limn-review 0.1.123

package/dist/db/my-turn-dismissals.js

@@ -0,0 +1,343 @@
+// MY TURN DISMISSALS + ONE CARD PER PR (CORE, free, both modes, no AI).
+//
+// Two rules the My Turn fold (`getMyTurn`) applies, kept here so they can be read — and tested —
+// apart from the 700-line fold that calls them.
+//
+// ── 1. A DISMISSAL SETS ONE ITEM DOWN UNTIL SOMETHING NEW HAPPENS ────────────────────────────
+//
+// The reader can take a subject — a pull request, or a repository for a red default branch — off
+// their plate. ⚠ This is NOT the "Done" button migration 0060 deleted, and the difference is the
+// whole design. That one stored "I dealt with this" and never expired, so a PR whose ball came back
+// stayed hidden behind it for weeks. This one stores a TIMESTAMP and lets the fold decide:
+//
+//   • an item on a dismissed subject is hidden only while its OWN clock (the moment the thing that
+//     needs you happened — `MyTurnPr.since`, a thread's `lastReplyAt`, …) is at or before the
+//     dismissal. Anything LATER shows again, and only that item: a new reply comes back as a reply,
+//     not as the review request you set down;
+//   • a subject with NO My Turn item at all — you acted, it closed, the request was withdrawn —
+//     DISCHARGES its row (`dischargeable`), so the next summons starts fresh rather than arriving
+//     already dismissed. That is what stops a dismissal outliving the thing it dismissed.
+//
+// It is applied INSIDE `getMyTurn`, so the board, the brief's counts, the badges, the browser
+// notification and the CLI all stop showing a dismissed item together — the Settings-gate rule.
+//
+// ── 2. ONE CARD PER PR ON THE BOARD (`onePerPr`) ─────────────────────────────────────────────
+//
+// A PR can hold several My Turn jobs at once (a review requested of you AND a reply in your thread
+// AND your own unanswered thread). The My turn tab shows ONE: the job highest in the READER'S type
+// order (Settings → My Turn — the tab's own grouping), and within one type the one that has waited
+// longest (the scorer's pick too: same PR, same type ⇒ same proximity and relevance, so the older
+// clock scores higher and wins `compareScored`'s age tie-break). Ties beyond that break on the
+// item's own id, so two reads of unchanged data keep the same card.
+//
+// ⚠ IT IS A BOARD RULE, NOT A NOTIFICATION RULE. `getWorkspaceInsights` asks for it; the
+// account-wide `GET /api/my-turn` does not, because the browser-notification watcher diffs item
+// ids — a deduplicated list would flip the winner whenever the top job cleared and announce the
+// runner-up as "new". Red default branches are repo-grained and never collide with a PR.
+import { and, eq, inArray } from 'drizzle-orm';
+import { db, schema } from './client.js';
+const { myTurnDismissals, pullRequests, repos } = schema;
+export const subjectKey = (t) => `${t.kind}:${t.id}`;
+/** Every dismissal the account holds. One indexed select plus a join for the PR's repo/state. */
+export async function readMyTurnDismissals(accountId) {
+    const rows = await db
+        .select({
+        prId: myTurnDismissals.prId,
+        repoId: myTurnDismissals.repoId,
+        dismissedAt: myTurnDismissals.dismissedAt,
+        prRepoId: pullRequests.repoId,
+        prState: pullRequests.state,
+    })
+        .from(myTurnDismissals)
+        .leftJoin(pullRequests, eq(pullRequests.id, myTurnDismissals.prId))
+        .where(eq(myTurnDismissals.accountId, accountId))
+        .execute();
+    const out = [];
+    for (const r of rows) {
+        if (r.prId != null && r.prRepoId != null) {
+            out.push({
+                target: { kind: 'pr', id: r.prId },
+                dismissedAtMs: r.dismissedAt.getTime(),
+                repoId: r.prRepoId,
+                closed: r.prState !== 'open',
+            });
+        }
+        else if (r.repoId != null) {
+            out.push({
+                target: { kind: 'repo', id: r.repoId },
+                dismissedAtMs: r.dismissedAt.getTime(),
+                repoId: r.repoId,
+                closed: false,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * The dismissal's timestamp, ROUNDED UP to the whole second. SQLite stores `mode: 'timestamp'` in
+ * whole seconds, so an unrounded write would land up to 999ms EARLY and an item that happened just
+ * before the press would compare as "after" it and stay on screen. Rounded the same way in both
+ * dialects, so the rule is one rule.
