limn-review 0.1.123

package/dist/db/reaction-targets.js

@@ -0,0 +1,94 @@
+// Emoji reactions — the ONLY database work the feature does.
+//
+// Reactions are never stored. This module exists for exactly one reason: turn the
+// (kind, LOCAL id) pairs a client sends into GitHub node ids, and do it through a join that
+// is scoped by accountId — so tenancy is STRUCTURAL rather than a check some handler has to
+// remember.
+//
+// Why local ids on the wire at all, when GitHub's mutation wants a node id?
+//   • An unvalidated node-id list would be BOTH an existence oracle over other tenants' GitHub
+//     content AND a way to spend this account's GitHub quota on arbitrary nodes. Resolving
+//     local ids removes the class: a client cannot name an id it does not own, because the
+//     join simply returns nothing.
+//   • The local ids are already on CommentDetail / PrCommentDetail / ReviewDetail, so no read
+//     payload had to grow a field and no getter had to change.
+//
+// The three kinds live in THREE SEPARATE ID SPACES (`review_comments`, `pr_comments`,
+// `reviews`) — the same hazard `ml_comment_labels` documents — so every lookup carries the
+// kind and the three are queried separately. A bare numeric id means nothing on its own.
+import { and, eq, inArray } from 'drizzle-orm';
+import { db, schema } from './client.js';
+const { pullRequests, prComments, reviewComments, reviews } = schema;
+/**
+ * Resolve a batch of (kind, local id) pairs to GitHub node ids, scoped to `accountId`.
+ *
+ * A pair that does not resolve — unknown id, wrong kind, another tenant's row — is simply
+ * ABSENT from the result. It is never an error and never a 404: distinguishing "does not
+ * exist" from "is not yours" is the oracle this design avoids, and the client's honest
+ * rendering for both is the same (no reaction bar).
+ *
+ * Three indexed `IN` lookups at most, and only for the kinds actually present.
+ */
+export async function resolveReactionTargets(accountId, targets) {
+    const byKind = new Map();
+    for (const t of targets) {
+        if (!Number.isInteger(t.id) || t.id <= 0)
+            continue;
+        let set = byKind.get(t.kind);
+        if (!set) {
+            set = new Set();
+            byKind.set(t.kind, set);
+        }
+        set.add(t.id);
+    }
+    const out = [];
+    const reviewCommentIds = byKind.get('review_comment');
+    if (reviewCommentIds && reviewCommentIds.size > 0) {
+        const rows = await db
+            .select({
+            id: reviewComments.id,
+            nodeId: reviewComments.githubNodeId,
+            prId: reviewComments.prId,
+        })
+            .from(reviewComments)
+            // The comment tables carry no accountId of their own — they reach their tenant through
+            // pr_id, exactly as ml_comment_labels' cleanup does. The join IS the isolation.
+            .innerJoin(pullRequests, eq(pullRequests.id, reviewComments.prId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(reviewComments.id, [...reviewCommentIds])))
+            .execute();
+        for (const r of rows) {
+            out.push({ kind: 'review_comment', id: r.id, nodeId: r.nodeId, prId: r.prId });
+        }
+    }
+    const prCommentIds = byKind.get('pr_comment');
+    if (prCommentIds && prCommentIds.size > 0) {
+        const rows = await db
+            .select({ id: prComments.id, nodeId: prComments.githubNodeId, prId: prComments.prId })
+            .from(prComments)
+            .innerJoin(pullRequests, eq(pullRequests.id, prComments.prId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(prComments.id, [...prCommentIds])))
+            .execute();
+        for (const r of rows) {
+            out.push({ kind: 'pr_comment', id: r.id, nodeId: r.nodeId, prId: r.prId });
+        }
+    }
+    const reviewIds = byKind.get('review');
+    if (reviewIds && reviewIds.size > 0) {
+        const rows = await db
+            .select({ id: reviews.id, nodeId: reviews.githubNodeId, prId: reviews.prId })
+            .from(reviews)
+            .innerJoin(pullRequests, eq(pullRequests.id, reviews.prId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(reviews.id, [...reviewIds])))
+            .execute();
+        for (const r of rows) {
+            out.push({ kind: 'review', id: r.id, nodeId: r.nodeId, prId: r.prId });
+        }
+    }
+    return out;
+}
+/** Single-target convenience for the write route. `null` ⇒ unknown or not this account's. */
+export async function resolveReactionTarget(accountId, target) {
+    const rows = await resolveReactionTargets(accountId, [target]);
+    return rows[0] ?? null;
+}
+//# sourceMappingURL=reaction-targets.js.map

package/dist/db/repo-activity.js

@@ -0,0 +1,171 @@
+// WHERE IS THE WORK HAPPENING — per-repository activity over a rolling 14 days.
