@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-managed/repository-issues.ts

@@ -0,0 +1,181 @@
+// The issues and pull requests the code viewer's Issues and Pull requests
+// tabs show (GET /api/admin/repositories/issues): those open, or those
+// closed (a pull request's merged among them), the most recently updated
+// first, a page at a time, each as one tile has room for, with how many are
+// open and closed. A pull request's tile names its branches, its size, its
+// review and its checks, which GraphQL alone gives, so it needs a token; an
+// open one's, and its popup's, whether it changes a lockfile whose new
+// packages are told (pull-dependencies.ts touchesLockfile), and its reviews
+// (pull-reviews.ts), each reviewer's. A nonpublic repository's are read with
+// its GitHub App's installation, which reads pull requests only with their
+// own permission (README).
+import { GithubApiError } from './github-app.ts'
+import { touchesLockfile } from './pull-dependencies.ts'
+import { ACTOR, type GraphAccount, type GraphqlError, actorOf, githubGraphql } from './repository-history.ts'
+import { ITEM_THREADS, type ReviewNode, TILE_THREADS, pullReviews, reviewFields, reviewsRefused } from './pull-reviews.ts'
+
+export const ISSUES_PAGE = 50
+// What a kept page or item was read as: kept ones read before differ.
+export const ISSUES_READ_VERSION = 3
+const MAX_LABELS = 20
+const MAX_TITLE = 1000
+const MAX_NAME = 256
+const COLOR = /^[a-f\d]{6}$/iu
+// A page's cursor as GitHub gives it, to read on from: opaque, base64 or
+// base64url as it is now (`…rOrK_u7Q==`), passed back to GitHub alone, so any
+// printable one is, but none with spaces or control characters.
+export const ISSUES_CURSOR = /^[!-~]{1,256}$/u
+
+export type IssuesKind = 'issues' | 'pulls'
+export type IssuesState = 'open' | 'closed'
+
+const shared = `number title createdAt updatedAt closedAt author { ${ACTOR} } comments { totalCount } labels(first: ${MAX_LABELS}) { totalCount nodes { name color } }`
+const fields = {
+  issues: `${shared} state stateReason`,
+  pulls: `${shared} state isDraft mergedAt reviewDecision additions deletions headRefName baseRefName
+      commits(last: 1) { nodes { commit { statusCheckRollup { state } } } }`,
+}
+// The files a pull request changes, as many as LISTED_FILES, as an open one's
+// tile and its popup tell whether it changes a lockfile by them.
+const LISTED_FILES = 100
+const files = `files(first: ${LISTED_FILES}) { totalCount nodes { path } }`
+const connection = { issues: 'issues', pulls: 'pullRequests' }
+const states = { issues: { open: '[OPEN]', closed: '[CLOSED]' }, pulls: { open: '[OPEN]', closed: '[CLOSED, MERGED]' } }
+
+// A page of `kind`, those in `state`, after the page `after` ends, and how
+// many of each state there are; open pull requests with their reviews.
+const pageQuery = (kind: IssuesKind, state: IssuesState) => `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    open: ${connection[kind]}(states: ${states[kind].open}) { totalCount }
+    closed: ${connection[kind]}(states: ${states[kind].closed}) { totalCount }
+    page: ${connection[kind]}(states: ${states[kind][state]}, first: ${ISSUES_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { ${fields[kind]}${kind === 'pulls' && state === 'open' ? ` ${files} ${reviewFields(TILE_THREADS, false)}` : ''} }
+    }
+  }
+}`
+
+type Node = ReviewNode & { number?: unknown; title?: unknown; createdAt?: unknown; updatedAt?: unknown; closedAt?: unknown; mergedAt?: unknown; author?: GraphAccount
+  comments?: { totalCount?: unknown }; labels?: { totalCount?: unknown; nodes?: { name?: unknown; color?: unknown }[] }; state?: unknown; stateReason?: unknown
+  isDraft?: unknown; reviewDecision?: unknown; additions?: unknown; deletions?: unknown; headRefName?: unknown; baseRefName?: unknown
+  commits?: { nodes?: { commit?: { statusCheckRollup?: { state?: unknown } | null } | null }[] }
+  files?: { totalCount?: unknown; nodes?: ({ path?: unknown } | null)[] } | null }
+type Page = { repository?: { open?: { totalCount?: unknown }; closed?: { totalCount?: unknown }
+  page?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (Node | null)[] } } | null }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const nameOf = (value: unknown, max = MAX_NAME) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+const REVIEWS: Record<string, string> = { APPROVED: 'approved', CHANGES_REQUESTED: 'changes', REVIEW_REQUIRED: 'required' }
+const CHECKS: Record<string, string> = { SUCCESS: 'success', FAILURE: 'failure', ERROR: 'failure', PENDING: 'pending', EXPECTED: 'pending' }
+const REASONS: Record<string, string> = { COMPLETED: 'completed', NOT_PLANNED: 'not-planned', DUPLICATE: 'duplicate' }
+
+// An issue or pull request as a tile shows it; null for one GitHub names no
+// number for.