+ */
+export function dismissalInstant(nowMs) {
+    return new Date(Math.ceil(nowMs / 1000) * 1000);
+}
+/**
+ * Dismiss one subject. Null when the subject is not this account's — the route answers 404, so
+ * the family is not an existence oracle. ⚠ The composite FK would refuse a cross-account pair
+ * anyway; this read exists to answer with a 404 rather than a constraint error.
+ *
+ * Re-dismissing moves the timestamp forward: "and whatever arrived since, too".
+ */
+export async function dismissMyTurn(accountId, target, nowMs = Date.now()) {
+    const at = dismissalInstant(nowMs);
+    if (target.kind === 'pr') {
+        const owned = await db
+            .select({ id: pullRequests.id })
+            .from(pullRequests)
+            .where(and(eq(pullRequests.id, target.id), eq(pullRequests.accountId, accountId)))
+            .limit(1)
+            .execute();
+        if (owned[0] == null)
+            return null;
+        await db
+            .insert(myTurnDismissals)
+            .values({ accountId, prId: target.id, repoId: null, dismissedAt: at })
+            .onConflictDoUpdate({
+            target: [myTurnDismissals.accountId, myTurnDismissals.prId],
+            set: { dismissedAt: at },
+        })
+            .execute();
+        return at;
+    }
+    const owned = await db
+        .select({ id: repos.id })
+        .from(repos)
+        .where(and(eq(repos.id, target.id), eq(repos.accountId, accountId)))
+        .limit(1)
+        .execute();
+    if (owned[0] == null)
+        return null;
+    await db
+        .insert(myTurnDismissals)
+        .values({ accountId, prId: null, repoId: target.id, dismissedAt: at })
+        .onConflictDoUpdate({
+        target: [myTurnDismissals.accountId, myTurnDismissals.repoId],
+        set: { dismissedAt: at },
+    })
+        .execute();
+    return at;
+}
+/** Bring a subject back. True when a dismissal existed. Scoped by account on the row itself. */
+export async function restoreMyTurn(accountId, target) {
+    const col = target.kind === 'pr' ? myTurnDismissals.prId : myTurnDismissals.repoId;
+    const deleted = await db
+        .delete(myTurnDismissals)
+        .where(and(eq(myTurnDismissals.accountId, accountId), eq(col, target.id)))
+        .returning({ id: myTurnDismissals.id })
+        .execute();
+    return deleted.length > 0;
+}
+/** Drop the rows the fold found nothing left for — see `MyTurnDismissalFilter.dischargeable`. */
+export async function dischargeMyTurnDismissals(accountId, targets) {
+    const prIds = targets.filter((t) => t.kind === 'pr').map((t) => t.id);
+    const repoIds = targets.filter((t) => t.kind === 'repo').map((t) => t.id);
+    if (prIds.length > 0) {
+        await db
+            .delete(myTurnDismissals)
+            .where(and(eq(myTurnDismissals.accountId, accountId), inArray(myTurnDismissals.prId, prIds)))
+            .execute();
+    }
+    if (repoIds.length > 0) {
+        await db
+            .delete(myTurnDismissals)
+            .where(and(eq(myTurnDismissals.accountId, accountId), inArray(myTurnDismissals.repoId, repoIds)))
+            .execute();
+    }
+}
+/**
+ * The per-fold filter. `keep` is called once per candidate item, in any order; it records which
+ * subjects the fold saw at all, which it showed and which it hid, so the three questions after the
+ * fold — what is dismissed, what may be discharged — are answered off what actually happened.
