@stats-forge/github-stats-forge-core 0.4.0 → 0.6.0

package/build/common/log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/common/log.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,QAAA,MAAM,MAAM,EAAE;IACZ,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CAI1C,CAAC;AAEF,OAAO,EAAE,MAAM,EAAE,CAAC"}
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/common/log.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,QAAA,MAAM,MAAM,EAAE;IACZ,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CAQ1C,CAAC;AAEF,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/build/common/log.js

@@ -1,8 +1,15 @@
 /**
- * Return console instance based on the environment.
+ * Where this package's diagnostics go.
+ *
+ * Dispatches to `console` at call time rather than import time,
+ * so a host or a test that replaces `console.log` is obeyed.
  */
 const logger = {
-    log: console.log,
-    error: console.error,
+    log: (...args) => {
+        console.log(...args);
+    },
+    error: (...args) => {
+        console.error(...args);
+    },
 };
 export { logger };

package/build/fetchers/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/fetchers/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAatD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAkDnD;;;;;;;GAOG;AACH,QAAA,MAAM,iBAAiB,YACZ;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,UAC5B,UAAU,KACjB,OAAO,CAAC,gBAAgB,CA4E1B,CAAC;AAEF,OAAO,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/fetchers/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AActD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+DnD;;;;;;;GAOG;AACH,QAAA,MAAM,iBAAiB,YACZ;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,UAC5B,UAAU,KACjB,OAAO,CAAC,gBAAgB,CAiF1B,CAAC;AAEF,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/build/fetchers/organization.js

@@ -1,6 +1,7 @@
 import { GITHUB_USERNAME_PATTERN } from '../common/constants.js';
 import { CardError, ORGANIZATION_NOT_FOUND } from '../common/error.js';
 import { createGraphQLFetcher } from '../common/http.js';
+import { logger } from '../common/log.js';
 import { retryer } from '../common/retryer.js';
 import { GetOrganizationDocument } from '../graphql/generated/organization.js';
 import { graphqlError } from './graphql-error.js';
@@ -38,6 +39,15 @@ const topLanguage = (repos) => {
     }
     return top;
 };
+/**
+ * The member count is the one field here a token can be refused:
+ * it needs the organization `Members` permission, which an app installation token rarely carries.
+ * GitHub answers `FORBIDDEN` on that field alone and still returns the organization,
+ * so the card drops the stat instead of failing whole.
+ *
+ * @returns Whether the member count is all the response was refused.
+ */
+const onlyMembersForbidden = (errors) => errors.every((error) => error.type === 'FORBIDDEN' && error.path?.at(-1) === 'membersWithRole');
 /**
  * Fetch an organization and the totals of its public repositories.
  *
@@ -61,6 +71,7 @@ const fetchOrganization = async ({ org }, config) => {
     let organization;
     let after = null;
     let pages = 0;
+    let membersForbidden = false;
     do {
         // Annotated because the walk feeds its own cursor back in, which TypeScript reads as circular.
         const res = await retryer(fetcher, { login: org, after }, config);
@@ -73,7 +84,11 @@ const fetchOrganization = async ({ org }, config) => {
                     secondaryMessage: ORGANIZATION_NOT_FOUND,
                 });
             }
-            throw graphqlError(res.data.errors, res.statusText, ORGANIZATION_ERROR);
+            if (!onlyMembersForbidden(res.data.errors)) {
+                throw graphqlError(res.data.errors, res.statusText, ORGANIZATION_ERROR);
+            }
+            logger.log(res.data.errors[0]?.message);
+            membersForbidden = true;
         }
         organization = res.data.data.organization ?? undefined;
         if (!organization) {
@@ -107,7 +122,7 @@ const fetchOrganization = async ({ org }, config) => {
                 ? target.history.totalCount
                 : 0;
         }),
-        publicMembers: organization.membersWithRole.totalCount,
+        publicMembers: membersForbidden ? null : organization.membersWithRole.totalCount,
         topLanguage: topLanguage(repos),
         truncated: after !== null,
     };

