limn-review 0.1.123

package/dist/api/routes/me.js

@@ -0,0 +1,458 @@
+import { MY_TURN_TOGGLES, validateMyTurnSettings } from '../../shared/index.js';
+import { config } from '../../config.js';
+import { accountToLocalUser, setBenchmarkConsent, setBlastRadiusConfig, setLargePrCodeLocThreshold, setMyTurnSettings, } from '../../auth/account.js';
+import { resolveLargePrThreshold } from '../../db/code-loc.js';
+import { aiCreditStatus, monthStartMs } from '../../db/credits.js';
+import { eraseAccountData } from '../../db/erase-account.js';
+import { exportAccountData } from '../../db/export-account.js';
+import { runBenchmarkRollupForAccount } from '../../sync/benchmark-rollup.js';
+import { accountIdOf } from '../plugins/auth.js';
+import { EMPTY_CAPABILITIES, entitledProCapabilities, } from '../../pro/contract.js';
+import { getAuthNotices } from '../../sync/auth-notices.js';
+import { isSeverityApiConfigured } from '../../ml/severity-client.js';
+import { getAiRuntimeStatus } from '../../ai/runtime.js';
+import { detectClaudeAuth, NO_CLAUDE_AUTH_MESSAGE } from '../../review/auth.js';
+import { getMyTurn } from '../../db/queries.js';
+import { clearDailyBriefCountsFor } from '../../db/daily-brief.js';
+import { dismissMyTurn, restoreMyTurn } from '../../db/my-turn-dismissals.js';
+const benchmarkConsentSchema = {
+    body: {
+        type: 'object',
+        required: ['optIn'],
+        additionalProperties: false,
+        properties: { optIn: { type: 'boolean' } },
+    },
+};
+// The LARGE-PR FLAG's threshold. `null` is a first-class value meaning "reset to the product
+// default", so the type is the union — NOT an optional key, which would make "clear it" and
+// "don't change it" the same request. The bounds are validation, not taste: `minimum: 1` because a
+// threshold of 0 flags literally every pull request, and an upper bound because an unbounded
+// integer is a number nobody could ever hit, i.e. a setting that silently means "off" while
+// looking like it is on. `multipleOf: 1` rejects 1500.5 (ajv's `integer` already does, but the
+// column is an INTEGER in both dialects and the intent is worth spelling).
+const largePrThresholdSchema = {
+    body: {
+        type: 'object',
+        required: ['threshold'],
+        additionalProperties: false,
+        properties: {
+            threshold: {
+                type: ['integer', 'null'],
+                minimum: 1,
+                maximum: 1_000_000,
+                multipleOf: 1,
+            },
+        },
+    },
+};
+// The BLAST-RADIUS reading settings. `config: null` RESETS to the product defaults, the same
+// first-class "no opinion" value `threshold: null` is above — a union, not an optional key, so
+// "clear it" and "leave it alone" stay different requests.
+//
+// The schema is deliberately LOOSE where the sanitizer is strict: `surfacesOff` is a bounded
+// array of short strings here, and `sanitizeBlastRadiusConfig` is what decides which strings are
+// real surfaces (dropping the rest rather than 400-ing the whole write, so an older backend
+// reading a newer client degrades to ignoring one opt-out instead of discarding the dial). The
+// bounds that ARE here are the ones a validator must own: an enum for the dial, and caps so the
+// body cannot be used to push a large payload into a JSON column.
+const blastRadiusConfigSchema = {
+    body: {
+        type: 'object',
+        required: ['config'],
+        additionalProperties: false,
+        properties: {
+            config: {
+                type: ['object', 'null'],
+                additionalProperties: false,
+                required: ['sensitivity'],
+                properties: {
+                    sensitivity: { type: 'string', enum: ['cautious', 'balanced', 'relaxed'] },
+                    // Show the Pro AI impact note on the PR pane. Absent = shown; only `false` is stored.
