@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.51

package/server-managed/repository-pulse.ts

@@ -0,0 +1,460 @@
+// What the code viewer's Pulse tab shows of a repository
+// (GET /api/admin/repositories/pulse): how its default branch moves, week by
+// week over the last year: its commits each day, the lines they add and
+// remove, those an agent made or co-authored, who made them and when in the
+// week, counted from its commits as the Commits tab reads and keeps them
+// (repository-history.ts historyFrom), so that only those not kept yet are
+// read of GitHub, a few queries an answer, the client asking again for the
+// rest; a year past YEAR_COMMITS is counted by GitHub's statistics instead,
+// which GitHub computes when first asked and again once the default branch
+// moves, answering 202 till they are (told pending, StatsPending, for the
+// client to ask again). And, since
+// the start of the week `weeks` weeks back, and over the same days of the
+// week `weeks` weeks earlier, the pull requests merged and opened and the
+// issues closed and opened, how many and the latest of each.
+import { agentOperated, githubAgent } from '../common/managed/github-agents.ts'
+import { GithubApiError, githubJson } from './github-app.ts'
+import { shareGithubRead } from './github-requests.ts'
+import { coauthorsOf } from './commit-coauthors.ts'
+import { ACTOR, type GraphAccount, type HistoryCommit, type HistoryPages, accountOf, actorOf, githubGraphql, historyFrom } from './repository-history.ts'
+
+export const PULSE_WEEKS = [1, 4, 13, 52]
+// What a year counted from its commits holds, its version: kept years of
+// another are counted again.
+export const PULSE_YEAR_VERSION = 12
+const WEEK_MS = 7 * 24 * 60 * 60_000
+const DAY_MS = 24 * 60 * 60_000
+const MAX_CONTRIBUTORS = 100
+const DIRECT_LISTED = 500
+export const LISTED = 10
+// Merged pull requests and closed issues are searched by when each was last
+// updated, GitHub sorting by no merge or close: as many as this are read, and
+// the latest merged or closed of them listed.
+const SEARCHED = 50
+// A year of more commits than this is counted by GitHub's statistics: read a
+// page at a time, it would take a hundred queries. Of those not kept, as
+// many queries are made an answer as YEAR_QUERIES, each reading on from as
+// many commits as YEAR_STARTS.
+export const YEAR_COMMITS = 10_000
+const YEAR_QUERIES = 5
+const YEAR_STARTS = 10
+// Commits are read on from as far as this before the year, a commit's clock
+// not always later than its parents': one dated before the year may have a
+// parent dated in it.
+const YEAR_SKEW_MS = 30 * DAY_MS
+const MAX_TITLE = 1000
+const SHA = /^[a-f\d]{40}$/u
+
+// GitHub still computing a statistic.
+export class StatsPending extends Error {
+  constructor() { super('github-stats-pending') }
+}
+
+// A week: its commits each day (Sunday first) and in all, the lines they
+// added and removed, and, counted from its commits, each day's lines
+// (`dayLines`, `[added, removed]`), the commits that release the repository
+// each day (`releaseDays`, release-commits.ts) and, of the rest, those an
+// agent made or co-authored (`agentDays`), and those pushed to the branch
+// directly (`directDays`, agent-merges.ts directCommits), which GitHub's
+// statistics don't count.
+export interface PulseWeek { week: number; days: number[]; commits: number; additions: number | null; deletions: number | null; dayLines?: [number, number][]
+  agentDays?: number[]; releaseDays?: number[]; directDays?: number[] }
+// A contributor, by their login and their account's numeric id (`id`, where
+// GitHub named it), else by the name their commits carry, and their weeks,
+// each `[week, commits, additions, deletions]`, those with any; counted from
+// their commits, their days too, each `[day, commits, additions, deletions,
+// agents, releases, direct]`, `releases` those that release the repository,
+// `agents`, of the rest, those an agent took part in (withAgent), and
+// `direct` those pushed to the branch directly.
+export interface PulseContributor { login: string | null; id?: number | null; name: string | null; weeks: [number, number, number, number][]
+  days?: [number, number, number, number, number, number, number][] }
+// A commit pushed to the branch directly, as Pulse lists it: its id, when it
+// was committed, its subject, its author, by account, else name, and what it
+// is: a release, else one an agent took part in, else one without.
+export interface PulseCommit { sha: string; at: number; subject: string; login: string | null; id: number | null; name: string | null
+  kind: 'agent' | 'without' | 'release' }
+// Commits by day of the week and hour (`punch[day][hour]`, Sunday first), in
+// each commit's own time zone, and, counted from its commits, each period's
+// (`punches`, by its weeks); `lines` false where GitHub counts none, null
+// while it is counting them; counted from its commits, the latest pushed to
+// the branch directly (`directCommits`, as many as DIRECT_LISTED); and,
+// counted from its commits read no further back than a period needed, when
+// from it is counted whole (`from`), absent for the year whole.
+export interface PulseStats { weeks: PulseWeek[]; contributors: PulseContributor[]; punch: number[][]; punches?: Record<number, number[][]>; lines: boolean | null
+  directCommits?: PulseCommit[]; from?: number }
+// The lines added and removed a week, and each contributor's, as GitHub's
+// statistics count them, `lines` false where it counts none.
