@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/repository-agents.ts

@@ -0,0 +1,220 @@
+// What the code viewer's Agents tab reconstructs agents' sessions
+// from (GET /api/admin/repositories/agents, common/managed/agent-tasks.ts):
+// a page of the repository's pull requests, the most recently updated first,
+// and of its default branch's commits, the newest first, those no pull
+// request merged; on the first page, its latest issues and the newest of
+// its agents' branches (GitHub lists branches by name alone, so every one an
+// agent's prefix names is read, as many as fifty pages of each, and the newest
+// kept). Each artifact's own texts (never comments: an agent links its
+// session in a pull request's body and its commits' messages) are read here
+// for the marks an agent leaves, and a pull request's labels for one naming
+// an agent, and those alone are answered, never the texts. GraphQL alone
+// gives them, so it needs a token.
+import { type AgentAuthor, type AgentBranch, type AgentCommit, type AgentIssue, type AgentPull, type AppAgent, agentSignals } from '../common/managed/agent-tasks.ts'
+import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { GithubApiError } from './github-app.ts'
+import { ACTOR, type NamedAccount, actorOf, commitAccount, githubGraphql } from './repository-history.ts'
+import { ISSUES_CURSOR } from './repository-issues.ts'
+
+export { APP_AGENTS }
+
+export const AGENT_PULLS_PAGE = 50
+export const AGENT_COMMITS_PAGE = 100
+const AGENT_ISSUES = 100
+const AGENT_BRANCHES = 500
+const MAX_BRANCH_PAGES = 50
+const CLOSES = 5
+// A pull request's labels read, for one naming an agent: GitHub's most a
+// page.
+const LABELS = 100
+const MAX_TITLE = 1000
+const MAX_NAME = 256
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+const SHA = /^[a-f\d]{40}$/u
+// The address Claude's own commits are authored with.
+const CLAUDE_EMAIL = 'noreply@anthropic.com'
+
+// The app agents' accounts' no-reply addresses, by each login of theirs.
+const AGENT_EMAILS = APP_AGENTS.flatMap(({ account }) => account?.logins.map(login => `${account.id}+${login}@users.noreply.github.com`) ?? [])
+
+// An agent's branches, a page at a time, as GitHub lists them, by name;
+// each its tip commit's time, message and author.
+const BRANCHES_QUERY = `query($owner: String!, $name: String!, $prefix: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    refs(refPrefix: $prefix, first: 100, after: $after) {
+      pageInfo { hasNextPage endCursor }
+      nodes { prefix name target { ... on Commit { committedDate message author { email user { login databaseId } } } } }
+    }
+  }
+}`
+// What a commit of the default branch is read by.
+const COMMIT_FIELDS = 'oid messageHeadline message committedDate additions deletions author { email user { login databaseId } } associatedPullRequests(first: 1) { totalCount }'
+// The newest of the default branch's commits the app agents' accounts
+// authored, by their GitHub no-reply addresses, however far back: a bot's
+// commits pushed with no pull request here (as before a repository moved)
+// may lie deeper than pages are read on to.
+const AUTHORED_QUERY = `query($owner: String!, $name: String!, $emails: [String!]!) {
+  repository(owner: $owner, name: $name) {
+    defaultBranchRef { target { ... on Commit { history(first: ${AGENT_COMMITS_PAGE}, author: { emails: $emails }) { nodes { ${COMMIT_FIELDS} } } } } }
+  }
+}`
+const PAGE_QUERY = `query($owner: String!, $name: String!, $pulls: String, $commits: String, $first: Boolean!, $readPulls: Boolean!, $readCommits: Boolean!) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(first: ${AGENT_PULLS_PAGE}, after: $pulls, orderBy: { field: UPDATED_AT, direction: DESC }) @include(if: $readPulls) {
+      pageInfo { hasNextPage endCursor }
+      nodes { number title state isDraft createdAt updatedAt author { ${ACTOR} } body headRefName isCrossRepository headRepositoryOwner { login } additions deletions
+        commits(last: 1) { totalCount nodes { commit { message } } }
+        mergeCommit { message }
+        closingIssuesReferences(first: ${CLOSES}) { nodes { number } }
+        labels(first: ${LABELS}) { nodes { name } } }
+    }
+    defaultBranchRef { target { ... on Commit {
