@preventive/triage 1.0.0-alpha.50 → 1.0.0-alpha.52

package/server-managed/listed-activity.ts

@@ -0,0 +1,39 @@
+// A period's pull requests and issues, as the Pulse shows them
+// (repository-pulse.ts repositoryActivity), told of those the repository's
+// tabs keep (repository-pulls.ts readList) rather than searched for.
+import { LISTED, type PulseNarrowing, pulseSince } from './repository-pulse.ts'
+import type { KeptIssue, KeptPull } from './repository-pulls.ts'
+
+const DAY_MS = 24 * 60 * 60_000
+const WEEK_MS = 7 * DAY_MS
+
+// What repositoryActivity tells, of the pull requests and issues kept
+// (repository-pulls.ts readList: `pulls` and `issues`, those updated since
+// the period before it started all read): each counted by the day (UTC), as
+// a search counts it, its narrowing's `authors` by login whatever its case,
+// an app's bot (`name[bot]`) its own, not a user's of its name, and the
+// latest of each listed, as many
+// as LISTED, those merged or closed the latest of all.
+export function listedActivity(pulls: KeptPull[], issues: KeptIssue[], weeks: number, now: number = Date.now(), narrowing: PulseNarrowing | null = null) {
+  const since = pulseSince(weeks, now)
+  const back = weeks * WEEK_MS
+  const dayOf = (at: number) => Math.floor(at / DAY_MS) * DAY_MS
+  const [from, to] = [dayOf(narrowing?.from ?? since), narrowing?.to == null ? Number.POSITIVE_INFINITY : dayOf(narrowing.to) + DAY_MS]
+  const [before, beforeEnd] = [dayOf(since - back), dayOf(now - back) + DAY_MS]
+  // A login whatever its case, a bot's (`name[bot]`, as REST names it) apart from a user's of its name.
+  const loginOf = (login: string, bot = false) => `${login.toLowerCase().replace(/\[bot\]$/u, '')}${bot || /\[bot\]$/iu.test(login) ? '[bot]' : ''}`
+  const authors = new Set((narrowing?.authors ?? []).map(login => loginOf(login)))
+  const by = (row: KeptPull | KeptIssue) => authors.size === 0 || (row.author !== null && authors.has(loginOf(row.author, row.bot)))
+  const told = <T extends KeptPull | KeptIssue>(rows: T[], when: (row: T) => number | null, item: (row: T, at: number) => object) => {
+    const timed = rows.flatMap(row => { const at = when(row); return at !== null && by(row) ? [{ row, at }] : [] })
+    const within = timed.filter(({ at }) => at >= from && at < to)
+    return { count: within.length, previous: timed.filter(({ at }) => at >= before && at < beforeEnd).length,
+      items: within.toSorted((a, b) => b.at - a.at).slice(0, LISTED).map(({ row, at }) => item(row, at)) }
+  }
+  const common = (row: KeptPull | KeptIssue, at: number) => ({ number: row.number, title: row.title, author: row.author, authorId: row.authorId ?? null, at,
+    createdAt: row.createdAt })
+  const pull = (row: KeptPull, at: number) => ({ ...common(row, at), kind: 'pulls', state: row.state, draft: row.draft })
+  const issue = (row: KeptIssue, at: number) => ({ ...common(row, at), kind: 'issues', state: row.state, reason: row.reason })
+  return { since, previousSince: since - back, merged: told(pulls, row => row.merged?.at ?? null, pull), opened: told(pulls, row => row.createdAt, pull),
+    closed: told(issues, row => row.state === 'closed' ? row.closedAt : null, issue), created: told(issues, row => row.createdAt, issue) }
+}

package/server-managed/locked-packages.ts

@@ -26,9 +26,13 @@ export interface LockedPackage {
   integrity?: string
   // Where its reviews ask: the sha1 Yarn 1 writes after a tarball's `#`, in
   // hex (`shasum`); the hash of the patch pnpm applies to it
-  // (`patchHash`, its patchedDependencies'); and the lockfile's format.
+  // (`patchHash`, its patchedDependencies'), and the patch's file, where the
+  // lockfile names one (`patchPath`, pnpm 9's and 10's): from the lockfile's
+  // directory as read, from the repository's root once that is known
+  // (patchedIn); and the lockfile's format.
   shasum?: string
   patchHash?: string
+  patchPath?: string
   lockfile?: ReviewedLockfile
   // Where only the importers' devDependencies reach it, as npm's `dev` flag
   // says, and an install of no devDependencies leaves it out: in npm's and
@@ -43,15 +47,19 @@ type Resolution =
   | { type: 'tarball'; tarball: string | undefined; integrity: string | undefined; sha1?: string | undefined; gitHosted?: boolean }
   | { type: 'git'; repo: string }
   | { type: 'directory' }
-interface ReadPackage { name: string; version: string | undefined; resolution: Resolution | undefined; dev?: boolean | undefined; patchHash?: string | undefined }
+interface ReadPackage { name: string; version: string | undefined; resolution: Resolution | undefined; dev?: boolean | undefined; patchHash?: string | undefined
+  patchPath?: string | undefined }
 
