limn-review 0.1.123

package/dist/db/cleanup.js

@@ -0,0 +1,36 @@
+import { and, eq, inArray, isNull, or, sql } from 'drizzle-orm';
+import { db, schema } from './client.js';
+import { config } from '../config.js';
+// One-time / idempotent maintenance run at startup.
+//
+// GitHub wraps inline-only reviews in an empty "commented" review, which the
+// sync used to record as a `review_submitted` event. Those wrappers duplicate
+// the inline `review_comment` markers on the timeline. New syncs no longer emit
+// them (see sync/upsert.ts), but pre-existing rows linger because upserts only
+// update. This removes them; it also catches reviews whose summary body was
+// later cleared on GitHub. Cheap and safe to run every boot.
+//
+// Written as portable drizzle (no raw better-sqlite3 / db.execute) so it runs on
+// both dialects; the count comes from `.returning().length` (dialect-neutral).
+export async function cleanupRedundantReviewEvents() {
+    // In cloud "lean storage" mode (config.persistBodies false) reviews.body is
+    // always null, so the body-emptiness signal this relies on is unavailable — and
+    // unnecessary: persistPr already only emits review_submitted for *substantive*
+    // reviews (it checks the in-memory GraphQL body, not the stored one), and cloud
+    // starts empty, so there are no wrapper events to remove. Skipping here avoids
+    // wrongly deleting markers for substantive "commented" reviews.
+    if (!config.persistBodies)
+        return 0;
+    const { events, reviews } = schema;
+    const emptyCommentedReviews = db
+        .select({ id: reviews.id })
+        .from(reviews)
+        .where(and(eq(reviews.state, 'commented'), or(isNull(reviews.body), eq(sql `trim(${reviews.body})`, ''))));
+    const deleted = await db
+        .delete(events)
+        .where(and(eq(events.type, 'review_submitted'), eq(events.refTable, 'reviews'), inArray(events.refId, emptyCommentedReviews)))
+        .returning({ id: events.id })
+        .execute();
+    return deleted.length;
+}
+//# sourceMappingURL=cleanup.js.map

package/dist/db/client.js

@@ -0,0 +1,102 @@
+// Mode-aware database client.
+//
+//   local  → better-sqlite3 (synchronous engine) + the sqlite-core schema
+//   cloud  → node-postgres Pool + the pg-core schema
+//
+// The whole app talks to `db` through the PORTABLE async surface only
+// (`await builder` / `.execute()` / `.returning().execute()` / runTransaction) —
+// the empirically-verified subset that behaves identically on both drivers (see
+// the probe in the cloud-refactor notes). `db` is TYPED as the Postgres drizzle
+// instance so any stray `.get()/.all()/.run()` (better-sqlite3-only) is a compile
+// error; at runtime the better-sqlite3 instance supports that same subset.
+import { chmodSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { config } from '../config.js';
+import * as sqliteSchema from './schema.sqlite.js';
+import * as pgSchema from './schema.pg.js';
+export const isPg = config.dbDialect === 'postgres';
+let dbInstance;
+let schemaValue;
+let closeFn;
+// Kept for the sqlite-only manual transaction path; null in cloud mode.
+let sqliteConn = null;
+if (isPg) {
+    // Dynamic import so the unused native driver isn't loaded in the other mode.
+    const pg = await import('pg');
+    const Pool = pg.Pool ?? pg.default.Pool;
+    const { drizzle } = await import('drizzle-orm/node-postgres');
+    const pool = new Pool({ connectionString: config.databaseUrl });
+    schemaValue = pgSchema;
+    dbInstance = drizzle(pool, { schema: pgSchema });
+    closeFn = async () => {
+        await pool.end();
+    };
+}
+else {
+    const { default: Database } = await import('better-sqlite3');
+    const { drizzle } = await import('drizzle-orm/better-sqlite3');
+    // Owner-only on the DIRECTORY as well as the file: WAL mode creates two siblings
+    // (`-wal`, `-shm`) that hold the same data and are created by SQLite with the process
+    // umask, so locking down only the main file would leave the write-ahead log readable.