+function item(kind: IssuesKind, node: Node | null) {
+  if (!node || !Number.isSafeInteger(node.number) || (node.number as number) <= 0) return null
+  const author = actorOf(node.author)
+  const labels = (node.labels?.nodes ?? []).flatMap(label => {
+    const name = nameOf(label?.name)
+    return name ? [{ name, color: typeof label?.color === 'string' && COLOR.test(label.color) ? label.color.toLowerCase() : null }] : []
+  })
+  const common = { number: node.number as number, title: nameOf(node.title, MAX_TITLE) ?? '', author: author.login, authorId: author.id, createdAt: timeOf(node.createdAt), updatedAt: timeOf(node.updatedAt),
+    closedAt: timeOf(node.closedAt), comments: count(node.comments?.totalCount), labels, moreLabels: Math.max(0, count(node.labels?.totalCount) - labels.length) }
+  if (kind === 'issues') {
+    return { ...common, state: node.state === 'OPEN' ? 'open' : 'closed', reason: REASONS[String(node.stateReason)] ?? null }
+  }
+  const checks = node.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state
+  const listed = node.files?.nodes
+  const paths = Array.isArray(listed) ? listed.flatMap(file => typeof file?.path === 'string' ? [file.path] : []) : null
+  return { ...common, state: node.state === 'MERGED' ? 'merged' : node.state === 'OPEN' ? 'open' : 'closed', draft: node.isDraft === true, mergedAt: timeOf(node.mergedAt),
+    review: REVIEWS[String(node.reviewDecision)] ?? null, checks: CHECKS[String(checks)] ?? null, additions: count(node.additions), deletions: count(node.deletions),
+    head: nameOf(node.headRefName), base: nameOf(node.baseRefName),
+    ...paths ? { touchesLockfile: touchesLockfile(paths, count(node.files?.totalCount)) } : {} }
+}
+
+// A pull request's checks, which a GitHub App reads only with the Checks and
+// Commit statuses permissions, refused: its tile then shows none; or its
+// files, whose lockfiles' new packages it then tells none of. Any other
+// field refused, the list is, as one without Pull requests: read is.
+const checksRefused = (error: GraphqlError) => error?.type === 'FORBIDDEN' && Array.isArray(error.path)
+  && (error.path.includes('statusCheckRollup') || error.path.includes('files'))
+const partRefused = (error: GraphqlError) => checksRefused(error) || reviewsRefused(error)
+
+// One issue or pull request, as its popup shows it (GET
+// /api/admin/repositories/item): as its tile does, with its description, its
+// Markdown as written (never GitHub's HTML of it); an issue's pull requests closing
+// it, a pull request's issues it closes, its commits and files changed, and
+// who merged it. Its state, of a different type each, named apart. A
+// description longer than MAX_BODY is shortened (`bodyShortened`), and the
+// linked past the first LINKED counted (`moreLinked`), the rest on GitHub.
+const MAX_BODY = 20_000
+const LINKED = 10
+const ITEM_QUERY = `query($owner: String!, $name: String!, $number: Int!) {
+  repository(owner: $owner, name: $name) {
+    item: issueOrPullRequest(number: $number) {
+      __typename
+      ... on Issue { ${shared} issueState: state stateReason body
+        closedByPullRequestsReferences(first: ${LINKED}, includeClosedPrs: true) { totalCount nodes { number title pullState: state isDraft } } }
+      ... on PullRequest { ${shared} pullState: state isDraft mergedAt reviewDecision additions deletions headRefName baseRefName body changedFiles ${files}
+        commits(last: 1) { totalCount nodes { commit { statusCheckRollup { state } } } } mergedBy { ${ACTOR} }
+        closingIssuesReferences(first: ${LINKED}) { totalCount nodes { number title issueState: state stateReason } }
+        ${reviewFields(ITEM_THREADS, true)} }
+    }
+  }
+}`
+type Linked = { number?: unknown; title?: unknown; issueState?: unknown; pullState?: unknown; stateReason?: unknown; isDraft?: unknown } | null
+type ItemNode = Node & { __typename?: unknown; issueState?: unknown; pullState?: unknown; body?: unknown; changedFiles?: unknown
+  commits?: Node['commits'] & { totalCount?: unknown }; mergedBy?: GraphAccount
+  closedByPullRequestsReferences?: Links; closingIssuesReferences?: Links }
+type Links = { totalCount?: unknown; nodes?: Linked[] } | null
+
+// The issues or pull requests an item names, each by its number, title and
+// state, as `kind`'s tile names one.
+const linked = (kind: IssuesKind, nodes: Linked[] | undefined) => (nodes ?? []).flatMap(node => {
+  const tile = item(kind, node ? { number: node.number, title: node.title, state: node.issueState ?? node.pullState, stateReason: node.stateReason, isDraft: node.isDraft } : null)
+  return tile ? [{ number: tile.number, title: tile.title, state: tile.state, ...'reason' in tile ? { reason: tile.reason } : { draft: tile.draft } }] : []
+})
+
+// The issue or pull request numbered `number`, its `kind` with it.
+export async function repositoryItem(fullName: string, token: string, number: number, fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql(ITEM_QUERY, { owner, name, number }, token, fetchImpl, partRefused) as { repository?: { item?: ItemNode | null } | null }
+  const node = data?.repository?.item
+  const kind: IssuesKind | null = node?.__typename === 'Issue' ? 'issues' : node?.__typename === 'PullRequest' ? 'pulls' : null
+  const tile = kind && node ? item(kind, { ...node, state: kind === 'issues' ? node.issueState : node.pullState }) : null
+  if (!kind || !node || !tile) throw new GithubApiError(404, 'github-not-found')
+  // As written, but for blank lines before it and spaces after: a first
+  // line's indent, an indented code block's, kept.