-// The packages of a lockfile of `format`, as its reader resolves them.
+// The packages of a lockfile of `format`, as its reader resolves them, a
+// patched one of pnpm's with its patch's file where the lockfile names it.
 // Versions go unchecked against ranges, as only what is locked is asked for.
 function packagesOf(format: LockfileFormat, text: string): ReadPackage[] {
   if (format === 'npm') return Object.values(parseNpmLockfile(text, { checkVersions: false }).packages)
   if (format === 'pnpm') {
     const { lockfile, env } = parsePnpmLockfile(text)
+    const files = new Map(Object.values(lockfile?.patchedDependencies ?? {}).flatMap(({ hash, path }) => path ? [[hash, path] as const] : []))
     return [...Object.values(env?.packages ?? {}), ...Object.values(lockfile?.packages ?? {})]
+      .map(pkg => pkg.patchHash !== undefined && files.has(pkg.patchHash) ? { ...pkg, patchPath: files.get(pkg.patchHash) } : pkg)
   }
   if (format !== 'yarn') throw new TypeError(`lockedPackages: ${format} lockfiles are not read`)
   // Yarn 2 and later write another format, which only the text tells apart.
@@ -88,12 +96,13 @@ function located({ name, version, resolution }: ReadPackage, review: boolean): L
   return integrity ? { ...at, ...shown(url), source: 'mirror', integrity } : { ...at, ...shown(url), source: 'tarball' }
 }
 // As above, and with what its reviews ask (LockedPackage `shasum`,
-// `patchHash`, `lockfile`) where `review`.
+// `patchHash`, `patchPath`, `lockfile`) where `review`.
 function locked(pkg: ReadPackage, format: LockfileFormat, review: boolean): LockedPackage | null {
   const one = located(pkg, review)
   if (!one || !review) return one
   const sha1 = pkg.resolution?.type === 'tarball' ? pkg.resolution.sha1 : undefined
-  return { ...one, ...sha1 ? { shasum: sha1 } : {}, ...pkg.patchHash ? { patchHash: pkg.patchHash } : {}, lockfile: format === 'yarn' ? 'yarn1' : format as ReviewedLockfile }
+  return { ...one, ...sha1 ? { shasum: sha1 } : {}, ...pkg.patchHash ? { patchHash: pkg.patchHash, ...pkg.patchPath ? { patchPath: pkg.patchPath } : {} } : {},
+    lockfile: format === 'yarn' ? 'yarn1' : format as ReviewedLockfile }
 }
 
 // The packages a lockfile of `format` (npm, pnpm or yarn, as
@@ -117,6 +126,20 @@ export function lockedPackages(format: LockfileFormat, text: string, { review =
   return [...found.values()]
 }
 
+// `pkg` as a lockfile at `path` locks it, read with its patch's file from
+// the lockfile's directory (LockedPackage `patchPath`): that file from the
+// repository's root, none where it names one outside it.
+export function patchedIn<T extends LockedPackage>(path: string, pkg: T): T {
+  if (pkg.patchPath === undefined) return pkg
+  const { patchPath, ...rest } = pkg
+  const parts = path.split('/').slice(0, -1)
+  for (const part of patchPath.split('/')) {
+    if (part === '..') { if (parts.pop() === undefined) return rest as T }
+    else if (part !== '.' && part !== '') parts.push(part)
+  }
+  return parts.length > 0 ? { ...rest, patchPath: parts.join('/') } as T : rest as T
+}
+
 // Whether a lockfile at `path` is a test's fixture or example: under a
 // directory of tests (`test`, `tests`, `__tests__` and such), in one of
 // fixtures or examples (`fixture`, `fixtures`, `example`, `examples`) inside

