@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.47

package/server-managed/http.ts

@@ -51,9 +51,10 @@
 //        description's Markdown | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/pull-dependencies?repoId=&number= → the package versions a pull request's npm, pnpm and
 //        Yarn 1 lockfiles lock that they didn't at its merge base, an update's with those it was, by directory; with review=1, each's
-//        review, where its repository reviews dependencies | 400/401/403/404/409/429/502
+//        review, where its repository reviews dependencies; with numbers=1,2,3 (twenty at most) in place of number, those of each,
+//        { pulls }, one GitHub fails told { number, error } | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/branch-dependencies?repoId= → the versions the default branch's lockfiles lock that want review, where
-//        its review is in effect for the reader | 400/401/403/404/409/429/502
+//        its review is in effect for the reader, GitHub not asked where it reviews none | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/lockfiles?repoId= → the lockfiles of the default branch its dependency review reads, by their
 //        paths, for its settings to name | 400/401/403/404/409/429/502
 //   GET /api/admin/repositories/pulse?repoId=&weeks=1|4|13|52 → the default branch's commits and lines a week and a day over
@@ -134,7 +135,7 @@ import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmVersionStore, pullDependencyStore,
+import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmPublishTimeStore, npmVersionStore, ownKeptPrunes, pullDependencyStore,
   repositoryReadStore, reviewBaselineStore, riskLineStore, scanReadStore } from './npm-kept.ts'
 import { type NpmDelta, npmDelta } from './npm-delta.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
@@ -150,7 +151,7 @@ import { contentAccess } from './content-access.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { Buffer } from 'node:buffer'
 import { createHash, randomUUID } from 'node:crypto'
-import type { AvatarStore } from './avatar-store.ts'
+import type { AvatarStore, CachedAvatar } from './avatar-store.ts'
 import type { BlobStore, OpenedBlob } from './blob-store.ts'
 import { bundleFilePrefix, bundleIntegrity, bundleKind, bundleRepo, reportBundleHashes } from './bundle.ts'
 import { resolveRepositoryImportLocation } from './repository-aliases.ts'
@@ -180,8 +181,9 @@ import { RISK_KEPT_MS, SCAN_READ_KEPT_MS, type ScanProgress, repositoryRiskLines
 import { WORKFLOWS_DIR } from './repository-actions.ts'
 import { githubActionsSource } from './github-actions.ts'
 import { type RepositoryEntry, createRepositoryBrowser, repositoryTreeFiles, scopedDirectory } from './repository-browser.ts'
+import { type Lru, lru } from './lru.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, cacheAvatar, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
-import { clearCookie, endSession, readSession } from './session.ts'
+import { clearCookie, endSession, readSession, runRequestPresence } from './session.ts'
 import { VIEW_AS_PATH, VIEW_ONLY_ERROR, clearViewCookie, endViewSession, runViewing, startViewSession, viewToken } from './view-as.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
@@ -196,7 +198,7 @@ import { LINK_LOGIN_PATH, isLinkOAuthCallback, linkLoginRedirect, linkOAuthCallb
 import type { ProfileChoice } from './github-links.ts'
 import { withAppUsers } from './github-users.ts'
 import { isBlobId } from './object-storage.ts'
-import { attachmentDisposition, sendJson, sendLines, writeResponse } from './http-response.ts'
+import { attachmentDisposition, sendJson, sendLines, writeResponse, writeResponseParts } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
@@ -205,7 +207,8 @@ import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
-import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
+import { NpmPackageError, type NpmReader, type NpmVersionDocument, type NpmVersionStore, canReadPrivateNpm, npmFileRows, npmPublishTime, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions,
+  readTogether } from './npm-packages.ts'
 import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
 import { loadRepositoryCodeBody, repositoryCodeFits } from './repository-code.ts'
 import { type ChangesStore, type CommitChanges, type CommitTree, TREES_READ, changesAsked, changesWithin, directoryFiles, repositoryChanges } from './repository-changes.ts'
@@ -214,8 +217,8 @@ import { type AllHeads, type HistoryCommit, type HistoryPages, MAX_HISTORY_PAGE,
   repositoryAllHeads, repositoryAllHistory, repositoryHistory, repositoryRefTips, squashedPulls } from './repository-history.ts'
 import { AGENTS_READ_VERSION, APP_AGENTS, COMMITS_CURSOR, repositoryAgents } from './repository-agents.ts'
 import { ISSUES_CURSOR, ISSUES_READ_VERSION, repositoryIssues, repositoryItem } from './repository-issues.ts'
-import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependencies } from './pull-dependencies.ts'
-import { lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
+import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependenciesAt } from './pull-dependencies.ts'
+import { type GithubAsked, lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
 import { MAX_REQUIRED_REVIEWS, SINCE_COMMIT } from './repository-dependency-reviews.ts'
 import { EVERY_LOCKFILE, heldTo, scopeOf } from './lockfile-scope.ts'
 import { type ReviewBaselineStore, baselineFor, heldDependencies, reviewedDependencies, reviewedPackages } from './pull-dependency-reviews.ts'
@@ -335,7 +338,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
   if (!s) return
   const snapshot = await teamSnapshot(deps.db, s.session.id, teamId, reportId)
   const ids = [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)]
-  const manualUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const manualUrls = storedFixUrls(await deps.db.listTriageFixes(ids))
   const storedIssues = await deps.db.listManagedIssues(ids)
   const issues = visibleManagedIssues(storedIssues, snapshot)
   const visibleIds = new Set(issues.map(issue => issue.findingId))
@@ -346,7 +349,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
     : { fixes: await lookupFixes(deps.config, deps.db, snapshot, urls), updates: [] }
   // Cold report reads, token refresh and upstream batches can outlive changes
   // to security/links, team grants, publication, sessions or the Fix links.
-  const currentUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const currentUrls = storedFixUrls(await deps.db.listTriageFixes(ids))
   if (await readWorkspaceSession(res, deps, cookie) == null) return
   await recheckTeam(deps.db, s.session.id, snapshot)
   if (JSON.stringify(currentUrls) !== JSON.stringify(manualUrls)) {
@@ -385,9 +388,8 @@ function activity(deps: ManagedHttpDeps, user: StoredUser, kind: ActivityInput['
   return deps.db.recordActivity({ kind, actor: user.login, actorId: user.id, action, ...context }, Date.now())
 }
 
-async function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined): Promise<string | null> {
-  if (repoId == null) return null
-  return (await deps.db.listAllRepos()).find(repo => repo.repoId === repoId)?.fullName ?? null
+function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined): Promise<string | null> {
+  return repoId == null ? Promise.resolve(null) : deps.db.getRepoFullName(repoId)
 }
 
