@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.51

package/server-managed/repository-history.ts

@@ -0,0 +1,432 @@
+// The commit history the code viewer's History tab draws
+// (GET /api/admin/repositories/history), as `git log --oneline --decorate
+// --graph` shows it: each commit's id, parents, subject, author and time, and
+// the branches and tags pointing at commits. From a revision, a page at a
+// time, of the whole repository or of the commits touching a directory, as
+// GitHub's REST API lists them, for any reader; or, as `--all`, across the
+// repository's most recently committed to branches at once, then on from where
+// those stop, in GraphQL queries, which need a token. A whole repository's is
+// read a page from a commit at a time, each page kept by the commit it starts
+// at (historyFrom): a commit's history never changes, and where a commit read
+// starts a page kept, that page glues on, and those after it.
+import { type AgentSignals, agentSignals } from '../common/managed/agent-tasks.ts'
+import { githubAgent } from '../common/managed/github-agents.ts'
+import { AGENT_MARKS_READ, APP_AGENTS } from './app-agents.ts'
+import { type CommitFacts, MAX_COAUTHORS, type Maker, coauthorFacts, coauthorTrailers } from './commit-coauthors.ts'
+import { GithubApiError, githubJson } from './github-app.ts'
+import { type GraphActor, accountOf, commitAccount, linkNoreplyUsers } from './github-accounts.ts'
+import { githubGraphql } from './github-graphql.ts'
+
+export { ACTOR, type GraphAccount, type GraphActor, type NamedAccount, accountOf, actorOf, commitAccount, linkNoreplyUsers } from './github-accounts.ts'
+export { type GraphqlError, githubGraphql } from './github-graphql.ts'
+
+export const HISTORY_PAGE = 100
+// The deepest page read, as far as Older commits goes.
+export const MAX_HISTORY_PAGE = 100
+// `--all`: the branches most recently committed to, of as many as fifty
+// pages of them list, the latest commits of each (as many as a GraphQL connection
+// gives), and the latest tags.
+export const ALL_BRANCHES = 25
+const MAX_HEAD_PAGES = 50
+const ALL_DEPTH = 100
+const ALL_TAGS = 100
+const REF_TIPS = 100
+const MAX_PARENTS = 8
+const MAX_SUBJECT = 1000
+const MAX_NAME = 256
+const SHA = /^[a-f\d]{40}$/u
+
+// A commit, its author by name, address (`authorEmail`) and their account's
+// login and numeric id (`authorId`), and who it names beside them
+// (commit-coauthors.ts coauthorFacts), each absent from pages kept before it
+// was read, with the lines it adds and removes and when it was authored in
+// its author's own time zone (`authorZone`, minutes east of UTC), where
+// GitHub's GraphQL API tells them (null where its REST API lists it); and the
+// marks an agent left in its message, where any (messageMarks), by the rules
+// they were read by (`marked`, AGENT_MARKS_READ; absent from pages kept
+// before). What of them is an agent's is told as they are answered
+// (coauthorsOf, historyMarks), never kept.
+export interface HistoryCommit extends CommitFacts { sha: string; parents: string[]; subject: string; committedAt: number | null; additions?: number | null
+  deletions?: number | null; authoredAt?: number | null; authorZone?: number | null; marks?: AgentSignals; marked?: number }
+export interface HistoryRef { name: string; sha: string }
+
+const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// The address Claude's own commits are authored with.
+export const CLAUDE_EMAIL = 'noreply@anthropic.com'
+
+const marking = (marks: AgentSignals) => marks.claude || marks.codex || marks.agents.length > 0 || marks.sessions.length > 0 || marks.tasks.length > 0
+
+// The marks an agent left in a commit's message (agent-tasks.ts
+// agentSignals: sessions' and tasks' links, agents' lines and fingerprints),
+// as its history keeps them; null for one none marked.
+export function messageMarks(message: unknown): AgentSignals | null {
+  const marks = agentSignals([message], APP_AGENTS)
+  return marking(marks) ? marks : null
+}
+
+// The marks an agent left on a commit, as the Agents tab tells them: its
+// message's (`marks`, messageMarks), its author an app agent's account, by
+// the agents the app knows now, or Claude's address; null for one none marked.
+export function commitMarks(marks: AgentSignals | null | undefined, { email, account }: Maker): AgentSignals | null {
+  const authored = account.login !== null && account.id !== null ? githubAgent(account.login, account.id) : null
+  const all = { sessions: marks?.sessions ?? [], tasks: marks?.tasks ?? [], claude: (marks?.claude ?? false) || email === CLAUDE_EMAIL, codex: marks?.codex ?? false,
+    agents: APP_AGENTS.flatMap(({ id }) => marks?.agents.includes(id) || authored === id ? [id] : []) }
+  return marking(all) ? all : null
+}
+// A commit's marks as its history keeps it (commitMarks).
+export const historyMarks = (commit: HistoryCommit) => commitMarks(commit.marks,
+  { name: commit.authorName, email: commit.authorEmail, account: { login: commit.authorLogin, id: commit.authorId ?? null } })
+
+const lineCount = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : null
+// The minutes east of UTC an ISO 8601 time is given in: `Z` none.