package/server-managed/npm-kept.ts

@@ -153,6 +153,10 @@ export const scanReadStore = <T>(db: UpstreamCacheStore, type: 'listings' | 'loc
 export const REPOSITORY_READ_KEPT_MS = 24 * 60 * 60_000
 export const repositoryReadStore = (db: UpstreamCacheStore, debug = false): KeptStore<object> =>
   keptStore<object>(db, 'repository/reads', REPOSITORY_READ_KEPT_MS, debug)
+// GitHub's answers to GETs that came with an ETag (github-requests.ts
+// taggedRead), by their request's key, for any instance to ask again
+// If-None-Match, kept as long as what was read of a repository is.
+export const githubTagStore = <T>(db: UpstreamCacheStore, debug = false): KeptStore<T> => keptStore<T>(db, 'github/tags', REPOSITORY_READ_KEPT_MS, debug)
 // Pages of a repository's history (repository-history.ts historyFrom), by its
 // id and the commit each starts at, which never change: kept a month after
 // they were last read from GitHub.
@@ -169,6 +173,16 @@ export const commitPullStore = <T>(db: UpstreamCacheStore, debug = false): KeptS
 // Pulse and the Agents tab read them (repository-pulls.ts readPulls), by its
 // id: kept as its history's pages are, those updated since read on.
 export const pullListStore = <T>(db: UpstreamCacheStore, debug = false): KeptStore<T> => keptStore<T>(db, 'repository/pulls', HISTORY_PAGE_KEPT_MS, debug)
+// A branch's tip, by its repository and commit, as the Agents tab looks it
+// up (repository-agents.ts agentBranches), and the commits the app agents'
+// accounts authored from a head, by it (authoredCommits): kept as the
+// history is, neither changing.
+export const branchTipStore = <T>(db: UpstreamCacheStore, debug = false): KeptStore<T> => keptStore<T>(db, 'repository/branch-tips', HISTORY_PAGE_KEPT_MS, debug)
+export const authoredCommitStore = <T>(db: UpstreamCacheStore, debug = false): KeptStore<T> => keptStore<T>(db, 'repository/agents-authored', HISTORY_PAGE_KEPT_MS, debug)
+// A repository's issues, the most recently updated first, as the Pulse and
+// the Agents tab read them (repository-pulls.ts readIssues): kept as its
+// pull requests are.
+export const issueListStore = <T>(db: UpstreamCacheStore, debug = false): KeptStore<T> => keptStore<T>(db, 'repository/issues-list', HISTORY_PAGE_KEPT_MS, debug)
 // The files each of a repository's commits changes (repository-changes.ts
 // repositoryChanges), by the commit, which never change: kept as its
 // history's pages are.
@@ -180,10 +194,10 @@ export const historyTreeStore = <T>(db: UpstreamCacheStore, debug = false): Kept
 // What the code viewer read of a repository's trees (http.ts
 // repositoryTreesOf), which never changes once a commit or tree names it: the
 // tree at a directory of a commit, by the repository's id, the commit and the
-// directory (`trees`), and how many files a tree holds and their bytes, by
-// the repository's id and the tree's (`tree-files`): kept as its history's
-// pages are.
-export const codeTreeStore = <T>(db: UpstreamCacheStore, type: 'trees' | 'tree-files', debug = false): KeptStore<T> =>
+// directory (`trees`), how many files a tree holds and their bytes, by
+// the repository's id and the tree's (`tree-files`), and a directory's
+// listing at a commit, by them (`listings`): kept as its history's pages are.
+export const codeTreeStore = <T>(db: UpstreamCacheStore, type: 'trees' | 'tree-files' | 'listings', debug = false): KeptStore<T> =>
   keptStore<T>(db, `repository/code-${type}`, HISTORY_PAGE_KEPT_MS, debug)
 // The commit the code viewer keeps a repository's directories at in byte
 // storage, its default branch's head as last read, and the repository's

