@wardby/cli 0.6.0 → 0.7.0

package/dist/providers/coding-proxy/registry/service.js

@@ -11,11 +11,15 @@
 import { createHash } from "node:crypto";
 import { logger } from "../../../core/logger.js";
 import { matchRoot, parseAllowlist, resolvePolicy } from "../../../coding/registry/allowlist.js";
-import { PLAN_REFUSAL_FILENAME } from "../../../coding/registry/report.js";
+import { acceptedAdvisoriesReason, LISTING_REFUSAL_FILENAME, PLAN_REFUSAL_FILENAME, } from "../../../coding/registry/report.js";
+import { GRAPH_INCOMPLETE, GRAPH_LIMIT, graphIncompleteMessage, graphLimitMessage, notAllowedMessage, notAllowedPendingMessage, PACKAGE_NOT_ALLOWED, PACKAGE_NOT_ALLOWED_PENDING, refusalHint, } from "../../../coding/registry/refusal-hints.js";
 import { RegistryError, } from "../../../coding/registry/types.js";
 import { capabilityHash } from "../proxy.js";
+import { DEPENDENCY_CACHE_ECOSYSTEM, MAX_DEPENDENCY_CACHE_LOCK_HASHES, sha256Hex } from "../dependency-cache/key.js";
 import { boundedMetadataFetch, DEFAULT_MAX_METADATA_BYTES, DEFAULT_METADATA_TIMEOUT_MS } from "./bounded-fetch.js";
+import { parseLockfileOffThread } from "./lockfile-parse.js";
 import { DEFAULT_PLAN_MAX_ENTRIES, DEFAULT_PLAN_TIMEOUT_MS, verifyLockfilePlan } from "./plan.js";
+import { AUDITED_VIA_UNKNOWN } from "./store.js";
 const registryLog = logger.child({ module: "coding-registry" });
 /** Server-side record of a registry failure. The worker only ever sees the
  *  RegistryError's code and message; the operator needs the cause. Without
@@ -57,9 +61,26 @@ const GRAPH_WALK_CONCURRENCY = 2;
  *  walk cannot starve the others' upstream fetches -- or the proxy's event
  *  loop: parsing packuments is CPU work on the same loop that carries model
  *  traffic (per-walk 2 and global 3 since a live install at 4/6 on 500m
- *  expired a ledger transaction). The walk is only the fallback now; lockfile
- *  verification answers most installs without it. */
+ *  expired a ledger transaction). The walk is only the fallback now: a
+ *  download of a version the run has not resolved starts one (and a
+ *  metadata miss, only after a failed or partial lockfile plan), and
+ *  lockfile verification answers most of those without it. */
 export const DEFAULT_MAX_GRAPH_CONCURRENCY = 3;
+/** Byte budget of the graph walk's memo of expanded packages (kept
+ *  versions and their declared dependencies), across every run. */
+export const DEFAULT_GRAPH_MEMO_BYTES = 32 * 1024 * 1024;
+/** How long a memoized expansion is reused. Safe for that long: a kept
+ *  version depends on the release-age cutoff, which only moves forward (a
+ *  stale entry can only omit a version that has since become old enough,
+ *  which fails closed), and on the OSV audit, which is itself cached for an
+ *  hour (audit.ts). The walk's view of advisories can therefore lag by the
+ *  audit cache TTL plus 15 minutes; that only affects which names the walk
+ *  allows, because every served version is re-audited through keptVersions
+ *  and malware is never allowed. A version published upstream within the TTL is
+ *  too new to be kept under any non-zero minReleaseAgeDays; with
+ *  minReleaseAgeDays 0 it is omitted until the entry expires (fails
+ *  closed). */
+export const GRAPH_MEMO_TTL_MS = 15 * 60_000;
 /** A node whose metadata or audit fails transiently is retried once more
  *  in the same walk, then parked; a later miss retries it again, up to
  *  this many attempts per node per run. */
@@ -82,6 +103,17 @@ export const DEFAULT_PLAN_MAX_PER_RUN = 20;
 export const PLAN_FETCH_FILENAME = PLAN_REFUSAL_FILENAME;
 /** Largest lockfile a plan reads (the HTTP layer enforces it: 413). */
 export const MAX_PLAN_BODY_BYTES = 20 * 1024 * 1024;
+/** Approximate retained size of a memoized expansion, for the memo's byte
+ *  budget. Deliberately generous. */
+function keptBytes(key, kept) {
+    let bytes = 128 + 2 * key.length;
+    for (const [version, dependencies] of kept) {
+        bytes += 64 + 2 * version.length;
+        for (const spec of dependencies)
+            bytes += 48 + 2 * (spec.name.length + spec.range.length);
+    }
+    return bytes;
+}
 /** A small counting semaphore. */
 class Slots {
     size;
@@ -108,10 +140,92 @@ class Slots {
     }
 }
 const edgeKey = (edge) => `${edge.name}\0${edge.range}`;
+/** Whether a parked failure may be retried. */
+function retriable(walk, name) {
+    return (walk.attempts.get(name) ?? 0) < MAX_GRAPH_NODE_ATTEMPTS;
+}
+/** Names with an edge the walk has not expanded yet: pending, or parked in
+ *  `failed` with attempts left. Read only between batches (a running
+ *  batch is off the queue). */
+function unexpandedNames(walk) {
+    const names = new Set(walk.pending.keys());
+    for (const name of walk.failed.keys())
+        if (retriable(walk, name))
+            names.add(name);
+    return names;
+}
+/** Packages walked so far, and the distinct names with an unexpanded edge
+ *  that are not yet expanded themselves (a further edge to an expanded
+ *  package adds no new package). */
+function walkProgress(walk) {
+    const queued = unexpandedNames(walk);
+    for (const name of walk.expandedVersions.keys())
+        queued.delete(name);
+    return { walked: walk.expandedVersions.size, queued: queued.size };
+}
+/** Unexpanded edges, for the progress log. */
+function unexpandedEdgeCount(walk) {
+    let count = 0;
+    for (const edges of walk.pending.values())
+        count += edges.length;
+    for (const [name, entry] of walk.failed)
+        if (retriable(walk, name))
+            count += entry.edges.length;
+    return count;
+}
+/** Adds edges to `name`'s pending group (at the end of the order, or at
+ *  the front with `first`). */
+function addPending(walk, name, edges, first = false) {
+    const group = walk.pending.get(name);
+    if (group) {
+        group.push(...edges);
+        if (first)
+            moveToFront(walk, name);
+        return;
+    }
+    walk.pending.set(name, [...edges]);
+    if (first)
+        walk.order.unshift(name);
+    else
+        walk.order.push(name);
+}
+function moveToFront(walk, name) {
+    const index = walk.order.indexOf(name);
+    if (index <= 0)
+        return;
+    walk.order.splice(index, 1);
+    walk.order.unshift(name);
+}
 export const DEFAULT_MAX_REFUSAL_RECORDS = 500;
+/** The most refusals `GET /registry/-/refusals` returns (distinct, newest first). */
+export const MAX_LISTED_REFUSALS = 20;
+const DEFAULT_REFUSALS_WINDOW_MS = 15 * 60_000;
 function contentTypeOf(route) {
     return route.kind === "file-metadata" ? "text/plain" : "application/octet-stream";
 }
+/**
+ * Why kept versions leave nothing to download, or null when some file is
+ * servable: every allowed file newer than the release-age limit
+ * (`wardby_version_filtered`), or no allowed file at all, such as a Python
+ * package with only source distributions (`wardby_file_not_allowed`).