+const zoneOf = (value: unknown) => {
+  const zone = typeof value === 'string' ? /(?:Z|([+-])(\d{2}):?(\d{2}))$/u.exec(value) : null
+  return zone ? zone[1] ? (zone[1] === '-' ? -1 : 1) * (Number(zone[2]) * 60 + Number(zone[3])) : 0 : null
+}
+
+// A commit as the Commits tab reads it, its subject the message's first
+// line, as `--oneline` shows, its author by name and account, and its
+// co-authors (coauthorsOf, `listed` as GitHub's GraphQL API lists them), and
+// the marks an agent left on it, as the Agents tab reads them from the pages
+// kept (commitMarks); null for one GitHub names no commit id for. With
+// `stats`, the GraphQL API's, its lines and its author's time.
+function historyCommit(sha: unknown, parents: unknown[], message: unknown, author: Maker, committedAt: unknown,
+  stats: { additions?: unknown; deletions?: unknown; authoredAt?: unknown } | null = null, listed: Maker[] | null = null): HistoryCommit | null {
+  if (typeof sha !== 'string' || !SHA.test(sha)) return null
+  const lines = stats ? { additions: lineCount(stats.additions), deletions: lineCount(stats.deletions), authoredAt: timeOf(stats.authoredAt),
+    authorZone: zoneOf(stats.authoredAt) } : { additions: null, deletions: null, authoredAt: null, authorZone: null }
+  const marks = messageMarks(message)
+  return {
+    sha,
+    parents: parents.filter((parent): parent is string => typeof parent === 'string' && SHA.test(parent)).slice(0, MAX_PARENTS),
+    subject: typeof message === 'string' ? message.replaceAll('\r\n', '\n').split('\n', 1)[0]!.trim().slice(0, MAX_SUBJECT) : '',
+    authorName: textOf(author.name, MAX_NAME),
+    authorEmail: textOf(author.email, MAX_NAME),
+    authorLogin: author.account.login,
+    authorId: author.account.id,
+    ...coauthorFacts(message, listed),
+    committedAt: timeOf(committedAt),
+    ...lines,
+    ...marks ? { marks } : {},
+    marked: AGENT_MARKS_READ,
+  }
+}
+
+type RestCommit = { sha?: unknown; parents?: { sha?: unknown }[]; author?: { login?: unknown; id?: unknown } | null
+  commit?: { message?: unknown; author?: { name?: unknown; email?: unknown } | null; committer?: { date?: unknown } | null } }
+// Its co-authors (`listed`) by its trailers, with the accounts of their addresses.
+const restCommit = (item: RestCommit, listed: Maker[] | null = null) => historyCommit(item?.sha, Array.isArray(item?.parents) ? item.parents.map(parent => parent?.sha) : [],
+  item?.commit?.message, { name: item?.commit?.author?.name, email: item?.commit?.author?.email, account: accountOf(item?.author) }, item?.commit?.committer?.date,
+  null, listed)
+
+const repoApi = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+
+// A page of the commits `commit` reaches, newest first as GitHub lists them,
+// those touching `path` alone where it names a directory; `more` where a
+// full page leaves some for the next, one that may be read. GitHub links
+// each's author to its account; with a token, its co-authors by GitHub's older
+// no-reply address too (linkNoreplyUsers).
+export async function repositoryHistory(fullName: string, token: string | null, commit: string, path: string, page: number, fetchImpl: typeof fetch = globalThis.fetch) {
+  const params = new URLSearchParams({ sha: commit, per_page: String(HISTORY_PAGE), page: String(page), ...path ? { path } : {} })
+  const data = await githubJson(`${repoApi(fullName)}/commits?${params}`, token, fetchImpl)
+  if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+  const items = data as RestCommit[]
+  const trailers = items.map(item => coauthorTrailers(item?.commit?.message).map(({ name, email }): GraphActor & { name: string } => ({ name, email, user: null })))
+  if (token) await linkNoreplyUsers(trailers.flat(), token, fetchImpl)
+  return { commits: items.flatMap((item, at) => restCommit(item, token ? trailers[at]!.map(actor => ({ name: actor.name, email: actor.email, account: commitAccount(actor) })) : null) ?? []),
+    more: data.length >= HISTORY_PAGE && page < MAX_HISTORY_PAGE }
+}
+
+// The commits the repository's branches and tags point at, as GitHub's
+// first page of each lists them, to name commits by.
+export async function repositoryRefTips(fullName: string, token: string | null, fetchImpl: typeof fetch = globalThis.fetch) {
+  const tips = (list: unknown): HistoryRef[] => Array.isArray(list) ? list.flatMap((item: { name?: unknown; commit?: { sha?: unknown } }) =>
+    typeof item?.name === 'string' && item.name && typeof item.commit?.sha === 'string' && SHA.test(item.commit.sha)
+      ? [{ name: item.name.slice(0, MAX_NAME), sha: item.commit.sha }] : []) : []
+  const [branches, tags] = await Promise.all(['branches', 'tags'].map(kind => githubJson(`${repoApi(fullName)}/${kind}?per_page=${REF_TIPS}`, token, fetchImpl)))
+  return { branches: tips(branches), tags: tips(tags) }
+}
+
+// A commit's author and those GitHub lists beside it.
+export const commitActors = (node: GraphCommit | null | undefined) => [node?.author, ...node?.authors?.nodes ?? []]
+
+// A tag's target, an annotated tag's own target in turn, through as many as
+// MAX_TAG_DEPTH annotated tags, each object's type naming what it is.