+export interface PulseLines { weeks: [number, number, number][]; contributors: { login: string; weeks: [number, number, number][] }[]; lines: boolean }
+// The days (`from`, `to`, both days, UTC; `to` none, on) and the authors (GitHub
+// logins, any of them) a period's pull requests and issues are narrowed to.
+export interface PulseNarrowing { from: number; to: number | null; authors: string[] }
+// The year's commits read so far: all of them, or as far back as asked
+// (`commits`, `from`), else how many (`read`), and whether past
+// YEAR_COMMITS (`tooMany`).
+export type YearCommits = { complete: true; commits: HistoryCommit[]; passed: HistoryCommit[]; from: number | null } | { complete: false; read: number; tooMany: boolean }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const repoApi = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
+const emptyPunch = () => Array.from({ length: 7 }, () => Array.from({ length: 24 }, () => 0))
+
+// One statistic: its rows once GitHub has computed it, 'pending' while it
+// computes them (202), none for a repository with no commits (204, no body),
+// 'too-large' where it counts none (lines past 10,000 commits, 422).
+function statistic(fullName: string, token: string | null, kind: string, fetchImpl: typeof fetch) {
+  // Stats and lines both need contributors. Share by the original transport;
+  // the per-call status wrapper below would otherwise give each its own read.
+  return shareGithubRead(fetchImpl, JSON.stringify(['statistic', fullName, token, kind]), () => readStatistic(fullName, token, kind, fetchImpl))
+}
+
+async function readStatistic(fullName: string, token: string | null, kind: string, fetchImpl: typeof fetch): Promise<unknown[] | 'pending' | 'too-large'> {
+  let status = 0
+  const answered: typeof fetch = async (input, init) => {
+    const res = await fetchImpl(input, init)
+    status = res.status
+    return res
+  }
+  try {
+    const data = await githubJson(`${repoApi(fullName)}/stats/${kind}`, token, answered)
+    if (status === 202) return 'pending'
+    if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+    return data
+  } catch (err) {
+    if (status === 202) return 'pending'
+    if (status === 204) return []
+    if (err instanceof GithubApiError && err.message === 'github-status-422') return 'too-large'
+    throw err
+  }
+}
+
+// `kinds` of GitHub's statistics, each asked once, together; any still
+// computed, StatsPending.
+async function statistics(fullName: string, token: string | null, kinds: string[], fetchImpl: typeof fetch) {
+  const read = await Promise.all(kinds.map(kind => statistic(fullName, token, kind, fetchImpl)))
+  if (read.includes('pending')) throw new StatsPending()
+  return read.map(rows => rows === 'too-large' ? null : rows as unknown[])
+}
+
+type ActivityRow = { week?: unknown; days?: unknown; total?: unknown }
+type ContributorRow = { author?: { login?: unknown; id?: unknown } | null; weeks?: { w?: unknown; a?: unknown; d?: unknown; c?: unknown }[] }
+
+// The default branch's commits over the last year as GitHub's statistics
+// count them, for a year past YEAR_COMMITS: a week a row, the oldest first,
+// its commits each day (Sunday first) and in all; its contributors (as many
+// as MAX_CONTRIBUTORS, the most commits that year first) and their weeks;
+// and its commits by day of the week and hour, in each commit's own time
+// zone. Lines are GitHub's to count apart (repositoryLines).
+export async function repositoryStats(fullName: string, token: string | null, fetchImpl: typeof fetch = globalThis.fetch): Promise<PulseStats> {
+  const [activityRows = null, contributorRows = null, punchRows = null] = await statistics(fullName, token, ['commit_activity', 'contributors', 'punch_card'], fetchImpl)
+  const weeks = ((activityRows ?? []) as ActivityRow[]).flatMap(row => {
+    if (!Number.isSafeInteger(row?.week)) return []
+    const days = Array.from({ length: 7 }, (_, day) => count(Array.isArray(row.days) ? row.days[day] : 0))
+    return [{ week: (row.week as number) * 1000, days, commits: count(row.total), additions: null, deletions: null }]
+  }).toSorted((a, b) => a.week - b.week)
+  const first = weeks[0]?.week ?? Number.POSITIVE_INFINITY
+  const contributors = ((contributorRows ?? []) as ContributorRow[]).flatMap(row => {
+    const { login, id } = accountOf(row?.author)
+    const theirs = (row?.weeks ?? []).flatMap(item => {
+      const week = count(item?.w) * 1000
+      return week >= first && count(item?.c) > 0 ? [[week, count(item?.c), 0, 0] as [number, number, number, number]] : []
+    })
+    return login && theirs.length > 0 ? [{ login, id, name: null, weeks: theirs, commits: theirs.reduce((sum, item) => sum + item[1], 0) }] : []
+  }).toSorted((a, b) => b.commits - a.commits).slice(0, MAX_CONTRIBUTORS).map(({ login, id, name, weeks: theirs }) => ({ login, id, name, weeks: theirs }))
+  const punch = emptyPunch()
+  for (const row of (punchRows ?? []) as unknown[][]) {
+    if (Array.isArray(row) && Number.isSafeInteger(row[0]) && Number.isSafeInteger(row[1]) && punch[row[0] as number]?.[row[1] as number] !== undefined) {
+      punch[row[0] as number]![row[1] as number] = count(row[2])
+    }
+  }
+  return { weeks, contributors, punch, lines: null }
+}
+
+// The lines added and removed each week since `since`, and each
+// contributor's, as GitHub's statistics count them; none, `lines` false,
+// where it counts none (past 10,000 commits, where it counts each
+// contributor's as none too).
