limn-review 0.1.123

package/dist/db/erase-account.js

@@ -0,0 +1,255 @@
+import { and, eq } from 'drizzle-orm';
+import { db, runTransaction, schema } from './client.js';
+import { deleteRepo } from './queries.js';
+// ---------------------------------------------------------------------------
+// Right to erasure (UK/EU GDPR Art. 17, CCPA "right to delete").
+//
+// A privacy policy that promises deletion and a codebase with no delete path is worse than
+// having neither — so this is the machinery behind that promise, not a soft "deactivate".
+// It removes the account row, its sealed GitHub token, every repository it added, every PR
+// subtree under those repositories, and every account-keyed row in between.
+//
+// Two design rules:
+//
+//  1. REUSE deleteRepo per repository rather than hand-rolling a second cascade. Almost none
+//     of the core schema declares `ON DELETE CASCADE` (the workspace tables and
+//     auto_merge_requests are the exceptions), so the FK-safe delete order is intricate and has
+//     already been got wrong twice (ci_status_events was missing from both delete paths at one
+//     point, which 500'd repo deletion). One implementation, one place to fix. Where a cascade
+//     DOES exist, this file still deletes explicitly and child-first: SQLite enforces FKs only
+//     under `foreign_keys=ON` while Postgres enforces them immediately, and an erasure promise
+//     must not depend on which dialect is running.
+//
+//  2. Enumerate the account-level tables EXPLICITLY and keep this list next to the schema in
+//     review. A table added later that carries `accountId` and is not listed here becomes a
+//     silent erasure leak — data that survives a deletion the user was told was complete.
+//     `eraseAccountData` is covered by a test that asserts every accountId-bearing table is
+//     empty afterwards, so the omission fails CI rather than shipping.
+//
+// The `users` and `commitFiles` tables are deliberately NOT touched: they are global,
+// deduplicated across tenants (a GitHub login is the same person for everyone, an immutable
+// commit's file list is the same list), so deleting rows there would corrupt other accounts'
+// data. `users` holds only what GitHub publishes on a public profile — login, display name,
+// avatar — and never anything the erasing user contributed.
+// ---------------------------------------------------------------------------
+const { accounts, repos, aiUsage, workspaces, workspaceRepos, workspaceReviewers, benchmarkContributions, searchIndex, autoMergeRequests, branchCommits, trunkCiStatusEvents, mlCommentLabels, prMentions, pendingMutedRepos, myTurnDismissals, repoFileCoupling, } = schema;
+const erasureHandlers = [];
+export function registerAccountErasureHandler(h) {
+    erasureHandlers.push(h);
+}
+/**
+ * Irreversibly delete everything belonging to one account. Returns how many repositories
+ * were removed. Safe to call for an id that no longer exists (returns 0).
+ */
+export async function eraseAccountData(accountId) {
+    // 1. Per-repository subtrees first, via the single canonical cascade. Sequential rather
+    //    than parallel: each call opens its own transaction, and on SQLite a second concurrent
+    //    write transaction would contend on the database lock.
+    const repoRows = await db
+        .select({ id: repos.id })
+        .from(repos)
+        .where(eq(repos.accountId, accountId))
+        .execute();
+    let reposDeleted = 0;
+    for (const r of repoRows) {
+        if (await deleteRepo(r.id, accountId))
+            reposDeleted += 1;
+    }
+    // 2. Plugin-owned tables, BEFORE the account row disappears — a handler may want to read
+    //    the account while resolving its own rows. A plugin failure must not abort the core
+    //    erasure: the user asked to be deleted, and leaving them half-deleted because an
+    //    optional plugin threw is the worse outcome. Logged by the caller.
+    for (const handler of erasureHandlers) {
+        await handler({ accountId });
+    }
+    // 3. Account-level core tables, then the account itself. One transaction so an account can
+    //    never be left present-but-stripped (or absent-but-referenced) if this fails midway.