+      history(first: ${AGENT_COMMITS_PAGE}, after: $commits) @include(if: $readCommits) {
+        pageInfo { hasNextPage endCursor }
+        nodes { ${COMMIT_FIELDS} }
+      }
+    } } }
+    issues(first: ${AGENT_ISSUES}, orderBy: { field: UPDATED_AT, direction: DESC }) @include(if: $first) {
+      nodes { number title state createdAt updatedAt author { ${ACTOR} } }
+    }
+  }
+}`
+
+type Login = { login?: unknown; databaseId?: unknown } | null | undefined
+type PullNode = { number?: unknown; title?: unknown; state?: unknown; isDraft?: unknown; createdAt?: unknown; updatedAt?: unknown; author?: Login; body?: unknown
+  headRefName?: unknown; isCrossRepository?: unknown; headRepositoryOwner?: Login; additions?: unknown; deletions?: unknown; commits?: { totalCount?: unknown; nodes?: ({ commit?: { message?: unknown } | null } | null)[] }
+  mergeCommit?: { message?: unknown } | null; closingIssuesReferences?: { nodes?: ({ number?: unknown } | null)[] }; labels?: { nodes?: ({ name?: unknown } | null)[] } }
+type GitActor = { email?: unknown; user?: Login }
+type CommitNode = { oid?: unknown; messageHeadline?: unknown; message?: unknown; committedDate?: unknown; additions?: unknown; deletions?: unknown
+  author?: GitActor | null; associatedPullRequests?: { totalCount?: unknown } }
+type IssueNode = { number?: unknown; title?: unknown; state?: unknown; createdAt?: unknown; updatedAt?: unknown; author?: Login }
+type RefNode = { prefix?: unknown; name?: unknown; target?: { committedDate?: unknown; message?: unknown; author?: GitActor | null } | null }
+type Connection<T> = { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (T | null)[] }
+type Page = { repository?: { pullRequests?: Connection<PullNode>; defaultBranchRef?: { target?: { history?: Connection<CommitNode> } | null } | null
+  issues?: Connection<IssueNode> } | null }
+type RefsPage = { repository?: { refs?: Connection<RefNode> } | null }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const number = (value: unknown) => Number.isSafeInteger(value) && (value as number) > 0 ? value as number : null
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const nameOf = (value: unknown, max = MAX_NAME) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+const loginOf = (author: Login) => typeof author?.login === 'string' && LOGIN.test(author.login) ? author.login : null
+const PULL_STATES: Record<string, AgentPull['state']> = { OPEN: 'open', MERGED: 'merged', CLOSED: 'closed' }
+
+function pull(node: PullNode | null): AgentPull | null {
+  const at = number(node?.number)
+  if (!node || !at) return null
+  const author = accountOf(node.author)
+  return { number: at, title: nameOf(node.title, MAX_TITLE) ?? '', state: PULL_STATES[String(node.state)] ?? 'closed', draft: node.isDraft === true,
+    author: loginOf(node.author), authorId: author?.id ?? null, createdAt: timeOf(node.createdAt), updatedAt: timeOf(node.updatedAt), head: nameOf(node.headRefName),
+    // A fork's, its owner; one GitHub no longer names, a fork of its own.
+    fork: node.isCrossRepository === true ? loginOf(node.headRepositoryOwner) ?? `pull-${at}` : null,
+    additions: count(node.additions), deletions: count(node.deletions), commits: count(node.commits?.totalCount),
+    closes: (node.closingIssuesReferences?.nodes ?? []).flatMap(closed => number(closed?.number) ?? []),
+    signals: agentSignals([node.body, node.commits?.nodes?.[0]?.commit?.message, node.mergeCommit?.message], APP_AGENTS, nameOf(node.headRefName),
+      author, (node.labels?.nodes ?? []).map(label => label?.name)) }
+}
+
+// An account as GitHub names it, by its login and id, both.
+const both = ({ login, id }: NamedAccount): AgentAuthor | null => login !== null && id !== null ? { login, id } : null
+const accountOf = (actor: Login) => both(actorOf(actor))
+// A commit's author: the account GitHub knows by its address, else the one
+// its no-reply address names by id and login, as a bot's, Copilot's or
+// Dependabot's, is told by that alone (repository-history.ts commitAccount).
+const authorOf = (actor: GitActor | null | undefined) => both(commitAccount(actor))
+
+// A commit to the default branch no pull request merged, where an agent left
+// its marks on it, or Claude authored it.
