@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.47

package/server-managed/index.ts

@@ -22,7 +22,8 @@ import { setCacheDir } from '@preventive/upstream/npm.js'
 const REAP_INTERVAL_MS = 3_600_000
 const REAP_RETRY_MS = 60_000
 
-type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown' | 'reviewedDependencies'>>
+// `ui: false` serves only the API: `out/` is never read.
+type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown' | 'reviewedDependencies'>> & { ui?: boolean }
 
 export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
   // Audits keep upstream's records on disk where the config has a cache
@@ -41,7 +42,7 @@ export async function createManagedApp(config: ManagedConfig, options: ManagedAp
   return await initializeApp(rollback => assembleManagedApp(config, assembled, rollback, waitUntil))
 }
 
-async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
+async function assembleManagedApp(config: ManagedConfig, { ui = true, ...options }: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
   const storage = await openManagedStorage(config)
   const { db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, prettyCache, npmCacheStorage } = storage
   rollback.defer(() => db.close())
@@ -55,12 +56,12 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
     p.finally(() => inFlight.delete(p)).catch(() => {})
   }
 
-  const serveStatic = loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
+  const serveStatic = ui ? loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
     indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
-  })
+  }) : () => false
   const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, prettyCache, npmCacheStorage, originGate, serveStatic,
-    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}),
+    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}), ...(waitUntil ? { waitUntil } : {}),
     isShuttingDown, track,
   })
 
@@ -137,8 +138,8 @@ export function logManagedStartup(config: ManagedConfig, port: number, mode = 'm
   ].join('\n'))
 }
 
-export async function init(config = loadManagedConfig()): Promise<Server> {
-  const app = await createManagedApp(config)
+export async function init(config = loadManagedConfig(), options: Pick<ManagedAppOptions, 'ui'> = {}): Promise<Server> {
+  const app = await createManagedApp(config, options)
   const server = createServer(withReap(app.handleRequest, { managed: app.reap }, { isShuttingDown: app.isShuttingDown }))
   let disposal: Promise<void> | undefined
   function dispose(): Promise<void> {

package/server-managed/kept-briefly.ts

@@ -0,0 +1,37 @@
+// What was lately worked out, kept a little while in memory for whoever asks
+// for it next, by key: each for `keptMs` from when it was kept, the least
+// lately read going first past `maxEntries` of them or `maxBytes` between
+// them, and one that alone takes more than `maxBytes` not kept at all.
+// Whoever reads one is the caller's to check, as they would one worked out.
+export function keptBriefly<T>({ keptMs, maxBytes, maxEntries = Infinity }: { keptMs: number; maxBytes: number; maxEntries?: number }) {
+  const held = new Map<string, { value: T; bytes: number; timer: ReturnType<typeof setTimeout> }>()
+  let heldBytes = 0
+  const forget = (key: string) => {
+    const entry = held.get(key)
+    if (!entry) return
+    clearTimeout(entry.timer)
+    held.delete(key)
+    heldBytes -= entry.bytes
+  }
+  return {
+    get(key: string): T | undefined {
+      const entry = held.get(key)
+      if (!entry) return undefined
+      held.delete(key)
+      held.set(key, entry)
+      return entry.value
+    },
+    keep(key: string, value: T, bytes: number) {
+      if (bytes > maxBytes) return
+      forget(key)
+      for (const old of held.keys()) {
+        if (held.size < maxEntries && heldBytes + bytes <= maxBytes) break
+        forget(old)
+      }
+      const timer = setTimeout(() => { forget(key) }, keptMs)
+      timer.unref()
+      held.set(key, { value, bytes, timer })
+      heldBytes += bytes
+    },
+  }
+}

