@preventive/triage 1.0.0-alpha.46 → 1.0.0-alpha.48

package/server-managed/http.ts

@@ -23,7 +23,7 @@
 //   POST /api/reports/<id>/triage → write triage entries: admin, or ≥triage role + membership | 401/403/404
 //   GET  /api/reports/<id>/triage/history?finding=<fid> → one visible finding's triage trail, newest first | 400/401/404
 //   GET  /api/avatar/<id>[?own]  → cached avatar bytes by user id, of the account chosen on their profile (`own`: the
-//        sign-in account's), or by linked account id; `app-<id>` or `user-<id>`, an app agent's GitHub App's or account's (APP_AGENTS) | 401/404
+//        sign-in account's), or by linked account id; `app-<id>` or `user-<id>`, an agent's GitHub App's or account's (GITHUB_AGENTS) | 401/404
 //   GET  /api/admin/users        → admin-only user list | 401/403
 //   GET  /api/admin/history      → paginated activity (admin), team content activity (manage) | 401/403
 //   POST /api/admin/set-role     → admin sets another user's role | 401/403/404
@@ -135,9 +135,10 @@ import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmPublishTimeStore, npmVersionStore, pullDependencyStore,
-  repositoryReadStore, reviewBaselineStore, riskLineStore, scanReadStore } from './npm-kept.ts'
-import { type NpmDelta, npmDelta } from './npm-delta.ts'
+import { type KeptStore, REPOSITORY_READ_KEPT_MS, codeHeadStore, codeTreeStore, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, lockfileReadStore,
+  npmDeltaStore, npmPublishTimeStore, npmVersionStore, ownKeptPrunes, pullDependencyStore, repositoryReadStore, reviewBaselineStore, riskLineStore, scanReadStore } from './npm-kept.ts'
+import { plainObject } from './npm-manifest.ts'
+import { type NpmDelta, keptNpmDeltas, npmDelta } from './npm-delta.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
 import { auditCache, auditedRepos, lastListing } from './upstream-cache.ts'
 import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
@@ -151,7 +152,7 @@ import { contentAccess } from './content-access.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { Buffer } from 'node:buffer'
 import { createHash, randomUUID } from 'node:crypto'
-import type { AvatarStore } from './avatar-store.ts'
+import type { AvatarStore, CachedAvatar } from './avatar-store.ts'
 import type { BlobStore, OpenedBlob } from './blob-store.ts'
 import { bundleFilePrefix, bundleIntegrity, bundleKind, bundleRepo, reportBundleHashes } from './bundle.ts'
 import { resolveRepositoryImportLocation } from './repository-aliases.ts'
@@ -181,12 +182,15 @@ import { RISK_KEPT_MS, SCAN_READ_KEPT_MS, type ScanProgress, repositoryRiskLines
 import { WORKFLOWS_DIR } from './repository-actions.ts'
 import { githubActionsSource } from './github-actions.ts'
 import { type RepositoryEntry, createRepositoryBrowser, repositoryTreeFiles, scopedDirectory } from './repository-browser.ts'
+import { type Lru, lru } from './lru.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, cacheAvatar, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
-import { clearCookie, endSession, readSession, runRequestPresence } from './session.ts'
+import { clearCookie, endSession, handOverSession, readSession, runRequestPresence, sessionIds } from './session.ts'
+import { runTimed } from './request-timing.ts'
+import { isExactVersion } from '@preventive/upstream/semver.js'
 import { VIEW_AS_PATH, VIEW_ONLY_ERROR, clearViewCookie, endViewSession, runViewing, startViewSession, viewToken } from './view-as.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
-import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
+import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, loadTeamTreesResponse, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
 import { FINDING_CATALOG_PAGE_BYTES, FINDING_CATALOG_PAGE_COUNT, MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
 import { lookupIssueLinks } from './github-issue-links.ts'
@@ -197,7 +201,7 @@ import { LINK_LOGIN_PATH, isLinkOAuthCallback, linkLoginRedirect, linkOAuthCallb
 import type { ProfileChoice } from './github-links.ts'
 import { withAppUsers } from './github-users.ts'
 import { isBlobId } from './object-storage.ts'
-import { attachmentDisposition, sendJson, sendLines, writeResponse, writeResponseParts } from './http-response.ts'
+import { attachmentDisposition, openLines, sendJson, sendLines, writeResponse, writeResponseParts } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
@@ -206,19 +210,20 @@ import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
-import { NpmPackageError, type NpmReader, type NpmVersionDocument, type NpmVersionStore, canReadPrivateNpm, npmFileRows, npmPublishTime, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions,
-  readTogether } from './npm-packages.ts'
+import { NpmPackageError, type NpmReader, type NpmVersionDocument, type NpmVersionStore, VERSION_KEPT_MS, canReadPrivateNpm, npmFileRows, npmPublishTime, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions, readTogether } from './npm-packages.ts'
 import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
-import { loadRepositoryCodeBody, repositoryCodeFits } from './repository-code.ts'
+import { type RepositoryCodeKept, loadRepositoryCodeBody, repositoryCodeFits, repositoryCodeKept } from './repository-code.ts'
 import { type ChangesStore, type CommitChanges, type CommitTree, TREES_READ, changesAsked, changesWithin, directoryFiles, repositoryChanges } from './repository-changes.ts'
 import { COAUTHORS_READ } from './commit-coauthors.ts'
-import { type AllHeads, type HistoryCommit, type HistoryPages, MAX_HISTORY_PAGE, type SquashedPull, type Squashes, historyFrom, historyStarts, openPullHeads,
-  repositoryAllHeads, repositoryAllHistory, repositoryHistory, repositoryRefTips, squashedPulls } from './repository-history.ts'
-import { AGENTS_READ_VERSION, APP_AGENTS, COMMITS_CURSOR, repositoryAgents } from './repository-agents.ts'
+import { type AllHeads, type HistoryCommit, type HistoryPages, MAX_HISTORY_PAGE, historyFrom, historyStarts, openPullHeads,
+  repositoryAllHeads, repositoryAllHistory, repositoryHistory, repositoryRefTips } from './repository-history.ts'
+import { type SquashedPull, type Squashes, squashedPulls } from './repository-squashes.ts'
+import { AGENTS_READ_VERSION, COMMITS_CURSOR, repositoryAgents } from './repository-agents.ts'
 import { ISSUES_CURSOR, ISSUES_READ_VERSION, repositoryIssues, repositoryItem } from './repository-issues.ts'
-import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependenciesAt } from './pull-dependencies.ts'
-import { type GithubAsked, lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
-import { MAX_REQUIRED_REVIEWS, SINCE_COMMIT } from './repository-dependency-reviews.ts'
+import { type GithubAsked, type ListedLockfile, type LockfileRead, type LockfileStore, MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullCommits, type PullDependencies,
+  type PullDependencyStore, eachOf, lockfileFormat, pullDependenciesAt } from './pull-dependencies.ts'
+import { lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
+import { MAX_REQUIRED_REVIEWS, type RepoDependencyReview, SINCE_COMMIT } from './repository-dependency-reviews.ts'
 import { EVERY_LOCKFILE, heldTo, scopeOf } from './lockfile-scope.ts'
 import { type ReviewBaselineStore, baselineFor, heldDependencies, reviewedDependencies, reviewedPackages } from './pull-dependency-reviews.ts'
 import { formattedPull, withFormatted } from './dependency-review-comments.ts'
@@ -229,7 +234,7 @@ import { PULSE_WEEKS, PULSE_YEAR_VERSION, type PulseStats, StatsPending, commitS
 import { type AgentMerges, agentCommits, agentMerges, directCommits, sameMerges } from './agent-merges.ts'
 import { releaseCommits } from './release-commits.ts'
 import { computeBundleDiff } from '../common/bundle-compare-diff.js'
-import type { ReviewChange, ReviewContext, ReviewInput } from './dependency-reviews.ts'
+import type { ReviewChange, ReviewContext, ReviewInput, ReviewedTarballs } from './dependency-reviews.ts'
 import { allowedReviewVerdicts, isReviewableFile, npmReviewVerdictLimit, npmTakenDown } from '../common/dependency-reviews.js'
 import { type NpmAdvisoryOptions, npmAdvisories, npmCommitTags, npmDownloads, npmGithubStats, npmKnown, npmLatestRepo, npmSocketReport } from './npm-insights.ts'
 import { npmProvenance } from './npm-provenance.ts'
@@ -309,6 +314,7 @@ const NPM_TYPE_ONLY_PATH = '/api/npm/type-only'
 const NPM_COMPARISON_PATH = '/api/npm/comparison'
 const NPM_RISK_PATH = '/api/npm/risk'
 const NPM_DELTA_PATH = '/api/npm/delta'
+const NPM_DELTAS_PATH = '/api/npm/deltas'
 // What risk's errors (risk/npm/registry.js NpmRiskError) are answered as: npm
 // having no such package or version, or a tarball unpacking past risk's
 // bounds; npm failing otherwise a 502.
@@ -333,7 +339,7 @@ const VIEW_PREFIXES = [...MANAGED_DATA_PREFIXES, '/api/auth', '/api/oauth']
 const underPrefix = (path: string, prefixes: readonly string[]) => prefixes.some(prefix => path === prefix || path.startsWith(prefix + '/'))
 
 async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, teamId: string, reportId: string | null): Promise<void> {
-  const s = await readWorkspaceSession(res, deps, cookie)
+  const s = await readWorkspaceSession(res, deps, cookie, { handed: true })
   if (!s) return
   const snapshot = await teamSnapshot(deps.db, s.session.id, teamId, reportId)
   const ids = [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)]
@@ -363,7 +369,7 @@ async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps,
 async function handleWorkspaceIssue(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps,
   cookie: string | undefined, teamId: string, query: URLSearchParams): Promise<void> {
   if (req.method !== 'GET' && req.method !== 'POST') { send405(res, 'GET, POST'); return }
-  const s = req.method === 'GET' ? await readWorkspaceSession(res, deps, cookie) : await checkMutation(req, res, deps, cookie)
+  const s = req.method === 'GET' ? await readWorkspaceSession(res, deps, cookie, { handed: true }) : await checkMutation(req, res, deps, cookie, { handed: true })
   if (!s) return
   if (!roleAtLeast(s.user.role, 'view')) { sendJson(res, 403, { error: 'forbidden' }); return }
   let body: unknown = Object.fromEntries(query)
@@ -395,7 +401,7 @@ function repositoryName(deps: ManagedHttpDeps, repoId: number | null | undefined
 // Managers get content activity for their currently accessible team content;
 // even the displayed report context must come from those accessible reports.
 async function handleHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (s == null) return
   const page = Number(query.get('page') ?? 1)
   const limit = Number(query.get('limit') ?? 100)
@@ -439,6 +445,9 @@ export interface ManagedHttpDeps {
   prettyCache?: PrettyCache
   // The public npm cache, where risk keeps public packages' assessments (npm-risk.ts).
   npmCacheStorage?: CacheStorage
+  // Where the code viewer keeps the default branch's head's directories
+  // (repository-code.ts repositoryCodeKept).
+  repositoryCodeStorage?: CacheStorage
   uploadStore?: BlobStore
   originGate: OriginGate
   isShuttingDown: () => boolean
@@ -468,36 +477,43 @@ function firstHeader(v: string | string[] | undefined): string | null {
 }
 
 // `key` is the image chosen for `id`; one not cached falls back to `id`'s own.
-async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id): Promise<void> {
-  const avatar = await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id))
+// A user's is never kept by the browser, as it changes with their profile.
+async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id, cacheControl = 'no-store'): Promise<void> {
+  sendAvatar(res, await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id)), cacheControl)
+}
+
+function sendAvatar(res: ServerResponse, avatar: CachedAvatar | null, cacheControl = 'no-store'): void {
   if (avatar == null) { sendJson(res, 404, { error: 'no-avatar' }); return }
   res.writeHead(200, {
     'content-type': avatar.contentType,
     'content-length': String(avatar.bytes.length),
     'x-content-type-options': 'nosniff',
-    'cache-control': 'no-store',
+    'cache-control': cacheControl,
   })
   res.end(avatar.bytes)
 }
 
 // The avatars `/api/avatar/app-<id>` and `/api/avatar/user-<id>` serve, these
-// alone: the agents' known by their GitHub Apps or accounts (APP_AGENTS),
-// each its mark on the Agents tab, and those the app draws agents' accounts
-// by (GITHUB_AGENTS). Each is fetched from GitHub once and
+// alone: those the app draws agents by (GITHUB_AGENTS), on the Agents tab and
+// wherever their work shows. Each is fetched from GitHub once and
 // kept, under a key no user's, a v4 UUID, can be: an app's, `…-0000-<id>`,
 // an account's, `…-0001-<id>`.
-const AGENT_AVATARS: ReadonlySet<string> = new Set([...APP_AGENTS, ...Object.values(GITHUB_AGENTS)]
-  .flatMap(agent => 'avatar' in agent && agent.avatar ? [agent.avatar] : []))
+const AGENT_AVATARS: ReadonlySet<string> = new Set(Object.values(GITHUB_AGENTS).flatMap(agent => 'avatar' in agent ? [agent.avatar] : []))
 const AGENT_AVATAR = /^(app|user)-([1-9]\d{0,11})$/u
+// An agent's mark is a public GitHub image that never changes with anyone's
+// profile, drawn on every tile and comment by it: kept by the browser a day,
+// for it alone.
+const AGENT_AVATAR_CACHE = 'private, max-age=86400'
 
 async function serveAgentAvatar(res: ServerResponse, avatarStore: AvatarStore, avatar: string): Promise<void> {
   const [, kind, id] = AGENT_AVATAR.exec(avatar)!
   const key = `00000000-0000-0000-000${kind === 'app' ? 0 : 1}-${id!.padStart(12, '0')}`
-  if (await avatarStore.get(key) == null) {
-    await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
-      .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
-  }
-  await serveAvatar(res, avatarStore, key)
+  // Read once where it is kept; read again only past fetching it.
+  const kept = await avatarStore.get(key)
+  if (kept != null) { sendAvatar(res, kept, AGENT_AVATAR_CACHE); return }
+  await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
+    .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
+  await serveAvatar(res, avatarStore, key, key, AGENT_AVATAR_CACHE)
 }
 
 const MAX_JSON_BODY_BYTES = 4096
@@ -518,14 +534,17 @@ async function readBodyBytes(req: IncomingMessage, maxBytes: number): Promise<Bu
 }
 