+const MAX_TAG_DEPTH = 4
+const tagTarget = (tags: number): string => `target { __typename oid${tags > 0 ? ` ... on Tag { ${tagTarget(tags - 1)} }` : ''} }`
+
+// The branches' tips, a page at a time, each with its commit's date (GitHub
+// orders heads by name alone), and, on the first page, the default branch's
+// tip, wherever its name sorts, and the latest tags.
+const HEADS_QUERY = `query($owner: String!, $name: String!, $after: String, $tags: Int!, $first: Boolean!) {
+  repository(owner: $owner, name: $name) {
+    defaultBranchRef { name target { oid ... on Commit { committedDate } } }
+    branches: refs(refPrefix: "refs/heads/", first: 100, after: $after) {
+      pageInfo { hasNextPage endCursor }
+      nodes { name target { oid ... on Commit { committedDate } } }
+    }
+    tags: refs(refPrefix: "refs/tags/", first: $tags, orderBy: { field: TAG_COMMIT_DATE, direction: DESC }) @include(if: $first) {
+      nodes { name ${tagTarget(MAX_TAG_DEPTH)} }
+    }
+  }
+}`
+
+// As many commits as gluing kept pages on goes to, in as many rounds of
+// looking them up, each looking up as many commits as tops.
+export const HISTORY_GLUED = 2000
+const MAX_GLUE_ROUNDS = 20
+const GLUE_LOOKUP = 50
+
+// The pages of a repository's history kept, each by the commit it starts at
+// (its top): the first page of the history from that commit, which never
+// changes.
+export interface HistoryPages {
+  read(tops: string[]): Promise<Map<string, HistoryCommit[]>>
+  // The pages kept of `first`; where none is, those of `then`, in one read
+  // (`first` whether they are `first`'s). Without it, both are read together.
+  readFirst?(first: string[], then: string[]): Promise<{ first: boolean; pages: Map<string, HistoryCommit[]> }>
+  write(top: string, commits: HistoryCommit[]): Promise<void>
+}
+
+// What a commit is read by in GraphQL.
+export const COMMIT_FRAGMENT = `fragment historyCommit on Commit { oid message committedDate additions deletions author { name email date user { login databaseId } }
+  authors(first: ${MAX_COAUTHORS + 1}) { nodes { name email user { login databaseId } } } parents(first: ${MAX_PARENTS}) { nodes { oid } } }`
+// A query's variables `$<prefix><n>` of `type`, as many as `count`.
+export const variablesOf = (prefix: string, count: number, type: string) => Array.from({ length: count }, (_, at) => `$${prefix}${at}: ${type}`).join(', ')
+
+// The latest commits of each tip, by its id, `b<n>` the `n`th's.
+const historiesQuery = (count: number) => `query($owner: String!, $name: String!, ${variablesOf('o', count, 'GitObjectID!')}) {
+  repository(owner: $owner, name: $name) {
+    ${Array.from({ length: count }, (_, at) => `b${at}: object(oid: $o${at}) { ... on Commit { history(first: ${ALL_DEPTH}) { pageInfo { hasNextPage } nodes { ...historyCommit } } } }`).join('\n    ')}
+  }
+}
+${COMMIT_FRAGMENT}`
+
+export type GraphCommit = { oid?: unknown; message?: unknown; committedDate?: unknown; additions?: unknown; deletions?: unknown
+  author?: ({ name?: unknown; date?: unknown } & GraphActor) | null; authors?: { nodes?: (({ name?: unknown } & GraphActor) | null)[] } | null
+  parents?: { nodes?: { oid?: unknown }[] } }
+type GraphTarget = { __typename?: unknown; oid?: unknown; committedDate?: unknown; target?: GraphTarget | null }
+type GraphRef = { name?: unknown; target?: GraphTarget | null }
+type HeadsPage = { repository?: { defaultBranchRef?: GraphRef | null
+  branches?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: GraphRef[] }; tags?: { nodes?: GraphRef[] } } | null }
+type Histories = { repository?: Record<string, { history?: { pageInfo?: { hasNextPage?: unknown }; nodes?: GraphCommit[] } } | null> | null }
+
+// The repository's branches, as many as MAX_HEAD_PAGES of them list, each
+// with its tip's time, its default branch and latest tags (an annotated tag
+// by the commit it tags), and whether any branch is left out.
+async function repositoryHeads(owner: string, name: string, token: string, fetchImpl: typeof fetch) {
+  const heads: (HistoryRef & { at: number | null })[] = []
+  let first: HeadsPage['repository'] = null
+  let after: string | null = null
+  for (let page = 0; page < MAX_HEAD_PAGES; page++) {
+    const data = await githubGraphql(HEADS_QUERY, { owner, name, after, tags: ALL_TAGS, first: page === 0 }, token, fetchImpl) as HeadsPage
+    const repository = data?.repository
+    if (!repository) throw new GithubApiError(404, 'github-not-found')
+    first ??= repository
+    for (const ref of repository.branches?.nodes ?? []) {
+      const sha = ref?.target?.oid
+      if (typeof ref?.name === 'string' && ref.name && typeof sha === 'string' && SHA.test(sha)) heads.push({ name: ref.name.slice(0, MAX_NAME), sha, at: timeOf(ref.target?.committedDate) })
+    }
+    const next = repository.branches?.pageInfo
+    if (next?.hasNextPage !== true || typeof next.endCursor !== 'string') return { heads, repository: first, cut: false }
+    after = next.endCursor
+  }
+  return { heads, repository: first, cut: true }
+}
+
+// Histories read in a GraphQL query, and queries at once: each counts its
+// commits' lines, which GitHub works out as it answers, stopping a query
+// past ten seconds.
