@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.51

package/server-managed/import-triage.ts

@@ -0,0 +1,51 @@
+import { createHash } from 'node:crypto'
+import type { ManagedDb } from './db-methods.ts'
+import type { ManagedComment } from '../common/managed/comments.ts'
+import type { TriageEntryPatch } from '../common/managed/triage.ts'
+import { triageWireEntry } from './triage-response.ts'
+
+export interface ImportTriageSnapshot {
+  entry: TriageEntryPatch | null
+  comments: ManagedComment[]
+  version: string
+}
+export interface ImportTriageStore {
+  getImportTriage(ids: readonly string[]): Promise<Record<string, ImportTriageSnapshot>>
+  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string, now: number): Promise<boolean>
+}
+
+// Raw store methods share one transaction for comparison, triage, and comments.
+export function importTriageMethods(store: Pick<ManagedDb, 'getReport' | 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
+  async function snapshot(ids: readonly string[]) {
+    const rows = new Map((await store.listTriage(ids)).map(row => [row.findingId, row]))
+    const comments = await store.listComments(ids)
+    return Object.fromEntries(ids.map(id => {
+      const row = rows.get(id)
+      const entry = row ? triageWireEntry(row) : null
+      const own = comments.filter(comment => comment.findingId === id)
+      const version = createHash('sha256').update(JSON.stringify([entry, row?.updatedAt, own])).digest('hex')
+      return [id, { entry, comments: own, version }]
+    }))
+  }
+  return {
+    getImportTriage: snapshot,
+    async importTriage(entries, expected, actor, reportId, now) {
+      // A report deleted after the HTTP membership check must not leave newly
+      // imported annotations behind. Check existence in the write transaction.
+      if (!reportId || !(await store.getReport(reportId))) return false
+      const current = await snapshot(entries.map(([id]) => id))
+      if (entries.some(([id]) => current[id]!.version !== expected[id])) return false
+      const changes: [string, TriageEntryPatch | null][] = []
+      for (const [id, value] of entries) {
+        const { comment, ...entry } = value ?? {}
+        changes.push([id, Object.keys(entry).length > 0 ? entry : null])
+        if (comment && !current[id]!.comments.some(existing => existing.body === comment)) {
+          await store.createComment({ findingId: id, body: comment, authorId: null, authorLogin: null,
+            actor, createdAt: null, updatedAt: null, reportId }, now)
+        }
+      }
+      await store.setTriageEntries(changes, actor.id, actor.login, now, reportId)
+      return true
+    },
+  }
+}

package/server-managed/index.ts

@@ -0,0 +1,192 @@
+// Managed HTTP app and standalone boot. The combined launcher mounts this
+// same app on e2e's listener; storage, routing and cleanup stay here.
+import { randomUUID } from 'node:crypto'
+import { type Server, createServer } from 'node:http'
+import { fileURLToPath } from 'node:url'
+import { createOriginGate } from '../server-common/origin.ts'
+import { managedStorageLines } from '../server-common/storage-log.ts'
+import { runReapers, withReap } from '../server-common/reap.ts'
+import { startServer } from '../server-common/standalone.ts'
+import { initializeApp } from '../server-common/initialize.ts'
+import { type ManagedConfig, loadManagedConfig } from './config.ts'
+import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
+import { setNpmTarballCache } from './npm-loads.ts'
+import { assembledReviewedDependencies } from './reviewed-dependencies.ts'
+import { setNpmDocumentCache } from './npm-packages.ts'
+import { loadManagedStatic } from './static.ts'
+import { openManagedStorage } from './storage.ts'
+import { setCacheDir } from '@preventive/upstream/npm.js'
+
+// Housekeeping runs on ordinary traffic too, including serverless instances
+// without a timer or cron. Failed sweeps retry on later traffic after a minute.
+const REAP_INTERVAL_MS = 3_600_000
+const REAP_RETRY_MS = 60_000
+
+// `ui: false` serves only the API: `out/` is never read.
