@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/repository-policy.ts

@@ -0,0 +1,27 @@
+import type { StoredUser } from './db.ts'
+
+const WHITEHAT = [
+  291301, // ChALkeR
+  259122746, // exo-nikita
+  247161625, // ex0sec
+]
+const whitehatIds = new Set(WHITEHAT)
+
+// (1) Server permission to add repositories. Keep this independent of GitHub
+// identity and ecosystem exceptions if other install modes broaden it later.
+export function canAddRepositories(user: StoredUser): boolean {
+  return user.role === 'admin'
+}
+
+// (3b) Only the ecosystem safeguard for public repositories is bypassed by
+// WHITEHAT. Callers must separately establish (0) server readability, (1) add
+// permission, and (2) server admin or GitHub access to this repository.
+export function passesPublicRepositorySafeguard(githubUserId: number | null, involved: boolean): boolean {
+  return involved || (githubUserId != null && whitehatIds.has(githubUserId))
+}
+
+// Arbitrary public repositories have no involvement evidence, so (2) requires
+// admin even if (1) expands in the future. This capability is also the UI gate.
+export function canAddAnyPublicRepository(user: StoredUser, githubUserId: number | null): boolean {
+  return canAddRepositories(user) && user.role === 'admin' && passesPublicRepositorySafeguard(githubUserId, false)
+}

package/server-managed/repository-pulls.ts

@@ -0,0 +1,156 @@
+// A repository's pull requests, the most recently updated first, as kept
+// once for both of those that read them so (http.ts keptPulls): the Pulse,
+// telling whose its year's commits are by those merged (agent-merges.ts
+// agentMerges), and the Agents tab, its pages of them (repository-agents.ts
+// agentPulls). Those updated since its year's start, a few queries an
+// answer, the rest read by the next, and those updated since read as they
+// are. Each kept as the Agents tab shows it (repository-agents.ts pull: the
+// marks an agent left in its texts, never the texts) and, one merged, what
+// it brought the default branch, as the Pulse tells it: an agent that
+// commits as whoever ran it (Codex's own) leaves its commits no mark, its
+// pull request's branch alone naming it (app-agents.ts
+// AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
+// (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
+// its author, an account agents work as (github-agents.ts AGENT_OPERATED),
+// or any GitHub App's bot.
+import { type AgentPull, labelAgents } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
+import { AGENT_BRANCH_PREFIXES } from './app-agents.ts'
+import { AGENT_PULL_FIELDS, type PullNode, pull } from './repository-agents.ts'
+import { githubGraphql } from './repository-history.ts'
+
+// What the pull requests kept are read by, its version: bumped as what a
+// page reads, or how one is told, changes, its pull requests read again
+// (http.ts keptPulls keys them by AGENTS_READ_VERSION and the Pulse's
+// PULSE_YEAR_VERSION too, as either changes how it tells an agent's).
+export const PULLS_READ_VERSION = 1
+// The pull requests read an answer, a page a query, as many queries as
+// PULLS_QUERIES, the rest left for the next to ask; of each merged, as many
+// of its latest commits as MERGED_COMMITS.
+const PULLS_PAGE = 100
+const PULLS_QUERIES = 5
+const MERGED_COMMITS = 100
+const LABEL_AGENTS = Object.keys(GITHUB_AGENTS)
+const SHA = /^[a-f\d]{40}$/u
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// A pull request as read: its row on the Agents tab, and one merged, what
+// it brought the default branch (`merged`).
+export type KeptPull = AgentPull & { merged?: Merged }
+// What a merged pull request brought: its merge commit (`sha`), when it was
+// merged (`at`) and whether it was an agent's (agentPull); an agent's merged
+// with a merge commit, which a year counts none of, its own commits too
+// (`own`, its latest MERGED_COMMITS); and of one of more commits whose merge
+// commit has one parent, its commits' subjects, the oldest first, for those
+// it was rebased as to be told by (agent-merges.ts agentCommits), those of
+// its empty commits left out, as a rebase leaves them, and how many more it
+// had than those read (`more`).
+export interface Merged { sha: string; at: number; agent: boolean; own?: string[]; subjects?: string[]; more?: number }
+// The pull requests updated since a year's start (`since`) as read so far
+// (readPulls), the most recently updated first; when the newest read was
+// last updated, those updated since read again (`through`, null till all
+// are read once), and where those read reach back no further than was
+// needed, when the oldest of them was updated (`reach`); whether every one
+// the repository has is read (`all`); and a read not finished: where it goes
+// on (`after`), when the newest it began with was updated (`from`), the
+// oldest it reads to (`stop`), how many it has read (`read`) and when the
+// oldest of them was updated (`to`).
+export interface PullList { pulls: KeptPull[]; since: number; through: number | null; reach?: number; all?: true
+  next: { after: string; from: number; stop: number; read: number; to?: number } | null }
+
+// Since when every pull request updated is read: all of them since the
+// year's start, -∞; none yet, ∞.