+//
+// The flow-metric tiles beside this on Reports → Overview answer "how much" and "how fast" for the
+// whole workspace. They cannot answer "which repository", because a workspace-wide figure is one
+// number over a population whose members routinely differ by two orders of magnitude: on the dev
+// corpus one fortnight held 147 PRs / 1.4k lines in a config repo and 71 PRs / 141.7k lines in an
+// application repo. Both are "activity"; they are not the same activity.
+//
+// ── WHY THIS IS A SEPARATE MODULE AND NOT A FIELD ON getWorkspaceMetrics ─────────────────────
+//
+// Two reasons, and the second is the load-bearing one:
+//
+//  1. `getWorkspaceMetrics` is a 400-line fold whose PR SELECT carries none of the five columns
+//     this needs (repoId, authorId, additions, deletions, changedFiles).
+//  2. It honours an ARBITRARY comparison window handed in by the Pro layer (the workspace sprint
+//     cadence). This surface is FREE and cannot read that cadence — `resolveComparisonWindow` /
+//     `getComparisonWindow` live in the private plugin over `pro_workspace_settings`, and CORE has
+//     zero references to them. So the window here is the same trailing 14 days
+//     (`INSIGHT_SPRINT_DAYS`) the free tiles already use, which is what makes the chart and the
+//     tiles beside it agree BY CONSTRUCTION rather than by coincidence. Folding this into
+//     `getWorkspaceMetrics` would silently hand it the plugin's cadence window on the one call
+//     path that has one, and the panel would then carry two 14-day-labelled things measuring
+//     different fortnights.
+//
+// It also cannot live in `queries.ts`: it needs `resolveActorLanes`, and `actor-lanes.ts` imports
+// FROM `queries.ts`. Every other lane-consuming fold (`period-metrics.ts`, `pr-intervals.ts`,
+// `automation-output.ts`, `person-period.ts`) is a module beside them for exactly that reason.
+//
+// COST: two indexed scans (one PR window, one repo list) plus `resolveActorLanes`' fixed handful.
+// Nothing multiplies by repo count, which is what keeps `/api/workspace-metrics` honest on the
+// `read` fall-through — the tier comment in api/plugins/rate-limit.ts turns on that word.
+import { and, eq, gte, inArray, lt } from 'drizzle-orm';
+import { db, schema } from './client.js';
+import { resolveActorLanes } from './actor-lanes.js';
+const { pullRequests, repos } = schema;
+/** The window. MIRRORS `INSIGHT_SPRINT_DAYS` in queries.ts, which is what the free flow-metric
+ *  tiles use — the two are read side by side and a divergence would be invisible. Deliberately a
+ *  constant and not a parameter: this is a FREE surface and the sprint cadence is plugin-owned, so
+ *  there is no setting that could legitimately move it. The label on screen must say "rolling 14
+ *  days", never "this sprint". */
+export const REPO_ACTIVITY_WINDOW_DAYS = 14;
+/** Top-N by PRs opened. Beyond about a dozen bands the bars are unreadable even rotated (the dev
+ *  workspace has 19 active repositories in a typical fortnight). NEVER a silent truncation — the
+ *  response carries `activeRepos` and an `omitted` aggregate so the cards can state both what was
+ *  cut and what it was worth. */
+export const REPO_ACTIVITY_MAX_REPOS = 12;
+/**
+ * Per-repository PR and line counts over the trailing `REPO_ACTIVITY_WINDOW_DAYS`.
+ *
+ * ⚠ `scope.repoIds` IS REQUIRED AND CONCRETE, and `[]` returns null — the same contract
+ * `getWorkspaceMetricsForScope` states at length. A nullable "means every repo" parameter would
+ * widen an empty workspace to the whole account, which is the opposite of what a scope is.
+ * `scope.workspaceId` is not decoration either: it is the JUDGEMENT grain, the thing that decides
+ * who counts as automation, and it is why this takes a `BotScope` rather than a bare id list.
+ */
+export async function getWorkspaceRepoActivity(accountId, scope, nowMs) {
+    if (scope.repoIds.length === 0)
+        return null;
+    // Ownership narrowing, mirroring getWorkspaceMetricsForScope: `resolveWorkspaceScope` already
+    // guarantees `repoIds ⊆ this workspace's membership`, and this second predicate makes the tenancy
+    // structural in the query rather than inherited from a caller's memory.