 // A file upload's content, opening a body the browser sealed to this session
-// (common/managed/upload-seal.ts). Link reports are never sent in parts.
+// (common/managed/upload-seal.ts). Link reports are never sent in parts; the
+// parts of one sent in them are deleted behind its answer.
 async function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, session: ManagedSession, kind: UploadKind | 'links'): Promise<Buffer> {
   const maxBytes = kind === 'bundles' ? deps.config.maxBundleBytes : deps.config.maxReportBytes
   const sealed = req.headers[UPLOAD_SEAL_HEADER] !== undefined
   const limit = sealed ? maxSealedBytes(maxBytes) : maxBytes
   let bytes
   if (kind === 'links' || req.headers['x-upload-id'] == null) bytes = await readBodyBytes(req, limit)
-  else if (deps.uploadStore) bytes = await readUpload(deps.uploadStore, req, session.id, kind, limit)
+  else if (deps.uploadStore) {
+    bytes = await readUpload(deps.uploadStore, req, session.id, kind, limit, cleanup => { deps.track(cleanup); deps.waitUntil?.(cleanup) })
+  }
   else throw new Error('bad-upload')
   return sealed ? await openSessionUpload(session.uploadKey, bytes, maxBytes) : bytes
 }
@@ -534,7 +553,7 @@ async function readUploadBody(req: IncomingMessage, deps: ManagedHttpDeps, sessi
 // first use. Only this session's server-side private key opens what is sealed to it.
 async function handleUploadKey(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if (req.method !== 'GET') { send405(res, 'GET'); return }
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (!s) return
   const key = s.session.uploadKey ?? await deps.db.ensureSessionUploadKey(s.session.id, newUploadKey())
   if (!key) { sendJson(res, 401, { error: 'unauthenticated' }); return }
@@ -544,7 +563,7 @@ async function handleUploadKey(req: IncomingMessage, res: ServerResponse, deps:
 async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, path: string) {
   const cancel = req.method === 'DELETE'
   if (req.method !== 'POST' && !cancel) { send405(res, 'POST, DELETE'); return }
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (!s || !requireManageRole(res, s.user)) return
   if (!deps.uploadStore) { sendJson(res, 404, { error: 'not-found' }); return }
   const match = /^\/api\/admin\/uploads\/(reports|bundles)\/([^/]+)(?:\/(0|[1-9][0-9]*))?$/u.exec(path)
@@ -585,8 +604,8 @@ async function readJsonBody(req: IncomingMessage, maxBytes = MAX_JSON_BODY_BYTES
 // Returns the session, or null after having already sent the 401/403. An
 // admin's view as another user writes nothing; `view` admits only the
 // endpoints that end it.
-async function checkMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { view = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+async function checkMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { view = false, handed = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed })
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
   const csrf = firstHeader(req.headers['x-csrf-token'])
   if (csrf == null) { sendJson(res, 403, { error: 'csrf-missing' }); return null }
@@ -640,7 +659,7 @@ async function handleViewAs(req: IncomingMessage, res: ServerResponse, deps: Man
   const userId = (body as { userId?: unknown } | null)?.userId
   if (typeof userId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
   if (userId === s.user.id) { sendJson(res, 400, { error: 'cannot-view-as-self' }); return }
-  const target = (await deps.db.listUsers()).find(user => user.id === userId)
+  const target = await deps.db.getUser(userId)
   if (!target) { sendJson(res, 404, { error: 'not-found' }); return }
   // The insert itself rechecks the admin session and role.
   const setCookie = await startViewSession(deps.config, deps.db, s.session, userId, Date.now())
@@ -714,7 +733,7 @@ function parseProfileChoice(body: unknown): ProfileChoice | null {
 // at least one admin).
 async function handleSetRole(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
   let body: unknown
@@ -723,7 +742,7 @@ async function handleSetRole(req: IncomingMessage, res: ServerResponse, deps: Ma
   const role = (body as { role?: unknown } | null)?.role
   if (typeof userId !== 'string' || !isRole(role)) { sendJson(res, 400, { error: 'bad-request' }); return }
   if (userId === s.user.id) { sendJson(res, 403, { error: 'cannot-change-own-role' }); return }
-  const target = (await deps.db.listUsers()).find(user => user.id === userId)
+  const target = await deps.db.getUser(userId)
   // A caller can hold the body open while their admin access is revoked.
   if (await readAdminSession(res, deps, cookie) == null) return
   const ok = await deps.db.setUserRole(userId, role)
@@ -744,22 +763,22 @@ function requireManageRole(res: ServerResponse, user: StoredUser): boolean {
 // A read endpoint open to admin|manage: resolve the session (401 if absent),
 // then gate on the role (403). Returns the session, or null after the response
 // was already sent. No CSRF — reads aren't mutations (cf. /api/admin/users).
-async function readManageSession(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+async function readManageSession(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { handed = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed })
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
   if (!requireManageRole(res, s.user)) return null
   return s
 }
 
-async function readAdminSession(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+async function readAdminSession(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { handed = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed })
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
   if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return null }
   return s
 }
 
-async function readWorkspaceSession(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+async function readWorkspaceSession(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { handed = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed })
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
   if (!roleAtLeast(s.user.role, 'view')) { sendJson(res, 403, { error: 'forbidden' }); return null }
   return s
@@ -789,7 +808,7 @@ async function currentSession(config: ManagedConfig, db: ManagedDb, cookie: stri
 // GET /api/admin/scan/models — the server's canonical scan model ids and effort
 // levels. Names are intentionally absent; the client derives them from ids.
 async function handleListModels(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (s == null) return
   sendJson(res, 200, { models: MANAGED_SCAN_MODELS, defaultModel: DEFAULT_MANAGED_SCAN_MODEL })
 }
@@ -800,7 +819,7 @@ async function handleListModels(res: ServerResponse, deps: ManagedHttpDeps, cook
 // filtering. Admin-only. No CSRF.
 async function handleListRepositories(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, discovery: RepositoryDiscovery): Promise<void> {
   if ((req.method ?? 'GET') !== 'GET') { send405(res, 'GET'); return }
-  const s = await readAdminSession(res, deps, cookie)
+  const s = await readAdminSession(res, deps, cookie, { handed: true })
   if (s == null) return
   const url = new URL(req.url ?? '/', 'http://localhost')
   // Keep the original unparameterized response shape for older clients. The
@@ -918,7 +937,7 @@ async function connectRepository(res: ServerResponse, deps: ManagedHttpDeps, use
 // Authentication, server admin permission, origin and CSRF remain mandatory.
 async function handleAddPublicRepository(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (!canAddAnyPublicRepository(s.user, await deps.db.getUserGithubId(s.user.id))) { sendJson(res, 403, { error: 'forbidden' }); return }
   let body: unknown
@@ -942,7 +961,7 @@ async function handleAddPublicRepository(req: IncomingMessage, res: ServerRespon
 // from the per-user checks required for browsing source.
 async function handleConnectRepositoryApp(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -977,10 +996,12 @@ async function handleConnectRepositoryApp(req: IncomingMessage, res: ServerRespo
 // POST /api/admin/repositories/select — an admin toggles whether a repo is
 // active in the operate-on set. Mutation: same-origin + CSRF. Body { repoId,
 // selected }. selected:true verifies + records the read context; selected:false
-// deactivates the row while retaining its reports, bundles, and metadata.
+// deactivates the row while retaining its reports, bundles, and metadata, but
+// for the code the code viewer kept of it, which no one reads meanwhile
+// (removeKeptCode).
 async function handleSelectRepository(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -993,6 +1014,7 @@ async function handleSelectRepository(req: IncomingMessage, res: ServerResponse,
     const repo = (await deps.db.listSelectedRepos()).find(row => row.repoId === repoId)
     if (await readAdminSession(res, deps, cookie) == null) return
     await deps.db.deactivateRepo(repoId)
+    await removeKeptCode(deps, repoId)
     if (repo) await activity(deps, s.user, 'repository', 'deactivated a repository', { repo: repo.fullName })
     sendJson(res, 200, { ok: true, selected: false }); return
   }
@@ -1008,7 +1030,7 @@ async function handleSelectRepository(req: IncomingMessage, res: ServerResponse,
 // stored kept as it is). Answers the setting then. Admin, CSRF.
 async function handleRepositoryDependencyReview(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: Record<string, unknown> | null
   try { body = await readJsonBody(req) as Record<string, unknown> | null } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -1080,7 +1102,7 @@ async function repositoryExclusiveTriageIds(deps: ManagedHttpDeps, reports: { id
 // removal would destroy. This is intentionally separate from the repository
 // list so the normal page stays cheap even with many reports.
 async function handleRepositoryImpact(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readAdminSession(res, deps, cookie)
+  const s = await readAdminSession(res, deps, cookie, { handed: true })
   if (s == null) return
   const repoId = Number(new URL(req.url ?? '/', 'http://localhost').searchParams.get('repoId'))
   if (!Number.isSafeInteger(repoId)) { sendJson(res, 400, { error: 'bad-repo' }); return }
@@ -1093,7 +1115,7 @@ async function handleRepositoryImpact(req: IncomingMessage, res: ServerResponse,
 // attached reports/bundles. The exact name + explicit acknowledgement are
 // checked server-side too; the UI's dialog is a usability guard, not the policy.
 async function handleRemoveRepository(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
   let body: unknown
@@ -1126,9 +1148,17 @@ async function handleRemoveRepository(req: IncomingMessage, res: ServerResponse,
     await deps.reportSourcesCache?.deleteBundle(bundle.id).catch((err) => { console.warn('managed: report sources delete failed:', err) })
     await deps.bundleStore.delete(bundle.id).catch(() => {})
   }
+  await removeKeptCode(deps, repo.repoId)
   sendJson(res, 200, { ok: true, deletedReports, deletedBundles, deletedTriage })
 }
 
+// The code the code viewer kept of a repository no longer read, its
+// directories' files (repositoryCodeKeptOf), removed once its row is: as a
+// bundle's derivatives are, at best, a failure warned of.
+async function removeKeptCode(deps: ManagedHttpDeps, repoId: number): Promise<void> {
+  await repositoryCodeKeptOf(deps)?.remove(repoId).catch((err: unknown) => { console.warn('managed: kept repository code delete failed:', err) })
+}
+
 // Strip a client-supplied upload filename to a safe display string. The bytes
 // are keyed by a server uuid. This name is used for display, Content-Disposition,
 // and format detection: decode URLs, remove controls/paths, and cap the basename
@@ -1180,7 +1210,7 @@ async function resolveUploadRepoId(req: IncomingMessage, res: ServerResponse, de
 // { reportId, repoId, directory }, where repoId is null (detach) or a
 // currently-selected repo id. Directory is relative to the repository root.
 async function handleSetReportRepo(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await manageMutation(req, res, deps, cookie)
+  const s = await manageMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -1201,7 +1231,7 @@ async function handleSetReportRepo(req: IncomingMessage, res: ServerResponse, de
 // POST /api/admin/reports/set-visible — publish or hide a stored report. New
 // reports start hidden so an admin can inspect the parsed metadata first.
 async function handleSetReportVisible(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await manageMutation(req, res, deps, cookie)
+  const s = await manageMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -1214,7 +1244,7 @@ async function handleSetReportVisible(req: IncomingMessage, res: ServerResponse,
 }
 