+                    showImpactNote: { type: 'boolean' },
+                    surfacesOff: {
+                        type: 'array',
+                        maxItems: 32,
+                        items: { type: 'string', maxLength: 32 },
+                    },
+                    overrides: {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            highCodeLoc: { type: 'integer', minimum: 1, maximum: 1_000_000 },
+                            highCodeFiles: { type: 'integer', minimum: 1, maximum: 100_000 },
+                            highDirs: { type: 'integer', minimum: 1, maximum: 100_000 },
+                            highSubsystems: { type: 'integer', minimum: 1, maximum: 100_000 },
+                            lowCodeLoc: { type: 'integer', minimum: 1, maximum: 1_000_000 },
+                            lowCodeFiles: { type: 'integer', minimum: 1, maximum: 100_000 },
+                        },
+                    },
+                },
+            },
+        },
+    },
+};
+// The MY TURN settings. `settings: null` RESETS to the product defaults — a union, not an optional
+// key, like the two settings above.
+//
+// ⚠ EVERY PROPERTY IS DECLARED, down to each `show` key (built from `MY_TURN_TOGGLES`, the one list).
+// Fastify's ajv STRIPS an undeclared key silently rather than rejecting it (the contact-form
+// honeypot defect), so a key missing here would be a switch that saves as nothing. The schema
+// checks SHAPE only; MEANING — a known type, no repeats, weights in steps of 10 summing to 100 — is
+// `validateMyTurnSettings`, whose sentence the Settings form shows before it ever sends.
+const myTurnSettingsSchema = {
+    body: {
+        type: 'object',
+        required: ['settings'],
+        additionalProperties: false,
+        properties: {
+            settings: {
+                type: ['object', 'null'],
+                additionalProperties: false,
+                properties: {
+                    show: {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: Object.fromEntries(MY_TURN_TOGGLES.map((k) => [k, { type: 'boolean' }])),
+                    },
+                    trunkScope: { type: 'string', maxLength: 32 },
+                    order: {
+                        type: 'array',
+                        maxItems: 15,
+                        items: { type: 'string', maxLength: 32 },
+                    },
+                    weights: {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            proximity: { type: 'integer' },
+                            stall: { type: 'integer' },
+                            relevance: { type: 'integer' },
+                        },
+                    },
+                },
+            },
+        },
+    },
+};
+// Erasure requires the caller to retype their own GitHub login. maxLength bounds the string
+// (every GitHub login is ≤ 39 chars) so the body can't be used to push a large payload.
+const deleteAccountSchema = {
+    body: {
+        type: 'object',
+        required: ['confirmLogin'],
+        additionalProperties: false,
+        properties: { confirmLogin: { type: 'string', minLength: 1, maxLength: 64 } },
+    },
+};
+/**
+ * `MeResponse.ai`. `enabled` is the ONE agentic switch (config.aiEnabled: local and not
+ * LIMN_AI_DISABLED) — the same value that decides whether `registerAgenticRoutes` registers
+ * anything. `runtime` is the one-time SDK download (ai/runtime.ts). `auth` is `detectClaudeAuth`'s
+ * HEURISTIC (a `~/.claude` directory counts): it decides only whether a Run button or the one
+ * "Sign in to Claude Code or set ANTHROPIC_API_KEY" line shows, never whether the feature is
+ * visible — the run itself is the authoritative check. Disabled ⇒ the other fields are inert.
+ */
+function agenticAiStatus() {
+    if (!config.aiEnabled) {
+        return { enabled: false, runtime: 'absent', runtimeMessage: null, auth: 'none', authMessage: null };
+    }
+    const rt = getAiRuntimeStatus();
+    const auth = detectClaudeAuth();
+    return {
+        enabled: true,
+        runtime: rt.runtime,
+        runtimeMessage: rt.runtimeMessage,
+        auth: auth.status === 'ok' ? 'ok' : 'none',
+        authMessage: auth.status === 'ok' ? null : NO_CLAUDE_AUTH_MESSAGE,
+    };
+}
+export async function meRoutes(app) {
+    app.get('/api/me', async (req) => {
+        const accountId = accountIdOf(req);
+        const user = accountToLocalUser(req.account);
+        // Per-account entitlement: local = full capabilities; cloud = full only when the
+        // account's plan isn't 'free' (Stripe billing seam) — used for the `pro` passthrough.
+        const entitled = req.account
+            ? entitledProCapabilities(req.account)
+            : EMPTY_CAPABILITIES;
+        // Month-to-date AI balances, computed CORE-side (the plan/allowance rules live in db/credits)
+        // so the SPA has the spend baseline on the very first authenticated call — no separate Pro
+        // fetch needed on login. Split by seam: summary is metered by TURN count, agent by CREDITS.