+    const ownedRepos = await db
+        .select({ id: repos.id, owner: repos.owner, name: repos.name, createdAt: repos.createdAt })
+        .from(repos)
+        .where(and(eq(repos.accountId, accountId), inArray(repos.id, scope.repoIds)))
+        .execute();
+    if (ownedRepos.length === 0)
+        return null;
+    const ownedIds = ownedRepos.map((r) => r.id);
+    const toMs = nowMs;
+    const fromMs = toMs - REPO_ACTIVITY_WINDOW_DAYS * 86_400_000;
+    // ⚠ TWO-SIDED AND HALF-OPEN, `[fromMs, toMs)`. `gte`/`lt`, never `lte` on the upper bound: a PR
+    // opened at exactly `toMs` belongs to the next read of this window, not to both.
+    const prs = await db
+        .select({
+        repoId: pullRequests.repoId,
+        authorId: pullRequests.authorId,
+        additions: pullRequests.additions,
+        deletions: pullRequests.deletions,
+        changedFiles: pullRequests.changedFiles,
+    })
+        .from(pullRequests)
+        .where(and(eq(pullRequests.accountId, accountId), inArray(pullRequests.repoId, ownedIds), gte(pullRequests.openedAt, new Date(fromMs)), lt(pullRequests.openedAt, new Date(toMs))))
+        .execute();
+    // THE AUTOMATION SET. `automatedIds`, never `automatedReviewerUserIds` alone. Real accounts carry
+    // the same actor as two rows with conflicting flags (`dependabot` and `dependabot[bot]`), and on
+    // the measured account one of each pair sat at `automated: 0`. Trusting one signal splits one bot
+    // across both series and under-counts each.
+    //
+    // ⚠ ITS CANDIDATE SET IS (workspace verdict ∪ globally `users.isBot`), and the login vocabularies
+    // refine a lane INSIDE that set rather than widening it — a vocabulary hit counts on its own for
+    // a candidate, but admits nobody. So an actor with a vendor login, `isBot: false` and no
+    // `workspace_reviewers` row lands in the HUMAN series. That is deliberate: it is the answer every
+    // other lane consumer gives, and re-deriving "is this a bot" here to be cleverer would put a
+    // second classifier on screen that can disagree with the Timeline's own bot-hiding.
+    const lanes = await resolveActorLanes(accountId, scope);
+    const byRepo = new Map();
+    for (const p of prs) {
+        let acc = byRepo.get(p.repoId);
+        if (!acc) {
+            acc = { human: 0, automation: 0, lines: 0, sized: 0, unsized: 0 };
+            byRepo.set(p.repoId, acc);
+        }
+        // A null author is neither evidence of a bot nor of a person; it counts as human for the same
+        // reason `resolveActorLanes` rule 2 does — the absence of an automation signal is not one.
+        if (p.authorId != null && lanes.automatedIds.has(p.authorId))
+            acc.automation += 1;
+        else
+            acc.human += 1;
+        // ⚠ THE SANCTIONED UNSIZED GUARD, copied verbatim from period-metrics.ts. The three size
+        // columns are NOT NULL DEFAULT 0, so a PR whose detail never hydrated is byte-identical to one
+        // that changed nothing. Summing the fabricated zero is invisible; summing 80% of a repository's
+        // PRs and calling it that repository's line count is a wrong number with no way to notice.
+        const observed = p.changedFiles > 0 || p.additions > 0 || p.deletions > 0;
+        if (observed) {
+            acc.sized += 1;
+            acc.lines += p.additions + p.deletions;
+        }
+        else {
+            acc.unsized += 1;
+        }
+    }
+    const rows = [];
+    for (const r of ownedRepos) {
+        const acc = byRepo.get(r.id);
+        if (!acc)
+            continue; // a repository with nothing opened in the window draws no band at all
+        rows.push({
+            repoId: r.id,
+            repoFullName: `${r.owner}/${r.name}`,
+            prsOpenedHuman: acc.human,
+            prsOpenedAutomation: acc.automation,
+            linesChanged: acc.sized > 0 ? acc.lines : null,
+            sizedPrs: acc.sized,
+            unsizedPrs: acc.unsized,
+            // ⚠ `repos.createdAt` is when the repo was added to THIS ACCOUNT, not when it was created on
+            // GitHub — which is exactly the axis wanted: it bounds how much of the window we could
+            // possibly have observed. A real `>=` against the window start; sqlite stores these as epoch
+            // SECONDS, so no `+1ms` fudging.
+            addedDuringWindow: r.createdAt.getTime() >= fromMs,
+        });
+    }
+    // Rank by TOTAL PRs opened — the primary metric, and the one both charts are ordered by so a
+    // reader can scan the same repository across the pair without re-finding it. Ties break on the
+    // repo name so the order is stable between requests rather than heap order.