+type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown' | 'reviewedDependencies'>> & { ui?: boolean }
+
+export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
+  // Audits keep upstream's records on disk where the config has a cache
+  // directory; bundle builds set it in their own worker. The npm viewer
+  // keeps the tarballs it downloads there too, beside theirs, and public
+  // packages' whole documents (npm-packages.ts).
+  setCacheDir(config.upstreamCacheDir ?? false)
+  setNpmTarballCache(config.upstreamCacheDir ?? null)
+  setNpmDocumentCache(config.upstreamCacheDir ?? null)
+  // Load the optional peer only for serverless managed deployments. Embedding
+  // hosts can discard listener promises, so retain maintenance inside the app.
+  const waitUntil = config.serverless ? (await import('@vercel/functions')).waitUntil : undefined
+  // The host's reviewed dependencies, registered before; none after.
+  const reviewedDependencies = assembledReviewedDependencies()
+  const assembled = { ...options, ...reviewedDependencies ? { reviewedDependencies } : {} }
+  return await initializeApp(rollback => assembleManagedApp(config, assembled, rollback, waitUntil))
+}
+
+async function assembleManagedApp(config: ManagedConfig, { ui = true, ...options }: ManagedAppOptions, rollback: AsyncDisposableStack, waitUntil?: (promise: Promise<unknown>) => void) {
+  const storage = await openManagedStorage(config)
+  const { db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, prettyCache, npmCacheStorage, repositoryCodeStorage } = storage
+  rollback.defer(() => db.close())
+  const originGate = createOriginGate(config.host, config.trustProxyEnv)
+
+  let shuttingDown = false
+  const isShuttingDown = () => shuttingDown || options.isShuttingDown?.() === true
+  const inFlight = new Set<Promise<unknown>>()
+  function track(p: Promise<unknown>): void {
+    inFlight.add(p)
+    p.finally(() => inFlight.delete(p)).catch(() => {})
+  }
+
+  const serveStatic = ui ? loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
+    indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
+  }) : () => false
+  const routeRequest = createManagedRequestHandler({
+    ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, prettyCache, npmCacheStorage, repositoryCodeStorage, originGate, serveStatic,
+    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}), ...(waitUntil ? { waitUntil } : {}),
+    isShuttingDown, track,
+  })
+
+  let cleanup: Promise<void> | undefined, nextCleanupAt = 0
+  const maintenance = new AbortController()
+  function reap(automatic = false): Promise<void> {
+    if (cleanup) return cleanup
+    if (isShuttingDown()) return Promise.resolve()
+    const startedAt = Date.now()
+    nextCleanupAt = startedAt + REAP_INTERVAL_MS
+    let sessions = 0, uploads = 0
+    cleanup = (async () => {
+      const owner = automatic && config.serverless ? randomUUID() : null
+      if (owner && !await db.claimMaintenanceLease(owner, startedAt, startedAt + Math.max(300_000, (config.storageEncryptionMigrateMaxMs ?? 0) + 60_000), config.storageEncryptionMigrate)) return false
+      let succeeded = false
+      try {
+        await runReapers({
+          sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
+          ...(storage.reapUploads ? { uploads: async () => { uploads = await storage.reapUploads!(maintenance.signal) } } : {}),
+          ...('reapPrettyCopies' in storage ? { prettyCopies: () => storage.reapPrettyCopies(maintenance.signal) } : {}),
+          ...('reapStorage' in storage ? { storage: () => storage.reapStorage(maintenance.signal) } : {}),
+        })
+        succeeded = true
+        return true
+      } finally {
+        if (owner) await db.finishMaintenanceLease(owner, Date.now() + (succeeded ? REAP_INTERVAL_MS : REAP_RETRY_MS))
+      }
+    })().then(ran => {
+      nextCleanupAt = Date.now() + REAP_INTERVAL_MS
+      if (!ran) return
+      return console.info(`managed-reaper: removed ${sessions} expired session(s), ${uploads} stale upload part(s) in ${Date.now() - startedAt}ms`)
+    }, err => {
+      nextCleanupAt = Date.now() + REAP_RETRY_MS
+      throw err
+    }).finally(() => { cleanup = undefined })
+    track(cleanup)
+    return cleanup
+  }
+  function automaticReap(): Promise<void> {
+    if (isShuttingDown() || cleanup || Date.now() < nextCleanupAt) return Promise.resolve()
+    return reap(true).catch(err => console.warn('managed-reaper: cleanup failed:', err))
+  }
+  async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
+    // Register before routing can end the response, including when init()'s
+    // listener is mounted in Fastify rather than using api/managed.ts.