 async function handleSetBundleVisible(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await manageMutation(req, res, deps, cookie)
+  const s = await manageMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -1229,7 +1259,7 @@ async function handleSetBundleVisible(req: IncomingMessage, res: ServerResponse,
 // POST /api/admin/bundles/set-repo — attach / detach a stored bundle's repo link
 // and directory (same shape as reports). Body { bundleId, repoId, directory }.
 async function handleSetBundleRepo(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await manageMutation(req, res, deps, cookie)
+  const s = await manageMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -1260,8 +1290,8 @@ async function handleListReports(res: ServerResponse, deps: ManagedHttpDeps, ses
 // declared integrity that has a stored bundle wins (bundleId set). When none is
 // stored yet, keep the first declared integrity so a later bundle upload of it
 // re-links (see linkReportsToBundle). Returns the (bundleId, integrity) to store.
-async function resolveReportBundle(deps: ManagedHttpDeps, user: StoredUser, bytes: Buffer): Promise<{ bundleId: string | null; integrity: string | null }> {
-  const hashes = reportBundleHashes(bytes)
+async function resolveReportBundle(deps: ManagedHttpDeps, user: StoredUser, json: unknown): Promise<{ bundleId: string | null; integrity: string | null }> {
+  const hashes = reportBundleHashes(json)
   for (const h of hashes) {
     const b = await deps.db.getBundleByIntegrity(h)
     if (b != null && await canAccessBundle(deps, user, b.id)) return { bundleId: b.id, integrity: h }
@@ -1293,7 +1323,7 @@ async function sendUploadedReport(req: IncomingMessage, res: ServerResponse, dep
 // insert failure or concurrent duplicate drops the orphan blob; an uncertain
 // commit retains it. 413 over the cap, 400 on empty.
 async function handleUploadReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  let s = await checkMutation(req, res, deps, cookie)
+  let s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
   let bytes: Buffer
@@ -1371,7 +1401,8 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   if (existing) { await sendUploadedReport(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
-  const { bundleId, integrity } = await resolveReportBundle(deps, s.user, bytes)
+  // A JSON report's parse already in hand, not parsed again for its hashes.
+  const { bundleId, integrity } = await resolveReportBundle(deps, s.user, parsed.format === 'json' ? parsed.data : null)
   const dataKey = await deps.reportStore.put(id, bytes)
   let report: ReportRecord
   try {
@@ -1400,7 +1431,7 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
 // or rendered inline against the app origin. 404 when there's no such report;
 // 503 when the row exists but the bytes don't (store desync).
 async function handleGetReport(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (s == null) return
   if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   const rec = await deps.db.getReport(id)
@@ -1423,7 +1454,7 @@ async function handleGetReport(res: ServerResponse, deps: ManagedHttpDeps, cooki
 // same-origin + CSRF. Drops the row, then best-effort the bytes; 404 when there
 // was no such report.
 async function handleDeleteReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
   const { report, user } = await deps.db.mutateReport(s.session.id, id, { type: 'delete' })
@@ -1461,8 +1492,10 @@ async function repositoryBrowserUser(deps: ManagedHttpDeps, userId: string) {
 // user's repository access, for the next catalog to send.
 async function backfillCatalogCommits(deps: ManagedHttpDeps, userId: string, missing: readonly CatalogCommit[]): Promise<void> {
   let browser: ReturnType<typeof createRepositoryBrowser> | undefined
+  let repos: ReturnType<ManagedDb['listAllRepos']> | undefined
   await backfillBundleCommits(deps.db, userId, missing, async repoId => {
-    const repo = (await deps.db.listAllRepos()).find(item => item.repoId === repoId)
+    // Read once for the repositories the backfill reaches, not once each.
+    const repo = (await (repos ??= deps.db.listAllRepos())).find(item => item.repoId === repoId)
     if (!repo) return null
     browser ??= createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, userId))
     return browser.reader(repo)
@@ -1474,7 +1507,7 @@ async function backfillCatalogCommits(deps: ManagedHttpDeps, userId: string, mis
 // Any team member (view or above) lists those their teams reach, for the code
 // viewer as for Create a bundle, whose builds stay admin|manage.
 async function handleBrowsableRepositories(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readWorkspaceSession(res, deps, cookie)
+  const s = await readWorkspaceSession(res, deps, cookie, { handed: true })
   if (!s) return
   sendJson(res, 200, { repos: selectableRepos(await bundleRepos(deps, s.user)) })
 }
@@ -1531,13 +1564,28 @@ function repositoryQuery(res: ServerResponse, query: URLSearchParams) {
 // answered, where it is none of theirs. Every team member (view or above)
 // reads the repositories their teams reach; the reader then checks their own
 // GitHub read permission (repository-browser.ts), on each read.
-async function authorizeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number, path: string) {
-  const s = await readWorkspaceSession(res, deps, cookie)
+async function authorizeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number, path: string, { handed = false } = {}) {
+  const s = await readWorkspaceSession(res, deps, cookie, { handed })
   if (!s) return null
-  const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
-  if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
-  const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
-  return { repo, virtualEntries: scopedDirectory(path, scopes), user: s.user }
+  const access = repositoryAccessIn(await repositoryGrants(deps, s.user), repoId, path)
+  if (!access) { sendJson(res, 404, { error: 'no-repository' }); return null }
+  return { ...access, user: s.user }
+}
+
+// What a reader's grants let them read of the repositories (bundleRepos's
+// reads, the reader's scopes read once for both), for repositoryAccessIn to
+// tell of each: read once for as many repositories as a request asks of.
+async function repositoryGrants(deps: ManagedHttpDeps, user: StoredUser) {
+  const access = await contentAccess(deps.db, user)
+  return { access, repos: (await deps.db.listSelectedRepos()).filter(access.bundle) }
+}
+// Repository `repoId` as `grants` let it be read at `path`, as
+// authorizeRepository answers it; null where it is none of the reader's.
+function repositoryAccessIn({ access, repos }: Awaited<ReturnType<typeof repositoryGrants>>, repoId: number, path: string) {
+  const repo = repos.find(item => item.repoId === repoId)
+  if (!repo) return null
+  const scopes = access.scopes == null ? [null] : access.scopes.filter(scope => scope.repoId === repoId).map(scope => scope.path)
+  return { repo, virtualEntries: scopedDirectory(path, scopes) }
 }
 
 // The repository as it was authorized, but for the shared default branch hint,
@@ -1557,12 +1605,12 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
   const { repoId, ref } = asked
   const withDefault = refs && query.get('withDefault') === 'true'
   const path = refs ? '' : asked.path
-  const authorize = async () => {
-    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+  const authorize = async (handed = false) => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path, { handed })
     if (access && (!refs || withDefault) && access.virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
     return access
   }
-  const access = await authorize()
+  const access = await authorize(true)
   if (!access) return
   try {
     const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id))
@@ -1572,8 +1620,9 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     const revisions = refs ? await readRepositoryRefs(deps.db, reader, access.repo, withDefault, access.virtualEntries) : null
     const contents = refs ? null : await readRepositoryContents(reader, ref, path, access.virtualEntries)
     const { tagCommits, tagsComplete, ...listed } = revisions ?? { tagCommits: [], tagsComplete: false }
-    // Create a bundle refreshes the tags bundle catalogs show, and keeps a tag
-    // its revision input resolves even when the listed page leaves it out.
+    // Every refs read (Create a bundle's, and the code viewer's) refreshes the
+    // tags bundle catalogs show, and a tag read keeps the one its revision
+    // input resolves even when the listed page leaves it out.
     // Like other GitHub caches, written before the access fence below.
     const tags = refs ? tagCommits : ref.length > 5 && ref.startsWith('tags/') && contents ? [{ name: ref.slice(5), sha: contents.commit }] : []
     if (refs || tags.length > 0) {
@@ -1601,27 +1650,78 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
 // tarball is asked for; the reader's access is checked again once it is
 // read, before any of it is sent. The load stays held until this response is
 // written or abandoned, and a reader who stops reading it gives it up after
-// a while.
+// a while. A directory of the default branch's head is kept in byte storage
+// as it was sent, for the next to open it (repositoryCodeKeptOf).
+// What GitHub answered of a repository's trees for the code viewer, which a
+// commit or tree it names never changes: the tree at a directory of a commit
+// (getRepoTreeId reads the commit, then a listing a level down to it), and
+// how many files a tree holds under it and their bytes (repositoryTreeFiles),
+// by the repository's id, for the next to open it. Asked of them only once
+// the reader's own access has named the commit, as GitHub would have
+// answered them; held by each instance a while, by the database it has, and
+// kept in that database for every instance (npm-kept.ts codeTreeStore).
+const REPOSITORY_TREES_KEPT = 4096
+type TreeFiles = Awaited<ReturnType<typeof repositoryTreeFiles>>
+const repositoryTrees = new WeakMap<ManagedDb, { ids: Lru<string>; files: Lru<TreeFiles> }>()
+const treeId = (value: unknown): value is string => typeof value === 'string' && /^[a-f\d]{40}$/u.test(value)
+const treeFiles = (value: unknown): value is TreeFiles => value === null || (plainObject(value)
+  && Number.isSafeInteger(value['files']) && (value['files'] as number) >= 0 && Number.isSafeInteger(value['bytes']) && (value['bytes'] as number) >= 0)
+function repositoryTreesOf(deps: ManagedHttpDeps) {
+  let held = repositoryTrees.get(deps.db)
+  if (!held) repositoryTrees.set(deps.db, held = { ids: lru(REPOSITORY_TREES_KEPT), files: lru(REPOSITORY_TREES_KEPT) })
+  const { ids, files } = held
+  return {
+    id: (key: string, read: () => Promise<string>) => keptTree(ids, codeTreeStore<string>(deps.db, 'trees', deps.config.debug), key, treeId, read),
+    files: (key: string, read: () => Promise<TreeFiles>) => keptTree(files, codeTreeStore<TreeFiles>(deps.db, 'tree-files', deps.config.debug), key, treeFiles, read),
+  }
+}
+// What `memory` holds by `key`, else what `store` keeps of it as `kept`
+// takes it, else what `read` answers, then held and kept.
+async function keptTree<T>(memory: Lru<T>, store: KeptStore<T>, key: string, kept: (value: unknown) => value is T, read: () => Promise<T>): Promise<T> {
+  const held = memory.get(key)
+  if (held !== undefined) return held
+  const stored = await store.read(key)
+  let value: T
+  if (stored && kept(stored.value)) value = stored.value
+  else {
+    value = await read()
+    await store.write(key, value, Date.now())
+  }
+  memory.set(key, value)
+  return value
+}
+
+// The default branch's head's directories as kept in byte storage
+// (repository-code.ts repositoryCodeKept), the commit they are kept at in
+// the database, for a repository active as it is selected; none where this
+// server has no byte storage for them. Work behind an answer is tracked
+// (serverless, its invocation kept alive till it settles), as a kept read
+// read again behind one is.
+function repositoryCodeKeptOf(deps: ManagedHttpDeps): RepositoryCodeKept | null {
+  if (!deps.repositoryCodeStorage) return null
+  const active = async (repoId: number) => (await deps.db.listSelectedRepos()).some(row => row.repoId === repoId)
+  return repositoryCodeKept(deps.repositoryCodeStorage, codeHeadStore(deps.db, deps.config.debug), active, work => {
+    deps.track(work)
+    deps.waitUntil?.(work)
+  }, deps.config.debug)
+}
+
 async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const asked = repositoryQuery(res, query)
   if (!asked) return
   const { repoId, ref, path } = asked
-  const authorize = async () => {
-    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+  const authorize = async (handed = false) => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path, { handed })
     if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
     return access
   }
-  const access = await authorize()
+  const access = await authorize(true)
   if (!access) return
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
     const commit = await reader.commit(ref)
     const repo = access.repo.fullName
     const client = createClient({ token: reader.readToken() })
-    // A directory the commit has none at is none to read, as browsing it says.
-    const tree = await upstreamGithub(() => client.getRepoTreeId({ repo, sha: commit, ...(path ? { directory: path } : {}) }).catch((err: unknown) => {
-      throw err instanceof Error && err.name === 'AssertionError' && err.message.includes(' has no directory at ') ? new GithubApiError(404, 'no-directory') : err
-    }))
     // Access still held, and the same repository, before anything read is sent.
     const fenced = async () => {
       await reader.recheckAccess()
@@ -1630,22 +1730,54 @@ async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps,
       if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return false }
       return true
     }
+    const send = (bytes: Buffer) => {
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      res.writeHead(200, {
+        'content-type': 'application/json', 'content-encoding': 'br', 'content-length': String(bytes.byteLength),
+        'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff',
+      })
+      writeResponse(res, bytes)
+    }
+    // The default branch's head's directory as kept, once the reader's own
+    // access has named its commit, sent as one read is, access checked again;
+    // its place among the active loads held till it is written or abandoned,
+    // else given up before a read from GitHub asks for its own.
+    const at = { repoId, repo, commit, path }, kept = repositoryCodeKeptOf(deps)
+    const atHead = kept !== null && await kept.at(at, ref, reader.defaultBranch)
+    if (atHead) {
+      const keptLoad = kept.read(at)
+      res.once('close', keptLoad.release)
+      const held = await keptLoad.result
+      if (held) {
+        if (await fenced() && !res.destroyed) send(held)
+        return
+      }
+      keptLoad.release()
+    }
+    const trees = repositoryTreesOf(deps)
+    // A directory the commit has none at is none to read, as browsing it says.
+    const tree = await trees.id(`${repoId}\0${commit}\0${path}`, () => upstreamGithub(() => client.getRepoTreeId({ repo, sha: commit, ...(path ? { directory: path } : {}) }).catch((err: unknown) => {
+      throw err instanceof Error && err.name === 'AssertionError' && err.message.includes(' has no directory at ') ? new GithubApiError(404, 'no-directory') : err
+    })))
     // Too large names the commit it was read at, for History to read.
-    if (!repositoryCodeFits(await repositoryTreeFiles(repo, reader.readToken(), tree))) {
+    const listed = await trees.files(`${repoId}\0${tree}`, () => repositoryTreeFiles(repo, reader.readToken(), tree))
+    if (!repositoryCodeFits(listed)) {
       if (await fenced()) sendJson(res, 413, { error: 'directory-too-large', commit })
       return
     }
     if (res.destroyed) return
-    const load = loadRepositoryCodeBody({ repoId, repo, commit, path, tree }, () => upstreamGithub(() => client.getRepoTreeTarball({ repo, tree })))
+    // A tarball upstream finds no tree in, as @preventive/archive refuses
+    // one with a symlink past the repository's root, is one the viewer
+    // cannot read; one holding another tree is GitHub's answer gone wrong.
+    const load = loadRepositoryCodeBody({ repoId, repo, commit, path, tree, listed }, symlinksAbove => upstreamGithub(() => client.getRepoTreeTarball({ repo, tree, symlinksAbove }).catch((err: unknown) => {
+      throw err instanceof Error && err.name === 'AssertionError' && err.message.includes(', got no tree: ') ? new GithubApiError(422, 'directory-unreadable') : err
+    })))
     res.once('close', load.release)
     const bytes = await load.result
+    // Like other GitHub caches, kept before the access fence below.
+    if (atHead) kept.keep(at, bytes)
     if (!(await fenced()) || res.destroyed) return
-    res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
-    res.writeHead(200, {
-      'content-type': 'application/json', 'content-encoding': 'br', 'content-length': String(bytes.byteLength),
-      'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff',
-    })
-    writeResponse(res, bytes)
+    send(bytes)
   } catch (err) {
     if (res.headersSent || res.destroyed) return
     if (err instanceof GithubApiError) { sendGithubError(res, err); return }
@@ -1682,12 +1814,12 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
   const starts = from === null ? null : historyStarts(from)
   if (!Number.isSafeInteger(page) || page < 1 || page > MAX_HISTORY_PAGE || (all && (path !== '' || (page > 1) !== (starts !== null)))
     || (from !== null && (starts === null || path !== '' || page === 1))) { sendJson(res, 400, { error: 'bad-request' }); return }
-  const authorize = async () => {
-    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+  const authorize = async (handed = false) => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path, { handed })
     if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
     return access
   }
-  const access = await authorize()
+  const access = await authorize(true)
   if (!access) return
   let readingPulls: Promise<{ number: number; sha: string }[] | null> = Promise.resolve(null)
   try {
@@ -1737,12 +1869,24 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
     // The pull requests squashed into a whole repository's commits, drawn as
     // the merges they were, and on its first page the open ones' heads,
     // naming commits: with a token, as far as GitHub answers them, the
-    // history sent all the same where it doesn't.
+    // history sent all the same where it doesn't. Those GitHub is still
+    // looking up SQUASH_WAIT_MS on are left to the lookup, kept alive behind
+    // the answer, as a kept answer's read is (`pullsPending`, for the client
+    // to ask again).
     const listed = (body as { commits: HistoryCommit[] }).commits
-    const [pulls, openPulls] = token && path === '' ? await Promise.all([
-      squashedPulls(repo, token, listed, historySquashes(deps, repoId)).catch(quiet<SquashedPull[]>([])),
+    const none = { pulls: [] as SquashedPull[], pending: false }
+    const [squashed, openPulls] = token && path === '' ? await Promise.all([
+      squashedPulls(repo, token, listed, historySquashes(deps, repoId), SQUASH_WAIT_MS).then(read => {
+        if (read.behind) {
+          const behind = read.behind.catch(quiet(null))
+          deps.track(behind)
+          deps.waitUntil?.(behind)
+        }
+        return read
+      }, quiet(none)),
       readingPulls,
-    ]) : [[], null]
+    ]) : [none, null]
+    const { pulls } = squashed
     await reader.recheckAccess()
     const current = await authorize()
     if (!current) return
@@ -1752,7 +1896,8 @@ async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDep
     const shown = ({ sha, parents, subject, authorName, authorLogin, authorId, coauthors, committedAt }: HistoryCommit) =>
       ({ sha, parents, subject, authorName, authorLogin, authorId: authorId ?? null, coauthors: coauthors ?? [], committedAt })
     sendJson(res, 200, await withAppUsers(deps.db, { ...body, commits: listed.map(shown),
-      ...pulls.length > 0 ? { pulls: pulls.map(pull => ({ ...pull, commits: pull.commits.map(shown) })) } : {}, ...openPulls?.length ? { openPulls } : {} }))
+      ...pulls.length > 0 ? { pulls: pulls.map(pull => ({ ...pull, commits: pull.commits.map(shown) })) } : {}, ...squashed.pending ? { pullsPending: true } : {},
+      ...openPulls?.length ? { openPulls } : {} }))
   } catch (err) {
     if (err instanceof GithubApiError) { sendGithubError(res, err); return }
     throw err
@@ -1806,12 +1951,12 @@ async function readForReplay(res: ServerResponse, deps: ManagedHttpDeps, cookie:
   const asked = repositoryQuery(res, query)
   if (!asked) return
   const { repoId, path } = asked
-  const authorize = async () => {
-    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+  const authorize = async (handed = false) => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path, { handed })
     if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
     return access
   }
-  const access = await authorize()
+  const access = await authorize(true)
   if (!access) return
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
@@ -1848,6 +1993,9 @@ function historyChanges(deps: ManagedHttpDeps, repoId: number): ChangesStore {
 // and how long one read is answered as kept even where it is asked for afresh.
 const REPOSITORY_READ_FRESH_MS = 2 * 60_000
 const REPOSITORY_READ_FLOOR_MS = 10_000
+// How long a history's answer waits on GitHub looking up the pull requests
+// squashed into its commits (handleRepositoryHistory).
+const SQUASH_WAIT_MS = 1500
 // The repositories' reads being read again, behind a kept answer or as asked
 // for afresh, by key: one at a time, those asking meanwhile answered by it.
 const repositoryRereads = new Map<string, Promise<unknown>>()
@@ -1941,7 +2089,7 @@ function historyPages(deps: ManagedHttpDeps, repoId: number, graphql = false): H
 
