@loopover/engine 1.0.0

package/dist/scoring/label-match.js

@@ -0,0 +1,145 @@
+import { hasUnsafeWildcardCount } from "../signals/change-guardrail.js";
+export function labelMatchesPattern(label, pattern) {
+    return labelPatternToRegExp(pattern.toLowerCase()).test(label.toLowerCase());
+}
+// Compiled fnmatch→RegExp matchers are memoized by pattern. The same small,
+// config-derived set of label keys is matched on every scored PR/issue, so the
+// per-call recompile inside the nested label loops in engine.ts is pure waste.
+// Keys come from a repo's registryConfig.labelMultipliers, sourced from the externally-fetched gittensor
+// registry (registry/sync.ts + registry/normalize.ts, not a value this repo's own maintainer directly controls
+// via .gittensory.yml) — so the pattern SET is small per repo, but individual pattern CONTENT is untrusted, not
+// literally attacker-supplied-per-request the way GitHub PR content is. The wildcard-count cap below (#2456)
+// bounds a single pattern's compile cost; this cache is additionally bounded to a fixed max entry count and
+// evicted LRU, so a long-running isolate that observes many distinct registry snapshots over its life still
+// can't grow the cache unboundedly. The compiled RegExp carries only the "i" flag (no global/sticky `lastIndex`
+// state), so sharing one instance across calls is safe and byte-identical to recompiling on every call.
+export const LABEL_PATTERN_REGEXP_CACHE_MAX_ENTRIES = 256;
+const labelPatternRegExpCache = new Map();
+// A RegExp that never matches any input — mirrors change-guardrail.ts's identical NEVER_MATCHES fallback for an
+// over-complex pattern, so a pathological registry entry degrades to "this label multiplier never applies"
+// instead of hanging the scoring path that evaluates it.
+const LABEL_PATTERN_NEVER_MATCHES = /^(?!)$/;
+// Upstream resolves label multipliers by matching each configured key as a Python `fnmatch` GLOB, not a
+// literal string: `fnmatch(label.lower(), pattern.lower())` in
+// gittensor/validator/oss_contributions/label_resolution.py, so a repo can configure `type:*`, `kind/*`, or
+// `priority:?` and have it match `type:bug-fix`, `kind/bug`, `priority:1` (#1244-class scoring parity). The
+// preview previously did exact equality, so it silently scored every wildcard-configured trusted label at the
+// neutral default — under-/over-estimating the score for any repo using glob keys. Translate one fnmatch
+// pattern to an anchored, case-insensitive RegExp. fnmatch semantics differ from the path-glob in
+// change-guardrail.ts (there `*` stops at `/` and `?` is literal): labels are flat strings, so `*` matches any
+// run, `?` any single character, and `[seq]`/`[!seq]` a character class. Literal keys are unaffected — for a
+// pattern with no glob metacharacter the RegExp is an exact match, so existing configs score identically.
+function labelPatternToRegExp(pattern) {
+    const cached = labelPatternRegExpCache.get(pattern);
+    if (cached !== undefined) {
+        // Refresh recency on hit so the cache behaves as an LRU: the most-recently-matched patterns
+        // survive eviction, not just the most-recently-inserted ones.
+        labelPatternRegExpCache.delete(pattern);
+        labelPatternRegExpCache.set(pattern, cached);
+        return cached;
+    }
+    // Reuses change-guardrail.ts's wildcard-GROUP counting (a `*` here matches the same "any run of chars"
+    // semantics as that glob compiler's `*`, so the same catastrophic-backtracking risk and the same empirically-
+    // safe threshold apply) — an over-complex registry-sourced label_multipliers key degrades to a safe never-match
+    // instead of hanging RegExp.test() on an adversarial near-miss label (#2456). Reachable via the public
+    // score-preview API, the MCP tool, and the per-PR label-audit signal, so one bad registry entry could otherwise
+    // hang scoring for every PR on that repo.