 // Workspace history is authorized BEFORE filtering, counting, or paging.
@@ -411,8 +413,14 @@ async function handleHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie:
   if (s.user.role !== 'admin') {
     const findings = new Map<string, ActivityContext>()
     const reports = kind === 'all' || kind === 'triage' ? await deps.db.listActivityReports(s.user.id) : []
+    // Every report's record in one read, as visibleFindingIds reads each one's.
+    const snapshot = reports.length > 0 ? await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), reports.map(report => report.reportId)) : { reports: [] }
+    if (snapshot == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+    const records = new Map(snapshot.reports.map(record => [record.id, record]))
     for (const report of reports) {
-      for (const finding of await visibleFindingIds(deps, s.user, report.reportId, s.session.id, null)) {
+      const record = records.get(report.reportId)
+      if (record == null) continue
+      for (const finding of await reportFindingIds(deps, record, record.repo.github)) {
         if (!findings.has(finding)) findings.set(finding, { finding, ...report })
       }
     }
@@ -436,6 +444,9 @@ export interface ManagedHttpDeps {
   originGate: OriginGate
   isShuttingDown: () => boolean
   track: (p: Promise<unknown>) => void
+  // Serverless (Vercel's): keeps the invocation alive for work that goes on
+  // past its answer, as a kept read read again behind it does.
+  waitUntil?: (p: Promise<unknown>) => void
   // Combined boot delegates unmatched paths to e2e and overrides discovery.
   serveStatic?: (req: IncomingMessage, res: ServerResponse) => boolean
   next?: Handler
@@ -458,14 +469,18 @@ function firstHeader(v: string | string[] | undefined): string | null {
 }
 
 // `key` is the image chosen for `id`; one not cached falls back to `id`'s own.
-async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id): Promise<void> {
-  const avatar = await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id))
+// A user's is never kept by the browser, as it changes with their profile.
+async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id, cacheControl = 'no-store'): Promise<void> {
+  sendAvatar(res, await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id)), cacheControl)
+}
+
+function sendAvatar(res: ServerResponse, avatar: CachedAvatar | null, cacheControl = 'no-store'): void {
   if (avatar == null) { sendJson(res, 404, { error: 'no-avatar' }); return }
   res.writeHead(200, {
     'content-type': avatar.contentType,
     'content-length': String(avatar.bytes.length),
     'x-content-type-options': 'nosniff',
-    'cache-control': 'no-store',
+    'cache-control': cacheControl,
   })
   res.end(avatar.bytes)
 }
@@ -479,15 +494,20 @@ async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: st
 const AGENT_AVATARS: ReadonlySet<string> = new Set([...APP_AGENTS, ...Object.values(GITHUB_AGENTS)]
   .flatMap(agent => 'avatar' in agent && agent.avatar ? [agent.avatar] : []))
 const AGENT_AVATAR = /^(app|user)-([1-9]\d{0,11})$/u
+// An agent's mark is a public GitHub image that never changes with anyone's
+// profile, drawn on every tile and comment by it: kept by the browser a day,
+// for it alone.
+const AGENT_AVATAR_CACHE = 'private, max-age=86400'
 
 async function serveAgentAvatar(res: ServerResponse, avatarStore: AvatarStore, avatar: string): Promise<void> {
   const [, kind, id] = AGENT_AVATAR.exec(avatar)!
   const key = `00000000-0000-0000-000${kind === 'app' ? 0 : 1}-${id!.padStart(12, '0')}`
-  if (await avatarStore.get(key) == null) {
-    await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
-      .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
-  }
-  await serveAvatar(res, avatarStore, key)
+  // Read once where it is kept; read again only past fetching it.
+  const kept = await avatarStore.get(key)
+  if (kept != null) { sendAvatar(res, kept, AGENT_AVATAR_CACHE); return }
+  await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
+    .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
+  await serveAvatar(res, avatarStore, key, key, AGENT_AVATAR_CACHE)
 }
 
 const MAX_JSON_BODY_BYTES = 4096
@@ -508,14 +528,17 @@ async function readBodyBytes(req: IncomingMessage, maxBytes: number): Promise<Bu
 }
 