+    const pendingMaintenance = automaticReap(); waitUntil?.(pendingMaintenance)
+    try { await routeRequest(req, res) }
+    finally { await pendingMaintenance }
+  }
+  const gcTimer = config.serverless ? null : setInterval(() => {
+    void automaticReap()
+  }, REAP_INTERVAL_MS)
+  rollback.defer(stop)
+
+  function stop(): void {
+    shuttingDown = true
+    maintenance.abort()
+    if (gcTimer) clearInterval(gcTimer)
+  }
+
+  async function close(): Promise<void> {
+    stop()
+    if (inFlight.size > 0) await Promise.allSettled([...inFlight])
+    await db.close()
+  }
+  return { handleRequest, reap, isShuttingDown, stop, close }
+}
+
+export function logManagedStartup(config: ManagedConfig, port: number, mode = 'managed'): void {
+  console.log([
+    `DeepView managed server (${mode}):`,
+    `  HTTP: http://${config.host}:${port}/`,
+    ...managedStorageLines(config),
+  ].join('\n'))
+}
+
+export async function init(config = loadManagedConfig(), options: Pick<ManagedAppOptions, 'ui'> = {}): Promise<Server> {
+  const app = await createManagedApp(config, options)
+  const server = createServer(withReap(app.handleRequest, { managed: app.reap }, { isShuttingDown: app.isShuttingDown }))
+  let disposal: Promise<void> | undefined
+  function dispose(): Promise<void> {
+    if (!disposal) {
+      app.stop()
+      disposal = (async () => {
+        try {
+          if (server.listening) {
+            await new Promise<void>((resolve, reject) => {
+              server.close(err => { if (err) reject(err); else resolve() })
+            })
+          }
+        } finally {
+          try { await app.close() }
+          finally {
+            server.off('error', onError)
+            server.off('close', onClose)
+            server.off('listening', onListening)
+          }
+        }
+      })()
+    }
+    return disposal
+  }
+  // Embedding hosts can await full cleanup even when they only copied the
+  // request listener and never bound this server. Repeated disposal is safe.
+  server[Symbol.asyncDispose] = dispose
+
+  function onError(): void { onClose() }
+  function onClose(): void {
+    if (!disposal) void dispose().catch(err => { console.error('Managed server cleanup failed:', err) })
+  }
+  function onListening(): void {
+    const address = server.address()
+    const port = typeof address === 'object' && address ? address.port : config.port
+    logManagedStartup(config, port)
+  }
+  server.on('error', onError)
+  server.once('close', onClose)
+  server.on('listening', onListening)
+  return server
+}
+
+export async function start(): Promise<void> {
+  const config = loadManagedConfig()
+  const server = await init(config)
+  startServer(server, config)
+}
+
+if (import.meta.main) await start()

package/server-managed/kept-briefly.ts

@@ -0,0 +1,37 @@
+// What was lately worked out, kept a little while in memory for whoever asks
+// for it next, by key: each for `keptMs` from when it was kept, the least
+// lately read going first past `maxEntries` of them or `maxBytes` between
+// them, and one that alone takes more than `maxBytes` not kept at all.
+// Whoever reads one is the caller's to check, as they would one worked out.