+ */
+export class MyTurnDismissalFilter {
+    byKey;
+    orderIdx;
+    present = new Set();
+    shown = new Set();
+    hidden = new Map();
+    constructor(rows, order) {
+        this.byKey = new Map(rows.map((r) => [subjectKey(r.target), r]));
+        this.orderIdx = new Map(order.map((r, i) => [r, i]));
+    }
+    /** True ⇒ the item stays. `clock` is the item's own ISO clock; null ⇒ it has none, and an
+     *  item with no clock cannot prove it is newer than the dismissal, so it stays hidden. */
+    keep(target, clock, reason, describe) {
+        const key = subjectKey(target);
+        this.present.add(key);
+        const d = this.byKey.get(key);
+        if (d == null)
+            return true;
+        const ms = clock == null ? Number.NaN : Date.parse(clock);
+        if (Number.isFinite(ms) && ms > d.dismissedAtMs) {
+            this.shown.add(key);
+            return true;
+        }
+        const prev = this.hidden.get(key);
+        if (prev == null || this.rank(reason) < this.rank(prev.reason)) {
+            this.hidden.set(key, { reason, describe });
+        }
+        return false;
+    }
+    rank(r) {
+        return this.orderIdx.get(r) ?? Number.MAX_SAFE_INTEGER;
+    }
+    /** Subjects wholly hidden by a live dismissal — the tab's "Dismissed" list, newest first. A
+     *  subject with a newer item showing is back on the plate and is not listed. */
+    dismissed() {
+        const out = [];
+        for (const [key, h] of this.hidden) {
+            if (this.shown.has(key))
+                continue;
+            const d = this.byKey.get(key);
+            out.push({
+                target: d.target,
+                ...h.describe(),
+                reason: h.reason,
+                dismissedAt: new Date(d.dismissedAtMs).toISOString(),
+            });
+        }
+        return out.sort((a, b) => b.dismissedAt.localeCompare(a.dismissedAt));
+    }
+    /**
+     * Rows with nothing left to dismiss: the fold saw NO item on the subject. ⚠ ONLY WHERE THE FOLD
+     * COULD HAVE SEEN ONE — a workspace-scoped fold has not looked at another workspace's repos, so
+     * `inScope` says which subjects this read covered. A closed PR is dead wherever it lives.
+     */
+    dischargeable(inScope) {
+        const out = [];
+        for (const [key, d] of this.byKey) {
+            if (this.present.has(key))
+                continue;
+            if (d.closed || inScope(d.repoId))
+                out.push(d.target);
+        }
+        return out;
+    }
+}
+const clockMsOf = (iso) => {
+    const ms = iso == null ? Number.NaN : Date.parse(iso);
+    // No clock ⇒ the oldest possible: the board's scorer dates such a card off the PR's open time,
+    // which is the longest wait it has.
+    return Number.isFinite(ms) ? ms : Number.NEGATIVE_INFINITY;
+};
+/**
+ * Keep ONE item per pull request across every PR-grained section — see the header's rule 2.
+ * Pure. Sections keep their own order; only losers are removed.
+ */
+export function onePerPr(mt, order) {
+    const orderIdx = new Map(order.map((r, i) => [r, i]));
+    const rank = (r) => orderIdx.get(r) ?? Number.MAX_SAFE_INTEGER;
+    const better = (a, b) => rank(a.reason) - rank(b.reason) < 0 ||
+        (rank(a.reason) === rank(b.reason) &&
+            (a.clockMs < b.clockMs || (a.clockMs === b.clockMs && `${a.reason}:${a.ref}` < `${b.reason}:${b.ref}`)));
+    const best = new Map();
+    const offer = (c) => {
+        const cur = best.get(c.prId);
+        if (cur == null || better(c, cur))
+            best.set(c.prId, c);
+    };
+    const winnerIs = (c) => {
+        const w = best.get(c.prId);
+        return w.reason === c.reason && w.ref === c.ref;
+    };
+    // Each section, described once: its reason, and how to read an item's PR, clock and id.