+function directCommit(node: CommitNode | null): AgentCommit | null {
+  if (!node || typeof node.oid !== 'string' || !SHA.test(node.oid) || count(node.associatedPullRequests?.totalCount) > 0) return null
+  const author = authorOf(node.author)
+  const signals = agentSignals([node.message], APP_AGENTS, null, author)
+  if (node.author?.email === CLAUDE_EMAIL) signals.claude = true
+  if (!signals.claude && !signals.codex && signals.agents.length === 0 && signals.sessions.length === 0 && signals.tasks.length === 0) return null
+  return { oid: node.oid, title: nameOf(node.messageHeadline, MAX_TITLE) ?? '', at: timeOf(node.committedDate),
+    author: author?.login ?? loginOf(node.author?.user), authorId: author?.id ?? null,
+    additions: count(node.additions), deletions: count(node.deletions), signals }
+}
+
+function issue(node: IssueNode | null): AgentIssue | null {
+  const at = number(node?.number)
+  if (!node || !at) return null
+  return { number: at, title: nameOf(node.title, MAX_TITLE) ?? '', state: node.state === 'OPEN' ? 'open' : 'closed', author: loginOf(node.author),
+    authorId: accountOf(node.author)?.id ?? null, createdAt: timeOf(node.createdAt), updatedAt: timeOf(node.updatedAt) }
+}
+
+// A branch under `prefix`, an agent's, named in full however GitHub splits
+// its name from the prefix it was listed under.
+const branch = (prefix: string) => (node: RefNode | null): AgentBranch | null => {
+  const ref = typeof node?.prefix === 'string' && typeof node.name === 'string' ? `${node.prefix}${node.name}` : null
+  const name = ref?.startsWith('refs/heads/') ? nameOf(ref.slice('refs/heads/'.length)) : null
+  const author = authorOf(node?.target?.author)
+  return name?.startsWith(prefix) ? { name, at: timeOf(node?.target?.committedDate), author: author?.login ?? loginOf(node?.target?.author?.user),
+    authorId: author?.id ?? null, signals: agentSignals([node?.target?.message], APP_AGENTS, name, author) } : null
+}
+
+// The newest of an agent's branches, those under `prefix`: every one, as many
+// as MAX_BRANCH_PAGES of them list, kept by their tips' times.
+async function agentBranches(owner: string, name: string, prefix: string, token: string, fetchImpl: typeof fetch) {
+  const found: AgentBranch[] = []
+  let after: string | null = null
+  for (let page = 0; page < MAX_BRANCH_PAGES; page++) {
+    const refs: Connection<RefNode> | undefined = (await githubGraphql(BRANCHES_QUERY, { owner, name, prefix: `refs/heads/${prefix}`, after }, token, fetchImpl) as RefsPage)
+      ?.repository?.refs
+    found.push(...(refs?.nodes ?? []).flatMap(node => branch(prefix)(node) ?? []))
+    const next: Connection<RefNode>['pageInfo'] = refs?.pageInfo
+    if (next?.hasNextPage !== true || typeof next.endCursor !== 'string') break
+    after = next.endCursor
+  }
+  return found.toSorted((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, AGENT_BRANCHES)
+}
+
+// What its answers are kept by, with their cursors (http.ts
+// handleRepositoryAgents): bumped as what a page reads, or how it tells an
+// agent, changes, so that no answer an older server kept is sent for a day.
+export const AGENTS_READ_VERSION = 5
+
+// A cursor of the default branch's commits: GitHub names one by a commit
+// and how many on from it, `<oid> <offset>`, a space between.
+export const COMMITS_CURSOR = /^(?:[!-~]{1,256}|[\da-f]{40} \d{1,9})$/u
+
+const nextCursor = (connection: Connection<unknown> | undefined, cursor = ISSUES_CURSOR) => {
+  const info = connection?.pageInfo
+  return info?.hasNextPage === true && typeof info.endCursor === 'string' && cursor.test(info.endCursor) ? info.endCursor : null
+}
+
+// A page of what the repository's agents left: its pull requests on from
+// the cursor `pulls` ends at, its default branch's commits on from
+// `commits` (the first page where neither is named, with its issues, its
+// agents' branches and the commits the app agents' accounts authored, and
+// the app agents it may name), and the cursors reading on from each, null
+// where either is read whole.