+export function keptBriefly<T>({ keptMs, maxBytes, maxEntries = Infinity }: { keptMs: number; maxBytes: number; maxEntries?: number }) {
+  const held = new Map<string, { value: T; bytes: number; timer: ReturnType<typeof setTimeout> }>()
+  let heldBytes = 0
+  const forget = (key: string) => {
+    const entry = held.get(key)
+    if (!entry) return
+    clearTimeout(entry.timer)
+    held.delete(key)
+    heldBytes -= entry.bytes
+  }
+  return {
+    get(key: string): T | undefined {
+      const entry = held.get(key)
+      if (!entry) return undefined
+      held.delete(key)
+      held.set(key, entry)
+      return entry.value
+    },
+    keep(key: string, value: T, bytes: number) {
+      if (bytes > maxBytes) return
+      forget(key)
+      for (const old of held.keys()) {
+        if (held.size < maxEntries && heldBytes + bytes <= maxBytes) break
+        forget(old)
+      }
+      const timer = setTimeout(() => { forget(key) }, keptMs)
+      timer.unref()
+      held.set(key, { value, bytes, timer })
+      heldBytes += bytes
+    },
+  }
+}

package/server-managed/kept.ts

@@ -0,0 +1,28 @@
+// Answers kept for an hour, by what they answer (npm-insights.ts,
+// npm-provenance.ts), at most `max` of them, the oldest asked going first;
+// one still being asked for is shared, and one that failed, or that `whole`
+// says is partial, is dropped once it is answered. `peek` gives one already
+// answered, asking for nothing; undefined where none is.
+const KEPT_MS = 60 * 60_000
+
+export function kept<T>(max: number, whole: (value: T) => boolean = () => true) {
+  const answers = new Map<string, { at: number; value: Promise<T>; answered?: { value: T } }>()
+  const get = (key: string, ask: () => Promise<T>): Promise<T> => {
+    const now = Date.now()
+    const hit = answers.get(key)
+    if (hit && now - hit.at < KEPT_MS) return hit.value
+    const value = ask()
+    const entry: { at: number; value: Promise<T>; answered?: { value: T } } = { at: now, value }
+    answers.delete(key)
+    answers.set(key, entry)
+    while (answers.size > max) answers.delete(answers.keys().next().value!)
+    const drop = () => { if (answers.get(key) === entry) answers.delete(key) }
+    value.then(answer => { if (whole(answer)) entry.answered = { value: answer }; else drop(); return answer }, drop)
+    return value
+  }
+  const peek = (key: string): T | undefined => {
+    const hit = answers.get(key)
+    return hit?.answered && Date.now() - hit.at < KEPT_MS ? hit.answered.value : undefined
+  }
+  return Object.assign(get, { peek })
+}

package/server-managed/link-reports.ts

@@ -0,0 +1,162 @@
+// Global deduplication reports live entirely in SQL. The payload is authenticated
+// ciphertext bound to its row, using the deployment's existing storage key.
+import { Buffer } from 'node:buffer'
+import { createHash, randomUUID } from 'node:crypto'
+import { type StorageKey, unwrapStorageValue, wrapStorageValue } from '../server-common/storage-crypto.ts'
+import { parseLinkedFindings } from '../client/linked-findings.js'
+import type { ManagedSql } from './sql.ts'
+import { ManagedMutationError } from './management.ts'
+
+export const LINK_REPORT_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_link_report (
+  id TEXT PRIMARY KEY, filename TEXT NOT NULL, sha256 TEXT NOT NULL UNIQUE,
+  encrypted_groups TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 1,
+  group_count INTEGER NOT NULL, finding_count INTEGER NOT NULL,
+  uploaded_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  uploaded_by_login TEXT, uploaded_at INTEGER NOT NULL
+) STRICT;
+`
+export interface LinkReport {
+  id: string; filename: string; enabled: boolean; groupCount: number; findingCount: number
+  uploadedByLogin: string | null; uploadedAt: number
+}
+export interface LinkReportStore {
+  listLegacyLinkReports(): Promise<{ id: string; filename: string }[]>
+  migrateLinkReport(id: string, content: string): Promise<boolean>
+  listLinkReports(): Promise<LinkReport[]>