+    await runTransaction(async (tx) => {
+        // Workspaces and everything keyed to one, CHILD BEFORE PARENT. All three tables carry
+        // `accountId`, so each delete is a single indexed predicate and none of them depends on
+        // another's result set — but the ORDER still matters and is not belt-and-braces alone:
+        //
+        //   workspace_reviewers ─┐
+        //                        ├─ composite FK (workspace_id, account_id) → workspaces(id, account_id)
+        //   workspace_repos ─────┘   ON DELETE CASCADE
+        //
+        // Postgres checks FKs immediately, so deleting `workspaces` first would rely entirely on the
+        // cascade firing; SQLite only enforces them at all with `foreign_keys=ON`. Deleting the
+        // children explicitly, first, makes the erasure independent of both — the cascades then find
+        // nothing to do, which is exactly the property the checklist below asserts.
+        //
+        // `workspace_reviewers` is the one that must never be left to a cascade: it holds the manual
+        // judgements, the human-set vendor names and `monthly_cents` — a price the user typed — so a
+        // row surviving here survives an erasure the user was told was complete.
+        await tx
+            .delete(workspaceReviewers)
+            .where(eq(workspaceReviewers.accountId, accountId))
+            .execute();
+        // Membership rows for surviving repos are already gone with their repos (the repo half of
+        // the composite FK cascades), but a workspace whose repos were all deleted, and any row the
+        // repo loop above could not reach, still carries this account's id.
+        await tx.delete(workspaceRepos).where(eq(workspaceRepos.accountId, accountId)).execute();
+        // The REPO half of the Pending mute (migration 0058 / pg 0045). Deleted BEFORE `workspaces`
+        // only for tidiness — it has no FK to a workspace at all (a repo belongs to exactly one
+        // workspace already, so copying that fact onto the mute row would give the account two
+        // answers to it). Its composite FK to `repos` cascades and the repo loop above has normally
+        // taken it; explicit for the same reason as every other entry here — the guarantee must not
+        // depend on which dialect enforces FKs, nor on the repo loop having succeeded. The row is a
+        // preference the user expressed by hand.
+        await tx
+            .delete(pendingMutedRepos)
+            .where(eq(pendingMutedRepos.accountId, accountId))
+            .execute();
+        // My Turn dismissals (migration 0069 / pg 0056). Both composite FKs cascade and the repo loop
+        // has normally taken every row; explicit for the same dialect-agnostic reason.
+        await tx
+            .delete(myTurnDismissals)
+            .where(eq(myTurnDismissals.accountId, accountId))
+            .execute();
+        await tx.delete(workspaces).where(eq(workspaces.accountId, accountId)).execute();
+        // Claude Review chat messages (migration 0073 / pg 0060). The repo loop has normally taken them
+        // with their runs; explicit because each row is text this user typed or paid to have written.
+        await tx
+            .delete(schema.claudeReviewChatMessages)
+            .where(eq(schema.claudeReviewChatMessages.accountId, accountId))
+            .execute();
+        // AI Fix runs (patches of the user's code + the prompts they were built from). Core since
+        // migration 0074 / pg 0061 — the plugin's erasure hook used to own them.
+        await tx.delete(schema.aiFixes).where(eq(schema.aiFixes.accountId, accountId)).execute();
+        // The AI spend ledger (token/credit counts — no prompt text).
+        await tx.delete(aiUsage).where(eq(aiUsage.accountId, accountId)).execute();
+        // Any aggregate rows contributed to the cross-org benchmark. Consent was the basis for
+        // these, so withdrawal-by-deletion must remove them too.
+        await tx
+            .delete(benchmarkContributions)
+            .where(eq(benchmarkContributions.accountId, accountId))
+            .execute();
+        // Full-text search rows are keyed by (accountId, …) and are copies of comment/PR text.
+        await tx.delete(searchIndex).where(eq(searchIndex.accountId, accountId)).execute();
+        // ML severity/category labels. Their FKs cascade from repos/pull_requests, so the repo loop
+        // above has normally taken them already — explicit for the same reason as every other entry
+        // here: the guarantee must not depend on which dialect enforces FKs, or on the repo loop
+        // having succeeded. Each row is a machine judgement ABOUT this account's bot comments.