+    rows.sort((a, b) => b.prsOpenedHuman +
+        b.prsOpenedAutomation -
+        (a.prsOpenedHuman + a.prsOpenedAutomation) ||
+        a.repoFullName.localeCompare(b.repoFullName));
+    const shown = rows.slice(0, REPO_ACTIVITY_MAX_REPOS);
+    const cut = rows.slice(REPO_ACTIVITY_MAX_REPOS);
+    // What the cap cut, so the cards can state it. The lines chart is ranked by the PR count, so the
+    // repository that leads on lines CAN be below the fold — `omitted.linesChanged` is the only thing
+    // that lets the reader see that happened. Null when nothing cut was ever sized, for the same
+    // reason a row's own figure is: unknown is not zero.
+    const cutSized = cut.reduce((n, r) => n + r.sizedPrs, 0);
+    return {
+        windowDays: REPO_ACTIVITY_WINDOW_DAYS,
+        from: new Date(fromMs).toISOString(),
+        to: new Date(toMs).toISOString(),
+        repos: shown,
+        activeRepos: rows.length,
+        workspaceRepos: ownedRepos.length,
+        omitted: {
+            repos: cut.length,
+            prsOpened: cut.reduce((n, r) => n + r.prsOpenedHuman + r.prsOpenedAutomation, 0),
+            linesChanged: cutSized > 0 ? cut.reduce((n, r) => n + (r.linesChanged ?? 0), 0) : null,
+        },
+    };
+}
+//# sourceMappingURL=repo-activity.js.map

package/dist/db/retention.js

@@ -0,0 +1,138 @@
+import { inArray, lt } from 'drizzle-orm';
+import { db, runTransaction, schema } from './client.js';
+import { config } from '../config.js';
+// Time-based retention sweep. Per-account server data (events, PRs + their whole subtree)
+// accumulates forever otherwise; this prunes anything past the retention window so the DB
+// stays bounded (the pre-launch, tight-budget scalability lever). Runs periodically from
+// the scheduler in BOTH deployment modes.
+//
+// THE ONE SAFE TTL KEY is `pullRequests.updatedAt < cutoff`, and we delete the WHOLE PR
+// subtree anchored to that. Two load-bearing reasons:
+//  1. Idempotency: the incremental sync re-walks a window ending at `lastIncremental −
+//     overlap` (~20 min) and a forced full sync re-walks `now − backfillDays`. A PR whose
+//     updatedAt is beyond the (clamped ≥ backfillDays) cutoff is outside BOTH windows, so
+//     it is never re-fetched → stays deleted. Keying on a CHILD's own timestamp instead
+//     (an old commit/event on a still-recent PR) would let the next sync re-create it →
+//     churn. So we anchor everything to the parent PR's recency.
+//  2. FK integrity: there is NO `ON DELETE CASCADE` anywhere (FKs ARE enforced), so the
+//     subtree is deleted manually, parent-last, in a transaction — mirroring deleteRepo.
+const { events, ciStatusEvents, reviewComments, reviewThreads, prComments, reviews, commits, reviewRequests, prViews, claudeReviews, claudeReviewFindings, pullRequests, prMentions, } = schema;
+const retentionHandlers = [];
+export function registerRetentionHandler(h) {
+    retentionHandlers.push(h);
+}
+// Batch size for the delete — bounds each transaction + the IN-clause size on both dialects.
+const BATCH = 500;
+function chunk(arr, n) {
+    const out = [];
+    for (let i = 0; i < arr.length; i += n)
+        out.push(arr.slice(i, i + n));
+    return out;
+}
+// Delete a batch of PRs and everything hanging off them, FK-safe order (children before
+// parents — the exact order deleteRepo uses). `tx` is the dialect-aware transaction executor.
+async function deletePrSubtree(tx, prIds) {
+    await tx.delete(events).where(inArray(events.prId, prIds)).execute();
+    // CI status history FKs pull_requests with ON DELETE no action (migrations 0022 / pg
+    // 0011) — it MUST go before the pullRequests delete below or the sweep FK-fails.
+    await tx.delete(ciStatusEvents).where(inArray(ciStatusEvents.prId, prIds)).execute();
+    await tx.delete(reviewComments).where(inArray(reviewComments.prId, prIds)).execute();
+    await tx.delete(reviewThreads).where(inArray(reviewThreads.prId, prIds)).execute();
+    await tx.delete(prComments).where(inArray(prComments.prId, prIds)).execute();
+    await tx.delete(reviews).where(inArray(reviews.prId, prIds)).execute();
+    await tx.delete(commits).where(inArray(commits.prId, prIds)).execute();
+    await tx.delete(reviewRequests).where(inArray(reviewRequests.prId, prIds)).execute();
+    // Review-request HISTORY (migration 0066 / pg 0053) — a PR child with no cascade; it must go
+    // before the pullRequests delete below or the sweep FK-fails.