+export const pullsReadTo = (list: Pick<PullList, 'next' | 'reach'>) => list.next ? list.next.to ?? Number.POSITIVE_INFINITY : list.reach ?? Number.NEGATIVE_INFINITY
+
+const PULLS_QUERY = `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(first: ${PULLS_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { ${AGENT_PULL_FIELDS} mergedAt mergeCommit { oid parents { totalCount } }
+        commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
+    }
+  }
+}`
+type MergedNode = PullNode & { mergedAt?: unknown; mergeCommit?: { oid?: unknown; message?: unknown; parents?: { totalCount?: unknown } | null } | null
+  author?: PullNode['author'] & { __typename?: unknown }
+  commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null }
+type PullsPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (MergedNode | null)[] } | null } | null }
+
+const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
+// Whether a pull request is an agent's: by its branch, a label naming one,
+// or its author, an account agents work as or a bot (GitHub's GraphQL API
+// naming a bot by its app's login alone, its type telling it).
+const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(headRefName)
+  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0 || author?.__typename === 'Bot'
+  || agentOperated(typeof author?.login === 'string' ? author.login : null, Number.isSafeInteger(author?.databaseId) ? author!.databaseId as number : null)
+
+// What a pull request merged brought (Merged); null for one not merged.
+function mergedOf(node: MergedNode): Merged | null {
+  const [at, sha] = [timeOf(node.mergedAt), node.mergeCommit?.oid]
+  if (at === null || typeof sha !== 'string' || !SHA.test(sha)) return null
+  const commits = (node.commits?.nodes ?? []).map(item => item?.commit)
+  const merging = count(node.mergeCommit?.parents?.totalCount) > 1
+  const copied = commits.filter(commit => commit?.changedFilesIfAvailable !== 0)
+  // Of one of more commits than its latest read, how many more it had.
+  const more = Math.max(0, count(node.commits?.totalCount) - commits.length)
+  const subjects = !merging && (copied.length > 1 || more > 0) && copied.length > 0 && copied.every(commit => typeof commit?.messageHeadline === 'string')
+    ? copied.map(commit => commit!.messageHeadline as string) : null
+  const agent = agentPull(node)
+  const own = agent && merging ? commits.flatMap(commit => typeof commit?.oid === 'string' && SHA.test(commit.oid) ? [commit.oid] : []) : []
+  return { sha, at, agent, ...own.length > 0 ? { own } : {}, ...subjects ? { subjects, ...more > 0 ? { more } : {} } : {} }
+}
+
+// The most recently updated first, the higher number first of those
+// updated together.
+const newestFirst = (a: AgentPull, b: AgentPull) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0) || b.number - a.number
+
+// The pull requests updated since `since`, read the most recently updated
+// first (a pull request is updated when merged, or after), on from what was
+// `kept`: till one updated before the year, or before the newest read before
+// was, as many queries an answer as PULLS_QUERIES, a read not finished going
+// on from where it was left by the next, or once those updated since `need`
+// are all read; where those read reached no further back than they needed,
+// and `need` is further, read again from the newest on, as far back as it
+// needs. Each kept as last read, one updated before the year forgotten.
+export async function readPulls(fullName: string, token: string, since: number, kept: PullList | null,
+  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<PullList> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const pulls = new Map((kept?.pulls ?? []).filter(item => (item.updatedAt ?? 0) >= since).map(item => [item.number, item]))
+  // Every one read, as long as none was forgotten, the year begun since.
+  const whole = kept?.all === true && pulls.size === kept.pulls.length
+  const further = !kept?.next && kept?.reach !== undefined && kept.reach > need
+  const stop = kept?.next?.stop ?? (further ? since : Math.max(since, kept?.through ?? since))
+  const result = (through: number | null, next: PullList['next'], reach: number | undefined, all = whole): PullList => ({
+    pulls: [...pulls.values()].toSorted(newestFirst), since, through, ...reach === undefined ? {} : { reach }, ...all ? { all: true as const } : {}, next })
+  let { after = null, from = null, read = 0, to = null }: { after?: string | null; from?: number | null; read?: number; to?: number | null } = kept?.next ?? {}
+  for (let queries = 0; queries < PULLS_QUERIES; queries++) {
+    const page = (await githubGraphql(PULLS_QUERY, { owner, name, after }, token, fetchImpl) as PullsPage | null)?.repository?.pullRequests
+    const end = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
+    let crossed = false
+    for (const node of page?.nodes ?? []) {
+      const updated = timeOf(node?.updatedAt)
+      if (!node || updated === null) continue
+      if (updated < stop) { crossed = true; break }
+      from ??= updated
+      to = updated
+      read++
+      const row = pull(node)
+      const merged = mergedOf(node)
+      if (row) pulls.set(row.number, merged ? { ...row, merged } : row)
+    }
+    // Read as far back as it reads to: the year's start, every one since
+    // read; else as far as those read before reached. Read to the last
+    // the repository has, every one of them.
+    if (crossed || end) return result(from ?? stop, null, stop > since ? kept?.reach : undefined, (end && !crossed) || (whole && stop > since))
+    after = page!.pageInfo!.endCursor as string
+    // Read as far back as `need`: finished, so far back, those updated
+    // since read by the next as ever.