package/server-managed/npm-patch.ts

@@ -0,0 +1,325 @@
+// A pnpm patch of an npm package version (patchedDependencies), as its
+// dependency review reads it (pull-dependency-reviews.ts): its file, which a
+// lockfile names (locked-packages.ts `patchPath`), read of a repository at a
+// commit, and held to the hash the lockfile names it by, as pnpm hashes it,
+// a sha256 in hex from pnpm 10 and an md5 in base32 before, of its text with
+// its CRLFs read as LFs; and applied to the version's files as pnpm applies
+// it as it installs it (patch-package's applyPatch, which pnpm 9, 10 and 11
+// bundle): each file it deletes, creates, renames or changes, a change's
+// hunks each found in the file as it was, where its header says, else as
+// many as FUZZ lines either side, its lines the same but for the space they
+// end in, and those it keeps kept as the file has them. A patch of a file's
+// bytes (git's binary patch), or of a file outside the package, isn't read,
+// and one that doesn't apply fails as a whole; what a patch changes of a
+// file's mode is left out, as the files it reads have none.
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { createClient } from '@preventive/upstream/github.js'
+import { isPatchHash, isPatchPath } from '../common/managed/npm-packages.js'
+import { GithubApiError } from './github-app.ts'
+import { upstreamGithub } from './github-errors.ts'
+import { type Lru, lru } from './lru.ts'
+import { NpmPackageError, type NpmPackageFile, npmFileText } from './npm-packages.ts'
+import type { GithubAsked } from './pull-dependencies.ts'
+
+// Where a patch is read: its file in a repository (by its id) at a commit,
+// from the repository's root; and the patch, by its hash besides.
+export interface PatchSource { repoId: number; commit: string; path: string }
+export interface NpmPatch extends PatchSource { hash: string }
+
+// The most a patch's file may hold, and how many lines either side of where a
+// hunk says its lines are they are looked for.
+export const MAX_PATCH_BYTES = 8 * 1024 * 1024
+const FUZZ = 20
+
+const COMMIT = /^[\da-f]{40}$/u
+
+// The patch a request names, by its hash (`hash`), its repository's id
+// (`repoId`, a number or its digits), the commit and its file's path; null
+// where it names none of where it is, and 'invalid' where it names one
+// otherwise.
+export function requestedPatch({ hash, repoId, commit, path }: { hash: unknown; repoId: unknown; commit: unknown; path: unknown }): NpmPatch | null | 'invalid' {
+  if ([repoId, commit, path].every(field => field == null)) return null
+  const id = typeof repoId === 'string' && /^[1-9]\d{0,15}$/u.test(repoId) ? Number(repoId) : repoId
+  if (!isPatchHash(hash) || !Number.isSafeInteger(id) || (id as number) <= 0 || typeof commit !== 'string' || !COMMIT.test(commit)
+    || !isPatchPath(path)) return 'invalid'
+  return { hash, repoId: id as number, commit, path }
+}
+
+// RFC 4648's base32 of `bytes`, in lowercase and unpadded, as pnpm 9 spells
+// an md5.
+const BASE32 = 'abcdefghijklmnopqrstuvwxyz234567'
+function base32(bytes: Uint8Array) {
+  let bits = 0, spelled = '', value = 0
+  for (const byte of bytes) {
+    value = ((value << 8) | byte) & 0xfff
+    bits += 8
+    for (; bits >= 5; bits -= 5) spelled += BASE32[(value >>> (bits - 5)) & 31]
+  }
+  return bits > 0 ? spelled + BASE32[(value << (5 - bits)) & 31] : spelled
+}
+
+// Whether `text` is the patch `hash` names: of its text with its CRLFs as
+// LFs, as pnpm reads it, or as it is.
+export function isPatchOf(text: string, hash: string): boolean {
+  return [...new Set([text.replaceAll('\r\n', '\n'), text])].some(read => hash.length === 64
+    ? createHash('sha256').update(read).digest('hex') === hash : base32(createHash('md5').update(read).digest()) === hash)
+}
+
+// A change a patch makes to a file at `path` of the package: deleting it,
+// creating it, renaming it from another (`from`), and its hunks, as
+// patch-package reads them: where its header says its lines are (`at`, the
+// first's index, as it reads `-0`, the first line), how many it finds
+// (`length`), and its lines, each without its LF, in runs of a kind
+// (`parts`): those it keeps, removes or adds, the last of a side told where
+// the file has no LF after it (`unended`).
+export interface HunkPart { kind: 'context' | 'deletion' | 'insertion'; lines: string[]; unended?: true }
+export interface PatchHunk { at: number; length: number; parts: HunkPart[] }
+export interface PatchedFile { path: string; from?: string; deleted?: true; created?: true; hunks: PatchHunk[] }
+
+const unreadable = () => new NpmPackageError(422, 'patch-unreadable')
+
+// A path as git writes it, unquoted where quoted (as C writes a string, its
+// bytes past ASCII in octal); null where it is quoted otherwise.
+const ESCAPES: Record<string, number> = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13, '"': 34, '\\': 92 }
+function unquoted(path: string): string | null {
+  if (!path.startsWith('"')) return path
+  const bytes: number[] = []
+  for (let at = 1; at < path.length; at++) {
+    const char = path[at]!
+    if (char === '"') return at === path.length - 1 ? new TextDecoder().decode(Uint8Array.from(bytes)) : null
+    if (char !== '\\') { bytes.push(...Buffer.from(char)); continue }
+    const next = path[++at] ?? ''
+    const octal = /^[0-3][0-7]{2}/u.exec(path.slice(at))?.[0]
+    if (octal) { bytes.push(Number.parseInt(octal, 8)); at += 2 }
+    else if (next in ESCAPES) bytes.push(ESCAPES[next]!)
+    else return null
+  }
+  return null
+}
+
+// A side's path in the package, as a `---` or `+++` line names it after its
+// prefix (`a/` or `b/`), git's tab after one with a space in it left out;