+const PAGES_PER_QUERY = 5
+const PAGES_PARALLEL = 5
+
+// The first page of the history from each of `tops`, by its top, each told
+// to `keep` as it is read, so those read stay kept where another fails: with
+// a token, in GraphQL queries of PAGES_PER_QUERY (inBatches); without, a
+// REST list each.
+async function readPages(fullName: string, token: string | null, tops: string[], fetchImpl: typeof fetch,
+  keep: (top: string, commits: HistoryCommit[]) => Promise<void>) {
+  const read = new Map<string, HistoryCommit[]>()
+  const got = (top: string, commits: HistoryCommit[]) => { read.set(top, commits); return keep(top, commits) }
+  if (!token) {
+    await Promise.all(tops.map(async top => got(top, (await repositoryHistory(fullName, null, top, '', 1, fetchImpl)).commits)))
+    return read
+  }
+  const [owner, name] = fullName.split('/') as [string, string]
+  await inBatches(tops, PAGES_PER_QUERY, PAGES_PARALLEL, async batch => {
+    const data = await githubGraphql(historiesQuery(batch.length), { owner, name, ...Object.fromEntries(batch.map((sha, at) => [`o${at}`, sha])) }, token, fetchImpl) as Histories
+    const nodes = batch.map((_, at) => data?.repository?.[`b${at}`]?.history?.nodes ?? [])
+    await linkNoreplyUsers(nodes.flat().flatMap(commitActors), token, fetchImpl)
+    await Promise.all(batch.map((top, at) => got(top, nodes[at]!.flatMap(node => graphCommit(node) ?? []))))
+  })
+  return read
+}
+
+// Its authors past the first, the git author, GitHub lists from its
+// `Co-authored-by:` trailers.
+export const graphCommit = (node: GraphCommit | null | undefined) => historyCommit(node?.oid, (node?.parents?.nodes ?? []).map(parent => parent?.oid),
+  node?.message, { name: node?.author?.name, email: node?.author?.email, account: commitAccount(node?.author) }, node?.committedDate,
+  { additions: node?.additions, deletions: node?.deletions, authoredAt: node?.author?.date },
+  Array.isArray(node?.authors?.nodes) ? node.authors.nodes.slice(1).map(actor => ({ name: actor?.name, email: actor?.email, account: commitAccount(actor) })) : null)
+
+// The history from each of `starts`, a page of each, kept (`pages`), or read
+// and then kept by its top; glued on to it, the pages kept that start at a
+// parent of a commit listed not listed, each adding commits none listed has,
+// and, where any of those has none kept and readable, at a commit listed, the
+// oldest first (where each goes on furthest; a page at a commit listed lists
+// mostly commits listed already), GLUE_LOOKUP of each looked up at a time, in
+// one read where none of those parents' is kept, else two, and
+// those that start where those go on, till HISTORY_GLUED are listed. The
+// pages from `starts` are listed whole, however many that is (all branches'
+// first, as many as ALL_BRANCHES of them): the cap is gluing's. Each commit
+// once, whether any goes on past those listed (`more`), and how many pages
+// were read of GitHub (`read`).
+export async function historyFrom(fullName: string, token: string | null, starts: string[], pages: HistoryPages, fetchImpl: typeof fetch = globalThis.fetch) {
+  const kept = await pages.read(starts)
+  const unread = starts.filter(top => !kept.has(top))
+  // Kept only as GitHub listed it from its top: none for a commit it named nothing of.
+  const keep = (top: string, commits: HistoryCommit[]) => commits[0]?.sha === top ? pages.write(top, commits) : Promise.resolve()
+  const read = unread.length > 0 ? await readPages(fullName, token, unread, fetchImpl, keep) : new Map<string, HistoryCommit[]>()
+  const listed = new Map<string, HistoryCommit>()
+  const add = (commits: HistoryCommit[]) => { for (const commit of commits) if (!listed.has(commit.sha)) listed.set(commit.sha, commit) }
+  for (const top of starts) add(kept.get(top) ?? read.get(top) ?? [])
+  const looked = new Set(starts)
+  for (let round = 0; round < MAX_GLUE_ROUNDS && listed.size < HISTORY_GLUED; round++) {
+    const parents = [...new Set([...listed.values()].flatMap(commit => commit.parents.filter(parent => !listed.has(parent) && !looked.has(parent))))].slice(0, GLUE_LOOKUP)
+    const within = [...listed.keys()].toReversed().filter(sha => !looked.has(sha)).slice(0, GLUE_LOOKUP)
+    if (parents.length === 0 && within.length === 0) break
+    // Without readFirst, GLUE_LOOKUP of both at once, the parents first.
+    const asked = pages.readFirst ? null : [...parents, ...within].slice(0, GLUE_LOOKUP)
+    let { first, pages: glued } = asked ? { first: false, pages: await pages.read(asked) } : await pages.readFirst!(parents, within)
+    // A parent with no page kept, or none readable (one GitHub's REST API
+    // listed, read with GraphQL), its line going on only by a page at a
+    // commit listed: those read too, apart, the others' lines notwithstanding.