+    mkdirSync(dirname(config.dbPath), { recursive: true, mode: 0o700 });
+    sqliteConn = new Database(config.dbPath);
+    sqliteConn.pragma('journal_mode = WAL');
+    sqliteConn.pragma('foreign_keys = ON');
+    // The local database holds every synced PR body, review comment and GitHub login the user
+    // can see — on a shared or multi-user machine the default 0644 made all of that readable by
+    // any other local account. 0600 it (and the WAL siblings, which the pragma above has just
+    // created). Best-effort: chmod is not meaningful on Windows, and a failure here must never
+    // stop the app from starting.
+    for (const suffix of ['', '-wal', '-shm']) {
+        try {
+            chmodSync(`${config.dbPath}${suffix}`, 0o600);
+        }
+        catch {
+            /* missing sibling (non-WAL platform) or an unsupported filesystem — not fatal */
+        }
+    }
+    schemaValue = sqliteSchema;
+    dbInstance = drizzle(sqliteConn, {
+        schema: sqliteSchema,
+    });
+    closeFn = async () => {
+        sqliteConn?.close();
+    };
+}
+export const db = dbInstance;
+export const schema = schemaValue;
+// Close the underlying connection (pool.end() / better-sqlite3 .close()). Used by
+// the one-shot migrate CLI; the long-running server never calls it.
+export async function closeDb() {
+    await closeFn();
+}
+// Dialect-aware transaction. better-sqlite3 rejects async transaction callbacks
+// ("Transaction function cannot return a promise"), so the sqlite path wraps a
+// manual BEGIN/COMMIT around the awaited (synchronously-resolving) drizzle ops —
+// no other macrotask interleaves between BEGIN and COMMIT because the callback
+// only awaits in-process sqlite work (no real I/O). The pg path uses a real
+// async transaction. Either way the callback uses the same portable `tx` surface.
+export async function runTransaction(fn) {
+    if (isPg) {
+        return dbInstance.transaction(async (tx) => fn(tx));
+    }
+    const conn = sqliteConn;
+    if (!conn)
+        throw new Error('sqlite connection not initialised');
+    conn.exec('BEGIN');
+    try {
+        const result = await fn(dbInstance);
+        conn.exec('COMMIT');
+        return result;
+    }
+    catch (err) {
+        try {
+            conn.exec('ROLLBACK');
+        }
+        catch {
+            /* rollback best-effort */
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/db/code-loc.js

@@ -0,0 +1,388 @@
+// ============================================================================
+// Code-only lines-of-change for a pull request — the input to the LARGE-PR FLAG.
+// ============================================================================
+//
+// "Large" is a claim about how much CODE a reviewer has to read, so a 2,000-line
+// lockfile bump, a regenerated OpenAPI schema or a docs rewrite must not trip it.
+// `codeLocFor` folds the PR's stored `files[]` (additions + deletions per file),
+// dropping everything `isNonCodeFile` classifies as prose, structured config,
+// generated/vendored output or binary payload.
+//
+// ---- RELATIONSHIP TO THE THREE OTHER CLASSIFIERS ----------------------------
+//
+// There are now FOUR path classifiers in this repo and they answer four
+// different questions. They are NOT meant to agree, and none may be folded into
+// another:
+//
+//   1. `NOISE_GLOBS` — apps/backend/src/review/prepare.ts
+//      "Which files should be stripped from the diff the Claude Review AGENT
+//      sees?" A BUDGET decision on a paid feature: lockfiles, minified bundles,
+//      dist/build output, snapshots. It deliberately keeps `.md`, `.yml`, `.json`
+//      and `docs/` IN the diff, because a review agent reading a config change is
+//      doing its job. ⚠ Widening it to satisfy THIS feature would silently change
+//      what a paid agent reviews, with no test to catch it.
+//
+//   2. `isLockFile` — apps/frontend/src/lib/diff.ts
+//      "Should this file's diff start COLLAPSED in the Changes tab?" Lockfiles
+//      only, by exact basename, case-sensitively (matching what git records).