+ */
+export function unservableReason(meta, keep, keptFiles) {
+    let anyFile = false;
+    let anyAllowed = false;
+    for (const version of keep) {
+        for (const file of meta.versions.get(version)?.files ?? []) {
+            anyFile = true;
+            if (!file.allowed)
+                continue;
+            if (keptFiles.has(file.filename))
+                return null;
+            anyAllowed = true;
+        }
+    }
+    if (anyAllowed)
+        return "wardby_version_filtered";
+    return anyFile ? "wardby_file_not_allowed" : null;
+}
 export function errorResponse(error) {
     return {
         status: error.status,
@@ -217,6 +331,17 @@ export class RegistryService {
      *  across replicas. */
     inFlight = new Map();
     tallies = new Map();
+    /** Expanded packages of the graph walks (`runId\0ecosystem\0name`),
+     *  least recently used first, so a package reached again under a new
+     *  range, in a later request of the same run, is not read again.
+     *  Run-scoped by key: a package's kept versions depend on the run's
+     *  policy and allowlist range. Bounded to `graphMemoBytes`; entries
+     *  expire GRAPH_MEMO_TTL_MS after they are computed, and a run's entries
+     *  are dropped when the run is released. */
+    graphMemo = new Map();
+    /** Sum of the memo entries' `bytes`. */
+    graphMemoTotal = 0;
+    graphMemoBytes = DEFAULT_GRAPH_MEMO_BYTES;
     walkSlots;
     planSlots;
     versionUpstream;
@@ -237,6 +362,49 @@ export class RegistryService {
             maxBytes: MAX_VERSION_DOCUMENT_BYTES,
         });
     }
+    /**
+     * `GET /registry/-/refusals`: the run's recent refusals (package, code and the
+     * shared hint), for a client that does not print the registry's 403 body
+     * (pip, uv). Authenticated with the run's registry token. Names come from the
+     * run's own requests; nothing else (no URL, no token) is returned.
+     */
+    async refusals(request) {
+        try {
+            const context = await this.options.store.findRunByRegistryTokenHash(capabilityHash(request.token), this.now());
+            if (!context)
+                throw new RegistryError(401, "invalid_capability", "the registry token is not valid for a live run");
+            const since = request.since && !Number.isNaN(request.since.getTime())
+                ? request.since
+                : new Date(this.now().getTime() - DEFAULT_REFUSALS_WINDOW_MS);
+            const rows = await this.options.store.listRecentRefusals(context.runId, since, MAX_LISTED_REFUSALS * 5);
+            const seen = new Set();
+            const refusals = [];
+            for (const row of rows) {
+                const code = row.reason ?? "wardby_refused";
+                const key = `${row.ecosystem}\0${row.name}\0${row.version ?? ""}\0${code}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const hint = refusalHint(code);
+                refusals.push({
+                    ecosystem: row.ecosystem,
+                    name: row.name,
+                    ...(row.version ? { version: row.version } : {}),
+                    code,
+                    ...(hint ? { hint } : {}),
+                });
+                if (refusals.length >= MAX_LISTED_REFUSALS)
+                    break;
+            }
+            return { status: 200, contentType: "application/json", body: JSON.stringify({ refusals }) };
+        }
+        catch (error) {
+            logRegistryFailure("refusals", "-", error);
+            if (error instanceof RegistryError)
+                return errorResponse(error);
+            return errorResponse(new RegistryError(502, "wardby_upstream_error", "the package registry request failed"));
+        }
+    }
     /** `POST /registry/<ecosystem>/-/plan`: verifies a lockfile against the
      *  registry and approves exactly its verified, reachable name@version
      *  pairs for the run (plan.ts). Answers `{ approved, refused }`. */
@@ -263,6 +431,15 @@ export class RegistryService {
         if (!support || !auditVersions)
             throw new RegistryError(404, "wardby_plan_unsupported", `the ${adapter.id} registry does not verify lockfiles`);
         const tally = this.tally(context);
+        try {
+            return await this.runPlan(request, adapter, support, auditVersions, context, tally);
+        }
+        catch (error) {
+            (tally.planFallback ??= new Set()).add(adapter.id);
+            throw error;
+        }
+    }
+    async runPlan(request, adapter, support, auditVersions, context, tally) {
         if (tally.planning)
             throw new RegistryError(429, "wardby_plan_in_progress", "a lockfile plan is already running for this run; wait for it to finish");
         const maxPlans = this.options.planMaxPerRun ?? DEFAULT_PLAN_MAX_PER_RUN;
@@ -274,20 +451,32 @@ export class RegistryService {
             // The body is read only while a slot is held: a queued plan holds no
             // lockfile text, and at most `planConcurrency` bodies exist at once.
             return await this.planSlots.run(async () => {
-                const lockfile = support.parse(await request.readBody(), {
+                const body = await request.readBody();
+                // The dependency cache's lockHash: computed here, from the bytes the
+                // proxy itself verified, never from anything a client claims.
+                const lockHash = context.dependencyCache && adapter.id === DEPENDENCY_CACHE_ECOSYSTEM ? sha256Hex(body) : null;
+                const parseOptions = {
                     maxEntries: this.options.planMaxEntries ?? DEFAULT_PLAN_MAX_ENTRIES,
                     proxyRegistryUrl: `${this.options.proxyBase}${adapter.id}/`,
-                });
-                return this.verifyPlan(request, adapter, support, lockfile, auditVersions, context);
+                };
+                // A YAML or yarn lockfile is read in a worker thread with a time
+                // bound (lockfile-parse.ts); npm's JSON stays on the event loop.