 // A file upload's content, opening a body the browser sealed to this session
-// (common/managed/upload-seal.ts). Link reports are never sent in parts.
+// (common/managed/upload-seal.ts). Link reports are never sent in parts; the
+// parts of one sent in them are deleted behind its answer.
 async function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: ManagedSession, kind: UploadKind | 'links'): Promise<Buffer> {
   const maxBytes = kind === 'bundles' ? deps.config.maxBundleBytes : deps.config.maxReportBytes
   const sealed = req.headers[UPLOAD_SEAL_HEADER] !== undefined
   const limit = sealed ? maxSealedBytes(maxBytes) : maxBytes
   let bytes
   if (kind === 'links' || req.headers['x-upload-id'] == null) bytes = await readBodyBytes(req, limit)
-  else if (deps.uploadStore) bytes = await readUpload(deps.uploadStore, req, session.id, kind, limit)
+  else if (deps.uploadStore) {
+    bytes = await readUpload(deps.uploadStore, req, session.id, kind, limit, cleanup => { deps.track(cleanup); deps.waitUntil?.(cleanup) })
+  }
   else throw new Error('bad-upload')
   return sealed ? await openSessionUpload(session.uploadKey, bytes, maxBytes) : bytes
 }
@@ -630,7 +653,7 @@ async function handleViewAs(req: IncomingMessage, res: ServerResponse, deps: Man
   const userId = (body as { userId?: unknown } | null)?.userId
   if (typeof userId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
   if (userId === s.user.id) { sendJson(res, 400, { error: 'cannot-view-as-self' }); return }
-  const target = (await deps.db.listUsers()).find(user => user.id === userId)
+  const target = await deps.db.getUser(userId)
   if (!target) { sendJson(res, 404, { error: 'not-found' }); return }
   // The insert itself rechecks the admin session and role.
   const setCookie = await startViewSession(deps.config, deps.db, s.session, userId, Date.now())
@@ -713,7 +736,7 @@ async function handleSetRole(req: IncomingMessage, res: ServerResponse, deps: Ma
   const role = (body as { role?: unknown } | null)?.role
   if (typeof userId !== 'string' || !isRole(role)) { sendJson(res, 400, { error: 'bad-request' }); return }
   if (userId === s.user.id) { sendJson(res, 403, { error: 'cannot-change-own-role' }); return }
-  const target = (await deps.db.listUsers()).find(user => user.id === userId)
+  const target = await deps.db.getUser(userId)
   // A caller can hold the body open while their admin access is revoked.
   if (await readAdminSession(res, deps, cookie) == null) return
   const ok = await deps.db.setUserRole(userId, role)
@@ -1250,8 +1273,8 @@ async function handleListReports(res: ServerResponse, deps: ManagedHttpDeps, ses
 // declared integrity that has a stored bundle wins (bundleId set). When none is
 // stored yet, keep the first declared integrity so a later bundle upload of it
 // re-links (see linkReportsToBundle). Returns the (bundleId, integrity) to store.
-async function resolveReportBundle(deps: ManagedHttpDeps, user: StoredUser, bytes: Buffer): Promise<{ bundleId: string | null; integrity: string | null }> {
-  const hashes = reportBundleHashes(bytes)
+async function resolveReportBundle(deps: ManagedHttpDeps, user: StoredUser, json: unknown): Promise<{ bundleId: string | null; integrity: string | null }> {
+  const hashes = reportBundleHashes(json)
   for (const h of hashes) {
     const b = await deps.db.getBundleByIntegrity(h)
     if (b != null && await canAccessBundle(deps, user, b.id)) return { bundleId: b.id, integrity: h }
@@ -1361,7 +1384,8 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   if (existing) { await sendUploadedReport(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
-  const { bundleId, integrity } = await resolveReportBundle(deps, s.user, bytes)
+  // A JSON report's parse already in hand, not parsed again for its hashes.
+  const { bundleId, integrity } = await resolveReportBundle(deps, s.user, parsed.format === 'json' ? parsed.data : null)
   const dataKey = await deps.reportStore.put(id, bytes)
   let report: ReportRecord
   try {
@@ -1451,8 +1475,10 @@ async function repositoryBrowserUser(deps: ManagedHttpDeps, userId: string) {
 // user's repository access, for the next catalog to send.
 async function backfillCatalogCommits(deps: ManagedHttpDeps, userId: string, missing: readonly CatalogCommit[]): Promise<void> {
   let browser: ReturnType<typeof createRepositoryBrowser> | undefined
+  let repos: ReturnType<ManagedDb['listAllRepos']> | undefined
   await backfillBundleCommits(deps.db, userId, missing, async repoId => {
-    const repo = (await deps.db.listAllRepos()).find(item => item.repoId === repoId)
+    // Read once for the repositories the backfill reaches, not once each.
+    const repo = (await (repos ??= deps.db.listAllRepos())).find(item => item.repoId === repoId)
     if (!repo) return null
     browser ??= createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, userId))
     return browser.reader(repo)
@@ -1524,9 +1550,11 @@ function repositoryQuery(res: ServerResponse, query: URLSearchParams) {
 async function authorizeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number, path: string) {
   const s = await readWorkspaceSession(res, deps, cookie)
   if (!s) return null
-  const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
+  // bundleRepos's reads, the reader's scopes read once for both.
+  const access = await contentAccess(deps.db, s.user)
+  const repo = (await deps.db.listSelectedRepos()).filter(access.bundle).find(item => item.repoId === repoId)
   if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
-  const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
+  const scopes = access.scopes == null ? [null] : access.scopes.filter(scope => scope.repoId === repoId).map(scope => scope.path)
   return { repo, virtualEntries: scopedDirectory(path, scopes), user: s.user }
 }
 
@@ -1592,6 +1620,22 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
 // read, before any of it is sent. The load stays held until this response is
 // written or abandoned, and a reader who stops reading it gives it up after
 // a while.
+// What GitHub answered of a repository's trees for the code viewer, which a
+// commit or tree it names never changes: the tree at a directory of a commit
+// (getRepoTreeId reads the commit, then a listing a level down to it), and
+// how many files a tree holds under it and their bytes (repositoryTreeFiles),
+// by the repository's id, for the next to open it. Asked of them only once
+// the reader's own access has named the commit, as GitHub would have
+// answered them; by the database, as each instance has one.
+const REPOSITORY_TREES_KEPT = 4096
+type TreeFiles = Awaited<ReturnType<typeof repositoryTreeFiles>>
+const repositoryTrees = new WeakMap<ManagedDb, { ids: Lru<string>; files: Lru<TreeFiles> }>()
+function repositoryTreesOf(db: ManagedDb) {
+  let kept = repositoryTrees.get(db)
+  if (!kept) repositoryTrees.set(db, kept = { ids: lru(REPOSITORY_TREES_KEPT), files: lru(REPOSITORY_TREES_KEPT) })
+  return kept
+}
+
 async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const asked = repositoryQuery(res, query)
   if (!asked) return
@@ -1608,10 +1652,12 @@ async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps,
     const commit = await reader.commit(ref)
     const repo = access.repo.fullName
     const client = createClient({ token: reader.readToken() })
+    const treeKey = `${access.repo.repoId}\0${commit}\0${path}`, trees = repositoryTreesOf(deps.db)
     // A directory the commit has none at is none to read, as browsing it says.
-    const tree = await upstreamGithub(() => client.getRepoTreeId({ repo, sha: commit, ...(path ? { directory: path } : {}) }).catch((err: unknown) => {
+    const tree = trees.ids.get(treeKey) ?? await upstreamGithub(() => client.getRepoTreeId({ repo, sha: commit, ...(path ? { directory: path } : {}) }).catch((err: unknown) => {
       throw err instanceof Error && err.name === 'AssertionError' && err.message.includes(' has no directory at ') ? new GithubApiError(404, 'no-directory') : err
     }))
+    trees.ids.set(treeKey, tree)
     // Access still held, and the same repository, before anything read is sent.
     const fenced = async () => {
       await reader.recheckAccess()
@@ -1621,12 +1667,15 @@ async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps,
       return true
     }
     // Too large names the commit it was read at, for History to read.
-    if (!repositoryCodeFits(await repositoryTreeFiles(repo, reader.readToken(), tree))) {
+    const filesKey = `${access.repo.repoId}\0${tree}`
+    let listed = trees.files.get(filesKey)
+    if (listed === undefined) trees.files.set(filesKey, listed = await repositoryTreeFiles(repo, reader.readToken(), tree))
+    if (!repositoryCodeFits(listed)) {
       if (await fenced()) sendJson(res, 413, { error: 'directory-too-large', commit })
       return
     }
     if (res.destroyed) return
-    const load = loadRepositoryCodeBody({ repoId, repo, commit, path, tree }, () => upstreamGithub(() => client.getRepoTreeTarball({ repo, tree })))
+    const load = loadRepositoryCodeBody({ repoId, repo, commit, path, tree, listed }, () => upstreamGithub(() => client.getRepoTreeTarball({ repo, tree })))
     res.once('close', load.release)
     const bytes = await load.result
     if (!(await fenced()) || res.destroyed) return
@@ -1679,12 +1728,22 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
   }
   const access = await authorize()
   if (!access) return
+  let readingPulls: Promise<{ number: number; sha: string }[] | null> = Promise.resolve(null)
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
     const repo = access.repo.fullName
     const token = reader.readToken()
     // With a token, as GraphQL reads them.
     const pages = historyPages(deps, repoId, token !== null)
+    const quiet = <T>(fallback: T) => (err: unknown) => {
+      if (deps.config.debug) console.warn('managed: history pull requests read failed:', err)
+      return fallback
+    }
+    // Open pull heads do not depend on the commit history. Start them with
+    // it, handling failures immediately even if the history fails first.
+    if (token && path === '' && page === 1) {
+      readingPulls = keptAnswer(deps, `${repoId}\0openPulls`, () => openPullHeads(repo, token), undefined, fresh).then(answer => answer.value.pulls, quiet(null))
+    }
     let body: object
     if (all) {
       if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
@@ -1719,13 +1778,9 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
     // naming commits: with a token, as far as GitHub answers them, the
     // history sent all the same where it doesn't.
     const listed = (body as { commits: HistoryCommit[] }).commits
-    const quiet = <T>(fallback: T) => (err: unknown) => {
-      if (deps.config.debug) console.warn('managed: history pull requests read failed:', err)
-      return fallback
-    }
     const [pulls, openPulls] = token && path === '' ? await Promise.all([
       squashedPulls(repo, token, listed, historySquashes(deps, repoId)).catch(quiet<SquashedPull[]>([])),
-      page === 1 ? keptAnswer(deps, `${repoId}\0openPulls`, () => openPullHeads(repo, token), undefined, fresh).then(answer => answer.value.pulls, quiet(null)) : null,
+      readingPulls,
     ]) : [[], null]
     await reader.recheckAccess()
     const current = await authorize()
@@ -1740,6 +1795,10 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
   } catch (err) {
     if (err instanceof GithubApiError) { sendGithubError(res, err); return }
     throw err
+  } finally {
+    // A failed history must not release the request's database lease while
+    // its independent pull read is still writing to the cache.
+    await readingPulls
   }
 }
 