+    if (need > since && to !== null && to < need) return result(Math.max(from ?? stop, kept?.through ?? Number.NEGATIVE_INFINITY), null, to)
+  }
+  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read, ...to === null ? {} : { to } }, kept?.reach)
+}

package/server-managed/repository-pulse.ts

@@ -0,0 +1,460 @@
+// What the code viewer's Pulse tab shows of a repository
+// (GET /api/admin/repositories/pulse): how its default branch moves, week by
+// week over the last year: its commits each day, the lines they add and
+// remove, those an agent made or co-authored, who made them and when in the
+// week, counted from its commits as the Commits tab reads and keeps them
+// (repository-history.ts historyFrom), so that only those not kept yet are
+// read of GitHub, a few queries an answer, the client asking again for the
+// rest; a year past YEAR_COMMITS is counted by GitHub's statistics instead,
+// which GitHub computes when first asked and again once the default branch
+// moves, answering 202 till they are (told pending, StatsPending, for the
+// client to ask again). And, since
+// the start of the week `weeks` weeks back, and over the same days of the
+// week `weeks` weeks earlier, the pull requests merged and opened and the
+// issues closed and opened, how many and the latest of each.
+import { agentOperated, githubAgent } from '../common/managed/github-agents.ts'
+import { GithubApiError, githubJson } from './github-app.ts'
+import { shareGithubRead } from './github-requests.ts'
+import { coauthorsOf } from './commit-coauthors.ts'
+import { ACTOR, type GraphAccount, type HistoryCommit, type HistoryPages, accountOf, actorOf, githubGraphql, historyFrom } from './repository-history.ts'
+
+export const PULSE_WEEKS = [1, 4, 13, 52]
+// What a year counted from its commits holds, its version: kept years of
+// another are counted again.
+export const PULSE_YEAR_VERSION = 12
+const WEEK_MS = 7 * 24 * 60 * 60_000
+const DAY_MS = 24 * 60 * 60_000
+const MAX_CONTRIBUTORS = 100
+const DIRECT_LISTED = 500
+const LISTED = 10
+// Merged pull requests and closed issues are searched by when each was last
+// updated, GitHub sorting by no merge or close: as many as this are read, and
+// the latest merged or closed of them listed.
+const SEARCHED = 50
+// A year of more commits than this is counted by GitHub's statistics: read a
+// page at a time, it would take a hundred queries. Of those not kept, as
+// many queries are made an answer as YEAR_QUERIES, each reading on from as
+// many commits as YEAR_STARTS.
+export const YEAR_COMMITS = 10_000
+const YEAR_QUERIES = 5
+const YEAR_STARTS = 10
+// Commits are read on from as far as this before the year, a commit's clock
+// not always later than its parents': one dated before the year may have a
+// parent dated in it.
+const YEAR_SKEW_MS = 30 * DAY_MS
+const MAX_TITLE = 1000
+const SHA = /^[a-f\d]{40}$/u
+
+// GitHub still computing a statistic.
+export class StatsPending extends Error {
+  constructor() { super('github-stats-pending') }
+}
+
+// A week: its commits each day (Sunday first) and in all, the lines they
+// added and removed, and, counted from its commits, each day's lines
+// (`dayLines`, `[added, removed]`), the commits that release the repository
+// each day (`releaseDays`, release-commits.ts) and, of the rest, those an
+// agent made or co-authored (`agentDays`), and those pushed to the branch
+// directly (`directDays`, agent-merges.ts directCommits), which GitHub's
+// statistics don't count.
+export interface PulseWeek { week: number; days: number[]; commits: number; additions: number | null; deletions: number | null; dayLines?: [number, number][]
+  agentDays?: number[]; releaseDays?: number[]; directDays?: number[] }
+// A contributor, by their login and their account's numeric id (`id`, where
+// GitHub named it), else by the name their commits carry, and their weeks,
+// each `[week, commits, additions, deletions]`, those with any; counted from
+// their commits, their days too, each `[day, commits, additions, deletions,
+// agents, releases, direct]`, `releases` those that release the repository,
+// `agents`, of the rest, those an agent took part in (withAgent), and
+// `direct` those pushed to the branch directly.
+export interface PulseContributor { login: string | null; id?: number | null; name: string | null; weeks: [number, number, number, number][]
+  days?: [number, number, number, number, number, number, number][] }
+// A commit pushed to the branch directly, as Pulse lists it: its id, when it
+// was committed, its subject, its author, by account, else name, and what it
+// is: a release, else one an agent took part in, else one without.
+export interface PulseCommit { sha: string; at: number; subject: string; login: string | null; id: number | null; name: string | null
+  kind: 'agent' | 'without' | 'release' }
+// Commits by day of the week and hour (`punch[day][hour]`, Sunday first), in
+// each commit's own time zone, and, counted from its commits, each period's
+// (`punches`, by its weeks); `lines` false where GitHub counts none, null
+// while it is counting them; counted from its commits, the latest pushed to
+// the branch directly (`directCommits`, as many as DIRECT_LISTED); and,
+// counted from its commits read no further back than a period needed, when
+// from it is counted whole (`from`), absent for the year whole.
+export interface PulseStats { weeks: PulseWeek[]; contributors: PulseContributor[]; punch: number[][]; punches?: Record<number, number[][]>; lines: boolean | null
+  directCommits?: PulseCommit[]; from?: number }
+// The lines added and removed a week, and each contributor's, as GitHub's
+// statistics count them, `lines` false where it counts none.