+    if (first && glued.size < parents.length && within.length > 0) {
+      glued = new Map([...glued, ...await pages.read(within)])
+      first = false
+    }
+    // Those at commits listed, unread where a parent's answered, are looked up again.
+    for (const sha of asked ?? (first ? parents : [...parents, ...within])) looked.add(sha)
+    for (const commit of [...glued.values()].flat()) {
+      if (listed.size >= HISTORY_GLUED) break
+      if (!listed.has(commit.sha)) listed.set(commit.sha, commit)
+    }
+  }
+  const commits = [...listed.values()]
+  return { commits, more: commits.some(commit => commit.parents.some(parent => !listed.has(parent))), read: unread.length }
+}
+
+export type AllHeads = { heads: (HistoryRef & { at: number | null })[]; defaultBranch: string | null; tags: HistoryRef[]; cut: boolean }
+
+// `--all`'s branches: the repository's, as many as MAX_HEAD_PAGES of them
+// list, each with its tip's time, its default branch among them wherever its
+// name sorts; its latest tags, each by the commit it tags; and whether
+// branches past those listed are left out (`cut`).
+export async function repositoryAllHeads(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<AllHeads> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const { heads, repository, cut } = await repositoryHeads(owner, name, token, fetchImpl)
+  const defaultBranch = textOf(repository?.defaultBranchRef?.name, MAX_NAME)
+  // The default branch, where its name sorts past the heads read.
+  const defaultTip = repository?.defaultBranchRef?.target?.oid
+  if (defaultBranch && typeof defaultTip === 'string' && SHA.test(defaultTip) && !heads.some(head => head.name === defaultBranch)) {
+    heads.push({ name: defaultBranch, sha: defaultTip, at: timeOf(repository?.defaultBranchRef?.target?.committedDate) })
+  }
+  // A tag by the commit it tags, through the annotated tags between; one
+  // ending at no commit names none.
+  const tags = (repository?.tags?.nodes ?? []).flatMap(ref => {
+    let target = ref?.target
+    while (target?.__typename === 'Tag') target = target.target
+    const sha = target?.__typename === 'Commit' ? target.oid : null
+    return typeof ref?.name === 'string' && typeof sha === 'string' && SHA.test(sha) ? [{ name: ref.name.slice(0, MAX_NAME), sha }] : []
+  })
+  return { heads, defaultBranch, tags, cut }
+}
+
+// `--all`: the latest commits of the most recently committed to of `heads`
+// (repositoryAllHeads), the default branch's among them, each commit once
+// (historyFrom); the branches naming them and the latest tags; the branches
+// not read, newest first, whose tips none of those is (`unread`), where
+// reading on goes; whether branches past those listed are left out, never to
+// be read (`cut`); and whether any is left out (`more`).
+export async function repositoryAllHistory(fullName: string, token: string, { heads, defaultBranch, tags, cut }: AllHeads, pages: HistoryPages,
+  fetchImpl: typeof fetch = globalThis.fetch) {
+  const newest = heads.toSorted((a, b) => Number(b.name === defaultBranch) - Number(a.name === defaultBranch) || (b.at ?? 0) - (a.at ?? 0))
+  const shown = newest.slice(0, ALL_BRANCHES)
+  const read = await historyFrom(fullName, token, [...new Set(shown.map(head => head.sha))], pages, fetchImpl)
+  const listed = new Set(read.commits.map(commit => commit.sha))
+  const more = cut || heads.length > shown.length || read.more
+  // Every branch naming a commit listed, those not read among them.
+  const branches = heads.flatMap(({ name: branch, sha }) => listed.has(sha) ? [{ name: branch, sha }] : [])
+  const unread = newest.slice(ALL_BRANCHES).filter(head => !listed.has(head.sha))
+  return { commits: read.commits, branches, tags, defaultBranch, unread, cut, more }
+}
+
+const chunked = <T>(items: T[], size: number) => Array.from({ length: Math.ceil(items.length / size) }, (_, at) => items.slice(at * size, (at + 1) * size))
+// GitHub stopping a query past its time: in its answer's errors, or as a 502
+// or 504 of its own.
+const SLOW = new Set(['github-timeout', 'github-status-502', 'github-status-504'])
+// `run` for `items` in batches of `size`, as many at once as `parallel`; a
+// batch GitHub stops past its time run again in halves, down to one alone,
+// so that one too slow to read fails alone, the others read. The halves
+// wait their turn with the rest, and as many batches are halved as run at
+// once twice over at most, GitHub slow throughout past that. Where one
+// fails, none more is run, those running done before its error is thrown,
+// so that what they read is kept.
+export async function inBatches<T>(items: T[], size: number, parallel: number, run: (batch: T[]) => Promise<void>) {
+  const failed: unknown[] = []
+  const waiting: (() => void)[] = []
+  let halved = 0, running = 0
+  const turn = () => {
+    if (running < parallel) { running++; return Promise.resolve() }
+    return new Promise<void>(resolve => { waiting.push(resolve) })
+  }
+  // A turn done, handed to the batch waiting longest.