+// null for none (`/dev/null`).
+function sidePath(named: string, prefix: string): string | null {
+  const path = unquoted(named.endsWith('\t') ? named.slice(0, -1) : named)
+  if (path === '/dev/null') return null
+  if (path === null || !path.startsWith(prefix)) throw unreadable()
+  return path.slice(prefix.length)
+}
+
+// The paths a `diff --git` line names, where they are the same, as git
+// writes them for a file neither renamed nor copied: `a/<path> b/<path>`.
+function gitPath(named: string): string | null {
+  if (named.startsWith('"')) {
+    const quoted = /^("(?:[^"\\]|\\.)*") ("(?:[^"\\]|\\.)*")$/u.exec(named)
+    const [a, b] = quoted ? [unquoted(quoted[1]!), unquoted(quoted[2]!)] : []
+    return a?.startsWith('a/') && b?.startsWith('b/') && a.slice(2) === b.slice(2) ? a.slice(2) : null
+  }
+  const length = (named.length - 5) / 2
+  const path = named.slice(2, 2 + length)
+  return Number.isInteger(length) && named.startsWith('a/') && named.slice(2 + length) === ` b/${path}` ? path : null
+}
+
+// The hunk whose `@@` line is at `at` of `lines`, those before `end` read,
+// and the line after it, as patch-package reads it: a line of its own
+// kind, else of those it keeps where it is empty, or a CR alone.
+function readHunk(lines: string[], at: number, end: number): { hunk: PatchHunk; next: number } {
+  const range = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/u.exec(lines[at++]!)
+  if (!range) throw unreadable()
+  let news = Number(range[4] ?? 1), olds = Number(range[2] ?? 1)
+  const hunk: PatchHunk = { at: Math.max(Number(range[1]), 1) - 1, length: olds, parts: [] }
+  while (olds > 0 || news > 0) {
+    // A line its count reads past those read isn't one.
+    if (at >= end) throw unreadable()
+    const line = lines[at++]!
+    const kind = line === '' || line === '\r' || line[0] === ' ' ? 'context' : line[0] === '-' ? 'deletion' : line[0] === '+' ? 'insertion' : null
+    if (!kind) throw unreadable()
+    const last = hunk.parts.at(-1)
+    const part = last?.kind === kind ? last : hunk.parts[hunk.parts.push({ kind, lines: [] }) - 1]!
+    part.lines.push(line.slice(1))
+    if (kind !== 'insertion') olds--
+    if (kind !== 'deletion') news--
+    if (olds < 0 || news < 0) throw unreadable()
+    // The line before it the last of its side, with no LF after it.
+    if (lines[at]?.startsWith('\\')) {
+      if (!lines[at++]!.startsWith('\')) throw unreadable()
+      part.unended = true
+    }
+  }
+  return { hunk, next: at }
+}
+
+// A patch's files as git's diff writes them, as pnpm writes a patch: a file's
+// `diff --git` line, its headers, the paths its sides have, and its hunks;
+// what comes before the first file, or between one file and the next, left
+// out. One whose own lines end in CRLFs, as an editor or git's autocrlf
+// leaves one, is read as patch-package reads it: its headers but their CRs,
+// its hunks' lines with them. Throws for one it can't read, or of bytes.
+export function parsePatch(patch: string): PatchedFile[] {
+  const lines = patch.split('\n')
+  // The lines read: those but the empty one past the patch's last ending.
+  const end = lines.length - (patch.endsWith('\n') ? 1 : 0)
+  // A header's line but its CR.
+  const headerAt = (at: number) => lines[at]?.replace(/\r$/u, '') ?? ''
+  const files: PatchedFile[] = []
+  for (let at = 0; at < lines.length;) {
+    const head = headerAt(at++)
+    if (!head.startsWith('diff --git ')) continue
+    let created = false, deleted = false, from: string | null = null, to: string | null = null
+    let sides: [string | null, string | null] | null = null
+    for (; at < lines.length && !/^(?:diff --git |@@ |--- )/u.test(lines[at]!); at++) {
+      const header = headerAt(at)
+      if (header === 'GIT binary patch' || header.startsWith('Binary files ')) throw new NpmPackageError(422, 'patch-unsupported')
+      if (header.startsWith('copy from ') || header.startsWith('copy to ')) throw new NpmPackageError(422, 'patch-unsupported')
+      if (header.startsWith('deleted file mode ')) deleted = true
+      else if (header.startsWith('new file mode ')) created = true
+      else if (header.startsWith('rename from ')) from = unquoted(header.slice('rename from '.length))
+      else if (header.startsWith('rename to ')) to = unquoted(header.slice('rename to '.length))
+    }
+    if (lines[at]?.startsWith('--- ')) {
+      if (!lines[at + 1]?.startsWith('+++ ')) throw unreadable()
+      sides = [sidePath(headerAt(at).slice(4), 'a/'), sidePath(headerAt(at + 1).slice(4), 'b/')]
+      at += 2
+    }
+    const named = gitPath(head.slice('diff --git '.length))
+    const after = to ?? (sides ? sides[1] : named), before = from ?? (sides ? sides[0] : named)
+    if ((from === null) !== (to === null) || (deleted && created)) throw unreadable()
+    const path = deleted ? before : after
+    if (path == null || (!created && before == null) || (!deleted && after == null) || ![before, after].every(side => side == null || isPatchPath(side))
+      || (from === null && !deleted && !created && before !== after)) throw unreadable()
+    const hunks: PatchHunk[] = []
+    while (lines[at]?.startsWith('@@ ')) {
+      const { hunk, next } = readHunk(lines, at, end)
+      hunks.push(hunk)
+      at = next
+    }
+    files.push({ path, ...from !== null && to !== null ? { from: before! } : {}, ...deleted ? { deleted: true as const } : {},
+      ...created ? { created: true as const } : {}, hunks: deleted ? [] : hunks })
+  }
+  return files
+}
+
+const doesNotApply = () => new NpmPackageError(422, 'patch-does-not-apply')
+
+// A change a hunk makes to a file's lines (`lines`, split at its LFs): those
+// at `splice` that it removes (`remove`) and adds in their place (`insert`),