+    const pr = (reason) => ({
+        of: (i) => ({ prId: i.prId, reason, clockMs: clockMsOf(i.since), ref: `${i.prId}` }),
+    });
+    const S = {
+        awaitingReview: pr('review_request'),
+        mentions: pr('mention'),
+        commentReplies: pr('comment_reply'),
+        pushedSince: pr('pushed_since'),
+        ownCiRed: pr('own_ci_red'),
+        ownConflicts: pr('own_conflicts'),
+        approvedPrs: pr('pr_approved'),
+        ownReady: pr('own_ready'),
+        yourPrs: pr('your_pr'),
+        watchedRepoPrs: pr('watched_repo_pr'),
+    };
+    const thread = (reason) => ({
+        of: (i) => ({
+            prId: i.prId,
+            reason,
+            clockMs: clockMsOf(i.lastReplyAt),
+            ref: `${i.threadId}`,
+        }),
+    });
+    const threadsAwaiting = thread('thread');
+    const threadReplies = thread('thread_reply');
+    const ownThreads = {
+        of: (i) => ({
+            prId: i.prId,
+            reason: 'own_thread',
+            clockMs: clockMsOf(i.since),
+            ref: `${i.threadId}`,
+        }),
+    };
+    const claude = {
+        of: (i) => ({
+            prId: i.prId,
+            reason: 'claude_review',
+            clockMs: clockMsOf(i.finishedAt),
+            ref: `${i.reviewId}`,
+        }),
+    };
+    for (const i of mt.awaitingReview)
+        offer(S.awaitingReview.of(i));
+    for (const i of mt.mentions)
+        offer(S.mentions.of(i));
+    for (const i of mt.commentReplies)
+        offer(S.commentReplies.of(i));
+    for (const i of mt.pushedSince)
+        offer(S.pushedSince.of(i));
+    for (const i of mt.ownCiRed)
+        offer(S.ownCiRed.of(i));
+    for (const i of mt.ownConflicts)
+        offer(S.ownConflicts.of(i));
+    for (const i of mt.approvedPrs)
+        offer(S.approvedPrs.of(i));
+    for (const i of mt.ownReady)
+        offer(S.ownReady.of(i));
+    for (const i of mt.yourPrs)
+        offer(S.yourPrs.of(i));
+    for (const i of mt.watchedRepoPrs)
+        offer(S.watchedRepoPrs.of(i));
+    for (const i of mt.threadsAwaiting)
+        offer(threadsAwaiting.of(i));
+    for (const i of mt.threadReplies)
+        offer(threadReplies.of(i));
+    for (const i of mt.ownThreads)
+        offer(ownThreads.of(i));
+    for (const i of mt.claudeReviewsToAction)
+        offer(claude.of(i));
+    return {
+        awaitingReview: mt.awaitingReview.filter((i) => winnerIs(S.awaitingReview.of(i))),
+        mentions: mt.mentions.filter((i) => winnerIs(S.mentions.of(i))),
+        commentReplies: mt.commentReplies.filter((i) => winnerIs(S.commentReplies.of(i))),
+        pushedSince: mt.pushedSince.filter((i) => winnerIs(S.pushedSince.of(i))),
+        ownCiRed: mt.ownCiRed.filter((i) => winnerIs(S.ownCiRed.of(i))),
+        ownConflicts: mt.ownConflicts.filter((i) => winnerIs(S.ownConflicts.of(i))),
+        approvedPrs: mt.approvedPrs.filter((i) => winnerIs(S.approvedPrs.of(i))),
+        ownReady: mt.ownReady.filter((i) => winnerIs(S.ownReady.of(i))),
+        yourPrs: mt.yourPrs.filter((i) => winnerIs(S.yourPrs.of(i))),
+        watchedRepoPrs: mt.watchedRepoPrs.filter((i) => winnerIs(S.watchedRepoPrs.of(i))),
+        threadsAwaiting: mt.threadsAwaiting.filter((i) => winnerIs(threadsAwaiting.of(i))),
+        threadReplies: mt.threadReplies.filter((i) => winnerIs(threadReplies.of(i))),
+        ownThreads: mt.ownThreads.filter((i) => winnerIs(ownThreads.of(i))),
+        claudeReviewsToAction: mt.claudeReviewsToAction.filter((i) => winnerIs(claude.of(i))),
+        // Repo-grained: a branch is not a pull request, and never shares a key with one.