package/server-managed/link-reports.ts

@@ -39,7 +39,11 @@ function decryptGroups(key: StorageKey | null, id: string, payload: string): str
   try { return JSON.parse(plain.toString('utf8')) as string[][] } finally { plain.fill(0) }
 }
 export async function linkRevision(db: ManagedSql): Promise<string> {
-  const rows = await db.prepare('SELECT id, sha256 FROM managed_link_report WHERE enabled = 1 ORDER BY id').all()
+  return linkRevisionOf(await db.prepare('SELECT id, sha256 FROM managed_link_report WHERE enabled = 1 ORDER BY id').all())
+}
+// The revision of the enabled link reports' `{ id, sha256 }` rows, by id,
+// however they were read.
+export function linkRevisionOf(rows: unknown[]): string {
   return rows.length > 0 ? createHash('sha256').update(JSON.stringify(rows)).digest('base64url') : ''
 }
 function parseLinkReport(content: string) {

package/server-managed/npm-delta.ts

@@ -10,11 +10,12 @@
 // leaving those out; and whether a binary file, which they count none of,
 // was added, removed or changed (`binary`), one moved as it was not. Worked
 // out in a worker, off the event loop, as many at once per process as
-// MAX_ACTIVE, their files read only once their turn has come, those waiting
-// past MAX_WAITING refused, each waiting a minute at most and counting in a
-// minute at most; one asked again meanwhile sharing the first's; and kept by
-// both sides' integrities, in this instance and beyond it (`kept`), what a
-// version holds never changing. Access is the caller's to check.
+// MAX_ACTIVE, both sides' files read together only once their turn has come,
+// those waiting past MAX_WAITING refused, each waiting a minute at most and
+// counting in a minute at most; one asked again meanwhile sharing the
+// first's; and kept by both sides' integrities, in this instance and beyond
+// it (`kept`), what a version holds never changing. Access is the caller's
+// to check.
 import { Worker } from 'node:worker_threads'
 import { createHash } from 'node:crypto'
 import type { KeptStore } from './npm-kept.ts'
@@ -160,7 +161,11 @@ async function worked(key: string, base: Side | null, other: Side, kept: KeptSto
   await turn(Date.now() + DELTA_TIMEOUT_MS)
   let binary, told
   try {
-    const [olds, news] = [texts(base ? await base.files() : null), texts(await other.files())]
+    // Its turn held till both sides are read, or have failed.
+    const [baseRead, otherRead] = await Promise.allSettled([base ? base.files() : Promise.resolve(null), other.files()])
+    if (baseRead.status === 'rejected') throw baseRead.reason
+    if (otherRead.status === 'rejected') throw otherRead.reason
+    const [olds, news] = [texts(baseRead.value), texts(otherRead.value)]
     if (olds.length + news.length > MAX_TEXT_LENGTH) throw new NpmPackageError(413, 'package-too-large')
     binary = binaryChanged(olds.binaries, news.binaries)
     told = await counted(olds.read, news.read, Date.now() + DELTA_TIMEOUT_MS)

package/server-managed/npm-kept.ts

@@ -4,7 +4,8 @@
 // instance: public versions' documents, of the fields read of them
 // (npm-manifest.ts npmVersionFields), for a day (readNpmVersion asks npm again
 // then, as a version can be deprecated, its package made private, or itself
-// removed); and, for scans, each package's risk line, for as long as a scan
+// removed), and when each was published, for a month (npmPublishTimeStore);
+// and, for scans, each package's risk line, for as long as a scan
 // keeps it, and what a scan read of GitHub, for a day, and of npm's
 // advisories, for an hour (repository-risk.ts); and what the code viewer read
 // of a repository's GitHub, its issues, pull requests and agents' work, for a
@@ -18,7 +19,7 @@
 // nothing.
 import { createHash } from 'node:crypto'
 import { plainObject } from './npm-manifest.ts'
-import { type NpmVersionStore, VERSION_KEPT_MS } from './npm-packages.ts'
+import { type NpmPublishTimeStore, type NpmVersionStore, VERSION_KEPT_MS } from './npm-packages.ts'
 import type { UpstreamCacheStore } from './upstream-cache.ts'
 
