limn-review 0.1.123

package/dist/db/bot-window.js

@@ -0,0 +1,35 @@
+// An explicit record rather than a ternary chain: a new BotWindowKind member is then a COMPILE
+// ERROR here instead of silently falling through to 14 days. `rolling_90` was added for the
+// Insights chat's 90d range and did exactly that under the old ternary.
+const WINDOW_DAYS = {
+    rolling_7: 7,
+    rolling_14: 14,
+    rolling_30: 30,
+    rolling_90: 90,
+    sprint: 14,
+};
+export function botWindowDays(window) {
+    return WINDOW_DAYS[window];
+}
+export function botWindowMs(window) {
+    return botWindowDays(window) * 86_400_000;
+}
+/**
+ * 365.25 ÷ 12. The ONE factor that turns a rate measured over a window into a rate per month.
+ *
+ * ⚠ IT MUST EQUAL `DAYS_PER_MONTH` IN `packages/pro/src/bots/benchmark/cost.ts`, which the plugin
+ * declares separately because production plugin code may only `import type` from `shared` and may
+ * not import from core at all. Two numbers, one fact: if these ever diverge, the Bots → ROI table
+ * and the Bots → Benchmark rollup will quote different money for the same bot at the same price,
+ * one tab apart. `benchmark-cost.test.ts` pins the plugin's to six places; `bot-analytics` tests
+ * pin this one.
+ *
+ * ⚠ AND IT IS LOAD-BEARING, NOT COSMETIC. `costPerActedOnUsd` shipped as `monthlyPrice ÷ actedOn`,
+ * where `actedOn` is counted over the SELECTED WINDOW — a month's numerator over a fortnight's
+ * denominator. On a real reviewer that read $2.23 beside the benchmark's $21.24 for the same bot
+ * and the same $49, with no way for a reader to reconcile them, and it erred in the direction that
+ * flatters the bot. Both figures are now monthly rates; they differ only by the window each was
+ * measured over, which each surface states.
+ */
+export const DAYS_PER_MONTH = 30.44;
+//# sourceMappingURL=bot-window.js.map

package/dist/db/branch-queries.js

@@ -0,0 +1,310 @@
+import { and, desc, eq, gte, inArray } from 'drizzle-orm';
+import { db, schema } from './client.js';
+const { repos, users, branchCommits, pullRequests } = schema;
+// How many merged PRs the expanded row lists per repo. DELIBERATELY far under what the sync
+// retains (`BRANCH_COMMIT_WINDOW` = 100 commits, feeding `getBranchTrends`): the list is a
+// glance, deeper history is the trend strip's job — and the cap keeps the hot workspace-wide
+// strip's WIRE payload lean. ⚠ The DB read below is bounded by BRANCH_COMMIT_WINDOW × repos,
+// not this cap — the JS loop discards the surplus. Accepted for now (indexed read, 60s client
+// cache); if it ever matters, the fix is a per-repo windowed subquery, not a lower sync window.
+const READ_PR_CAP = 10;
+/** The key `trunkHeadFailingChecks` answers under: a sha is unique only WITHIN a repo. */
+export function trunkHeadKey(repoId, sha) {
+    return `${repoId}:${sha}`;
+}
+/**
+ * THE ONE READER OF A DEFAULT-BRANCH HEAD'S FAILING CHECKS — `/api/branch-status` and the Pending
+ * board's red-trunk cards (ci_failing's trunk arm, the promoted `trunk_red` my_turn card) both read
+ * through it, so the two surfaces cannot name different checks for one red head.
+ *
+ * The head's own `branch_commits` row holds them (written by the branch snapshot in the same
+ * transaction as `repos.defaultBranchCiStatus`). Matched by SHA, NEVER by position: the commit
+ * window is ordered by committer date, and a backdated committer date (a rebase, or a cherry-pick
+ * with --committer-date-is-author-date) can sort the head anywhere in it.
+ *
+ * Account-scoped, one query over the `(accountId, repoId, sha)` unique. The `inArray × inArray`
+ * predicate over-matches (repo A's row for a sha only repo B asked about), so the result is keyed
+ * by the PAIR (`trunkHeadKey`) and only requested pairs are kept. A head with no row — outside the
+ * stored window, or not synced yet — or a green one (NULL) is simply absent: "no names", never
+ * "nothing failed".