+        let aiUsage = null;
+        if (req.account) {
+            const nowMs = Date.now();
+            const c = await aiCreditStatus(req.account, nowMs);
+            aiUsage = {
+                enabled: true,
+                monthStart: new Date(monthStartMs(nowMs)).toISOString(),
+                summaryTurnsUsed: c.summaryTurnsUsed,
+                summaryTurnLimit: c.summaryTurnLimit,
+                summaryTurnsRemaining: c.summaryTurnsRemaining,
+                agentCreditsUsed: c.agentCreditsUsed,
+                agentAllowanceCredits: c.agentAllowanceCredits,
+                agentCreditsRemaining: c.agentCreditsRemaining,
+            };
+        }
+        return {
+            user,
+            // NOTE: this response deliberately carries NO My-Turn counts. It used to return a
+            // `counts` object (a whole `getMyTurn` fold) plus `feedLastSeenAt`/`newFeedItems` (a
+            // second fold over the feed) for the Welcome-back banner. The banner is now
+            // per-workspace and reads standing `my_turn` card counts off the daily brief, so all
+            // three had no reader left and were pure per-request work on the SPA's first call.
+            // If you need a count here again, prefer the brief's fold over re-adding one.
+            deploymentMode: config.deploymentMode,
+            pro: entitled,
+            // THE AGENTIC FEATURES — Claude Review (+ chat, follow-up, ticket check, auto review),
+            // review memory, AI Fix. CORE, FREE, LOCAL ONLY. TOP-LEVEL and NOT inside `pro`, so
+            // `entitledProCapabilities` can never zero it (the `mlSeverity` argument).
+            ai: agenticAiStatus(),
+            // ML severity/category enrichment of bot comments — FREE TIER, so a TOP-LEVEL field and
+            // NOT part of `pro` above: `entitledProCapabilities` returns all-false for a cloud
+            // account on the free plan, which would hide this from exactly the users it is for.
+            // True iff a severity-api is reachable for this deployment; false under `npx`.
+            mlSeverity: isSeverityApiConfigured(),
+            // The in-app merge conflict resolver. CORE and free, and now registered in BOTH modes —
+            // so this is a constant, kept on the wire because the SPA gates its "Resolve conflicts"
+            // button on it and a field that disappears is a field every caller has to re-learn.
+            // ⚠ NOT a git-version probe: /api/me does not shell out on every SPA boot. A git too old
+            // for `merge-tree --write-tree` is refused by the OPEN route with `git_too_old`.
+            conflictResolver: true,
+            // Chronology's default working-hours zone for a workspace that never set one.
+            workTimeZone: config.defaultWorkTimezone,
+            // Cross-org benchmark consent (cloud-only; always false in local). Drives the Settings toggle.
+            benchmarkOptIn: config.isCloud ? req.account?.benchmarkOptIn ?? false : false,
+            // The LARGE-PR FLAG's threshold, RESOLVED (stored value, else the product default) so no
+            // renderer has to know about the null. TOP-LEVEL and not inside `pro` above: the flag is
+            // free, and `entitledProCapabilities` zeroes that object for free cloud accounts — exactly
+            // this feature's audience (the `mlSeverity` argument, verbatim).
+            largePrCodeLocThreshold: resolveLargePrThreshold(req.account?.largePrCodeLocThreshold ?? null),
+            largePrCodeLocThresholdIsDefault: req.account?.largePrCodeLocThreshold == null,
+            // The BLAST-RADIUS reading settings, RAW and nullable — the one place this response does
+            // NOT resolve a default, and deliberately. The defaults are an 18-number table across
+            // three dial positions living in `packages/shared`, which is types-only on this side
+            // (PACKAGING); resolving here would mean hand-mirroring it forever. The SPA's one
+            // `resolveBlastConfig()` imports that table as a real value instead, so `null` travels and
+            // nothing is duplicated. Free feature → top-level, not inside `pro` (the `mlSeverity`
+            // argument again).
+            blastRadius: req.account?.blastRadiusConfig ?? null,
+            // The MY TURN settings, RAW and nullable (the stored overrides) — the `blastRadius` rule: the
+            // SPA resolves them through the ONE `resolveMyTurnSettings`, so nothing is duplicated here.
+            // Free feature → top-level, not inside `pro` (the `mlSeverity` argument).