+  const written = typeof node.body === 'string' ? node.body.replace(/^(?:[ \t]*\r?\n)+/u, '').trimEnd() : ''
+  const links = kind === 'issues' ? node.closedByPullRequestsReferences : node.closingIssuesReferences
+  const named = linked(kind === 'issues' ? 'pulls' : 'issues', links?.nodes)
+  const described = { body: written.slice(0, MAX_BODY), bodyShortened: written.length > MAX_BODY, moreLinked: Math.max(0, count(links?.totalCount) - named.length) }
+  const merger = actorOf(node.mergedBy)
+  return kind === 'issues' ? { kind, ...tile, ...described, closedBy: named }
+    : { kind, ...tile, ...described, closes: named, commits: count(node.commits?.totalCount), files: count(node.changedFiles),
+      mergedBy: merger.login, mergedById: merger.id, reviews: pullReviews(node, tile.author, true) }
+}
+
+// A page of the repository's issues or pull requests in `state`, after the
+// page `after` ended (null for the first): its `items`, how many are open and
+// closed (`counts`), and, where more follow, the cursor reading them (`after`).
+export async function repositoryIssues(fullName: string, token: string, kind: IssuesKind, state: IssuesState, after: string | null, fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql(pageQuery(kind, state), { owner, name, after }, token, fetchImpl, partRefused) as Page
+  const repository = data?.repository
+  if (!repository) throw new GithubApiError(404, 'github-not-found')
+  const info = repository.page?.pageInfo
+  const next = info?.hasNextPage === true && typeof info.endCursor === 'string' && ISSUES_CURSOR.test(info.endCursor) ? info.endCursor : null
+  return {
+    items: (repository.page?.nodes ?? []).flatMap(node => {
+      const tile = item(kind, node)
+      if (!tile) return []
+      return kind === 'pulls' && state === 'open' && node ? [{ ...tile, reviews: pullReviews(node, tile.author) }] : [tile]
+    }),
+    counts: { open: count(repository.open?.totalCount), closed: count(repository.closed?.totalCount) },
+    more: next !== null, after: next,
+  }
+}

package/server-managed/repository-pulse.ts

@@ -0,0 +1,439 @@
+// What the code viewer's Pulse tab shows of a repository
+// (GET /api/admin/repositories/pulse): how its default branch moves, week by
+// week over the last year: its commits each day, the lines they add and
+// remove, those an agent made or co-authored, who made them and when in the
+// week, counted from its commits as the Commits tab reads and keeps them
+// (repository-history.ts historyFrom), so that only those not kept yet are
+// read of GitHub, a few queries an answer, the client asking again for the
+// rest; a year past YEAR_COMMITS is counted by GitHub's statistics instead,
+// which GitHub computes when first asked and again once the default branch
+// moves, answering 202 till they are (told pending, StatsPending, for the
+// client to ask again). And, since
+// the start of the week `weeks` weeks back, and over the same days of the
+// week `weeks` weeks earlier, the pull requests merged and opened and the
+// issues closed and opened, how many and the latest of each.
+import { agentOperated, githubAgent } from '../common/managed/github-agents.ts'
+import { GithubApiError, githubJson } from './github-app.ts'
+import { shareGithubRead } from './github-requests.ts'
+import { ACTOR, type GraphAccount, type HistoryCommit, type HistoryPages, accountOf, actorOf, githubGraphql, historyFrom } from './repository-history.ts'
+
+export const PULSE_WEEKS = [1, 4, 13, 52]
+// What a year counted from its commits holds, its version: kept years of
+// another are counted again.
+export const PULSE_YEAR_VERSION = 8
+const WEEK_MS = 7 * 24 * 60 * 60_000
+const DAY_MS = 24 * 60 * 60_000
+const MAX_CONTRIBUTORS = 100
+const DIRECT_LISTED = 500
+const LISTED = 10
+// Merged pull requests and closed issues are searched by when each was last
+// updated, GitHub sorting by no merge or close: as many as this are read, and
+// the latest merged or closed of them listed.
+const SEARCHED = 50
+// A year of more commits than this is counted by GitHub's statistics: read a
+// page at a time, it would take a hundred queries. Of those not kept, as
+// many queries are made an answer as YEAR_QUERIES, each reading on from as
+// many commits as YEAR_STARTS.
+export const YEAR_COMMITS = 10_000
+const YEAR_QUERIES = 5
+const YEAR_STARTS = 10
+// Commits are read on from as far as this before the year, a commit's clock
+// not always later than its parents': one dated before the year may have a
+// parent dated in it.
+const YEAR_SKEW_MS = 30 * DAY_MS
+const MAX_TITLE = 1000
+const SHA = /^[a-f\d]{40}$/u
+
+// GitHub still computing a statistic.
+export class StatsPending extends Error {
+  constructor() { super('github-stats-pending') }
+}
+
+// A week: its commits each day (Sunday first) and in all, the lines they
+// added and removed, and, counted from its commits, each day's lines
+// (`dayLines`, `[added, removed]`), the commits that release the repository
+// each day (`releaseDays`, release-commits.ts) and, of the rest, those an
+// agent made or co-authored (`agentDays`), and those pushed to the branch
+// directly (`directDays`, agent-merges.ts directCommits), which GitHub's
+// statistics don't count.
+export interface PulseWeek { week: number; days: number[]; commits: number; additions: number | null; deletions: number | null; dayLines?: [number, number][]
+  agentDays?: number[]; releaseDays?: number[]; directDays?: number[] }
+// A contributor, by their login and their account's numeric id (`id`, where
+// GitHub named it), else by the name their commits carry, and their weeks,
+// each `[week, commits, additions, deletions]`, those with any; counted from
+// their commits, their days too, each `[day, commits, additions, deletions,
+// agents, releases, direct]`, `releases` those that release the repository,
+// `agents`, of the rest, those an agent took part in (withAgent), and
+// `direct` those pushed to the branch directly.