+                const lockfile = support.parsesOffThread?.(body)
+                    ? await parseLockfileOffThread(adapter.id, body, parseOptions, {
+                        timeoutMs: this.options.planParseTimeoutMs,
+                        signal: request.signal,
+                    })
+                    : support.parse(body, parseOptions);
+                return this.verifyPlan(request, adapter, support, lockfile, auditVersions, context, lockHash);
             });
         }
         finally {
             tally.planning = false;
         }
     }
-    async verifyPlan(request, adapter, support, lockfile, auditVersions, context) {
+    async verifyPlan(request, adapter, support, lockfile, auditVersions, context, lockHash) {
         const entries = parseAllowlist(context.allowlist, this.options.adapters).get(adapter.id) ?? [];
-        const { minReleaseAgeDays } = resolvePolicy(context.policy);
+        const { minReleaseAgeDays, acceptedAdvisories } = resolvePolicy(context.policy);
         const timeoutMs = this.options.planTimeoutMs ?? DEFAULT_PLAN_TIMEOUT_MS;
         const signal = AbortSignal.any([AbortSignal.timeout(timeoutMs), request.signal]);
         const store = this.options.store;
@@ -306,6 +495,8 @@ export class RegistryService {
                 upstream: this.versionUpstream,
                 streamUpstream: this.options.upstream,
                 audit: (versions, auditSignal) => auditVersions(adapter, versions, auditSignal),
+                accepted: new Set(acceptedAdvisories),
+                auditMode: context.packageAudit,
                 hostAllowed: (url) => this.hostAllowed(adapter, url),
                 signal,
             });
@@ -318,7 +509,33 @@ export class RegistryService {
                 ? "the client went away before the lockfile was verified"
                 : `the lockfile was not verified within ${Math.round(timeoutMs / 1000)} s (REGISTRY_PLAN_TIMEOUT_MS); what was verified is kept, so try again`);
         }
-        await store.approveVersions(context.runId, adapter.id, result.approved);
+        // An approved name is proven part of the approved graph, so it is an
+        // allowance too: its metadata (which npm re-reads for packages already
+        // in the lockfile) is served without a graph walk. Written before the
+        // approvals: a name allowance left behind by a failed approval write is
+        // only what a walk would conclude.
+        // In package audit mode an approval outside the allowlist is an audited
+        // allowance, tagged with the top-level audited package that brought it
+        // (one of unknown relation with AUDITED_VIA_UNKNOWN, never itself).
+        const plain = result.approved.filter((v) => !v.audit || v.audit.relation === "allowed");
+        await store.addAllowances(context.runId, adapter.id, [...new Set(plain.map((v) => v.name))]);
+        const byVia = new Map();
+        for (const v of result.approved) {
+            if (!v.audit || v.audit.relation === "allowed")
+                continue;
+            const via = v.audit.relation === "unknown" ? AUDITED_VIA_UNKNOWN : (v.audit.via ?? v.name);
+            byVia.set(via, (byVia.get(via) ?? new Set()).add(v.name));
+        }
+        for (const [via, names] of byVia)
+            await store.addAuditedAllowances(context.runId, adapter.id, [...names], via);
+        // A registry whose approvals are names (PyPI) keeps every download on the
+        // usual per-file path: no exact version is served from an approval.
+        if (support.approves !== "names")
+            await store.approveVersions(context.runId, adapter.id, result.approved);
+        // A plan that refused anything leaves some lockfile packages without an
+        // allowance: metadata misses walk for the rest of the run.
+        if (result.refused.length > 0)
+            (this.tally(context).planFallback ??= new Set()).add(adapter.id);
         // Only verdicts about the registry's name@version itself answer later
         // downloads; a lockfile-dependent one (unreachable, an integrity or
         // source the lockfile claims) must not block the same version reached
@@ -327,12 +544,19 @@ export class RegistryService {
             .filter((refusal) => refusal.intrinsic)
             .map(({ name, version, code, reason, publishedAt }) => ({ name, version, code, reason, publishedAt })));
         await this.recordPlanRefusals(context, adapter, result.refused);
+        // Only a lockfile approved whole may be restored from the dependency
+        // cache; the store ignores it once the session is sealed or full. A plan
+        // that audited anything is never cached: a restore downloads nothing,
+        // so nothing it installs would be recorded.
+        if (lockHash && result.refused.length === 0 && result.audited === 0)
+            await store.recordDependencyCacheLockHash(context.runId, lockHash, MAX_DEPENDENCY_CACHE_LOCK_HASHES);
         return {
             status: 200,
             contentType: "application/json",
             body: JSON.stringify({
                 approved: result.approved.length,
                 refused: result.refused.map(({ name, version, code, reason }) => ({ name, version, code, reason })),
+                ...(context.packageAudit ? { audited: result.audited } : {}),
             }),
         };
     }
@@ -407,7 +631,9 @@ export class RegistryService {
                 }
                 if (request.method === "HEAD")
                     return { status: 200, contentType: contentTypeOf(route), body: "" };
-                return this.download(adapter, context, name, route, file, request.signal);
+                // The plan's waiver (if any) is recorded on the served row, and its
+                // audit verdict (audit-mode plans only) as the run's audit record.
+                return this.download(adapter, context, name, route, file, request.signal, acceptedAdvisoriesReason(approved.acceptedAdvisories), approved.audit);
             }
             // A version the plan definitively refused is answered from the plan,
             // with its code and reason: no metadata, no graph walk.
@@ -428,7 +654,7 @@ export class RegistryService {
                 throw new RegistryError(403, refused.code, `"${name}" ${route.version} was refused by this run's lockfile verification: ${refused.reason}`);
             }
         }
-        const root = await this.authorize(adapter, context, name);
+        const { root, audit } = await this.authorize(adapter, context, name, route.kind);
         let meta;
         try {
             // Only a metadata request renders a document; a download, the version
@@ -445,8 +671,10 @@ export class RegistryService {
         }
         let keep;
         let keptFiles;
+        let waivers;
+        let auditAdvisories;
         try {
-            ({ keep, keptFiles } = await this.keptVersions(adapter, context, meta, root));
+            ({ keep, keptFiles, waivers, auditAdvisories } = await this.keptVersions(adapter, context, meta, root));
         }
         catch (error) {
             // Every refusal gets a row, including one the run never chose: the
@@ -456,12 +684,37 @@ export class RegistryService {
             }
             throw error;
         }
+        if (route.kind === "metadata" && route.version !== undefined) {
+            // One version's document: the same checks as the whole package's,
+            // narrowed to that version.