+  const done = () => {
+    const next = waiting.shift()
+    if (next) next()
+    else running--
+  }
+  const attempt = async (batch: T[]): Promise<void> => {
+    await turn()
+    try {
+      if (failed.length === 0) await run(batch)
+      return
+    } catch (err) {
+      if (batch.length === 1 || halved >= 2 * parallel || !(err instanceof GithubApiError && SLOW.has(err.message))) { failed.push(err); return }
+      halved++
+    } finally { done() }
+    const half = Math.ceil(batch.length / 2)
+    await Promise.all([attempt(batch.slice(0, half)), attempt(batch.slice(half))])
+  }
+  await Promise.all(chunked(items, size).map(attempt))
+  if (failed.length > 0) throw failed[0]
+}
+
+// The open pull requests most recently updated, each by the commit its head
+// is at, to name commits by.
+const OPEN_PULLS = 100
+const OPEN_PULLS_QUERY = `query($owner: String!, $name: String!) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(states: OPEN, first: ${OPEN_PULLS}, orderBy: { field: UPDATED_AT, direction: DESC }) { nodes { number headRefOid } }
+  }
+}`
+export async function openPullHeads(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql(OPEN_PULLS_QUERY, { owner, name }, token, fetchImpl) as
+    { repository?: { pullRequests?: { nodes?: ({ number?: unknown; headRefOid?: unknown } | null)[] } } | null }
+  return { pulls: (data?.repository?.pullRequests?.nodes ?? []).flatMap(node => Number.isSafeInteger(node?.number) && (node!.number as number) > 0
+    && typeof node!.headRefOid === 'string' && SHA.test(node!.headRefOid) ? [{ number: node!.number as number, sha: node!.headRefOid }] : []) }
+}
+
+// Where `--all` reads on from, as a request names them (`from`): as many
+// commit ids, each once, as branches are read at first; null for none, or
+// for one that isn't a commit id.
+export function historyStarts(from: string): string[] | null {
+  const starts = [...new Set(from.split(','))]
+  return starts.length <= ALL_BRANCHES && starts.every(sha => SHA.test(sha)) ? starts : null
+}

package/server-managed/repository-issues.ts

@@ -0,0 +1,195 @@
+// The issues and pull requests the code viewer's Issues and Pull requests
+// tabs show (GET /api/admin/repositories/issues): those open, or those
+// closed (a pull request's merged among them), the most recently updated
+// first, a page at a time, each as one tile has room for, with how many are
+// open and closed. A pull request's tile names its branches, its size, its
+// review and its checks, which GraphQL alone gives, so it needs a token; an
+// open one's, and its popup's, whether it changes a lockfile whose new
+// packages are told (pull-dependencies.ts touchesLockfile), and its reviews
+// (pull-reviews.ts), each reviewer's; and an open one's base's and head's
+// commits, kept with its page but never told, by which what its lockfiles
+// add is read (http.ts teamRepositoryDependencies). A nonpublic repository's
+// are read with its GitHub App's installation, which reads pull requests only
+// with their own permission (doc/code-viewer.md).
+import { GithubApiError } from './github-app.ts'
+import { touchesLockfile } from './pull-dependencies.ts'
+import { ACTOR, type GraphAccount, type GraphqlError, actorOf, githubGraphql } from './repository-history.ts'
+import { ITEM_THREADS, type ReviewNode, TILE_THREADS, pullReviews, reviewFields, reviewsRefused } from './pull-reviews.ts'
+
+export const ISSUES_PAGE = 50
+// What a kept page or item was read as: kept ones read before differ.
+export const ISSUES_READ_VERSION = 4
+const MAX_LABELS = 20
+const MAX_TITLE = 1000
+const MAX_NAME = 256
+const COLOR = /^[a-f\d]{6}$/iu
+const SHA = /^[a-f\d]{40}$/u
+// A page's cursor as GitHub gives it, to read on from: opaque, base64 or
+// base64url as it is now (`…rOrK_u7Q==`), passed back to GitHub alone, so any
+// printable one is, but none with spaces or control characters.
+export const ISSUES_CURSOR = /^[!-~]{1,256}$/u
+
+export type IssuesKind = 'issues' | 'pulls'
+export type IssuesState = 'open' | 'closed'
+
+const shared = `number title createdAt updatedAt closedAt author { ${ACTOR} } comments { totalCount } labels(first: ${MAX_LABELS}) { totalCount nodes { name color } }`
+const fields = {
+  issues: `${shared} state stateReason`,
+  pulls: `${shared} state isDraft mergedAt reviewDecision additions deletions headRefName baseRefName
+      commits(last: 1) { nodes { commit { statusCheckRollup { state } } } }`,
+}
+// The files a pull request changes, as many as LISTED_FILES, as an open one's
+// tile and its popup tell whether it changes a lockfile by them.
+const LISTED_FILES = 100
+const files = `files(first: ${LISTED_FILES}) { totalCount nodes { path } }`
+const connection = { issues: 'issues', pulls: 'pullRequests' }
+const states = { issues: { open: '[OPEN]', closed: '[CLOSED]' }, pulls: { open: '[OPEN]', closed: '[CLOSED, MERGED]' } }
+
+// A page of `kind`, those in `state`, after the page `after` ends, and how
+// many of each state there are; open pull requests with their commits and
+// their reviews.