+    if (hasUnsafeWildcardCount(pattern)) {
+        setLabelPatternRegExpCacheEntry(pattern, LABEL_PATTERN_NEVER_MATCHES);
+        return LABEL_PATTERN_NEVER_MATCHES;
+    }
+    let regex = "";
+    let i = 0;
+    while (i < pattern.length) {
+        const char = pattern.charAt(i);
+        i += 1;
+        if (char === "*") {
+            regex += ".*";
+        }
+        else if (char === "?") {
+            regex += ".";
+        }
+        else if (char === "[") {
+            const close = pattern.indexOf("]", i);
+            if (close === -1) {
+                // No closing bracket: fnmatch treats the `[` as a literal character.
+                regex += "\\[";
+            }
+            else {
+                const rawBody = pattern.slice(i, close);
+                if (rawBody === "" || rawBody === "!") {
+                    // Empty classes and bare `[!]` stay literal in Python fnmatch instead of compiling as classes.
+                    regex += `\\[${escapeRegExpLiteral(rawBody)}\\]`;
+                }
+                else if (hasDescendingCharacterRange(rawBody)) {
+                    // Python fnmatch treats invalid ranges like `[z-a]` as a never-match pattern; RegExp throws.
+                    regex += "(?!)";
+                }
+                else {
+                    let body = rawBody.replace(/\\/g, "\\\\");
+                    // `[!seq]` is fnmatch's negated class; RegExp spells negation as `[^seq]`.
+                    if (body.startsWith("!"))
+                        body = `^${body.slice(1)}`;
+                    else if (body.startsWith("^"))
+                        body = `\\${body}`;
+                    regex += `[${body}]`;
+                }
+                i = close + 1;
+            }
+        }
+        else if (/[.+^${}()|\]\\]/.test(char)) {
+            regex += `\\${char}`;
+        }
+        else {
+            regex += char;
+        }
+    }
+    const compiled = new RegExp(`^${regex}$`, "i");
+    setLabelPatternRegExpCacheEntry(pattern, compiled);
+    return compiled;
+}
+// Inserts a new (never-before-cached) entry, evicting the least-recently-used entry first if the
+// cache is already at its bound. Callers must only use this for keys not already present — refreshing
+// an existing key's recency on a cache hit is handled inline above via delete+set.
+function setLabelPatternRegExpCacheEntry(pattern, compiled) {
+    if (labelPatternRegExpCache.size >= LABEL_PATTERN_REGEXP_CACHE_MAX_ENTRIES) {
+        // Map iteration order is insertion order, so the first key is always the least-recently-used
+        // one (recency is refreshed via delete+set on every hit/insert). The map is non-empty here
+        // because size >= LABEL_PATTERN_REGEXP_CACHE_MAX_ENTRIES (a positive constant), so the loop body
+        // always runs exactly once.
+        for (const oldestPattern of labelPatternRegExpCache.keys()) {
+            labelPatternRegExpCache.delete(oldestPattern);
+            break;
+        }
+    }
+    labelPatternRegExpCache.set(pattern, compiled);
+}
+export function clearLabelPatternRegExpCacheForTest() {
+    labelPatternRegExpCache.clear();
+}
+export function labelPatternRegExpCacheKeysForTest() {
+    return [...labelPatternRegExpCache.keys()];
+}
+function escapeRegExpLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function hasDescendingCharacterRange(body) {
+    const start = body.startsWith("!") ? 1 : 0;
+    // Walk the class left-to-right, consuming each `X-Y` range as a unit so a range endpoint can't be
+    // misread as the start of a spurious second range. Only a genuinely inverted range like `[z-a]` — the
+    // case JS `RegExp` actually throws on — must degrade the class to never-match; a literal `-` that
+    // follows a completed range (as in `[a-z-9]`, a valid class) must NOT be suppressed. The prior scan
+    // flagged any `-` whose left neighbor outranked its right neighbor, so it wrongly killed `[a-z-9]`.