+            const document = keep.has(route.version)
+                ? (adapter.renderVersion?.(meta, route.version, keptFiles, `${this.options.proxyBase}${adapter.id}/`) ?? null)
+                : null;
+            if (!document) {
+                await this.refuse(context, adapter, name, "wardby_version_filtered", {
+                    version: route.version,
+                    filename: `${route.version}.tgz`,
+                });
+                throw new RegistryError(404, "wardby_version_filtered", `"${name}" ${route.version} is outside the allowlisted range, newer than the release-age limit, has a high-severity advisory, or is not published`);
+            }
+            await this.allowServed(context, adapter, name, keptDependencies(adapter, meta, new Set([route.version])), audit);
+            return { status: 200, contentType: document.contentType, body: document.body };
+        }
         if (route.kind === "metadata") {
             if (keep.size === 0) {
                 await this.refuse(context, adapter, name, "wardby_version_filtered");
                 throw new RegistryError(404, "wardby_version_filtered", `every matching version of "${name}" is outside the allowlisted range, newer than the release-age limit, or has a high-severity advisory`);
             }
-            await this.options.store.addAllowances(context.runId, adapter.id, keptDependencies(adapter, meta, keep));
+            await this.allowServed(context, adapter, name, keptDependencies(adapter, meta, keep), audit);
+            // Versions kept but no file the client may download: a Python package
+            // published only as an sdist, or whose every wheel is newer than the
+            // release-age limit. The (empty) index is still served, and pip and uv
+            // only say "no versions", so the refusal is recorded to say why, marked
+            // as a listing's: the installer may not have needed it (see
+            // LISTING_REFUSAL_FILENAME for how it counts).
+            const unservable = unservableReason(meta, keep, keptFiles);
+            if (unservable)
+                await this.refuse(context, adapter, name, unservable, { filename: LISTING_REFUSAL_FILENAME });
             const document = adapter.renderMetadata(meta, keep, keptFiles, `${this.options.proxyBase}${adapter.id}/`);
             return { status: 200, contentType: document.contentType, body: document.body };
         }
@@ -474,7 +727,9 @@ export class RegistryService {
         // (route.filename), since keptFiles holds wheel filenames.
         const agedFile = route.kind === "file-metadata" ? route.filename : file?.filename;
         if (!file || !keep.has(file.version) || !agedFile || !keptFiles.has(agedFile)) {
-            await this.refuse(context, adapter, name, "wardby_version_filtered", file ?? undefined);
+            // A download that does not resolve is still a refusal of the version asked for, not of the whole
+            // name (which any version served later would clear; see summarizeRegistryFetches).
+            await this.refuse(context, adapter, name, "wardby_version_filtered", file ?? (route.kind === "download" ? { version: route.version, filename: route.filename } : undefined));
             const versionSuffix = route.kind === "download" ? ` ${route.version}` : "";
             throw new RegistryError(404, "wardby_version_filtered", `"${name}"${versionSuffix} is not available to this run`);
         }
@@ -492,7 +747,30 @@ export class RegistryService {
         // reservation, nothing recorded as served.
         if (request.method === "HEAD")
             return { status: 200, contentType: contentTypeOf(route), body: "" };
-        return this.download(adapter, context, name, route, file, request.signal);
+        // A version kept only by waiving accepted advisories records them on
+        // its served row. In package audit mode, a package outside the
+        // allowlist, or a version kept only past advisories (full), is recorded
+        // as the run's audit record.
+        const advisories = auditAdvisories.get(file.version) ?? [];
+        const verdict = audit
+            ? { ...audit, ...(advisories.length > 0 ? { advisories } : {}) }
+            : advisories.length > 0
+                ? { relation: "allowed", advisories }
+                : undefined;
+        return this.download(adapter, context, name, route, file, request.signal, acceptedAdvisoriesReason(waivers.get(file.version) ?? []), verdict);
+    }
+    /** The allowances serving a package's metadata grows: its kept versions'
+     *  dependencies, and, for an audited package, each tagged with the
+     *  top-level audited package that declared it (its own name for a
+     *  top-level one, which is also recorded for itself so its later
+     *  downloads read as top-level). */
+    async allowServed(context, adapter, name, dependencies, audit) {
+        const store = this.options.store;
+        if (!audit)
+            return store.addAllowances(context.runId, adapter.id, dependencies);
+        if (audit.relation === "top-level")
+            await store.addAuditedAllowances(context.runId, adapter.id, [name], name);
+        await store.addAuditedAllowances(context.runId, adapter.id, dependencies, audit.via ?? name);
     }
     hostAllowed(adapter, url) {
         try {
@@ -513,32 +791,71 @@ export class RegistryService {
         }
         return tally.served;
     }
-    async authorize(adapter, context, name) {
+    async authorize(adapter, context, name, kind) {
         const entries = parseAllowlist(context.allowlist, this.options.adapters).get(adapter.id) ?? [];
+        // A root keeps its own range in every mode: audit mode never serves a
+        // version an entry's range excludes (keptVersions applies root.range).
         const root = matchRoot(entries, name);
-        if (root || (await this.options.store.isAllowedDependency(context.runId, adapter.id, name)))
-            return root;
-        // Not a root and not yet an allowance: the name may still be in the
-        // approved graph, unrecorded only because the client never asked for
-        // its parent's metadata (a lockfile install requests tarballs
-        // directly). Resolve the graph before refusing.
+        if (root)
+            return { root };
+        const allowance = await this.options.store.findAllowance(context.runId, adapter.id, name);
+        if (allowance) {
+            if (allowance.auditedVia === null)
+                return { root: undefined };
+            if (allowance.auditedVia === AUDITED_VIA_UNKNOWN)
+                return { root: undefined, audit: { relation: "unknown" } };
+            return allowance.auditedVia === name
+                ? { root: undefined, audit: { relation: "top-level" } }
+                : { root: undefined, audit: { relation: "transitive", via: allowance.auditedVia } };
+        }
+        if (context.packageAudit) {
+            // Package audit mode: a miss is never refused and never walks; it is
+            // served (through every other check) and recorded. A download with
+            // no metadata first, or a metadata miss once a lockfile plan of the
+            // run fell back, cannot say how the package reached the run.
+            const fellBack = this.tally(context).planFallback?.has(adapter.id) ?? false;
+            return { root: undefined, audit: { relation: kind === "download" || fellBack ? "unknown" : "top-level" } };
+        }
+        // A package manager resolves top-down: it reads a parent's metadata,
+        // which records the parent's declared dependencies as allowances,
+        // before it asks for a child. A metadata request for a name that is
+        // neither a root nor an allowance is therefore refused at once, unless
+        // a lockfile plan of this run failed or refused an entry (then the
+        // lockfile's packages may lack allowances, and the miss walks).