+        await tx
+            .delete(mlCommentLabels)
+            .where(eq(mlCommentLabels.accountId, accountId))
+            .execute();
+        // "@you" mention rows (migration 0056 / pg 0043). Same reasoning as the labels above — the
+        // repo loop and the cascading repo/PR FKs normally take them, and this makes the guarantee
+        // independent of both. Each row records that a named person typed THIS user's login on a
+        // specific PR, which is exactly the kind of trace an erasure promise covers.
+        await tx.delete(prMentions).where(eq(prMentions.accountId, accountId)).execute();
+        // Standing auto-merge intents. Their FKs cascade from pull_requests, so deleteRepo above
+        // has already taken most of them — but a row is only as safe as the repo loop that ran,
+        // and an intent naming a PR id is a record of what this user was about to ship. Explicit.
+        await tx
+            .delete(autoMergeRequests)
+            .where(eq(autoMergeRequests.accountId, accountId))
+            .execute();
+        // Default-branch commit snapshots (author names, commit subjects) — same reasoning: the
+        // repo cascade normally clears them, this makes the guarantee independent of it.
+        await tx.delete(branchCommits).where(eq(branchCommits.accountId, accountId)).execute();
+        // The trunk CI transition log (migration 0052 / pg 0039). Same reasoning again: the repo
+        // loop and the cascade normally clear it, and this makes the guarantee independent of both.
+        // Unlike `ci_status_events` it is NOT anchored to a PR, so the time-based retention sweep
+        // can never reach it either — the only bounds are its own per-repo trim and this delete.
+        await tx
+            .delete(trunkCiStatusEvents)
+            .where(eq(trunkCiStatusEvents.accountId, accountId))
+            .execute();
+        // Finally the account: identity + the AES-256-GCM sealed GitHub token.
+        await tx.delete(accounts).where(eq(accounts.id, accountId)).execute();
+    });
+    return { reposDeleted };
+}
+/**
+ * Every core table that carries an `accountId`, with its column — the checklist
+ * `eraseAccountData` is tested against. Exported so the test iterates THIS list rather than a
+ * copy of it, which is what makes "a new accountId table was added and not erased" a test
+ * failure instead of a silent leak.
+ */
+export function accountScopedTables() {
+    const { pullRequests, events, claudeReviews } = schema;
+    const rows = [
+        { name: 'accounts', col: accounts.id, table: accounts },
+        { name: 'repos', col: repos.accountId, table: repos },
+        { name: 'pullRequests', col: pullRequests.accountId, table: pullRequests },
+        { name: 'events', col: events.accountId, table: events },
+        { name: 'claudeReviews', col: claudeReviews.accountId, table: claudeReviews },
+        // Claude Review chat messages (migration 0073 / pg 0060) — the questions a person typed and the
+        // answers they paid for. deleteRepo takes them with their runs; erased explicitly below too.
+        {
+            name: 'claudeReviewChatMessages',
+            col: schema.claudeReviewChatMessages.accountId,
+            table: schema.claudeReviewChatMessages,
+        },
+        { name: 'aiUsage', col: aiUsage.accountId, table: aiUsage },
+        // Adopted from the plugin (migration 0074 / pg 0061) with AI Fix's fixer. No FKs, so nothing
+        // cascades: the explicit delete above is the whole guarantee. (`reviewLearnings`, review
+        // memory's table, sat here until migration 0075 / pg 0062 DROPPED it.)
+        { name: 'aiFixes', col: schema.aiFixes.accountId, table: schema.aiFixes },
+        // `myTurnDismissals` sat here until migration 0060 / pg 0047 DROPPED the table. It is named
+        // rather than silently absent because this list is a checklist, and a checklist that shortens
+        // with no explanation reads as an omission — the exact failure this function guards against.
+        // THE WORKSPACE TRIO (migrations 0044/0045). FOUR entries left here when they arrived —
+        // `repoReviewers`, `accountReviewers`, `teams`, `teamRepos` — and THREE replaced them. The net
+        // drop of one is correct and intended: the two bot tables collapsed onto a single
+        // (account, workspace, actor) row. It is written out because an off-by-one in a checklist is
+        // exactly how a table gets missed.