+export async function repositoryLines(fullName: string, token: string | null, since: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<PulseLines> {
+  const [frequency = null, contributorRows = null] = await statistics(fullName, token, ['code_frequency', 'contributors'], fetchImpl)
+  if (frequency === null) return { weeks: [], contributors: [], lines: false }
+  const weeks = frequency.flatMap(row => Array.isArray(row) && Number.isSafeInteger(row[0]) && (row[0] as number) * 1000 >= since
+    ? [[(row[0] as number) * 1000, count(row[1]), count(Math.abs(Number(row[2])))] as [number, number, number]] : [])
+  const contributors = ((contributorRows ?? []) as ContributorRow[]).flatMap(row => {
+    const { login } = accountOf(row?.author)
+    const theirs = (row?.weeks ?? []).flatMap(item => count(item?.w) * 1000 >= since && count(item?.a) + count(item?.d) > 0
+      ? [[count(item?.w) * 1000, count(item?.a), count(item?.d)] as [number, number, number]] : [])
+    return login && theirs.length > 0 ? [{ login, weeks: theirs }] : []
+  })
+  return { weeks, contributors, lines: true }
+}
+
+// The default branch's head, null for a repository with none.
+export async function defaultHead(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<string | null> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const data = await githubGraphql('query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { defaultBranchRef { target { oid } } } }',
+    { owner, name }, token, fetchImpl) as { repository?: { defaultBranchRef?: { target?: { oid?: unknown } | null } | null } | null } | null
+  if (!data?.repository) throw new GithubApiError(404, 'github-not-found')
+  const oid = data.repository.defaultBranchRef?.target?.oid
+  return typeof oid === 'string' && SHA.test(oid) ? oid : null
+}
+
+// The commits from `head` made since `since`, as the Commits tab reads and
+// keeps them (`pages`, historyFrom): on from the parents of those since (or
+// as much as YEAR_SKEW_MS before), not yet listed, YEAR_STARTS at a time,
+// till none is left; the pages kept read
+// of the store, those not of GitHub, as many queries of them as
+// YEAR_QUERIES, the rest left for the next to ask (`complete` false, how
+// many are `read`); more than YEAR_COMMITS, too many (`tooMany`). Read
+// whole, those it was read on past besides (`passed`): undated, or dated
+// before it, a clock behind, the branch's commits since beneath them. Read
+// no further than `need` asks, those since it read whole (`complete`, `from`
+// the newest of those read whose parents are not, every commit after it
+// read; null, the year read whole).
+export async function yearCommits(fullName: string, token: string, head: string, since: number, pages: HistoryPages,
+  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<YearCommits> {
+  const found = new Map<string, HistoryCommit>()
+  const tried = new Set<string>()
+  const within = (commit: HistoryCommit) => commit.committedAt === null || commit.committedAt >= since - YEAR_SKEW_MS
+  const dated = (commit: HistoryCommit) => commit.committedAt !== null && commit.committedAt >= since
+  const read = () => [...found.values()].filter(dated).length
+  const passed = () => [...found.values()].filter(commit => !dated(commit) && within(commit))
+  let queries = 0
+  let starts = [head]
+  while (starts.length > 0) {
+    // Those not read yet, the head before any, else the parents of those
+    // read, no later than the newest of them (but for a clock behind): read
+    // whole after it.
+    const unread = new Set(starts)
+    const from = found.size === 0 ? Number.POSITIVE_INFINITY : Math.max(Number.NEGATIVE_INFINITY, ...[...found.values()]
+      .filter(commit => commit.parents.some(sha => unread.has(sha))).map(commit => commit.committedAt ?? Number.POSITIVE_INFINITY))
+    if (need > since && from < need) return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from }
+    if (queries >= YEAR_QUERIES) return { complete: false, read: read(), tooMany: false }
+    const batch = starts.slice(0, YEAR_STARTS)
+    for (const sha of batch) tried.add(sha)
+    const got = await historyFrom(fullName, token, batch, pages, fetchImpl)
+    if (got.read > 0) queries++
+    for (const commit of got.commits) if (!found.has(commit.sha)) found.set(commit.sha, commit)
+    if (read() > YEAR_COMMITS) return { complete: false, read: read(), tooMany: true }
+    starts = [...new Set([...found.values()].filter(within).flatMap(commit => commit.parents))].filter(sha => !found.has(sha) && !tried.has(sha))
+  }
+  return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from: null }
+}
+
+// Whether an author is a GitHub App's bot: by its login (`<app>[bot]`, as a
+// commit's no-reply address names it, github-accounts.ts commitAccount),
+// else, for one GitHub names no account for, by the name it commits as.
+const bot = (login: string | null | undefined, name: string | null | undefined) => /\[bot\]$/iu.test(login ?? name ?? '')
+
+// Whether an agent made `commit` or co-authored it: its author one of
+// GitHub's agents (common/managed/github-agents.ts githubAgent), or any of
+// its co-authors an agent (commit-coauthors.ts coauthorsOf), as Commits
+// marks them, or any bot, whichever GitHub App's; or one an agent's pull request brought (`merges`,
+// agent-merges.ts agentCommits); or one an account agents work as pushed to
+// the branch directly (`direct`, github-agents.ts agentOperated).