+            myTurnSettings: req.account?.myTurnSettings ?? null,
+            // Orgs currently SAML-blocked for this account (empty in the normal case + in local).
+            authNotices: getAuthNotices(accountId),
+            aiUsage,
+        };
+    });
+    // Cross-org benchmark consent (CLOUD-ONLY, opt-in). Setting it true seeds the account's
+    // contributions immediately (best-effort, in the background); false withdraws + deletes them
+    // (handled in setBenchmarkConsent). Available to every cloud account — free or paid — because
+    // the network needs volume to be worth anything (viewing the benchmark is the paid part, later).
+    app.post('/api/me/benchmark-consent', { schema: benchmarkConsentSchema }, async (req, reply) => {
+        if (!config.isCloud) {
+            return reply.code(400).send({ error: 'BadRequest', message: 'Benchmark is cloud-only' });
+        }
+        const accountId = accountIdOf(req);
+        const { optIn } = req.body;
+        await setBenchmarkConsent(accountId, optIn);
+        if (optIn) {
+            // Fire-and-forget: don't block the response on the rollup; a failure is logged, not fatal.
+            void runBenchmarkRollupForAccount(accountId, req.log).catch((err) => req.log.error({ err, accountId }, 'benchmark seed after opt-in failed'));
+        }
+        return { status: 'ok', benchmarkOptIn: optIn };
+    });
+    // The LARGE-PR FLAG's threshold — ONE PER-ACCOUNT SETTING, in lines of CODE churn (the
+    // docs/config/lockfile/generated churn is excluded before the sum; see db/code-loc.ts).
+    //
+    // Deliberately NOT per-workspace and not per-repo: a second grain would need a resolver, and
+    // "which grain am I reading?" is the question the reviewer object spent migration 0045 removing.
+    // `threshold: null` RESETS to the product default rather than storing 1500 — the two states are
+    // "the user has an opinion" and "the user does not", so a future change to the default still
+    // reaches everyone who never overrode it.
+    //
+    // Available in BOTH modes and on every tier: the flag is free, so its setting must be too.
+    // Rate tier: the schema-validated single-column UPDATE falls through `tierFor` to the blanket
+    // `read` bucket, which is DECIDED (and pinned in rate-limit.test.ts), not inherited — it reaches
+    // no GitHub API and no model, exactly like POST /api/me/benchmark-consent beside it.
+    app.post('/api/me/large-pr-threshold', { schema: largePrThresholdSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { threshold } = req.body;
+        // Belt and braces over the JSON schema: `Number.isInteger` also rejects NaN/Infinity, which
+        // a hand-rolled body validator elsewhere could let through as `type: 'integer'` never sees.
+        if (threshold !== null && !(Number.isInteger(threshold) && threshold > 0)) {
+            return reply.code(400).send({
+                error: 'BadRequest',
+                message: 'threshold must be a positive whole number of lines, or null to reset.',
+            });
+        }
+        await setLargePrCodeLocThreshold(accountId, threshold);
+        const body = {
+            status: 'ok',
+            largePrCodeLocThreshold: resolveLargePrThreshold(threshold),
+            largePrCodeLocThresholdIsDefault: threshold == null,
+        };
+        return body;
+    });
+    // The BLAST-RADIUS reading settings — the second ONE-PER-ACCOUNT setting on this route, and
+    // account-grained for the same reasons as the threshold above plus one of its own: the
+    // comparison it feeds is RENDER-TIME, so it rides /api/me and the vis-timeline tooltip (raw
+    // HTML strings, no hooks) can read it off a module cell. A per-workspace value would put a new
+    // "workspace not resolved yet" null-state on four surfaces.
+    //
+    // A PUT rather than a POST because the body is the WHOLE settings object — this replaces the
+    // stored blob, it does not merge into it, and the verb should say so.
+    //
+    // Available in BOTH modes and on every tier: blast radius is free, so its setting must be too.
+    // Rate tier: one schema-validated single-column UPDATE, no GitHub and no model — the blanket
+    // `read` bucket, DECIDED and pinned in rate-limit.test.ts rather than inherited.