+const pageQuery = (kind: IssuesKind, state: IssuesState) => `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    open: ${connection[kind]}(states: ${states[kind].open}) { totalCount }
+    closed: ${connection[kind]}(states: ${states[kind].closed}) { totalCount }
+    page: ${connection[kind]}(states: ${states[kind][state]}, first: ${ISSUES_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { ${fields[kind]}${kind === 'pulls' && state === 'open' ? ` baseRefOid headRefOid ${files} ${reviewFields(TILE_THREADS, false)}` : ''} }
+    }
+  }
+}`
+
+type Node = ReviewNode & { number?: unknown; title?: unknown; createdAt?: unknown; updatedAt?: unknown; closedAt?: unknown; mergedAt?: unknown; author?: GraphAccount
+  comments?: { totalCount?: unknown }; labels?: { totalCount?: unknown; nodes?: { name?: unknown; color?: unknown }[] }; state?: unknown; stateReason?: unknown
+  isDraft?: unknown; reviewDecision?: unknown; additions?: unknown; deletions?: unknown; headRefName?: unknown; baseRefName?: unknown; baseRefOid?: unknown
+  commits?: { nodes?: { commit?: { statusCheckRollup?: { state?: unknown } | null } | null }[] }
+  files?: { totalCount?: unknown; nodes?: ({ path?: unknown } | null)[] } | null }
+type Page = { repository?: { open?: { totalCount?: unknown }; closed?: { totalCount?: unknown }
+  page?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (Node | null)[] } } | null }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const nameOf = (value: unknown, max = MAX_NAME) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+const REVIEWS: Record<string, string> = { APPROVED: 'approved', CHANGES_REQUESTED: 'changes', REVIEW_REQUIRED: 'required' }
+const CHECKS: Record<string, string> = { SUCCESS: 'success', FAILURE: 'failure', ERROR: 'failure', PENDING: 'pending', EXPECTED: 'pending' }
+const REASONS: Record<string, string> = { COMPLETED: 'completed', NOT_PLANNED: 'not-planned', DUPLICATE: 'duplicate' }
+
+// An issue or pull request as a tile shows it; null for one GitHub names no
+// number for.
+function item(kind: IssuesKind, node: Node | null) {
+  if (!node || !Number.isSafeInteger(node.number) || (node.number as number) <= 0) return null
+  const author = actorOf(node.author)
+  const labels = (node.labels?.nodes ?? []).flatMap(label => {
+    const name = nameOf(label?.name)
+    return name ? [{ name, color: typeof label?.color === 'string' && COLOR.test(label.color) ? label.color.toLowerCase() : null }] : []
+  })
+  const common = { number: node.number as number, title: nameOf(node.title, MAX_TITLE) ?? '', author: author.login, authorId: author.id, createdAt: timeOf(node.createdAt), updatedAt: timeOf(node.updatedAt),
+    closedAt: timeOf(node.closedAt), comments: count(node.comments?.totalCount), labels, moreLabels: Math.max(0, count(node.labels?.totalCount) - labels.length) }
+  if (kind === 'issues') {
+    return { ...common, state: node.state === 'OPEN' ? 'open' : 'closed', reason: REASONS[String(node.stateReason)] ?? null }
+  }
+  const checks = node.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state
+  const listed = node.files?.nodes
+  const paths = Array.isArray(listed) ? listed.flatMap(file => typeof file?.path === 'string' ? [file.path] : []) : null
+  return { ...common, state: node.state === 'MERGED' ? 'merged' : node.state === 'OPEN' ? 'open' : 'closed', draft: node.isDraft === true, mergedAt: timeOf(node.mergedAt),
+    review: REVIEWS[String(node.reviewDecision)] ?? null, checks: CHECKS[String(checks)] ?? null, additions: count(node.additions), deletions: count(node.deletions),
+    head: nameOf(node.headRefName), base: nameOf(node.baseRefName),
+    ...paths ? { touchesLockfile: touchesLockfile(paths, count(node.files?.totalCount)) } : {} }
+}
+
+// A pull request's checks, which a GitHub App reads only with the Checks and
+// Commit statuses permissions, refused: its tile then shows none; or its
+// files, whose lockfiles' new packages it then tells none of. Any other
+// field refused, the list is, as one without Pull requests: read is.
+const checksRefused = (error: GraphqlError) => error?.type === 'FORBIDDEN' && Array.isArray(error.path)
+  && (error.path.includes('statusCheckRollup') || error.path.includes('files'))
+const partRefused = (error: GraphqlError) => checksRefused(error) || reviewsRefused(error)
+
+// One issue or pull request, as its popup shows it (GET
+// /api/admin/repositories/item): as its tile does, with its description, its
+// Markdown as written (never GitHub's HTML of it); an issue's pull requests closing
+// it, a pull request's issues it closes, its commits and files changed, and
+// who merged it. Its state, of a different type each, named apart. A
+// description longer than MAX_BODY is shortened (`bodyShortened`), and the
+// linked past the first LINKED counted (`moreLinked`), the rest on GitHub.