package/build/fetchers/types.d.ts

@@ -55,8 +55,9 @@ export interface OrganizationData {
     /**
      * Members GitHub shows publicly.
      * Membership is private by default, so this counts fewer people than the organization has.
+     * `null` when the token may not read them, which is the card's cue to leave the stat out.
      */
-    publicMembers: number;
+    publicMembers: number | null;
     /** The language most of those repositories name as their primary one, `null` when none do. */
     topLanguage: {
         name: string;

package/build/fetchers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/fetchers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,KAAK,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,GAAG;IAC1D,eAAe,EAAE;QACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,MAAM,WAAW,aAAa;IAE5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D,qFAAqF;IACrF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mGAAmG;IACnG,YAAY,EAAE,eAAe,GAAG,SAAS,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,KAAK,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC,EAAE,MAAM,CAAC;IAC/C,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B,EAAE,MAAM,CAAC;IACrC,qDAAqD,EAAE,MAAM,CAAC;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6CAA6C,EAAE,MAAM,CAAC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0BAA0B,EAAE,OAAO,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,KAAK,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,iBAAiB,EAAE,KAAK,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC,EAAE,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/fetchers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,KAAK,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,GAAG;IAC1D,eAAe,EAAE;QACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB,GAAG,IAAI,CAAC;CACV,CAAC;AAEF,MAAM,WAAW,aAAa;IAE5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D,qFAAqF;IACrF,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mGAAmG;IACnG,YAAY,EAAE,eAAe,GAAG,SAAS,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,MAAM,CAAC;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,KAAK,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC,EAAE,MAAM,CAAC;IAC/C,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B,EAAE,MAAM,CAAC;IACrC,qDAAqD,EAAE,MAAM,CAAC;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6CAA6C,EAAE,MAAM,CAAC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0BAA0B,EAAE,OAAO,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,KAAK,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,iBAAiB,EAAE,KAAK,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC,EAAE,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stats-forge/github-stats-forge-core",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Dynamically generate stats for your GitHub readme",
   "keywords": [
     "card-generator",

package/src/api/contributed-to.ts

@@ -44,6 +44,7 @@ const contributedToQuery = z
  */
 export const contributedTo = cardHandler(
   contributedToQuery,
+  { username: 'username' },
   async (
     {
       username,

package/src/api/gist.ts

@@ -23,6 +23,7 @@ const gistQuery = z.object({
  */
 export const gist = cardHandler(
   gistQuery,
+  { id: 'gist' },
   async (
     { id, locale, border_radius, show_owner, browser_rendering, hide_border },
     colors,

package/src/api/handler.ts

@@ -1,27 +1,40 @@
 import type * as z from 'zod/mini';
 
 import type { ColorParams } from '../common/color.ts';
-import type { CardConfig } from '../common/config.ts';
+import type { AllowlistKind, CardConfig } from '../common/config.ts';
+import { CardError } from '../common/error.ts';
 
 import type { ApiResult } from './api-result.ts';
 import { errorResult } from './api-result.ts';
 import type { ApiQuery } from './params.ts';
 import { parseColorParams, parseParams } from './params.ts';
 