+ */
+export async function trunkHeadFailingChecks(accountId, heads) {
+    const out = new Map();
+    if (heads.length === 0)
+        return out;
+    const wanted = new Set(heads.map((h) => trunkHeadKey(h.repoId, h.sha)));
+    const rows = await db
+        .select({
+        repoId: branchCommits.repoId,
+        sha: branchCommits.sha,
+        failingChecks: branchCommits.failingChecks,
+    })
+        .from(branchCommits)
+        .where(and(eq(branchCommits.accountId, accountId), inArray(branchCommits.repoId, [...new Set(heads.map((h) => h.repoId))]), inArray(branchCommits.sha, [...new Set(heads.map((h) => h.sha))])))
+        .execute();
+    for (const r of rows) {
+        const key = trunkHeadKey(r.repoId, r.sha);
+        if (r.failingChecks != null && wanted.has(key))
+            out.set(key, r.failingChecks);
+    }
+    return out;
+}
+/**
+ * Default-branch health for every repo in scope: the stored head snapshot plus that branch's
+ * recent commits.
+ *
+ * Account-scoped on BOTH tables independently. `branch_commits.accountId` is denormalized
+ * precisely so the commit read is a single indexed predicate rather than a join back through
+ * `repos` — but the repo listing is scoped too, so a `repoIds` array naming another tenant's
+ * repos selects nothing rather than leaking rows.
+ *
+ * Repos with no synced branch data still appear, with nulls: the client renders one row per
+ * repo in the visible set, and "unknown" is the truthful state for a repo added a minute ago.
+ *
+ * `repoIds` null/empty ⇒ every repo the account owns.
+ */
+export async function getBranchStatus(accountId, repoIds) {
+    const scoped = repoIds != null && repoIds.length > 0;
+    const repoRows = await db
+        .select({
+        id: repos.id,
+        branchName: repos.defaultBranchName,
+        headSha: repos.defaultBranchHeadSha,
+        ciStatus: repos.defaultBranchCiStatus,
+        updatedAt: repos.defaultBranchUpdatedAt,
+    })
+        .from(repos)
+        .where(scoped
+        ? and(eq(repos.accountId, accountId), inArray(repos.id, repoIds))
+        : eq(repos.accountId, accountId))
+        .execute();
+    if (repoRows.length === 0)
+        return { repos: [] };
+    const ids = repoRows.map((r) => r.id);
+    // One pass over the account's commits for the scoped repos, newest first; grouped into their
+    // merged PRs in JS. The whole set is at most `BRANCH_COMMIT_WINDOW × repos` rows (the sync
+    // trims per repo; the grouping below then keeps only READ_PR_CAP PR groups of each), so there
+    // is no per-repo query fan-out and no unbounded result. Commit authors are deliberately not
+    // selected any more — the listed unit is the PR, whose author comes off the PR row below.
+    const commitRows = await db
+        .select({
+        repoId: branchCommits.repoId,
+        sha: branchCommits.sha,
+        messageHeadline: branchCommits.messageHeadline,
+        committedAt: branchCommits.committedAt,
+        ciStatus: branchCommits.ciStatus,
+        prNumber: branchCommits.prNumber,
+    })
+        .from(branchCommits)
+        .where(and(eq(branchCommits.accountId, accountId), inArray(branchCommits.repoId, ids)))
+        .orderBy(desc(branchCommits.committedAt))
+        .execute();
+    // Resolve each commit's associated PR NUMBER (stored by the branch sync) to the LOCAL
+    // pull_requests row, so the client's chip can open that PR's own detail tab instead of leaving
+    // the app. One extra query, bounded by the distinct numbers across the scoped repos' windows.
+    //
+    // Isolation: the predicate carries `accountId` AND restricts to `ids` — the repo ids already
+    // resolved from the account-scoped `repos` listing above — so a number can only ever match a PR
+    // THIS account synced. A number that belongs to another tenant's data cannot resolve.
+    //
+    // The map key is `(repoId, number)`, NEVER the bare number: PR numbers are unique only WITHIN a
+    // repo, so a number-keyed map would cross-link repo A's #12 onto repo B's commit and open the
+    // wrong PR. The `inArray × inArray` predicate deliberately over-matches (it can return repo A's
+    // #12 when only repo B asked for it); keying by the pair is what makes that harmless. A future
+    // "simplification" to a bare number key is silently wrong, which is why there is a seeded test
+    // for it rather than only this comment.
