npmPublishTime(doc).read): NpmLoad<Buffer> {
+  return shared('package', doc, async () => {
+    const { files, tarballSize } = await unpackedOf(doc)
     return encodeBrotli(Buffer.from(JSON.stringify({
-      name: doc.name, version: doc.version, private: doc.private, integrity: doc.dist.integrity, tarballSize: tarball.byteLength,
-      published: npmPublishTime(doc.name, doc.version), manifest: doc.manifest, files: npmFileRows(files), known: known(),
+      name: doc.name, version: doc.version, private: doc.private, integrity: doc.dist.integrity, tarballSize,
+      published: await published(), manifest: doc.manifest, files: npmFileRows(files), known: known(),
     })))
   })
 }

package/server-managed/npm-packages.ts

@@ -153,14 +153,60 @@ async function publicWholeDocument(name: string, url: string, { limit, signal }:
   return json
 }
 
+// Whole documents being asked of npm as anyone asks, by URL and limit:
+// readers asking for one meanwhile share it, as opening a version asks for
+// its package's for its versions, its advisories and its risk at once; each
+// gives up on it alone once its own signal aborts, and it is given up on once
+// they all have. None is asked with the token. Read alike by every reader,
+// none changing it.
+const wholeAsks = new Map<string, { asked: Promise<Record<string, unknown> | null>; controller: AbortController; readers: number }>()
+
+function sharedWholeDocument(name: string, url: string, { limit, signal }: { limit: number; signal: AbortSignal }): Promise<Record<string, unknown> | null> {
+  if (signal.aborted) return Promise.reject(signal.reason)
+  const key = `${url} ${limit}`
+  let ask = wholeAsks.get(key)
+  if (!ask) {
+    const controller = new AbortController()
+    const created = { asked: publicWholeDocument(name, url, { limit, signal: controller.signal }), controller, readers: 0 }
+    const settle = () => { if (wholeAsks.get(key) === created) wholeAsks.delete(key) }
+    created.asked.then(settle, settle)
+    wholeAsks.set(key, ask = created)
+  }
+  const held = ask
+  held.readers++
+  return new Promise((answer, fail) => {
+    let left = false
+    const leave = () => {
+      if (left) return false
+      left = true
+      held.readers--
+      signal.removeEventListener('abort', onAbort)
+      return true
+    }
+    const onAbort = () => {
+      if (!leave()) return
+      if (held.readers === 0) {
+        if (wholeAsks.get(key) === held) wholeAsks.delete(key)
+        held.controller.abort(signal.reason)
+      }
+      fail(signal.reason)
+    }
+    const answered = (json: Record<string, unknown> | null) => { if (leave()) answer(json) }
+    const failed = (err: unknown) => { if (leave()) fail(err) }
+    signal.addEventListener('abort', onAbort, { once: true })
+    held.asked.then(answered, failed)
+  })
+}
+
 // Asked anonymously first, unless its caller knows npm has none for anyone
 // (`anonymous` false): a reader without private access stops there. One
 // with it asks again with the token where npmTokenReads says so, and the
 // answer is private. A whole document (`whole`) anyone may read is kept
-// (publicWholeDocument).
+// (publicWholeDocument), and asked once for those asking at once
+// (sharedWholeDocument).
 async function readDocument(name: string, url: string, privileged: boolean,
   { whole = false, anonymous = true, ...options }: { accept: string; limit: number; signal: AbortSignal; whole?: boolean; anonymous?: boolean }) {
-  const open = anonymous ? whole ? await publicWholeDocument(name, url, options) : await registryDocument(url, { ...options, token: null }) : null
+  const open = anonymous ? whole ? await sharedWholeDocument(name, url, options) : await registryDocument(url, { ...options, token: null }) : null
   if (open) return { json: open, private: false }
   if (!npmTokenReads(name, privileged)) return null
   const json = await registryDocument(url, { ...options, token: npmToken() })
@@ -203,6 +249,8 @@ function versionDocument(name: string, json: Record<string, unknown>, isPrivate:
 // (npm-manifest.ts npmVersionFields), as the database keeps them (npm-kept.ts).
 export interface NpmVersionStore {
   read(name: string, version: string): Promise<{ at: number; json: Record<string, unknown> } | null>
+  // Those of `versions` kept, by `name@version`, in one read.
+  readMany?(versions: { name: string; version: string }[]): Promise<Map<string, { at: number; json: Record<string, unknown> }>>
   write(name: string, version: string, json: Record<string, unknown>): Promise<void>
 }
 
@@ -228,6 +276,20 @@ export function readNpmVersion(name: string, spec: string, privileged: boolean,
   })
 }
 