+export interface PulseLines { weeks: [number, number, number][]; contributors: { login: string; weeks: [number, number, number][] }[]; lines: boolean }
+// The days (`from`, `to`, both days, UTC; `to` none, on) and the authors (GitHub
+// logins, any of them) a period's pull requests and issues are narrowed to.
+export interface PulseNarrowing { from: number; to: number | null; authors: string[] }
+// The year's commits read so far: all of them, or as far back as asked
+// (`commits`, `from`), else how many (`read`), and whether past
+// YEAR_COMMITS (`tooMany`).
+export type YearCommits = { complete: true; commits: HistoryCommit[]; passed: HistoryCommit[]; from: number | null } | { complete: false; read: number; tooMany: boolean }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const repoApi = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+const emptyPunch = () => Array.from({ length: 7 }, () => Array.from({ length: 24 }, () => 0))
+
+// One statistic: its rows once GitHub has computed it, 'pending' while it
+// computes them (202), none for a repository with no commits (204, no body),
+// 'too-large' where it counts none (lines past 10,000 commits, 422).
+function statistic(fullName: string, token: string | null, kind: string, fetchImpl: typeof fetch) {
+  // Stats and lines both need contributors. Share by the original transport;
+  // the per-call status wrapper below would otherwise give each its own read.
+  return shareGithubRead(fetchImpl, JSON.stringify(['statistic', fullName, token, kind]), () => readStatistic(fullName, token, kind, fetchImpl))
+}
+
+async function readStatistic(fullName: string, token: string | null, kind: string, fetchImpl: typeof fetch): Promise<unknown[] | 'pending' | 'too-large'> {
+  let status = 0
+  const answered: typeof fetch = async (input, init) => {
+    const res = await fetchImpl(input, init)
+    status = res.status
+    return res
+  }
+  try {
+    const data = await githubJson(`${repoApi(fullName)}/stats/${kind}`, token, answered)
+    if (status === 202) return 'pending'
+    if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+    return data
+  } catch (err) {
+    if (status === 202) return 'pending'
+    if (status === 204) return []
+    if (err instanceof GithubApiError && err.message === 'github-status-422') return 'too-large'
+    throw err
+  }
+}
+
+// `kinds` of GitHub's statistics, each asked once, together; any still
+// computed, StatsPending.
+async function statistics(fullName: string, token: string | null, kinds: string[], fetchImpl: typeof fetch) {
+  const read = await Promise.all(kinds.map(kind => statistic(fullName, token, kind, fetchImpl)))
+  if (read.includes('pending')) throw new StatsPending()
+  return read.map(rows => rows === 'too-large' ? null : rows as unknown[])
+}
+
+type ActivityRow = { week?: unknown; days?: unknown; total?: unknown }
+type ContributorRow = { author?: { login?: unknown; id?: unknown } | null; weeks?: { w?: unknown; a?: unknown; d?: unknown; c?: unknown }[] }
+
+// The default branch's commits over the last year as GitHub's statistics
+// count them, for a year past YEAR_COMMITS: a week a row, the oldest first,
+// its commits each day (Sunday first) and in all; its contributors (as many
+// as MAX_CONTRIBUTORS, the most commits that year first) and their weeks;
+// and its commits by day of the week and hour, in each commit's own time
+// zone. Lines are GitHub's to count apart (repositoryLines).
+export async function repositoryStats(fullName: string, token: string | null, fetchImpl: typeof fetch = globalThis.fetch): Promise<PulseStats> {
+  const [activityRows = null, contributorRows = null, punchRows = null] = await statistics(fullName, token, ['commit_activity', 'contributors', 'punch_card'], fetchImpl)
+  const weeks = ((activityRows ?? []) as ActivityRow[]).flatMap(row => {
+    if (!Number.isSafeInteger(row?.week)) return []
+    const days = Array.from({ length: 7 }, (_, day) => count(Array.isArray(row.days) ? row.days[day] : 0))
+    return [{ week: (row.week as number) * 1000, days, commits: count(row.total), additions: null, deletions: null }]
+  }).toSorted((a, b) => a.week - b.week)
+  const first = weeks[0]?.week ?? Number.POSITIVE_INFINITY
+  const contributors = ((contributorRows ?? []) as ContributorRow[]).flatMap(row => {
+    const { login, id } = accountOf(row?.author)
+    const theirs = (row?.weeks ?? []).flatMap(item => {
+      const week = count(item?.w) * 1000
+      return week >= first && count(item?.c) > 0 ? [[week, count(item?.c), 0, 0] as [number, number, number, number]] : []
+    })
+    return login && theirs.length > 0 ? [{ login, id, name: null, weeks: theirs, commits: theirs.reduce((sum, item) => sum + item[1], 0) }] : []
+  }).toSorted((a, b) => b.commits - a.commits).slice(0, MAX_CONTRIBUTORS).map(({ login, id, name, weeks: theirs }) => ({ login, id, name, weeks: theirs }))
+  const punch = emptyPunch()
+  for (const row of (punchRows ?? []) as unknown[][]) {
+    if (Array.isArray(row) && Number.isSafeInteger(row[0]) && Number.isSafeInteger(row[1]) && punch[row[0] as number]?.[row[1] as number] !== undefined) {
+      punch[row[0] as number]![row[1] as number] = count(row[2])
+    }
+  }
+  return { weeks, contributors, punch, lines: null }
+}
+
+// The lines added and removed each week since `since`, and each
+// contributor's, as GitHub's statistics count them; none, `lines` false,
+// where it counts none (past 10,000 commits, where it counts each
+// contributor's as none too).