@@ -1840,9 +1899,9 @@ const refusedRead = (err: unknown) => err instanceof GithubApiError
 // What `read` answers of a repository, kept by `key` (its id first) for every
 // reader (repositoryReadStore), each one's access checked as they ask before
 // this: answered as kept for REPOSITORY_READ_FRESH_MS, then, while it is
-// kept, answered at once and read again behind it for the next to ask, where
-// the instance outlives its answer (not serverless, where it is read again
-// before it is answered); `kept` where it was, or where reading it again
+// kept, answered at once and read again behind it for the next to ask, the
+// read tracked (serverless, its invocation kept alive till it settles,
+// deps.waitUntil); `kept` where it was, or where reading it again
 // failed as `keepThrough` lets it. One asked for afresh (`fresh`) is read
 // now, unless it was read REPOSITORY_READ_FLOOR_MS since, what was kept
 // answered where that read fails. One GitHub refuses to read again is no
@@ -1877,10 +1936,12 @@ async function keptAnswer<T extends object>(deps: ManagedHttpDeps, key: string,
   }
   const age = held ? Date.now() - held.at : Infinity
   const now = fresh && age >= REPOSITORY_READ_FLOOR_MS
-  if (held && !now && (age < REPOSITORY_READ_FRESH_MS || !deps.config.serverless)) {
+  if (held && !now) {
     if (age >= REPOSITORY_READ_FRESH_MS && !repositoryRereads.has(key)) {
       // Its failure leaves the kept answer sent until it is a day old, so it is said.
-      deps.track(reread().catch((err: unknown) => { console.warn('managed: repository read failed:', err) }))
+      const behind = reread().catch((err: unknown) => { console.warn('managed: repository read failed:', err) })
+      deps.track(behind)
+      deps.waitUntil?.(behind)
     }
     return { value: held.value as T, kept: true, at: held.at }
   }
@@ -1902,14 +1963,16 @@ async function keptAnswer<T extends object>(deps: ManagedHttpDeps, key: string,
 function historyPages(deps: ManagedHttpDeps, repoId: number, graphql = false): HistoryPages {
   const store = historyPageStore<HistoryCommit[]>(deps.db, deps.config.debug)
   const keyOf = (top: string) => `${repoId}\0${COAUTHORS_READ}\0${top}`
+  const told = (tops: string[], kept: Map<string, { value: HistoryCommit[] }>) => new Map(tops.flatMap(top => {
+    const page = kept.get(keyOf(top))?.value
+    return Array.isArray(page) && page.every(commit => Array.isArray(commit.coauthors)) && (!graphql || page.every(commit => commit.additions != null))
+      ? [[top, page] as const] : []
+  }))
   return {
-    async read(tops) {
-      const kept = await store.readMany(tops.map(keyOf))
-      return new Map(tops.flatMap(top => {
-        const page = kept.get(keyOf(top))?.value
-        return Array.isArray(page) && page.every(commit => Array.isArray(commit.coauthors)) && (!graphql || page.every(commit => commit.additions != null))
-          ? [[top, page] as const] : []
-      }))
+    read: async tops => told(tops, await store.readMany(tops.map(keyOf))),
+    async readFirst(first, then) {
+      const kept = await store.readFirst(first.map(keyOf), then.map(keyOf))
+      return { first: kept.first, pages: told(kept.first ? first : then, kept.found) }
     },
     write: (top, commits) => store.write(keyOf(top), commits, Date.now()),
   }
@@ -1955,9 +2018,11 @@ async function readWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, c
 // What `answer` gives of the whole of repository `repoId` (with its name and
 // a token), as readWholeRepository reads it: sent at once where it was kept,
 // else once access is checked again, with the app's users it names
-// (github-users.ts), never kept with it.
+// (github-users.ts), never kept with it; or what `unread` tells of it, the
+// app's alone, once the app's access is checked, GitHub then never asked.
 async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
-  answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>): Promise<void> {
+  answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>,
+  unread: () => Promise<object | null> = () => Promise.resolve(null)): Promise<void> {
   const authorize = async () => {
     const access = await authorizeRepository(res, deps, cookie, repoId, '')
     if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
@@ -1965,6 +2030,8 @@ async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps,
   }
   const access = await authorize()
   if (!access) return
+  const told = await unread()
+  if (told) { sendJson(res, 200, await withAppUsers(deps.db, told)); return }
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
     const token = reader.readToken()
@@ -2033,72 +2100,108 @@ function itemNumber(query: URLSearchParams): number | null {
 // GET /api/admin/repositories/pull-dependencies: the package versions pull
 // request `number`'s lockfiles add (pull-dependencies.ts), what its base's and head's
 // commits tell kept by them (pullDependencyKept), its `number` with them.
-// They are the whole repository's (answerWholeRepository), kept by its number
-// as its popup's item is, its head moving with each push. With `review=1`,
+// They are the whole repository's (answerWholeRepository), the commits they
+// are of kept by its number as its popup's item is, its head moving with each
+// push, what they tell kept by them alone, not again. With `review=1`,
 // as an open one's are asked, where the repository reviews dependencies,
 // each version's review (pull-dependency-reviews.ts), read afresh as each
 // asks, reviews being published meanwhile; its baseline kept, where the host
 // registered no reviewed dependencies, which are asked in its place.
+// Up to MAX_ASKED_PULLS pull requests asked together (`numbers=1,2,3`) are
+// answered together, as many read at once as PULLS_AT_ONCE, `{ pulls }`,
+// each's answer, else `{ number, error }` where GitHub fails it, with one
+// check of its access before and one after, but where each was kept.
+const MAX_ASKED_PULLS = 20
+const PULLS_AT_ONCE = 3
 async function handleRepositoryPullDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const repoId = Number(query.get('repoId'))
-  const number = itemNumber(query)
   const review = query.get('review') === '1'
-  if (!Number.isSafeInteger(repoId) || repoId <= 0 || number === null || !['1', null].includes(query.get('review'))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const listed = query.get('numbers')
+  const numbers = listed === null ? [itemNumber(query)] : listed.split(',').map(text => itemNumber(new URLSearchParams({ number: text })))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || numbers.length > MAX_ASKED_PULLS || numbers.some(number => number === null) || new Set(numbers).size < numbers.length
+    || !['1', null].includes(query.get('review'))) { sendJson(res, 400, { error: 'bad-request' }); return }
   await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
-    const answered = await keptAnswer(deps, `${repoId}\0pull-dependencies\0${PULL_DEPENDENCIES_READ}\0${number}`,
-      async () => ({ number, ...await pullDependencies(fullName, token, number, pullDependencyKept(deps, repoId)) }))
-    // Where its review is on, those of lockfiles it leaves out told to none,
-    // whoever asks.
-    const setting = (await deps.db.listRepoDependencyReviews()).get(repoId)
-    const held = setting?.enabled ? heldDependencies(answered.value, setting.lockfiles) : answered.value
-    const now = review ? await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(held)) : null
-    // Its review by the lockfiles they were told by, though they have changed
-    // since; turned off meanwhile, all of them, as where it is off.
-    const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
-    const told = review && !now && setting?.enabled && !(await deps.db.listRepoDependencyReviews()).get(repoId)?.enabled ? answered.value : held
-    const reviewed = deps.reviewedDependencies ?? null
-    const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
-    // Its comments read for reviews, where the host reads them, while it is
-    // open (pull-comment-reviews.ts reads whether it is with them).
-    const parse = reviewed?.parseComments
-    const comments = state && parse ? commentReviews({ fullName, number, token, parse, reviewers: accounts => repoReviewers(deps, repoId, accounts) }) : null
-    // The comment the host formats of the reader's reviews of its versions, for its copy button.
-    const formatted = await formattedPull(reviewed, deps.db, user.id, told, state, { repository: fullName, number })
-    return { value: { number: told.number, ...await reviewedDependencies(told, state, { baseline, baselineUnread: unread, baselineError: error, reviewed, commentReviews: comments }),
-      ...formatted ? { formatted } : {} }, kept: answered.kept }
+    if (listed === null) return pullDependencyAnswer(deps, fullName, token, user, repoId, numbers[0]!, review)
+    const answers = await eachOf(numbers as number[], PULLS_AT_ONCE, number => pullDependencyAnswer(deps, fullName, token, user, repoId, number, review).catch((err: unknown) => {
+      // GitHub asked, though it failed: its access asked again after.
+      if (err instanceof GithubApiError) return { value: { number, error: err.message }, kept: false }
+      throw err
+    }))
+    return { value: { pulls: answers.map(({ value }) => value) }, kept: answers.every(({ kept }) => kept) }
   })
 }
 