+export async function repositoryAgents(fullName: string, token: string, cursors: { pulls: string | null; commits: string | null },
+  fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const first = cursors.pulls === null && cursors.commits === null
+  const [data, branches, authored] = await Promise.all([
+    githubGraphql(PAGE_QUERY, { owner, name, pulls: cursors.pulls, commits: cursors.commits, first,
+      readPulls: first || cursors.pulls !== null, readCommits: first || cursors.commits !== null }, token, fetchImpl) as Promise<Page>,
+    first ? Promise.all(AGENT_BRANCH_PREFIXES.map(prefix => agentBranches(owner, name, prefix, token, fetchImpl))) : [],
+    first ? githubGraphql(AUTHORED_QUERY, { owner, name, emails: AGENT_EMAILS }, token, fetchImpl) as Promise<Page> : null,
+  ])
+  const repository = data?.repository
+  if (!repository) throw new GithubApiError(404, 'github-not-found')
+  const history = repository.defaultBranchRef?.target?.history
+  const after = { pulls: nextCursor(repository.pullRequests), commits: nextCursor(history, COMMITS_CURSOR) }
+  const commits = [...history?.nodes ?? [], ...authored?.repository?.defaultBranchRef?.target?.history?.nodes ?? []].flatMap(node => directCommit(node) ?? [])
+  return {
+    pulls: (repository.pullRequests?.nodes ?? []).flatMap(node => pull(node) ?? []),
+    commits: commits.filter((commit, index) => commits.findIndex(other => other.oid === commit.oid) === index),
+    ...first ? {
+      issues: (repository.issues?.nodes ?? []).flatMap(node => issue(node) ?? []),
+      branches: branches.flat(),
+      agents: APP_AGENTS.map(({ id, name: agent, avatar }): AppAgent => ({ id, name: agent, ...avatar ? { avatar } : {} })),
+    } : {},
+    more: after.pulls !== null || after.commits !== null, after,
+  }
+}

package/server-managed/repository-browser.ts

@@ -1,12 +1,28 @@
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
-import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { GithubApiError, type GithubIdentity, READ_PERMISSIONS, githubJson, githubRepoPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
 import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
 import { readSolidityEntryPoints } from './solidity-entry-points.ts'
 import { parseGithubCommit } from './bundle-commits.ts'
+import { appDependabotAlerts } from './dependabot-access.ts'
 
 const REFS_PAGE = 100
 
+// Each branch or tag GitHub lists, by its name and commit, those it names
+// one for.
+const refCommits = (items: { name?: unknown; commit?: { sha?: unknown } }[]) => items.flatMap(item => typeof item?.name === 'string' && item.name
+  && typeof item.commit?.sha === 'string' && /^[a-f\d]{40}$/u.test(item.commit.sha) ? [{ name: item.name, sha: item.commit.sha }] : [])
+
+// Each branch GitHub lists, by its name and commit. Branches are listed by
+// name, a full page of them leaving the default branch out where many come
+// before it: its commit is read apart then, by its ref, none where that fails.
+async function branchCommits(read: (suffix: string) => Promise<unknown>, branches: { name?: unknown; commit?: { sha?: unknown } }[], defaultBranch: string) {
+  const listed = refCommits(branches)
+  if (!defaultBranch || branches.length < REFS_PAGE || listed.some(item => item.name === defaultBranch)) return listed
+  const ref = await read(`/git/ref/heads/${defaultBranch.split('/').map(encodeURIComponent).join('/')}`).catch(() => null) as { object?: { sha?: unknown } } | null
+  return typeof ref?.object?.sha === 'string' && /^[a-f\d]{40}$/u.test(ref.object.sha) ? [...listed, { name: defaultBranch, sha: ref.object.sha }] : listed
+}
+
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
 // Restricted managers can walk the ancestors of their grants, without seeing
@@ -19,7 +35,6 @@ export function scopedDirectory(path: string, scopes: (string | null)[]): Reposi
 }
 
 export interface RepositoryBrowserUser { githubUserId: number | null; token: string | null }
-type GithubIdentity = Awaited<ReturnType<typeof githubUserIdentity>>
 
 function credentialFailure(err: unknown): err is GithubApiError {
   return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
@@ -53,16 +68,40 @@ export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryB
         if (!cached) tokens.set(repo.installationId, token)
         return token
       }
-      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl)
+      // Its Dependabot alerts, with the token of the installation GitHub tells
+      // covers it, where the user's own access lets them see them
+      // (dependabot-access.ts).
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl).then(reader => ({ ...reader,
+        dependabotAlerts: () => appDependabotAlerts(config, repo, { identity: getIdentity, permission: reader.permission }, fetchImpl) }))
     },
   }
 }
 
+// The files of the tree `tree` (its id) of the repository `fullName`, and of
+// every tree under it, as GitHub lists them at once with `token`, a reader's
+// (readToken): how many and their bytes, or null where GitHub cuts the
+// listing short, as it does past 100,000 entries.
+export async function repositoryTreeFiles(fullName: string, token: string | null, tree: string, fetchImpl: typeof fetch = globalThis.fetch) {
+  if (!/^[a-f\d]{40}$/u.test(tree)) throw new GithubApiError(400, 'bad-tree')
+  const url = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}/git/trees/${tree}?recursive=1`
+  const data = await githubJson(url, token, fetchImpl) as { tree?: unknown; truncated?: unknown }
+  if (!Array.isArray(data?.tree)) throw new GithubApiError(502, 'github-malformed')
+  if (data.truncated === true) return null
+  let bytes = 0, files = 0
+  for (const item of data.tree as { type?: unknown; size?: unknown }[]) {
+    if (item?.type !== 'blob') continue
+    files++
+    if (typeof item.size === 'number' && item.size > 0) bytes += item.size
+  }
+  return { files, bytes }
+}
+
 async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
   const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
   // Public reads can use the signed-in user's quota without repository grants.