+const MAX_BODY = 20_000
+const LINKED = 10
+const ITEM_QUERY = `query($owner: String!, $name: String!, $number: Int!) {
+  repository(owner: $owner, name: $name) {
+    item: issueOrPullRequest(number: $number) {
+      __typename
+      ... on Issue { ${shared} issueState: state stateReason body
+        closedByPullRequestsReferences(first: ${LINKED}, includeClosedPrs: true) { totalCount nodes { number title pullState: state isDraft } } }
+      ... on PullRequest { ${shared} pullState: state isDraft mergedAt reviewDecision additions deletions headRefName baseRefName body changedFiles ${files}
+        commits(last: 1) { totalCount nodes { commit { statusCheckRollup { state } } } } mergedBy { ${ACTOR} }
+        closingIssuesReferences(first: ${LINKED}) { totalCount nodes { number title issueState: state stateReason } }
+        ${reviewFields(ITEM_THREADS, true)} }
+    }
+  }
+}`
+type Linked = { number?: unknown; title?: unknown; issueState?: unknown; pullState?: unknown; stateReason?: unknown; isDraft?: unknown } | null
+type ItemNode = Node & { __typename?: unknown; issueState?: unknown; pullState?: unknown; body?: unknown; changedFiles?: unknown
+  commits?: Node['commits'] & { totalCount?: unknown }; mergedBy?: GraphAccount
+  closedByPullRequestsReferences?: Links; closingIssuesReferences?: Links }
+type Links = { totalCount?: unknown; nodes?: Linked[] } | null
+
+// The issues or pull requests an item names, each by its number, title and
+// state, as `kind`'s tile names one.
+const linked = (kind: IssuesKind, nodes: Linked[] | undefined) => (nodes ?? []).flatMap(node => {
+  const tile = item(kind, node ? { number: node.number, title: node.title, state: node.issueState ?? node.pullState, stateReason: node.stateReason, isDraft: node.isDraft } : null)
+  return tile ? [{ number: tile.number, title: tile.title, state: tile.state, ...'reason' in tile ? { reason: tile.reason } : { draft: tile.draft } }] : []
+})
+
+// The issue or pull request numbered `number`, its `kind` with it.
+export async function repositoryItem(fullName: string, token: string, number: number, fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql(ITEM_QUERY, { owner, name, number }, token, fetchImpl, partRefused) as { repository?: { item?: ItemNode | null } | null }
+  const node = data?.repository?.item
+  const kind: IssuesKind | null = node?.__typename === 'Issue' ? 'issues' : node?.__typename === 'PullRequest' ? 'pulls' : null
+  const tile = kind && node ? item(kind, { ...node, state: kind === 'issues' ? node.issueState : node.pullState }) : null
+  if (!kind || !node || !tile) throw new GithubApiError(404, 'github-not-found')
+  // As written, but for blank lines before it and spaces after: a first
+  // line's indent, an indented code block's, kept.
+  const written = typeof node.body === 'string' ? node.body.replace(/^(?:[ \t]*\r?\n)+/u, '').trimEnd() : ''
+  const links = kind === 'issues' ? node.closedByPullRequestsReferences : node.closingIssuesReferences
+  const named = linked(kind === 'issues' ? 'pulls' : 'issues', links?.nodes)
+  const described = { body: written.slice(0, MAX_BODY), bodyShortened: written.length > MAX_BODY, moreLinked: Math.max(0, count(links?.totalCount) - named.length) }
+  const merger = actorOf(node.mergedBy)
+  return kind === 'issues' ? { kind, ...tile, ...described, closedBy: named }
+    : { kind, ...tile, ...described, closes: named, commits: count(node.commits?.totalCount), files: count(node.changedFiles),
+      mergedBy: merger.login, mergedById: merger.id, reviews: pullReviews(node, tile.author, true) }
+}
+
+// An open pull request's base's and head's commits, by its number, as GitHub
+// has them now: those its REST API names `base.sha` and `head.sha`
+// (pull-dependencies.ts pullCommits). None where either isn't a commit's id.
+const commitsOf = (number: number, { baseRefOid: base, headRefOid: head }: Node) =>
+  typeof base === 'string' && SHA.test(base) && typeof head === 'string' && SHA.test(head) ? [{ number, base, head }] : []
+
+// A page of the repository's issues or pull requests in `state`, after the
+// page `after` ended (null for the first): its `items`, how many are open and
+// closed (`counts`), and, where more follow, the cursor reading them
+// (`after`); open pull requests' commits (`commits`, commitsOf) too, which
+// the code viewer is never told (http.ts handleRepositoryIssues).
+export async function repositoryIssues(fullName: string, token: string, kind: IssuesKind, state: IssuesState, after: string | null, fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql(pageQuery(kind, state), { owner, name, after }, token, fetchImpl, partRefused) as Page
+  const repository = data?.repository
+  if (!repository) throw new GithubApiError(404, 'github-not-found')
+  const info = repository.page?.pageInfo
+  const next = info?.hasNextPage === true && typeof info.endCursor === 'string' && ISSUES_CURSOR.test(info.endCursor) ? info.endCursor : null
+  const open = kind === 'pulls' && state === 'open'
+  const tiles = (repository.page?.nodes ?? []).flatMap(node => {
+    const tile = item(kind, node)
+    return tile && node ? [{ node, tile }] : []
+  })
+  return {
+    items: tiles.map(({ node, tile }) => open ? { ...tile, reviews: pullReviews(node, tile.author) } : tile),
+    counts: { open: count(repository.open?.totalCount), closed: count(repository.closed?.totalCount) },
+    more: next !== null, after: next,
+    ...open ? { commits: tiles.flatMap(({ node, tile }) => commitsOf(tile.number, node)) } : {},
+  }
+}