+        if (kind !== "download" && !this.tally(context).planFallback?.has(adapter.id)) {
+            await this.refuse(context, adapter, name, PACKAGE_NOT_ALLOWED);
+            throw new RegistryError(403, PACKAGE_NOT_ALLOWED, notAllowedMessage(name, adapter.id, entries.length > 0));
+        }
+        // A download (or, after a failed or partial plan, a metadata request)
+        // that is not yet an allowance: the name may still be in the approved
+        // graph, unrecorded only because the client never asked for its
+        // parent's metadata (a lockfile install requests tarballs directly).
+        // Resolve the graph before refusing.
         const graph = await this.resolveInGraph(adapter, context, entries, name);
         if (graph === "found")
-            return undefined;
+            return { root: undefined };
         if (typeof graph === "object" && "cutShort" in graph) {
             if (graph.cutShort === "limit") {
                 // The bound is permanent for the rest of the run, so a retry can
                 // never succeed: answer with a definitive 4xx (npm does not retry
                 // it) rather than a 503 that a client or agent would retry forever.
                 // Still not "not allowed": the name was not proven absent.
-                await this.refuse(context, adapter, name, "wardby_graph_limit");
-                throw new RegistryError(403, "wardby_graph_limit", `"${name}" was not reached before this agent's ${adapter.id} dependency graph walk hit its package limit (REGISTRY_MAX_GRAPH_PACKAGES) for this run; retrying will not help: allowlist the package directly, or ask the operator to raise the limit`);
+                await this.refuse(context, adapter, name, GRAPH_LIMIT);
+                throw new RegistryError(403, GRAPH_LIMIT, graphLimitMessage(name, adapter.id, graph.limit));
             }
-            // Not proven absent, so never "not allowed": a timed-out walk resumes
-            // where it stopped on the next miss, so a retry (npm retries a 5xx on
-            // its own) can find the name.
-            await this.refuse(context, adapter, name, "wardby_graph_incomplete");
-            throw new RegistryError(503, "wardby_graph_incomplete", `"${name}" was not reached before this agent's ${adapter.id} dependency graph walk was cut short by its time limit (REGISTRY_GRAPH_TIMEOUT_MS); the walk continues where it stopped: try again`);
+            if (graph.frontier) {
+                // An expanded version declares the name and only its own versions
+                // are left to check: the walk resumes there on the next miss, so a
+                // retry (npm retries a 5xx on its own) can find it.
+                await this.refuse(context, adapter, name, GRAPH_INCOMPLETE);
+                throw new RegistryError(503, GRAPH_INCOMPLETE, graphIncompleteMessage(name, adapter.id, graph.progress));
+            }
+            // The walk never reached the name. Not proven absent, so not the
+            // final "not allowed", but definite (a 4xx npm does not retry): a
+            // later miss may still resume the walk and find it, which is no
+            // reason to keep the agent waiting on retries now.
+            await this.refuse(context, adapter, name, PACKAGE_NOT_ALLOWED_PENDING);
+            throw new RegistryError(403, PACKAGE_NOT_ALLOWED_PENDING, notAllowedPendingMessage(name, adapter.id, graph.progress));
         }
         if (typeof graph === "object") {
             // Some part of the graph could not be read, so whether the name is in
@@ -549,19 +866,18 @@ export class RegistryService {
             await this.refuse(context, adapter, name, code);
             throw new RegistryError(status, code, `"${name}" could not be checked against this agent's approved ${adapter.id} dependency graph because ${source} was unavailable while resolving it; try again`);
         }
-        await this.refuse(context, adapter, name, "wardby_package_not_allowed");
-        const hint = entries.length === 0
-            ? `this agent has no ${adapter.id} package allowlist`
-            : `"${name}" is not on this agent's ${adapter.id} package allowlist or in its dependency graph`;
-        throw new RegistryError(403, "wardby_package_not_allowed", hint);
+        await this.refuse(context, adapter, name, PACKAGE_NOT_ALLOWED);
+        throw new RegistryError(403, PACKAGE_NOT_ALLOWED, notAllowedMessage(name, adapter.id, entries.length > 0));
     }
     /** Whether `name` is in the run's approved graph for this ecosystem:
      *  the allowlist's exact roots plus the dependencies of every kept
      *  version (the same filter the metadata path applies: root range,
      *  release age, advisories), transitively. Each newly found name is
      *  recorded as an allowance as the walk goes, exactly as if its
-     *  parent's metadata had been served. A scoped wildcard root cannot be
-     *  enumerated, so it is never a starting point. */
+     *  parent's metadata had been served. Only a download asks, or a
+     *  metadata miss after a failed or partial lockfile plan (see
+     *  `authorize`). A scoped wildcard root cannot be enumerated, so it is
+     *  never a starting point. */
     async resolveInGraph(adapter, context, entries, name) {
         if (!adapter.dependenciesInMetadata)
             return "absent";
@@ -573,13 +889,16 @@ export class RegistryService {
             const edges = roots.map((root) => ({ name: root, range: "*" }));
             walk = {
                 found: new Set(roots),
-                queue: edges,
+                order: [],
+                pending: new Map(),
                 seen: new Set(edges.map(edgeKey)),
                 expandedVersions: new Map(),
                 exhausted: false,
                 attempts: new Map(),
                 failed: new Map(),
             };
+            for (const edge of edges)
+                addPending(walk, edge.name, [edge]);
             tally.graphs.set(adapter.id, walk);
         }
         const current = walk;
@@ -588,7 +907,11 @@ export class RegistryService {
             if (current.found.has(name))
                 return "found";
             if (current.exhausted)
-                return { cutShort: "limit" };
+                return {
+                    cutShort: "limit",
+                    progress: walkProgress(current),
+                    limit: this.options.maxGraphPackages ?? DEFAULT_MAX_GRAPH_PACKAGES,
+                };
             // Single-flight: a miss while a walk is running waits for it rather
             // than starting a second one, then re-checks (that walk may have
             // stopped on finding a different name). Checked before the queue: a
@@ -597,17 +920,19 @@ export class RegistryService {
             // starts at most one walk of its own, so it spends at most one
             // round of retries on failed nodes.
             if (!current.running) {
-                const retriable = [...current.failed.keys()].some((key) => (current.attempts.get(key) ?? 0) < MAX_GRAPH_NODE_ATTEMPTS);
-                if (started || (current.queue.length === 0 && !retriable))
+                const anyRetriable = [...current.failed.keys()].some((key) => retriable(current, key));
+                if (started || (current.pending.size === 0 && !anyRetriable))
                     return this.graphMiss(current);
                 started = true;
                 current.running = this.walkGraph(adapter, context, entries, current, name).finally(() => {
                     current.running = undefined;
                 });
             }
-            const end = await current.running;
-            if (end === "timeout" && !current.found.has(name))
-                return { cutShort: "timeout" };
+            const result = await current.running;
+            // Read from the walk's own snapshot, never from the live walk: a
+            // miss in the meantime may have started the next walk already.