-  // Nonpublic reads still require the repository App and the effective-user gate.
-  let token = userToken ?? await installationToken()
+  // Nonpublic reads still require the repository App and the effective-user gate,
+  // whose permission level is kept (`level`).
+  let level: string | null = null, token = userToken ?? await installationToken()
   const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
   const metadata = async () => {
     try { return await read('') }
@@ -90,9 +129,8 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
     if (!token) throw new GithubApiError(404, 'no-repository')
     const appToken = await installationToken()
     if (!appToken) throw new GithubApiError(404, 'no-repository')
-    if (!(await githubRepoReadPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl))) {
-      throw new GithubApiError(404, 'no-repository')
-    }
+    level = await githubRepoPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl)
+    if (!READ_PERMISSIONS.has(level)) throw new GithubApiError(404, 'no-repository')
     token = appToken
     return data
   }
@@ -103,6 +141,9 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
     // Server-only credential, selected by the same live visibility/permission
     // gate as directory browsing. Never included in an HTTP response.
     readToken: () => token,
+    // The user's permission level on it where the gate asked GitHub of it, as
+    // for a private repository; null for a public one.
+    permission: () => level,
     async refs() {
       // Suggestions are bounded; the input also accepts any branch or tag name.
       const list = async (kind: string) => {
@@ -112,11 +153,11 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       }
       const [branches, tags] = await Promise.all([list('branches'), list('tags')])
       const names = (items: { name?: unknown }[]) => items.flatMap(item => typeof item?.name === 'string' ? [item.name] : [])
-      // Each tag's commit, for the tag cache. A full page may leave tags
-      // out; only a shorter one lists every tag.
-      const tagCommits = tags.flatMap(item => typeof item?.name === 'string' && item.name && typeof item.commit?.sha === 'string'
-        && /^[a-f\d]{40}$/u.test(item.commit.sha) ? [{ name: item.name, sha: item.commit.sha }] : [])
-      return { defaultBranch, branches: names(branches), tags: names(tags), tagCommits, tagsComplete: tags.length < REFS_PAGE }
+      // Each branch's and tag's commit, for the code viewer's header to name a
+      // commit by, and each tag's for the tag cache. A full page may leave
+      // tags out; only a shorter one lists every tag.
+      return { defaultBranch, branches: names(branches), tags: names(tags), branchCommits: await branchCommits(read, branches, defaultBranch),
+        tagCommits: refCommits(tags), tagsComplete: tags.length < REFS_PAGE }
     },
     async commit(ref: string) {
       if (/^[a-f\d]{40}$/iu.test(ref)) return ref

package/server-managed/repository-changes.ts

@@ -0,0 +1,284 @@
+// The files each commit changes, as the code viewer's Replay plays them
+// (GET /api/admin/repositories/changes), as `git log --name-status` lists
+// them: each file's path and whether the commit added (`A`), modified (`M`),
+// removed (`D`) or renamed (`R`, with the path it had) it, as GitHub's REST
+// API lists a commit's files (GET /repos/:owner/:repo/commits/:sha), a
+// page of FILES_PAGE at a time, as many as MAX_FILES, `more` where it had
+// more. What a commit changes never changes, so each is kept by the commit
+// (`kept`), whole, read of GitHub once; what a reader is answered, only the
+// files within the directory they asked of (changesWithin). And the files a
+// commit holds, which Replay starts from (GET /api/admin/repositories/tree),
+// as GitHub lists its tree at once (repositoryTree), kept as well.
+
+import { GithubApiError, githubJson } from './github-app.ts'
+
+// Commits an answer tells at most, read of GitHub as many at once as
+// CHANGES_PARALLEL.
+export const CHANGES_ASKED = 50
+const CHANGES_PARALLEL = 6
+// A commit's files read, as many as fill MAX_FILES, FILES_PAGE a page (the
+// most GitHub lists a page; it lists fewer, unasked).
+export const MAX_FILES = 300
+export const FILES_PAGE = 100
+const MAX_PATH = 4096
+const SHA = /^[a-f\d]{40}$/u
+
+export type ChangeStatus = 'A' | 'M' | 'D' | 'R'
+// A file a commit changes: its path, its status, and a rename's path before.