+    const prNumbers = [
+        ...new Set(commitRows.map((c) => c.prNumber).filter((n) => n != null)),
+    ];
+    const prByRepoNumber = new Map();
+    if (prNumbers.length > 0) {
+        const prRows = await db
+            .select({
+            id: pullRequests.id,
+            repoId: pullRequests.repoId,
+            number: pullRequests.number,
+            title: pullRequests.title,
+            mergedAt: pullRequests.mergedAt,
+            authorLogin: users.githubLogin,
+            authorAvatarUrl: users.avatarUrl,
+        })
+            .from(pullRequests)
+            .leftJoin(users, eq(users.id, pullRequests.authorId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(pullRequests.repoId, ids), inArray(pullRequests.number, prNumbers)))
+            .execute();
+        for (const p of prRows)
+            prByRepoNumber.set(`${p.repoId}:${p.number}`, {
+                id: p.id,
+                title: p.title,
+                mergedAt: p.mergedAt,
+                authorLogin: p.authorLogin ?? null,
+                authorAvatarUrl: p.authorAvatarUrl ?? null,
+            });
+    }
+    // The HEAD commit's failing checks, through THE ONE READER the Pending cards use too — matched by
+    // SHA, never by position (see `trunkHeadFailingChecks`).
+    const failingByRepoSha = await trunkHeadFailingChecks(accountId, repoRows.flatMap((r) => (r.headSha != null ? [{ repoId: r.id, sha: r.headSha }] : [])));
+    const groupsByRepo = new Map();
+    const lastCommitAtByRepo = new Map();
+    for (const c of commitRows) {
+        // Newest raw commit per repo — INDEPENDENT of PR membership, so a direct-push-only repo
+        // still reads as recently active (the newest commit's own timestamp, never our observation
+        // time: `defaultBranchUpdatedAt` is when we LOOKED, which would make an idle repo read as
+        // freshly active).
+        if (!lastCommitAtByRepo.has(c.repoId))
+            lastCommitAtByRepo.set(c.repoId, c.committedAt);
+        if (c.prNumber == null)
+            continue;
+        const groups = groupsByRepo.get(c.repoId) ?? new Map();
+        groupsByRepo.set(c.repoId, groups);
+        const g = groups.get(c.prNumber);
+        if (g == null) {
+            groups.set(c.prNumber, {
+                prNumber: c.prNumber,
+                newestCommitAt: c.committedAt,
+                // The group's rollup is its NEWEST commit's — for a merge-commit PR that is the merge
+                // commit itself, i.e. the trunk state this PR produced. Nullable column ("no CI
+                // observed") reads as 'unknown' on the wire.
+                ciStatus: (c.ciStatus ?? 'unknown'),
+                commits: [{ sha: c.sha, messageHeadline: c.messageHeadline }],
+            });
+        }
+        else {
+            g.commits.push({ sha: c.sha, messageHeadline: c.messageHeadline });
+        }
+    }
+    return {
+        repos: repoRows.map((r) => {
+            const groups = [...(groupsByRepo.get(r.id)?.values() ?? [])];
+            const mergedPrs = groups
+                .map((g) => {
+                const pr = prByRepoNumber.get(`${r.id}:${g.prNumber}`);
+                return {
+                    prNumber: g.prNumber,
+                    // Null while prNumber is set means "that PR isn't synced for this account"
+                    // (squash-merged before the backfill window, or a repo added later): the client
+                    // links out to github.com rather than dropping the reference.
+                    prId: pr?.id ?? null,
+                    title: pr?.title ?? null,
+                    authorLogin: pr?.authorLogin ?? null,
+                    authorAvatarUrl: pr?.authorAvatarUrl ?? null,
+                    // "In the order they were merged": the PR row's mergedAt when resolved, else the
+                    // newest consolidated commit's time — never null, so the sort below is total.
+                    mergedAt: (pr?.mergedAt ?? g.newestCommitAt).toISOString(),
+                    ciStatus: g.ciStatus,
+                    commits: g.commits,
+                };
+            })
+                .sort((a, b) => b.mergedAt.localeCompare(a.mergedAt))
+                .slice(0, READ_PR_CAP);
+            return {
+                repoId: r.id,
+                branchName: r.branchName,
+                headSha: r.headSha,
+                ciStatus: (r.ciStatus ?? 'unknown'),
+                // Derived, not a second stored copy: the head commit's own row already holds its failures.