+    let i = start;
+    while (i < body.length) {
+        if (i + 2 < body.length && body.charAt(i + 1) === "-") {
+            if (body.charCodeAt(i) > body.charCodeAt(i + 2))
+                return true;
+            i += 3;
+        }
+        else {
+            i += 1;
+        }
+    }
+    return false;
+}

package/dist/scoring/model.d.ts

@@ -0,0 +1,31 @@
+import type { ScoringModelSnapshotRecord } from "./types.js";
+export declare const DEFAULT_ISSUE_DISCOVERY_SHARE = 0.5;
+export declare const DEFAULT_SCORING_CONSTANTS: Record<string, number>;
+export declare const DEFAULT_GITTENSOR_UPSTREAM_REPO = "entrius/gittensor";
+export declare const DEFAULT_GITTENSOR_UPSTREAM_REF = "test";
+export declare const SCORING_CONSTANT_NAMES: Set<string>;
+export declare const SCORING_SNAPSHOT_STALE_MS: number;
+export declare function scoringSnapshotStalenessWarning(snapshot: Pick<ScoringModelSnapshotRecord, "fetchedAt">, now?: number): string | null;
+export declare function parsePythonNumberConstants(source: string, options?: {
+    knownOnly?: boolean;
+}): Record<string, number>;
+/**
+ * Numeric constant names upstream gittensor defines that gittensory's scoring engine does NOT model.
+ * The normal parse is `knownOnly` (it keeps only constants we already encode), which silently hides
+ * upstream ADDITIONS — e.g. a newly-introduced time-decay constant. Surfacing these makes scoring
+ * staleness visible: if upstream adds a scoring dimension, an operator sees it instead of the gate
+ * silently drifting behind. Detection only — it does not change any score.
+ */
+export declare function findUnmodeledConstantKeys(allConstants: Record<string, number>): string[];
+export declare function findUnmodeledUpstreamConstants(source: string): string[];
+/**
+ * Owner-controlled global gate for applying upstream time-decay to score previews (#703). Default OFF: the
+ * roadmap deferral requires the owner to review a before/after ranking diff before enabling. Even when on,
+ * a fresh PR is unaffected (decay 1.0), so it only changes aged-PR projections.
+ */
+export declare function isTimeDecayEnabled(env: {
+    SCORING_TIME_DECAY_ENABLED?: string | null | undefined;
+}): boolean;
+export declare function detectActiveModel(constants: Record<string, number>): ScoringModelSnapshotRecord["activeModel"];
+export declare function hasSaturationConstants(constants: Record<string, number>): boolean;
+export declare function hasDensityConstants(constants: Record<string, number>): boolean;

package/dist/scoring/model.js

@@ -0,0 +1,157 @@
+// Deterministic subset of the backend's `src/scoring/model.ts`, extracted so a miner can run the same
+// score-preview constants/classification logic locally (#2282). The upstream-fetching, D1-persisting half
+// of that file (`refreshScoringModelSnapshot`, `getOrCreateScoringModelSnapshot`, and their private fetch
+// helpers) is Cloudflare/D1-bound and stays in `src/scoring/model.ts`, which imports the pure pieces below
+// back from this package.
+export const DEFAULT_ISSUE_DISCOVERY_SHARE = 0.5;
+export const DEFAULT_SCORING_CONSTANTS = {
+    OSS_EMISSION_SHARE: 0.9,
+    // Upstream name is ISSUES_TREASURY_EMISSION_SHARE (plural). The prior singular spelling never matched
+    // upstream, freezing this at the local default and showing up as a false "unmodeled" drift warning (#806).
+    ISSUES_TREASURY_EMISSION_SHARE: 0.1,
+    // Lookback window used upstream for PR history; stored so it syncs and does not surface as unmodeled drift.
+    PR_LOOKBACK_DAYS: 30,
+    MERGED_PR_BASE_SCORE: 25,
+    // Upstream MAX_CONTRIBUTION_BONUS is 5. This local value is only the fetch-failure fallback; keeping it at
+    // 25 silently 5x-inflated the contribution bonus whenever the upstream fetch failed (#807).
+    MAX_CONTRIBUTION_BONUS: 5,
+    CONTRIBUTION_SCORE_FOR_FULL_BONUS: 1500,
+    // Applied in preview.ts when computing totalTokenScore from components (#808).
+    TEST_FILE_CONTRIBUTION_WEIGHT: 0.05,
+    // Upstream-enforced eligibility floors for PR and issue-discovery history (#808).