+// Pull request `number`'s answer, as the endpoint gives it, and whether all
+// of it was kept, GitHub asked for none of it.
+async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, token: string, user: StoredUser, repoId: number, number: number, review: boolean) {
+  const kept = pullDependencyKept(deps, repoId)
+  const reading: { told?: PullDependencies } = {}
+  const answered = await keptAnswer(deps, `${repoId}\0pull-commits\0${PULL_DEPENDENCIES_READ}\0${number}`, async () => {
+    const { commits, told } = await pullDependenciesAt(fullName, token, number, kept)
+    reading.told = told
+    return { commits }
+  })
+  // What its commits tell, as read, else as kept by them, else, no longer
+  // kept, read again.
+  const held = reading.told ?? (typeof answered.value.commits === 'string' ? await kept.read(answered.value.commits) : null)
+  const pulled = { number, ...held ?? (await pullDependenciesAt(fullName, token, number, kept)).told }
+  // Where its review is on, those of lockfiles it leaves out told to none,
+  // whoever asks.
+  const setting = await deps.db.repoDependencyReview(repoId)
+  const scoped = setting?.enabled ? heldDependencies(pulled, setting.lockfiles) : pulled
+  const now = review ? await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(scoped)) : null
+  // Its review by the lockfiles they were told by, though they have changed
+  // since; turned off meanwhile, all of them, as where it is off.
+  const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
+  const told = review && !now && setting?.enabled && !(await deps.db.repoDependencyReview(repoId))?.enabled ? pulled : scoped
+  const reviewed = deps.reviewedDependencies ?? null
+  const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
+  // Its comments read for reviews, where the host reads them, while it is
+  // open (pull-comment-reviews.ts reads whether it is with them).
+  const parse = reviewed?.parseComments
+  const comments = state && parse ? commentReviews({ fullName, number, token, parse, reviewers: accounts => repoReviewers(deps, repoId, accounts) }) : null
+  // The comment the host formats of the reader's reviews of its versions, for its copy button.
+  const formatted = await formattedPull(reviewed, deps.db, user.id, told, state, { repository: fullName, number })
+  return { value: { number: told.number, ...await reviewedDependencies(told, state, { baseline, baselineUnread: unread, baselineError: error, reviewed, commentReviews: comments }),
+    ...formatted ? { formatted } : {} }, kept: answered.kept && held !== null }
+
+}
+
 // GET /api/admin/repositories/branch-dependencies: what the lockfiles of the
 // repository's default branch lock that wants review, where its review is in
-// effect for the reader (`review`, else none), as a team's Dependencies tab
-// shows it: its head, as its pulse reads it, kept a while; every lockfile
-// there its review holds to (lockfile-scope.ts, commit-lockfiles.ts) as one
-// directory, its versions as a pull request's others are
-// (pull-dependency-reviews.ts), each left unread a directory of its own
-// failing the review, as a pull request's are.
+// effect for the reader (`review`, else none, told without asking GitHub
+// where it reviews none), as a team's Dependencies tab shows it: its head, as
+// its pulse reads it, kept a while; every lockfile there its review holds to
+// (lockfile-scope.ts, commit-lockfiles.ts) as one directory, its versions as
+// a pull request's others are (pull-dependency-reviews.ts), each left unread
+// a directory of its own failing the review, as a pull request's are. Kept,
+// its access not asked again, where its head was kept and its lockfiles and
+// baseline held, GitHub asked for none of them.
 async function handleRepositoryBranchDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const repoId = Number(query.get('repoId'))
   if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
   await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
-    const head = (await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))).value.sha
+    const headRead = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
+    const head = headRead.value.sha
     if (!head) return { value: { head: null, review: null }, kept: false }
+    const asked: GithubAsked = { github: !headRead.kept }
     // Those its review holds to alone read, as many as are read of them.
-    const setting = (await deps.db.listRepoDependencyReviews()).get(repoId)
+    const setting = await deps.db.repoDependencyReview(repoId)
     if (!setting?.enabled) return { value: { head, review: null }, kept: false }
-    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path))
+    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path), asked)
     const { packages, paths } = lockedIn(read)
     const told = { base: head, head, cut: false, lockfiles: [{ paths, added: [], more: 0, locked: packages.slice(0, MAX_LOCKED), moreLocked: Math.max(0, packages.length - MAX_LOCKED) },
       ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' }))] }
     const now = await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(told))
-    if (!now) return { value: { head, review: null }, kept: false }
+    if (!now) return { value: { head, review: null }, kept: !asked.github }
     // Told by the lockfiles it held to as they were read, though they have
     // changed since.
     const state = { ...now, lockfiles: setting.lockfiles }
     const reviewed = deps.reviewedDependencies ?? null
-    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null } : await baselineFor(fullName, token, repoId, state, baselineKept(deps))
-    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: false }
-  })
+    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null }
+      : await baselineFor(fullName, token, repoId, state, baselineKept(deps), asked)
+    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: !asked.github }
+  }, async () => (await deps.db.repoDependencyReview(repoId))?.enabled ? null : { review: null })
 }
 