+        redTrunks: mt.redTrunks,
+    };
+}
+//# sourceMappingURL=my-turn-dismissals.js.map

package/dist/db/my-turn-settings.js

@@ -0,0 +1,34 @@
+// ── MY TURN SETTINGS, READ SERVER-SIDE (CORE, free, no AI) ─────────────────────────────────
+//
+// The account's stored overrides (`accounts.my_turn_settings`), resolved through the ONE shared
+// resolver (`resolveMyTurnSettings`, packages/shared/src/my-turn-settings.ts). Every server reader
+// comes through here: `getMyTurn` (which types are shown), the Pending ranker (the type order and
+// the Do next weights) and the Pro work plan's scorer (the weights).
+//
+// ⚠ READ STRAIGHT FROM `accounts`, NEVER FROM THE LOCAL-ACCOUNT CACHE. The cache is the per-request
+// hook's copy (auth/account.ts); a server fold that read it would see a save only if the setter
+// remembered to refresh it. One indexed read by primary key costs nothing beside the folds it gates.
+import { eq } from 'drizzle-orm';
+import { resolveMyTurnSettings, } from '../shared/index.js';
+import { db, schema } from './client.js';
+/** The account's My Turn settings, resolved (the product defaults where nothing is stored). */
+export async function getMyTurnSettings(accountId) {
+    const rows = await db
+        .select({ settings: schema.accounts.myTurnSettings })
+        .from(schema.accounts)
+        .where(eq(schema.accounts.id, accountId))
+        .limit(1)
+        .execute();
+    return resolveMyTurnSettings(rows[0]?.settings ?? null);
+}
+/** The ranking an `/api/attention` response was built with — what every explanation on the board
+ *  must print, rather than the product constants. */
+export function rankRulesOf(s) {
+    return {
+        weights: s.weights,
+        preset: s.preset,
+        myTurnOrder: [...s.order],
+        myTurnOff: [...s.off],
+    };
+}
+//# sourceMappingURL=my-turn-settings.js.map

package/dist/db/pending-classify.js

@@ -0,0 +1,46 @@
+/**
+ * IS THIS BUILD RED? — and RED IS ALWAYS THE PAIR `failure` | `error`, never one of them.
+ *
+ * GitHub reports an infrastructure/permissions problem as `error` and a genuine check failure as
+ * `failure`, and every layer of this app that asks "is it red" has to accept both: db/triage.ts's
+ * reason tags, getWorkspaceMetricsDetail's own local `isRed`, and the SPA's lib/ui.ts. A fold that
+ * tested only 'failure' would silently drop every errored build — which is the half that most
+ * often needs a human.
+ */
+export const RED_CI_STATUSES = ['failure', 'error'];
+export function isRedCiStatus(ci) {
+    return RED_CI_STATUSES.includes(ci ?? '');
+}
+/**
+ * DOES THE HEAD CONFLICT WITH THE BASE? An OR over two columns, because they are two views of one
+ * fact: `mergeStateStatus = 'dirty'` is GitHub's protection-aware verdict, `mergeable =
+ * 'conflicting'` its conflict-only one, and they agree on every real row we have measured.