 // The pull requests squashed into repository `repoId`'s commits, kept by
 // each commit and the rules their commits' co-authors were read by
-// (COAUTHORS_READ), null for one none was (repository-history.ts
+// (COAUTHORS_READ), null for one none was (repository-squashes.ts
 // squashedPulls); one kept before its commits' co-authors were read, read
 // again.
 function historySquashes(deps: ManagedHttpDeps, repoId: number): Squashes {
@@ -1984,28 +2132,55 @@ async function readWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, c
 async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
   answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>,
   unread: () => Promise<object | null> = () => Promise.resolve(null)): Promise<void> {
-  const authorize = async () => {
-    const access = await authorizeRepository(res, deps, cookie, repoId, '')
-    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
-    return access
-  }
-  const access = await authorize()
-  if (!access) return
+  const access = await wholeRepositoryAccess(deps, cookie, repoId, { handed: true })
+  if ('error' in access) { sendRefusal(res, access); return }
   const told = await unread()
   if (told) { sendJson(res, 200, await withAppUsers(deps.db, told)); return }
+  const read = await readWholeRepositoryOf(deps, access, answer, () => wholeRepositoryAccess(deps, cookie, repoId))
+  if ('error' in read) { sendRefusal(res, read); return }
+  sendJson(res, 200, await withAppUsers(deps.db, read.value))
+}
+
+// What a request is refused, as its answer tells it.
+type Refusal = { status: number; error: string; retryAfter?: number }
+const refusal = (status: number, error: string, retryAfter?: number | null): Refusal => ({ status, error, ...retryAfter == null ? {} : { retryAfter } })
+function sendRefusal(res: ServerResponse, { status, error, retryAfter }: Refusal) {
+  sendJson(res, status, { error }, retryAfter == null ? {} : { 'retry-after': String(retryAfter) })
+}
+// The whole of repository `repoId`, where the session `cookie` names may
+// read all of it, and who reads it; else why not: none of it
+// (`no-repository`), or only some (`no-directory`).
+type WholeAccess = { repo: SelectedRepo; user: StoredUser }
+async function wholeRepositoryAccess(deps: ManagedHttpDeps, cookie: string | undefined, repoId: number, { handed = false } = {}): Promise<WholeAccess | Refusal> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed })
+  if (s == null) return refusal(401, 'unauthenticated')
+  if (!roleAtLeast(s.user.role, 'view')) return refusal(403, 'forbidden')
+  return wholeAccessIn(await repositoryGrants(deps, s.user), s.user, repoId)
+}
+function wholeAccessIn(grants: Awaited<ReturnType<typeof repositoryGrants>>, user: StoredUser, repoId: number): WholeAccess | Refusal {
+  const access = repositoryAccessIn(grants, repoId, '')
+  if (!access) return refusal(404, 'no-repository')
+  if (access.virtualEntries !== null) return refusal(404, 'no-directory')
+  return { repo: access.repo, user }
+}
+// What `answer` reads of the whole of the repository `access` lets its
+// reader read, with their own GitHub access: as kept, else with that access
+// and `reauthorize`'s checked again after; else why it was refused.
+async function readWholeRepositoryOf<T>(deps: ManagedHttpDeps, access: WholeAccess, answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: T; kept: boolean }>,
+  reauthorize: () => Promise<WholeAccess | Refusal>): Promise<{ value: T; kept: boolean } | Refusal> {
   try {
     const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
     const token = reader.readToken()
-    if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
+    if (!token) return refusal(403, 'github-token-required')
     const answered = await answer(access.repo.fullName, token, access.user)
-    if (answered.kept) { sendJson(res, 200, await withAppUsers(deps.db, answered.value)); return }
+    if (answered.kept) return answered
     await reader.recheckAccess()
-    const current = await authorize()
-    if (!current) return
-    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
-    sendJson(res, 200, await withAppUsers(deps.db, answered.value))
+    const current = await reauthorize()
+    if ('error' in current) return current
+    if (!sameRepository(current.repo, access.repo)) return refusal(409, 'repository-changed')
+    return answered
   } catch (err) {
-    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    if (err instanceof GithubApiError) return refusal(err.status === 401 ? 502 : err.status, err.message, err.retryAfter)
     throw err
   }
 }
@@ -2013,7 +2188,9 @@ async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps,
 // GET /api/admin/repositories/issues: what the code viewer's Issues and Pull
 // requests tabs show (repository-issues.ts): `kind`'s open or closed
 // (`state`), a page at a time, on from the cursor `after` names. They are
-// the whole repository's (readWholeRepository).
+// the whole repository's, read as readWholeRepository reads them, kept with
+// open pull requests' commits, which they never tell (teamOpenPulls reads
+// them).
 async function handleRepositoryIssues(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const repoId = Number(query.get('repoId'))
   const kind = query.get('kind')
@@ -2021,8 +2198,11 @@ async function handleRepositoryIssues(res: ServerResponse, deps: ManagedHttpDeps
   const after = query.get('after')
   if (!Number.isSafeInteger(repoId) || repoId <= 0 || (kind !== 'issues' && kind !== 'pulls') || (state !== 'open' && state !== 'closed')
     || (after !== null && !ISSUES_CURSOR.test(after))) { sendJson(res, 400, { error: 'bad-request' }); return }
-  await readWholeRepository(res, deps, cookie, repoId, async (fullName, token) => ({ kind, state, ...await repositoryIssues(fullName, token, kind, state, after) }),
-    `issues\0${ISSUES_READ_VERSION}\0${kind}\0${state}\0${after ?? ''}`, true)
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const { value: { commits: _commits, ...page }, kept, at } = await keptAnswer(deps, `${repoId}\0issues\0${ISSUES_READ_VERSION}\0${kind}\0${state}\0${after ?? ''}`,
+      async () => ({ kind, state, ...await repositoryIssues(fullName, token, kind, state, after) }))
+    return { value: { ...page, readAt: at }, kept }
+  })
 }
 
 // GET /api/admin/repositories/agents: what the code viewer's Agents tab
@@ -2093,19 +2273,23 @@ async function handleRepositoryPullDependencies(res: ServerResponse, deps: Manag
 }
 
 // Pull request `number`'s answer, as the endpoint gives it, and whether all
-// of it was kept, GitHub asked for none of it.
-async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, token: string, user: StoredUser, repoId: number, number: number, review: boolean) {
+// of it was kept, GitHub asked for none of it: its base's and head's commits
+// as a page of its repository's open pull requests read them (`commits`,
+// kept and read again as that page is), else as kept by its number.
+async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, token: string, user: StoredUser, repoId: number, number: number, review: boolean,
+  commits?: PullCommits) {
   const kept = pullDependencyKept(deps, repoId)
   const reading: { told?: PullDependencies } = {}
-  const answered = await keptAnswer(deps, `${repoId}\0pull-commits\0${PULL_DEPENDENCIES_READ}\0${number}`, async () => {
-    const { commits, told } = await pullDependenciesAt(fullName, token, number, kept)
-    reading.told = told
-    return { commits }
-  })
+  const answered = commits ? { value: { commits: `${commits.base}...${commits.head}` }, kept: true }
+    : await keptAnswer(deps, `${repoId}\0pull-commits\0${PULL_DEPENDENCIES_READ}\0${number}`, async () => {
+      const read = await pullDependenciesAt(fullName, token, number, kept)
+      reading.told = read.told
+      return { commits: read.commits }
+    })
   // What its commits tell, as read, else as kept by them, else, no longer
-  // kept, read again.
+  // kept, read again: by those given, without asking GitHub for them.
   const held = reading.told ?? (typeof answered.value.commits === 'string' ? await kept.read(answered.value.commits) : null)
-  const pulled = { number, ...held ?? (await pullDependenciesAt(fullName, token, number, kept)).told }
+  const pulled = { number, ...held ?? (await pullDependenciesAt(fullName, token, number, kept, undefined, commits)).told }
   // Where its review is on, those of lockfiles it leaves out told to none,
   // whoever asks.
   const setting = await deps.db.repoDependencyReview(repoId)
@@ -2116,7 +2300,8 @@ async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, tok
   const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
   const told = review && !now && setting?.enabled && !(await deps.db.repoDependencyReview(repoId))?.enabled ? pulled : scoped
   const reviewed = deps.reviewedDependencies ?? null
-  const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
+  const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps), lockfileKept(deps, repoId))
+    : { baseline: null, unread: [], error: null }
   // Its comments read for reviews, where the host reads them, while it is
   // open (pull-comment-reviews.ts reads whether it is with them).
   const parse = reviewed?.parseComments
@@ -2137,32 +2322,40 @@ async function pullDependencyAnswer(deps: ManagedHttpDeps, fullName: string, tok
 // a pull request's others are (pull-dependency-reviews.ts), each left unread
 // a directory of its own failing the review, as a pull request's are. Kept,
 // its access not asked again, where its head was kept and its lockfiles and
-// baseline held, GitHub asked for none of them.
+// baseline held or kept (lockfileKept), GitHub asked for none of them.
 async function handleRepositoryBranchDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const repoId = Number(query.get('repoId'))
   if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
-  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
-    const headRead = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
-    const head = headRead.value.sha
-    if (!head) return { value: { head: null, review: null }, kept: false }
-    const asked: GithubAsked = { github: !headRead.kept }
-    // Those its review holds to alone read, as many as are read of them.
-    const setting = await deps.db.repoDependencyReview(repoId)
-    if (!setting?.enabled) return { value: { head, review: null }, kept: false }
-    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path), asked)
-    const { packages, paths } = lockedIn(read)
-    const told = { base: head, head, cut: false, lockfiles: [{ paths, added: [], more: 0, locked: packages.slice(0, MAX_LOCKED), moreLocked: Math.max(0, packages.length - MAX_LOCKED) },
-      ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' }))] }
-    const now = await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(told))
-    if (!now) return { value: { head, review: null }, kept: !asked.github }
-    // Told by the lockfiles it held to as they were read, though they have
-    // changed since.
-    const state = { ...now, lockfiles: setting.lockfiles }
-    const reviewed = deps.reviewedDependencies ?? null
-    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null }
-      : await baselineFor(fullName, token, repoId, state, baselineKept(deps), asked)
-    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: !asked.github }
-  }, async () => (await deps.db.repoDependencyReview(repoId))?.enabled ? null : { review: null })
+  await answerWholeRepository(res, deps, cookie, repoId, (fullName, token, user) => branchDependencyAnswer(deps, fullName, token, user, repoId),
+    async () => (await deps.db.repoDependencyReview(repoId))?.enabled ? null : { review: null })
+}
+
+// The default branch's answer, as GET branch-dependencies gives it, and
+// whether all of it was kept, GitHub asked for none of it; its review's
+// setting as read already (`known`), where it was.
+async function branchDependencyAnswer(deps: ManagedHttpDeps, fullName: string, token: string, user: StoredUser, repoId: number,
+  known?: RepoDependencyReview | null): Promise<{ value: object; kept: boolean }> {
+  const headRead = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
+  const head = headRead.value.sha
+  if (!head) return { value: { head: null, review: null }, kept: false }
+  const asked: GithubAsked = { github: !headRead.kept }
+  // Those its review holds to alone read, as many as are read of them.
+  const setting = known === undefined ? await deps.db.repoDependencyReview(repoId) : known
+  if (!setting?.enabled) return { value: { head, review: null }, kept: false }
+  const reads = lockfileKept(deps, repoId)
+  const read = await lockedAt(fullName, token, head, reads, path => heldTo(setting.lockfiles, path), asked)
+  const { packages, paths } = lockedIn(read)
+  const told = { base: head, head, cut: false, lockfiles: [{ paths, added: [], more: 0, locked: packages.slice(0, MAX_LOCKED), moreLocked: Math.max(0, packages.length - MAX_LOCKED) },
+    ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' }))] }
+  const now = await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(told))
+  if (!now) return { value: { head, review: null }, kept: !asked.github }
+  // Told by the lockfiles it held to as they were read, though they have
+  // changed since.
+  const state = { ...now, lockfiles: setting.lockfiles }
+  const reviewed = deps.reviewedDependencies ?? null
+  const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null }
+    : await baselineFor(fullName, token, repoId, state, baselineKept(deps), reads, asked)
+  return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: !asked.github }
 }
 