 // A value kept by key, as JSON, `at` when it was.
@@ -26,6 +27,9 @@ export interface KeptStore<T> {
   read(key: string): Promise<{ at: number; value: T } | null>
   // Those of `keys` kept, by key, in one read of the database.
   readMany(keys: string[]): Promise<Map<string, { at: number; value: T }>>
+  // Those of `first` kept; where none is, those of `then`, in one read of the
+  // database (`first` whether they are `first`'s).
+  readFirst(first: string[], then: string[]): Promise<{ first: boolean; found: Map<string, { at: number; value: T }> }>
   write(key: string, value: T, at: number): Promise<void>
   // Removes what is kept by `key`.
   remove(key: string): Promise<void>
@@ -34,15 +38,25 @@ export interface KeptStore<T> {
 // When each database last had the rows under each prefix removed.
 const PRUNE_EVERY_MS = 60 * 60_000
 const pruned = new WeakMap<UpstreamCacheStore, Map<string, number>>()
+// Who sees each database's prunes through (index.ts: its app, which waits
+// for them before closing it, and on serverless keeps its invocation alive
+// till they settle), as a write no longer waits for one.
+const pruneOwners = new WeakMap<UpstreamCacheStore, (prune: Promise<unknown>) => void>()
+export function ownKeptPrunes(db: UpstreamCacheStore, own: (prune: Promise<unknown>) => void) {
+  pruneOwners.set(db, own)
+}
 
 // Removes the rows under `prefix` kept `keptMs` before `at`, at most once an
 // hour a database, as rows under it are written: here, and risk's downloads
-// (npm-risk.ts). A failure is `warn`ed of, and removes nothing.
-export async function pruneKept(db: UpstreamCacheStore, prefix: string, keptMs: number, at: number, warn: (error: unknown) => void) {
+// (npm-risk.ts), each one run handed to the database's owner. A failure is
+// `warn`ed of, and removes nothing.
+export function pruneKept(db: UpstreamCacheStore, prefix: string, keptMs: number, at: number, warn: (error: unknown) => void): Promise<void> {
   const times = pruned.get(db) ?? pruned.set(db, new Map()).get(db)!
-  if (at - (times.get(prefix) ?? -Infinity) < PRUNE_EVERY_MS) return
+  if (at - (times.get(prefix) ?? -Infinity) < PRUNE_EVERY_MS) return Promise.resolve()
   times.set(prefix, at)
-  try { await db.deleteUpstreamCacheEntries(prefix, at - keptMs) } catch (error) { warn(error) }
+  const prune = (async () => { try { await db.deleteUpstreamCacheEntries(prefix, at - keptMs) } catch (error) { warn(error) } })()
+  pruneOwners.get(db)?.(prune)
+  return prune
 }
 
 // Values of `type`, each read for `keptMs` after it was kept.
@@ -66,9 +80,20 @@ function keptStore<T>(db: UpstreamCacheStore, type: string, keptMs: number, debu
         return new Map(keys.flatMap(key => { const kept = valueOf(rows.get(keyOf(key))); return kept ? [[key, kept] as const] : [] }))
       } catch (error) { warn('read', error); return new Map() }
     },
+    async readFirst(first, then) {
+      try {
+        const { first: answered, entries } = await db.getFirstUpstreamCacheEntries(first.map(keyOf), then.map(keyOf))
+        const asked = answered ? first : then
+        return { first: answered, found: new Map(asked.flatMap(key => { const kept = valueOf(entries.get(keyOf(key))); return kept ? [[key, kept] as const] : [] })) }
+      } catch (error) { warn('read', error); return { first: false, found: new Map() } }
+    },
     async write(key, value, at) {
       try { await db.setUpstreamCacheEntry(keyOf(key), JSON.stringify({ at, value }), at) } catch (error) { warn('write', error) }
-      await prune(at)
+      // Behind the write, not before it is done: the prune reads the whole
+      // table (no index serves its prefix), which no writer need wait on.
+      // Its hour is marked before it runs, so writes meanwhile start none,
+      // and its database's owner sees it through (ownKeptPrunes).
+      void prune(at)
     },
     async remove(key) {
       try { await db.deleteUpstreamCacheEntries(keyOf(key), Number.MAX_SAFE_INTEGER) } catch (error) { warn('remove', error) }
@@ -83,10 +108,29 @@ export function npmVersionStore(db: UpstreamCacheStore, debug = false): NpmVersi
       const hit = await kept.read(`${name}@${version}`)
       return hit && plainObject(hit.value) ? { at: hit.at, json: hit.value } : null
     },
+    async readMany(versions) {
+      const hits = await kept.readMany(versions.map(({ name, version }) => `${name}@${version}`))
+      return new Map([...hits].flatMap(([key, hit]) => plainObject(hit.value) ? [[key, { at: hit.at, json: hit.value }] as const] : []))
+    },
     write: (name, version, json) => kept.write(`${name}@${version}`, json, Date.now()),
   }
 }
 