 // GET /api/admin/repositories/lockfiles: the lockfiles of the repository's
@@ -2699,9 +2802,8 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
         throw new BundleBuildError(409, 'repository-changed')
       }
       signal.throwIfAborted()
-      const bytes = Buffer.from(built.bytes)
-      await storeUploadedBundle(req, res, deps, cookie, current, bytes, input.repoId, built.directory, built.filename, 'build',
-        bundleIntegrity(bytes), input.conditions)
+      await storeUploadedBundle(req, res, deps, cookie, current, built.bytes, input.repoId, built.directory, built.filename, 'build',
+        bundleIntegrity(built.bytes), input.conditions)
     })
   } catch (error) {
     if (res.destroyed || controller.signal.aborted) return
@@ -2782,15 +2884,17 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     repo.repoId = null
     directory = ''
   }
-  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, 'upload', integrity)
+  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, 'upload', integrity, null, existing === null)
 }
 
+// `absent` where the caller has just found no bundle of `integrity`: not read
+// again, one inserted since meeting the insert's UNIQUE below as a race does.
 async function storeUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined,
   s: { session: ManagedSession; user: StoredUser }, bytes: Buffer, repoId: number | null, directory: string, filename: string,
-  provenance: BundleProvenance, integrity = bundleIntegrity(bytes), buildConditions: BundleBuildConditions | null = null): Promise<void> {
+  provenance: BundleProvenance, integrity = bundleIntegrity(bytes), buildConditions: BundleBuildConditions | null = null, absent = false): Promise<void> {
   const kind = bundleKind(filename)
   const reuse = { provenance, filename, kind, buildConditions }
-  const existing = await deps.db.getBundleByIntegrity(integrity)
+  const existing = absent ? null : await deps.db.getBundleByIntegrity(integrity)
   if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, reuse); return }
   const id = randomUUID()
   const dataKey = await deps.bundleStore.put(id, bytes, kind)
@@ -2920,12 +3024,11 @@ async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session
 // need a published report in their teams; ownership never overrides role none.
 async function canViewReport(deps: ManagedHttpDeps, user: StoredUser, reportId: string): Promise<boolean> {
   if (!roleAtLeast(user.role, 'view')) return false
-  const report = await deps.db.getReport(reportId)
+  const report = await deps.db.getReportView(user.id, reportId)
   if (report == null) return false
   if (user.role === 'admin') return true
-  if (user.role === 'manage') return report.uploadedBy === user.id || deps.db.userCanReadReport(user.id, reportId)
-  if (!report.visible) return false
-  return deps.db.userCanReadReport(user.id, reportId)
+  if (user.role === 'manage') return report.uploadedBy === user.id || report.readable
+  return report.visible && report.readable
 }
 
 // GET/HEAD /api/reports/:id/sources. Only the linked bundle's files cited by
@@ -3205,7 +3308,7 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
   if (outputBytes > MAX_REPORT_QUERY_BYTES) { sendJson(res, 413, { error: 'batch-too-large' }); return }
   parts.push(suffix)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
-  writeResponse(res, Buffer.concat(parts, outputBytes))
+  writeResponseParts(res, parts, outputBytes)
 }
 