 // GET /api/admin/repositories/lockfiles: the lockfiles of the repository's
@@ -2174,7 +2367,195 @@ async function handleRepositoryLockfiles(res: ServerResponse, deps: ManagedHttpD
   if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
   await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
     const head = (await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))).value.sha
-    return { value: { head, lockfiles: head ? (await lockfilesAt(fullName, token, head)).map(({ path, format }) => ({ path, format })) : [] }, kept: false }
+    return { value: { head, lockfiles: head ? (await lockfilesAt(fullName, token, head, lockfileKept(deps, repoId))).map(({ path, format }) => ({ path, format })) : [] }, kept: false }
+  })
+}
+
+// GET /api/teams/:id/dependencies: what the team's Dependencies tab shows
+// (team-dependencies.js), in one request rather than one a repository, a
+// page of its pull requests and a batch of their dependencies: of each of
+// the team's repositories (those `repoIds` names alone, where it names
+// some), as lines of JSON as each is read, as the endpoints of each read
+// them: its default branch's dependencies and its open pull requests
+// (`{ repoId, branch, pulls: { items, more } }`) where its review is in
+// effect for the reader, else `{ repoId, branch: null }`, as for one they
+// may read only some of, or `{ repoId, error, status }`; then its pull
+// requests' dependencies, of those changing a lockfile or that may,
+// TEAM_PULLS_TOGETHER at a time (`{ repoId, dependencies }`); each line of
+// dependencies with the lines their versions wanting reviews change, where
+// they are counted already (`deltas`, npm-delta.ts keptNpmDeltas), told
+// before the rows asking for them are drawn. Last, `{ done: true
+// }`, or, its time up, `{ done: false, unread }`, the repositories left for
+// the reader to ask for again. The team's repositories, the reader's grants
+// and the repositories' reviews read once, those reviewing none answered at
+// once, GitHub asked nothing of them; each read with GitHub has its access
+// checked again after (readWholeRepositoryOf), and the reader's session
+// before each line, their team and grants before each telling a
+// repository's.
+const TEAM_REPOSITORIES_AT_ONCE = 4
+const TEAM_DEPENDENCIES_MS = 240_000
+const TEAM_PULL_PAGES = 20
+const TEAM_PULLS_TOGETHER = 20
+const PARTIAL_ACCESS = new Set(['no-directory', 'no-repository'])
+type TeamDependencyLine = Record<string, unknown> & { repoId?: number }
+type TeamPull = { number: number; touchesLockfile?: boolean | null }
+async function handleTeamDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, s: { session: ManagedSession; user: StoredUser },
+  teamId: string, query: URLSearchParams): Promise<void> {
+  const deadline = Date.now() + TEAM_DEPENDENCIES_MS
+  const named = query.get('repoIds')
+  const only = named === null ? null : new Set(named.split(',').map(Number))
+  if (only && (only.size === 0 || only.size > 1000 || [...only].some(id => !Number.isSafeInteger(id) || id <= 0))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const snapshot = await teamSnapshot(deps.db, s.session.id, teamId)
+  const repoIds = [...new Set(snapshot.repositories.map(repo => repo.repoId))].filter(id => !only || only.has(id))
+  const grants = await repositoryGrants(deps, s.user)
+  const settings = await deps.db.getRepoDependencyReviews(repoIds)
+  const out = openLines(res)
+  let stopped = false
+  // Lines written once their reader still reads them as at the start, the
+  // stream running minutes and a kept answer asking nothing again: their
+  // session theirs, and, where a line tells what a repository holds, the
+  // team still theirs and holding it, their grants still reaching the whole
+  // of it. None, and the answer cut short, where not, or the reader is gone.
+  const send = async (...lines: TeamDependencyLine[]) => {
+    if (stopped) return false
+    const now = await readSession(deps.config, deps.db, cookie, Date.now())
+    if (now?.user.id !== s.user.id || !roleAtLeast(now.user.role, 'view')) stopped = true
+    const telling = lines.filter(line => line.repoId !== undefined && (line['branch'] || line['dependencies'])).map(line => line.repoId!)
+    if (!stopped && telling.length > 0 && !await stillReads(now!.user, telling)) stopped = true
+    for (const line of lines) if (stopped || !await out.write(line)) stopped = true
+    if (stopped) out.cut()
+    return !stopped
+  }
+  const stillReads = async (user: StoredUser, ids: number[]) => {
+    const team = await teamSnapshot(deps.db, s.session.id, teamId).catch((err: unknown) => {
+      if (err instanceof TeamReportsError) return null
+      throw err
+    })
+    if (!team) return false
+    const current = await repositoryGrants(deps, user)
+    return ids.every(id => team.repositories.some(repo => repo.repoId === id) && !('error' in wholeAccessIn(current, user, id)))
+  }
+  const reading: { access: WholeAccess; setting: RepoDependencyReview }[] = []
+  const answered: TeamDependencyLine[] = []
+  for (const repoId of repoIds) {
+    const access = wholeAccessIn(grants, s.user, repoId), setting = settings.get(repoId)
+    if ('error' in access || !setting?.enabled) answered.push({ repoId, branch: null })
+    else reading.push({ access, setting })
+  }
+  if (answered.length > 0 && !await send(...answered)) return
+  const done = await eachOf(reading, TEAM_REPOSITORIES_AT_ONCE, ({ access, setting }) => stopped || Date.now() > deadline ? Promise.resolve(false)
+    : teamRepositoryDependencies(deps, access, setting, deadline, send, () => wholeRepositoryAccess(deps, cookie, access.repo.repoId)))
+  if (stopped) return
+  const unread = reading.filter((_, at) => !done[at]).map(({ access }) => access.repo.repoId)
+  if (!await send(unread.length === 0 ? { done: true } : { done: false, unread })) return
+  await out.end()
+}
+
+// A repository's lines of its team's Dependencies, as handleTeamDependencies
+// tells them; whether all were written, none left for its time.
+async function teamRepositoryDependencies(deps: ManagedHttpDeps, access: WholeAccess, setting: RepoDependencyReview, deadline: number,
+  send: (...lines: TeamDependencyLine[]) => Promise<boolean>, reauthorize: () => Promise<WholeAccess | Refusal>): Promise<boolean> {
+  const repoId = access.repo.repoId
+  type Read = { branch: object | null; pulls?: { items: TeamPull[]; more: boolean }; commits?: Map<number, PullCommits> }
+  const read = await readWholeRepositoryOf<Read>(deps, access, async (fullName, token, user) => {
+    const branch = await branchDependencyAnswer(deps, fullName, token, user, repoId, setting)
+    if (!(branch.value as { review?: unknown }).review) return { value: { branch: null }, kept: branch.kept }
+    const pulls = await teamOpenPulls(deps, repoId, fullName, token)
+    return { value: { branch: branch.value, pulls: { items: pulls.items, more: pulls.more }, commits: pulls.commits }, kept: branch.kept && pulls.kept }
+  }, reauthorize)
+  if ('error' in read) return send({ repoId, ...PARTIAL_ACCESS.has(read.error) ? { branch: null } : { error: read.error, status: read.status } })
+  const { branch, pulls, commits } = read.value
+  if (!branch) return send({ repoId, branch: null })
+  if (!await send({ repoId, branch, pulls, ...await withDeltas(deps, [branch]) })) return false
+  // Each by the commits its page names, where it names them, GitHub not asked
+  // for them (pullDependencyAnswer); never told.
+  const numbers = pulls!.items.filter(item => item.touchesLockfile === true || item.touchesLockfile === null).map(item => item.number)
+  for (let at = 0; at < numbers.length; at += TEAM_PULLS_TOGETHER) {
+    if (Date.now() > deadline) return false
+    const batch = numbers.slice(at, at + TEAM_PULLS_TOGETHER)
+    const pulled = await readWholeRepositoryOf(deps, access, async (fullName, token, user) => {
+      const answers = await eachOf(batch, PULLS_AT_ONCE, number => pullDependencyAnswer(deps, fullName, token, user, repoId, number, true, commits?.get(number)).catch((err: unknown) => {
+        // GitHub asked, though it failed: its access asked again after.
+        if (err instanceof GithubApiError) return { value: { number, error: err.message }, kept: false }
+        throw err
+      }))
+      return { value: answers.map(({ value }) => value), kept: answers.every(({ kept }) => kept) }
+    }, reauthorize)
+    const dependencies = 'error' in pulled ? batch.map(number => ({ number, error: pulled.error })) : pulled.value
+    if (!await send({ repoId, dependencies, ...await withDeltas(deps, dependencies) })) return false
+  }
+  return true
+}
+const withDeltas = async (deps: ManagedHttpDeps, answers: object[]) => {
+  const deltas = await teamDeltas(deps, answers)
+  return deltas.length > 0 ? { deltas } : {}
+}
+
+// A commit's or a blob's id, as GitHub names one.
+const OBJECT_ID = /^[a-f\d]{40}$/u
+
+// A repository's open pull requests, as many pages of them as
+// TEAM_PULL_PAGES, each read and kept as GET issues reads it; each's base's
+// and head's commits as its page has them (`commits`, by its number), where
+// it has them; whether it has more, and whether all were kept.
+async function teamOpenPulls(deps: ManagedHttpDeps, repoId: number, fullName: string, token: string) {
+  const items: TeamPull[] = []
+  const commits = new Map<number, PullCommits>()
+  let after: string | null = null, kept = true
+  for (let page = 0; page < TEAM_PULL_PAGES; page++) {
+    const cursor = after
+    const answer = await keptAnswer(deps, `${repoId}\0issues\0${ISSUES_READ_VERSION}\0pulls\0open\0${cursor ?? ''}`,
+      async () => ({ kind: 'pulls', state: 'open', ...await repositoryIssues(fullName, token, 'pulls', 'open', cursor) }))
+    kept &&= answer.kept
+    const value = answer.value as { items?: unknown; more?: unknown; after?: unknown; commits?: unknown }
+    items.push(...(Array.isArray(value.items) ? value.items : []).filter(item => Number.isSafeInteger(item?.number) && item.number > 0))
+    for (const pull of Array.isArray(value.commits) ? value.commits as { number?: unknown; base?: unknown; head?: unknown }[] : []) {
+      const { number, base, head } = pull ?? {}
+      if (Number.isSafeInteger(number) && typeof base === 'string' && OBJECT_ID.test(base) && typeof head === 'string' && OBJECT_ID.test(head)) {
+        commits.set(number as number, { base, head })
+      }
+    }
+    if (value.more !== true || typeof value.after !== 'string') return { items, commits, more: false, kept }
+    after = value.after
+  }
+  return { items, commits, more: true, kept }
+}
+
+// The lines the versions wanting reviews of `answers` change, as their rows
+// show them (npm-delta.js deltaBase), where they are counted already: of
+// public versions alone, those npm answered for in a day (npmVersionStore),
+// their integrities those npmDelta keys them by. `[name, version, base,
+// delta]` each, none counted here.
+async function teamDeltas(deps: ManagedHttpDeps, answers: object[]) {
+  const asked = new Map<string, [string, string, string]>()
+  for (const answer of answers as { lockfiles?: { added?: unknown; unreviewed?: unknown }[]; review?: { required?: number } }[]) {
+    const required = answer.review?.required
+    if (!Number.isSafeInteger(required)) continue
+    for (const pkg of (answer.lockfiles ?? []).flatMap(dir => [...Array.isArray(dir.added) ? dir.added : [], ...Array.isArray(dir.unreviewed) ? dir.unreviewed : []]) as
+      { name?: unknown; version?: unknown; source?: unknown; was?: unknown; reviews?: unknown; rejected?: unknown; baseline?: unknown; reviewed?: unknown; unsupported?: unknown }[]) {
+      if (pkg.source !== 'registry' || typeof pkg.name !== 'string' || typeof pkg.version !== 'string' || !isExactVersion(pkg.version)) continue
+      if (pkg.unsupported || pkg.baseline || pkg.reviewed || typeof pkg.reviews !== 'number' || (pkg.reviews >= required! && !pkg.rejected)) continue
+      const was = Array.isArray(pkg.was) ? pkg.was.find(prior => typeof prior === 'string' && prior !== pkg.version) as string | undefined : undefined
+      asked.set(`${pkg.name}\0${pkg.version}\0${was ?? '(empty)'}`, [pkg.name, pkg.version, was ?? '(empty)'])
+    }
+  }
+  if (asked.size === 0) return []
+  const versions = [...asked.values()].flatMap(([name, version, base]) => [{ name, version }, ...base === '(empty)' || !isExactVersion(base) ? [] : [{ name, version: base }]])
+  const kept = await npmVersionStore(deps.db, deps.config.debug).readMany!(versions)
+  const integrity = (name: string, version: string) => {
+    const hit = kept.get(`${name}@${version}`)
+    const dist = hit && Date.now() - hit.at < VERSION_KEPT_MS ? hit.json['dist'] : null
+    return typeof dist === 'object' && dist !== null && typeof (dist as { integrity?: unknown }).integrity === 'string' ? (dist as { integrity: string }).integrity : null
+  }
+  const sides = [...asked.values()].flatMap(([name, version, base]) => {
+    const against = base === '(empty)' ? null : integrity(name, base), other = integrity(name, version)
+    return other && (base === '(empty)' || against) ? [{ name, version, base, key: [against, other] as [string | null, string] }] : []
+  })
+  if (sides.length === 0) return []
+  const counted = await keptNpmDeltas(sides.map(({ key }) => key), npmDeltaStore<NpmDelta>(deps.db, deps.config.debug))
+  return sides.flatMap(({ name, version, base, key: [against, other] }) => {
+    const delta = counted.get(`${against ?? '(empty)'}\0${other}`)
+    return delta ? [[name, version, base, delta]] : []
   })
 }
 