+const withAgent = (commit: HistoryCommit, merges: ReadonlySet<string>, direct: ReadonlySet<string>) => merges.has(commit.sha)
+  || (direct.has(commit.sha) && agentOperated(commit.authorLogin, commit.authorId ?? null))
+  || githubAgent(commit.authorLogin, commit.authorId ?? null, commit.authorName) !== null || bot(commit.authorLogin, commit.authorName)
+  || coauthorsOf(commit).some(coauthor => Boolean(coauthor.agent) || bot(coauthor.login, coauthor.name))
+
+// The year from `first` (pulseSince(52, …)) of `commits`, as GitHub's
+// statistics count them, merges left out: a week a row, its commits each day
+// (UTC) and in all and the lines they added and removed, in all and each day,
+// those that release the repository (`releases`, release-commits.ts) and,
+// of the rest, those an agent made or co-authored, merged from an agent's
+// pull request (`merges`) or pushed directly as an account agents work as
+// (`direct`, withAgent), each day;
+// its contributors,
+// by account (its id, by the login it committed as first listed, the newest,
+// whatever it was renamed from; a login's commits read before ids were, the
+// one account's that committed as it, where only one did), else login, each
+// matched as GitHub matches logins, regardless of case, else name (as many
+// as MAX_CONTRIBUTORS, the most commits first),
+// and their weeks and days, each day's releases and commits with agents too;
+// and its commits by day of the week and hour, in each author's own time
+// zone (else UTC, where GitHub told none), the year's and each period's
+// (PULSE_WEEKS, its last weeks).
+export function commitStats(commits: HistoryCommit[], first: number, merges: ReadonlySet<string> = new Set(), releases: ReadonlySet<string> = new Set(),
+  direct: ReadonlySet<string> = new Set()): PulseStats {
+  const weeks = Array.from({ length: 52 }, (_, at) => ({ week: first + at * WEEK_MS, days: Array.from({ length: 7 }, () => 0), commits: 0, additions: 0, deletions: 0,
+    dayLines: Array.from({ length: 7 }, () => [0, 0] as [number, number]), agentDays: Array.from({ length: 7 }, () => 0), releaseDays: Array.from({ length: 7 }, () => 0),
+    directDays: Array.from({ length: 7 }, () => 0) }))
+  type Counts = Map<number, number[]>
+  const people = new Map<string, { login: string | null; logins: Set<string>; id: number | null; name: string | null; weeks: Counts; days: Counts; commits: number }>()
+  const punches = Object.fromEntries(PULSE_WEEKS.map(span => [span, emptyPunch()]))
+  // Each commit's author, by the key their commits are counted by, and of a
+  // login an account took on, that account (`merged`).
+  const keys = new Map<string, string>()
+  const merged = new Map<string, { login: string | null; id: number | null; name: string | null }>()
+  const add = (counts: Counts, at: number, made: number[]) => counts.set(at, made.map((value, index) => (counts.get(at)?.[index] ?? 0) + value))
+  for (const commit of commits) {
+    if (commit.parents.length > 1 || commit.committedAt === null || commit.committedAt < first) continue
+    const at = Math.floor((commit.committedAt - first) / WEEK_MS)
+    const week = weeks[at]
+    if (!week) continue
+    const [additions, deletions] = [commit.additions ?? 0, commit.deletions ?? 0]
+    const weekday = new Date(commit.committedAt).getUTCDay()
+    week.days[weekday]!++
+    week.dayLines[weekday]![0] += additions
+    week.dayLines[weekday]![1] += deletions
+    week.commits++
+    week.additions += additions
+    week.deletions += deletions
+    const release = releases.has(commit.sha)
+    const agent = !release && withAgent(commit, merges, direct)
+    if (release) week.releaseDays[weekday]!++
+    if (direct.has(commit.sha)) week.directDays[weekday]!++
+    if (agent) week.agentDays[weekday]!++
+    const local = new Date(commit.authoredAt != null && commit.authorZone != null ? commit.authoredAt + commit.authorZone * 60_000 : commit.committedAt)
+    for (const span of PULSE_WEEKS) if (at >= 52 - span) punches[span]![local.getUTCDay()]![local.getUTCHours()]!++
+    const key = commit.authorLogin && commit.authorId != null ? `#${commit.authorId}` : commit.authorLogin ? `@${commit.authorLogin.toLowerCase()}`
+      : commit.authorName ? `=${commit.authorName}` : null
+    if (!key) continue
+    keys.set(commit.sha, key)
+    const person = people.get(key) ?? { login: commit.authorLogin, logins: new Set<string>(), id: commit.authorId ?? null, name: commit.authorName,
+      weeks: new Map(), days: new Map(), commits: 0 }
+    if (commit.authorLogin) person.logins.add(commit.authorLogin.toLowerCase())
+    add(person.weeks, week.week, [1, additions, deletions])
+    add(person.days, Math.floor(commit.committedAt / DAY_MS) * DAY_MS, [1, additions, deletions, agent ? 1 : 0, release ? 1 : 0, direct.has(commit.sha) ? 1 : 0])
+    person.commits++
+    people.set(key, person)
+  }
+  // A login one account committed as, those of its commits read before ids
+  // were that account's; one more did, theirs apart, no one's.