+ *
+ * ⚠ NULL IN EITHER IS NOT OBSERVED, never a conflict — and never "fine" either. That is why this is
+ * a JS fold and not a SQL predicate: `mergeable <> 'conflicting'` in SQL silently drops the NULL
+ * rows, which are exactly the ones we have not asked about yet.
+ */
+export function isConflicting(p) {
+    return p.mergeStateStatus === 'dirty' || p.mergeable === 'conflicting';
+}
+/**
+ * WHICH FORWARD CARD IS THIS PR? — `'update_branch'` when GitHub wants the branch updated first,
+ * `'merge'` when it will merge now, else null. The Ready to land tab's two kinds, spelled ONCE for
+ * the merge-candidate loop in `getWorkspaceInsights` and for My Turn's `own_ready` promotion, so a
+ * PR promoted into My turn is classified by the very test its home card was.
+ *
+ * ⚠ CONFLICTS OUTRANK 'behind' — GitHub's own `canUpdateBranch` is "behind AND NOT conflicting",
+ * so an Update-branch button on a conflicting PR is a button GitHub refuses.
+ * ⚠ `readyToMerge` is `READY_MERGE_STATES.has(mergeStateStatus)`, evaluated by the CALLER: that set
+ * lives in db/triage.ts, which opens the DB client at load, and this module stays pure.
+ */
+export function forwardKindOf(p, readyToMerge) {
+    if (p.mergeStateStatus == null)
+        return null;
+    if (isConflicting(p))
+        return null;
+    if (p.mergeStateStatus === 'behind')
+        return 'update_branch';
+    return readyToMerge ? 'merge' : null;
+}
+//# sourceMappingURL=pending-classify.js.map

package/dist/db/pending-mute.js

@@ -0,0 +1,171 @@
+// THE PENDING MUTE (CORE, free, no AI) — "stop these Pending items claiming my turn".
+//
+// ── WHAT A MUTE IS ───────────────────────────────────────────────────────────────────────────
+// A muted repo's "your turn"-shaped rows are downgraded to `relevance: 'none'` (hence
+// `personal: false`) inside `getMyTurn`, at the ONE place `personal` is folded from `relevance`.
+// From that single write, and with no second predicate anywhere:
+//
+//   • the Pending card relabels from "Your turn" / "In your repos" to the neutral
+//     "Review or reply" (`cardKindLabel`, which reads `relevance`);
+//   • the browser notification stops firing for it (`useMyTurnNotifications`, which reads
+//     `personal`);
+//   • the welcome-back banner, the workspace badges, the "Elsewhere" rows and the
+//     "N need your attention" line stop counting it (`myTurnPersonal`, folded off `relevance`);
+//   • it moves into the broad "N need review or reply" population (`myTurnOther`);
+//   • it ranks lower in the "Do next" head (`RELEVANCE_WEIGHT` in db/work-plan.ts).
+//
+// ⚠ THE CARD NEVER LEAVES THE BOARD, and the broad `myTurn` count never moves. "That work is
+// real, it is just not yours, and hiding it would delete work rather than route it" is the rule
+// the Pending board is built on; a mute is a ROUTING gesture inside it, not a filter.
+//
+// ── WHAT IT IS NOT ───────────────────────────────────────────────────────────────────────────
+// ⚠ IT IS NOT THE `repos.inbox_watch` AXIS MIGRATION 0046 DROPPED, and `api/routes/workspaces.ts`
+// still carries the rule that killed it ("do not reintroduce a per-repo visibility flag here: the
+// workspace IS the scope"). That column was a SECOND VISIBILITY SCOPE on top of membership — it
+// decided whether a repo's work appeared AT ALL, so every screen had two axes and no way to say
+// which it was obeying. Nothing here changes any screen's population: a muted repo is fully live
+// on Feed, Timeline, Activity, Bots and the Pending board. What changes is whether its rows may
+// CLAIM THE READER'S TURN and interrupt them. Membership remains the only visibility axis.