+    // These gate whether a validator counts a contributor's submissions, not the per-PR/issue score itself.
+    // Stored here so they sync from upstream and no longer appear as unmodeled drift warnings.
+    MIN_VALID_MERGED_PRS: 3,
+    MIN_CREDIBILITY: 0.8,
+    MIN_VALID_SOLVED_ISSUES: 3,
+    MIN_ISSUE_CREDIBILITY: 0.8,
+    MIN_TOKEN_SCORE_FOR_VALID_ISSUE: 5,
+    // Open-issue spam gate constants — wired into the issue-discovery scoring lane in preview.ts (#808).
+    OPEN_ISSUE_SPAM_BASE_THRESHOLD: 2,
+    OPEN_ISSUE_SPAM_TOKEN_SCORE_PER_SLOT: 300,
+    MAX_OPEN_ISSUE_THRESHOLD: 30,
+    OPEN_PR_COLLATERAL_PERCENT: 0.2,
+    MAX_OPEN_PR_REVIEW_COLLATERAL_MULTIPLIER: 2.0,
+    MAX_LINES_SCORED_FOR_NON_CODE_EXT: 300,
+    DEFAULT_ISSUE_DISCOVERY_SHARE,
+    REVIEW_PENALTY_RATE: 0.15,
+    STANDARD_ISSUE_MULTIPLIER: 1.33,
+    MAINTAINER_ISSUE_MULTIPLIER: 1.66,
+    EXCESSIVE_PR_PENALTY_BASE_THRESHOLD: 2,
+    OPEN_PR_THRESHOLD_TOKEN_SCORE: 300,
+    MAX_OPEN_PR_THRESHOLD: 30,
+    SRC_TOK_SATURATION_SCALE: 58,
+    // Density-era constants (#812): upstream is on the saturation model, but `current_density_model` is still
+    // a supported `activeModel` (types.ts union, the public OpenAPI schema, the DB parser, ~20 test fixtures,
+    // and src/services/score-breakdown.ts). The density branch in preview.ts is therefore NOT dead — it is the
+    // supported alternate/fallback model. Single-sourcing these fallbacks HERE (instead of as silent hardcoded
+    // literals at every constant() call site) closes the duplicate-source-of-truth gap without a breaking
+    // removal of a still-supported model.
+    MIN_TOKEN_SCORE_FOR_BASE_SCORE: 5,
+    MAX_CODE_DENSITY_MULTIPLIER: 1.15,
+    // Upstream time-decay (#703): a merged PR's score decays on a sigmoid after a grace period. Modeled here
+    // so they no longer surface as unmodeled drift (#690); APPLICATION is opt-in + default-off (see preview).
+    TIME_DECAY_GRACE_PERIOD_HOURS: 12,
+    TIME_DECAY_SIGMOID_MIDPOINT: 10,
+    TIME_DECAY_SIGMOID_STEEPNESS_SCALAR: 0.4,
+    TIME_DECAY_MIN_MULTIPLIER: 0.05,
+};
+export const DEFAULT_GITTENSOR_UPSTREAM_REPO = "entrius/gittensor";
+export const DEFAULT_GITTENSOR_UPSTREAM_REF = "test";
+// Single source of truth (#812): every recognized upstream constant name is a key of
+// DEFAULT_SCORING_CONSTANTS, so the known-only parser, the unmodeled-drift detector, and the preview-side
+// fallbacks all derive from one place. The density-era constants are included because the density model is
+// still a supported activeModel (see comment above). Exported so the D1-bound refresh in
+// `src/scoring/model.ts` can reuse it for its `recognizedCount` sanity floor without duplicating the Set.
+export const SCORING_CONSTANT_NAMES = new Set(Object.keys(DEFAULT_SCORING_CONSTANTS));
+// Mirror Pipeline B's UPSTREAM_STALE_MS (upstream/ruleset.ts): a served scoring snapshot older than this
+// window means the last upstream refresh failed or has not run, so previews are quietly using last-good (or
+// DEFAULT) constants with no other staleness signal on the scoring side (#810).