+//      A narrow presentation heuristic; far too narrow to answer "is this code".
+//
+//   3. `isNonCodeFile` — HERE
+//      "Does this file's churn count toward how much CODE this PR asks a human to
+//      read?" The broadest of the three, and the only one that excludes prose and
+//      structured config. Case-INSENSITIVE (a `Readme.MD` is still prose), and
+//      the only one whose answer is a number a user compares against a threshold
+//      they configured.
+//
+//   4. `BLAST_SURFACES` + `isTestFile` — apps/backend/src/db/blast-radius.ts
+//      "Do this file's CONSUMERS LIVE OUTSIDE THE DIFF?" The only one asking
+//      about REACH rather than volume or presentation, which is why it is a list
+//      of contract shapes (migrations, IDL, `.d.ts`, OpenAPI, IaC) rather than a
+//      list of things to ignore. It sits ON TOP of this file rather than beside
+//      it: `isNonCodeFile` is reused verbatim to split code from prose/config,
+//      and blast-radius.ts adds only the two judgements this file has no opinion
+//      about — is it a test, and is it a contract.
+//
+// ---- THE THREE DATA TRAPS (all measured on the real corpus) -----------------
+//
+// See `codeLocFor` for how each is handled. In one line each:
+//   * 18.5% of PRs have `files IS NULL`, and 18.8% carry a never-observed size —
+//     `codeLoc` is NULL there, never 0. "Not large" about a PR nobody measured is
+//     a false claim (the same rule `lib/botVolume.ts`'s `formatLoc` states).
+//   * `files(first: 100)` truncates, and it truncates EXACTLY the largest PRs —
+//     so `codeLocIsLowerBound` rides alongside and the reading is ASYMMETRIC:
+//     over-threshold is safe to assert, under-threshold is not.
+//   * `files = []` is OVERLOADED: it is also `sync/routing-files.ts`'s "we tried
+//     and failed" sentinel. It never means "zero code lines".
+/** The page size of the `files(first: 100)` connection in `github/queries.ts`. A PR whose
+ *  stored `files[]` is at this length was (or may have been) truncated by that cap. */
+export const PR_FILES_PAGE_CAP = 100;
+// ---- the classifier ---------------------------------------------------------
+function normalize(path) {
+    let p = path.replace(/\\/g, '/');
+    if (p.startsWith('./'))
+        p = p.slice(2);
+    if (p.startsWith('/'))
+        p = p.slice(1);
+    return p;
+}
+/** Prose. Extensions whose content is written for humans, not machines. */
+const DOC_EXTENSIONS = new Set([
+    'md',
+    'mdx',
+    'markdown',
+    'mdown',
+    'rst',
+    'txt',
+    'adoc',
+    'asciidoc',
+    'org',
+    'tex',
+    'pdf',
+]);
+/** Structured configuration + data. NOT `.html`/`.css`/`.scss`/`.sql`, which are hand-written
+ *  source a reviewer must actually read. `.xml` is here because in practice it is manifests,
+ *  poms and layouts — data with a schema, not logic. */
+const CONFIG_EXTENSIONS = new Set([
+    'json',
+    'json5',
+    'jsonc',
+    'yml',
+    'yaml',
+    'toml',
+    'ini',
+    'cfg',
+    'conf',
+    'properties',
+    'plist',
+    'xml',
+    'csv',
+    'tsv',
+    'lock',
+    'lockfile',
+]);
+/** Binary / media payloads. Their "additions" are a diff artefact, not lines anyone reads. */
+const BINARY_EXTENSIONS = new Set([
+    'png',
+    'jpg',
+    'jpeg',
+    'gif',
+    'bmp',
+    'ico',
+    'icns',
+    'webp',
+    'avif',
+    'svg',
+    'tiff',
+    'psd',
+    'mp3',
+    'mp4',
+    'mov',
+    'webm',
+    'wav',
+    'ogg',
+    'woff',
+    'woff2',
+    'ttf',
+    'otf',
+    'eot',
+    'zip',
+    'gz',
+    'tgz',
+    'bz2',
+    'xz',
+    '7z',
+    'rar',
+    'jar',
+    'war',