+// or an empty last line it adds or removes, its LF after the last.
+type LineChange = { splice: number; remove: number; insert: string[] } | 'push' | 'pop'
+
+// The changes `hunk` makes where its lines are at `at` of `lines`, as
+// patch-package works them out (evaluateHunk): those it finds the same but
+// for the space they end in, as it compares them; else null.
+function changesAt(hunk: PatchHunk, lines: string[], at: number): LineChange[] | null {
+  if (at < 0 || lines.length - at < hunk.length) return null
+  const changes: LineChange[] = []
+  for (const part of hunk.parts) {
+    if (part.kind === 'insertion') {
+      changes.push({ splice: at, remove: 0, insert: part.lines })
+      if (part.unended) changes.push('pop')
+      continue
+    }
+    for (const line of part.lines) if (lines[at++]!.trimEnd() !== line.trimEnd()) return null
+    if (part.kind === 'deletion') {
+      changes.push({ splice: at - part.lines.length, remove: part.lines.length, insert: [] })
+      if (part.unended) changes.push('push')
+    }
+  }
+  return changes
+}
+
+// `text` with `hunks` applied as patch-package applies them (applyPatch):
+// each one's lines found in the text as it was, where its header says, else
+// as near as FUZZ lines either side, the nearer first, and the earlier of
+// two as near; then its changes made in turn, past the lines those before
+// added or removed.
+function applied(text: string, hunks: PatchHunk[]): string {
+  const lines = text.split('\n')
+  const changes = hunks.flatMap(hunk => {
+    for (let offset = 0; Math.abs(offset) <= FUZZ; offset = offset < 0 ? -offset : -offset - 1) {
+      const found = changesAt(hunk, lines, hunk.at + offset)
+      if (found) return found
+    }
+    throw doesNotApply()
+  })
+  let shift = 0
+  for (const change of changes) {
+    if (change === 'push') lines.push('')
+    else if (change === 'pop') lines.pop()
+    else {
+      lines.splice(change.splice + shift, change.remove, ...change.insert)
+      shift += change.insert.length - change.remove
+    }
+  }
+  return lines.join('\n')
+}
+
+// A version's `files` with `patch` applied, in the order of their paths, as
+// its tarball's are read; a file it changes the text of must be text. One it
+// creates holds its first hunk's first lines, in place of any there, as
+// patch-package writes it.
+export function patchedFiles(files: NpmPackageFile[], patch: PatchedFile[]): NpmPackageFile[] {
+  const byPath = new Map(files.map(file => [file.path, file.bytes]))
+  const encoder = new TextEncoder()
+  for (const file of patch) {
+    if (file.created) {
+      const first = file.hunks[0]?.parts[0]
+      byPath.set(file.path, encoder.encode(first ? `${first.lines.join('\n')}${first.unended ? '' : '\n'}` : ''))
+      continue
+    }
+    const source = file.from ?? file.path
+    const bytes = byPath.get(source)
+    if (!bytes) throw doesNotApply()
+    if (file.deleted) { byPath.delete(source); continue }
+    let next = bytes
+    if (file.hunks.length > 0) {
+      const text = npmFileText(bytes)
+      if (text === null) throw doesNotApply()
+      next = encoder.encode(applied(text, file.hunks))
+    }
+    if (file.from !== undefined) {
+      if (byPath.has(file.path)) throw doesNotApply()
+      byPath.delete(source)
+    }
+    byPath.set(file.path, next)
+  }
+  return [...byPath].map(([path, bytes]) => ({ path, bytes })).toSorted((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)
+}
+
+// About the bytes a patch read takes: the characters of its paths and of the
+// lines its hunks hold, and the room past them each line takes (LINE_COST)
+// and each file, hunk and part (HUNK_COST), as V8 takes it; so a patch of a
+// few long lines (a minified file's) weighs about its size, and one of many
+// short lines or tiny hunks many times it, as it takes.
+const HUNK_COST = 256, LINE_COST = 40
+const held = (lines: string[]) => lines.reduce((sum, line) => sum + LINE_COST + line.length, HUNK_COST)
+export const patchWeight = (files: PatchedFile[]) => files.reduce((sum, file) => sum + HUNK_COST + file.path.length + (file.from?.length ?? 0)
+  + file.hunks.reduce((bytes, hunk) => bytes + HUNK_COST + hunk.parts.reduce((parts, part) => parts + held(part.lines), 0), 0), 1)
+
+// Patches read lately, by their source and hash, as what a commit holds never
+// changes: as many as MAX_KEPT_PATCHES of the bytes they take (patchWeight).
+const MAX_KEPT_PATCHES = 64 * 1024 * 1024
+const patches: Lru<PatchedFile[]> = lru(MAX_KEPT_PATCHES, patchWeight)
+
+// The patch `patch` names, read as kept, else of repository `fullName` with
+// `token`, held to its hash and read (parsePatch), and kept; `asked` told
+// where GitHub was. Its file missing there, or other than its hash says, or
+// past MAX_PATCH_BYTES, fails.
+export async function readPatch(fullName: string, token: string, patch: NpmPatch, asked?: GithubAsked): Promise<PatchedFile[]> {
+  const key = `${patch.repoId}\0${patch.commit}\0${patch.path}\0${patch.hash}`
+  const known = patches.get(key)
+  if (known) return known
+  if (asked) asked.github = true
+  let text: string
+  try {
+    text = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).getRepoFile({ repo: fullName, path: patch.path, ref: patch.commit }))
+  } catch (err) {
+    if (err instanceof GithubApiError && err.message === 'github-not-found') throw new NpmPackageError(404, 'patch-not-found')
+    throw err
+  }
+  if (Buffer.byteLength(text) > MAX_PATCH_BYTES) throw new NpmPackageError(413, 'patch-too-large')
+  if (!isPatchOf(text, patch.hash)) throw new NpmPackageError(409, 'patch-mismatch')
+  const files = parsePatch(text)
+  patches.set(key, files)
+  return files
+}