+/** Which of an endpoint's params name an identity, and which list guards each. */
+type Identities<TSchema extends z.ZodMiniType> = Partial<
+  Record<Extract<keyof z.output<TSchema>, string>, AllowlistKind>
+>;
+
+/** An endpoint, and the identities a pinned deployment may refuse it. */
+type CardEndpoint<TSchema extends z.ZodMiniType> = ((
+  query: ApiQuery<TSchema>,
+  config: CardConfig,
+) => Promise<ApiResult>) & { IDENTITIES: Identities<TSchema> };
+
 /**
- * An endpoint: the schema it accepts, and what it draws from the parsed params.
+ * An endpoint: the schema it accepts, the identities a pinned deployment may refuse,
+ * and what it draws from the parsed params.
  *
  * Colors parse first and on their own, because a rejected color cannot be used to draw its own error card.
- * Parsing throws, fetching throws, and one `catch` turns whatever was thrown into the answer.
+ * Parsing throws, the allowlist throws, fetching throws, and one `catch` turns whatever was thrown into the answer.
  *
  * @returns The handler, taking the query the schema describes.
  */
-const cardHandler =
-  <TSchema extends z.ZodMiniType>(
-    schema: TSchema,
-    render: (params: z.output<TSchema>, colors: ColorParams, config: CardConfig) => Promise<string>,
-  ) =>
-  async (query: ApiQuery<TSchema>, config: CardConfig): Promise<ApiResult> => {
+const cardHandler = <TSchema extends z.ZodMiniType>(
+  schema: TSchema,
+  identities: Identities<TSchema>,
+  render: (params: z.output<TSchema>, colors: ColorParams, config: CardConfig) => Promise<string>,
+): CardEndpoint<TSchema> => {
+  const handler = async (query: ApiQuery<TSchema>, config: CardConfig): Promise<ApiResult> => {
     let colors: ColorParams;
     try {
       colors = parseColorParams(query);
@@ -30,13 +43,25 @@ const cardHandler =
     }
 
     try {
-      return {
-        status: 'success',
-        content: await render(parseParams(schema, query), colors, config),
-      };
+      const params = parseParams(schema, query);
+
+      // before the render, so a refusal costs no rate-limit point; an absent identity is the
+      // fetcher's `missing_param` to report
+      for (const [param, kind] of Object.entries(identities) as Array<[string, AllowlistKind]>) {
+        const value: unknown = (params as Record<string, unknown>)[param];
+        if (typeof value === 'string' && !config.isAllowed(value, kind)) {
+          throw CardError.notAllowed(param);
+        }
+      }
+
+      return { status: 'success', content: await render(params, colors, config) };
     } catch (error) {
       return errorResult(error, colors);
     }
   };
 
+  // carried like `OPTIONS`, so `tests/allowlist.test.ts` can assert every card declares one
+  return Object.assign(handler, { IDENTITIES: identities });
+};
+
 export { cardHandler };

package/src/api/organization.ts

@@ -40,6 +40,7 @@ const orgQuery = z.object({
  */
 const renderOrg = cardHandler(
   orgQuery,
+  { org: 'username' },
   async (
     {
       org,

package/src/api/params.ts

@@ -1,13 +1,3 @@
-import * as z from 'zod/mini';
-
-import type { ColorParams } from '../common/color.ts';
-import { COLOR_PARAM_KEYS, THEME_PARAM_KEYS, isValidColorInput } from '../common/color.ts';
-import { GITHUB_USERNAME_PATTERN } from '../common/constants.ts';
-import { getWidestRange, parseRangeDate } from '../common/date.ts';
-import { CardError } from '../common/error.ts';
-import { isLocaleAvailable } from '../common/localize.ts';
-import { parseArray, parseBoolean } from '../common/ops.ts';
-
 /**
  * @file The api layer is the trust boundary:
  * a query string arrives as strings, and each endpoint declares what it accepts as a schema over them.
@@ -18,6 +8,16 @@ import { parseArray, parseBoolean } from '../common/ops.ts';
  * this package ships to the browser, and the functional API tree-shakes down to the checks used below.
  */
 
+import * as z from 'zod/mini';
+
+import type { ColorParams } from '../common/color.ts';
+import { COLOR_PARAM_KEYS, THEME_PARAM_KEYS, isValidColorInput } from '../common/color.ts';
+import { GITHUB_USERNAME_PATTERN } from '../common/constants.ts';
+import { getWidestRange, parseRangeDate } from '../common/date.ts';
+import { CardError } from '../common/error.ts';
+import { isLocaleAvailable } from '../common/localize.ts';
+import { parseArray, parseBoolean } from '../common/ops.ts';
+
 /** Every param arrives as a string, or not at all. */
 const rawParam = z.optional(z.string());
 