+export async function repositoryLines(fullName: string, token: string | null, since: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<PulseLines> {
+  const [frequency = null, contributorRows = null] = await statistics(fullName, token, ['code_frequency', 'contributors'], fetchImpl)
+  if (frequency === null) return { weeks: [], contributors: [], lines: false }
+  const weeks = frequency.flatMap(row => Array.isArray(row) && Number.isSafeInteger(row[0]) && (row[0] as number) * 1000 >= since
+    ? [[(row[0] as number) * 1000, count(row[1]), count(Math.abs(Number(row[2])))] as [number, number, number]] : [])
+  const contributors = ((contributorRows ?? []) as ContributorRow[]).flatMap(row => {
+    const { login } = accountOf(row?.author)
+    const theirs = (row?.weeks ?? []).flatMap(item => count(item?.w) * 1000 >= since && count(item?.a) + count(item?.d) > 0
+      ? [[count(item?.w) * 1000, count(item?.a), count(item?.d)] as [number, number, number]] : [])
+    return login && theirs.length > 0 ? [{ login, weeks: theirs }] : []
+  })
+  return { weeks, contributors, lines: true }
+}
+
+// The default branch's head, null for a repository with none.
+export async function defaultHead(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<string | null> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql('query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { defaultBranchRef { target { oid } } } }',
+    { owner, name }, token, fetchImpl) as { repository?: { defaultBranchRef?: { target?: { oid?: unknown } | null } | null } | null } | null
+  if (!data?.repository) throw new GithubApiError(404, 'github-not-found')
+  const oid = data.repository.defaultBranchRef?.target?.oid
+  return typeof oid === 'string' && SHA.test(oid) ? oid : null
+}
+
+// The commits from `head` made since `since`, as the Commits tab reads and
+// keeps them (`pages`, historyFrom): on from the parents of those since (or
+// as much as YEAR_SKEW_MS before), not yet listed, YEAR_STARTS at a time,
+// till none is left; the pages kept read
+// of the store, those not of GitHub, as many queries of them as
+// YEAR_QUERIES, the rest left for the next to ask (`complete` false, how
+// many are `read`); more than YEAR_COMMITS, too many (`tooMany`). Read
+// whole, those it was read on past besides (`passed`): undated, or dated
+// before it, a clock behind, the branch's commits since beneath them. Read
+// no further than `need` asks, those since it read whole (`complete`, `from`
+// the newest of those read whose parents are not, every commit after it
+// read; null, the year read whole).
+export async function yearCommits(fullName: string, token: string, head: string, since: number, pages: HistoryPages,
+  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<YearCommits> {
+  const found = new Map<string, HistoryCommit>()
+  const tried = new Set<string>()
+  const within = (commit: HistoryCommit) => commit.committedAt === null || commit.committedAt >= since - YEAR_SKEW_MS
+  const dated = (commit: HistoryCommit) => commit.committedAt !== null && commit.committedAt >= since
+  const read = () => [...found.values()].filter(dated).length
+  const passed = () => [...found.values()].filter(commit => !dated(commit) && within(commit))
+  let queries = 0
+  let starts = [head]
+  while (starts.length > 0) {
+    // Those not read yet, the head before any, else the parents of those
+    // read, no later than the newest of them (but for a clock behind): read
+    // whole after it.
+    const unread = new Set(starts)
+    const from = found.size === 0 ? Number.POSITIVE_INFINITY : Math.max(Number.NEGATIVE_INFINITY, ...[...found.values()]
+      .filter(commit => commit.parents.some(sha => unread.has(sha))).map(commit => commit.committedAt ?? Number.POSITIVE_INFINITY))
+    if (need > since && from < need) return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from }
+    if (queries >= YEAR_QUERIES) return { complete: false, read: read(), tooMany: false }
+    const batch = starts.slice(0, YEAR_STARTS)
+    for (const sha of batch) tried.add(sha)
+    const got = await historyFrom(fullName, token, batch, pages, fetchImpl)
+    if (got.read > 0) queries++
+    for (const commit of got.commits) if (!found.has(commit.sha)) found.set(commit.sha, commit)
+    if (read() > YEAR_COMMITS) return { complete: false, read: read(), tooMany: true }
+    starts = [...new Set([...found.values()].filter(within).flatMap(commit => commit.parents))].filter(sha => !found.has(sha) && !tried.has(sha))
+  }
+  return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from: null }
+}
+
+// Whether an author is a GitHub App's bot: by its login (`<app>[bot]`, as a
+// commit's no-reply address names it, github-accounts.ts commitAccount),
+// else, for one GitHub names no account for, by the name it commits as.