package/server-managed/pull-dependencies.ts

@@ -30,7 +30,7 @@ import { createClient } from '@preventive/upstream/github.js'
 import { GithubApiError, githubJson } from './github-app.ts'
 import { upstreamGithub } from './github-errors.ts'
 import { compareVersions, isExactVersion } from '@preventive/upstream/semver.js'
-import { type LockedPackage, isTestFixture, lockedPackages } from './locked-packages.ts'
+import { type LockedPackage, isTestFixture, lockedPackages, patchedIn } from './locked-packages.ts'
 import { type Lru, lru } from './lru.ts'
 import { type ChangedFile, commitChanges } from './repository-changes.ts'
 
@@ -50,8 +50,9 @@ export const MAX_LOCKED = 20_000
 const READ_PARALLEL = 4
 // The rules what is told was told by, kept with it (http.ts
 // pullDependencyKept), and the lockfiles read for it (lockfileKept): one
-// told or read by others is told or read again.
-export const PULL_DEPENDENCIES_READ = 3
+// told or read by others is told or read again, as those read before pnpm's
+// patches' files were.
+export const PULL_DEPENDENCIES_READ = 4
 const SHA = /^[a-f\d]{40}$/u
 
 type Format = 'npm' | 'pnpm' | 'yarn' | 'bun'
@@ -277,8 +278,9 @@ export const lockedWith = (pkg: LockedPackage) => `${lockedAs(pkg)}\0${pkg.integ
 // package versions after none before has, each once, by name and version,
 // each with the versions of its name before, those past MAX_ADDED counted
 // (`more`), not told but reviewed as they are; and every one after, each
-// integrity it is locked with (`locked`), as many as MAX_LOCKED; or the first
-// failure among them.
+// integrity it is locked with (`locked`), as many as MAX_LOCKED, each patch's
+// file from the repository's root (patchedIn); or the first failure among
+// them.
 function addedIn(paths: string[], before: LockfileRead[], after: LockfileRead[]): DirectoryDependencies {
   const failed = [...before, ...after].find(read => 'error' in read)
   if (failed && 'error' in failed) return { paths, error: failed.error, ...failed.detail ? { detail: failed.detail } : {} }
@@ -292,7 +294,8 @@ function addedIn(paths: string[], before: LockfileRead[], after: LockfileRead[])
   const added = new Map<string, AddedPackage>()
   const locked = new Map<string, LockedPackage>()
   for (const read of after) {
-    for (const pkg of 'packages' in read ? read.packages : []) {
+    for (const found of 'packages' in read ? read.packages : []) {
+      const pkg = patchedIn(paths[0]!, found)
       const key = lockedAs(pkg)
       const held = locked.get(lockedWith(pkg))
       if (!held) locked.set(lockedWith(pkg), { ...pkg })