+    await tx
+        .delete(schema.reviewRequestEvents)
+        .where(inArray(schema.reviewRequestEvents.prId, prIds))
+        .execute();
+    await tx.delete(prViews).where(inArray(prViews.prId, prIds)).execute();
+    // "@you" mention rows (migration 0056 / pg 0043). The pr_id FK cascades, but this sweep runs
+    // parent-last by hand on both dialects and a mention row outliving its PR would go on claiming
+    // a deleted PR is personally relevant.
+    await tx.delete(prMentions).where(inArray(prMentions.prId, prIds)).execute();
+    // My Turn dismissals of these PRs (migration 0069 / pg 0056) — the composite FK cascades, but this
+    // sweep runs parent-last by hand on both dialects.
+    await tx
+        .delete(schema.myTurnDismissals)
+        .where(inArray(schema.myTurnDismissals.prId, prIds))
+        .execute();
+    // Claude review runs + findings FK these PRs — clear findings (via reviewId) then runs.
+    const reviewIdRows = await tx
+        .select({ id: claudeReviews.id })
+        .from(claudeReviews)
+        .where(inArray(claudeReviews.prId, prIds))
+        .execute();
+    const reviewIds = reviewIdRows.map((r) => r.id);
+    if (reviewIds.length > 0) {
+        // Claude Review chat messages (migration 0073 / pg 0060) FK both the runs and the findings —
+        // they go first.
+        await tx
+            .delete(schema.claudeReviewChatMessages)
+            .where(inArray(schema.claudeReviewChatMessages.reviewId, reviewIds))
+            .execute();
+        await tx
+            .delete(claudeReviewFindings)
+            .where(inArray(claudeReviewFindings.reviewId, reviewIds))
+            .execute();
+    }
+    await tx.delete(claudeReviews).where(inArray(claudeReviews.prId, prIds)).execute();
+    // AI Fix runs (core since migration 0074 / pg 0061; the plugin's retention hook used to prune
+    // them). No FKs — explicit, pr-keyed.
+    await tx.delete(schema.aiFixes).where(inArray(schema.aiFixes.prId, prIds)).execute();
+    await tx.delete(pullRequests).where(inArray(pullRequests.id, prIds)).execute();
+    // NB: commitFiles is GLOBAL (sha-keyed, shared across PRs/tenants) — deliberately NOT
+    // pruned here. users + syncState are likewise out of scope.
+    //
+    // NB2: `trunk_ci_status_events` (migration 0052 / pg 0039) is deliberately absent, and its
+    // absence is STRUCTURAL, not an oversight. This whole sweep is anchored to a parent PR's
+    // `updatedAt` (see the header) and a trunk CI observation has no PR — there is nothing here to
+    // key it on, and inventing a second, differently-keyed sweep would give the file two retention
+    // definitions. It is bounded instead by a HYBRID trim in its own writer
+    // (`sync/branch-status.ts` — `staleTrunkCiEventIds`: the newest `TRUNK_CI_EVENT_WINDOW` rows per
+    // repo ∪ everything inside `FEED_WINDOW_DAYS`), which runs on every branch snapshot, and it is
+    // cleared outright by `deleteRepo` + `eraseAccountData`. ⚠ It is NOT a plain count trim: a
+    // pure newest-N bound evicted the failure rows the Feed reads on repos that sync faster than the
+    // read window elapses. `branch_commits` is out for the same reason (its hybrid trim lives in the
+    // same writer).
+}
+// Prune every PR (and subtree) older than the retention window. `retentionDays` defaults
+// to config; a test can pass a value. Returns the number of PRs pruned. No-op when
+// retention is disabled (days <= 0).
+export async function pruneOldData(log, retentionDays = config.retentionDays) {
+    if (!retentionDays || retentionDays <= 0)
+        return 0;
+    // Clamp to the backfill window so a forced full sync can't resurrect a deleted PR.
+    const effDays = Math.max(retentionDays, config.backfillDays);
+    const cutoff = new Date(Date.now() - effDays * 24 * 60 * 60 * 1000);
+    const oldRows = await db
+        .select({ id: pullRequests.id })
+        .from(pullRequests)
+        .where(lt(pullRequests.updatedAt, cutoff))
+        .execute();
+    const prIds = oldRows.map((r) => r.id);
+    if (prIds.length === 0)
+        return 0;
+    let pruned = 0;
+    for (const batch of chunk(prIds, BATCH)) {
+        await runTransaction(async (tx) => {
+            await deletePrSubtree(tx, batch);
+        });
+        // Prune plugin-owned tables for these PRs (outside the core tx — the plugin owns its
+        // own transactions; a plugin failure must not roll back the core delete). Best-effort.