@@ -2215,6 +2596,34 @@ function pullDependencyKept(deps: ManagedHttpDeps, repoId: number): PullDependen
   }
 }
 
+// What reading repository `repoId`'s lockfiles for its dependency review
+// keeps, by the rules they were read by (PULL_DEPENDENCIES_READ,
+// lockfileReadStore): each commit's listing, and each lockfile's read, of
+// those GitHub gave (pull-dependencies.ts LockfileStore). One kept otherwise
+// is none.
+function lockfileKept(deps: ManagedHttpDeps, repoId: number): LockfileStore {
+  const listings = lockfileReadStore<ListedLockfile[]>(deps.db, 'listings', deps.config.debug)
+  const lockfiles = lockfileReadStore<LockfileRead>(deps.db, 'lockfiles', deps.config.debug)
+  const keyOf = (key: string) => `${repoId}\0${PULL_DEPENDENCIES_READ}\0${key}`
+  return {
+    listings: {
+      async read(commit) {
+        const value: unknown = (await listings.read(keyOf(commit)))?.value
+        return Array.isArray(value) && value.every(item => typeof item?.path === 'string' && typeof item.format === 'string' && lockfileFormat(item.path) === item.format
+          && typeof item.sha === 'string' && OBJECT_ID.test(item.sha)) ? value : null
+      },
+      write: (commit, listed) => listings.write(keyOf(commit), listed, Date.now()),
+    },
+    lockfiles: {
+      async read(key) {
+        const value = (await lockfiles.read(keyOf(key)))?.value as { packages?: unknown; error?: unknown } | null | undefined
+        return value && (Array.isArray(value.packages) || value.error === 'lockfile-unreadable') ? value as LockfileRead : null
+      },
+      write: (key, read) => lockfiles.write(keyOf(key), read, Date.now()),
+    },
+  }
+}
+
 // GET /api/admin/repositories/pulse: what the code viewer's Pulse tab shows
 // (repository-pulse.ts): the default branch's year, counted from its commits
 // (pulseCommits), and the pull requests and issues of the last `weeks`
@@ -2441,7 +2850,7 @@ function scanProgress(deps: ManagedHttpDeps, key: string, scan: string | null) {
 // reader leaving, losing their admin role or
 // the server shutting down stops it.
 async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
-  const s = await readAdminSession(res, deps, cookie)
+  const s = await readAdminSession(res, deps, cookie, { handed: true })
   if (!s) return
   const repos = await riskRepositories(deps.db, query)
   if (!repos) {
@@ -2724,7 +3133,7 @@ async function sendUploadedBundle(req: IncomingMessage, res: ServerResponse, dep
 }
 
 async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const initial = await manageMutation(req, res, deps, cookie)
+  const initial = await manageMutation(req, res, deps, cookie, { handed: true })
   if (!initial) return
   const controller = new AbortController()
   const onClose = () => controller.abort()
@@ -2763,9 +3172,8 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
         throw new BundleBuildError(409, 'repository-changed')
       }
       signal.throwIfAborted()
-      const bytes = Buffer.from(built.bytes)
-      await storeUploadedBundle(req, res, deps, cookie, current, bytes, input.repoId, built.directory, built.filename, 'build',
-        bundleIntegrity(bytes), input.conditions)
+      await storeUploadedBundle(req, res, deps, cookie, current, built.bytes, input.repoId, built.directory, built.filename, 'build',
+        bundleIntegrity(built.bytes), input.conditions)
     })
   } catch (error) {
     if (res.destroyed || controller.signal.aborted) return
@@ -2788,7 +3196,7 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
 // After storing, any reports that declared this integrity but weren't linked yet
 // get attached (auto-link). 413 over the cap, 400 on empty.
 async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  let s = await checkMutation(req, res, deps, cookie)
+  let s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
   let bytes: Buffer
@@ -2846,15 +3254,17 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     repo.repoId = null
     directory = ''
   }
-  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, 'upload', integrity)
+  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, 'upload', integrity, null, existing === null)
 }
 
+// `absent` where the caller has just found no bundle of `integrity`: not read
+// again, one inserted since meeting the insert's UNIQUE below as a race does.
 async function storeUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined,
   s: { session: ManagedSession; user: StoredUser }, bytes: Buffer, repoId: number | null, directory: string, filename: string,
-  provenance: BundleProvenance, integrity = bundleIntegrity(bytes), buildConditions: BundleBuildConditions | null = null): Promise<void> {
+  provenance: BundleProvenance, integrity = bundleIntegrity(bytes), buildConditions: BundleBuildConditions | null = null, absent = false): Promise<void> {
   const kind = bundleKind(filename)
   const reuse = { provenance, filename, kind, buildConditions }
-  const existing = await deps.db.getBundleByIntegrity(integrity)
+  const existing = absent ? null : await deps.db.getBundleByIntegrity(integrity)
   if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, reuse); return }
   const id = randomUUID()
   const dataKey = await deps.bundleStore.put(id, bytes, kind)
@@ -2916,7 +3326,7 @@ async function handleGetBundle(req: IncomingMessage, res: ServerResponse, deps:
 // the FK; their bundle_integrity stays, so a re-upload re-links), then the bytes
 // best-effort. 404 when there was no such bundle.
 async function handleDeleteBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
   const { bundle, user } = await deps.db.mutateBundle(s.session.id, id, { type: 'delete' })
@@ -2929,8 +3339,8 @@ async function handleDeleteBundle(req: IncomingMessage, res: ServerResponse, dep
 
 // admin|manage mutation guard: same-origin + CSRF + role, in one step. Returns
 // the session, or null after the 401/403 was sent.
-async function manageMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  const s = await checkMutation(req, res, deps, cookie)
+async function manageMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { handed = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await checkMutation(req, res, deps, cookie, { handed })
   if (s == null) return null
   if (!requireManageRole(res, s.user)) return null
   return s
@@ -2938,8 +3348,8 @@ async function manageMutation(req: IncomingMessage, res: ServerResponse, deps: M
 
 // Workspace access and repository connections are administered separately
 // from content management. Managers cannot change their own access via teams.
-async function adminMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  const s = await checkMutation(req, res, deps, cookie)
+async function adminMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, { handed = false } = {}): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await checkMutation(req, res, deps, cookie, { handed })
   if (s == null) return null
   if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return null }
   return s
@@ -2984,19 +3394,18 @@ async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session
 // need a published report in their teams; ownership never overrides role none.
 async function canViewReport(deps: ManagedHttpDeps, user: StoredUser, reportId: string): Promise<boolean> {
   if (!roleAtLeast(user.role, 'view')) return false
-  const report = await deps.db.getReport(reportId)
+  const report = await deps.db.getReportView(user.id, reportId)
   if (report == null) return false
   if (user.role === 'admin') return true
-  if (user.role === 'manage') return report.uploadedBy === user.id || deps.db.userCanReadReport(user.id, reportId)
-  if (!report.visible) return false
-  return deps.db.userCanReadReport(user.id, reportId)
+  if (user.role === 'manage') return report.uploadedBy === user.id || report.readable
+  return report.visible && report.readable
 }
 
 // GET/HEAD /api/reports/:id/sources. Only the linked bundle's files cited by
 // visible findings (location AND evidence) are returned. Missing/unavailable
 // bundles are a quiet no-op; cached gzip bodies stream directly from disk.
 async function handleReportSources(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, teamId: string | null) {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true })
   if (!s) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   const sourcePaths = roleAtLeast(s.user.role, 'manage') ? undefined : await teamSourcePaths(deps.db, deps.reportStore, s.session.id, teamId ?? '', id)
@@ -3040,7 +3449,7 @@ async function reportIds(data: unknown): Promise<Set<string>> {
 async function handleDeduplication(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
   const method = req.method ?? 'GET'
   if (!(id ? ['GET', 'PATCH'] : ['GET', 'POST']).includes(method)) { send405(res, id ? 'GET, PATCH' : 'GET, POST'); return }
-  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now()) : await checkMutation(req, res, deps, cookie)
+  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true }) : await checkMutation(req, res, deps, cookie, { handed: true })
   if (!s) { if (method === 'GET') sendJson(res, 401, { error: 'unauthenticated' }); return }
   if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
   if (method === 'GET') { sendJson(res, 200, id ? await deps.db.getLinkReport(s.session.id, id) : { reports: await deps.db.listLinkReports() }); return }
@@ -3063,7 +3472,7 @@ async function handleDeduplication(req: IncomingMessage, res: ServerResponse, de
 async function handleRepositoryAliases(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
   const method = req.method ?? 'GET'
   if (!(id ? ['PATCH', 'DELETE'] : ['GET', 'POST']).includes(method)) { send405(res, id ? 'PATCH, DELETE' : 'GET, POST'); return }
-  const s = method === 'GET' ? await readAdminSession(res, deps, cookie) : await checkMutation(req, res, deps, cookie)
+  const s = method === 'GET' ? await readAdminSession(res, deps, cookie, { handed: true }) : await checkMutation(req, res, deps, cookie, { handed: true })
   if (!s) return
   if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
   if (method === 'GET') {
@@ -3083,7 +3492,7 @@ async function handleRepositoryAliases(req: IncomingMessage, res: ServerResponse
 // Managers can resolve only destinations their current repository grants cover.
 async function handleRepositorySuggestion(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   if (req.method !== 'GET') { send405(res, 'GET'); return }
-  if (!await readManageSession(res, deps, cookie)) return
+  if (!await readManageSession(res, deps, cookie, { handed: true })) return
   const params = new URL(req.url!, 'http://localhost').searchParams
   const github = reportRepoGithub({ repo: { github: params.get('repo') } })
   const directory = normalizeTeamPath(params.get('directory'))
@@ -3121,7 +3530,7 @@ async function suggestReportLocation(deps: ManagedHttpDeps, user: StoredUser, da
 // location editor. It never changes the stored assignment.
 async function handleReportLocationSuggestion(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
   if (req.method !== 'GET') { send405(res, 'GET'); return }
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (!s) return
   const report = await deps.db.getReport(id)
   if (!report || !(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
@@ -3143,7 +3552,7 @@ async function handleReportLocationSuggestion(req: IncomingMessage, res: ServerR
 // "not authorized" (so neither existence nor membership is probeable); 503 = row
 // without bytes (store desync).
 async function handleViewReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (s == null) return
   const snapshot = await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), [id])
   const access = snapshot?.reports[0]
@@ -3180,7 +3589,7 @@ async function handleViewReport(req: IncomingMessage, res: ServerResponse, deps:
 const REPORT_QUERY_CONCURRENCY = 8
 const REPORT_QUERY_IN_FLIGHT_BYTES = 64 * 1024 * 1024
 async function handleQueryReports(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readManageSession(res, deps, cookie, { handed: true })
   if (!s) return
   let body
   try { body = await readJsonBody(req, 1024 * 1024) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3274,9 +3683,11 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
 