+  const accounts = Map.groupBy([...people.values()].filter(person => person.id !== null).flatMap(person => [...person.logins].map(login => ({ login, person }))),
+    ({ login }) => login)
+  for (const [key, person] of people) {
+    const [owner, ...others] = person.login !== null && person.id === null ? accounts.get(person.login.toLowerCase()) ?? [] : []
+    if (!owner || others.length > 0) continue
+    const account = owner.person
+    for (const [week, counts] of person.weeks) add(account.weeks, week, counts)
+    for (const [day, counts] of person.days) add(account.days, day, counts)
+    account.commits += person.commits
+    people.delete(key)
+    merged.set(key, account)
+  }
+  const rows = (counts: Counts) => [...counts].toSorted(([a], [b]) => a - b).map(([at, made]) => [at, ...made])
+  const contributors = [...people.values()].toSorted((a, b) => b.commits - a.commits).slice(0, MAX_CONTRIBUTORS).map(({ login, id, name, weeks: theirs, days }) => ({
+    login, id, name, weeks: rows(theirs) as [number, number, number, number][], days: rows(days) as [number, number, number, number, number, number, number][] }))
+  // Each pushed directly by the contributor its author's commits are counted
+  // as, whatever account it named.
+  const directCommits = commits.filter(commit => direct.has(commit.sha) && commit.committedAt !== null && commit.committedAt >= first)
+    .toSorted((a, b) => b.committedAt! - a.committedAt!).slice(0, DIRECT_LISTED).map((commit): PulseCommit => {
+      const { sha, committedAt, subject, authorLogin, authorId, authorName } = commit
+      const author = people.get(keys.get(sha) ?? '') ?? merged.get(keys.get(sha) ?? '') ?? { login: authorLogin, id: authorId ?? null, name: authorName }
+      const kind = releases.has(sha) ? 'release' : withAgent(commit, merges, direct) ? 'agent' : 'without'
+      return { sha, at: committedAt!, subject, login: author.login, id: author.id, name: author.name, kind }
+    })
+  return { weeks, contributors, punch: punches[52]!, punches, lines: true, directCommits }
+}
+
+// The year's statistics as a period of `weeks` weeks shows them: when its
+// commits are made, the period's where they were counted from its commits
+// (`periodPunch`), else the year's or more, as GitHub's statistics count it;
+// the commits pushed to the branch directly, the period's alone.
+export function periodStats(stats: PulseStats, weeks: number) {
+  const { punches, directCommits, ...rest } = stats
+  const punch = punches?.[weeks]
+  const since = stats.weeks.at(-weeks)?.week ?? Number.NEGATIVE_INFINITY
+  return { ...rest, punch: punch ?? rest.punch, periodPunch: Boolean(punch), ...directCommits ? { directCommits: directCommits.filter(commit => commit.at >= since) } : {} }
+}
+
+// GitHub's statistics of a year past YEAR_COMMITS (repositoryStats) with
+// its `lines` added in, each week's and each contributor's, by login; null
+// while GitHub is counting them, `lines` null.
+export function withLines(stats: PulseStats, lines: PulseLines | null): PulseStats {
+  if (!lines) return { ...stats, lines: null }
+  if (!lines.lines) return { ...stats, lines: false }
+  const weekly = new Map(lines.weeks.map(([week, additions, deletions]) => [week, [additions, deletions]]))
+  const theirs = new Map(lines.contributors.map(person => [person.login, new Map(person.weeks.map(([week, additions, deletions]) => [week, [additions, deletions]]))]))
+  return {
+    ...stats,
+    weeks: stats.weeks.map(week => ({ ...week, additions: weekly.get(week.week)?.[0] ?? 0, deletions: weekly.get(week.week)?.[1] ?? 0 })),
+    contributors: stats.contributors.map(person => ({ ...person, weeks: person.weeks.map(([week, made]) => {
+      const added = person.login ? theirs.get(person.login)?.get(week) : undefined
+      return [week, made, added?.[0] ?? 0, added?.[1] ?? 0] as [number, number, number, number]
+    }) })),
+    lines: true,
+  }
+}
+
+// Where a period of `weeks` weeks starts, as GitHub's statistics count weeks:
+// the Sunday (UTC) that many weeks back, this week the last of them.
+export function pulseSince(weeks: number, now: number) {
+  const today = Math.floor(now / DAY_MS) * DAY_MS
+  const sunday = today - new Date(today).getUTCDay() * DAY_MS
+  return sunday - (weeks - 1) * WEEK_MS
+}
+
+const SEARCH = (name: string, fragment: string, first = 0) => `${name}: search(type: ISSUE, query: $${name}, first: ${Math.max(first, 1)}) {
+    issueCount${first > 0 ? ` nodes { ...${fragment} }` : ''}
+  }`
+const ACTIVITY_QUERY = `query($merged: String!, $mergedBefore: String!, $opened: String!, $openedBefore: String!,
+  $closed: String!, $closedBefore: String!, $created: String!, $createdBefore: String!) {
+  ${SEARCH('merged', 'pull', SEARCHED)}
+  ${SEARCH('mergedBefore', 'pull')}
+  ${SEARCH('opened', 'pull', LISTED)}
+  ${SEARCH('openedBefore', 'pull')}
+  ${SEARCH('closed', 'issue', SEARCHED)}
+  ${SEARCH('closedBefore', 'issue')}
+  ${SEARCH('created', 'issue', LISTED)}
+  ${SEARCH('createdBefore', 'issue')}
+}
+fragment pull on PullRequest { number title pullState: state isDraft createdAt mergedAt author { ${ACTOR} } }
+fragment issue on Issue { number title issueState: state stateReason createdAt closedAt author { ${ACTOR} } }`
+
+type SearchNode = { number?: unknown; title?: unknown; pullState?: unknown; issueState?: unknown; isDraft?: unknown; stateReason?: unknown
+  createdAt?: unknown; mergedAt?: unknown; closedAt?: unknown; author?: GraphAccount } | null
+type Search = { issueCount?: unknown; nodes?: SearchNode[] } | null | undefined
+const REASONS: Record<string, string> = { COMPLETED: 'completed', NOT_PLANNED: 'not-planned', DUPLICATE: 'duplicate' }
+
+// An issue or pull request a search lists, as the popup's preview of it
+// takes one, `at` when it was merged, opened or closed.