+            if (result.end === "timeout" && !current.found.has(name))
+                return { cutShort: "timeout", progress: result.progress, frontier: result.frontier?.has(name) ?? false };
         }
     }
     /** The answer for a name the walk did not find: unavailable while any
@@ -618,21 +943,42 @@ export class RegistryService {
             return "absent";
         return { unavailable: [...walk.failed.values()].some((entry) => entry.cause === "audit") ? "audit" : "upstream" };
     }
+    /** One walk, logged once when it stops, with its progress (and, on a
+     *  timeout, its frontier) taken before `running` is cleared. */
     async walkGraph(adapter, context, entries, walk, target) {
+        const startedAt = this.now().getTime();
+        const loadsBefore = walk.loads ?? 0;
+        const end = await this.expandGraph(adapter, context, entries, walk, target);
+        const progress = walkProgress(walk);
+        registryLog.info({
+            event: "registry.graph_walk",
+            runId: context.runId,
+            ecosystem: adapter.id,
+            end,
+            walked: progress.walked,
+            queued: progress.queued,
+            queuedEdges: unexpandedEdgeCount(walk),
+            loads: (walk.loads ?? 0) - loadsBefore,
+            durationMs: this.now().getTime() - startedAt,
+        }, "coding registry graph walk stopped");
+        return end === "timeout" ? { end, progress, frontier: unexpandedNames(walk) } : { end, progress };
+    }
+    async expandGraph(adapter, context, entries, walk, target) {
         const maxPackages = this.options.maxGraphPackages ?? DEFAULT_MAX_GRAPH_PACKAGES;
         const deadline = this.now().getTime() + (this.options.graphTimeoutMs ?? DEFAULT_GRAPH_TIMEOUT_MS);
-        // Parked failures with attempts left go first: a later miss is this
-        // walk's retry of them.
-        const retry = [...walk.failed.entries()].filter(([key]) => (walk.attempts.get(key) ?? 0) < MAX_GRAPH_NODE_ATTEMPTS);
-        for (const [key] of retry)
-            walk.failed.delete(key);
-        walk.queue.unshift(...retry.map(([, entry]) => entry.edge));
+        // Parked failures with attempts left go first (a later miss is this
+        // walk's retry of them), and the requested name before everything:
+        // order changes only how soon an answer comes, never which edges are
+        // followed or what they allow.
+        const retry = [...walk.failed.entries()].filter(([name]) => retriable(walk, name));
+        for (const [name] of retry)
+            walk.failed.delete(name);
+        for (const [name, entry] of retry.reverse())
+            addPending(walk, name, entry.edges, true);
+        if (walk.pending.has(target))
+            moveToFront(walk, target);
         const attemptsThisWalk = new Map();
-        // Per-walk memo: a walk lasts at most the graph timeout, well inside
-        // the metadata and audit cache lifetimes, so this changes no decision.
-        // A failed computation is not memoized, so its retry really retries.
-        const kept = new Map();
-        while (walk.queue.length > 0) {
+        while (walk.pending.size > 0) {
             if (walk.found.has(target))
                 return "found";
             if (walk.released)
@@ -645,65 +991,68 @@ export class RegistryService {
                 walk.exhausted = true;
                 return "limit";
             }
-            // Each edge adds at most one new package, so a batch no larger than
-            // the room left can never overshoot the bound.
-            const batch = walk.queue.splice(0, Math.min(GRAPH_WALK_CONCURRENCY, room));
-            const expansions = Promise.all(batch.map((edge) => this.graphNode(adapter, context, entries, edge, kept)));
+            // Each name adds at most one new package, so a batch no larger than
+            // the room left can never overshoot the bound. A name's node takes
+            // every edge pending for it.
+            const batch = walk.order.splice(0, Math.min(GRAPH_WALK_CONCURRENCY, room)).map((name) => {
+                const edges = walk.pending.get(name) ?? [];
+                walk.pending.delete(name);
+                return { name, edges };
+            });
+            const expansions = Promise.all(batch.map(({ name, edges }) => this.graphNode(adapter, context, entries, name, edges, walk)));
             let timer;
             const timedOut = new Promise((resolve) => {
                 timer = setTimeout(() => resolve("timeout"), remaining);
             });
             const results = await Promise.race([expansions, timedOut]).finally(() => clearTimeout(timer));
             if (results === "timeout") {
-                // Not expanded: put the batch back so a later miss retries it (its
-                // metadata is likely cached by then).
-                walk.queue.unshift(...batch);
+                // Not expanded: put the whole batch back, in order, so a later
+                // miss retries it (its node is likely memoized by then).
+                for (const { name, edges } of [...batch].reverse())
+                    addPending(walk, name, edges, true);
                 return "timeout";
             }
             const expanded = [];
-            batch.forEach((edge, index) => {
+            batch.forEach(({ name, edges }, index) => {
                 const result = results[index];
                 if (result.ok) {
-                    expanded.push({ edge, selected: result.selected });
+                    expanded.push({ name, edges, selected: result.selected });
                     return;
                 }
-                // A transient failure is never counted as expanded: the edge is
+                // A transient failure is never counted as expanded: the node is
                 // retried (once more in this walk, then by later misses) instead
                 // of silently closing its whole subtree for the run.
-                const key = edgeKey(edge);
-                walk.attempts.set(key, (walk.attempts.get(key) ?? 0) + 1);
-                attemptsThisWalk.set(key, (attemptsThisWalk.get(key) ?? 0) + 1);
-                if ((attemptsThisWalk.get(key) ?? 0) < GRAPH_NODE_ATTEMPTS_PER_WALK &&
-                    (walk.attempts.get(key) ?? 0) < MAX_GRAPH_NODE_ATTEMPTS)
-                    walk.queue.push(edge);
+                walk.attempts.set(name, (walk.attempts.get(name) ?? 0) + 1);
+                attemptsThisWalk.set(name, (attemptsThisWalk.get(name) ?? 0) + 1);
+                if ((attemptsThisWalk.get(name) ?? 0) < GRAPH_NODE_ATTEMPTS_PER_WALK && retriable(walk, name))
+                    addPending(walk, name, edges);
                 else
-                    walk.failed.set(key, { edge, cause: result.cause });
+                    walk.failed.set(name, { edges, cause: result.cause });
             });
             // A package joins the graph (and gets its allowance) only when some
             // kept version of it satisfies a range that reached it. Recorded
             // before it counts as found, so `found` never holds a name the store
             // would refuse.