+    app.put('/api/me/blast-radius-config', { schema: blastRadiusConfigSchema }, async (req) => {
+        const accountId = accountIdOf(req);
+        const { config: incoming } = req.body;
+        // ⚠ ECHO WHAT WAS STORED, NOT WHAT WAS SENT. The sanitizer drops unknown surfaces and
+        // out-of-range overrides, so returning the request body would let Settings render a choice
+        // the database does not hold — the same disagreement `largePrCodeLocThresholdIsDefault`
+        // exists to prevent one field over.
+        const stored = await setBlastRadiusConfig(accountId, incoming);
+        const body = { status: 'ok', blastRadius: stored };
+        return body;
+    });
+    // The MY TURN settings — the third ONE-PER-ACCOUNT setting on this route: which card types count
+    // as your turn, the order My turn groups them in, and the Do next weights every Pending tab
+    // ranks by. Account-grained because one account is one reader, in every workspace.
+    //
+    // A PUT (the body is the WHOLE settings object, replacing the stored one). ⚠ ECHOES WHAT WAS
+    // STORED: `setMyTurnSettings` compacts to overrides only, so a sent default is not stored and
+    // Settings must render what the database holds, not what it sent.
+    //
+    // No 404: the target is the caller's own account (an unauthenticated cloud call is a 401 at the
+    // gate). Both modes, every tier — the feature is free. Rate tier `read`, DECIDED and pinned in
+    // rate-limit.test.ts: one validated UPDATE, no GitHub and no model.
+    app.put('/api/me/my-turn-settings', { schema: myTurnSettingsSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { settings } = req.body;
+        if (settings !== null) {
+            const problem = validateMyTurnSettings(settings);
+            if (problem != null) {
+                return reply.code(400).send({ error: 'InvalidMyTurnSettings', message: problem });
+            }
+        }
+        const stored = await setMyTurnSettings(accountId, settings);
+        // The brief's roll-up counts are cached for five minutes; a save that switched a type off
+        // must not leave "Elsewhere" lines counting it until the TTL runs out.
+        clearDailyBriefCountsFor(accountId);
+        const body = { status: 'ok', myTurnSettings: stored };
+        return body;
+    });
+    // ---- Data-subject rights (UK/EU GDPR Arts. 15, 17, 20; CCPA/CPRA) ----
+    //
+    // Both are SELF-SERVICE by design. A privacy policy that says "email us to be deleted" is a
+    // promise backed by a human remembering to run SQL; these two routes are the promise backed
+    // by code, and they are what the policy at /privacy §9 points at.
+    // Access + portability: the whole account as one JSON document. The sealed GitHub token is
+    // excluded (see db/export-account.ts) — an export is a file people email to themselves.
+    app.get('/api/me/export', async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const data = await exportAccountData(accountId);
+        if (!data) {
+            return reply.code(404).send({ error: 'NotFound', message: 'Account not found' });
+        }
+        // Content-Disposition so the browser saves a file rather than rendering a huge JSON blob;
+        // the date in the name makes successive exports distinguishable.
+        const stamp = new Date().toISOString().slice(0, 10);
+        reply.header('content-disposition', `attachment; filename="pierre-export-${data.account.githubLogin ?? accountId}-${stamp}.json"`);
+        reply.type('application/json');
+        return data;
+    });
+    // Erasure. Irreversible, and deliberately requires the caller to type their own GitHub login
+    // into `confirmLogin` — not as security (the session already proves who they are) but as
+    // INTENT: this destroys every synced repository and cannot be undone, so a mis-click or a
+    // stray fetch must not be sufficient. The cross-origin guard already blocks a foreign page
+    // from issuing it at all.
+    app.delete('/api/me/account', { schema: deleteAccountSchema }, async (req, reply) => {
+        const account = req.account;
+        if (!account) {
+            return reply.code(401).send({ error: 'Unauthorized', message: 'Sign in first.' });
+        }
+        const { confirmLogin } = req.body;
+        if (!account.githubLogin ||
+            confirmLogin.trim().toLowerCase() !== account.githubLogin.toLowerCase()) {
+            return reply.code(400).send({
+                error: 'BadRequest',
+                message: 'confirmLogin must match your GitHub username exactly.',
+            });
+        }
+        // A local install is a single implicit account synthesized from `gh api user` at every
+        // startup — deleting it would be recreated seconds later, and the user's actual delete
+        // action is removing the SQLite file. Refuse rather than pretend.