 // The server selects the complete published workspace for classification.
 // Privileged hidden-report previews are independently scoped and bounded.
-async function handleTeamReports(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, teamId: string, reportId: string | null): Promise<void> {
+// Its reports' file trees are asked for apart, by its graph or Files alone.
+async function handleTeamReports(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, teamId: string, reportId: string | null,
+  part: 'reports' | 'trees' = 'reports'): Promise<void> {
   const snapshot = await teamSnapshot(deps.db, session.id, teamId, reportId)
-  const body = await loadTeamReportsResponse(deps.db, deps.reportStore, snapshot)
+  const body = await (part === 'trees' ? loadTeamTreesResponse : loadTeamReportsResponse)(deps.db, deps.reportStore, snapshot)
   await recheckTeam(deps.db, session.id, snapshot)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
   writeResponse(res, body)
@@ -3333,7 +3744,7 @@ async function reportFindingIds(deps: ManagedHttpDeps, rec: { id: string; sha256
 // stripped finding must not leak that the finding exists. A cleared entry is
 // sent as null (the server's tombstone), distinct from one never set.
 async function handleGetReportTriage(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, teamId: string | null): Promise<void> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true })
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   await visibleFindingIds(deps, s.user, id, s.session.id, teamId)
@@ -3352,7 +3763,7 @@ async function handleGetReportTriage(res: ServerResponse, deps: ManagedHttpDeps,
 // exists). Each event is the entry as written then (null = a clear), who
 // wrote it and when; "what changed" is the diff against the next-older event.
 async function handleGetReportTriageHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, query: URLSearchParams, teamId: string | null): Promise<void> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true })
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   if (!(await canTriageReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   const finding = query.get('finding') ?? ''
@@ -3383,7 +3794,7 @@ async function handleGetReportTriageHistory(res: ServerResponse, deps: ManagedHt
 // scope for rows that are themselves per finding id — so a stripped (or
 // foreign) finding id 404s without revealing whether it exists.
 async function handleSetReportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, teamId: string | null): Promise<void> {
-  const s = await checkMutation(req, res, deps, cookie)
+  const s = await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   if (!(await canTriageReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   let body: unknown
@@ -3417,7 +3828,7 @@ async function handleSetReportTriage(req: IncomingMessage, res: ServerResponse,
 // GET only: clients match local annotations against these IDs without sending
 // their local finding IDs or annotation bodies to discover which reports exist.
 async function handleImportFindingIds(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, search: URLSearchParams): Promise<void> {
-  const s = await readAdminSession(res, deps, cookie)
+  const s = await readAdminSession(res, deps, cookie, { handed: true })
   if (!s) return
   const after = search.get('after') ?? ''
   if (after && !/^[a-f\d-]{36}$/iu.test(after)) { sendJson(res, 400, { error: 'bad-cursor' }); return }
@@ -3439,7 +3850,7 @@ async function handleImportFindingIds(res: ServerResponse, deps: ManagedHttpDeps
 // Admin imports compare the exact snapshot shown by the conflict dialog before
 // writing. The store commits shared finding triage and imported comments together.
 async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (!s) return
   let body: { findingIds?: unknown; entries?: unknown; expected?: unknown }
   try { body = await readJsonBody(req, MAX_TRIAGE_BODY_BYTES) as typeof body }
@@ -3478,7 +3889,7 @@ async function handleReportComments(req: IncomingMessage, res: ServerResponse, d
   if (commentId == null ? method !== 'GET' && method !== 'POST' : method !== 'PATCH' && method !== 'DELETE') {
     send405(res, commentId == null ? 'GET, POST' : 'PATCH, DELETE'); return
   }
-  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now()) : await checkMutation(req, res, deps, cookie)
+  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true }) : await checkMutation(req, res, deps, cookie, { handed: true })
   if (s == null) { if (method === 'GET') sendJson(res, 401, { error: 'unauthenticated' }); return }
   const allowed = method === 'GET' ? await canViewReport(deps, s.user, reportId) : await canTriageReport(deps, s.user, reportId)
   if (!allowed) { sendJson(res, 404, { error: 'no-report' }); return }
@@ -3526,7 +3937,7 @@ async function handleReportComments(req: IncomingMessage, res: ServerResponse, d
 // the page needs: all users (member dropdown), selected repos (repo dropdown),
 // and the visibility-permission keys. admin, read-only (no CSRF).
 async function handleListTeams(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readAdminSession(res, deps, cookie)
+  const s = await readAdminSession(res, deps, cookie, { handed: true })
   if (s == null) return
   const scopes = await deps.db.listTeamNpmScopes()
   const reviewTeams = new Set(await deps.db.listDependencyReviewEnabledTeams())
@@ -3540,7 +3951,7 @@ async function handleListTeams(res: ServerResponse, deps: ManagedHttpDeps, cooki
 
 // POST /api/admin/teams — create a team. Body { name }. 409 if the name's taken.
 async function handleCreateTeam(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3557,7 +3968,7 @@ async function handleCreateTeam(req: IncomingMessage, res: ServerResponse, deps:
 // POST /api/admin/teams/rename — rename a team. Body { teamId, name }. 404 if no
 // such team; 409 if the new name is already taken by another team.
 async function handleRenameTeam(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3576,7 +3987,7 @@ async function handleRenameTeam(req: IncomingMessage, res: ServerResponse, deps:
 
 // Hidden teams retain their configuration but grant no access or sidebar presence.
 async function handleSetTeamHidden(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3592,7 +4003,7 @@ async function handleSetTeamHidden(req: IncomingMessage, res: ServerResponse, de
 
 // POST /api/admin/teams/delete — drop a team (its links cascade). Body { teamId }.
 async function handleDeleteTeam(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3609,7 +4020,7 @@ async function handleDeleteTeam(req: IncomingMessage, res: ServerResponse, deps:
 // path links with the whole repository. Body { teamId, repoId, path? }.
 // Repo must be in the selected set.
 async function handleSetTeamRepo(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3634,7 +4045,7 @@ async function handleSetTeamRepo(req: IncomingMessage, res: ServerResponse, deps
 // POST /api/admin/teams/remove-repo — unlink one path. Omitting path retains
 // the legacy remove-all behavior. Body { teamId, repoId, path? }.
 async function handleRemoveTeamRepo(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3654,7 +4065,7 @@ async function handleRemoveTeamRepo(req: IncomingMessage, res: ServerResponse, d
 // POST /api/admin/teams/set-member — add/update a member + their visibility
 // permissions. Body { teamId, userId, dependencies?, security? }.
 async function handleSetTeamMember(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3677,7 +4088,7 @@ async function handleSetTeamMember(req: IncomingMessage, res: ServerResponse, de
 
 // POST /api/admin/teams/remove-member — remove a membership. Body { teamId, userId }.
 async function handleRemoveTeamMember(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3693,7 +4104,7 @@ async function handleRemoveTeamMember(req: IncomingMessage, res: ServerResponse,
 }
 
 async function handleSetTeamDependencyReview(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (!s) return
   let body
   try { body = await readJsonBody(req) as { teamId?: unknown; enabled?: unknown } } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3705,7 +4116,7 @@ async function handleSetTeamDependencyReview(req: IncomingMessage, res: ServerRe
 // POST /api/admin/teams/set-npm-scopes — replace the npm scopes whose private
 // packages the team's members may read. Body { teamId, scopes: ['@scope'] }.
 async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await adminMutation(req, res, deps, cookie)
+  const s = await adminMutation(req, res, deps, cookie, { handed: true })
   if (s == null) return
   let body: unknown
   try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
@@ -3724,10 +4135,18 @@ async function handleSetTeamNpmScopes(req: IncomingMessage, res: ServerResponse,
 // npm scopes of its visible teams, else none: none are read for an unscoped
 // package, an admin or a manager, or an answer checked again that is public.
 // Null for none.
-async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined, names: readonly string[]): Promise<NpmReader | null> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
+async function npmReader(deps: ManagedHttpDeps, cookie: string | undefined, names: readonly string[], { handed = false } = {}): Promise<NpmReader | null> {
+  const s = await readSession(deps.config, deps.db, cookie, Date.now(), { handed })
   return s == null ? null : npmReaderOf(deps, s.user, names)
 }
+// The reader of the session `cookie` names now, as npmReader reads them,
+// their npm scopes whatever the packages, and whether they read team
+// `teamId`'s reviews: one statement.
+async function npmReviewReader(deps: ManagedHttpDeps, cookie: string | undefined, teamId: string): Promise<(NpmReader & { readsTeam: boolean }) | null> {
+  const ids = sessionIds(deps.config, cookie)
+  const reader = ids && await deps.db.getNpmReviewReader(ids.id, ids.viewer, Date.now(), teamId)
+  return reader && roleAtLeast(reader.role, 'view') ? { role: reader.role, scopes: new Set(reader.scopes), userId: reader.id, readsTeam: reader.readsTeam } : null
+}
 // The same of `user`, as a session the request read just now tells them.
 async function npmReaderOf(deps: ManagedHttpDeps, user: { id: string; role: NpmReader['role'] }, names: readonly string[]): Promise<NpmReader | null> {
   if (!roleAtLeast(user.role, 'view')) return null
@@ -3748,9 +4167,11 @@ const REVIEW_READS_AT_ONCE = 8
 
 // Lists must enforce the same target and base access as the review itself,
 // including permission changes while the registry requests are in flight;
-// first as `session`, the one the request read just now, where given.
+// first as `session`, the one the request read just now, where given. A
+// team's (`teamId`) only to one who still reads its reviews there, asked
+// again with the rest (npmReviewReader).
 async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[],
-  session?: { id: string; role: NpmReader['role'] }): Promise<T[] | null> {
+  session?: { id: string; role: NpmReader['role'] }, teamId?: string): Promise<T[] | null> {
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
@@ -3769,8 +4190,10 @@ async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse,
     const read = await eachOf([...asked], REVIEW_READS_AT_ONCE, ([, [name, version]]) => readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
     const documents = new Map([...asked.keys()].map((key, at) => [key, read[at] ?? null]))
     const packages = reviews.map(review => versionsOf(review).map(([name, version]) => documents.get(`${name}\0${version}`) ?? null))
-    const current = await npmReader(deps, cookie, packages.flat().flatMap(doc => doc?.private ? [doc.name] : []))
+    const current = teamId === undefined ? await npmReader(deps, cookie, packages.flat().flatMap(doc => doc?.private ? [doc.name] : []))
+      : await npmReviewReader(deps, cookie, teamId)
     if (!current || current.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    if ('readsTeam' in current && !current.readsTeam) { sendJson(res, 404, { error: 'no-team' }); return null }
     return reviews.filter((_, index) => packages[index]!.every(doc => doc && (!doc.private || canReadPrivateNpm(current, doc.name))))
   } catch (error) {
     if (controller.signal.aborted) return null
@@ -3808,13 +4231,16 @@ async function npmReviewPublicationLimit(deps: ManagedHttpDeps, reader: NpmReade
   return npmReviewVerdictLimit(doc, list, socket, risk)
 }
 
-// Reviews are scoped to the bytes actually displayed, including the base.
-// Access to both versions is rechecked before returning or saving annotations.
+// Reviews are scoped to the bytes actually displayed, including the base:
+// each change but a revocation loads both versions' files, of tarballs held
+// to their integrity and to their shasum where npm tells one (npm-loads.ts),
+// and the review keeps those shasums. Access to both versions is rechecked
+// before returning or saving annotations.
 async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, params: URLSearchParams): Promise<void> {
   const method = req.method ?? 'GET'
   if (!['GET', 'POST'].includes(method)) { send405(res, 'GET, POST'); return }
   const mutation = method !== 'GET'
-  const session = mutation ? await checkMutation(req, res, deps, cookie) : await readSession(deps.config, deps.db, cookie, Date.now())
+  const session = mutation ? await checkMutation(req, res, deps, cookie, { handed: true }) : await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true })
   if (!session) { if (!mutation) sendJson(res, 401, { error: 'unauthenticated' }); return }
   if (!roleAtLeast(session.user.role, mutation ? 'triage' : 'view')) { sendJson(res, 403, { error: 'forbidden' }); return }
   let body: Record<string, unknown> = {}
@@ -3889,10 +4315,14 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
       || (base && (base.version !== baseVersion || base.dist.integrity !== baseIntegrity))) {
       sendJson(res, 409, { error: 'review-content-changed' }); return
     }
-    if (change?.action === 'publish' || change?.action === 'save') {
-      const loads = [doc, ...base ? [base] : []].map(loadNpmFiles)
-      try {
-        const files = await Promise.all(loads.map(load => load.result))
+    // Each change but a revocation loads both versions' files; a save or a
+    // publication is held to them.
+    const loads = change && change.action !== 'revoke' ? [doc, ...base ? [base] : []].map(loadNpmFiles) : []
+    let tarballs: ReviewedTarballs | undefined
+    try {
+      const files = await Promise.all(loads.map(load => load.result))
+      if (loads.length > 0) tarballs = { shasum: doc.dist.shasum, baseShasum: base?.dist.shasum ?? null }
+      if (change?.action === 'publish' || change?.action === 'save') {
         const maps = files.map(list => new Map<string, unknown>(npmFileRows(list).map(([path, size, text, digest]) => [path, text ?? { format: 'digest', size, digest }])))
         const after = maps[0]!, before = maps[1] ?? new Map<string, unknown>()
         const diff = computeBundleDiff(before, after, () => '.')
@@ -3906,8 +4336,8 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
           change.files = changed.map(file => file.path)
           change.nonTextFiles = changed.filter(file => !reviewable(file)).map(file => file.path)
         }
-      } finally { loads.forEach(load => load.release()) }
-    }
+      }
+    } finally { loads.forEach(load => load.release()) }
     const limit = change?.action === 'publish' && change.final && change.final.status !== 'reject'
       ? await npmReviewPublicationLimit(deps, reader, doc, controller.signal) : 'accept'
     const current = await npmReader(deps, cookie, [doc, base].flatMap(item => item?.private ? [item.name] : []))
@@ -3926,7 +4356,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
     if (change.action === 'publish' && change.final && !allowedReviewVerdicts([], limit).includes(change.final.status)) {
       sendJson(res, 400, { error: limit === 'reject' ? 'review-malware' : 'review-critical-vulnerability' }); return
     }
-    const review = await deps.db.changeDependencyReview(context, checked.session.id, change, Date.now())
+    const review = await deps.db.changeDependencyReview(context, checked.session.id, change, Date.now(), tarballs)
     sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, current.userId, [review]))[0] })
   } catch (err) {
     if (controller.signal.aborted) return
@@ -3936,6 +4366,62 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   } finally { res.off('close', onClose) }
 }
 