+export const SCORING_SNAPSHOT_STALE_MS = 2 * 60 * 60 * 1000;
+export function scoringSnapshotStalenessWarning(snapshot, now = Date.now()) {
+    if (Date.parse(snapshot.fetchedAt) + SCORING_SNAPSHOT_STALE_MS >= now)
+        return null;
+    return "Scoring constants snapshot is stale: the last upstream refresh is older than the freshness window, so scoring may be using last-good or default constants and be behind upstream.";
+}
+export function parsePythonNumberConstants(source, options = { knownOnly: true }) {
+    const constants = {};
+    for (const line of source.split("\n")) {
+        // Match Python numeric literals including underscore separators in integer and fractional parts
+        // (1_000_000, 0.000_001, 3.14_15), floats, and exponents (1e-9, 5.8e1). The previous regex only
+        // allowed `_` in the integer part, truncating 0.000_001 -> 0 and 3.14_15 -> 3.14 (#992).
+        const match = line.match(/^([A-Z][A-Z0-9_]+)\s*=\s*([-+]?(?:\d[\d_]*\.?[\d_]*|\.\d[\d_]*)(?:[eE][-+]?\d+)?)/);
+        if (!match)
+            continue;
+        const name = match[1];
+        const raw = match[2];
+        if (options.knownOnly !== false && !SCORING_CONSTANT_NAMES.has(name))
+            continue;
+        // Number() rejects underscore separators, so strip them before parsing.
+        constants[name] = Number(raw.replace(/_/g, ""));
+    }
+    return constants;
+}
+/**
+ * Upstream operational/infra constants gittensory intentionally does not model in score previews.
+ * They are not scoring dimensions — surfacing them as "unmodeled drift" is noise (#809).
+ */
+const NON_SCORING_UPSTREAM_CONSTANT_NAMES = new Set([
+    "SECONDS_PER_DAY",
+    "SECONDS_PER_HOUR",
+    "GITHUB_HTTP_TIMEOUT_SECONDS",
+    "MIRROR_HTTP_TIMEOUT_SECONDS",
+    "MIRROR_MAX_ATTEMPTS",
+    "TREE_SITTER_PARSE_TIMEOUT_MICROS",
+    "SCORING_SUBPROCESS_BUDGET_S",
+    "MAX_FILE_SIZE_BYTES",
+    "RECYCLE_UID",
+    "ISSUES_TREASURY_UID",
+    "MAX_ISSUE_ID",
+    // Floating-point epsilon for the registry emission_share-sum validation
+    // (load_weights.py: `total_share > 1.0 + EMISSION_SHARE_TOLERANCE`), not a scoring dimension — without
+    // this entry the parser (which reads exponent literals like `1e-9`, #992) flagged it as a permanent
+    // false-positive unmodeled-scoring-drift warning (#809).
+    "EMISSION_SHARE_TOLERANCE",
+    // Fallback weight applied by the validator's load_programming_language_weights() for extensions absent from
+    // the JSON file; gittensory reads the JSON directly and does not track this loader default (#1692).
+    "DEFAULT_PROGRAMMING_LANGUAGE_WEIGHT",
+]);
+/**
+ * Numeric constant names upstream gittensor defines that gittensory's scoring engine does NOT model.
+ * The normal parse is `knownOnly` (it keeps only constants we already encode), which silently hides
+ * upstream ADDITIONS — e.g. a newly-introduced time-decay constant. Surfacing these makes scoring
+ * staleness visible: if upstream adds a scoring dimension, an operator sees it instead of the gate
+ * silently drifting behind. Detection only — it does not change any score.
+ */
+export function findUnmodeledConstantKeys(allConstants) {
+    return Object.keys(allConstants)
+        .filter((name) => !SCORING_CONSTANT_NAMES.has(name) && !NON_SCORING_UPSTREAM_CONSTANT_NAMES.has(name))
+        .sort();
+}
+export function findUnmodeledUpstreamConstants(source) {
+    return findUnmodeledConstantKeys(parsePythonNumberConstants(source, { knownOnly: false }));
+}
+/**
+ * Owner-controlled global gate for applying upstream time-decay to score previews (#703). Default OFF: the
+ * roadmap deferral requires the owner to review a before/after ranking diff before enabling. Even when on,
+ * a fresh PR is unaffected (decay 1.0), so it only changes aged-PR projections.