+        if (account.isLocal) {
+            return reply.code(400).send({
+                error: 'BadRequest',
+                message: 'This is a local install: there is no hosted account to delete. Remove the ' +
+                    'database file (see `pierre --help` for its location) to erase everything.',
+            });
+        }
+        req.log.warn({ accountId: account.id }, 'account erasure requested');
+        const result = await eraseAccountData(account.id);
+        req.log.warn({ accountId: account.id, reposDeleted: result.reposDeleted }, 'account erased');
+        // Drop the session too, or the browser keeps presenting a cookie for an account that no
+        // longer exists (which resolves to `null` and 401s confusingly).
+        try {
+            req.session.delete();
+        }
+        catch {
+            /* no session plugin in local mode — unreachable here, but harmless */
+        }
+        return { status: 'deleted', reposDeleted: result.reposDeleted };
+    });
+    // The account-wide inbox. Unscoped on purpose (see `getMyTurn`): the browser-notification
+    // watcher reads exactly this call — and without `onePerPr`, which is the board's rule.
+    app.get('/api/my-turn', async (req) => getMyTurn(accountIdOf(req)));
+    // DISMISS / BRING BACK one My Turn subject — a pull request (`pr`) or, for a red default branch,
+    // a repository (`repo`). ⚠ NOT the "Done" routes 0060 deleted: a dismissal lasts only until
+    // something newer happens on the subject, and a subject that leaves your plate discharges it
+    // (db/my-turn-dismissals.ts). DB-only, both modes, free.
+    //
+    // The id is in the PATH; ownership is checked (→ 404, so the family is no existence oracle) and
+    // the composite FK refuses a cross-account pair in the database regardless.
+    app.put('/api/my-turn/dismissals/:kind/:id', async (req, reply) => {
+        const target = parseDismissTarget(req.params);
+        if (target == null) {
+            return reply.code(400).send({ error: 'BadRequest', message: 'Unknown My Turn entry.' });
+        }
+        const accountId = accountIdOf(req);
+        const at = await dismissMyTurn(accountId, target);
+        if (at == null)
+            return reply.code(404).send({ error: 'NotFound', message: 'Not found' });
+        // The brief's roll-up counts are cached for five minutes; a dismissed item must not go on
+        // being counted in the "Elsewhere" lines until the TTL runs out.
+        clearDailyBriefCountsFor(accountId);
+        const body = { target, dismissedAt: at.toISOString() };
+        return body;
+    });
+    app.delete('/api/my-turn/dismissals/:kind/:id', async (req, reply) => {
+        const target = parseDismissTarget(req.params);
+        if (target == null) {
+            return reply.code(400).send({ error: 'BadRequest', message: 'Unknown My Turn entry.' });
+        }
+        const accountId = accountIdOf(req);
+        // Scoped on the row itself, so another account's id deletes nothing — and answers 404.
+        if (!(await restoreMyTurn(accountId, target))) {
+            return reply.code(404).send({ error: 'NotFound', message: 'Not found' });
+        }
+        clearDailyBriefCountsFor(accountId);
+        return reply.code(204).send();
+    });
+}
+/** `:kind/:id` → a target, or null for anything else (a non-integer id, an unknown kind). */
+export function parseDismissTarget(params) {
+    const p = (params ?? {});
+    if (p.kind !== 'pr' && p.kind !== 'repo')
+        return null;
+    const raw = typeof p.id === 'string' ? p.id : '';
+    if (!/^[1-9][0-9]{0,15}$/.test(raw))
+        return null;
+    const id = Number(raw);
+    return Number.isSafeInteger(id) ? { kind: p.kind, id } : null;
+}
+//# sourceMappingURL=me.js.map

package/dist/api/routes/mentions.js

@@ -0,0 +1,22 @@
+import { getScopeMentionCandidates, resolveWorkspaceScope } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Workspace-wide @mention candidates (CORE) — the scope-wide sibling of
+// GET /api/prs/:id/mention-candidates. Powers the ad-hoc Insights "Ask about the workspace" box,
+// whose questions span the whole selected scope rather than one PR.
+//
+// `?workspace=<id>` is a plain integer; absent / unparseable / another tenant's id all resolve to
+// the account's DEFAULT workspace (never a 404 — every id yields the same response shape, so it is
+// not an existence oracle). `resolveWorkspaceScope` turns it into the workspace's repo ids
+// server-side, so a caller cannot widen it, and an empty workspace yields `[]` → no candidates,
+// rather than the account's whole roster. Self + bots excluded. Returns a bare MentionCandidate[]
+// exactly like the PR route so MentionTextarea can consume it directly — each row carrying
+// `isMaintainer` (has merged a PR in the SCOPE's repos), which the picker sorts and shields on.