+function listed(node: SearchNode, at: unknown) {
+  if (!node || !Number.isSafeInteger(node.number) || (node.number as number) <= 0) return null
+  const title = typeof node.title === 'string' ? node.title.trim().slice(0, MAX_TITLE) : ''
+  const author = actorOf(node.author)
+  const common = { number: node.number as number, title, author: author.login, authorId: author.id, at: timeOf(at), createdAt: timeOf(node.createdAt) }
+  return node.pullState === undefined
+    ? { ...common, kind: 'issues', state: node.issueState === 'OPEN' ? 'open' : 'closed', reason: REASONS[String(node.stateReason)] ?? null }
+    : { ...common, kind: 'pulls', state: node.pullState === 'MERGED' ? 'merged' : node.pullState === 'OPEN' ? 'open' : 'closed', draft: node.isDraft === true }
+}
+
+// The pull requests merged and opened and the issues closed and opened since
+// the start of the week `weeks` weeks back (`since`), and over the same days
+// of the week `weeks` weeks earlier (`previous`, its count: a week's Sunday to
+// Thursday beside the week before's, not the days just before, whose days of
+// the week differ), the latest of each listed, as many as LISTED: those
+// opened as GitHub sorts them, those merged or closed the latest of the
+// SEARCHED most recently updated, which are the latest of all where the
+// period holds no more, or the last listed was merged or closed after the
+// SEARCHED-th was last updated. A search counts by the day (UTC). Narrowed
+// (`narrowing`), those of its days from `from` to `to` (both days, UTC;
+// none, on), and those its `authors` (GitHub logins) opened, any of them.
+export async function repositoryActivity(fullName: string, token: string, weeks: number, now: number = Date.now(), fetchImpl: typeof fetch = globalThis.fetch,
+  narrowing: PulseNarrowing | null = null) {
+  const since = pulseSince(weeks, now)
+  const back = weeks * WEEK_MS
+  const day = (at: number) => new Date(at).toISOString().slice(0, 10)
+  const current = narrowing?.to == null ? `>=${day(narrowing?.from ?? since)}` : `${day(narrowing.from)}..${day(narrowing.to)}`
+  const previous = `${day(since - back)}..${day(now - back)}`
+  const repo = `repo:${fullName}`
+  // An app's login (`name[bot]`) is searched for as GitHub names its app.
+  const by = (narrowing?.authors ?? []).map(login => ` author:${login.endsWith('[bot]') ? `app/${login.slice(0, -5)}` : login}`).join('')
+  const asked = (what: string, range: string, sort: string) => `${repo} ${what}${range}${by} sort:${sort}`
+  const kinds = {
+    merged: ['is:pr is:merged merged:', 'updated-desc'], opened: ['is:pr created:', 'created-desc'],
+    closed: ['is:issue is:closed closed:', 'updated-desc'], created: ['is:issue created:', 'created-desc'],
+  } as const
+  const variables = Object.fromEntries(Object.entries(kinds).flatMap(([name, [what, sort]]) => [[name, asked(what, current, sort)],
+    [`${name}Before`, asked(what, previous, sort)]]))
+  const data = await githubGraphql(ACTIVITY_QUERY, variables, token, fetchImpl) as Record<string, Search> | null
+  const at = { merged: 'mergedAt', opened: 'createdAt', closed: 'closedAt', created: 'createdAt' } as const
+  const told = Object.fromEntries((Object.keys(kinds) as (keyof typeof kinds)[]).map(name => [name, {
+    count: count(data?.[name]?.issueCount),
+    previous: count(data?.[`${name}Before`]?.issueCount),
+    items: (data?.[name]?.nodes ?? []).flatMap(node => listed(node, node?.[at[name]]) ?? []).toSorted((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, LISTED),
+  }]))
+  return { since, previousSince: since - back, ...told }
+}

package/server-managed/repository-risk-assess.ts

@@ -0,0 +1,105 @@
+// A package's risk line, as a repository risk scan tells it
+// (repository-risk.ts): its version's document read and assessed, as risk
+// tells one npm removed where npm has none; and how a failure is told.
+import { setTimeout as delay } from 'node:timers/promises'
+import { NpmRiskError, SEVERITIES, type Severity } from '../risk/index.js'
+import { GithubApiError } from './github-errors.ts'
+import { NpmPackageError, type NpmVersionDocument } from './npm-packages.ts'
+import type { RepositoryRiskLine } from './repository-risk.ts'
+
+// An assessment refused as busy (`npm-busy`, by npm-risk.ts or the npm reads
+// beneath it), or that npm asked to ask later (risk's `upstream-busy`, as its
+// downloads API answers past a burst of requests), is asked again after a
+// wait, up to this many times.