-            const discovered = [
-                ...new Set(expanded
-                    .filter(({ edge, selected }) => selected.length > 0 && !walk.found.has(edge.name))
-                    .map(({ edge }) => edge.name)),
-            ];
+            const discovered = expanded
+                .filter(({ name, selected }) => selected.length > 0 && !walk.found.has(name))
+                .map(({ name }) => name);
             try {
                 if (discovered.length > 0)
                     await this.options.store.addAllowances(context.runId, adapter.id, discovered);
             }
             catch (error) {
-                // The store write failed: put the expanded edges back so a later
+                // The store write failed: put the expanded groups back so a later
                 // miss re-expands them, rather than leaving the graph silently short.
-                walk.queue.unshift(...expanded.map(({ edge }) => edge));
+                for (const { name, edges } of [...expanded].reverse())
+                    addPending(walk, name, edges, true);
                 throw error;
             }
             for (const name of discovered)
                 walk.found.add(name);
-            for (const { edge, selected } of expanded) {
-                let versions = walk.expandedVersions.get(edge.name);
+            for (const { name, selected } of expanded) {
+                let versions = walk.expandedVersions.get(name);
                 if (!versions)
-                    walk.expandedVersions.set(edge.name, (versions = new Set()));
+                    walk.expandedVersions.set(name, (versions = new Set()));
                 for (const { version, dependencies } of selected) {
                     if (versions.has(version))
                         continue;
@@ -713,45 +1062,43 @@ export class RegistryService {
                         if (walk.seen.has(key))
                             continue;
                         walk.seen.add(key);
-                        walk.queue.push(dependency);
+                        // A package parked after failing waits with its edges and is
+                        // retried with them.
+                        const parked = walk.failed.get(dependency.name);
+                        if (parked)
+                            parked.edges.push(dependency);
+                        else
+                            addPending(walk, dependency.name, [dependency], dependency.name === target);
                     }
                 }
             }
         }
         return walk.found.has(target) ? "found" : "complete";
     }
-    /** The kept versions of one package inside the edge's range, and each
-     *  one's declared dependencies, through the same metadata cache and
-     *  `keptVersions` filter the metadata path uses (a root's allowlist range
-     *  applies there), within the process-wide walk concurrency cap. `"*"`
-     *  selects every kept version; a range no kept version satisfies selects
-     *  none. A package npm doesn't have, or whose metadata is too large,
-     *  definitively selects nothing; any other failure (upstream error or
-     *  timeout, audit unavailable) is transient and reported for retry. */
-    graphNode(adapter, context, entries, edge, memo) {
+    /** The kept versions of one package inside any of the ranges that reached
+     *  it, and each one's declared dependencies, through the same metadata
+     *  cache and `keptVersions` filter the metadata path uses (a root's
+     *  allowlist range applies there), within the process-wide walk
+     *  concurrency cap. A `"*"` edge selects every kept version; a range no
+     *  kept version satisfies selects none. A package npm doesn't have, or
+     *  whose metadata is too large, definitively selects nothing; any other
+     *  failure (upstream error or timeout, audit unavailable) is transient
+     *  and reported for retry. */
+    graphNode(adapter, context, entries, name, edges, walk) {
         return this.walkSlots.run(async () => {
             try {
-                let load = memo.get(edge.name);
-                if (!load) {
-                    load = (async () => {
-                        const meta = await this.metadata(adapter, edge.name, false);
-                        const { keep } = await this.keptVersions(adapter, context, meta, matchRoot(entries, edge.name));
-                        return new Map([...keep].map((version) => [version, versionDependencies(adapter, meta, version)]));
-                    })();
-                    memo.set(edge.name, load);
-                    load.catch(() => memo.delete(edge.name));
-                }
-                const keep = await load;
-                const inRange = (version) => {
-                    if (edge.range === "*")
+                const keep = await this.keptForGraph(adapter, context, entries, name, walk);
+                const ranges = [...new Set(edges.map((edge) => edge.range))];
+                const inRange = (version) => ranges.some((range) => {
+                    if (range === "*")
                         return true;
                     try {
-                        return adapter.satisfies(version, edge.range);
+                        return adapter.satisfies(version, range);
                     }
                     catch {
                         return false;
                     }
-                };
+                });
                 const selected = [];
                 for (const [version, dependencies] of keep)
                     if (inRange(version))
@@ -766,6 +1113,56 @@ export class RegistryService {
             }
         });
     }
+    /** A package's kept versions for the run's walk, from the memo or
+     *  computed (and memoized). A failed computation is not memoized, so its
+     *  retry really retries. */
+    async keptForGraph(adapter, context, entries, name, walk) {
+        const key = `${context.runId}\0${adapter.id}\0${name}`;
+        const now = this.now().getTime();
+        const memoized = this.graphMemo.get(key);
+        if (memoized) {
+            this.dropMemo(key);
+            if (memoized.expires > now) {
+                this.putMemo(key, memoized); // most recently used
+                return memoized.kept;
+            }
+        }
+        if (walk)
+            walk.loads = (walk.loads ?? 0) + 1;
+        const meta = await this.metadata(adapter, name, false);
+        const { keep } = await this.keptVersions(adapter, context, meta, matchRoot(entries, name));
+        const kept = new Map([...keep].map((version) => [version, versionDependencies(adapter, meta, version)]));
+        // A run released meanwhile (its walk stopped) keeps nothing here.
+        if (this.tallies.has(context.runId))
+            this.memoize(key, kept);
+        return kept;
+    }
+    dropMemo(key) {
+        const entry = this.graphMemo.get(key);
+        if (!entry)
+            return;
+        this.graphMemo.delete(key);
+        this.graphMemoTotal -= entry.bytes;
+    }
+    putMemo(key, entry) {
+        this.graphMemo.set(key, entry);
+        this.graphMemoTotal += entry.bytes;
+    }
+    /** Memoizes an expansion, least recently used evicted first, within the
+     *  byte budget. An entry larger than the whole budget is not kept. */
+    memoize(key, kept) {
+        const now = this.now().getTime();
+        for (const [memoKey, entry] of this.graphMemo)
+            if (entry.expires <= now)
+                this.dropMemo(memoKey);
+        this.dropMemo(key);
+        const bytes = keptBytes(key, kept);
+        if (bytes > this.graphMemoBytes)
+            return;
+        while (this.graphMemo.size > 0 && this.graphMemoTotal + bytes > this.graphMemoBytes)
+            this.dropMemo(this.graphMemo.keys().next().value);
+        this.putMemo(key, { expires: now + GRAPH_MEMO_TTL_MS, bytes, kept });
+    }
     /** A package's metadata, cached. `render` asks for the form
      *  `renderMetadata` can serve; a cached entry fetched without it (by the
      *  graph walk or a download) is fetched again with it, and replaces it. */
@@ -836,11 +1233,20 @@ export class RegistryService {
         this.putCached(key, { expires: now + this.metadataTtlMs, bytes, meta });
     }
     async keptVersions(adapter, context, meta, root) {
-        const { minReleaseAgeDays } = resolvePolicy(context.policy);
+        const { minReleaseAgeDays, acceptedAdvisories } = resolvePolicy(context.policy);
+        // Package audit mode `full` lets non-malware blocking advisories through;
+        // malware is withheld whatever the mode (audit.ts splitWaived).