+// When public versions were published (npm-packages.ts npmPublishTime), which
+// never changes once they are: kept a month, and kept again by the next view
+// of the version past it.
+const PUBLISH_TIME_KEPT_MS = 30 * 24 * 60 * 60_000
+export function npmPublishTimeStore(db: UpstreamCacheStore, debug = false): NpmPublishTimeStore {
+  const kept = keptStore<string>(db, 'npm/publish-times', PUBLISH_TIME_KEPT_MS, debug)
+  return {
+    async read(name, version) {
+      const hit = await kept.read(`${name}@${version}`)
+      return typeof hit?.value === 'string' ? hit.value : null
+    },
+    write: (name, version, at) => kept.write(`${name}@${version}`, at, Date.now()),
+  }
+}
+
 // Risk lines, each kept `keptMs`, for good where Infinity, a scan telling one
 // past RISK_KEPT_MS as stale (repository-risk.ts).
 export const riskLineStore = <T>(db: UpstreamCacheStore, keptMs: number, debug = false): KeptStore<T> => keptStore<T>(db, 'repository-risk/lines', keptMs, debug)

package/server-managed/npm-loads.ts

@@ -1,14 +1,16 @@
 // Loading a published version for the npm package viewer (npm-packages.ts):
 // its tarball, kept on disk as bundle builds keep theirs, else read from the
-// registry, and the viewer's response built from it, each shared by the
-// readers asking for it meanwhile and held to a few at once per process.
+// registry, its files unpacked from it, and the viewer's response built from
+// them, each shared by the readers asking for it meanwhile and held to a few
+// versions at once per process; its files kept a little while after.
 import { Buffer } from 'node:buffer'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { CompressionError, decompress } from '@preventive/archive/compression.js'
 import { encodeBrotli } from './brotli.ts'
-import { MAX_NPM_PACKAGE_BYTES, MAX_NPM_PACKAGE_FILES, NPM_REGISTRY, NpmPackageError, type NpmPackageFile, type NpmVersionDocument, askUpstream,
-  npmFileRows, npmPublishTime, npmToken, readNpmTar } from './npm-packages.ts'
+import { keptBriefly } from './kept-briefly.ts'
+import { MAX_NPM_PACKAGE_BYTES, MAX_NPM_PACKAGE_FILES, NPM_REGISTRY, NpmPackageError, type NpmPackageFile, type NpmVersionDocument, type TarReading,
+  askUpstream, npmFileRows, npmPublishTime, npmToken, readNpmTar } from './npm-packages.ts'
 import { keepFile, readKeptFile, upstreamCachePath } from './upstream-cache.ts'
 