package/src/api/pin.ts

@@ -40,6 +40,7 @@ const pinQuery = z.object({
  */
 const renderPin = cardHandler(
   pinQuery,
+  { username: 'username' },
   async (
     {
       username,

package/src/api/stats.ts

@@ -58,6 +58,7 @@ const statsQuery = z
  */
 const renderStats = cardHandler(
   statsQuery,
+  { username: 'username' },
   async (
     {
       username,

package/src/api/top-langs.ts

@@ -45,6 +45,7 @@ const topLangsQuery = z.object({
  */
 const renderTopLangs = cardHandler(
   topLangsQuery,
+  { username: 'username' },
   async (
     {
       username,

package/src/api/wakatime.ts

@@ -43,6 +43,8 @@ const wakatimeQuery = z.object({
  */
 const renderWakatime = cardHandler(
   wakatimeQuery,
+  // no allowlist: `username` is a WakaTime profile, not a GitHub login (see `apps/server/README.md`)
+  {},
   async (
     {
       username,

package/src/cards/organization/index.ts

@@ -211,7 +211,8 @@ const renderCard = (
     };
   }
 
-  if (shows('members')) {
+  // A refused member count is `null`, and no row is better than a row reading "0".
+  if (shows('members') && publicMembers !== null) {
     STATS['members'] = {
       icon: icons.people,
       label: t.members(),

package/src/common/config.ts

@@ -3,6 +3,9 @@ import type { FetchLike } from './http.ts';
 
 type Env = Record<string, string | undefined>;
 
+/** Which list guards an identity. `username` is any GitHub login, an organization's included. */
+type AllowlistKind = 'username' | 'gist';
+
 interface PersonalAccessToken {
   /** Env variable the token came from — the retryer logs this name, never the value. */
   name: string;
@@ -20,10 +23,15 @@ interface CardConfigInit {
 }
 
 /**
- * @returns Parsed string values.
+ * @returns The comma-separated values, trimmed, or `undefined` when the variable is unset or empty.
  */
-const parseCsv = (value: string | undefined): Array<string> | undefined =>
-  value ? value.split(',') : undefined;
+const parseCsv = (value: string | undefined): Array<string> | undefined => {
+  const values = (value ?? '')
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter((entry) => entry !== '');
+  return values.length > 0 ? values : undefined;
+};
 
 /**
  * @returns Page limit: `"true"` means every page, a positive number caps the pages, anything else means one.
@@ -37,12 +45,15 @@ const parseFetchMultiPageStars = (value: string | undefined): number => {
 };
 
 /**
+ * An empty variable is an unset one: `docker compose` writes `PAT_2=` for a token left blank.
+ *
  * @returns Personal access tokens found in the environment.
  */
 const parsePATsFromEnv = (env: Env): Array<PersonalAccessToken> =>
   Object.keys(env)
     .filter((key) => /PAT_\d*$/.exec(key))
-    .map((name) => ({ name, value: env[name] ?? '' }));
+    .map((name) => ({ name, value: env[name] ?? '' }))
+    .filter((pat) => pat.value !== '');
 
 /**
  * Deployment-wide configuration for the card renderers.
@@ -75,17 +86,22 @@ export class CardConfig {
   static fromEnv(env: Env): CardConfig {
     return new CardConfig({
       pats: parsePATsFromEnv(env),
-      usernameAllowlist: parseCsv(env['WHITELIST']),
-      gistAllowlist: parseCsv(env['GIST_WHITELIST']),
+      usernameAllowlist: parseCsv(env['ALLOWLIST']),
+      gistAllowlist: parseCsv(env['GIST_ALLOWLIST']),
       excludeRepositories: parseCsv(env['EXCLUDE_REPO']) ?? [],
       fetchMultiPageStars: parseFetchMultiPageStars(env['FETCH_MULTI_PAGE_STARS']),
     });
   }
 