+    'so',
+    'dylib',
+    'dll',
+    'exe',
+    'bin',
+    'wasm',
+    'pyc',
+    'class',
+    'pdb',
+    'db',
+    'sqlite',
+    'parquet',
+]);
+/** Machine-generated language lock files, by exact (lower-cased) basename. Deliberately a
+ *  SUPERSET of the frontend's `isLockFile` list — this one also has the `*.lock` /
+ *  `*.lockfile` extension arms above, which that one refuses on purpose. */
+const LOCK_BASENAMES = new Set([
+    'package-lock.json',
+    'npm-shrinkwrap.json',
+    'pnpm-lock.yaml',
+    'yarn.lock',
+    'bun.lockb',
+    'bun.lock',
+    'cargo.lock',
+    'poetry.lock',
+    'uv.lock',
+    'pipfile.lock',
+    'gemfile.lock',
+    'composer.lock',
+    'go.sum',
+    'flake.lock',
+    'package.resolved',
+    'gradle.lockfile',
+    'mix.lock',
+    'pubspec.lock',
+    'packages.lock.json',
+]);
+/** Extensionless files that are prose or project metadata rather than source. Matched on the
+ *  lower-cased basename with any doc extension already stripped. */
+const DOC_BASENAMES = new Set([
+    'readme',
+    'license',
+    'licence',
+    'copying',
+    'notice',
+    'authors',
+    'contributors',
+    'changelog',
+    'changes',
+    'history',
+    'contributing',
+    'code_of_conduct',
+    'security',
+    'codeowners',
+    'owners',
+    'maintainers',
+    'patents',
+    'acknowledgements',
+    'acknowledgments',
+]);
+/** Directory names whose whole subtree is prose or generated/vendored output. Matched as a
+ *  WHOLE path segment, anywhere in the path, so `apps/backend/docs/x.ts` counts too. */
+const NON_CODE_DIRS = new Set([
+    'docs',
+    'doc',
+    'documentation',
+    'node_modules',
+    'vendor',
+    'vendored',
+    'third_party',
+    'thirdparty',
+    '3rdparty',
+    'dist',
+    'build',
+    'out',
+    'generated',
+    'gen',
+    'autogen',
+    'coverage',
+    '__snapshots__',
+    '__pycache__',
+    'fixtures',
+    '__fixtures__',
+    'testdata',
+    'golden',
+    'snapshots',
+]);
+function lastSegment(path) {
+    const idx = path.lastIndexOf('/');
+    return idx === -1 ? path : path.slice(idx + 1);
+}
+function extensionOf(basename) {
+    const idx = basename.lastIndexOf('.');
+    // A leading dot is a DOTFILE marker, not an extension (`.eslintrc` has no extension).
+    if (idx <= 0)
+        return '';
+    return basename.slice(idx + 1);
+}
+/**
+ * Does this path's churn count as CODE for the large-PR flag?
+ *
+ * Returns true for documentation, structured configuration, dotfiles, lockfiles, binary/media
+ * payloads and anything living under a generated / vendored / docs directory.
+ *
+ * ⚠ Read the "relationship to the two classifiers that already exist" block at the top of this
+ * file before widening it — and in particular do NOT reach for `review/prepare.ts`'s
+ * `NOISE_GLOBS` instead: that list is a paid agent's diff budget and answers a different
+ * question.
+ */
+export function isNonCodeFile(path) {
+    const p = normalize(path).toLowerCase();
+    if (p === '')
+        return true;
+    const segments = p.split('/');
+    const base = lastSegment(p);
+    // Dot-directories are tooling/config trees in their entirety (.github/, .vscode/, .circleci/,
+    // .idea/, .storybook/), and so is everything under a docs / generated / vendored directory.
+    //
+    // ⚠ DIRECTORY SEGMENTS ONLY — `segments.length - 1`, never the whole array. A file named
+    // `build` (as in `scripts/build`, a shell entrypoint) is source code; only a DIRECTORY called
+    // `build` is output. Testing the basename against the directory list is how a hand-written
+    // script gets silently uncounted.