+export interface PulseContributor { login: string | null; id?: number | null; name: string | null; weeks: [number, number, number, number][]
+  days?: [number, number, number, number, number, number, number][] }
+// A commit pushed to the branch directly, as Pulse lists it: its id, when it
+// was committed, its subject, its author, by account, else name, and what it
+// is: a release, else one an agent took part in, else one without.
+export interface PulseCommit { sha: string; at: number; subject: string; login: string | null; id: number | null; name: string | null
+  kind: 'agent' | 'without' | 'release' }
+// Commits by day of the week and hour (`punch[day][hour]`, Sunday first), in
+// each commit's own time zone, and, counted from its commits, each period's
+// (`punches`, by its weeks); `lines` false where GitHub counts none, null
+// while it is counting them; counted from its commits, the latest pushed to
+// the branch directly (`directCommits`, as many as DIRECT_LISTED).
+export interface PulseStats { weeks: PulseWeek[]; contributors: PulseContributor[]; punch: number[][]; punches?: Record<number, number[][]>; lines: boolean | null
+  directCommits?: PulseCommit[] }
+// The lines added and removed a week, and each contributor's, as GitHub's
+// statistics count them, `lines` false where it counts none.
+export interface PulseLines { weeks: [number, number, number][]; contributors: { login: string; weeks: [number, number, number][] }[]; lines: boolean }
+// The days (`from`, `to`, both days, UTC; `to` none, on) and the authors (GitHub
+// logins, any of them) a period's pull requests and issues are narrowed to.
+export interface PulseNarrowing { from: number; to: number | null; authors: string[] }
+// The year's commits read so far: all of them (`commits`), else how many
+// (`read`), and whether past YEAR_COMMITS (`tooMany`).
+export type YearCommits = { complete: true; commits: HistoryCommit[]; passed: HistoryCommit[] } | { complete: false; read: number; tooMany: boolean }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const repoApi = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+const emptyPunch = () => Array.from({ length: 7 }, () => Array.from({ length: 24 }, () => 0))
+
+// One statistic: its rows once GitHub has computed it, 'pending' while it
+// computes them (202), none for a repository with no commits (204, no body),
+// 'too-large' where it counts none (lines past 10,000 commits, 422).
+function statistic(fullName: string, token: string | null, kind: string, fetchImpl: typeof fetch) {
+  // Stats and lines both need contributors. Share by the original transport;
+  // the per-call status wrapper below would otherwise give each its own read.
+  return shareGithubRead(fetchImpl, JSON.stringify(['statistic', fullName, token, kind]), () => readStatistic(fullName, token, kind, fetchImpl))
+}
+
+async function readStatistic(fullName: string, token: string | null, kind: string, fetchImpl: typeof fetch): Promise<unknown[] | 'pending' | 'too-large'> {
+  let status = 0
+  const answered: typeof fetch = async (input, init) => {
+    const res = await fetchImpl(input, init)
+    status = res.status
+    return res
+  }
+  try {
+    const data = await githubJson(`${repoApi(fullName)}/stats/${kind}`, token, answered)
+    if (status === 202) return 'pending'
+    if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+    return data
+  } catch (err) {
+    if (status === 202) return 'pending'
+    if (status === 204) return []
+    if (err instanceof GithubApiError && err.message === 'github-status-422') return 'too-large'
+    throw err
+  }
+}
+
+// `kinds` of GitHub's statistics, each asked once, together; any still
+// computed, StatsPending.
+async function statistics(fullName: string, token: string | null, kinds: string[], fetchImpl: typeof fetch) {
+  const read = await Promise.all(kinds.map(kind => statistic(fullName, token, kind, fetchImpl)))
+  if (read.includes('pending')) throw new StatsPending()
+  return read.map(rows => rows === 'too-large' ? null : rows as unknown[])
+}
+
+type ActivityRow = { week?: unknown; days?: unknown; total?: unknown }
+type ContributorRow = { author?: { login?: unknown; id?: unknown } | null; weeks?: { w?: unknown; a?: unknown; d?: unknown; c?: unknown }[] }
+
+// The default branch's commits over the last year as GitHub's statistics
+// count them, for a year past YEAR_COMMITS: a week a row, the oldest first,
+// its commits each day (Sunday first) and in all; its contributors (as many
+// as MAX_CONTRIBUTORS, the most commits that year first) and their weeks;
+// and its commits by day of the week and hour, in each commit's own time
+// zone. Lines are GitHub's to count apart (repositoryLines).