 // The server selects the complete published workspace for classification.
@@ -3235,24 +3338,23 @@ async function visibleFindingIds(deps: ManagedHttpDeps, user: StoredUser, report
   }
   const rec = await deps.db.getReport(reportId)
   if (rec == null) return new Set()
-  const repo = { github: await repositoryName(deps, rec.repoId) }
-  const key = JSON.stringify([reportId, rec.sha256, rec.filename, repo])
+  return reportFindingIds(deps, rec, await repositoryName(deps, rec.repoId))
+}
+// A whole report's finding ids, kept by its content, name and repository,
+// the one read least recently dropped first.
+async function reportFindingIds(deps: ManagedHttpDeps, rec: { id: string; sha256: string; filename: string }, github: string | null): Promise<Set<string>> {
+  const key = JSON.stringify([rec.id, rec.sha256, rec.filename, { github }])
   let cache = visibleIdsCaches.get(deps)
   if (cache == null) { cache = new Map(); visibleIdsCaches.set(deps, cache) }
   const hit = cache.get(key)
-  if (hit != null) return hit
-  const ids = new Set<string>()
-  const bytes = await deps.reportStore.get(reportId)
-  if (bytes == null) return ids
-  const text = bytes.toString('utf8')
-  const { data } = readManagedReport(text, rec.filename)
-  if (data == null) return ids
-  const report = await loadManagedFindings(JSON.stringify(data), rec.filename)
-  if (report == null) return ids
-  for (const f of report.findings) {
-    const id = (f as { id?: unknown }).id
-    if (typeof id === 'string' && id !== '') ids.add(id)
-  }
+  if (hit != null) { cache.delete(key); cache.set(key, hit); return hit }
+  const bytes = await deps.reportStore.get(rec.id)
+  if (bytes == null) return new Set()
+  const { data } = readManagedReport(bytes.toString('utf8'), rec.filename)
+  if (data == null) return new Set()
+  // The ids the team workspace derives (teamFindingIds), from the one parse.
+  const ids = await reportIds(data)
+  ids.delete('')
   while (cache.size >= VISIBLE_IDS_CACHE_MAX) {
     const oldest = cache.keys().next().value
     if (oldest === undefined) break
@@ -3663,8 +3765,12 @@ async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse,
 // Null for none.
 async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined, names: readonly string[]): Promise<NpmReader | null> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (s == null || !roleAtLeast(s.user.role, 'view')) return null
-  return { role: s.user.role, scopes: new Set(npmScopesCount(s.user.role, names) ? await deps.db.listUserNpmScopes(s.user.id) : []), userId: s.user.id }
+  return s == null ? null : npmReaderOf(deps, s.user, names)
+}
+// The same of `user`, as a session the request read just now tells them.
+async function npmReaderOf(deps: ManagedHttpDeps, user: { id: string; role: NpmReader['role'] }, names: readonly string[]): Promise<NpmReader | null> {
+  if (!roleAtLeast(user.role, 'view')) return null
+  return { role: user.role, scopes: new Set(npmScopesCount(user.role, names) ? await deps.db.listUserNpmScopes(user.id) : []), userId: user.id }
 }
 
 // What a registry read found, or a 404 for the package (handleNpm's catch
@@ -3680,20 +3786,25 @@ function found<T>(value: T | null | undefined): T {
 const REVIEW_READS_AT_ONCE = 8
 