+    for (let i = 0; i < segments.length - 1; i++) {
+        const seg = segments[i];
+        if (seg.startsWith('.'))
+            return true;
+        if (NON_CODE_DIRS.has(seg))
+            return true;
+    }
+    // A dotfile basename (.env, .env.local, .gitignore, .eslintrc.js, .prettierrc) is
+    // configuration whatever extension it carries.
+    if (base.startsWith('.'))
+        return true;
+    if (LOCK_BASENAMES.has(base))
+        return true;
+    // Minified / sourcemap / snapshot artefacts, by compound suffix (a plain extension set can't
+    // express `.min.js`, whose extension is `js`).
+    if (base.endsWith('.min.js') ||
+        base.endsWith('.min.css') ||
+        base.endsWith('.min.mjs') ||
+        base.endsWith('.map') ||
+        base.endsWith('.snap')) {
+        return true;
+    }
+    // Conventional "this file was generated" markers, which no reviewer reads line by line.
+    if (base.includes('.generated.') ||
+        base.endsWith('.gen.go') ||
+        base.endsWith('.pb.go') ||
+        base.endsWith('_pb2.py') ||
+        base.endsWith('_pb2.pyi') ||
+        base.endsWith('.pb.cc') ||
+        base.endsWith('.pb.h') ||
+        base.endsWith('.g.dart') ||
+        base.endsWith('.freezed.dart')) {
+        return true;
+    }
+    const ext = extensionOf(base);
+    if (ext === '') {
+        // No extension at all: prose/metadata by name (README, LICENSE, CODEOWNERS), otherwise a
+        // script or a Dockerfile/Makefile — hand-written logic, which COUNTS.
+        return DOC_BASENAMES.has(base);
+    }
+    if (DOC_EXTENSIONS.has(ext))
+        return true;
+    if (CONFIG_EXTENSIONS.has(ext))
+        return true;
+    if (BINARY_EXTENSIONS.has(ext))
+        return true;
+    // A prose basename that carries a doc-ish extension is already caught above; one carrying a
+    // code extension (e.g. `changelog.ts`) is real source and must not be excluded — hence no
+    // DOC_BASENAMES check down here.
+    return false;
+}
+/** The one honest "we don't know". Never `{codeLoc: 0}` — see the trap notes above. */
+const UNKNOWN = { codeLoc: null, codeLocIsLowerBound: false };
+/**
+ * Fold a stored PR row into its code-only line count.
+ *
+ * The three data traps, each handled explicitly:
+ *
+ * 1. **`files IS NULL`** (18.5% of the real corpus) — the per-file breakdown was never stored
+ *    for this PR. Nothing to fold → `null`.
+ *
+ * 2. **A never-observed size** (18.8%) — `additions`, `deletions` and `changedFiles` are all 0.
+ *    ⚠ NARROWED: this now refuses only when the FILE LIST agrees (sums to zero too). See the
+ *    inline note — a stored `files[]` carrying real per-file numbers is a positive observation of
+ *    size, and refusing on the columns alone was discarding it for 9.8% of open pull requests.
+ *    Those columns are NOT NULL with a 0 default, so "we never saw this PR's size" and "this PR
+ *    genuinely changed nothing" are the SAME row. `lib/botVolume.ts` states the rule for the
+ *    total-LoC label and it holds identically here: send null, never a fabricated 0, because
+ *    rendering "not large" about a PR nobody measured is a false claim.
+ *
+ * 3. **`files = []` is OVERLOADED** — `sync/routing-files.ts` persists `[]` as a "we tried and
+ *    failed" sentinel, which is byte-identical to a PR that really touched nothing. The
+ *    cross-check is `changedFiles`: a PR with `changedFiles > 0` and an empty `files` array is
+ *    the sentinel, and treating it as zero code lines would mark real PRs as trivially small.
+ *    We go further and return null for EVERY empty array, because the only remaining case —
+ *    `changedFiles === 0` — has already been answered by trap 2.