+export async function repositoryStats(fullName: string, token: string | null, fetchImpl: typeof fetch = globalThis.fetch): Promise<PulseStats> {
+  const [activityRows = null, contributorRows = null, punchRows = null] = await statistics(fullName, token, ['commit_activity', 'contributors', 'punch_card'], fetchImpl)
+  const weeks = ((activityRows ?? []) as ActivityRow[]).flatMap(row => {
+    if (!Number.isSafeInteger(row?.week)) return []
+    const days = Array.from({ length: 7 }, (_, day) => count(Array.isArray(row.days) ? row.days[day] : 0))
+    return [{ week: (row.week as number) * 1000, days, commits: count(row.total), additions: null, deletions: null }]
+  }).toSorted((a, b) => a.week - b.week)
+  const first = weeks[0]?.week ?? Number.POSITIVE_INFINITY
+  const contributors = ((contributorRows ?? []) as ContributorRow[]).flatMap(row => {
+    const { login, id } = accountOf(row?.author)
+    const theirs = (row?.weeks ?? []).flatMap(item => {
+      const week = count(item?.w) * 1000
+      return week >= first && count(item?.c) > 0 ? [[week, count(item?.c), 0, 0] as [number, number, number, number]] : []
+    })
+    return login && theirs.length > 0 ? [{ login, id, name: null, weeks: theirs, commits: theirs.reduce((sum, item) => sum + item[1], 0) }] : []
+  }).toSorted((a, b) => b.commits - a.commits).slice(0, MAX_CONTRIBUTORS).map(({ login, id, name, weeks: theirs }) => ({ login, id, name, weeks: theirs }))
+  const punch = emptyPunch()
+  for (const row of (punchRows ?? []) as unknown[][]) {
+    if (Array.isArray(row) && Number.isSafeInteger(row[0]) && Number.isSafeInteger(row[1]) && punch[row[0] as number]?.[row[1] as number] !== undefined) {
+      punch[row[0] as number]![row[1] as number] = count(row[2])
+    }
+  }
+  return { weeks, contributors, punch, lines: null }
+}
+
+// The lines added and removed each week since `since`, and each
+// contributor's, as GitHub's statistics count them; none, `lines` false,
+// where it counts none (past 10,000 commits, where it counts each
+// contributor's as none too).
+export async function repositoryLines(fullName: string, token: string | null, since: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<PulseLines> {
+  const [frequency = null, contributorRows = null] = await statistics(fullName, token, ['code_frequency', 'contributors'], fetchImpl)
+  if (frequency === null) return { weeks: [], contributors: [], lines: false }
+  const weeks = frequency.flatMap(row => Array.isArray(row) && Number.isSafeInteger(row[0]) && (row[0] as number) * 1000 >= since
+    ? [[(row[0] as number) * 1000, count(row[1]), count(Math.abs(Number(row[2])))] as [number, number, number]] : [])
+  const contributors = ((contributorRows ?? []) as ContributorRow[]).flatMap(row => {
+    const { login } = accountOf(row?.author)
+    const theirs = (row?.weeks ?? []).flatMap(item => count(item?.w) * 1000 >= since && count(item?.a) + count(item?.d) > 0
+      ? [[count(item?.w) * 1000, count(item?.a), count(item?.d)] as [number, number, number]] : [])
+    return login && theirs.length > 0 ? [{ login, weeks: theirs }] : []
+  })
+  return { weeks, contributors, lines: true }
+}
+
+// The default branch's head, null for a repository with none.
+export async function defaultHead(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<string | null> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql('query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { defaultBranchRef { target { oid } } } }',
+    { owner, name }, token, fetchImpl) as { repository?: { defaultBranchRef?: { target?: { oid?: unknown } | null } | null } | null } | null
+  if (!data?.repository) throw new GithubApiError(404, 'github-not-found')
+  const oid = data.repository.defaultBranchRef?.target?.oid
+  return typeof oid === 'string' && SHA.test(oid) ? oid : null
+}
+
+// The commits from `head` made since `since`, as the Commits tab reads and
+// keeps them (`pages`, historyFrom): on from the parents of those since (or
+// as much as YEAR_SKEW_MS before), not yet listed, YEAR_STARTS at a time,
+// till none is left; the pages kept read
+// of the store, those not of GitHub, as many queries of them as
+// YEAR_QUERIES, the rest left for the next to ask (`complete` false, how
+// many are `read`); more than YEAR_COMMITS, too many (`tooMany`). Read
+// whole, those it was read on past besides (`passed`): undated, or dated
+// before it, a clock behind, the branch's commits since beneath them.
+export async function yearCommits(fullName: string, token: string, head: string, since: number, pages: HistoryPages,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<YearCommits> {
+  const found = new Map<string, HistoryCommit>()
+  const tried = new Set<string>()
+  const within = (commit: HistoryCommit) => commit.committedAt === null || commit.committedAt >= since - YEAR_SKEW_MS
+  const dated = (commit: HistoryCommit) => commit.committedAt !== null && commit.committedAt >= since
+  const read = () => [...found.values()].filter(dated).length
+  let queries = 0
+  let starts = [head]
+  while (starts.length > 0) {
+    if (queries >= YEAR_QUERIES) return { complete: false, read: read(), tooMany: false }
+    const batch = starts.slice(0, YEAR_STARTS)
+    for (const sha of batch) tried.add(sha)
+    const got = await historyFrom(fullName, token, batch, pages, fetchImpl)
+    if (got.read > 0) queries++
+    for (const commit of got.commits) if (!found.has(commit.sha)) found.set(commit.sha, commit)
+    if (read() > YEAR_COMMITS) return { complete: false, read: read(), tooMany: true }
+    starts = [...new Set([...found.values()].filter(within).flatMap(commit => commit.parents))].filter(sha => !found.has(sha) && !tried.has(sha))
+  }
+  return { complete: true, commits: [...found.values()].filter(dated), passed: [...found.values()].filter(commit => !dated(commit) && within(commit)) }
+}
+
+// Whether an agent made `commit` or co-authored it: its author one of
+// GitHub's agents (common/managed/github-agents.ts githubAgent), or any of
+// its co-authors an agent (commit-coauthors.ts coauthorsOf), as Commits
+// marks them; or one an agent's pull request brought (`merges`,
+// agent-merges.ts agentCommits); or one an account agents work as pushed to
+// the branch directly (`direct`, github-agents.ts agentOperated).