+//
+// ⚠ IT IS NOT THE ORPHANED `bot_mute_rules` TABLE (migration 0029) either. That backed a removed
+// feature that HID review threads and RESOLVED them on a timer. This hides nothing and resolves
+// nothing.
+//
+// ── TWO INDEPENDENT FACTS, OR-ed. NEVER A CHAIN. ─────────────────────────────────────────────
+//
+//     muted(repo) == its workspace's `workspaces.pending_muted`  OR  a `pending_muted_repos` row
+//
+// Workspace grain alone does not answer the ask (one noisy repo inside a useful workspace);
+// repo grain alone makes silencing a 20-repo workspace twenty clicks. `null`-means-inherit is a
+// named bug class in this codebase (`workspace_reviewers.monthly_cents`, the Slack target, the
+// sprint cadence): it needs a resolver, and "which grain am I reading?" then has to be answered
+// at every call site. There is no resolver — there is ONE union, computed here, and clearing
+// either half neither reveals nor overwrites the other. It is the `hiddenBotUserIds` shape.
+import { and, eq, inArray } from 'drizzle-orm';
+import { db, runTransaction, schema } from './client.js';
+const { pendingMutedRepos, workspaceRepos, workspaces } = schema;
+/**
+ * THE ONE READ. Every repo id in this account whose Pending items are muted, by EITHER fact.
+ *
+ * Account-scoped, never workspace-scoped, and that is what makes the ACCOUNT-WIDE
+ * `GET /api/my-turn` — the one the browser-notification watcher reads, deliberately with no
+ * `?workspace=` — obey a per-WORKSPACE mute without gaining a scope parameter: a repo belongs to
+ * exactly one workspace, so a workspace-grained mute is fully resolvable per repo id.
+ *
+ * Two indexed selects, unioned in JS rather than in SQL: an `OR` across a join and a second table
+ * is a portable-dialect liability for no gain here (both sides are tiny — one row per muted repo,
+ * one flag per workspace), and the union is the thing the comment above has to keep saying.
+ */
+export async function getMutedPendingRepoIds(accountId) {
+    const [wsRows, repoRows] = await Promise.all([
+        // The WORKSPACE half: every repo whose workspace carries the flag. The join is on BOTH
+        // columns because `workspace_repos` carries its own `account_id` — the same pairing the
+        // composite FK enforces, so the predicate and the constraint say the same thing.
+        db
+            .select({ repoId: workspaceRepos.repoId })
+            .from(workspaceRepos)
+            .innerJoin(workspaces, and(eq(workspaces.id, workspaceRepos.workspaceId), eq(workspaces.accountId, workspaceRepos.accountId)))
+            .where(and(eq(workspaceRepos.accountId, accountId), eq(workspaces.pendingMuted, true)))
+            .execute(),
+        // The REPO half: presence is the fact.
+        db
+            .select({ repoId: pendingMutedRepos.repoId })
+            .from(pendingMutedRepos)
+            .where(eq(pendingMutedRepos.accountId, accountId))
+            .execute(),
+    ]);
+    const out = new Set();
+    for (const r of wsRows)
+        out.add(r.repoId);
+    for (const r of repoRows)
+        out.add(r.repoId);
+    return out;
+}
+/**
+ * The REPO HALF ALONE, account-scoped, for the settings listing — deliberately NOT the union
+ * above. `listWorkspaces` intersects it with each workspace's membership to build
+ * `Workspace.mutedRepoIds`, and the settings screen has to render the two switches SEPARATELY:
+ * folding the workspace flag in here would hand it one merged set it could not un-mix, and
+ * un-ticking a repository would then appear to do nothing. The row carries no workspace id (a
+ * repo belongs to exactly one workspace already, and a fact lives at exactly one grain).