+ */
+export function isTimeDecayEnabled(env) {
+    return /^(1|true|yes|on)$/i.test(env.SCORING_TIME_DECAY_ENABLED ?? "");
+}
+export function detectActiveModel(constants) {
+    if (hasSaturationConstants(constants))
+        return "pending_saturation_model";
+    if (hasDensityConstants(constants)) {
+        return "current_density_model";
+    }
+    return "unknown";
+}
+// Exported (unlike the backend original, where these stay private) so `src/scoring/model.ts`'s
+// D1-bound `refreshScoringModelSnapshot`/`activeModelWarnings` can reuse them without duplication.
+export function hasSaturationConstants(constants) {
+    return Number.isFinite(constants.SRC_TOK_SATURATION_SCALE);
+}
+export function hasDensityConstants(constants) {
+    return Number.isFinite(constants.MAX_CODE_DENSITY_MULTIPLIER) && Number.isFinite(constants.MIN_TOKEN_SCORE_FOR_BASE_SCORE);
+}

package/dist/scoring/pending-pr-scenarios.d.ts

@@ -0,0 +1,44 @@
+import type { CheckSummaryRecord, PullRequestRecord, PullRequestReviewRecord, RoleContext } from "./types.js";
+import type { ScorePreviewInput } from "./preview.js";
+export type OpenPrPendingClass = "merge_ready" | "stale_likely_close" | "draft" | "blocked" | "maintainer_lane" | "open_other";
+export type ClassifiedOpenPullRequest = {
+    repoFullName: string;
+    number: number;
+    title: string;
+    classification: OpenPrPendingClass;
+    reasons: string[];
+};
+export type PendingPrScenarioDetection = {
+    source: "github_observed" | "user_supplied";
+    pendingMergedPrCount: number;
+    pendingClosedPrCount: number;
+    approvedPrCount: number;
+    expectedOpenPrCountAfterMerge?: number | undefined;
+    scenarioNotes: string[];
+    classified: ClassifiedOpenPullRequest[];
+};
+export type ContributorRepoOpenPrSignals = {
+    reviewsByPullNumber: Map<number, PullRequestReviewRecord[]>;
+    checksByPullNumber: Map<number, CheckSummaryRecord[]>;
+};
+export declare const DRAFT_TITLE_PATTERN: RegExp;
+export declare function detectPendingPrScenario(args: {
+    login: string;
+    repoFullName: string;
+    pullRequests: PullRequestRecord[];
+    roleContext: RoleContext;
+    openPrCount?: number | undefined;
+    reviewsByPullNumber?: Map<number, PullRequestReviewRecord[]> | undefined;
+    checksByPullNumber?: Map<number, CheckSummaryRecord[]> | undefined;
+    excludePullNumbers?: number[] | undefined;
+    userSupplied?: Pick<ScorePreviewInput, "pendingMergedPrCount" | "pendingClosedPrCount" | "approvedPrCount" | "expectedOpenPrCountAfterMerge" | "projectedCredibility" | "scenarioNotes"> | undefined;
+}): PendingPrScenarioDetection | null;
+export declare function classifyOpenPullRequest(args: {
+    pr: PullRequestRecord;
+    roleContext: RoleContext;
+    reviews: PullRequestReviewRecord[];
+    checks: CheckSummaryRecord[];
+    duplicateProne?: boolean | undefined;
+    missingTests?: boolean | undefined;
+}): ClassifiedOpenPullRequest;
+export declare function applyPendingPrDetectionToScoreInput(input: ScorePreviewInput, detection: PendingPrScenarioDetection | null): ScorePreviewInput;

package/dist/scoring/pending-pr-scenarios.js

@@ -0,0 +1,145 @@
+const STALE_DAYS = 14;
+// Real draft markers only — "[draft]", "Draft:", "Draft -"; the delimiter keeps "Drafting" and
+// "draft-js" from matching. Trailing \s* lets the same pattern also strip the marker for dedup keys.