+const withAgent = (commit: HistoryCommit, merges: ReadonlySet<string>, direct: ReadonlySet<string>) => merges.has(commit.sha)
+  || (direct.has(commit.sha) && agentOperated(commit.authorLogin, commit.authorId ?? null))
+  || githubAgent(commit.authorLogin, commit.authorId ?? null, commit.authorName) !== null || (commit.coauthors ?? []).some(coauthor => coauthor.agent)
+
+// The year from `first` (pulseSince(52, …)) of `commits`, as GitHub's
+// statistics count them, merges left out: a week a row, its commits each day
+// (UTC) and in all and the lines they added and removed, in all and each day,
+// those that release the repository (`releases`, release-commits.ts) and,
+// of the rest, those an agent made or co-authored, merged from an agent's
+// pull request (`merges`) or pushed directly as an account agents work as
+// (`direct`, withAgent), each day;
+// its contributors,
+// by account (its id, by the login it committed as first listed, the newest,
+// whatever it was renamed from; a login's commits read before ids were, the
+// one account's that committed as it, where only one did), else login, each
+// matched as GitHub matches logins, regardless of case, else name (as many
+// as MAX_CONTRIBUTORS, the most commits first),
+// and their weeks and days, each day's releases and commits with agents too;
+// and its commits by day of the week and hour, in each author's own time
+// zone (else UTC, where GitHub told none), the year's and each period's
+// (PULSE_WEEKS, its last weeks).
+export function commitStats(commits: HistoryCommit[], first: number, merges: ReadonlySet<string> = new Set(), releases: ReadonlySet<string> = new Set(),
+  direct: ReadonlySet<string> = new Set()): PulseStats {
+  const weeks = Array.from({ length: 52 }, (_, at) => ({ week: first + at * WEEK_MS, days: Array.from({ length: 7 }, () => 0), commits: 0, additions: 0, deletions: 0,
+    dayLines: Array.from({ length: 7 }, () => [0, 0] as [number, number]), agentDays: Array.from({ length: 7 }, () => 0), releaseDays: Array.from({ length: 7 }, () => 0),
+    directDays: Array.from({ length: 7 }, () => 0) }))
+  type Counts = Map<number, number[]>
+  const people = new Map<string, { login: string | null; logins: Set<string>; id: number | null; name: string | null; weeks: Counts; days: Counts; commits: number }>()
+  const punches = Object.fromEntries(PULSE_WEEKS.map(span => [span, emptyPunch()]))
+  // Each commit's author, by the key their commits are counted by, and of a
+  // login an account took on, that account (`merged`).
+  const keys = new Map<string, string>()
+  const merged = new Map<string, { login: string | null; id: number | null; name: string | null }>()
+  const add = (counts: Counts, at: number, made: number[]) => counts.set(at, made.map((value, index) => (counts.get(at)?.[index] ?? 0) + value))
+  for (const commit of commits) {
+    if (commit.parents.length > 1 || commit.committedAt === null || commit.committedAt < first) continue
+    const at = Math.floor((commit.committedAt - first) / WEEK_MS)
+    const week = weeks[at]
+    if (!week) continue
+    const [additions, deletions] = [commit.additions ?? 0, commit.deletions ?? 0]
+    const weekday = new Date(commit.committedAt).getUTCDay()
+    week.days[weekday]!++
+    week.dayLines[weekday]![0] += additions
+    week.dayLines[weekday]![1] += deletions
+    week.commits++
+    week.additions += additions
+    week.deletions += deletions
+    const release = releases.has(commit.sha)
+    const agent = !release && withAgent(commit, merges, direct)
+    if (release) week.releaseDays[weekday]!++
+    if (direct.has(commit.sha)) week.directDays[weekday]!++
+    if (agent) week.agentDays[weekday]!++
+    const local = new Date(commit.authoredAt != null && commit.authorZone != null ? commit.authoredAt + commit.authorZone * 60_000 : commit.committedAt)
+    for (const span of PULSE_WEEKS) if (at >= 52 - span) punches[span]![local.getUTCDay()]![local.getUTCHours()]!++
+    const key = commit.authorLogin && commit.authorId != null ? `#${commit.authorId}` : commit.authorLogin ? `@${commit.authorLogin.toLowerCase()}`
+      : commit.authorName ? `=${commit.authorName}` : null
+    if (!key) continue
+    keys.set(commit.sha, key)
+    const person = people.get(key) ?? { login: commit.authorLogin, logins: new Set<string>(), id: commit.authorId ?? null, name: commit.authorName,
+      weeks: new Map(), days: new Map(), commits: 0 }
+    if (commit.authorLogin) person.logins.add(commit.authorLogin.toLowerCase())
+    add(person.weeks, week.week, [1, additions, deletions])
+    add(person.days, Math.floor(commit.committedAt / DAY_MS) * DAY_MS, [1, additions, deletions, agent ? 1 : 0, release ? 1 : 0, direct.has(commit.sha) ? 1 : 0])
+    person.commits++
+    people.set(key, person)
+  }
+  // A login one account committed as, those of its commits read before ids
+  // were that account's; one more did, theirs apart, no one's.