+// GET /api/npm/deltas?versions=[[name, version, otherVersion], …]: the lines
+// each of up to MAX_ASKED_DELTAS versions changes against another, or
+// `(empty)`, as GET delta counts them, as lines of JSON as each is counted
+// (`{ name, version, otherVersion, …delta }`, or `{ name, version,
+// otherVersion, error, status }`), as a list's rows near the viewport ask
+// for them together (npm-delta.js), DELTAS_AT_ONCE at a time. Each read as
+// GET delta reads it, with the reader's access to its package, which is
+// checked again once it is counted: a private one's told only to a reader
+// who may still read it, none told to one whose session is gone.
+const MAX_ASKED_DELTAS = 50
+const DELTAS_AT_ONCE = 2
+async function handleNpmDeltas(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, params: URLSearchParams): Promise<void> {
+  if (req.method !== 'GET') { send405(res, 'GET'); return }
+  let asked: unknown = null
+  try { asked = JSON.parse(params.get('versions') ?? '') } catch {}
+  if (!Array.isArray(asked) || asked.length === 0 || asked.length > MAX_ASKED_DELTAS || !asked.every(item => Array.isArray(item) && item.length === 3
+    && isNpmPackageName(item[0]) && isNpmPackageSpec(item[1]) && (item[2] === '(empty)' || isNpmPackageSpec(item[2])))) { sendJson(res, 400, { error: 'bad-package' }); return }
+  const versions = asked as [string, string, string][]
+  const reader = await npmReader(deps, cookie, [...new Set(versions.map(([name]) => name))], { handed: true })
+  if (reader == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  const controller = new AbortController()
+  res.once('close', () => { if (!res.writableEnded) controller.abort() })
+  res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+  const kept = npmDeltaStore<NpmDelta>(deps.db, deps.config.debug), keptVersions = npmVersionStore(deps.db, deps.config.debug)
+  const out = openLines(res)
+  let stopped = false
+  await eachOf(versions, DELTAS_AT_ONCE, async ([name, version, otherVersion]) => {
+    if (stopped || controller.signal.aborted) return
+    const asOne = { name, version, otherVersion }
+    let isPrivate = false, line: Record<string, unknown>
+    try {
+      const privileged = canReadPrivateNpm(reader, name)
+      const together = otherVersion === '(empty)' ? keptVersions : readTogether(keptVersions, [{ name, version }, { name, version: otherVersion }])
+      const [doc, old] = await Promise.all([readNpmVersion(name, version, privileged, controller.signal, together).then(found),
+        otherVersion === '(empty)' ? null : readNpmVersion(name, otherVersion, privileged, controller.signal, together).then(found)])
+      isPrivate = doc.private || old?.private === true
+      const side = (of: NpmVersionDocument) => ({ integrity: of.dist.integrity, files: async () => {
+        const load = loadNpmFiles(of)
+        try { return await load.result } finally { load.release() }
+      } })
+      line = { ...asOne, ...await npmDelta(old ? side(old) : null, side(doc), kept) }
+    } catch (err) {
+      if (controller.signal.aborted) return
+      if (!(err instanceof NpmPackageError)) console.warn('managed: a package delta failed:', err)
+      line = err instanceof NpmPackageError ? { ...asOne, error: err.message, status: err.status } : { ...asOne, error: 'delta-failed', status: 500 }
+    }
+    // A reader who lost their session, or their access to a private one,
+    // while it was counted, is told nothing of it.
+    const current = await npmReader(deps, cookie, isPrivate ? [name] : [])
+    if (current == null) { stopped = true; out.cut(); return }
+    if (isPrivate && !canReadPrivateNpm(current, name)) line = { ...asOne, error: 'package-not-found', status: 404 }
+    if (!stopped && !await out.write(line)) stopped = true
+  })
+  if (!stopped) await out.end()
+}
+
 // GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only,risk,comparison}. Only readers with private access
 // (canReadPrivateNpm) can be answered from the server's npm token; the rest get
 // what the registry answers anonymously, every time (see npm-packages.ts).
@@ -3956,7 +4442,7 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
   }
   const diffed = path === NPM_RENAME_DIFF_PATH && params.has('path') ? renameDiffRequest(params) : null
   if (path === NPM_RENAME_DIFF_PATH && params.has('path') && !diffed) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const reader = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
+  const reader = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName], { handed: true })
   if (reader == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
@@ -4201,7 +4687,7 @@ async function handleWorkspaceShare(req: IncomingMessage, res: ServerResponse, d
   const method = req.method ?? 'GET'
   const allowed = id ? ['PATCH', 'DELETE'] : ['GET', 'POST', 'DELETE']
   if (!allowed.includes(method)) { send405(res, allowed.join(', ')); return }
-  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now()) : await checkMutation(req, res, deps, cookie)
+  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now(), { handed: true }) : await checkMutation(req, res, deps, cookie, { handed: true })
   if (!s) { if (method === 'GET') sendJson(res, 401, { error: 'unauthenticated' }); return }
   if (!requireManageRole(res, s.user)) return
   const { db } = deps
@@ -4230,6 +4716,9 @@ async function handleWorkspaceShare(req: IncomingMessage, res: ServerResponse, d
 export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
   const { config, db, avatarStore, isShuttingDown, track } = deps
   const repositoryDiscovery = new RepositoryDiscovery(config)
+  // Kept reads' prunes run behind their writes: tracked, so the database
+  // outlives them, and on serverless kept alive past the answer.
+  ownKeptPrunes(db, prune => { track(prune); deps.waitUntil?.(prune) })
 
   async function route(req: IncomingMessage, res: ServerResponse): Promise<void> {
     const url = new URL(req.url ?? '/', 'http://localhost')
@@ -4329,6 +4818,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const managedDataPath = underPrefix(path, MANAGED_DATA_PREFIXES)
     const workspaceSession = managedDataPath ? await readWorkspaceSession(res, deps, cookie) : null
     if (managedDataPath && !workspaceSession) return
+    // What it read, for the handler's own first read to take.
+    if (workspaceSession) handOverSession(cookie, workspaceSession)
     const issueRoute = /^\/api\/teams\/([^/]+)\/issues$/u.exec(path)
     if (issueRoute) {
       await handleWorkspaceIssue(req, res, deps, cookie, decodeURIComponent(issueRoute[1]!), url.searchParams); return
@@ -4341,8 +4832,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path === '/api/admin/links') {
       if (!config.allowShare) { sendJson(res, 404, { error: 'sharing-disabled' }); return }
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readSession(config, db, cookie, Date.now())
-      if (!s) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+      const s = workspaceSession!
       if (!requireManageRole(res, s.user)) return
       const shares = await db.listManagedWorkspaceShares(s.session.id, Date.now())
       sendJson(res, shares ? 200 : 403, shares ? { shares } : { error: 'forbidden' }); return
@@ -4360,8 +4850,6 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // sign-in account's. A linked account's is served by its own id.
     if (path.startsWith(AVATAR_PREFIX)) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readSession(config, db, cookie, Date.now())
-      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
       const id = path.slice(AVATAR_PREFIX.length)
       if (AGENT_AVATARS.has(id) && AGENT_AVATAR.test(id)) { await serveAgentAvatar(res, avatarStore, id); return }
       await serveAvatar(res, avatarStore, id, url.searchParams.has('own') ? id : await db.getAvatarKey(id))
@@ -4374,9 +4862,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
     if (path === ADMIN_USERS_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readSession(config, db, cookie, Date.now())
-      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-      if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
+      if (workspaceSession!.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
       sendJson(res, 200, { users: await db.listUsers() })
       return
     }
@@ -4548,13 +5034,17 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const teamFeed = /^\/api\/teams\/([^/]+)\/feed$/u.exec(path)
     if (teamFeed || path === '/api/teams/feed') {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readWorkspaceSession(res, deps, cookie)
-      if (!s) return
+      const s = workspaceSession!
       const teamId = teamFeed?.[1] ?? null
       const reportId = url.searchParams.get('reportId')
       if (teamId) await teamSnapshot(db, s.session.id, teamId, reportId)
       await serveUserTeamFeed(res, deps, s.session.id, s.user, teamId, { reportId }); return
     }
+    const teamDependencies = /^\/api\/teams\/([^/]+)\/dependencies$/u.exec(path)
+    if (teamDependencies) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleTeamDependencies(res, deps, cookie, workspaceSession!, teamDependencies[1]!, url.searchParams); return
+    }
     const teamFixes = /^\/api\/teams\/([^/]+)\/fixes$/u.exec(path)
     if (teamFixes) {
       if (method !== 'GET') { send405(res, 'GET'); return }
@@ -4568,10 +5058,10 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       await recheckTeam(db, workspaceSession!.session.id, snapshot)
       sendJson(res, 200, annotations); return
     }
-    const teamReports = /^\/api\/teams\/([^/]+)\/reports$/u.exec(path)
+    const teamReports = /^\/api\/teams\/([^/]+)\/(reports|trees)$/u.exec(path)
     if (teamReports) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleTeamReports(res, deps, workspaceSession!.session, teamReports[1]!, url.searchParams.get('reportId')); return
+      await handleTeamReports(res, deps, workspaceSession!.session, teamReports[1]!, url.searchParams.get('reportId'), teamReports[2] as 'reports' | 'trees'); return
     }
     if (path === REPORT_QUERY_PATH) {
       if (method !== 'POST') { send405(res, 'POST'); return }
@@ -4639,8 +5129,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
     if (path === '/api/npm/reviews/latest') {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readWorkspaceSession(res, deps, cookie)
-      if (!s) return
+      const s = workspaceSession!
       const integrity = url.searchParams.get('integrity'), name = url.searchParams.get('package'), version = url.searchParams.get('version')
       if (!isNpmPackageName(name) || !isNpmPackageSpec(version) || !integrity || integrity.length > 1024) {
         sendJson(res, 400, { error: 'bad-review-context' }); return
@@ -4652,7 +5141,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
     if (path === '/api/npm/reviews/discard') {
       if (method !== 'POST') { send405(res, 'POST'); return }
-      const s = await checkMutation(req, res, deps, cookie)
+      const s = await checkMutation(req, res, deps, cookie, { handed: true })
       if (!s) return
       let body: Record<string, unknown>
       try {
@@ -4669,8 +5158,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
     if (path === '/api/npm/reviews/mine') {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readWorkspaceSession(res, deps, cookie)
-      if (!s) return
+      const s = workspaceSession!
       const id = url.searchParams.get('beforeId'), time = url.searchParams.get('beforeTime')
       if ((time !== null || id !== null) && (time === null || !/^\d+$/u.test(time) || !Number.isSafeInteger(Number(time)) || !id || id.length > 100)) {
         sendJson(res, 400, { error: 'bad-review-cursor' }); return
@@ -4684,8 +5172,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // Dependencies tab lists them, fifty a page.
     if (path === '/api/npm/reviews/team') {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const s = await readWorkspaceSession(res, deps, cookie)
-      if (!s) return
+      const s = workspaceSession!
       const id = url.searchParams.get('beforeId'), teamId = url.searchParams.get('teamId'), time = url.searchParams.get('beforeTime')
       if (!teamId || teamId.length > 100) { sendJson(res, 400, { error: 'bad-team' }); return }
       if ((time !== null || id !== null) && (time === null || !/^\d+$/u.test(time) || !Number.isSafeInteger(Number(time)) || !id || id.length > 100)) {
@@ -4693,16 +5180,15 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       }
       const page = await deps.db.listTeamDependencyReviews(teamId, s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
       if (!page) { sendJson(res, 404, { error: 'no-team' }); return }
-      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user)
-      if (!reviews) return
       // Its access asked again, as it may have been taken while npm was read.
-      if (!await deps.db.readsTeamDependencyReviews(teamId, s.user.id)) { sendJson(res, 404, { error: 'no-team' }); return }
-      sendJson(res, 200, { ...page, reviews })
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews, s.user, teamId)
+      if (reviews) sendJson(res, 200, { ...page, reviews })
       return
     }
     if (path === '/api/npm/reviews') {
       await handleNpmReviews(req, res, deps, cookie, url.searchParams); return
     }
+    if (path === NPM_DELTAS_PATH) { await handleNpmDeltas(req, res, deps, cookie, url.searchParams); return }
     if (NPM_PATHS.has(path)) {
       await handleNpm(req, res, deps, cookie, path, url.searchParams); return
     }
@@ -4712,12 +5198,15 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     sendJson(res, 404, { error: 'not-found' }, { connection: 'close' })
   }
 
-  return (req, res) => {
+  // Each request's time told in its Server-Timing header (request-timing.ts).
+  return (req, res) => runTimed(res, () => {
     if (isShuttingDown()) { sendJson(res, 503, { error: 'shutting-down' }, { connection: 'close' }); return }
     if (!deps.originGate.isOriginAllowed(req)) { sendJson(res, 403, { error: 'origin-denied' }); return }
     // Feeds lease a connection per poll, never across streaming sleeps. This
-    // also covers capability-authenticated feeds handled by public-workspace.
-    const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '')
+    // also covers capability-authenticated feeds handled by public-workspace;
+    // and a team's dependencies and npm's deltas, streamed as GitHub and npm
+    // are waited on, lease one a statement.
+    const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '') || /^\/api\/(?:teams\/[^/?]+\/dependencies|npm\/deltas)(?:\?|$)/u.test(req.url ?? '')
     const serve = () => runRequestPresence(() => db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res))
     const work = runViewing(viewToken(config, req.headers.cookie) != null, serve).catch((err) => {
       if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
@@ -4727,5 +5216,5 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     })
     track(work)
     return work
-  }
+  })
 }