+        const auditAll = context.packageAudit === "full";
         const cutoff = this.now().getTime() - minReleaseAgeDays * DAY_MS;
+        // The run's accepted advisories waive the blocking ones they name
+        // (never malware); fixed for the run (snapshotted at dispatch).
+        const accepted = new Set(acceptedAdvisories);
         const advisories = await this.options.audit.audit(adapter, meta.name);
         const keep = new Set();
         const keptFiles = new Set();
+        /** Kept version -> the advisories waived to keep it (only non-empty). */
+        const waivers = new Map();
+        const auditAdvisories = new Map();
         for (const info of meta.versions.values()) {
             if (root?.range && !adapter.satisfies(info.version, root.range))
                 continue;
@@ -850,13 +1256,23 @@ export class RegistryService {
             const oldEnough = info.files.filter((file) => file.publishedAt && file.publishedAt.getTime() <= cutoff);
             if (oldEnough.length === 0)
                 continue;
-            if (advisories.withheld(info.version).length > 0)
+            if (advisories.withheld(info.version, accepted, auditAll).length > 0)
                 continue;
             keep.add(info.version);
+            if (auditAll) {
+                const audited = advisories.audited?.(info.version, accepted) ?? [];
+                if (audited.length > 0)
+                    auditAdvisories.set(info.version, [...audited]);
+            }
             for (const file of oldEnough)
                 keptFiles.add(file.filename);
+            if (accepted.size > 0) {
+                const waived = advisories.waived(info.version, accepted);
+                if (waived.length > 0)
+                    waivers.set(info.version, waived);
+            }
         }
-        return { keep, keptFiles };
+        return { keep, keptFiles, waivers, auditAdvisories };
     }
     tally(context) {
         const now = this.now().getTime();
@@ -896,6 +1312,10 @@ export class RegistryService {
         for (const walk of tally.graphs?.values() ?? [])
             walk.released = true;
         tally.graphs?.clear();
+        const prefix = `${runId}\0`;
+        for (const key of [...this.graphMemo.keys()])
+            if (key.startsWith(prefix))
+                this.dropMemo(key);
     }
     /** Releases every run's in-process state (timers included), e.g. when the
      *  server shuts down. */
@@ -972,7 +1392,40 @@ export class RegistryService {
             extras.add(extra);
         return [...extras].sort();
     }
-    async download(adapter, context, name, route, file, signal) {
+    /** One RegistryAuditRecord (the first served file of a version wins) and
+     *  its `registry.audited` log line. */
+    async recordAudit(context, adapter, name, version, sizeBytes, audit) {
+        const advisories = audit.advisories ?? [];
+        await this.options.store.recordAudit({
+            runId: context.runId,
+            ecosystem: adapter.id,
+            name,
+            version,
+            relation: audit.relation,
+            ...(audit.via ? { via: audit.via } : {}),
+            sizeBytes,
+            advisories,
+        });
+        registryLog.info({
+            event: "registry.audited",
+            runId: context.runId,
+            ecosystem: adapter.id,
+            name,
+            version,
+            sizeBytes,
+            relation: audit.relation,
+            ...(audit.via ? { via: audit.via } : {}),
+            mode: context.packageAudit,
+            advisories: advisories.map((advisory) => advisory.id),
+        }, "coding registry served a package under package audit mode");
+    }
+    async download(adapter, context, name, route, file, signal, 
+    /** The served row's reason: set only when serving it waived accepted
+     *  advisories (`accepted advisories: <ids>`). */
+    servedReason, 
+    /** Set when package audit mode is why it is served: recorded once the
+     *  file completes, beside its served row. */
+    audit) {
         const { limits, store } = this.options;
         const runId = context.runId;
         const served = await this.servedUsage(context);
@@ -1100,6 +1553,7 @@ export class RegistryService {
                             integrity: file.integrity ? `${file.integrity.algorithm}:${file.integrity.hex}` : undefined,
                             sizeBytes: bytes,
                             outcome: "served",
+                            ...(servedReason ? { reason: servedReason } : {}),
                         });
                         // Counted before release() drops the reservation, so no window
                         // exists where neither the tally nor inFlight holds this file.
@@ -1109,7 +1563,16 @@ export class RegistryService {
                             const body = Buffer.concat(buffered);
                             const extras = await this.allowedExtras(adapter, context, name);
                             const dependencies = (await adapter.dependenciesFromFile(route, body, extras).catch(() => [])).map((dependency) => ({ name: adapter.normalizeName(dependency.name), extras: dependency.extras }));
-                            await store.addAllowances(context.runId, adapter.id, dependencies.map((dependency) => dependency.name));
+                            const names = dependencies.map((dependency) => dependency.name);
+                            // A file's dependencies are audited too when the package is
+                            // outside the allowlist (never for one kept only past advisories).
+                            if (audit && audit.relation !== "allowed") {
+                                if (audit.relation === "top-level")
+                                    await store.addAuditedAllowances(context.runId, adapter.id, [name], name);
+                                await store.addAuditedAllowances(context.runId, adapter.id, names, audit.via ?? name);
+                            }
+                            else
+                                await store.addAllowances(context.runId, adapter.id, names);
                             // Dependency extras are followed only below a package the run
                             // allows with extras (an entry naming extras, or a dependency
                             // such a package asked for with extras): a plain entry follows
@@ -1117,6 +1580,10 @@ export class RegistryService {
                             if (extras.length > 0)
                                 await store.addExtraAllowances(context.runId, adapter.id, dependencies);
                         }
+                        // Recorded before the stream closes: a failed write errors it
+                        // like a failed served row, so nothing is installed unrecorded.
+                        if (audit)
+                            await this.recordAudit(context, adapter, name, file.version, bytes, audit);
                         controller.close();
                     }
                     catch (error) {