+        for (const h of retentionHandlers) {
+            try {
+                await h({ prIds: batch });
+            }
+            catch (err) {
+                log.warn({ err }, 'retention: pro handler failed for a batch');
+            }
+        }
+        pruned += batch.length;
+    }
+    log.info(`retention: pruned ${pruned} PR(s) older than ${effDays}d`);
+    return pruned;
+}
+//# sourceMappingURL=retention.js.map

package/dist/db/review-threads-for-review.js

@@ -0,0 +1,240 @@
+// CLAUDE REVIEW — the OTHER reviewers' open threads on a PR (CORE, DB-only, no GitHub call).
+//
+// Two readers, ONE predicate:
+//   • the review run loads every unresolved review thread that is NOT rooted on one of Limn's own
+//     posted findings (`loadReviewThreadsForReview`) and asks Claude, per thread, whether the
+//     comment is right and whether the code has dealt with it (review/claude-review/threads.ts);
+//   • the auto-review sweeper re-reviews the SAME head when a newer qualifying comment arrives
+//     (`newestReviewCommentAt`, read by `getAutoReviewCandidates`).
+//
+// ⚠ A QUALIFYING COMMENT is a review-thread comment in an UNRESOLVED thread that Limn did NOT post,
+// by a person or a review bot (the `countsAuthor` filter below). Both readers go through `isLimnPostedComment`, so the comment
+// the run records as "seen" (`claude_reviews.comments_through`) and the comment the sweeper treats
+// as "new" can never disagree; if they did, a review could re-trigger itself forever.
+//
+// ⚠ HOW WE KNOW LIMN POSTED IT. Limn posts AS THE READER (their own GitHub token), so TWO facts
+// must hold together:
+//   A. the comment's author is the ACCOUNT'S OWN GitHub login (accounts.github_login, compared
+//      case-insensitively) — a marker someone else pasted, or a teammate's own Limn post, is
+//      another reviewer's comment; and
+//   B. it carries Limn's provenance — any one of:
+//      1. the hidden `<!-- pierre:claude-review` marker. Every finding comment carries
+//         `<!-- pierre:claude-review-finding v=1 -->` (post-review.ts FINDING_COMMENT_MARKER), review
+//         bodies their own spelling of it. It survives an edit on GitHub. ⚠ The retired per-ticket
+//         "Post as comment" stamped `<!-- pierre:claude-review-ticket v=1 -->`; nothing produces it
+//         now (a story's results post as findings), but comments already on GitHub carry it, so
+//         the match stays a PREFIX — never narrow it to the finding spelling;
+//      2. LEGACY, for comments posted before that marker existed: the comment's GitHub id is a
+//         posted finding's `github_comment_id`, or its text STARTS WITH a posted finding's resolved
+//         body (an edit on GitHub defeats this one — hence the marker).
+// An unknown author (a deleted account, an unsynced user) is never "own".
+//
+// ⚠ ONLY REAL REVIEWERS MOVE THE TRIGGER. The comment-time half (`newestReviewCommentAt`, and the
+// loader's `newestCommentAt` that becomes `comments_through`) also takes a `countsAuthor` filter —
+// built ONCE per workspace by db/queries.ts `reReviewCommentAuthorFilter`: a person, or a bot whose
+// role in this workspace is `'review'`. CI, coverage, deploy and dependency bots never re-trigger a
+// review. Both readers get the SAME filter, so what a run records as seen and what the sweeper
+// calls new still agree. ⚠ The THREADS themselves are not filtered: the review still assesses
+// every open thread, whoever wrote it.