+  getLinkReport(sessionId: string, id: string): Promise<LinkReport & { groups: string[][] }>
+  getLinkRevision(): Promise<string>
+  getEnabledLinkGroups(revision: string): Promise<string[][]>
+  importLinkReport(sessionId: string, filename: string, content: string): Promise<{ report: LinkReport; reused: boolean }>
+  setLinkReportEnabled(sessionId: string, id: string, enabled: boolean): Promise<void>
+}
+const columns = `id, filename, enabled, group_count AS groupCount, finding_count AS findingCount,
+  uploaded_by_login AS uploadedByLogin, uploaded_at AS uploadedAt`
+const identity = (id: string) => `managed_link_report.encrypted_groups:${id}`
+function decryptGroups(key: StorageKey | null, id: string, payload: string): string[][] {
+  if (!key) throw new ManagedMutationError(503, 'storage-encryption-required')
+  const plain = unwrapStorageValue(key, identity(id), payload)
+  try { return JSON.parse(plain.toString('utf8')) as string[][] } finally { plain.fill(0) }
+}
+export async function linkRevision(db: ManagedSql): Promise<string> {
+  return linkRevisionOf(await db.prepare('SELECT id, sha256 FROM managed_link_report WHERE enabled = 1 ORDER BY id').all())
+}
+// The revision of the enabled link reports' `{ id, sha256 }` rows, by id,
+// however they were read.
+export function linkRevisionOf(rows: unknown[]): string {
+  return rows.length > 0 ? createHash('sha256').update(JSON.stringify(rows)).digest('base64url') : ''
+}
+function parseLinkReport(content: string) {
+  const parsed = parseLinkedFindings(content)
+  if (parsed) return parsed
+  // Older managed exports may carry the normalized links envelope.
+  try {
+    const data = JSON.parse(content)
+    if (data?.source !== 'links' || !Array.isArray(data.links) || !Array.isArray(data.findings) || data.findings.length > 0) return null
+    return data.links.length === 0 ? { groups: [], skipped: 0 } : parseLinkedFindings(JSON.stringify(data.links))
+  } catch { return null }
+}
+export function linkReportMethods(db: ManagedSql, key: StorageKey | null): LinkReportStore {
+  const map = (row: Omit<LinkReport, 'enabled'> & { enabled: number }): LinkReport => ({ ...row, enabled: row.enabled === 1 })
+  async function authorize(sessionId: string) {
+    const user = await db.prepare(`SELECT u.id, u.login, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { id: string; login: string; role: string } | undefined
+    if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+    if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+    return user
+  }
+  return {
+    async listLegacyLinkReports() {
+      return await db.prepare("SELECT id, filename FROM managed_report WHERE analyzer = 'links' ORDER BY id").all() as { id: string; filename: string }[]
+    },
+    async migrateLinkReport(id, content) {
+      const row = await db.prepare(`SELECT filename, sha256, visible, uploaded_by AS uploadedBy,
+        uploaded_by_login AS uploadedByLogin, uploaded_at AS uploadedAt FROM managed_report WHERE id = ? AND analyzer = 'links'`).get(id) as {
+        filename: string; sha256: string; visible: number; uploadedBy: string | null; uploadedByLogin: string | null; uploadedAt: number
+      } | undefined
+      if (!row) return false
+      if (!key) throw new Error('Managed link reports require MANAGED_STORAGE_ENCRYPTION_KEY')
+      if (createHash('sha256').update(content).digest('base64url') !== row.sha256) throw new Error('Legacy link report content changed')
+      const parsed = parseLinkReport(content)
+      if (!parsed) throw new Error('Invalid legacy link report')
+      const plain = Buffer.from(JSON.stringify(parsed.groups))
+      try {
+        const sha256 = createHash('sha256').update(plain).digest('base64url')
+        await db.prepare(`INSERT INTO managed_link_report
+          (id, filename, sha256, encrypted_groups, enabled, group_count, finding_count, uploaded_by, uploaded_by_login, uploaded_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(sha256) DO NOTHING`).run(