+                // Matched by SHA (see trunkHeadFailingChecks); no match — a trimmed head, or nothing
+                // synced yet — degrades to the CI label alone.
+                failingChecks: r.headSha != null ? (failingByRepoSha.get(trunkHeadKey(r.id, r.headSha)) ?? []) : [],
+                lastCommitAt: lastCommitAtByRepo.get(r.id)?.toISOString() ?? null,
+                mergedPrs,
+            };
+        }),
+    };
+}
+// Trend window for `getBranchTrends`. Exported because the sync side keys off the SAME number
+// twice: the trim in sync/branch-status.ts retains rows inside this window even beyond its
+// 100-commit bound (so the one-time history backfill survives the next tick), and the backfill
+// itself fetches `history(since: now − TREND_DAYS)`. This read filter is ALSO where the "no
+// year-old bars" promise lives — the writer never deletes a row the newest-100 bound protects,
+// however old (see the trim's comment).
+export const TREND_DAYS = 90;
+const DAY_MS = 86_400_000;
+/**
+ * The ONE lazy series behind an expanded default-branch row: per UTC day, failing trunk commits
+ * (the DayStrip cells) and PRs merged into the default branch (the line band above them) — a
+ * single shared axis, dense from the oldest retained commit day to today, so the two facts
+ * align cell-for-cell.
+ *
+ * Fetched only when a row expands — deliberately NOT part of `getBranchStatus`, whose payload is
+ * a hot workspace-wide read. Bucketed in JS rather than SQL date functions (dialect-divergent),
+ * which is fine because the sync trims `branch_commits` to ≤100 rows per repo and the merged-PR
+ * read is bounded by the axis window.
+ *
+ * Returns null when the repo isn't owned by the account (→ 404 at the route).
+ */
+export async function getBranchTrends(accountId, repoId) {
+    const repoRows = await db
+        .select({ id: repos.id, defaultBranchName: repos.defaultBranchName })
+        .from(repos)
+        .where(and(eq(repos.id, repoId), eq(repos.accountId, accountId)))
+        .execute();
+    const repo = repoRows[0];
+    if (repo == null)
+        return null;
+    const now = Date.now();
+    const commitRows = await db
+        .select({ committedAt: branchCommits.committedAt, ciStatus: branchCommits.ciStatus })
+        .from(branchCommits)
+        .where(and(eq(branchCommits.accountId, accountId), eq(branchCommits.repoId, repoId), gte(branchCommits.committedAt, new Date(now - TREND_DAYS * DAY_MS))))
+        .execute();
+    const failedByDay = new Map();
+    const passedByDay = new Map();
+    for (const c of commitRows) {
+        const day = c.committedAt.toISOString().slice(0, 10);
+        // "Failed" is the red rollup pair — the same predicate as the strip's own failing count —
+        // and "passed" is 'success' alone: pending/unknown/null are neither, so a day's cell can
+        // legitimately show fewer commits than landed.
+        if (c.ciStatus === 'failure' || c.ciStatus === 'error') {
+            failedByDay.set(day, (failedByDay.get(day) ?? 0) + 1);
+        }
+        else if (c.ciStatus === 'success') {
+            passedByDay.set(day, (passedByDay.get(day) ?? 0) + 1);
+        }
+    }
+    // The axis is dense from the OLDEST RETAINED commit day to today, zero-filled — but never
+    // padded back to the full 90 days: on a busy repo the 100-commit cap trims inside the date
+    // window, and days before the oldest retained commit are trimmed history, not quiet days.
+    // Padding them would draw a green past we never observed. The merged-PR line shares this
+    // axis on purpose (that is the whole point of the single chart), so it is truncated to the
+    // same span even though pullRequests could answer further back.
+    const oldestDay = commitRows
+        .map((c) => c.committedAt.toISOString().slice(0, 10))
+        .sort()[0];
+    const daily = [];
+    if (oldestDay != null) {
+        const startMs = Date.parse(`${oldestDay}T00:00:00Z`);
+        const endMs = Date.parse(`${new Date(now).toISOString().slice(0, 10)}T00:00:00Z`);
+        // PRs merged into the default branch, counted per UTC day of `mergedAt`. `baseRefName =
+        // <default branch>` excludes NULL bases by construction (SQL equality) and on PURPOSE — an
+        // unhydrated base is not evidence the PR landed on trunk. A repo whose default branch name
+        // we haven't synced yet has nothing attributable, so its line is flat zero rather than a
+        // guess.