package/server-managed/pull-dependency-reviews.ts

@@ -17,9 +17,11 @@
 // tarball (a mirror's too), or with no integrity can't be; a file of the
 // project's isn't. Its reviews are those of it, of an integrity it is locked
 // with, either whole, or compared with a version of its package: for a
-// version the pull request adds, one it was; for another, any. A patched one
-// (`patched`) passes by none of them, the app reviewing no patch yet: only
-// by the reviewed dependencies, or locked so, its patch too, at that commit.
+// version the pull request adds, one it was; for another, any. A patched
+// one's (`patch`) are of it as patched, by its patch's hash, its patch read
+// of the repository where its lockfile names the patch's file (npm-patch.ts):
+// compared with the version it patches, where that is one it was, they review
+// the patch alone. Locked so at that commit, its patch too, it needs none.
 // Which versions the repository's lockfiles locked at that commit never
 // changes: it is read once, every lockfile there of those read here
 // (pull-dependencies.ts), and kept by the commit (`baselines` in this
@@ -137,11 +139,14 @@ function stancesOf(pkg: LockedPackage, reviews: ReviewsOf, bases: string[] | 'an
 type Reviewer = { login: string; status: PublishedReview['status']; passes?: true; comment?: true }
 
 // A version as the client is told it: what its reviews are held to left
-// out, but whether it is patched.
-function shown<T extends LockedPackage>(pkg: T): Omit<T, 'integrity' | 'shasum' | 'patchHash' | 'lockfile'> & { patched?: true } {
+// out, but its patch, where it is patched (`patch`): its hash, which its
+// reviews are held to, and its file, where its lockfile names one, from the
+// repository's root, whence its reviews read it.
+type Patch = { hash: string; path?: string }
+function shown<T extends LockedPackage>(pkg: T): Omit<T, 'integrity' | 'shasum' | 'patchHash' | 'patchPath' | 'lockfile'> & { patch?: Patch } {
   const copy = { ...pkg }
-  for (const field of ['integrity', 'shasum', 'patchHash', 'lockfile'] as const) delete copy[field]
-  return { ...copy, ...pkg.patchHash ? { patched: true as const } : {} }
+  for (const field of ['integrity', 'shasum', 'patchHash', 'patchPath', 'lockfile'] as const) delete copy[field]
+  return { ...copy, ...pkg.patchHash ? { patch: { hash: pkg.patchHash, ...pkg.patchPath ? { path: pkg.patchPath } : {} } } : {} }
 }
 
 // A version as the registered reviewed dependencies are asked of it, by
@@ -204,11 +209,12 @@ function capped<T extends { toReview: unknown[]; unreviewed: unknown[]; unsuppor
 }
 // How many versions of `lists` there are, each once across them, by `key`,
 // as the client tells them once: one wanting reviews by its name and
-// version, one that can't be reviewed by where it is from too.
-type Shown = Pick<LockedPackage, 'name' | 'version' | 'source' | 'from'>
+// version, and its patch's hash, as each patch of it is reviewed apart; one
+// that can't be reviewed by where it is from too.
+type Shown = Pick<LockedPackage, 'name' | 'version' | 'source' | 'from'> & { patch?: Patch }
 const distinct = (lists: Shown[][], key: (pkg: Shown) => string) => new Set(lists.flat().map(key)).size
-const versionKey = (pkg: Shown) => `${pkg.name}@${pkg.version ?? ''}`
-const sourceKey = (pkg: Shown) => `${pkg.source}\0${versionKey(pkg)}\0${pkg.from ?? ''}`
+const versionKey = (pkg: Shown) => `${pkg.name}@${pkg.version ?? ''}\0${pkg.patch?.hash ?? ''}`
+const sourceKey = (pkg: Shown) => `${pkg.source}\0${pkg.name}@${pkg.version ?? ''}\0${pkg.from ?? ''}`
 
 // The reviews an open pull request's comments make of `wanting`, the
 // versions still wanting one (pull-comment-reviews.ts): those that count,
@@ -308,9 +314,9 @@ export async function reviewedDependencies(told: PullDependencies, state: RepoRe
 }
 
 // The package versions a pull request's lockfiles lock that its reviews here
-// may pass, whose reviews are asked: those that can be reviewed, unpatched.
+// may pass, whose reviews are asked: those that can be reviewed.
 export const reviewedPackages = (told: PullDependencies) => told.lockfiles
-  .flatMap(dir => 'error' in dir ? [] : dir.locked.filter(pkg => reviewedAs(pkg) === 'version' && !pkg.patchHash).map(pkg => ({ name: pkg.name, version: pkg.version! })))
+  .flatMap(dir => 'error' in dir ? [] : dir.locked.filter(pkg => reviewedAs(pkg) === 'version').map(pkg => ({ name: pkg.name, version: pkg.version! })))
 
 // A repository's baseline as read for a pull request: its versions and the
 // lockfiles there left unread; none where it reviews since no commit; and