History API takes a revset: ?r= f28389bd6aab

    /// A revset (Oxygen's docs/revset_query_language.md) in place of the

    /// reference's whole history; the reference still gives the labels.

    r: Option<String>,

    let revset = q.r.clone().filter(|s| !s.trim().is_empty());

    let by_revset = revset.is_some();

            match &revset {

                Some(rs) => view::history_revset(repo, cache, target, rs, offset, limit),

                None => view::history(repo, cache, target, q.path.as_deref(), offset, limit),

            }

        .await

        .map_err(|e| {

            // A revset that does not parse, names nothing, or goes past the

            // budget is the caller's to fix.

            if by_revset {

                ApiError(StatusCode::BAD_REQUEST, e.to_string())

            } else {

                e.into()

            }

        })?;

/// A window of the changes a revset selects (Oxygen's

/// docs/revset_query_language.md §3), newest first, under a budget

/// stricter than the command line's so a query cannot load the server.

/// `target` is the reference the request named, for labels and heads.

pub fn history_revset(repo: &Repo, cache: &StateCache, target: RefTarget, revset: &str, offset: usize, limit: usize) -> Result<History> {

    let loaded = cache.load(repo, &target.heads)?;

    let head_set: BTreeSet<ChangeHash> = loaded.state.heads().into_iter().collect();

    let selected = repo.revset_with_budget(revset, std::time::Duration::from_secs(2))?;

    let total = selected.hashes.len();

    let labels = head_labels(repo)?;

    let window: Vec<ChangeView> = selected

        .hashes

        .iter()

        .skip(offset)

        .take(limit)

        .filter_map(|h| selected.metas.get(h).map(|m| change_view(repo, h, m, head_set.contains(h), &labels)))

        .collect();

    Ok(History { target, entries: window, total, offset, has_more: offset + limit < total, path: None })

}

    // A revset in place of the whole history (`?r=`), under a budget; a

    // bad one is the caller's problem.

    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=%3A%3Amain%20%26%20kind(normal)", None, None).await;

    assert_eq!(st, StatusCode::OK, "{v}");

    assert_eq!(v["total"].as_u64(), Some(1));

    assert_eq!(v["changes"][0]["hash"], base.to_hex());

    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=none()", None, None).await;

    assert_eq!((st, v["total"].as_u64()), (StatusCode::OK, Some(0)));

    assert_eq!(api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=main%20%26", None, None).await.0, StatusCode::BAD_REQUEST);

    assert_eq!(api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=nosuch()", None, None).await.0, StatusCode::BAD_REQUEST);

JSON under `/api/v1`, bearer tokens, `application/json`, RFC 7807 problem responses (an unknown route too), cursor pagination (`?after=`), ETags on cacheable resources, and rate limits per token. Resources mirror the pages: `/repos/{owner}/{name}`, `/bookmarks`, `/changes/{hash}`, `/tree/{ref}/{path}`, `/file/{ref}/{path}`, `/blame`, `/history/{ref}` (`?path=`, `?offset=&limit=`, or `?r=REVSET` for the changes a revset selects, evaluated under a two-second budget and answering 400 when it does not parse or goes past it; Oxygen's docs/revset_query_language.md), `/compare`, `/conflicts`, `/proposals` (`?state=open|draft|landed|closed|all`, open ones and drafts by default; a source bookmark may hold `/`, and `owner/name:bookmark` naming the repository itself is its own bookmark), `/proposals/{n}/comments|reviews|checks|files`, `PATCH /proposals/{n}` (the title and description, for its author or a maintainer, and `labels`, the whole set by name, for triage; what is not given stays), `POST /proposals/{n}/land` (repo:write: what the Land button does, `409` with the blockers when it cannot; a landed proposal keeps the changes it landed and reports `landed` with who, how (`web`, or `api (token NAME)`) and when, which its event, the audit log and the push record also say, adding when nobody approved), `/proposals/{n}/content/{base|head}/{path}` (a changed file's bytes in the target's state or the projected state, for editor diff views), `/issues` (creating an issue can set its labels, assignees and milestone; `PATCH /issues/{n}` edits the title and body for the author or triage, and replaces labels, assignees or the milestone for triage, recording each on the timeline; unknown names are refused before anything changes), `/labels` (`POST` creates or changes one, `DELETE /labels/{name}` removes it; triage), `/milestones` (`POST` creates one or changes the description and due date of the one with that title, `PATCH /milestones/{title}` changes title, description, due date or state; triage), `/releases` (`PATCH /releases/{tag}` changes the title, notes or prerelease flag, repo:write), `/tags`, `/trust`, `/pushes`, `/hooks`, `/checks`, `/user`, `/notifications` (the caller's inbox and unread count; `/notifications/{id}/read` and `/notifications/read` mark read; scope `user:read`), `/users/{name}`, `/orgs/{name}`, `/checks/{state}` (the checks on a state, named by its hash, by its heads joined with `+`, by the one head of a single-head state, or by a bookmark), `/checks/required` (`GET`, and `PUT` of the whole list by a repository admin: the checks a proposal needs, passed, to land), `/projects/{owner}` (list, create) and `/projects/{owner}/{n}` (the board as the caller may see it, `PATCH` for title, description, privacy and closing, `/cards` to add a reference or note to a column named by id or name, `/cards/{id}` to move or remove one; `repo:write` and the page's rights to change), `/flow/runs` (`GET`: runs newest first, `?before=N&limit=`; `POST {"bookmark"}` or `{"change"}`, repo:write: run a bookmark's current state, the default bookmark when none is named, or one change's state), `/flow/runs/{n}` (a run with its jobs), `/flow/runs/{n}/jobs/{job}/log` (`?after=seq&limit=`) and `/flow/runs/{n}/rerun` (repo:write: a finished run again), both answering `201 {"number", "url"}` or `409` with why nothing started, `/flow/runs/{n}/cancel` (repo:write: a run still going ends as `cancelled`, its running jobs stopped when their runner next reports; `409` when it had already ended; a push to a bookmark cancels the push runs of it still going), `/search`. A change's author carries the account its key is linked to, or `null` and a `note` saying the key is not linked and where its owner links it (the change page shows a "key not linked" tag, with a link to Settings → Keys for signed-in viewers). Shapes reuse `oxy --json` shapes wherever one exists (change, status, blame, diff) so tools written against the CLI work against the hub. `crates/hub-api` holds the types with `serde` derives and is what the runner and the VS Code extension will link.