+export const DRAFT_TITLE_PATTERN = /^(?:\[\s*draft\s*\]|draft(?:\s*:|\s+-))\s*/i;
+// Mirrors `src/github/commands.ts`'s `isMaintainerAssociation`/`MAINTAINER_ASSOCIATIONS` exactly. Duplicated
+// here (rather than imported) because this package cannot reach into `src/`; keep the two in sync by hand.
+const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+function isMaintainerAssociation(association) {
+    return Boolean(association && MAINTAINER_ASSOCIATIONS.has(association));
+}
+export function detectPendingPrScenario(args) {
+    const user = args.userSupplied;
+    const hasUserCounts = user?.pendingMergedPrCount !== undefined ||
+        user?.pendingClosedPrCount !== undefined ||
+        user?.approvedPrCount !== undefined ||
+        user?.expectedOpenPrCountAfterMerge !== undefined;
+    if (hasUserCounts) {
+        return {
+            source: "user_supplied",
+            pendingMergedPrCount: nonNegative(user?.pendingMergedPrCount),
+            pendingClosedPrCount: nonNegative(user?.pendingClosedPrCount),
+            approvedPrCount: nonNegative(user?.approvedPrCount),
+            ...(user?.expectedOpenPrCountAfterMerge !== undefined ? { expectedOpenPrCountAfterMerge: nonNegative(user.expectedOpenPrCountAfterMerge) } : {}),
+            scenarioNotes: user?.scenarioNotes ?? [],
+            classified: [],
+        };
+    }
+    const excluded = new Set(args.excludePullNumbers ?? []);
+    const contributorOpen = args.pullRequests.filter((pr) => sameRepoFullName(pr.repoFullName, args.repoFullName) &&
+        pr.state === "open" &&
+        sameLogin(pr.authorLogin, args.login) &&
+        !excluded.has(pr.number));
+    if (contributorOpen.length === 0)
+        return null;
+    const classified = contributorOpen.map((pr) => classifyOpenPullRequest({
+        pr,
+        roleContext: args.roleContext,
+        reviews: args.reviewsByPullNumber?.get(pr.number) ?? [],
+        checks: args.checksByPullNumber?.get(pr.number) ?? [],
+    }));
+    const mergeReady = classified.filter((entry) => entry.classification === "merge_ready");
+    const staleLikelyClose = classified.filter((entry) => entry.classification === "stale_likely_close");
+    const pendingMergedPrCount = mergeReady.length;
+    const pendingClosedPrCount = staleLikelyClose.length;
+    if (pendingMergedPrCount === 0 && pendingClosedPrCount === 0)
+        return null;
+    const currentOpen = args.openPrCount ?? contributorOpen.length;
+    const expectedOpenPrCountAfterMerge = Math.max(0, currentOpen - pendingMergedPrCount - pendingClosedPrCount);
+    const scenarioNotes = [
+        "GitHub-observed open PR state from cached reviews, checks, and activity timestamps (estimate only).",
+        ...(pendingMergedPrCount > 0
+            ? [`${pendingMergedPrCount} open PR(s) look merge-ready (approved, no changes requested, no failing checks, not draft/stale).`]
+            : []),
+        ...(pendingClosedPrCount > 0 ? [`${pendingClosedPrCount} open PR(s) look stale and may be closed instead of merged.`] : []),
+        ...classified
+            .filter((entry) => entry.classification === "draft" || entry.classification === "blocked" || entry.classification === "maintainer_lane")
+            .map((entry) => `PR #${entry.number} treated as ${entry.classification.replace(/_/g, " ")} for this projection.`),
+    ];
+    return {
+        source: "github_observed",
+        pendingMergedPrCount,
+        pendingClosedPrCount,
+        approvedPrCount: mergeReady.length,
+        expectedOpenPrCountAfterMerge,
+        scenarioNotes,
+        classified,
+    };
+}
+export function classifyOpenPullRequest(args) {
+    const reasons = [];
+    if (args.roleContext.maintainerLane) {
+        reasons.push("Maintainer-lane context for this repo; not counted as outside-contributor pending reward work.");