-  /** @returns Whether this deployment serves the id. */
-  isAllowed(id: string, kind: 'username' | 'gist'): boolean {
+  /**
+   * Matched case-insensitively, as a GitHub login is; an absent list serves anyone.
+   *
+   * @returns Whether this deployment serves the id.
+   */
+  isAllowed(id: string, kind: AllowlistKind): boolean {
     const list = kind === 'gist' ? this.gistAllowlist : this.usernameAllowlist;
-    return list === undefined || list.includes(id);
+    const wanted = id.toLowerCase();
+    return list === undefined || list.some((allowed) => allowed.toLowerCase() === wanted);
   }
 
   /** @returns A copy with `overrides` applied — how a host swaps in a user's PAT per request. */
@@ -102,4 +118,4 @@ export class CardConfig {
   }
 }
 
-export type { PersonalAccessToken, CardConfigInit };
+export type { AllowlistKind, PersonalAccessToken, CardConfigInit };

package/src/common/error.ts

@@ -1,5 +1,3 @@
-import { OWNER_AFFILIATIONS } from './constants.ts';
-
 /**
  * @file One error type for everything a card render can fail on.
  *
@@ -10,18 +8,25 @@ import { OWNER_AFFILIATIONS } from './constants.ts';
  * so a permanent failure has to throw a `CardError` to be reported as one.
  */
 
+import { OWNER_AFFILIATIONS } from './constants.ts';
+
 /** A general message to ask user to try again later. */
 const TRY_AGAIN_LATER = 'Please try again later';
 
+/** The second line for an identity a pinned deployment does not serve. */
+const NOT_ALLOWED = 'This deployment does not serve that account';
+
 /** Why a request failed. */
 type ErrorCode =
   /** The query is wrong: a param is malformed, unsafe, or not renderable. */
   | 'invalid_param'
   /** The query is missing a param the endpoint cannot render without. */
   | 'missing_param'
+  /** The query is well-formed, but this deployment is pinned to identities it does not name. */
+  | 'not_allowed'
   /** The user, repository or gist does not exist. */
   | 'not_found'
-  /** The deployment has no usable GitHub token. */
+  /** The deployment has no usable GitHub token — retryable, the fix being a token on the next start. */
   | 'no_tokens'
   /** Every token is rate limited. */
   | 'rate_limited'
@@ -35,8 +40,9 @@ type ErrorCode =
 const RETRYABLE: Record<ErrorCode, boolean> = {
   invalid_param: false,
   missing_param: false,
+  not_allowed: false,
   not_found: false,
-  no_tokens: false,
+  no_tokens: true,
   rate_limited: true,
   upstream: true,
 };
@@ -106,6 +112,20 @@ class CardError extends Error {
     });
   }
 
+  /**
+   * An identity this deployment is not configured to draw.
+   * Names neither the value nor the list: one is the caller's, the other the operator's.
+   *
+   * @returns The error.
+   */
+  static notAllowed(param: string): CardError {
+    return new CardError('Not allowed', {
+      code: 'not_allowed',
+      secondaryMessage: NOT_ALLOWED,
+      param,
+    });
+  }
+
   /**
    * Anything thrown that is not already a `CardError`:
    * an upstream failure, since the query itself got this far.

package/src/common/http.ts

@@ -63,7 +63,12 @@ const httpRequest = async <TData>(
 /** Response of a GraphQL call: the envelope the GitHub API wraps results in. */
 type GraphQLResponse<TResult> = HttpResponse<{
   data: TResult;
-  errors?: Array<{ type?: string; message?: string }>;
+  errors?: Array<{
+    type?: string;
+    message?: string;
+    /** The field the error is about, from the operation root: `['organization', 'membersWithRole']`. */
+    path?: Array<string | number>;
+  }>;
 }>;
 