+ */
+export async function repoGrainedPendingMutes(accountId) {
+    const rows = await db
+        .select({ repoId: pendingMutedRepos.repoId })
+        .from(pendingMutedRepos)
+        .where(eq(pendingMutedRepos.accountId, accountId))
+        .execute();
+    return new Set(rows.map((r) => r.repoId));
+}
+/**
+ * THE WRITE, for `PUT /api/workspaces/:id/pending-mute`. Each half is applied ONLY when the
+ * caller supplied it (`undefined` = untouched), so one Save can carry either grain or both
+ * without a no-op write inventing a value for the other.
+ *
+ * ⚠ THE REPO SET IS SCOPED TO THIS WORKSPACE'S MEMBERSHIP, AND THAT IS A CORRECTNESS RULE, NOT A
+ * VALIDATION NICETY. `mutedRepoIds` is the EXACT muted set within the named workspace: ids in it
+ * that the workspace does not hold are IGNORED (never written), and stored rows for repos OUTSIDE
+ * this workspace are LEFT ALONE (never deleted). Without the second half, saving workspace A's
+ * screen would silently clear every mute the reader had set in workspaces B and C — the "an edit
+ * meant for one team travels to every team" failure this modal's grain split exists to prevent.
+ *
+ * Tenancy is ALSO structural: `repo_id` arrives in a request body, and the composite FK
+ * `(repo_id, account_id) → repos(id, account_id)` means a cross-account pair fails in the
+ * DATABASE. The membership intersection below is the scope guard; the FK is the tenant guard.
+ * Neither substitutes for the other.
+ *
+ * Returns false when the workspace is not this account's (the route 404s), so ownership is
+ * decided here rather than by whichever handler remembered to check.
+ */
+export async function setWorkspacePendingMute(accountId, workspaceId, patch) {
+    const owned = (await db
+        .select({ id: workspaces.id })
+        .from(workspaces)
+        .where(and(eq(workspaces.id, workspaceId), eq(workspaces.accountId, accountId)))
+        .limit(1)
+        .execute())[0];
+    if (!owned)
+        return false;
+    // The workspace's membership — the domain the repo half is allowed to write inside.
+    const memberRows = patch.mutedRepoIds === undefined
+        ? []
+        : await db
+            .select({ repoId: workspaceRepos.repoId })
+            .from(workspaceRepos)
+            .where(and(eq(workspaceRepos.accountId, accountId), eq(workspaceRepos.workspaceId, workspaceId)))
+            .execute();
+    const membership = new Set(memberRows.map((r) => r.repoId));
+    const wanted = new Set((patch.mutedRepoIds ?? []).filter((id) => membership.has(id)));
+    const toClear = [...membership].filter((id) => !wanted.has(id));
+    await runTransaction(async (tx) => {
+        if (patch.muted !== undefined) {
+            await tx
+                .update(workspaces)
+                .set({ pendingMuted: patch.muted })
+                .where(and(eq(workspaces.id, workspaceId), eq(workspaces.accountId, accountId)))
+                .execute();
+        }
+        if (patch.mutedRepoIds !== undefined) {
+            if (toClear.length > 0) {
+                await tx
+                    .delete(pendingMutedRepos)
+                    .where(and(eq(pendingMutedRepos.accountId, accountId), inArray(pendingMutedRepos.repoId, toClear)))
+                    .execute();
+            }
+            for (const repoId of wanted) {
+                // The conflict target is the table's ONE unique, (account_id, repo_id). Presence is the
+                // fact, so there is nothing to update — DO NOTHING keeps `created_at` as "when the reader
+                // muted it" rather than "when they last pressed Save".
+                await tx
+                    .insert(pendingMutedRepos)
+                    .values({ accountId, repoId })
+                    .onConflictDoNothing({
+                    target: [pendingMutedRepos.accountId, pendingMutedRepos.repoId],
+                })
+                    .execute();
+            }
+        }
+    });
+    return true;
+}
+//# sourceMappingURL=pending-mute.js.map