+  const accounts = Map.groupBy([...people.values()].filter(person => person.id !== null).flatMap(person => [...person.logins].map(login => ({ login, person }))),
+    ({ login }) => login)
+  for (const [key, person] of people) {
+    const [owner, ...others] = person.login !== null && person.id === null ? accounts.get(person.login.toLowerCase()) ?? [] : []
+    if (!owner || others.length > 0) continue
+    const account = owner.person
+    for (const [week, counts] of person.weeks) add(account.weeks, week, counts)
+    for (const [day, counts] of person.days) add(account.days, day, counts)
+    account.commits += person.commits
+    people.delete(key)
+    merged.set(key, account)
+  }
+  const rows = (counts: Counts) => [...counts].toSorted(([a], [b]) => a - b).map(([at, made]) => [at, ...made])
+  const contributors = [...people.values()].toSorted((a, b) => b.commits - a.commits).slice(0, MAX_CONTRIBUTORS).map(({ login, id, name, weeks: theirs, days }) => ({
+    login, id, name, weeks: rows(theirs) as [number, number, number, number][], days: rows(days) as [number, number, number, number, number, number, number][] }))
+  // Each pushed directly by the contributor its author's commits are counted
+  // as, whatever account it named.
+  const directCommits = commits.filter(commit => direct.has(commit.sha) && commit.committedAt !== null && commit.committedAt >= first)
+    .toSorted((a, b) => b.committedAt! - a.committedAt!).slice(0, DIRECT_LISTED).map((commit): PulseCommit => {
+      const { sha, committedAt, subject, authorLogin, authorId, authorName } = commit
+      const author = people.get(keys.get(sha) ?? '') ?? merged.get(keys.get(sha) ?? '') ?? { login: authorLogin, id: authorId ?? null, name: authorName }
+      const kind = releases.has(sha) ? 'release' : withAgent(commit, merges, direct) ? 'agent' : 'without'
+      return { sha, at: committedAt!, subject, login: author.login, id: author.id, name: author.name, kind }
+    })
+  return { weeks, contributors, punch: punches[52]!, punches, lines: true, directCommits }
+}
+
+// The year's statistics as a period of `weeks` weeks shows them: when its
+// commits are made, the period's where they were counted from its commits
+// (`periodPunch`), else the year's or more, as GitHub's statistics count it;
+// the commits pushed to the branch directly, the period's alone.
+export function periodStats(stats: PulseStats, weeks: number) {
+  const { punches, directCommits, ...rest } = stats
+  const punch = punches?.[weeks]
+  const since = stats.weeks.at(-weeks)?.week ?? Number.NEGATIVE_INFINITY
+  return { ...rest, punch: punch ?? rest.punch, periodPunch: Boolean(punch), ...directCommits ? { directCommits: directCommits.filter(commit => commit.at >= since) } : {} }
+}
+
+// GitHub's statistics of a year past YEAR_COMMITS (repositoryStats) with
+// its `lines` added in, each week's and each contributor's, by login; null
+// while GitHub is counting them, `lines` null.
+export function withLines(stats: PulseStats, lines: PulseLines | null): PulseStats {
+  if (!lines) return { ...stats, lines: null }
+  if (!lines.lines) return { ...stats, lines: false }
+  const weekly = new Map(lines.weeks.map(([week, additions, deletions]) => [week, [additions, deletions]]))
+  const theirs = new Map(lines.contributors.map(person => [person.login, new Map(person.weeks.map(([week, additions, deletions]) => [week, [additions, deletions]]))]))
+  return {
+    ...stats,
+    weeks: stats.weeks.map(week => ({ ...week, additions: weekly.get(week.week)?.[0] ?? 0, deletions: weekly.get(week.week)?.[1] ?? 0 })),
+    contributors: stats.contributors.map(person => ({ ...person, weeks: person.weeks.map(([week, made]) => {
+      const added = person.login ? theirs.get(person.login)?.get(week) : undefined
+      return [week, made, added?.[0] ?? 0, added?.[1] ?? 0] as [number, number, number, number]
+    }) })),
+    lines: true,
+  }
+}
+
+// Where a period of `weeks` weeks starts, as GitHub's statistics count weeks:
+// the Sunday (UTC) that many weeks back, this week the last of them.
+export function pulseSince(weeks: number, now: number) {
+  const today = Math.floor(now / DAY_MS) * DAY_MS
+  const sunday = today - new Date(today).getUTCDay() * DAY_MS
+  return sunday - (weeks - 1) * WEEK_MS
+}
+
+const SEARCH = (name: string, fragment: string, first = 0) => `${name}: search(type: ISSUE, query: $${name}, first: ${Math.max(first, 1)}) {
+    issueCount${first > 0 ? ` nodes { ...${fragment} }` : ''}
+  }`
+const ACTIVITY_QUERY = `query($merged: String!, $mergedBefore: String!, $opened: String!, $openedBefore: String!,
+  $closed: String!, $closedBefore: String!, $created: String!, $createdBefore: String!) {
+  ${SEARCH('merged', 'pull', SEARCHED)}
+  ${SEARCH('mergedBefore', 'pull')}
+  ${SEARCH('opened', 'pull', LISTED)}
+  ${SEARCH('openedBefore', 'pull')}
+  ${SEARCH('closed', 'issue', SEARCHED)}
+  ${SEARCH('closedBefore', 'issue')}
+  ${SEARCH('created', 'issue', LISTED)}
+  ${SEARCH('createdBefore', 'issue')}
+}
+fragment pull on PullRequest { number title pullState: state isDraft createdAt mergedAt author { ${ACTOR} } }
+fragment issue on Issue { number title issueState: state stateReason createdAt closedAt author { ${ACTOR} } }`
+
+type SearchNode = { number?: unknown; title?: unknown; pullState?: unknown; issueState?: unknown; isDraft?: unknown; stateReason?: unknown
+  createdAt?: unknown; mergedAt?: unknown; closedAt?: unknown; author?: GraphAccount } | null
+type Search = { issueCount?: unknown; nodes?: SearchNode[] } | null | undefined
+const REASONS: Record<string, string> = { COMPLETED: 'completed', NOT_PLANNED: 'not-planned', DUPLICATE: 'duplicate' }
+
+// An issue or pull request a search lists, as the popup's preview of it
+// takes one, `at` when it was merged, opened or closed.