+import { and, eq, gt, inArray, isNotNull } from 'drizzle-orm';
+import { db, schema } from './client.js';
+import { globalAutomationUserIds } from './automation-ids.js';
+const LIMN_MARKER = /<!--\s*pierre:claude-review/i;
+const norm = (s) => s.replace(/\r\n?/g, '\n').trim();
+/** The account's own GitHub login — the author half of `isLimnPostedComment`. */
+export async function accountGithubLogin(accountId) {
+    const row = (await db
+        .select({ login: schema.accounts.githubLogin })
+        .from(schema.accounts)
+        .where(eq(schema.accounts.id, accountId))
+        .limit(1)
+        .execute())[0];
+    return row?.login ?? null;
+}
+/** Is this review-thread comment one Limn posted? (The ONE predicate — see the header.) */
+export function isLimnPostedComment(c, own, accountLogin) {
+    if (!accountLogin || !c.authorLogin)
+        return false;
+    if (c.authorLogin.toLowerCase() !== accountLogin.toLowerCase())
+        return false;
+    const body = c.body ?? '';
+    if (LIMN_MARKER.test(body))
+        return true;
+    if (!own)
+        return false;
+    if (c.databaseId != null && own.commentIds.has(c.databaseId))
+        return true;
+    const text = norm(body);
+    if (!text)
+        return false;
+    return own.bodies.some((b) => b.length > 0 && text.startsWith(b));
+}
+/** Every POSTED finding's resolved body + stored comment id, per PR (account-scoped). */
+export async function ownPostedCommentsForPrs(accountId, prIds) {
+    const out = new Map();
+    if (prIds.length === 0)
+        return out;
+    const { claudeReviews: cr, claudeReviewFindings: crf } = schema;
+    const rows = await db
+        .select({
+        prId: cr.prId,
+        body: crf.body,
+        editedBody: crf.editedBody,
+        githubCommentId: crf.githubCommentId,
+    })
+        .from(crf)
+        .innerJoin(cr, eq(cr.id, crf.reviewId))
+        .where(and(eq(cr.accountId, accountId), inArray(cr.prId, [...prIds]), isNotNull(crf.postedAt)))
+        .execute();
+    for (const r of rows) {
+        let o = out.get(r.prId);
+        if (!o) {
+            o = { bodies: [], commentIds: new Set() };
+            out.set(r.prId, o);
+        }
+        const resolved = r.editedBody && r.editedBody.trim() ? r.editedBody : r.body;
+        o.bodies.push(norm(resolved));
+        if (r.githubCommentId)
+            o.commentIds.add(r.githubCommentId);
+    }
+    return out;
+}
+/**
+ * The newest QUALIFYING review-thread comment per PR, created strictly after `since` (a lower bound
+ * that keeps the scan small; pass the oldest cutoff you care about). PRs with none are absent.
+ */
+export async function newestReviewCommentAt(accountId, prIds, since, 
+// TRAILING: only these authors' comments count (see the header). Absent ⇒ every author.
+countsAuthor) {
+    const out = new Map();
+    if (prIds.length === 0)
+        return out;
+    const { reviewComments: rc, reviewThreads: rt, pullRequests: prs, users } = schema;
+    const rows = await db
+        .select({
+        prId: rc.prId,
+        createdAt: rc.createdAt,
+        body: rc.body,
+        databaseId: rc.databaseId,
+        authorId: rc.authorId,
+        authorLogin: users.githubLogin,
+    })
+        .from(rc)
+        .innerJoin(rt, eq(rt.id, rc.threadId))
+        .innerJoin(prs, eq(prs.id, rc.prId))
+        .leftJoin(users, eq(users.id, rc.authorId))
+        .where(and(eq(prs.accountId, accountId), inArray(rc.prId, [...prIds]), eq(rt.isResolved, false), gt(rc.createdAt, since)))
+        .execute();
+    if (rows.length === 0)
+        return out;
+    const [own, login] = await Promise.all([
+        ownPostedCommentsForPrs(accountId, [...new Set(rows.map((r) => r.prId))]),
+        accountGithubLogin(accountId),
+    ]);
+    for (const r of rows) {
+        if (isLimnPostedComment(r, own.get(r.prId), login))
+            continue;
+        if (countsAuthor && !countsAuthor(r.authorId ?? null))
+            continue;
+        const prev = out.get(r.prId);
+        if (!prev || r.createdAt.getTime() > prev.getTime())
+            out.set(r.prId, r.createdAt);
+    }
+    return out;
+}
+/**
+ * Every unresolved review thread on the PR that is NOT rooted on one of Limn's own posted findings,
+ * with its comments. Account-scoped (a foreign PR reads as no threads). `authorIsBot` is the GLOBAL
+ * automation set (`globalAutomationUserIds`) — the ball rule's set, which needs no workspace.
+ */
+export async function loadReviewThreadsForReview(accountId, prId, 
+// TRAILING: which authors move `newestCommentAt` (never which threads are sent). Absent ⇒ all.