+        { name: 'workspaces', col: workspaces.accountId, table: workspaces },
+        // workspaceRepos carries its OWN accountId (not only workspaceId/repoId) — it must be on the
+        // checklist, or a membership row could survive an erasure carrying this account's id.
+        { name: 'workspaceRepos', col: workspaceRepos.accountId, table: workspaceRepos },
+        // The bot object, now one grain. It holds the human judgements, the human-set vendor names
+        // and `monthly_cents` — the one column no classifier can regenerate — so this is the entry
+        // whose omission would cost the user data they entered by hand.
+        { name: 'workspaceReviewers', col: workspaceReviewers.accountId, table: workspaceReviewers },
+        {
+            name: 'benchmarkContributions',
+            col: benchmarkContributions.accountId,
+            table: benchmarkContributions,
+        },
+        { name: 'searchIndex', col: searchIndex.accountId, table: searchIndex },
+        {
+            name: 'autoMergeRequests',
+            col: autoMergeRequests.accountId,
+            table: autoMergeRequests,
+        },
+        { name: 'branchCommits', col: branchCommits.accountId, table: branchCommits },
+        // The trunk CI transition log. On the checklist rather than in the KNOWN_UNCHECKED
+        // exemption that `ci_status_events` sits in, because this one has NO parent PR: neither the
+        // retention sweep nor `deletePrSubtree` can ever reach it, so `deleteRepo` + this delete are
+        // the ONLY things that bound it.
+        {
+            name: 'trunkCiStatusEvents',
+            col: trunkCiStatusEvents.accountId,
+            table: trunkCiStatusEvents,
+        },
+        { name: 'mlCommentLabels', col: mlCommentLabels.accountId, table: mlCommentLabels },
+        // "@you was mentioned on this PR" (migration 0056 / pg 0043).
+        { name: 'prMentions', col: prMentions.accountId, table: prMentions },
+        // The REPO half of the Pending mute (migration 0058 / pg 0045). The WORKSPACE half is a
+        // COLUMN on `workspaces`, already on this checklist, so there is nothing separate to count
+        // for it — the row it lives on is deleted.
+        { name: 'pendingMutedRepos', col: pendingMutedRepos.accountId, table: pendingMutedRepos },
+        // My Turn dismissals (migration 0069 / pg 0056) — one timestamp per dismissed PR or red branch.
+        { name: 'myTurnDismissals', col: myTurnDismissals.accountId, table: myTurnDismissals },
+        // The blast-radius co-change index (migration 0063 / pg 0050). Purely DERIVED — erasing it
+        // loses nothing but a rebuild — and it is on the checklist anyway, because the rule is "does
+        // the table carry an accountId", not "is the data precious". A derived table left behind
+        // still holds this account's file PATHS.
+        { name: 'repoFileCoupling', col: repoFileCoupling.accountId, table: repoFileCoupling },
+    ];
+    return rows.map(({ name, col, table }) => ({
+        name,
+        count: async (accountId) => {
+            const found = await db
+                .select({ id: col })
+                .from(table)
+                .where(and(eq(col, accountId)))
+                .execute();
+            return found.length;
+        },
+    }));
+}
+//# sourceMappingURL=erase-account.js.map

package/dist/db/export-account.js

@@ -0,0 +1,189 @@
+import { eq, inArray } from 'drizzle-orm';
+import { db, schema } from './client.js';
+// ---------------------------------------------------------------------------
+// Right of access + data portability (UK/EU GDPR Arts. 15 and 20).
+//
+// One JSON document containing everything the server holds for one account, in a
+// "commonly used, machine-readable format" as Art. 20 requires. Deliberately built from
+// explicit column lists rather than `select()` so that:
+//
+//   • the sealed GitHub token can NEVER appear in the output. `accounts.accessTokenEnc` is
+//     encrypted, but an export is a file a user emails around and drops in cloud storage —
+//     shipping even a sealed credential in it would be a self-inflicted key-exposure risk,
+//     and it is not personal data the subject needs. Same for `stripeCustomerId` beyond the
+//     fact a subscription exists.