+const bot = (login: string | null | undefined, name: string | null | undefined) => /\[bot\]$/iu.test(login ?? name ?? '')
+
+// Whether an agent made `commit` or co-authored it: its author one of
+// GitHub's agents (common/managed/github-agents.ts githubAgent), or any of
+// its co-authors an agent (commit-coauthors.ts coauthorsOf), as Commits
+// marks them, or any bot, whichever GitHub App's; or one an agent's pull request brought (`merges`,
+// agent-merges.ts agentCommits); or one an account agents work as pushed to
+// the branch directly (`direct`, github-agents.ts agentOperated).
+const withAgent = (commit: HistoryCommit, merges: ReadonlySet<string>, direct: ReadonlySet<string>) => merges.has(commit.sha)
+  || (direct.has(commit.sha) && agentOperated(commit.authorLogin, commit.authorId ?? null))
+  || githubAgent(commit.authorLogin, commit.authorId ?? null, commit.authorName) !== null || bot(commit.authorLogin, commit.authorName)
+  || coauthorsOf(commit).some(coauthor => Boolean(coauthor.agent) || bot(coauthor.login, coauthor.name))
+
+// The year from `first` (pulseSince(52, …)) of `commits`, as GitHub's
+// statistics count them, merges left out: a week a row, its commits each day
+// (UTC) and in all and the lines they added and removed, in all and each day,
+// those that release the repository (`releases`, release-commits.ts) and,
+// of the rest, those an agent made or co-authored, merged from an agent's
+// pull request (`merges`) or pushed directly as an account agents work as
+// (`direct`, withAgent), each day;
+// its contributors,
+// by account (its id, by the login it committed as first listed, the newest,
+// whatever it was renamed from; a login's commits read before ids were, the
+// one account's that committed as it, where only one did), else login, each
+// matched as GitHub matches logins, regardless of case, else name (as many
+// as MAX_CONTRIBUTORS, the most commits first),
+// and their weeks and days, each day's releases and commits with agents too;
+// and its commits by day of the week and hour, in each author's own time
+// zone (else UTC, where GitHub told none), the year's and each period's
+// (PULSE_WEEKS, its last weeks).
+export function commitStats(commits: HistoryCommit[], first: number, merges: ReadonlySet<string> = new Set(), releases: ReadonlySet<string> = new Set(),
+  direct: ReadonlySet<string> = new Set()): PulseStats {
+  const weeks = Array.from({ length: 52 }, (_, at) => ({ week: first + at * WEEK_MS, days: Array.from({ length: 7 }, () => 0), commits: 0, additions: 0, deletions: 0,
+    dayLines: Array.from({ length: 7 }, () => [0, 0] as [number, number]), agentDays: Array.from({ length: 7 }, () => 0), releaseDays: Array.from({ length: 7 }, () => 0),
+    directDays: Array.from({ length: 7 }, () => 0) }))
+  type Counts = Map<number, number[]>
+  const people = new Map<string, { login: string | null; logins: Set<string>; id: number | null; name: string | null; weeks: Counts; days: Counts; commits: number }>()
+  const punches = Object.fromEntries(PULSE_WEEKS.map(span => [span, emptyPunch()]))
+  // Each commit's author, by the key their commits are counted by, and of a
+  // login an account took on, that account (`merged`).
+  const keys = new Map<string, string>()
+  const merged = new Map<string, { login: string | null; id: number | null; name: string | null }>()
+  const add = (counts: Counts, at: number, made: number[]) => counts.set(at, made.map((value, index) => (counts.get(at)?.[index] ?? 0) + value))
+  for (const commit of commits) {
+    if (commit.parents.length > 1 || commit.committedAt === null || commit.committedAt < first) continue
+    const at = Math.floor((commit.committedAt - first) / WEEK_MS)
+    const week = weeks[at]
+    if (!week) continue
+    const [additions, deletions] = [commit.additions ?? 0, commit.deletions ?? 0]
+    const weekday = new Date(commit.committedAt).getUTCDay()
+    week.days[weekday]!++
+    week.dayLines[weekday]![0] += additions
+    week.dayLines[weekday]![1] += deletions
+    week.commits++
+    week.additions += additions
+    week.deletions += deletions
+    const release = releases.has(commit.sha)
+    const agent = !release && withAgent(commit, merges, direct)
+    if (release) week.releaseDays[weekday]!++
+    if (direct.has(commit.sha)) week.directDays[weekday]!++
+    if (agent) week.agentDays[weekday]!++
+    const local = new Date(commit.authoredAt != null && commit.authorZone != null ? commit.authoredAt + commit.authorZone * 60_000 : commit.committedAt)
+    for (const span of PULSE_WEEKS) if (at >= 52 - span) punches[span]![local.getUTCDay()]![local.getUTCHours()]!++
+    const key = commit.authorLogin && commit.authorId != null ? `#${commit.authorId}` : commit.authorLogin ? `@${commit.authorLogin.toLowerCase()}`
+      : commit.authorName ? `=${commit.authorName}` : null
+    if (!key) continue
+    keys.set(commit.sha, key)
+    const person = people.get(key) ?? { login: commit.authorLogin, logins: new Set<string>(), id: commit.authorId ?? null, name: commit.authorName,
+      weeks: new Map(), days: new Map(), commits: 0 }
+    if (commit.authorLogin) person.logins.add(commit.authorLogin.toLowerCase())
+    add(person.weeks, week.week, [1, additions, deletions])
+    add(person.days, Math.floor(commit.committedAt / DAY_MS) * DAY_MS, [1, additions, deletions, agent ? 1 : 0, release ? 1 : 0, direct.has(commit.sha) ? 1 : 0])
+    person.commits++
+    people.set(key, person)
+  }
+  // A login one account committed as, those of its commits read before ids
+  // were that account's; one more did, theirs apart, no one's.