+export async function mentionsRoutes(app) {
+    app.get('/api/mention-candidates', async (req) => {
+        const q = req.query;
+        const accountId = accountIdOf(req);
+        const scope = await resolveWorkspaceScope(accountId, q.workspace);
+        return getScopeMentionCandidates(accountId, scope.repoIds);
+    });
+}
+//# sourceMappingURL=mentions.js.map

package/dist/api/routes/mergers.js

@@ -0,0 +1,8 @@
+import { getMergers } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Per-repo "merge rights" inference (distinct users who've merged a PR there).
+// Reference data — no filters; the frontend looks it up per timeline row.
+export async function mergersRoutes(app) {
+    app.get('/api/mergers', async (req) => getMergers(accountIdOf(req)));
+}
+//# sourceMappingURL=mergers.js.map

package/dist/api/routes/ml-labels.js

@@ -0,0 +1,109 @@
+import { getMlBacklogForAccount, getPrMlLabels, } from '../../db/ml-labels.js';
+import { isSeverityApiConfigured } from '../../ml/severity-client.js';
+import { getMlEnrichmentState } from '../../sync/ml-enrichment.js';
+import { accountIdOf } from '../plugins/auth.js';
+// ML severity/category labels on BOT-authored text (CORE, FREE TIER — not a Pro capability, so
+// deliberately NOT under /api/pro/, which is 402'd for free cloud accounts and auto-tiered as
+// AI for any mutating verb).
+//
+// BOTH ROUTES ARE PURE DB READS. Nothing here calls the model, spends money or touches GitHub —
+// generation is the background worker's job (sync/ml-enrichment.ts). That is why they are
+// registered UNCONDITIONALLY, even where no severity-api is configured: they answer honestly
+// (an empty label set / `enabled:false`) instead of 404ing, so a deployment that later gains
+// the service needs no client change, and the SPA's own gate is `MeResponse.mlSeverity`.
+export async function mlLabelRoutes(app) {
+    // Every ML label on one PR — THE per-PR index. One request serves every badge on the page
+    // (a 60-thread PR must not become 60 requests), so the client caches it with
+    // `staleTime: Infinity` and each card looks itself up by (targetKind, targetId).
+    //
+    // A target with no label is simply absent from the array: "no label" and "not enriched yet"
+    // are the same thing to a badge, and both mean render nothing.
+    app.get('/api/prs/:id/ml-labels', {
+        schema: {
+            params: {
+                type: 'object',
+                properties: { id: { type: 'integer' } },
+                required: ['id'],
+            },
+        },
+    }, async (req, reply) => {
+        const { id } = req.params;
+        // Ownership lives in the getter, which returns null for a foreign PR (the repo-wide rule
+        // for id-addressed reads).
+        const labels = await getPrMlLabels(id, accountIdOf(req));
+        if (labels === null) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        return { prId: id, labels, generatedAt: new Date().toISOString() };
+    });
+    // (GET /api/bot-severity — the standalone Bots-interface severity rollup — was REMOVED on the
+    // C7 cut list: no SPA consumer since the merged Bots ROI table took its fold off
+    // `getBotAnalytics`. `getBotSeverityRollup` itself stays in db/ml-labels.ts — its exclusion
+    // semantics are the pinned reference the windowed twin declares itself VERBATIM-equal to.)
+    // Live state of the background enrichment worker — what every sync surface polls so that
+    // "sync complete" is not announced while the model is still scoring the text the walk just
+    // fetched. See MlEnrichmentStatus in @pierre-review/shared for why the sync UI needs it.
+    //
+    // NO SCOPE PARAMETER, on purpose: the worker walks every workspace of the account, so a
+    // workspace-scoped backlog would under-report exactly the work that is running.
+    app.get('/api/ml-status', { schema: { querystring: { type: 'object', additionalProperties: false, properties: {} } } }, async (req) => {
+        const accountId = accountIdOf(req);
+        const enabled = isSeverityApiConfigured();
+        const state = getMlEnrichmentState();
+        // Skip the scan entirely when the feature is off: the client is polling only because it
+        // cannot know that until it asks once, and the counts would be meaningless anyway.