+        return { repoFullName: args.pr.repoFullName, number: args.pr.number, title: args.pr.title, classification: "maintainer_lane", reasons };
+    }
+    if (isMaintainerAssociation(args.pr.authorAssociation)) {
+        reasons.push("Author association indicates maintainer-authored work.");
+        return { repoFullName: args.pr.repoFullName, number: args.pr.number, title: args.pr.title, classification: "maintainer_lane", reasons };
+    }
+    if (isDraftPullRequest(args.pr)) {
+        reasons.push("Draft PRs are not treated as likely to land.");
+        return { repoFullName: args.pr.repoFullName, number: args.pr.number, title: args.pr.title, classification: "draft", reasons };
+    }
+    const approvalCount = args.reviews.filter((review) => review.state.toUpperCase() === "APPROVED").length;
+    const changeRequestCount = args.reviews.filter((review) => review.state.toUpperCase() === "CHANGES_REQUESTED").length;
+    const checkFailureCount = args.checks.filter((check) => check.conclusion === "failure" || check.conclusion === "timed_out" || check.conclusion === "cancelled").length;
+    const ageDays = daysSince(args.pr.updatedAt ?? args.pr.createdAt);
+    if (args.duplicateProne)
+        reasons.push("Overlapping open work detected in the same repo (possible duplicate or WIP collision).");
+    if (args.missingTests)
+        reasons.push("Cached file list shows code changes without matching test files.");
+    if (changeRequestCount > 0)
+        reasons.push(`${changeRequestCount} changes-requested review(s).`);
+    if (checkFailureCount > 0)
+        reasons.push(`${checkFailureCount} failing or cancelled check(s).`);
+    if (approvalCount === 0)
+        reasons.push("No approved review in cache.");
+    if (changeRequestCount > 0 || checkFailureCount > 0 || approvalCount === 0) {
+        return { repoFullName: args.pr.repoFullName, number: args.pr.number, title: args.pr.title, classification: "blocked", reasons };
+    }
+    if (ageDays >= STALE_DAYS) {
+        reasons.push(`No meaningful update in at least ${STALE_DAYS} days; may be closed instead of merged.`);
+        return { repoFullName: args.pr.repoFullName, number: args.pr.number, title: args.pr.title, classification: "stale_likely_close", reasons };
+    }
+    reasons.push("Approved with passing checks and recent activity; treated as likely to merge (estimate).");
+    return { repoFullName: args.pr.repoFullName, number: args.pr.number, title: args.pr.title, classification: "merge_ready", reasons };
+}
+export function applyPendingPrDetectionToScoreInput(input, detection) {
+    if (!detection || detection.source === "user_supplied")
+        return input;
+    return {
+        ...input,
+        pendingMergedPrCount: detection.pendingMergedPrCount,
+        pendingClosedPrCount: detection.pendingClosedPrCount,
+        approvedPrCount: detection.approvedPrCount,
+        expectedOpenPrCountAfterMerge: detection.expectedOpenPrCountAfterMerge,
+        scenarioNotes: [...(input.scenarioNotes ?? []), ...detection.scenarioNotes],
+        pendingScenarioObserved: true,
+    };
+}
+function isDraftPullRequest(pr) {
+    if (pr.isDraft)
+        return true;
+    if (DRAFT_TITLE_PATTERN.test(pr.title.trim()))
+        return true;
+    return pr.labels.some((label) => label.toLowerCase() === "draft" || label.toLowerCase() === "wip");
+}
+function sameRepoFullName(left, right) {
+    return left.toLowerCase() === right.toLowerCase();
+}
+function sameLogin(value, login) {
+    return Boolean(value && value.toLowerCase() === login.toLowerCase());
+}
+function daysSince(value) {
+    if (!value)
+        return Number.POSITIVE_INFINITY;
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        return Number.POSITIVE_INFINITY;
+    return Math.max(0, (Date.now() - parsed) / 86_400_000);
+}
+function nonNegative(value) {
+    if (value === undefined || !Number.isFinite(value))
+        return 0;
+    return Math.max(0, Math.trunc(value));
+}