+//   • adding a column to a table cannot silently widen the export.
+//
+// Scope note: the export includes the third-party GitHub activity synced into this account
+// (other people's comments and logins). That is correct — it is the data held in connection
+// with this account, and the subject is entitled to see what is there — but it means an
+// export can contain other people's personal data, which is why the download is
+// same-origin-only, behind the session, and rate-limited like every other route.
+// ---------------------------------------------------------------------------
+const { accounts, repos, pullRequests, reviews, reviewThreads, reviewComments, prComments, events, workspaces, workspaceRepos, workspaceReviewers, aiUsage, benchmarkContributions, autoMergeRequests, } = schema;
+/** Cap per collection. An export must not be a way to ask the server to build a 2 GB string;
+ *  the caps are far above a normal account and the response records where one bit. */
+const EXPORT_ROW_CAP = 50_000;
+/** Build the full export document for one account. Returns null if the account is gone. */
+export async function exportAccountData(accountId) {
+    const truncated = [];
+    const capped = (collection, rows) => {
+        if (rows.length > EXPORT_ROW_CAP) {
+            truncated.push({ collection, cap: EXPORT_ROW_CAP });
+            return rows.slice(0, EXPORT_ROW_CAP);
+        }
+        return rows;
+    };
+    const accountRows = await db
+        .select({
+        id: accounts.id,
+        githubUserId: accounts.githubUserId,
+        githubLogin: accounts.githubLogin,
+        displayName: accounts.displayName,
+        avatarUrl: accounts.avatarUrl,
+        isLocal: accounts.isLocal,
+        plan: accounts.plan,
+        // Deliberately NOT exported: accessTokenEnc (a credential, even sealed) and
+        // stripeCustomerId (Stripe's own identifier — request billing data from Stripe).
+        hasStoredGithubToken: accounts.accessTokenEnc,
+        aiCreditAllowance: accounts.aiCreditAllowance,
+        benchmarkOptIn: accounts.benchmarkOptIn,
+        largePrCodeLocThreshold: accounts.largePrCodeLocThreshold,
+        blastRadiusConfig: accounts.blastRadiusConfig,
+        myTurnSettings: accounts.myTurnSettings,
+        lastLoginAt: accounts.lastLoginAt,
+        lastActiveAt: accounts.lastActiveAt,
+        createdAt: accounts.createdAt,
+    })
+        .from(accounts)
+        .where(eq(accounts.id, accountId))
+        .limit(1)
+        .execute();
+    const account = accountRows[0];
+    if (!account)
+        return null;
+    const repoRows = await db
+        .select()
+        .from(repos)
+        .where(eq(repos.accountId, accountId))
+        .execute();
+    const prRows = capped('pullRequests', await db.select().from(pullRequests).where(eq(pullRequests.accountId, accountId)).execute());
+    const prIds = prRows.map((p) => p.id);
+    // The child tables reach their account through prId. An account with no PRs short-circuits
+    // to empty arrays rather than issuing an `IN ()`.
+    const childRows = async (fn) => (prIds.length === 0 ? [] : fn(prIds));
+    const [reviewRows, threadRows, reviewCommentRows, prCommentRows, eventRows, workspaceRows, workspaceRepoRows, usageRows, workspaceReviewerRows, benchmarkRows, autoMergeRows,] = await Promise.all([
+        childRows((ids) => db.select().from(reviews).where(inArray(reviews.prId, ids)).execute()),
+        childRows((ids) => db.select().from(reviewThreads).where(inArray(reviewThreads.prId, ids)).execute()),
+        childRows((ids) => db.select().from(reviewComments).where(inArray(reviewComments.prId, ids)).execute()),
+        childRows((ids) => db.select().from(prComments).where(inArray(prComments.prId, ids)).execute()),
+        db.select().from(events).where(eq(events.accountId, accountId)).execute(),
+        // Workspaces + their memberships. Explicit column lists, per this file's rule: adding a
+        // column to either table must be a deliberate decision to export it, not a side effect.