 // Lists must enforce the same target and base access as the review itself,
-// including permission changes while the registry requests are in flight.
-async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[]): Promise<T[] | null> {
+// including permission changes while the registry requests are in flight;
+// first as `session`, the one the request read just now, where given.
+async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[],
+  session?: { id: string; role: NpmReader['role'] }): Promise<T[] | null> {
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
   try {
-    const reader = await npmReader(deps, cookie, reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []]))
+    const names = reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []])
+    const reader = session ? await npmReaderOf(deps, session, names) : await npmReader(deps, cookie, names)
     if (!reader || reader.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
     // Public versions' documents as the viewer keeps them (npm-kept.ts), a
-    // day: a list asks npm for none it read within it. Each version once, as
-    // many at once as REVIEW_READS_AT_ONCE.
-    const kept = npmVersionStore(deps.db, deps.config.debug)
+    // day, all read of the database at once: a list asks npm for none it read
+    // within it. Each version once, as many at once as REVIEW_READS_AT_ONCE.
     const versionsOf = (review: T) => [[review.package, review.version], ...review.basePackage ? [[review.basePackage, review.baseVersion!]] : []] as [string, string][]
     const asked = new Map(reviews.flatMap(versionsOf).map(([name, version]) => [`${name}\0${version}`, [name, version] as const]))
+    const store = npmVersionStore(deps.db, deps.config.debug)
+    const held = await store.readMany?.([...asked.values()].map(([name, version]) => ({ name, version }))) ?? new Map()
+    const kept: NpmVersionStore = { read: (name, version) => Promise.resolve(held.get(`${name}@${version}`) ?? null), write: store.write }
     const read = await eachOf([...asked], REVIEW_READS_AT_ONCE, ([, [name, version]]) => readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
     const documents = new Map([...asked.keys()].map((key, at) => [key, read[at] ?? null]))
     const packages = reviews.map(review => versionsOf(review).map(([name, version]) => documents.get(`${name}\0${version}`) ?? null))
@@ -3809,7 +3920,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   try {
     const reader = await npmReader(deps, cookie, [context.package, ...context.basePackage ? [context.basePackage] : []])
     if (!reader || reader.userId !== session.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-    const kept = npmVersionStore(deps.db, deps.config.debug)
+    const kept = readTogether(npmVersionStore(deps.db, deps.config.debug), [{ name, version }, ...context.basePackage ? [{ name: context.basePackage, version: context.baseVersion! }] : []])
     const read = (pkg: string, spec: string) => readNpmVersion(pkg, spec, canReadPrivateNpm(reader, pkg), controller.signal, kept)
     const [doc, base] = await Promise.all([read(name, version), context.basePackage ? read(context.basePackage, context.baseVersion!) : null])
     if (!doc || (context.basePackage && !base)) { sendJson(res, 404, { error: 'package-not-found' }); return }
@@ -3844,7 +3955,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
     if (!change) {
       const allBases = params.get('allBases') === 'true'
       const rows = await deps.db.listDependencyReviews(context, current.userId, allBases)
-      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows) : rows
+      const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows, { id: current.userId, role: current.role }) : rows
       if (reviews) sendJson(res, 200, { reviews: await withFormatted(deps.reviewedDependencies ?? null, current.userId, reviews), teams: await deps.db.listDependencyReviewTeams(current.userId) })
       return
     }
@@ -3949,7 +4060,17 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       await reply(doc.private, { name, downloads, github })
       return
     }
-    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptVersions))
+    // The version it is compared with, where its route names one, read
+    // beside it, the two read of those kept at once.
+    const against: [string, string, boolean] | null = (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)') || (path === NPM_DELTA_PATH && otherSpec !== '(empty)')
+      || ((path === NPM_TYPE_ONLY_PATH || path === NPM_RENAME_DIFF_PATH || (path === NPM_PRETTY_PATH && !params.has('path'))) && otherSpec !== '')
+      ? [name, otherSpec, privileged]
+      : path === NPM_COMPARISON_PATH && otherSpec !== '(empty)' ? [otherName, otherSpec, canReadPrivateNpm(reader, otherName)] : null
+    const keptTogether = against ? readTogether(keptVersions, [{ name, version: spec }, { name: against[0], version: against[1] }]) : keptVersions
+    const otherAsked = against && readNpmVersion(against[0], against[1], against[2], controller.signal, keptTogether)
+    otherAsked?.catch(() => {})
+    const otherDoc = async () => found(await otherAsked!)
+    const doc = found(await readNpmVersion(name, spec, privileged, controller.signal, keptTogether))
     if (spec === 'latest') latest = Promise.resolve(doc)
     const repo = githubRepoOf(doc), sha = bundleCommitHash(doc.manifest['gitHead'])
     // What the viewer asks about a version beside its files, by its route,
@@ -3972,7 +4093,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // new and however few download it where a team lists its scope, its own
     // packages, as a new dependency on a package of such a scope is.
     if (path === NPM_RISK_PATH) {
-      const old = otherSpec === '' || otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const old = otherSpec === '' || otherSpec === '(empty)' ? null : await otherDoc()
       const scope = npmPackageScope(name)
       const teamScoped = scope !== null && await deps.db.hasTeamNpmScope(scope)
       const assessment = await npmRisk(doc, otherSpec === '' ? 'pick' : old, { db: deps.db, npmCache: deps.npmCacheStorage, debug: deps.config.debug, teamScoped, fromEmpty: otherSpec === '(empty)',
@@ -3987,7 +4108,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // package's, and those but for declaration files changed in types alone
     // (npm-delta.ts), as a list of versions wanting reviews tells them.
     if (path === NPM_DELTA_PATH) {
-      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const old = otherSpec === '(empty)' ? null : await otherDoc()
       res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
       const side = (version: NpmVersionDocument) => ({ integrity: version.dist.integrity, files: async () => {
         const load = loadNpmFiles(version)
@@ -4003,7 +4124,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // the one compared with, or `(empty)`, none, as Review reads a first
     // version. Read of both, each package's access checked again once worked out.
     if (path === NPM_COMPARISON_PATH) {
-      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(otherName, otherSpec, canReadPrivateNpm(reader, otherName), controller.signal, keptVersions))
+      const old = otherSpec === '(empty)' ? null : await otherDoc()
       res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
       const loads = [doc, ...old ? [old] : []].map(loadNpmFiles)
       let body
@@ -4041,7 +4162,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // and those that changed in types alone (type-only.ts).
     if (path === NPM_PRETTY_PATH || path === NPM_TYPE_ONLY_PATH || (path === NPM_RENAME_DIFF_PATH && !diffed)) {
       if (!deps.prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-      const other = otherSpec === '' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const other = otherSpec === '' ? null : await otherDoc()
       const sides = other && await deps.prettyCache.npmSides(doc, other)
       const lines = path === NPM_RENAME_DIFF_PATH ? renamedPairs(sides!, !doc.private && !other!.private)
         : path === NPM_TYPE_ONLY_PATH ? typeOnlyFiles(sides!) : sides ? compared(sides) : await deps.prettyCache.npmAll(doc)
@@ -4059,7 +4180,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     if (diffed) {
       const { prettyCache } = deps
       if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-      const other = found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      const other = await otherDoc()
       const diff = await renameDiffOf(diffed, async () => [await prettyText(await prettyCache.npm(doc, diffed.base)),
         await prettyText(await prettyCache.npm(other, diffed.other))], !doc.private && !other.private)
       if (!(await recheck(doc.private || other.private))) { diff.stream.destroy(); return }
@@ -4079,18 +4200,20 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
     // viewer's own request to meet. Its whole document, read for its
     // advisories' version list and the time each version was published
     // (npmPublishTime), is read only where registry reads leave room for
-    // readers'.
-    if (!download) {
+    // readers'; a public version's time is then kept in the database
+    // (npm-kept.ts), to come with the version on any instance.
+    const published = download ? undefined : npmPublishTime(doc, npmPublishTimeStore(deps.db, deps.config.debug))
+    if (published) {
       const quiet = (asked: Promise<unknown>) => { asked.catch(() => {}) }
       quiet(npmDownloads(name))
       quiet(latestDoc().then(newest => newest && githubFigures(newest)))
       quiet(readNpmVersions(name, privileged, controller.signal, { times: true, spare: true })
-        .then(versions => versions && npmAdvisories(name, versions.versions, advisoryOptions)))
+        .then(versions => versions && Promise.all([published.keep(), npmAdvisories(name, versions.versions, advisoryOptions)])))
       quiet(tagsOf())
       quiet(socketOf())
       quiet(provenanceOf())
     }
-    const load = download ? loadNpmTarball(doc) : loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha))
+    const load = published ? loadNpmPackageBody(doc, () => npmKnown(name, doc.version, doc.private, repo, sha), published.read) : loadNpmTarball(doc)
     res.once('close', load.release)
     const bytes = await load.result
     if (!(await recheck(doc.private))) return
@@ -4146,6 +4269,9 @@ async function handleWorkspaceShare(req: IncomingMessage, res: ServerResponse, d
 export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
   const { config, db, avatarStore, isShuttingDown, track } = deps
   const repositoryDiscovery = new RepositoryDiscovery(config)
+  // Kept reads' prunes run behind their writes: tracked, so the database
+  // outlives them, and on serverless kept alive past the answer.
+  ownKeptPrunes(db, prune => { track(prune); deps.waitUntil?.(prune) })
 
   async function route(req: IncomingMessage, res: ServerResponse): Promise<void> {
     const url = new URL(req.url ?? '/', 'http://localhost')
@@ -4562,7 +4688,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         sendJson(res, 400, { error: 'bad-review-context' }); return
       }
       const review = await deps.db.getLatestOwnDependencyReview(s.user.id, { ecosystem: 'npm', package: name, version, integrity })
-      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [])
+      const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [], s.user)
       if (visible) sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, s.user.id, visible))[0] ?? null })
       return
     }
@@ -4592,7 +4718,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
         sendJson(res, 400, { error: 'bad-review-cursor' }); return
       }
       const page = await deps.db.listOwnDependencyReviews(s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
-      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
       if (reviews) sendJson(res, 200, { ...page, reviews: await withFormatted(deps.reviewedDependencies ?? null, s.user.id, reviews) })
       return
     }
@@ -4609,7 +4735,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       }
       const page = await deps.db.listTeamDependencyReviews(teamId, s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
       if (!page) { sendJson(res, 404, { error: 'no-team' }); return }
-      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
       if (!reviews) return
       // Its access asked again, as it may have been taken while npm was read.
       if (!await deps.db.readsTeamDependencyReviews(teamId, s.user.id)) { sendJson(res, 404, { error: 'no-team' }); return }
@@ -4634,7 +4760,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // Feeds lease a connection per poll, never across streaming sleeps. This
     // also covers capability-authenticated feeds handled by public-workspace.
     const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '')
-    const serve = () => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res)
+    const serve = () => runRequestPresence(() => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res))
     const work = runViewing(viewToken(config, req.headers.cookie) != null, serve).catch((err) => {
       if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)