 /**

package/src/common/languageColors.json

@@ -33,6 +33,7 @@
   "Apollo Guidance Computer": "#0B3D91",
   "AppleScript": "#101F1F",
   "Arc": "#aa2afe",
+  "ArkTS": "#0080ff",
   "AsciiDoc": "#73a0c5",
   "AspectJ": "#a957b0",
   "Assembly": "#6E4C13",
@@ -322,6 +323,7 @@
   "Kotlin": "#A97BFF",
   "LFE": "#4C3023",
   "LLVM": "#185619",
+  "LLVM TableGen": "#6E8B3D",
   "LOLCODE": "#cc9900",
   "LSL": "#3d9970",
   "LabVIEW": "#fede06",

package/src/common/log.ts

@@ -1,12 +1,19 @@
 /**
- * Return console instance based on the environment.
+ * Where this package's diagnostics go.
+ *
+ * Dispatches to `console` at call time rather than import time,
+ * so a host or a test that replaces `console.log` is obeyed.
  */
 const logger: {
   log: (...args: Array<unknown>) => void;
   error: (...args: Array<unknown>) => void;
 } = {
-  log: console.log,
-  error: console.error,
+  log: (...args) => {
+    console.log(...args);
+  },
+  error: (...args) => {
+    console.error(...args);
+  },
 };
 
 export { logger };

package/src/fetchers/organization.ts

@@ -3,6 +3,7 @@ import { GITHUB_USERNAME_PATTERN } from '../common/constants.ts';
 import { CardError, ORGANIZATION_NOT_FOUND } from '../common/error.ts';
 import { createGraphQLFetcher } from '../common/http.ts';
 import type { GraphQLResponse } from '../common/http.ts';
+import { logger } from '../common/log.ts';
 import { retryer } from '../common/retryer.ts';
 import { GetOrganizationDocument } from '../graphql/generated/organization.ts';
 import type {
@@ -61,6 +62,19 @@ const topLanguage = (
   return top;
 };
 
+/**
+ * The member count is the one field here a token can be refused:
+ * it needs the organization `Members` permission, which an app installation token rarely carries.
+ * GitHub answers `FORBIDDEN` on that field alone and still returns the organization,
+ * so the card drops the stat instead of failing whole.
+ *
+ * @returns Whether the member count is all the response was refused.
+ */
+const onlyMembersForbidden = (
+  errors: NonNullable<GraphQLResponse<unknown>['data']['errors']>,
+): boolean =>
+  errors.every((error) => error.type === 'FORBIDDEN' && error.path?.at(-1) === 'membersWithRole');
+
 /**
  * Fetch an organization and the totals of its public repositories.
  *
@@ -88,6 +102,7 @@ const fetchOrganization = async (
   let organization: Organization | undefined;
   let after: string | null = null;
   let pages = 0;
+  let membersForbidden = false;
 
   do {
     // Annotated because the walk feeds its own cursor back in, which TypeScript reads as circular.
@@ -105,7 +120,11 @@ const fetchOrganization = async (
           secondaryMessage: ORGANIZATION_NOT_FOUND,
         });
       }
-      throw graphqlError(res.data.errors, res.statusText, ORGANIZATION_ERROR);
+      if (!onlyMembersForbidden(res.data.errors)) {
+        throw graphqlError(res.data.errors, res.statusText, ORGANIZATION_ERROR);
+      }
+      logger.log(res.data.errors[0]?.message);
+      membersForbidden = true;
     }
 
     organization = res.data.data.organization ?? undefined;
@@ -144,7 +163,7 @@ const fetchOrganization = async (
         ? target.history.totalCount
         : 0;
     }),
-    publicMembers: organization.membersWithRole.totalCount,
+    publicMembers: membersForbidden ? null : organization.membersWithRole.totalCount,
     topLanguage: topLanguage(repos),
     truncated: after !== null,
   };

package/src/fetchers/types.ts

@@ -61,8 +61,9 @@ export interface OrganizationData {
   /**
    * Members GitHub shows publicly.
    * Membership is private by default, so this counts fewer people than the organization has.
+   * `null` when the token may not read them, which is the card's cue to leave the stat out.
    */
-  publicMembers: number;
+  publicMembers: number | null;
   /** The language most of those repositories name as their primary one, `null` when none do. */
   topLanguage: { name: string; color: string | null } | null;
   /** Whether the repository walk stopped at its page cap, leaving the totals short. */