+export const BUSY_RETRIES = 20
+export const BUSY_WAIT_MS = 1000
+
+// How long a package's risk line, or a lockfile's advisories, is told as it
+// is: after it, a risk line is told stale and assessed again, as risk tells
+// again what of a package changes in time, and advisories asked again, as npm
+// publishes them (repository-risk.ts).
+export const RISK_KEPT_MS = 60 * 60_000
+
+// The most severe of `findings`, or null for none.
+export function highestSeverity(findings: readonly { severity: Severity }[]): Severity | null {
+  return SEVERITIES.find(severity => findings.some(finding => finding.severity === severity)) ?? null
+}
+
+// Why a step failed, as a line says it: an error's code, and for a lockfile
+// refused, what of it its reader refused.
+export type RiskFailure = { error: string; detail?: string }
+type RiskLine = Extract<RepositoryRiskLine, { type: 'risk' }>
+
+// What an error is known by: a GitHub or npm failure's code, or `failed`;
+// GitHub not reached with what failed (githubUnreachable), while `doing` what
+// of a repository, and risk's with what it asked of npm and how that failed,
+// where they say.
+export function failureOf(error: unknown, doing?: string): RiskFailure {
+  if (error instanceof GithubApiError && error.detail) return { error: error.message, detail: doing ? `${doing}: ${error.detail}` : error.detail }
+  if (error instanceof GithubApiError || error instanceof NpmPackageError) return { error: error.message }
+  if (!(error instanceof NpmRiskError)) return { error: 'failed' }
+  return error.message === error.code ? { error: error.code } : { error: error.code, detail: error.message }
+}
+
+export const isBusy = (error: unknown) => (error instanceof NpmPackageError && error.status === 429) || (error instanceof NpmRiskError && error.code === 'upstream-busy')
+
+// A package to assess: npm's of its name and version, or, with an
+// `integrity`, a mirror's held to it.
+export interface AssessedPackage { name: string; version: string; integrity?: string }
+
+export type Assessment = { published: string | null; findings: { id: string; severity: Severity; takenDown?: unknown }[]; score: { score: number } }
+
+// What of a scan's source assessing a package asks (RepositoryRiskSource).
+export interface AssessingSource {
+  version(name: string, version: string, signal: AbortSignal): Promise<NpmVersionDocument>
+  assess(doc: NpmVersionDocument, teamScoped: boolean, signal: AbortSignal): Promise<Assessment>
+  removed(name: string, version: string, teamScoped: boolean, signal: AbortSignal): Promise<Assessment>
+}
+
+// A package's risk line, its version's document kept and the assessment asked
+// again after a wait while the server is busy; null once the scan stops. A
+// version npm has no document of is told as risk tells one npm removed
+// (removedOf), its malware keeping whether its package was taken down.
+export async function assessPackage(source: AssessingSource, signal: AbortSignal, pkg: AssessedPackage, teamScoped: boolean): Promise<RiskLine | null> {
+  const at = { type: 'risk', ...pkg } as const
+  let doc: NpmVersionDocument | NpmPackageError | undefined
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const read = doc ??= await documentOf(source, pkg, signal)
+      if (!(read instanceof NpmPackageError) && pkg.integrity !== undefined && !pkg.integrity.split(/\s+/u).includes(read.dist.integrity)) return { ...at, error: 'integrity-mismatch' }
+      const { published, findings, score } = read instanceof NpmPackageError ? await removedOf(source, pkg, teamScoped, signal, read) : await assessedOf(source, pkg, teamScoped, signal, read)
+      const told = findings.map(({ id, severity, takenDown }) => ({ id, severity, ...takenDown === true ? { takenDown: true as const } : {} }))
+      return { ...at, published, severity: highestSeverity(told), score: score.score, findings: told }
+    } catch (error) {
+      if (signal.aborted) return null
+      if (!isBusy(error) || attempt >= BUSY_RETRIES) return { ...at, ...failureOf(error) }
+      try { await delay(BUSY_WAIT_MS * Math.min(attempt + 1, 5), undefined, { signal }) } catch { return null }
+    }
+  }
+}
+
+// npm's document of a version, or its answer that it has none (a 404).
+async function documentOf(source: AssessingSource, pkg: AssessedPackage, signal: AbortSignal): Promise<NpmVersionDocument | NpmPackageError> {
+  try { return await source.version(pkg.name, pkg.version, signal) } catch (error) {
+    if (error instanceof NpmPackageError && error.status === 404) return error
+    throw error
+  }
+}
+
+// A version's assessment; where risk finds npm no longer has it, as a document
+// read from where versions' are kept doesn't tell, as one npm removed.
+async function assessedOf(source: AssessingSource, pkg: AssessedPackage, teamScoped: boolean, signal: AbortSignal, doc: NpmVersionDocument): Promise<Assessment> {
+  try { return await source.assess(doc, teamScoped, signal) } catch (error) {
+    if (!(error instanceof NpmRiskError && error.code === 'version-not-found')) throw error
+    return removedOf(source, pkg, teamScoped, signal, new NpmPackageError(404, 'package-not-found'))
+  }
+}
+
+// A version npm has no document of, as risk tells one npm removed, as it
+// removes every one it finds malware in (`removed`): `gone`, npm's answer of
+// none, thrown where nothing tells of it.