+          id, row.filename, sha256, wrapStorageValue(key, identity(id), plain), row.visible,
+          parsed.groups.length, new Set(parsed.groups.flat()).size, row.uploadedBy, row.uploadedByLogin, row.uploadedAt)
+        await db.prepare('DELETE FROM managed_report WHERE id = ?').run(id)
+      } finally { plain.fill(0) }
+      return true
+    },
+    async listLinkReports() {
+      return (await db.prepare(`SELECT ${columns} FROM managed_link_report ORDER BY uploaded_at DESC, id`).all() as Parameters<typeof map>[0][]).map(map)
+    },
+    async getLinkReport(sessionId, id) {
+      await authorize(sessionId)
+      const row = await db.prepare(`SELECT ${columns}, encrypted_groups AS payload FROM managed_link_report WHERE id = ?`).get(id) as (Parameters<typeof map>[0] & { payload: string }) | undefined
+      if (!row) throw new ManagedMutationError(404, 'no-link-report')
+      const { payload, ...report } = row
+      return { ...map(report), groups: decryptGroups(key, id, payload) }
+    },
+    getLinkRevision: () => linkRevision(db),
+    async getEnabledLinkGroups(revision) {
+      if (await linkRevision(db) !== revision) throw new ManagedMutationError(409, 'deduplication-changed')
+      const rows = await db.prepare('SELECT id, encrypted_groups AS payload FROM managed_link_report WHERE enabled = 1 ORDER BY id').all() as { id: string; payload: string }[]
+      if (rows.length > 0 && !key) throw new Error('Managed link reports require MANAGED_STORAGE_ENCRYPTION_KEY')
+      return rows.flatMap(row => decryptGroups(key, row.id, row.payload))
+    },
+    async importLinkReport(sessionId, filename, content) {
+      const user = await authorize(sessionId)
+      if (!key) throw new ManagedMutationError(503, 'storage-encryption-required')
+      const parsed = parseLinkReport(content)
+      if (!parsed || parsed.skipped) throw new ManagedMutationError(400, 'invalid-link-report')
+      const plain = Buffer.from(JSON.stringify(parsed.groups))
+      const sha256 = createHash('sha256').update(plain).digest('base64url')
+      try {
+        const existing = await db.prepare(`SELECT ${columns} FROM managed_link_report WHERE sha256 = ?`).get(sha256) as Parameters<typeof map>[0] | undefined
+        if (existing) return { report: map(existing), reused: true }
+        const id = randomUUID(), uploadedAt = Date.now()
+        const findingCount = new Set(parsed.groups.flat()).size, groupCount = parsed.groups.length
+        await db.prepare(`INSERT INTO managed_link_report
+          (id, filename, sha256, encrypted_groups, group_count, finding_count, uploaded_by, uploaded_by_login, uploaded_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, filename, sha256, wrapStorageValue(key, identity(id), plain), groupCount, findingCount, user.id, user.login, uploadedAt)
+        return { report: { id, filename, enabled: true, groupCount, findingCount, uploadedByLogin: user.login, uploadedAt }, reused: false }
+      } finally { plain.fill(0) }
+    },
+    async setLinkReportEnabled(sessionId, id, enabled) {
+      await authorize(sessionId)
+      if (!(await db.prepare('UPDATE managed_link_report SET enabled = ? WHERE id = ?').run(+enabled, id)).changes) throw new ManagedMutationError(404, 'no-link-report')
+    },
+  }
+}
+
+// Merge complete components BEFORE projecting them onto the response. An ID
+// absent from every returned report can still bridge two visible findings.
+export function mergeLinkGroups(groups: readonly string[][], present?: ReadonlySet<string>): string[][] {
+  const parents = new Map<string, string>()
+  const root = (id: string): string => {
+    if (!parents.has(id)) parents.set(id, id)
+    let value = id
+    while (parents.get(value) !== value) {
+      parents.set(value, parents.get(parents.get(value)!)!)
+      value = parents.get(value)!
+    }
+    return value
+  }
+  for (const ids of groups) {
+    if (ids.length === 0) continue
+    const first = root(ids[0]!)