+        db
+            .select({
+            id: workspaces.id,
+            accountId: workspaces.accountId,
+            name: workspaces.name,
+            isDefault: workspaces.isDefault,
+            createdAt: workspaces.createdAt,
+            // Chronology's working hours and budgets — settings the user TYPED, so Art. 15 material,
+            // exported deliberately (NULL = every default).
+            flowSettings: workspaces.flowSettings,
+        })
+            .from(workspaces)
+            .where(eq(workspaces.accountId, accountId))
+            .execute(),
+        // Scoped by accountId rather than by the repo id list: the membership table carries its own
+        // accountId, so this needs no `IN ()` guard and cannot be skewed by the pullRequests cap.
+        db
+            .select({ workspaceId: workspaceRepos.workspaceId, repoId: workspaceRepos.repoId })
+            .from(workspaceRepos)
+            .where(eq(workspaceRepos.accountId, accountId))
+            .execute(),
+        db.select().from(aiUsage).where(eq(aiUsage.accountId, accountId)).execute(),
+        // THE BOT OBJECT, one row per (workspace, reviewer). See the payload field's comment for why
+        // it is Art. 15 material: classification decisions, a vendor name and a price the user typed.
+        db
+            .select({
+            id: workspaceReviewers.id,
+            accountId: workspaceReviewers.accountId,
+            workspaceId: workspaceReviewers.workspaceId,
+            authorUserId: workspaceReviewers.authorUserId,
+            automated: workspaceReviewers.automated,
+            role: workspaceReviewers.role,
+            confidence: workspaceReviewers.confidence,
+            source: workspaceReviewers.source,
+            reasonsJson: workspaceReviewers.reasonsJson,
+            kind: workspaceReviewers.kind,
+            label: workspaceReviewers.label,
+            identitySource: workspaceReviewers.identitySource,
+            // ⚠ THE PRICE IS EXPORTED EVEN THOUGH THE PRODUCT SURFACES STRIP IT, and that is a
+            // decision, not an oversight. Reading a seat price on `GET /api/bot-reviewers` (and the
+            // three sibling routes that echo a reviewer row) needs the paid `botDepth` entitlement —
+            // `stripCost` in api/routes/bot-triage.ts. This export does not: Art. 15/20 are about the
+            // SUBJECT'S OWN DATA, and `monthly_cents` is a number this account typed in. A downgraded
+            // account can therefore still export prices it can no longer see in the UI, which is the
+            // correct answer for a portability endpoint and the wrong one for a feature tier. If that
+            // is ever reversed, it must be reversed HERE and recorded in bot-triage.ts's `stripCost`
+            // note, which names this file as the one exemption.
+            monthlyCents: workspaceReviewers.monthlyCents,
+            // The price's reading rule ('flat' | 'per_seat') — user-typed the same way the price is.
+            costModel: workspaceReviewers.costModel,
+            updatedAt: workspaceReviewers.updatedAt,
+        })
+            .from(workspaceReviewers)
+            .where(eq(workspaceReviewers.accountId, accountId))
+            .execute(),
+        db
+            .select()
+            .from(benchmarkContributions)
+            .where(eq(benchmarkContributions.accountId, accountId))
+            .execute(),
+        // "Merge when ready" intents. A record of an action the user asked the server to take on
+        // their behalf (and of merges it performed), so it belongs in an Art. 15 export even
+        // though the rows are small and short-lived.
+        db
+            .select()
+            .from(autoMergeRequests)
+            .where(eq(autoMergeRequests.accountId, accountId))
+            .execute(),
+    ]);
+    return {
+        meta: {
+            generatedAt: new Date().toISOString(),
+            format: 'pierre-account-export',
+            formatVersion: 1,
+            truncated,
+            notes: [
+                'Your stored GitHub access token is deliberately excluded: it is a credential, not ' +
+                    'personal data you need, and an export file is not a safe place for one.',
+                'Payment and card data is held by Stripe, never by this server — request it from Stripe.',
+                'This export includes GitHub activity by OTHER people (their logins and the comments ' +
+                    'they wrote) because that is what was synced into your account. Handle it accordingly.',
+                'Repository content is a cache of GitHub data and is regenerable from GitHub at any time.',
+            ],
+        },
+        account: {
+            ...account,
+            // Report only the PRESENCE of a token, never the sealed value.