 // The tar stream a package's files may come in, headers and padding included.
@@ -16,20 +18,31 @@ import { keepFile, readKeptFile, upstreamCachePath } from './upstream-cache.ts'
 // arrives.
 export const MAX_TAR_BYTES = 96 * 1024 * 1024
 const TARBALL_TIMEOUT_MS = 120_000
-// Loads in flight per process; each can hold a tarball, its tar, its files
-// and their encoded JSON.
+// Loads in flight per process, those of one version (its tarball, its files,
+// its response) as one, as they read its tarball and unpack it once between
+// them; each can hold a tarball, its tar, its files and their encoded JSON.
 const MAX_ACTIVE_LOADS = 4
+// How long a public version's files are kept once unpacked, and what they
+// may take between them, the least lately read going first past it:
+// Compare's requests for a pair of versions, and the Code tab's, come one
+// after another, each loading the same files. A private version's are never
+// kept, as nothing else of it is past its readers.
+const UNPACKED_KEPT_MS = 60_000
+const MAX_UNPACKED_BYTES = 128 * 1024 * 1024
 
 // A load's result, shared by its readers, and a reader's release of it.
 export interface NpmLoad<T> { result: Promise<T>; release: () => void }
 
-interface Load { job: Promise<unknown>; readers: number; settled: boolean }
+interface Load { job: Promise<unknown>; readers: number; settled: boolean; slot: string }
 
 // Loads by what they read; readers asking for the same share one. A load
 // keeps its place among the active ones until its work is done and each
 // reader has released it, as a reader does once its response is written or
-// abandoned, so what responses still hold counts too.
+// abandoned, so what responses still hold counts too. Places by the slot
+// their loads share, with how many hold each and how many places it takes.
 const loads = new Map<string, Load>()
+const slots = new Map<string, { holding: number; places: number }>()
+const placesTaken = () => [...slots.values()].reduce((sum, slot) => sum + slot.places, 0)
 
 const refused = <T>(status: number, code: string): NpmLoad<T> => {
   const result = Promise.reject(new NpmPackageError(status, code))
@@ -37,26 +50,40 @@ const refused = <T>(status: number, code: string): NpmLoad<T> => {
   return { result, release() {} }
 }
 
-function shared<T>(key: string, doc: NpmVersionDocument, work: () => Promise<T>): NpmLoad<T> {
+// What names a version's tarball, and so its files: its integrity and URL,
+// and whether it is read with the token.
+const tarballKey = (doc: NpmVersionDocument) => `${doc.dist.integrity} ${doc.dist.tarball} ${doc.private}`
+
+function shared<T>(what: string, doc: NpmVersionDocument, work: () => Promise<T>): NpmLoad<T> {
   const { unpackedSize, fileCount } = doc.dist
   if ((unpackedSize ?? 0) > MAX_NPM_PACKAGE_BYTES || (fileCount ?? 0) > MAX_NPM_PACKAGE_FILES) return refused(413, 'package-too-large')
-  return sharedLoad(key, work, 'npm-busy')
+  const slot = tarballKey(doc)
+  return sharedLoad(`${what} ${slot}`, work, 'npm-busy', { slot })
+}
+
+// The places among the active ones a load takes whose files hold `files` and
+// `bytes`: as many as packages they would fill, up to every one, each place
+// holding what a package may.
+export function loadPlaces({ files, bytes }: { files: number; bytes: number }): number {
+  return Math.min(MAX_ACTIVE_LOADS, Math.max(1, Math.ceil(files / MAX_NPM_PACKAGE_FILES), Math.ceil(bytes / MAX_NPM_PACKAGE_BYTES)))
 }
 