+export type ChangedFile = [path: string, status: Exclude<ChangeStatus, 'R'>] | [path: string, status: 'R', from: string]
+export interface CommitChanges { files: ChangedFile[]; more: boolean }
+
+// What each commit changes kept, by the commit.
+export interface ChangesStore {
+  read(shas: string[]): Promise<Map<string, CommitChanges>>
+  write(sha: string, changes: CommitChanges): Promise<void>
+}
+
+const pathOf = (value: unknown) => typeof value === 'string' && value !== '' && value.length <= MAX_PATH && !/\p{Cc}/u.test(value) ? value : null
+
+// A file's status as git names it: a copy is a file added; one GitHub
+// lists unchanged (its mode alone changed, say) changes none.
+const STATUSES: Record<string, ChangeStatus> = { added: 'A', copied: 'A', modified: 'M', changed: 'M', removed: 'D', renamed: 'R' }
+
+type GithubFile = { filename?: unknown; status?: unknown; previous_filename?: unknown }
+
+// A commit's files as GitHub lists them; a rename it names no path before
+// for, a file added.
+export function commitChanges(data: unknown): CommitChanges {
+  const listed = (data as { files?: unknown } | null)?.files
+  if (!Array.isArray(listed)) throw new GithubApiError(502, 'github-malformed')
+  const files = (listed as GithubFile[]).slice(0, MAX_FILES).flatMap((file): ChangedFile[] => {
+    const path = pathOf(file?.filename)
+    const status = typeof file?.status === 'string' ? STATUSES[file.status] : undefined
+    if (!path || !status) return []
+    const from = status === 'R' ? pathOf(file.previous_filename) : null
+    return [status === 'R' ? from ? [path, 'R', from] : [path, 'A'] : [path, status]]
+  })
+  return { files, more: listed.length >= MAX_FILES }
+}
+
+// What a commit changes within the directory `path` ('' the whole
+// repository): its files there, a rename across its edge the file added
+// where it came in, removed where it went out.
+export function changesWithin({ files, more }: CommitChanges, path: string): CommitChanges {
+  if (path === '') return { files, more }
+  const within = (file: string) => file.startsWith(`${path}/`)
+  return { more, files: files.flatMap((file): ChangedFile[] => {
+    if (file[1] !== 'R') return within(file[0]) ? [file] : []
+    const [to, , from] = file
+    if (within(to)) return [within(from) ? file : [to, 'A']]
+    return within(from) ? [[from, 'D']] : []
+  }) }
+}
+
+// Runs `run` for each of `items`, as many at once as `parallel`.
+async function eachOf<T>(items: T[], parallel: number, run: (item: T) => Promise<void>) {
+  let next = 0
+  await Promise.all(Array.from({ length: Math.min(parallel, items.length) }, async () => { while (next < items.length) await run(items[next++]!) }))
+}
+
+// A commit's files as GitHub lists them, read a page at a time while each
+// is full, till MAX_FILES are.
+async function commitFiles(url: string, token: string | null, fetchImpl: typeof fetch) {
+  const files: unknown[] = []
+  for (let page = 1; files.length < MAX_FILES; page++) {
+    const data = await githubJson(`${url}?per_page=${FILES_PAGE}&page=${page}`, token, fetchImpl) as { files?: unknown } | null
+    if (!Array.isArray(data?.files)) throw new GithubApiError(502, 'github-malformed')
+    files.push(...data.files)
+    if (data.files.length < FILES_PAGE) break
+  }
+  return { files }
+}
+
+// What each of `shas` changes, kept, else read of GitHub and then kept; null
+// for one GitHub has no commit of (as one of another repository is).
+export async function repositoryChanges(fullName: string, token: string | null, shas: string[], kept: ChangesStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<Map<string, CommitChanges | null>> {
+  const asked = [...new Set(shas)].filter(sha => SHA.test(sha))
+  const found = new Map<string, CommitChanges | null>(await kept.read(asked))
+  const repo = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+  await eachOf(asked.filter(sha => !found.has(sha)), CHANGES_PARALLEL, async sha => {
+    try {
+      const changes = commitChanges(await commitFiles(`${repo}/commits/${sha}`, token, fetchImpl))
+      found.set(sha, changes)
+      await kept.write(sha, changes)
+    } catch (err) {
+      // No such commit: GitHub's 404, or its 422 for an id naming none.