+async function removedOf(source: AssessingSource, pkg: AssessedPackage, teamScoped: boolean, signal: AbortSignal, gone: NpmPackageError): Promise<Assessment> {
+  try { return await source.removed(pkg.name, pkg.version, teamScoped, signal) } catch (error) {
+    throw error instanceof NpmRiskError && (error.code === 'version-not-found' || error.code === 'package-not-found') ? gone : error
+  }
+}

package/server-managed/repository-risk-audit.ts

@@ -0,0 +1,79 @@
+// A lockfile's advisories, as a repository risk scan asks them
+// (repository-risk.ts): npm's registry's of its packages of the registry or
+// a mirror, asked at once, as `npm audit` asks, each told with whether it is
+// of malware (risk's npmMalwareAdvisory); kept by the lockfile's blob, in the
+// instance's memory and the source's `audits`, for RISK_KEPT_MS, as npm
+// publishes advisories, or why they couldn't be had for AUDIT_FAILED_KEPT_MS.
+import type { Advisory } from '@preventive/upstream/advisories.js'
+import { isExactVersion } from '@preventive/upstream/semver.js'
+import { npmMalwareAdvisory } from '../risk/index.js'
+import { isNpmPackageName } from '../common/managed/npm-packages.js'
+import type { LockedPackage } from './locked-packages.ts'
+import type { Lru } from './lru.ts'
+import type { KeptStore } from './npm-kept.ts'
+import { RISK_KEPT_MS, type RiskFailure, failureOf } from './repository-risk-assess.ts'
+
+export type AdvisoryRow = Advisory & { malware: boolean }
+// A lockfile's advisories, or why they couldn't be had.
+export type Audit = AdvisoryRow[] | RiskFailure
+
+export interface AuditSource {
+  // npm's registry's advisories of these packages' versions, asked at once.
+  advisories(packages: { name: string; versions: string[] }[], signal: AbortSignal): Promise<Advisory[]>
+  // Where audits are kept beyond this instance, by the lockfile's blob.
+  audits?: KeptStore<Audit>
+}
+
+// How long a lockfile's advisories that couldn't be had are told so, rather
+// than asked again: a scan's next parts don't wait on an audit that failed,
+// as by timing out, again and again.
+const AUDIT_FAILED_KEPT_MS = 10 * 60_000
+
+// Whether an audit kept `at` is told as it is: its advisories within
+// RISK_KEPT_MS, why they couldn't be had within AUDIT_FAILED_KEPT_MS.
+const isFresh = ({ at, audit }: { at: number; audit: Audit }) => Date.now() - at < (Array.isArray(audit) ? RISK_KEPT_MS : AUDIT_FAILED_KEPT_MS)
+
+// The audits of lockfiles, each of its `packages` by its `key` (auditLockfile),
+// `inTurn` with others, asked at once: each null where it has none to ask
+// of, or once `signal` aborts. Each is the caller's to tell once it may.
+export function auditLockfiles(source: AuditSource, memory: Lru<{ at: number; audit: Audit }>, signal: AbortSignal,
+  lockfiles: { key: string; packages: readonly LockedPackage[] | null }[], inTurn: <T>(work: () => Promise<T>) => Promise<T>): Promise<Audit | null>[] {
+  return lockfiles.map(({ key, packages }) => {
+    const audit = packages ? inTurn(() => (signal.aborted ? Promise.resolve(null) : auditLockfile(source, memory, signal, key, packages))) : Promise.resolve(null)
+    // One no longer waited on, as the scan stopped, fails alone.
+    audit.catch(() => {})
+    return audit
+  })
+}
+
+// The audit of a lockfile's `packages`, by its `key` as kept (`memory`, then
+// the source's), else asked and kept; null where it locks none to ask of, or
+// once `signal` aborts.
+export async function auditLockfile(source: AuditSource, memory: Lru<{ at: number; audit: Audit }>, signal: AbortSignal, key: string,
+  packages: readonly LockedPackage[]): Promise<Audit | null> {
+  let kept = memory.get(key)
+  if (!kept || !isFresh(kept)) {
+    const stored = await source.audits?.read(key)
+    kept = stored ? { at: stored.at, audit: stored.value } : undefined
+  }
+  if (kept && isFresh(kept)) { memory.set(key, kept); return kept.audit }
+  const asked = new Map<string, Set<string>>()
+  for (const { name, version, source: from } of packages) {
+    if ((from !== 'registry' && from !== 'mirror') || !isNpmPackageName(name) || !isExactVersion(version)) continue
+    if (!asked.has(name)) asked.set(name, new Set())
+    asked.get(name)!.add(version)
+  }
+  if (asked.size === 0) return null
+  let audit: Audit
+  try {
+    audit = (await source.advisories([...asked].map(([name, versions]) => ({ name, versions: [...versions] })), signal))
+      .map(advisory => ({ ...advisory, malware: npmMalwareAdvisory(advisory) }))
+  } catch (error) {
+    if (signal.aborted) return null
+    audit = failureOf(error)
+  }
+  const now = Date.now()
+  memory.set(key, { at: now, audit })
+  await source.audits?.write(key, audit, now)
+  return audit
+}