 // A load among the active ones, by `key`, refused as `busy` past them: a
 // repository directory's (repository-code.ts) as a package's, each holding
-// alike a tarball, its tar, its files and their encoded JSON.
-export function sharedLoad<T>(key: string, work: () => Promise<T>, busy: string): NpmLoad<T> {
+// alike a tarball, its tar, its files and their encoded JSON. Loads of one
+// `slot` take one place between them, or `places` (loadPlaces) where they
+// hold more.
+export function sharedLoad<T>(key: string, work: () => Promise<T>, busy: string,
+  { slot = key, places = 1 }: { slot?: string; places?: number } = {}): NpmLoad<T> {
   let load = loads.get(key)
   if (!load) {
-    if (loads.size >= MAX_ACTIVE_LOADS) return refused(429, busy)
-    const created: Load = { job: work(), readers: 0, settled: false }
-    const settle = () => {
-      created.settled = true
-      if (created.readers === 0 && loads.get(key) === created) loads.delete(key)
-    }
-    created.job.then(settle, settle)
+    if (!slots.has(slot) && placesTaken() + places > MAX_ACTIVE_LOADS) return refused(429, busy)
+    const created: Load = { job: work(), readers: 0, settled: false, slot }
+    const finish = () => { settle(key, created) }
+    created.job.then(finish, finish)
     loads.set(key, created)
+    const taken = slots.get(slot)
+    slots.set(slot, { holding: (taken?.holding ?? 0) + 1, places: taken?.places ?? places })
     load = created
   }
   const held = load
@@ -67,11 +94,27 @@ export function sharedLoad<T>(key: string, work: () => Promise<T>, busy: string)
     release() {
       if (released) return
       released = true
-      if (--held.readers === 0 && held.settled && loads.get(key) === held) loads.delete(key)
+      held.readers--
+      done(key, held)
     },
   }
 }
 
+function settle(key: string, load: Load) {
+  load.settled = true
+  done(key, load)
+}
+
+// A load gone from the active ones, and its place with it, once its work is
+// done and its readers have released it.
+function done(key: string, load: Load) {
+  if (load.readers !== 0 || !load.settled || loads.get(key) !== load) return
+  loads.delete(key)
+  const taken = slots.get(load.slot)!
+  if (taken.holding === 1) slots.delete(load.slot)
+  else taken.holding--
+}
+
 // The sha512 an integrity names, in base64, or null where it names none.
 const sha512Of = (integrity: string) => /(?:^|\s)sha512-([\d+/A-Za-z]{86}==)(?=\s|$)/u.exec(integrity)?.[1] ?? null
 // Hashed off the event loop: a tarball runs to tens of MiB.
@@ -129,12 +172,51 @@ async function readTarball(doc: NpmVersionDocument): Promise<Uint8Array> {
   return bytes
 }
 
+// Tarballs being read, and versions' files being unpacked, by what names
+// them (tarballKey): readers asking for one meanwhile share it, its bytes
+// those each one's own document names.
+const reading = new Map<string, Promise<Uint8Array>>()
+const unpacking = new Map<string, Promise<Unpacked>>()
+
+function sharedRead<T>(pending: Map<string, Promise<T>>, key: string, read: () => Promise<T>): Promise<T> {
+  let job = pending.get(key)
+  if (!job) {
+    const started = read().finally(() => { if (pending.get(key) === started) pending.delete(key) })
+    pending.set(key, job = started)
+  }
+  return job
+}
+
+const sharedTarball = (doc: NpmVersionDocument) => sharedRead(reading, tarballKey(doc), () => readTarball(doc))
+
+// A version's files, and the size of the tarball they came in.
+interface Unpacked { files: NpmPackageFile[]; tarballSize: number }
+
+// Public versions' files lately unpacked, by tarballKey.
+const unpacked = keptBriefly<Unpacked>({ keptMs: UNPACKED_KEPT_MS, maxBytes: MAX_UNPACKED_BYTES })
+
+// The version's files, kept from a load of them a little while since, else
+// unpacked from its tarball (and kept, a public version's): bytes its
+// reader's own document names, as its tarball's are.
+function unpackedOf(doc: NpmVersionDocument): Promise<Unpacked> {
+  const key = tarballKey(doc)
+  const kept = unpacked.get(key)
+  if (kept) return Promise.resolve(kept)
+  return sharedRead(unpacking, key, async () => {
+    const tarball = await sharedTarball(doc)
+    const value = { files: await readTarballFiles(tarball), tarballSize: tarball.byteLength }
+    if (!doc.private) unpacked.keep(key, value, value.files.reduce((sum, file) => sum + file.path.length + file.bytes.byteLength, 0))
+    return value
+  })
+}
+
 // A gzipped tarball's files, its top directory left out, as npm extracts
 // a package's: a repository tree's as GitHub archives it, too, its symlinks
-// let climb as readNpmTar's `symlinksAbove` says.
-export async function readTarballFiles(tarball: Uint8Array, options: { symlinksAbove?: number } = {}): Promise<NpmPackageFile[]> {
+// let climb as readNpmTar's `symlinksAbove` says, and its tar stream and
+// files bounded as `options` give, a package's bounds unless given.
+export async function readTarballFiles(tarball: Uint8Array, { maxTarBytes = MAX_TAR_BYTES, ...options }: TarReading & { maxTarBytes?: number } = {}): Promise<NpmPackageFile[]> {
   let tar: Uint8Array
-  try { tar = await decompress(tarball, 'gzip', { limit: MAX_TAR_BYTES }) }
+  try { tar = await decompress(tarball, 'gzip', { limit: maxTarBytes }) }
   catch (err) {
     const limited = err instanceof CompressionError && err.limited
     throw new NpmPackageError(limited ? 413 : 422, limited ? 'package-too-large' : 'bad-tarball')
@@ -144,31 +226,31 @@ export async function readTarballFiles(tarball: Uint8Array, options: { symlinksA
 