+countsAuthor) {
+    const { reviewComments: rc, reviewThreads: rt, pullRequests: prs, repos, users, commits } = schema;
+    const pr = (await db
+        .select({ number: prs.number, owner: repos.owner, name: repos.name })
+        .from(prs)
+        .innerJoin(repos, eq(repos.id, prs.repoId))
+        .where(and(eq(prs.id, prId), eq(prs.accountId, accountId)))
+        .limit(1)
+        .execute())[0];
+    if (!pr)
+        return { threads: [], newestCommentAt: null };
+    const rows = await db
+        .select({
+        threadId: rt.id,
+        path: rt.path,
+        line: rt.line,
+        isOutdated: rt.isOutdated,
+        derivedState: rt.derivedState,
+        commentId: rc.id,
+        body: rc.body,
+        excerpt: rc.excerpt,
+        databaseId: rc.databaseId,
+        createdAt: rc.createdAt,
+        authorId: rc.authorId,
+        authorLogin: users.githubLogin,
+    })
+        .from(rt)
+        .innerJoin(rc, eq(rc.threadId, rt.id))
+        .leftJoin(users, eq(users.id, rc.authorId))
+        .where(and(eq(rt.prId, prId), eq(rt.isResolved, false)))
+        .execute();
+    if (rows.length === 0)
+        return { threads: [], newestCommentAt: null };
+    const [ownMap, bots, commitRows, login] = await Promise.all([
+        ownPostedCommentsForPrs(accountId, [prId]),
+        globalAutomationUserIds(),
+        db.select({ committedAt: commits.committedAt }).from(commits).where(eq(commits.prId, prId)).execute(),
+        accountGithubLogin(accountId),
+    ]);
+    const own = ownMap.get(prId);
+    const commitTimes = commitRows.map((c) => c.committedAt.getTime());
+    const after = (t) => commitTimes.filter((c) => c > t.getTime()).length;
+    const byThread = new Map();
+    for (const r of rows) {
+        const list = byThread.get(r.threadId) ?? [];
+        list.push(r);
+        byThread.set(r.threadId, list);
+    }
+    let newest = null;
+    const threads = [];
+    for (const list of byThread.values()) {
+        list.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime() || a.commentId - b.commentId);
+        const root = list[0];
+        const rootIsOwn = isLimnPostedComment(root, own, login);
+        const kept = list.filter((c) => !isLimnPostedComment(c, own, login));
+        for (const c of kept) {
+            if (countsAuthor && !countsAuthor(c.authorId ?? null))
+                continue;
+            if (!newest || c.createdAt > newest)
+                newest = c.createdAt;
+        }
+        // A thread rooted on Limn's own posted finding belongs to the follow-up, not here.
+        if (rootIsOwn || kept.length === 0)
+            continue;
+        const first = kept[0];
+        const last = kept[kept.length - 1];
+        threads.push({
+            threadId: root.threadId,
+            path: root.path,
+            line: root.line,
+            isOutdated: root.isOutdated,
+            derivedState: root.derivedState,
+            url: root.databaseId
+                ? `https://github.com/${pr.owner}/${pr.name}/pull/${pr.number}#discussion_r${root.databaseId}`
+                : null,
+            comments: kept.map((c) => ({
+                authorLogin: c.authorLogin ?? null,
+                authorIsBot: c.authorId != null && bots.has(c.authorId),
+                createdAt: c.createdAt,
+                body: (c.body ?? c.excerpt ?? '').trim(),
+            })),
+            commitsAfterFirstComment: after(first.createdAt),
+            commitsAfterLastComment: after(last.createdAt),
+        });
+    }
+    threads.sort((a, b) => a.threadId - b.threadId);
+    return { threads, newestCommentAt: newest };
+}
+//# sourceMappingURL=review-threads-for-review.js.map

package/dist/db/run-migrations.js

@@ -0,0 +1,24 @@
+import { resolve } from 'node:path';
+import { db, isPg } from './client.js';
+// Apply pending migrations against the shared connection. Dialect-aware: the
+// sqlite migrator is synchronous, the node-postgres migrator is async — so this
+// is `async` either way and the caller (index.ts / migrate.ts) awaits it. Each
+// dialect resolves its own migrations folder next to the compiled output
+// (dist/db/migrations or dist/db/migrations-pg). Safe at server startup — does
+// not close the connection.
+export async function runMigrations() {
+    const migrationsFolder = resolve(import.meta.dirname, isPg ? 'migrations-pg' : 'migrations');
+    if (isPg) {
+        const { migrate } = await import('drizzle-orm/node-postgres/migrator');
+        await migrate(db, {
+            migrationsFolder,
+        });
+    }
+    else {
+        const { migrate } = await import('drizzle-orm/better-sqlite3/migrator');
+        // `db` is typed as the pg instance; at runtime here it's the better-sqlite3
+        // one, which is what the sqlite migrator expects.
+        migrate(db, { migrationsFolder });
+    }
+}
+//# sourceMappingURL=run-migrations.js.map