+            hasStoredGithubToken: Boolean(account.hasStoredGithubToken),
+        },
+        repositories: repoRows,
+        workspaces: workspaceRows.map((w) => ({
+            ...w,
+            repoIds: workspaceRepoRows.filter((wr) => wr.workspaceId === w.id).map((wr) => wr.repoId),
+        })),
+        pullRequests: prRows,
+        reviews: capped('reviews', reviewRows),
+        reviewThreads: capped('reviewThreads', threadRows),
+        reviewComments: capped('reviewComments', reviewCommentRows),
+        prComments: capped('prComments', prCommentRows),
+        events: capped('events', eventRows),
+        aiUsage: usageRows,
+        workspaceReviewers: workspaceReviewerRows,
+        benchmarkContributions: benchmarkRows,
+        autoMergeRequests: autoMergeRows,
+    };
+}
+//# sourceMappingURL=export-account.js.map

package/dist/db/failing-checks.js

@@ -0,0 +1,124 @@
+// ── WHICH CHECKS ARE FAILING — the Pending cards' names line (CORE, no AI, no GitHub call) ─────
+//
+// A red CI label on a Pending card says THAT the build failed; these readers say WHICH checks. Both
+// read rows the sync already stores, so the board still fetches nothing on mount:
+//
+//   • A PR — the NEWEST `ci_status_events` row whose `head_sha` is the PR's CURRENT head. That log
+//     is written in the same transaction as `pull_requests.ci_status` (sync/upsert.ts, not
+//     lean-gated), so the dot and the names come from one observation. ⚠ IT IS A TRANSITION LOG,
+//     NOT A SNAPSHOT: a row for an older head describes code that is no longer the PR, and a newer
+//     non-red row means the red set it once named is gone — both give NO names.
+//   • A default branch — the head commit's `branch_commits` row, through THE ONE READER
+//     `/api/branch-status` uses (`trunkHeadFailingChecks`, db/branch-queries.ts).
+//
+// ⚠ BARE NAMES, never workflow-prefixed: the PR side stores no workflow name, and one card
+// vocabulary for both sides beats a richer trunk line (the Feed's CI items made the same call).
+// ⚠ "NO NAMES" IS NOT "NOTHING FAILED". A cancelled-only failure is recorded as neutral
+// (`checkContextState`), and a tolerant GitHub response that nulled the contexts writes `[]` — the
+// card then shows its CI label alone, never "0 failing".
+// ⚠ DISPLAY ONLY. These names must never reach a card's `detail`, a work-plan fact, or any hashed
+// or model payload — they are third-party text and they move on every push.
+import { and, eq, inArray } from 'drizzle-orm';
+import { FAILING_CHECKS_SHOWN } from '../shared/index.js';
+import { db, schema } from './client.js';
+import { isRedCiStatus } from './pending-classify.js';
+import { trunkHeadFailingChecks, trunkHeadKey } from './branch-queries.js';
+const { ciStatusEvents } = schema;
+/** The longest check name a card carries — the trunk writer's own slice (sync/branch-status.ts).
+ *  Check names are chosen by CI vendors; the PR-side log stores them uncapped. */
+export const MAX_CHECK_NAME_CHARS = 200;
+/**
+ * Names → the card's pair: each sliced to `MAX_CHECK_NAME_CHARS`, blanks dropped, deduped,
+ * alphabetical, the first `cap` kept, the total counted over ALL of them. null when nothing
+ * remains — an empty list is "no names", which the card renders as nothing.