 // The version's tarball, for download.
 export function loadNpmTarball(doc: NpmVersionDocument): NpmLoad<Uint8Array> {
-  return shared(`tarball ${doc.dist.integrity} ${doc.dist.tarball}`, doc, () => readTarball(doc))
+  return shared('tarball', doc, () => sharedTarball(doc))
 }
 
 // The version's files, for one of them to be pretty-printed (pretty-print.ts).
 export function loadNpmFiles(doc: NpmVersionDocument): NpmLoad<NpmPackageFile[]> {
-  return shared(`files ${doc.dist.integrity} ${doc.dist.tarball}`, doc, async () => readTarballFiles(await readTarball(doc)))
+  return shared('files', doc, async () => (await unpackedOf(doc)).files)
 }
 
 // The version as the viewer reads it, as brotli-encoded JSON: `{ name,
 // version, private, integrity, tarballSize, published, manifest, files,
 // known }`, its files as npmFileRows gives them, and with them, as its files
-// are encoded, when it was published where that is kept (npmPublishTime,
-// else null) and what `known` gives: what is kept about its package
+// are encoded, when it was published where that is kept (`published`, asked
+// then, else null) and what `known` gives: what is kept about its package
 // (npm-insights.ts npmKnown), which the viewer need not then ask for. Encoding
 // is where a load holds the most, so it takes its place among the active
 // loads until its body is done, and readers asking meanwhile share that body,
-// the first one's manifest and `known` in it; nothing is kept once its readers
-// are done.
-export function loadNpmPackageBody(doc: NpmVersionDocument, known: () => object = () => ({})): NpmLoad<Buffer> {
-  return shared(`package ${doc.dist.integrity} ${doc.dist.tarball} ${doc.private}`, doc, async () => {
-    const tarball = await readTarball(doc)
-    const files = await readTarballFiles(tarball)
+// the first one's manifest, `published` and `known` in it; the body is not
+// kept once its readers are done, its files a little while (unpackedOf).
+export function loadNpmPackageBody(doc: NpmVersionDocument, known: () => object = () => ({}),
+  published: () => Promise<string | null> = npmPublishTime(doc).read): NpmLoad<Buffer> {
+  return shared('package', doc, async () => {
+    const { files, tarballSize } = await unpackedOf(doc)
     return encodeBrotli(Buffer.from(JSON.stringify({
-      name: doc.name, version: doc.version, private: doc.private, integrity: doc.dist.integrity, tarballSize: tarball.byteLength,
-      published: npmPublishTime(doc.name, doc.version), manifest: doc.manifest, files: npmFileRows(files), known: known(),
+      name: doc.name, version: doc.version, private: doc.private, integrity: doc.dist.integrity, tarballSize,
+      published: await published(), manifest: doc.manifest, files: npmFileRows(files), known: known(),
     })))
   })
 }