+        const mergedByDay = new Map();
+        if (repo.defaultBranchName != null) {
+            const mergedRows = await db
+                .select({ mergedAt: pullRequests.mergedAt })
+                .from(pullRequests)
+                .where(and(eq(pullRequests.accountId, accountId), eq(pullRequests.repoId, repoId), eq(pullRequests.baseRefName, repo.defaultBranchName), gte(pullRequests.mergedAt, new Date(startMs))))
+                .execute();
+            for (const p of mergedRows) {
+                // The predicate already excludes NULL mergedAt; the guard is for the type, not the data.
+                if (p.mergedAt == null)
+                    continue;
+                const day = p.mergedAt.toISOString().slice(0, 10);
+                mergedByDay.set(day, (mergedByDay.get(day) ?? 0) + 1);
+            }
+        }
+        for (let ms = startMs; ms <= endMs; ms += DAY_MS) {
+            const day = new Date(ms).toISOString().slice(0, 10);
+            daily.push({
+                day,
+                failed: failedByDay.get(day) ?? 0,
+                passed: passedByDay.get(day) ?? 0,
+                merged: mergedByDay.get(day) ?? 0,
+            });
+        }
+    }
+    return { repoId, daily };
+}
+//# sourceMappingURL=branch-queries.js.map

package/dist/db/change-shape.js

@@ -0,0 +1,243 @@
+import { isNonCodeFile } from './code-loc.js';
+// ============================================================================
+// CHANGE SHAPE — is this pull request's code churn actually CODE?
+// ============================================================================
+//
+// Blast radius asks how far a change can REACH, and answers it from the file paths. That is the
+// right question and the wrong half of the evidence in one specific case: a change to the
+// COMMENTS inside a high-consequence file. A real one —
+//
+//     golang/go#80721 "crypto/hpke: document sequence counter size"
+//     src/crypto/hpke/hpke.go, +4 −2, every changed line a `//` doc comment
+//
+// — landed as HIGH, because `crypto/` is one of the contract surfaces. The path is right about
+// the file and wrong about the change. This module reads the PATCH and says which.
+//
+// ---- WHAT IT ANSWERS, AND WHAT IT DELIBERATELY DOES NOT --------------------
+//
+//   'comments'   — every changed line in every code file is a comment or blank.
+//   'formatting' — the added and removed lines are the SAME lines modulo whitespace.
+//   'code'       — something else changed. The overwhelming majority.
+//   null         — we could not tell, and that is a first-class answer (see below).
+//
+// ⚠ IMPORTS WERE CONSIDERED AND DELIBERATELY LEFT OUT. Reordering imports is trivial; ADDING one
+// means the file now uses something it did not, which is a real change with real reach. The two
+// are one line apart in a diff and telling them apart needs more than a line matcher, so the
+// honest move is to not claim either. If it is ever added it belongs beside `deps` — carried for
+// narration, never as a reason to lower a level.
+//
+// ---- THE CONSERVATIVE RULE, WHICH IS THE WHOLE DESIGN ----------------------
+//
+// ⚠ EVERY UNCERTAINTY RESOLVES TO "NOT TRIVIAL". An unknown file extension, a patch GitHub did
+// not give us, a block comment we cannot bound — all of them return `code` or `null`, never
+// `comments`. That asymmetry is deliberate and it is the only thing that makes this safe to wire
+// into a level: the failure mode of a wrong `code` is a pull request that stays HIGH and gets
+// read carefully, and the failure mode of a wrong `comments` is a maintainer waving through a
+// change to a crypto file. Those are not equally bad.