+  const accounts = Map.groupBy([...people.values()].filter(person => person.id !== null).flatMap(person => [...person.logins].map(login => ({ login, person }))),
+    ({ login }) => login)
+  for (const [key, person] of people) {
+    const [owner, ...others] = person.login !== null && person.id === null ? accounts.get(person.login.toLowerCase()) ?? [] : []
+    if (!owner || others.length > 0) continue
+    const account = owner.person
+    for (const [week, counts] of person.weeks) add(account.weeks, week, counts)
+    for (const [day, counts] of person.days) add(account.days, day, counts)
+    account.commits += person.commits
+    people.delete(key)
+    merged.set(key, account)
+  }
+  const rows = (counts: Counts) => [...counts].toSorted(([a], [b]) => a - b).map(([at, made]) => [at, ...made])
+  const contributors = [...people.values()].toSorted((a, b) => b.commits - a.commits).slice(0, MAX_CONTRIBUTORS).map(({ login, id, name, weeks: theirs, days }) => ({
+    login, id, name, weeks: rows(theirs) as [number, number, number, number][], days: rows(days) as [number, number, number, number, number, number, number][] }))
+  // Each pushed directly by the contributor its author's commits are counted
+  // as, whatever account it named.
+  const directCommits = commits.filter(commit => direct.has(commit.sha) && commit.committedAt !== null && commit.committedAt >= first)
+    .toSorted((a, b) => b.committedAt! - a.committedAt!).slice(0, DIRECT_LISTED).map((commit): PulseCommit => {
+      const { sha, committedAt, subject, authorLogin, authorId, authorName } = commit
+      const author = people.get(keys.get(sha) ?? '') ?? merged.get(keys.get(sha) ?? '') ?? { login: authorLogin, id: authorId ?? null, name: authorName }
+      const kind = releases.has(sha) ? 'release' : withAgent(commit, merges, direct) ? 'agent' : 'without'
+      return { sha, at: committedAt!, subject, login: author.login, id: author.id, name: author.name, kind }
+    })
+  return { weeks, contributors, punch: punches[52]!, punches, lines: true, directCommits }
+}
+
+// The year's statistics as a period of `weeks` weeks shows them: when its
+// commits are made, the period's where they were counted from its commits
+// (`periodPunch`), else the year's or more, as GitHub's statistics count it;
+// the commits pushed to the branch directly, the period's alone.
+export function periodStats(stats: PulseStats, weeks: number) {
+  const { punches, directCommits, ...rest } = stats
+  const punch = punches?.[weeks]
+  const since = stats.weeks.at(-weeks)?.week ?? Number.NEGATIVE_INFINITY
+  return { ...rest, punch: punch ?? rest.punch, periodPunch: Boolean(punch), ...directCommits ? { directCommits: directCommits.filter(commit => commit.at >= since) } : {} }
+}
+
+// GitHub's statistics of a year past YEAR_COMMITS (repositoryStats) with
+// its `lines` added in, each week's and each contributor's, by login; null
+// while GitHub is counting them, `lines` null.
+export function withLines(stats: PulseStats, lines: PulseLines | null): PulseStats {
+  if (!lines) return { ...stats, lines: null }
+  if (!lines.lines) return { ...stats, lines: false }
+  const weekly = new Map(lines.weeks.map(([week, additions, deletions]) => [week, [additions, deletions]]))
+  const theirs = new Map(lines.contributors.map(person => [person.login, new Map(person.weeks.map(([week, additions, deletions]) => [week, [additions, deletions]]))]))
+  return {
+    ...stats,
+    weeks: stats.weeks.map(week => ({ ...week, additions: weekly.get(week.week)?.[0] ?? 0, deletions: weekly.get(week.week)?.[1] ?? 0 })),
+    contributors: stats.contributors.map(person => ({ ...person, weeks: person.weeks.map(([week, made]) => {
+      const added = person.login ? theirs.get(person.login)?.get(week) : undefined
+      return [week, made, added?.[0] ?? 0, added?.[1] ?? 0] as [number, number, number, number]
+    }) })),
+    lines: true,
+  }
+}
+
+// Where a period of `weeks` weeks starts, as GitHub's statistics count weeks:
+// the Sunday (UTC) that many weeks back, this week the last of them.