+function listed(node: SearchNode, at: unknown) {
+  if (!node || !Number.isSafeInteger(node.number) || (node.number as number) <= 0) return null
+  const title = typeof node.title === 'string' ? node.title.trim().slice(0, MAX_TITLE) : ''
+  const author = actorOf(node.author)
+  const common = { number: node.number as number, title, author: author.login, authorId: author.id, at: timeOf(at), createdAt: timeOf(node.createdAt) }
+  return node.pullState === undefined
+    ? { ...common, kind: 'issues', state: node.issueState === 'OPEN' ? 'open' : 'closed', reason: REASONS[String(node.stateReason)] ?? null }
+    : { ...common, kind: 'pulls', state: node.pullState === 'MERGED' ? 'merged' : node.pullState === 'OPEN' ? 'open' : 'closed', draft: node.isDraft === true }
+}
+
+// The pull requests merged and opened and the issues closed and opened since
+// the start of the week `weeks` weeks back (`since`), and over the same days
+// of the week `weeks` weeks earlier (`previous`, its count: a week's Sunday to
+// Thursday beside the week before's, not the days just before, whose days of
+// the week differ), the latest of each listed, as many as LISTED: those
+// opened as GitHub sorts them, those merged or closed the latest of the
+// SEARCHED most recently updated, which are the latest of all where the
+// period holds no more, or the last listed was merged or closed after the
+// SEARCHED-th was last updated. A search counts by the day (UTC). Narrowed
+// (`narrowing`), those of its days from `from` to `to` (both days, UTC;
+// none, on), and those its `authors` (GitHub logins) opened, any of them.
+export async function repositoryActivity(fullName: string, token: string, weeks: number, now: number = Date.now(), fetchImpl: typeof fetch = globalThis.fetch,
+  narrowing: PulseNarrowing | null = null) {
+  const since = pulseSince(weeks, now)
+  const back = weeks * WEEK_MS
+  const day = (at: number) => new Date(at).toISOString().slice(0, 10)
+  const current = narrowing?.to == null ? `>=${day(narrowing?.from ?? since)}` : `${day(narrowing.from)}..${day(narrowing.to)}`
+  const previous = `${day(since - back)}..${day(now - back)}`
+  const repo = `repo:${fullName}`
+  // An app's login (`name[bot]`) is searched for as GitHub names its app.
+  const by = (narrowing?.authors ?? []).map(login => ` author:${login.endsWith('[bot]') ? `app/${login.slice(0, -5)}` : login}`).join('')
+  const asked = (what: string, range: string, sort: string) => `${repo} ${what}${range}${by} sort:${sort}`
+  const kinds = {
+    merged: ['is:pr is:merged merged:', 'updated-desc'], opened: ['is:pr created:', 'created-desc'],
+    closed: ['is:issue is:closed closed:', 'updated-desc'], created: ['is:issue created:', 'created-desc'],
+  } as const
+  const variables = Object.fromEntries(Object.entries(kinds).flatMap(([name, [what, sort]]) => [[name, asked(what, current, sort)],
+    [`${name}Before`, asked(what, previous, sort)]]))
+  const data = await githubGraphql(ACTIVITY_QUERY, variables, token, fetchImpl) as Record<string, Search> | null
+  const at = { merged: 'mergedAt', opened: 'createdAt', closed: 'closedAt', created: 'createdAt' } as const
+  const told = Object.fromEntries((Object.keys(kinds) as (keyof typeof kinds)[]).map(name => [name, {
+    count: count(data?.[name]?.issueCount),
+    previous: count(data?.[`${name}Before`]?.issueCount),
+    items: (data?.[name]?.nodes ?? []).flatMap(node => listed(node, node?.[at[name]]) ?? []).toSorted((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, LISTED),
+  }]))
+  return { since, previousSince: since - back, ...told }
+}

package/server-managed/repository-risk-audit.ts

@@ -33,6 +33,19 @@ const AUDIT_FAILED_KEPT_MS = 10 * 60_000
 // RISK_KEPT_MS, why they couldn't be had within AUDIT_FAILED_KEPT_MS.
 const isFresh = ({ at, audit }: { at: number; audit: Audit }) => Date.now() - at < (Array.isArray(audit) ? RISK_KEPT_MS : AUDIT_FAILED_KEPT_MS)
 
+// The audits of lockfiles, each of its `packages` by its `key` (auditLockfile),
+// `inTurn` with others, asked at once: each null where it has none to ask
+// of, or once `signal` aborts. Each is the caller's to tell once it may.
+export function auditLockfiles(source: AuditSource, memory: Lru<{ at: number; audit: Audit }>, signal: AbortSignal,
+  lockfiles: { key: string; packages: readonly LockedPackage[] | null }[], inTurn: <T>(work: () => Promise<T>) => Promise<T>): Promise<Audit | null>[] {
+  return lockfiles.map(({ key, packages }) => {
+    const audit = packages ? inTurn(() => (signal.aborted ? Promise.resolve(null) : auditLockfile(source, memory, signal, key, packages))) : Promise.resolve(null)
+    // One no longer waited on, as the scan stopped, fails alone.
+    audit.catch(() => {})
+    return audit
+  })
+}
+
 // The audit of a lockfile's `packages`, by its `key` as kept (`memory`, then
 // the source's), else asked and kept; null where it locks none to ask of, or
 // once `signal` aborts.