+/** Single-line comment markers by file extension. An extension absent from this map is a
+ *  language we do not claim to understand, and its file makes the whole answer `code`. */
+const LINE_COMMENT = {
+    // C-family and friends
+    ts: ['//'], tsx: ['//'], js: ['//'], jsx: ['//'], mjs: ['//'], cjs: ['//'], mts: ['//'], cts: ['//'],
+    go: ['//'], java: ['//'], c: ['//'], h: ['//'], cc: ['//'], cpp: ['//'], hpp: ['//'], cxx: ['//'],
+    cs: ['//'], rs: ['//'], swift: ['//'], kt: ['//'], kts: ['//'], scala: ['//'], dart: ['//'],
+    php: ['//', '#'], m: ['//'], mm: ['//'], zig: ['//'], v: ['//'], groovy: ['//'],
+    // Hash-comment languages
+    py: ['#'], rb: ['#'], sh: ['#'], bash: ['#'], zsh: ['#'], pl: ['#'], pm: ['#'], r: ['#'],
+    ex: ['#'], exs: ['#'], nim: ['#'], cr: ['#'], tcl: ['#'],
+    // Dash-comment languages
+    sql: ['--'], lua: ['--'], hs: ['--'], elm: ['--'], ada: ['--'],
+    // Others
+    erl: ['%'], hrl: ['%'], tex: ['%'], clj: [';'], cljs: [';'], el: [';'], lisp: [';'], scm: [';'],
+    vim: ['"'], ini: [';', '#'], jl: ['#'],
+};
+/** Block comment delimiters by extension. Absent = the language has none we track, and a file
+ *  whose changed lines are not all single-line comments is simply `code`. */
+const BLOCK_COMMENT = {
+    ts: [['/*', '*/']], tsx: [['/*', '*/']], js: [['/*', '*/']], jsx: [['/*', '*/']],
+    mjs: [['/*', '*/']], cjs: [['/*', '*/']], mts: [['/*', '*/']], cts: [['/*', '*/']],
+    go: [['/*', '*/']], java: [['/*', '*/']], c: [['/*', '*/']], h: [['/*', '*/']],
+    cc: [['/*', '*/']], cpp: [['/*', '*/']], hpp: [['/*', '*/']], cxx: [['/*', '*/']],
+    cs: [['/*', '*/']], rs: [['/*', '*/']], swift: [['/*', '*/']], kt: [['/*', '*/']],
+    kts: [['/*', '*/']], scala: [['/*', '*/']], dart: [['/*', '*/']], php: [['/*', '*/']],
+    m: [['/*', '*/']], mm: [['/*', '*/']], groovy: [['/*', '*/']], sql: [['/*', '*/']],
+    // ⚠ Python's triple-quoted strings are STRINGS, not comments — but a changed docstring is the
+    // exact case this module exists for, and a bare triple-quoted expression statement has no other
+    // use. Tracked as a block, and the conservative rule covers the misreads: a multi-line string
+    // assigned to a variable would be misclassified as a comment, so a changed one reports
+    // `comments` when it is really data. That is the one known false-trivial, it is bounded to
+    // Python, and it still cannot take a level below MEDIUM.
+    py: [['"""', '"""'], ["'''", "'''"]],
+    lua: [['--[[', ']]']],
+};
+function extensionOf(path) {
+    const p = path.replace(/\\/g, '/').toLowerCase();
+    const base = p.slice(p.lastIndexOf('/') + 1);
+    const i = base.lastIndexOf('.');
+    if (i <= 0)
+        return '';
+    return base.slice(i + 1);
+}
+/** Split a REST `patch` into hunks, each a list of marked lines. Header lines (`@@`, `\ No
+ *  newline at end of file`) are dropped. */
+function hunksOf(patch) {
+    const out = [];
+    let cur = null;
+    for (const raw of patch.split('\n')) {
+        if (raw.startsWith('@@')) {
+            cur = [];
+            out.push(cur);
+            continue;
+        }
+        if (cur == null)
+            continue;
+        if (raw.startsWith('\\'))
+            continue; // ""
+        const marker = raw[0];
+        if (marker === '+' || marker === '-' || marker === ' ') {
+            cur.push({ marker, text: raw.slice(1) });
+        }
+        else if (raw === '') {
+            // An empty line in a patch is a context line whose content is empty.
+            cur.push({ marker: ' ', text: '' });
+        }
+    }
+    return out;
+}
+/**
+ * Are every one of this hunk's CHANGED lines a comment or blank?
+ *
+ * Block state is tracked across the whole hunk INCLUDING context lines, because those are what
+ * tell us whether we are inside a comment when a changed line arrives.
+ *
+ * ⚠ A HUNK CAN BEGIN INSIDE A BLOCK COMMENT and the patch does not say so. That is detectable:
+ * if the first delimiter we meet is a CLOSE, we started inside one. Anything we still cannot
+ * bound returns false.
+ */
+function hunkIsCommentOnly(lines, singles, blocks) {
+    // Pre-scan for the "started inside a block" case.