+export function pulseSince(weeks: number, now: number) {
+  const today = Math.floor(now / DAY_MS) * DAY_MS
+  const sunday = today - new Date(today).getUTCDay() * DAY_MS
+  return sunday - (weeks - 1) * WEEK_MS
+}
+
+const SEARCH = (name: string, fragment: string, first = 0) => `${name}: search(type: ISSUE, query: $${name}, first: ${Math.max(first, 1)}) {
+    issueCount${first > 0 ? ` nodes { ...${fragment} }` : ''}
+  }`
+const ACTIVITY_QUERY = `query($merged: String!, $mergedBefore: String!, $opened: String!, $openedBefore: String!,
+  $closed: String!, $closedBefore: String!, $created: String!, $createdBefore: String!) {
+  ${SEARCH('merged', 'pull', SEARCHED)}
+  ${SEARCH('mergedBefore', 'pull')}
+  ${SEARCH('opened', 'pull', LISTED)}
+  ${SEARCH('openedBefore', 'pull')}
+  ${SEARCH('closed', 'issue', SEARCHED)}
+  ${SEARCH('closedBefore', 'issue')}
+  ${SEARCH('created', 'issue', LISTED)}
+  ${SEARCH('createdBefore', 'issue')}
+}
+fragment pull on PullRequest { number title pullState: state isDraft createdAt mergedAt author { ${ACTOR} } }
+fragment issue on Issue { number title issueState: state stateReason createdAt closedAt author { ${ACTOR} } }`
+
+type SearchNode = { number?: unknown; title?: unknown; pullState?: unknown; issueState?: unknown; isDraft?: unknown; stateReason?: unknown
+  createdAt?: unknown; mergedAt?: unknown; closedAt?: unknown; author?: GraphAccount } | null
+type Search = { issueCount?: unknown; nodes?: SearchNode[] } | null | undefined
+const REASONS: Record<string, string> = { COMPLETED: 'completed', NOT_PLANNED: 'not-planned', DUPLICATE: 'duplicate' }
+
+// An issue or pull request a search lists, as the popup's preview of it
+// takes one, `at` when it was merged, opened or closed.
+function listed(node: SearchNode, at: unknown) {
+  if (!node || !Number.isSafeInteger(node.number) || (node.number as number) <= 0) return null
+  const title = typeof node.title === 'string' ? node.title.trim().slice(0, MAX_TITLE) : ''
+  const author = actorOf(node.author)
+  const common = { number: node.number as number, title, author: author.login, authorId: author.id, at: timeOf(at), createdAt: timeOf(node.createdAt) }
+  return node.pullState === undefined
+    ? { ...common, kind: 'issues', state: node.issueState === 'OPEN' ? 'open' : 'closed', reason: REASONS[String(node.stateReason)] ?? null }
+    : { ...common, kind: 'pulls', state: node.pullState === 'MERGED' ? 'merged' : node.pullState === 'OPEN' ? 'open' : 'closed', draft: node.isDraft === true }
+}
+
+// The pull requests merged and opened and the issues closed and opened since
+// the start of the week `weeks` weeks back (`since`), and over the same days
+// of the week `weeks` weeks earlier (`previous`, its count: a week's Sunday to
+// Thursday beside the week before's, not the days just before, whose days of
+// the week differ), the latest of each listed, as many as LISTED: those
+// opened as GitHub sorts them, those merged or closed the latest of the
+// SEARCHED most recently updated, which are the latest of all where the
+// period holds no more, or the last listed was merged or closed after the
+// SEARCHED-th was last updated. A search counts by the day (UTC). Narrowed
+// (`narrowing`), those of its days from `from` to `to` (both days, UTC;
+// none, on), and those its `authors` (GitHub logins) opened, any of them.
+export async function repositoryActivity(fullName: string, token: string, weeks: number, now: number = Date.now(), fetchImpl: typeof fetch = globalThis.fetch,
+  narrowing: PulseNarrowing | null = null) {
+  const since = pulseSince(weeks, now)
+  const back = weeks * WEEK_MS
+  const day = (at: number) => new Date(at).toISOString().slice(0, 10)
+  const current = narrowing?.to == null ? `>=${day(narrowing?.from ?? since)}` : `${day(narrowing.from)}..${day(narrowing.to)}`
+  const previous = `${day(since - back)}..${day(now - back)}`
+  const repo = `repo:${fullName}`
+  // An app's login (`name[bot]`) is searched for as GitHub names its app.
+  const by = (narrowing?.authors ?? []).map(login => ` author:${login.endsWith('[bot]') ? `app/${login.slice(0, -5)}` : login}`).join('')
+  const asked = (what: string, range: string, sort: string) => `${repo} ${what}${range}${by} sort:${sort}`
+  const kinds = {
+    merged: ['is:pr is:merged merged:', 'updated-desc'], opened: ['is:pr created:', 'created-desc'],
+    closed: ['is:issue is:closed closed:', 'updated-desc'], created: ['is:issue created:', 'created-desc'],
+  } as const
+  const variables = Object.fromEntries(Object.entries(kinds).flatMap(([name, [what, sort]]) => [[name, asked(what, current, sort)],
+    [`${name}Before`, asked(what, previous, sort)]]))
+  const data = await githubGraphql(ACTIVITY_QUERY, variables, token, fetchImpl) as Record<string, Search> | null
+  const at = { merged: 'mergedAt', opened: 'createdAt', closed: 'closedAt', created: 'createdAt' } as const
+  const told = Object.fromEntries((Object.keys(kinds) as (keyof typeof kinds)[]).map(name => [name, {
+    count: count(data?.[name]?.issueCount),
+    previous: count(data?.[`${name}Before`]?.issueCount),
+    items: (data?.[name]?.nodes ?? []).flatMap(node => listed(node, node?.[at[name]]) ?? []).toSorted((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, LISTED),
+  }]))
+  return { since, previousSince: since - back, ...told }
+}