+// `store`, where it reads many at once, with the exact ones of `versions`
+// read from it in one read, for readNpmVersion to read each of those from as
+// it asks: a version and the one it is compared with, read together.
+export function readTogether(store: NpmVersionStore, versions: { name: string; version: string }[]): NpmVersionStore {
+  const exact = versions.filter(({ version }) => isExactVersion(version))
+  if (!store.readMany || exact.length < 2) return store
+  const keys = new Set(exact.map(({ name, version }) => `${name}@${version}`))
+  const kept = store.readMany(exact)
+  return { ...store, async read(name, version) {
+    const key = `${name}@${version}`
+    return keys.has(key) ? (await kept).get(key) ?? null : store.read(name, version)
+  } }
+}
+
 // The package's dist-tags and versions, newest published first, from its
 // abbreviated document; with `times`, from its whole one, which alone has
 // when each was published, `times` by version (ISO dates), and `created`,
@@ -277,7 +339,31 @@ const isPublishTime = (value: string | undefined) => typeof value === 'string' &
 const PUBLISH_TIMES = 100_000
 const publishTimes = new Map<string, string>()
 
-export const npmPublishTime = (name: string, version: string): string | null => publishTimes.get(`${name}@${version}`) ?? null
+// Where public versions' publish times are kept beyond the instance, as the
+// database keeps them (npm-kept.ts npmPublishTimeStore).
+export interface NpmPublishTimeStore {
+  read(name: string, version: string): Promise<string | null>
+  write(name: string, version: string, at: string): Promise<void>
+}
+
+// When `doc` was published: as noted here, else as `store` keeps a public
+// version's, so that another instance, or this one restarted, has it before
+// it reads the whole document again. The store is read once, at once, beside
+// whatever its caller reads meanwhile, a failure read as none; `read` looks
+// here again as it is asked, as the whole document read meanwhile may have
+// noted it by then, and `keep` keeps there the time noted here where it read
+// none.
+export function npmPublishTime(doc: Pick<NpmVersionDocument, 'name' | 'version' | 'private'>, store?: NpmPublishTimeStore) {
+  const noted = () => publishTimes.get(`${doc.name}@${doc.version}`) ?? null
+  const kept = store && !doc.private ? store.read(doc.name, doc.version).catch(() => null) : Promise.resolve(null)
+  return {
+    read: async (): Promise<string | null> => noted() ?? await kept ?? noted(),
+    async keep() {
+      const at = noted()
+      if (at !== null && store && !doc.private && await kept === null) await store.write(doc.name, doc.version, at)
+    },
+  }
+}
 
 export interface NpmPackageFile { path: string; bytes: Uint8Array }
 

package/server-managed/npm-risk.ts

@@ -35,6 +35,7 @@ import { buffer } from 'node:stream/consumers'
 import type { CacheStore } from '@preventive/upstream/npm.js'
 import { DEFAULT_MINIMUM_RELEASE_AGE, type NpmAssessment, assessNpm, npmReadyDownload, npmReadyDownloads } from '../risk/index.js'
 import { CacheMissError, type CacheStorage } from './cache-storage.ts'
+import { npmVersionStore } from './npm-kept.ts'
 import { loadNpmTarball } from './npm-loads.ts'
 import { NpmPackageError, type NpmVersionDocument, npmTokenReads, readNpmPackument, readNpmVersion } from './npm-packages.ts'
 import { npmPackageScope } from '../common/managed/npm-packages.js'
@@ -176,7 +177,9 @@ export function npmRisk(doc: NpmVersionDocument, old: NpmVersionDocument | 'pick
     return scopes.get(scope)!
   }
   const given = old === 'pick' ? null : old
-  const documentOf = async (version: string) => [doc, given].find(read => read?.version === version) ?? await readNpmVersion(doc.name, version, privileged, signal) ?? undefined
+  // The one picked, read as the viewer reads a version, kept a day where public.
+  const documentOf = async (version: string) => [doc, given].find(read => read?.version === version)
+    ?? await readNpmVersion(doc.name, version, privileged, signal, npmVersionStore(stores.db, stores.debug)) ?? undefined
   return bounded(spare, () => assessNpm(doc.name, doc.version, { oldVersion: old === 'pick' ? true : old?.version ?? null, fromEmpty,
     minimumReleaseAge: teamScoped ? 0 : DEFAULT_MINIMUM_RELEASE_AGE,
     popularity: !teamScoped, cache: npmRiskCache(stores, !doc.private && !given?.private), signal, dependencies: !spare, advisories: !spare, osv: !doc.private, owned,