+ */
+export function summariseFailingChecks(names, cap = FAILING_CHECKS_SHOWN) {
+    const unique = [
+        ...new Set(names.flatMap((n) => {
+            const t = (n ?? '').trim().slice(0, MAX_CHECK_NAME_CHARS);
+            return t.length > 0 ? [t] : [];
+        })),
+    ].sort((a, b) => a.localeCompare(b, 'en') || (a < b ? -1 : a > b ? 1 : 0));
+    if (unique.length === 0)
+        return null;
+    return { failingChecks: unique.slice(0, cap), failingCheckTotal: unique.length };
+}
+/**
+ * The failing checks of each RED PR's CURRENT head, keyed by PR id.
+ *
+ * Only PRs whose `ciStatus` is red and whose `headSha` is known are asked about. One account-scoped
+ * select; the `prId IN × headSha IN` predicate over-matches (PR 1's row for a sha only PR 2 asked
+ * about), so rows are kept only for a REQUESTED `(prId, headSha)` pair. The newest row per PR wins
+ * by `observedAt`, then `id` (the CI-history backfill synthesizes rows at commit time, so two rows
+ * can share a second). That row is used only when ITS status is red.
+ */
+export async function prFailingChecks(accountId, prs) {
+    const out = new Map();
+    const asked = new Map();
+    for (const p of prs) {
+        if (p.headSha != null && isRedCiStatus(p.ciStatus))
+            asked.set(p.id, p.headSha);
+    }
+    if (asked.size === 0)
+        return out;
+    const rows = await db
+        .select({
+        id: ciStatusEvents.id,
+        prId: ciStatusEvents.prId,
+        headSha: ciStatusEvents.headSha,
+        status: ciStatusEvents.status,
+        failingChecks: ciStatusEvents.failingChecks,
+        observedAt: ciStatusEvents.observedAt,
+    })
+        .from(ciStatusEvents)
+        .where(and(eq(ciStatusEvents.accountId, accountId), inArray(ciStatusEvents.prId, [...asked.keys()]), inArray(ciStatusEvents.headSha, [...new Set(asked.values())])))
+        .execute();
+    const newest = new Map();
+    for (const r of rows) {
+        if (asked.get(r.prId) !== r.headSha)
+            continue;
+        const cur = newest.get(r.prId);
+        if (cur == null ||
+            r.observedAt.getTime() > cur.observedAt.getTime() ||
+            (r.observedAt.getTime() === cur.observedAt.getTime() && r.id > cur.id)) {
+            newest.set(r.prId, r);
+        }
+    }
+    for (const [prId, r] of newest) {
+        if (!isRedCiStatus(r.status))
+            continue;
+        const summary = summariseFailingChecks(r.failingChecks ?? []);
+        if (summary != null)
+            out.set(prId, { headSha: r.headSha, ...summary });
+    }
+    return out;
+}
+/**
+ * The failing checks of each red default-branch HEAD, keyed by `trunkHeadKey(repoId, sha)` —
+ * through the one reader `/api/branch-status` uses, mapped to bare names. Independent of whether a
+ * landing PR resolved: a direct push to trunk has failing checks too.
+ */
+export async function trunkFailingChecks(accountId, heads) {
+    const out = new Map();
+    const pairs = heads.flatMap((h) => (h.sha != null ? [{ repoId: h.repoId, sha: h.sha }] : []));
+    if (pairs.length === 0)
+        return out;
+    for (const [key, runs] of await trunkHeadFailingChecks(accountId, pairs)) {
+        const summary = summariseFailingChecks(runs.map((r) => r.name));
+        if (summary != null)
+            out.set(key, summary);
+    }
+    return out;
+}
+/** The REQUIRED pair on `CiFailingCard` / `MyTurnTrunkCard`: the names, or null for both when
+ *  none are known (never an empty list, never a 0). */
+export function failingChecksFields(s) {
+    return s != null
+        ? { failingChecks: s.failingChecks, failingCheckTotal: s.failingCheckTotal }
+        : { failingChecks: null, failingCheckTotal: null };
+}
+/** The trunk map's lookup for one head — the `trunkHeadKey` spelling, never re-typed. */
+export function trunkFailingFor(map, repoId, sha) {
+    return sha != null ? map.get(trunkHeadKey(repoId, sha)) : undefined;
+}
+//# sourceMappingURL=failing-checks.js.map