+    for (const id of ids.slice(1)) { const other = root(id); if (other !== first) parents.set(other, first) }
+  }
+  const merged = new Map<string, string[]>()
+  for (const id of parents.keys()) {
+    if (present && !present.has(id)) continue
+    const key = root(id)
+    const ids = merged.get(key) ?? []
+    ids.push(id); merged.set(key, ids)
+  }
+  return [...merged.values()].filter(ids => ids.length >= 2)
+}

package/server-managed/listed-activity.ts

@@ -0,0 +1,39 @@
+// A period's pull requests and issues, as the Pulse shows them
+// (repository-pulse.ts repositoryActivity), told of those the repository's
+// tabs keep (repository-pulls.ts readList) rather than searched for.
+import { LISTED, type PulseNarrowing, pulseSince } from './repository-pulse.ts'
+import type { KeptIssue, KeptPull } from './repository-pulls.ts'
+
+const DAY_MS = 24 * 60 * 60_000
+const WEEK_MS = 7 * DAY_MS
+
+// What repositoryActivity tells, of the pull requests and issues kept
+// (repository-pulls.ts readList: `pulls` and `issues`, those updated since
+// the period before it started all read): each counted by the day (UTC), as
+// a search counts it, its narrowing's `authors` by login whatever its case,
+// an app's bot (`name[bot]`) its own, not a user's of its name, and the
+// latest of each listed, as many
+// as LISTED, those merged or closed the latest of all.
+export function listedActivity(pulls: KeptPull[], issues: KeptIssue[], weeks: number, now: number = Date.now(), narrowing: PulseNarrowing | null = null) {
+  const since = pulseSince(weeks, now)
+  const back = weeks * WEEK_MS
+  const dayOf = (at: number) => Math.floor(at / DAY_MS) * DAY_MS
+  const [from, to] = [dayOf(narrowing?.from ?? since), narrowing?.to == null ? Number.POSITIVE_INFINITY : dayOf(narrowing.to) + DAY_MS]
+  const [before, beforeEnd] = [dayOf(since - back), dayOf(now - back) + DAY_MS]
+  // A login whatever its case, a bot's (`name[bot]`, as REST names it) apart from a user's of its name.
+  const loginOf = (login: string, bot = false) => `${login.toLowerCase().replace(/\[bot\]$/u, '')}${bot || /\[bot\]$/iu.test(login) ? '[bot]' : ''}`
+  const authors = new Set((narrowing?.authors ?? []).map(login => loginOf(login)))
+  const by = (row: KeptPull | KeptIssue) => authors.size === 0 || (row.author !== null && authors.has(loginOf(row.author, row.bot)))
+  const told = <T extends KeptPull | KeptIssue>(rows: T[], when: (row: T) => number | null, item: (row: T, at: number) => object) => {
+    const timed = rows.flatMap(row => { const at = when(row); return at !== null && by(row) ? [{ row, at }] : [] })
+    const within = timed.filter(({ at }) => at >= from && at < to)
+    return { count: within.length, previous: timed.filter(({ at }) => at >= before && at < beforeEnd).length,
+      items: within.toSorted((a, b) => b.at - a.at).slice(0, LISTED).map(({ row, at }) => item(row, at)) }
+  }
+  const common = (row: KeptPull | KeptIssue, at: number) => ({ number: row.number, title: row.title, author: row.author, authorId: row.authorId ?? null, at,
+    createdAt: row.createdAt })
+  const pull = (row: KeptPull, at: number) => ({ ...common(row, at), kind: 'pulls', state: row.state, draft: row.draft })
+  const issue = (row: KeptIssue, at: number) => ({ ...common(row, at), kind: 'issues', state: row.state, reason: row.reason })
+  return { since, previousSince: since - back, merged: told(pulls, row => row.merged?.at ?? null, pull), opened: told(pulls, row => row.createdAt, pull),
+    closed: told(issues, row => row.state === 'closed' ? row.closedAt : null, issue), created: told(issues, row => row.createdAt, issue) }
+}