+ *
+ * 4. (Not a trap so much as a bound.) `files(first: 100)` truncates. `codeLocIsLowerBound` is
+ *    set when the stored list hit the page cap OR when `changedFiles` exceeds what we hold —
+ *    both mean files are missing, and a missing file can only ADD lines.
+ */
+export function codeLocFor(pr) {
+    // Trap 1.
+    if (pr.files == null)
+        return UNKNOWN;
+    // ⚠ TRAP 2, NARROWED — read this before widening it back.
+    //
+    // The ambiguity is real: `additions`/`deletions`/`changedFiles` are NOT NULL with a 0 default,
+    // so "we never saw this pull request's size" and "it genuinely changed nothing" are the same
+    // row. But that is only unresolvable when the FILE LIST cannot answer it either. A non-empty
+    // `files[]` whose per-file numbers sum above zero IS a positive observation of size, from the
+    // same GitHub payload the columns should have carried — so refusing on the columns alone
+    // discards evidence we hold.
+    //
+    // Measured after `backfillMissingPrFiles` landed: 154 of 1,564 open pull requests (9.8%) had a
+    // real file list and three zeroed columns, and were reported UNKNOWN — no large-PR flag and no
+    // blast-radius chip — purely because this test ran first and read only the columns.
+    //
+    // ⚠ THE REFUSAL STILL STANDS WHEN THE FILES AGREE. All-zero columns AND a file list that sums
+    // to zero is still UNKNOWN, so a genuinely empty pull request never acquires a fabricated size.
+    const filesSum = pr.files.reduce((n, f) => n + ((f?.additions ?? 0) + (f?.deletions ?? 0)), 0);
+    if (pr.additions === 0 && pr.deletions === 0 && pr.changedFiles === 0 && filesSum === 0) {
+        return UNKNOWN;
+    }
+    // Trap 3: an empty array with a non-zero size is the routing-files sentinel (or a partial
+    // write); either way we hold no per-file breakdown to classify.
+    if (pr.files.length === 0)
+        return UNKNOWN;
+    let codeLoc = 0;
+    for (const f of pr.files) {
+        if (typeof f?.path !== 'string')
+            continue;
+        if (isNonCodeFile(f.path))
+            continue;
+        codeLoc += (f.additions ?? 0) + (f.deletions ?? 0);
+    }
+    const codeLocIsLowerBound = pr.files.length >= PR_FILES_PAGE_CAP || pr.changedFiles > pr.files.length;
+    return { codeLoc, codeLocIsLowerBound };
+}
+/**
+ * The product default when an account has stored no threshold of its own. Mirrors
+ * `LARGE_PR_CODE_LOC_DEFAULT` in `@pierre-review/shared` — one number, spelled in the two
+ * places that need it without the backend importing a value from a types-only package at
+ * runtime (`shared` is `import type` only on this side; see PACKAGING).
+ */
+export function resolveLargePrThreshold(stored) {
+    return stored != null && Number.isInteger(stored) && stored > 0 ? stored : 1500;
+}
+//# sourceMappingURL=code-loc.js.map

package/dist/db/credits.js

@@ -0,0 +1,79 @@
+import { getAiUsageSummary, getSummaryTurnCount } from './usage.js';
+// USD → credits conversion, MIRRORED from @pierre-review/shared AI_CREDITS_PER_USD. Inlined
+// here (not imported) because the release guard forbids a real runtime import of the
+// types-only shared package into release/dist. TWO sites, kept in lockstep: shared
+// (types.ts) + this one. (The pro plugin's third copy in insights/routes.ts is gone — it
+// reads ctx.aiCredits now.) $1 of model cost = 1250 credits (1 credit ≈ $0.0008).
+export const AI_CREDITS_PER_USD = 1250;
+// The two AI seams are metered DIFFERENTLY:
+//  - SUMMARY (cheap one-shot Haiku completions — digests, sprint report, insights chat, PR
+//    summary, CI analysis, themes, …) is metered by a monthly TURN COUNT. Each real (billed)
+//    completion is one turn; a $0 cache hit / ambient-session call is free and doesn't count.