+      if (err instanceof GithubApiError && (err.message === 'github-not-found' || err.message === 'github-status-422')) found.set(sha, null)
+      else throw err
+    }
+  })
+  return new Map(asked.map(sha => [sha, found.get(sha) ?? null]))
+}
+
+// The files a commit (or a tree) holds, as many as MAX_TREE_FILES, each by its path and
+// its bytes (`sizes`, in the same order), as
+// GitHub lists its tree and every tree under it at once
+// (GET /repos/:owner/:repo/git/trees/:tree?recursive=1); where GitHub cuts
+// that listing short (past 100,000 entries or 7 MB, as a large repository's
+// is), as GitHub advises: the tree's own entries listed alone, and each tree
+// in it read so in turn, as many at once as TREES_PARALLEL (treeByTrees).
+// Its blobs, not its directories nor submodules, sorted by path; past
+// MAX_TREE_FILES those nearest its root of those read, `cut` where some are
+// left out: more files than MAX_TREE_FILES, a tree's own entries cut short,
+// or more trees to read than MAX_TREE_READS.
+// Null for a commit GitHub has none of. Kept by the commit and the rules it
+// is read by (TREES_READ), a tree kept by older ones (without sizes, the
+// last) read again.
+export const MAX_TREE_FILES = 75_000
+export const TREES_READ = 3
+const MAX_TREE_READS = 400
+const TREES_PARALLEL = 6
+export interface CommitTree { files: string[]; sizes: number[]; cut: boolean }
+export interface TreeStore {
+  read(commit: string): Promise<CommitTree | null>
+  write(commit: string, tree: CommitTree): Promise<void>
+}
+
+type TreeEntry = { type?: unknown; path?: unknown; sha?: unknown; size?: unknown }
+// A file read: its path and its bytes.
+type Blob = [path: string, size: number]
+type TreeListing = (tree: string, recursive: boolean) => Promise<{ entries: TreeEntry[]; truncated: boolean }>
+
+export async function repositoryTree(fullName: string, token: string | null, commit: string, kept: TreeStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<CommitTree | null> {
+  if (!SHA.test(commit)) return null
+  const held = await kept.read(commit)
+  if (held) return held
+  const repo = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+  const listing: TreeListing = async (tree, recursive) => {
+    const data = await githubJson(`${repo}/git/trees/${tree}${recursive ? '?recursive=1' : ''}`, token, fetchImpl) as { tree?: unknown; truncated?: unknown }
+    if (!Array.isArray(data?.tree)) throw new GithubApiError(502, 'github-malformed')
+    return { entries: data.tree as TreeEntry[], truncated: data.truncated === true }
+  }
+  let whole: Awaited<ReturnType<TreeListing>>
+  try {
+    whole = await listing(commit, true)
+  } catch (err) {
+    if (err instanceof GithubApiError && (err.message === 'github-not-found' || err.message === 'github-status-422')) return null
+    throw err
+  }
+  const files: Blob[] = []
+  let cut = false
+  if (whole.truncated) cut = await treeByTrees(commit, listing, files)
+  else blobsOf(whole.entries, '', files)
+  const depth = (path: string) => path.split('/').length
+  const byPath = ([a]: Blob, [b]: Blob) => a < b ? -1 : a > b ? 1 : 0
+  const nearest = files.length > MAX_TREE_FILES ? files.toSorted((a, b) => depth(a[0]) - depth(b[0]) || byPath(a, b)).slice(0, MAX_TREE_FILES) : files
+  const sorted = nearest.toSorted(byPath)
+  const tree = { files: sorted.map(([path]) => path), sizes: sorted.map(([, size]) => size), cut: cut || files.length > MAX_TREE_FILES }
+  await kept.write(commit, tree)
+  return tree
+}
+
+// The blobs of a tree's entries, each its path under `prefix` and its bytes
+// (none, as GitHub names none), onto `files`.
+function blobsOf(entries: TreeEntry[], prefix: string, files: Blob[]) {
+  for (const item of entries) {
+    if (item?.type !== 'blob' || !pathOf(item.path)) continue
+    files.push([`${prefix}${item.path as string}`, Number.isSafeInteger(item.size) && (item.size as number) > 0 ? item.size as number : 0])
+  }
+}
+
+// The files under the commit's tree, `commit`, onto `files`, its trees read
+// a round at a time, those nearest the root first: its own entries, then
+// each tree in it whole, or, where that is cut short, alone in turn, and so
+// on. Each round read whole, whatever answers first, but for trees no file
+// of which could be kept: as deep as, or deeper than, the files nearest the
+// root, as many as MAX_TREE_FILES, of those read (files of a tree are at
+// least a level deeper than it is). As many trees read in all as
+// MAX_TREE_READS, those of a round first in its order. Whether some were
+// left out.