+        const backlog = enabled
+            ? await cachedBacklog(accountId)
+            : { pending: 0, unscorable: 0, labelled: 0 };
+        const iso = (ms) => ms == null ? null : new Date(ms).toISOString();
+        return {
+            enabled,
+            running: state.running,
+            pending: backlog.pending,
+            unscorable: backlog.unscorable,
+            labelled: backlog.labelled,
+            scoredThisRun: state.labelled,
+            batchesThisRun: state.batches,
+            failuresThisRun: state.failures,
+            startedAt: iso(state.startedAt),
+            finishedAt: iso(state.finishedAt),
+            pausedUntil: iso(state.pausedUntil),
+            serviceHealthy: state.serviceHealthy,
+            markerFallback: state.markerFallback,
+            generatedAt: new Date().toISOString(),
+        };
+    });
+}
+// ---- Backlog cache ----
+//
+// This route is POLLED — every few seconds while a sync round is open — and its backlog is a
+// bot-set resolve plus three indexed counts PER WORKSPACE. The counts move only when the worker
+// writes (at most a batch every few seconds) or a sync lands, so serving a couple of seconds of
+// staleness costs the reader nothing and stops N pollers from multiplying the scan. A rate-limit
+// tier alone would not help: it caps requests, not the work each one does.
+const BACKLOG_TTL_MS = 3_000;
+const backlogCache = new Map();
+function cachedBacklog(accountId) {
+    const hit = backlogCache.get(accountId);
+    if (hit && Date.now() - hit.at < BACKLOG_TTL_MS)
+        return hit.value;
+    // Cache the PROMISE, not the resolved value, so concurrent polls that arrive while the scan
+    // is still running share it instead of each starting their own.
+    const value = getMlBacklogForAccount(accountId).catch((err) => {
+        // A failed scan must not be cached as a permanent zero, and must not reject every waiter
+        // repeatedly: drop the entry so the next poll retries, and report an honest empty backlog.
+        backlogCache.delete(accountId);
+        throw err;
+    });
+    backlogCache.set(accountId, { at: Date.now(), value });
+    // Bounded: process-wide across tenants in cloud, so evict anything past the window.
+    if (backlogCache.size > 1_000) {
+        const cutoff = Date.now() - BACKLOG_TTL_MS;
+        for (const [id, entry] of backlogCache)
+            if (entry.at < cutoff)
+                backlogCache.delete(id);
+    }
+    return value;
+}
+//# sourceMappingURL=ml-labels.js.map

package/dist/api/routes/open-prs.js

@@ -0,0 +1,35 @@
+import { getOpenPrs, resolveWorkspaceScope } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+// `repoIds` → the `narrow` argument of `resolveWorkspaceScope`, never a scope in its own right.
+// Empty/absent → null = no narrowing (every repo in the workspace).
+function parseIntList(raw) {
+    if (!raw)
+        return null;
+    const ids = raw
+        .split(',')
+        .map((s) => Number.parseInt(s.trim(), 10))
+        .filter((n) => Number.isFinite(n));
+    return ids.length > 0 ? ids : null;
+}
+export async function openPrsRoutes(app) {
+    // Every currently-open PR in the active WORKSPACE (ignores the board's date range).
+    //
+    // `?workspace=<id>` is the scope; `?repoIds=` only narrows within it. This route used to carry
+    // repo ids alone, with `null` meaning "every repo of the account" — so an EMPTY workspace, which
+    // sends no ids, listed the whole account's open PRs, and two workspaces sending no ids collided
+    // in one client cache slot. `resolveWorkspaceScope` returns `membership ∩ (?repoIds= ??
+    // membership)`: always concrete, `[]` for an empty workspace, which `getOpenPrs` renders as an
+    // empty list.
+    app.get('/api/open-prs', async (req) => {
+        const q = req.query;
+        const accountId = accountIdOf(req);
+        const scope = await resolveWorkspaceScope(accountId, q.workspace, parseIntList(q.repoIds));
+        const prs = await getOpenPrs({
+            accountId,
+            repoIds: scope.repoIds,
+            userIds: parseIntList(q.userIds),
+        });
+        return { prs };
+    });
+}
+//# sourceMappingURL=open-prs.js.map