+    let inBlock = null;
+    if (blocks.length > 0) {
+        outer: for (const l of lines) {
+            const t = l.text;
+            for (const b of blocks) {
+                const openAt = t.indexOf(b[0]);
+                const closeAt = t.indexOf(b[1]);
+                if (openAt !== -1 && (closeAt === -1 || closeAt > openAt))
+                    break outer; // opened first
+                if (closeAt !== -1) {
+                    inBlock = b; // a close with no open before it — the hunk began inside this block
+                    break outer;
+                }
+            }
+        }
+    }
+    for (const l of lines) {
+        const trimmed = l.text.trim();
+        const changed = l.marker !== ' ';
+        let isCommentLine = inBlock != null;
+        if (inBlock != null) {
+            // Inside a block: it stays a comment line, and may close here.
+            if (trimmed.includes(inBlock[1])) {
+                const after = trimmed.slice(trimmed.indexOf(inBlock[1]) + inBlock[1].length).trim();
+                inBlock = null;
+                // Code after the closing delimiter on the same line means this is not purely a comment.
+                if (after !== '' && changed)
+                    return false;
+            }
+        }
+        else if (trimmed === '') {
+            isCommentLine = true;
+        }
+        else if (singles.some((s) => trimmed.startsWith(s))) {
+            isCommentLine = true;
+        }
+        else {
+            // Does a block open here, with nothing but whitespace before it?
+            const opener = blocks.find((b) => trimmed.startsWith(b[0]));
+            if (opener) {
+                isCommentLine = true;
+                const rest = trimmed.slice(opener[0].length);
+                const closeAt = rest.indexOf(opener[1]);
+                if (closeAt === -1) {
+                    inBlock = opener;
+                }
+                else {
+                    // Opened and closed on one line; anything after it is code.
+                    const after = rest.slice(closeAt + opener[1].length).trim();
+                    if (after !== '' && changed)
+                        return false;
+                }
+            }
+        }
+        if (changed && !isCommentLine)
+            return false;
+    }
+    // ⚠ An unterminated block at the end of the hunk means we never saw it close. The lines we
+    // accepted were inside it, which is fine — the state simply does not carry to the next hunk,
+    // and each hunk re-derives its own.
+    return true;
+}
+/** Whitespace-insensitive key for the formatting comparison. */
+const wsKey = (s) => s.replace(/\s+/g, '');
+/**
+ * Classify one pull request's code churn from its per-file patches.
+ *
+ * `files` is the REST `/pulls/:n/files` shape. A file with no `patch` (GitHub omits it for
+ * binaries and for very large diffs) makes the answer `null` — we did not see the change, so we
+ * do not get to describe it.
+ *
+ * ⚠ NON-CODE FILES ARE EXCLUDED, not judged. Documentation and config have their own place in
+ * the blast fold (`nonCodeFiles`); a README beside a comment-only Go change must not make the
+ * answer `code`. If NO code file remains there is nothing for this module to say — the existing
+ * `codeFiles === 0` rules already handle that pull request — so it returns null.
+ */
+export function classifyChangeShape(files) {
+    const code = files.filter((f) => typeof f?.path === 'string' && !isNonCodeFile(f.path));
+    if (code.length === 0)
+        return null;
+    let allComments = true;
+    const addedKeys = [];
+    const removedKeys = [];
+    for (const f of code) {
+        const patch = f.patch;
+        // ⚠ NO PATCH, NO CLAIM. GitHub omits it for binaries and oversized diffs.
+        if (typeof patch !== 'string' || patch === '')
+            return null;
+        const ext = extensionOf(f.path);
+        const singles = LINE_COMMENT[ext];
+        const blocks = BLOCK_COMMENT[ext] ?? [];
+        const hunks = hunksOf(patch);
+        if (hunks.length === 0)
+            return null;
+        for (const h of hunks) {
+            for (const l of h) {
+                if (l.marker === '+')
+                    addedKeys.push(wsKey(l.text));
+                else if (l.marker === '-')
+                    removedKeys.push(wsKey(l.text));
+            }
+            // An unknown language can still be `formatting` (that comparison needs no syntax), but it
+            // can never be `comments`.
+            if (allComments) {
+                if (singles == null)
+                    allComments = false;
+                else if (!hunkIsCommentOnly(h, singles, blocks))
+                    allComments = false;
+            }
+        }
+    }
+    if (allComments)
+        return 'comments';
+    // FORMATTING — the same lines came back, differing only in whitespace. Compared as sorted
+    // multisets so a reorder within the hunk still counts, and requiring a non-empty change so a
+    // patch with no +/- lines at all does not read as a formatting change.