+async function treeByTrees(commit: string, listing: TreeListing, files: Blob[]): Promise<boolean> {
+  let cut = false, reads = 1, round = [{ tree: commit, prefix: '', recursive: false }]
+  const atDepth: number[] = []
+  let counted = 0
+  while (round.length > 0) {
+    for (; counted < files.length; counted++) {
+      const depth = files[counted]![0].split('/').length
+      atDepth[depth] = (atDepth[depth] ?? 0) + 1
+    }
+    // The depth no file deeper than is kept.
+    let kept = Number.POSITIVE_INFINITY
+    for (let depth = 0, sum = 0; depth < atDepth.length; depth++) {
+      sum += atDepth[depth] ?? 0
+      if (sum >= MAX_TREE_FILES) {
+        kept = depth
+        break
+      }
+    }
+    const asked = round.filter(({ prefix }) => prefix.split('/').length - 1 < kept).slice(0, Math.max(0, MAX_TREE_READS - reads))
+    cut ||= asked.length < round.length
+    reads += asked.length
+    const listed: Awaited<ReturnType<TreeListing>>[] = []
+    await eachOf([...asked.keys()], TREES_PARALLEL, async at => { listed[at] = await listing(asked[at]!.tree, asked[at]!.recursive) })
+    const next: typeof round = []
+    for (const [at, { tree, prefix, recursive }] of asked.entries()) {
+      const { entries, truncated } = listed[at]!
+      if (truncated && recursive) {
+        next.push({ tree, prefix, recursive: false })
+        continue
+      }
+      cut ||= truncated
+      blobsOf(entries, prefix, files)
+      if (recursive) continue
+      for (const item of entries) {
+        const path = pathOf(item?.path)
+        if (item?.type === 'tree' && path && typeof item.sha === 'string' && SHA.test(item.sha)) next.push({ tree: item.sha, prefix: `${prefix}${path}/`, recursive: true })
+      }
+    }
+    round = next
+  }
+  return cut
+}
+
+// The files commit `commit` holds within the directory `path` ('' the whole
+// repository), as repositoryTree reads them: its whole tree's within it; where
+// that is cut short, some of the directory's perhaps among those left out,
+// the directory's own tree read so (directoryTree), kept by its id, the files
+// nearest it kept. Null for a commit GitHub has none of.
+export async function directoryFiles(fullName: string, token: string | null, commit: string, path: string, kept: TreeStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<CommitTree | null> {
+  const whole = await repositoryTree(fullName, token, commit, kept, fetchImpl)
+  if (!whole || path === '' || !whole.cut) return whole && treeWithin(whole, path)
+  const id = await directoryTree(fullName, token, commit, path, fetchImpl)
+  const own = id ? await repositoryTree(fullName, token, id, kept, fetchImpl) : null
+  return own ? { ...own, files: own.files.map(file => `${path}/${file}`) } : treeWithin(whole, path)
+}
+
+// The id of the tree at `path` in commit `commit`, read a level at a time
+// (GET /repos/:owner/:repo/git/trees/:tree, its own entries alone); null
+// where it has none there, or GitHub has no such commit.
+async function directoryTree(fullName: string, token: string | null, commit: string, path: string, fetchImpl: typeof fetch): Promise<string | null> {
+  const repo = `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+  let tree = commit
+  for (const name of path.split('/')) {
+    let data: { tree?: unknown }
+    try {
+      data = await githubJson(`${repo}/git/trees/${tree}`, token, fetchImpl) as typeof data
+    } catch (err) {
+      if (err instanceof GithubApiError && (err.message === 'github-not-found' || err.message === 'github-status-422')) return null
+      throw err
+    }
+    if (!Array.isArray(data?.tree)) throw new GithubApiError(502, 'github-malformed')
+    const entry = (data.tree as TreeEntry[]).find(item => item?.path === name && item.type === 'tree')
+    if (typeof entry?.sha !== 'string' || !SHA.test(entry.sha)) return null
+    tree = entry.sha
+  }
+  return tree
+}
+
+// The files of a tree within the directory `path` ('' the whole repository).
+export function treeWithin({ files, sizes, cut }: CommitTree, path: string): CommitTree {
+  if (path === '') return { files, sizes, cut }
+  const within = [...files.keys()].filter(at => files[at]!.startsWith(`${path}/`))
+  return { files: within.map(at => files[at]!), sizes: within.map(at => sizes[at]!), cut }
+}
+
+// The commits a request names (`shas`), each once, as many as
+// CHANGES_ASKED; null for none, or for one that isn't a commit id.
+export function changesAsked(shas: string | null): string[] | null {
+  if (!shas) return null
+  const asked = [...new Set(shas.split(','))]
+  return asked.length <= CHANGES_ASKED && asked.every(sha => SHA.test(sha)) ? asked : null
+}