+//  - AGENT (Agent-SDK runs — Claude Review, AI Fix) is metered by CREDITS ($ cost), because a
+//    single agentic run's cost varies wildly and a flat turn count would be unfair.
+// Defaults for a paid cloud account (both reset at the UTC month boundary):
+export const DEFAULT_SUMMARY_TURN_LIMIT = 500; // ~$5/mo of Haiku at a blended ~$0.01/turn
+export const DEFAULT_AGENT_CREDIT_ALLOWANCE = 15 * AI_CREDITS_PER_USD; // 18,750 cr = $15/mo
+const toCredits = (usd) => Math.round(usd * AI_CREDITS_PER_USD);
+// UTC first-of-month epoch ms — the month-to-date window start (matches the /api/pro/ai-usage
+// route). Monthly reset is automatic: the window rolls at the UTC month boundary.
+export function monthStartMs(nowMs) {
+    const d = new Date(nowMs);
+    return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), 1);
+}
+// The account's SUMMARY monthly turn limit, or null when unmetered.
+// - local (isLocal): unmetered — null (never blocked; today's behavior).
+// - paid cloud (plan !== 'free'): the plan default turn limit.
+// - free cloud: a zero limit (belt-and-braces — the /api/pro/* 402 gate blocks these first).
+function summaryTurnLimitFor(account) {
+    if (account.isLocal)
+        return null;
+    if (account.plan !== 'free')
+        return DEFAULT_SUMMARY_TURN_LIMIT;
+    return 0;
+}
+// The account's AGENT credit allowance, or null when unmetered. The per-account override
+// column (accounts.aiCreditAllowance) now governs the AGENT budget (a forward hook for
+// top-ups / alternate plans); summary is a flat turn count with no per-account override yet.
+function agentAllowanceFor(account) {
+    if (account.isLocal)
+        return null;
+    if (account.plan !== 'free')
+        return account.aiCreditAllowance ?? DEFAULT_AGENT_CREDIT_ALLOWANCE;
+    return 0;
+}
+// The PURE metering computation (no I/O) — month-to-date usage vs. the per-seam budgets. Split
+// out from aiCreditStatus so the budget math is unit-testable without a DB.
+export function computeAiCreditStatus(account, usage) {
+    const summaryTurnLimit = summaryTurnLimitFor(account);
+    const summaryTurnsUsed = usage.summaryTurns;
+    const summaryTurnsRemaining = summaryTurnLimit == null ? null : Math.max(0, summaryTurnLimit - summaryTurnsUsed);
+    const summaryBlocked = summaryTurnsRemaining != null && summaryTurnsRemaining <= 0;
+    const agentAllowanceCredits = agentAllowanceFor(account);
+    const agentCreditsUsed = toCredits(usage.agentUsd);
+    const agentCreditsRemaining = agentAllowanceCredits == null ? null : Math.max(0, agentAllowanceCredits - agentCreditsUsed);
+    const agentBlocked = agentCreditsRemaining != null && agentCreditsRemaining <= 0;
+    return {
+        summaryTurnsUsed,
+        summaryTurnLimit,
+        summaryTurnsRemaining,
+        summaryBlocked,
+        agentCreditsUsed,
+        agentAllowanceCredits,
+        agentCreditsRemaining,
+        agentBlocked,
+        blocked: summaryBlocked,
+    };
+}
+// The per-account metering status: reads the month-to-date ledger (summary turn count + agent
+// $ spend) and applies the pure computation above. This is what ctx.aiCredits.check calls per
+// generation, and what /api/me + /api/pro/ai-usage surface.
+export async function aiCreditStatus(account, nowMs) {
+    const since = monthStartMs(nowMs);
+    const [summaryTurns, usage] = await Promise.all([
+        getSummaryTurnCount(account.id, since),
+        getAiUsageSummary(account.id, since),
+    ]);
+    return computeAiCreditStatus(account, { summaryTurns, agentUsd: usage.agentUsd });
+}
+//# sourceMappingURL=credits.js.map