+    if (addedKeys.length > 0 || removedKeys.length > 0) {
+        const a = [...addedKeys].filter((s) => s !== '').sort();
+        const b = [...removedKeys].filter((s) => s !== '').sort();
+        if (a.length === b.length && a.every((v, i) => v === b[i]))
+            return 'formatting';
+    }
+    return 'code';
+}
+//# sourceMappingURL=change-shape.js.map

package/dist/db/changepoint.js

@@ -0,0 +1,75 @@
+// Pure changepoint detection over a weekly series — the unattributed half of the advisor's
+// verification loop ("something changed around the 3rd, cause unknown"). Same robust idiom as
+// weeklyAnomalies (queries.ts): medians + MAD, never means — a bot's weekly volume is bursty
+// and a single spike must not manufacture a "change". No DB, no I/O, CI-tested directly.
+//
+// Semantics: a candidate split at index i compares values[0..i) against values[i..n). Both
+// segments need MIN_BASELINE_POINTS non-null points or the split is unjudgeable (thin data →
+// no claim, never a guess). The score is a robust z: |medianAfter − medianBefore| divided by
+// the MAD-derived sigma of the POOLED residuals (each value against its own segment's
+// median), floored at `minScale` so a near-constant series can't divide by ~0 into
+// significance. Nulls (no-data weeks — the null-vs-zero policy) are skipped, not imputed.
+export const CHANGEPOINT_Z = 3; // same bar as ANOMALY_Z — ≥3 robust SDs is an exception
+export const MIN_BASELINE_POINTS = 4; // fewer and "typical" isn't yet meaningful, per side
+function medianOf(values) {
+    if (values.length === 0)
+        return null;
+    const sorted = [...values].sort((a, b) => a - b);
+    const mid = Math.floor(sorted.length / 2);
+    return sorted.length % 2 === 1 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+}
+function evaluateSplit(values, index, minScale) {
+    const before = values.slice(0, index).filter((v) => v != null);
+    const after = values.slice(index).filter((v) => v != null);
+    if (before.length < MIN_BASELINE_POINTS || after.length < MIN_BASELINE_POINTS)
+        return null;
+    const beforeMedian = medianOf(before);
+    const afterMedian = medianOf(after);
+    // Pooled residuals against each value's OWN segment median: the spread that remains once
+    // the hypothesised step is accounted for. A true step change leaves small residuals on both
+    // sides, so the z is large; noise leaves large residuals and the z collapses.
+    const residuals = [
+        ...before.map((v) => Math.abs(v - beforeMedian)),
+        ...after.map((v) => Math.abs(v - afterMedian)),
+    ];
+    const mad = medianOf(residuals);
+    const sigma = Math.max(1.4826 * mad, minScale);
+    const z = Math.abs(afterMedian - beforeMedian) / sigma;
+    if (z < CHANGEPOINT_Z)
+        return null;
+    return {
+        index,
+        beforeMedian,
+        afterMedian,
+        direction: afterMedian > beforeMedian ? 'up' : 'down',
+        z,
+    };
+}
+/**
+ * Detect changepoints in a weekly series. With `anchors` (candidate split indices — e.g. the
+ * weeks of known config events) only those splits are evaluated and every significant one is
+ * returned, in index order. Without anchors, every valid split is scanned and only the single
+ * BEST split comes back (zero or one element): one series, one strongest claim — reporting
+ * every index over the bar would list the same step three times as the window slides past it.
+ */
+export function detectChangepoints(values, opts) {
+    if (opts.anchors) {
+        const out = [];
+        for (const index of [...opts.anchors].sort((a, b) => a - b)) {
+            if (index <= 0 || index >= values.length)
+                continue;
+            const cp = evaluateSplit(values, index, opts.minScale);
+            if (cp)
+                out.push(cp);
+        }
+        return out;
+    }
+    let best = null;
+    for (let index = 1; index < values.length; index++) {
+        const cp = evaluateSplit(values, index, opts.minScale);
+        if (cp && (best == null || cp.z > best.z))
+            best = cp;
+    }
+    return best ? [best] : [];
+}
+//# sourceMappingURL=changepoint.js.map