pierre-review 0.1.60 → 0.1.62

package/dist/api/plugins/auth.js

@@ -32,6 +32,7 @@ export function registerAccountContext(app) {
                     isLocal: true,
                     plan: 'free',
                     stripeCustomerId: null,
+                    aiCreditAllowance: null,
                 };
         }
     });

package/dist/api/routes/activity.js

@@ -11,17 +11,17 @@ function parseIntList(raw) {
 }
 export async function activityRoutes(app) {
     // The Activity aggregate: per repo, current-state stats + thread totals +
-    // attention/unread flags + open PRs. Scoped to the account; `repoIds` + `userIds`
-    // narrow to the active FilterBar repo + member selection (across ALL the account's
-    // repos — watched-only was dropped). Pure DB read — no GitHub sync, no AI.
+    // attention/unread flags + open PRs. Scoped to the account's WATCHED repos (inboxWatch);
+    // `repoIds` + `userIds` narrow to the active FilterBar repo + member selection WITHIN
+    // watched. Pure DB read — no GitHub sync, no AI.
     app.get('/api/activity', async (req) => {
         const q = req.query;
         return getActivity(accountIdOf(req), parseIntList(q.repoIds), parseIntList(q.userIds));
     });
     // The consolidated Feed (the Activity "Feed" entry): one flat, chronological stream
-    // merging My Turn actionables + the activity feed, deduped. Scoped by the FilterBar
-    // repo + member selection across ALL the account's repos (watched-only dropped).
-    // Pure DB read — no GitHub sync, no AI.
+    // merging My Turn actionables + the activity feed, deduped. Scoped to the account's
+    // WATCHED repos (inboxWatch); the FilterBar repo + member selection narrow WITHIN
+    // watched. Pure DB read — no GitHub sync, no AI.
     app.get('/api/activity/feed', async (req) => {
         const q = req.query;
         const limit = q.limit != null ? Number(q.limit) : null;

package/dist/api/routes/me.js

@@ -27,9 +27,20 @@ export async function meRoutes(app) {
         // baseline exists (feedLastSeenAt set by the first feed view) so a fresh account
         // never sees a scary first-load number. FYI is a Pro capability — the count comes
         // from the plugin's enricher (0 on the free tier, where there's no provider).
+        // Per-account entitlement: local = full capabilities (unchanged); cloud = full only when
+        // the account's plan isn't 'free' (Stripe billing seam). Computed once and reused for both
+        // the FYI gate and the `pro` passthrough below.
+        const entitled = req.account
+            ? entitledProCapabilities(req.account)
+            : EMPTY_CAPABILITIES;
         const feedLastSeen = await getFeedLastSeenAt(accountId);
         const fyi = getFyiProvider();
-        const newFeedItems = feedLastSeen && fyi ? await fyi.countNewSince(accountId, feedLastSeen) : 0;
+        // FYI is the Pro `feedMyTurn` capability. Gate the count on ENTITLEMENT, not just provider
+        // presence: once Pro loads in cloud the provider is registered process-globally for every
+        // account, so a free cloud account would otherwise leak an FYI count it hasn't paid for.
+        const newFeedItems = feedLastSeen && fyi && entitled.feedMyTurn
+            ? await fyi.countNewSince(accountId, feedLastSeen)
+            : 0;
         return {
             user,
             counts: {
@@ -44,9 +55,7 @@ export async function meRoutes(app) {
             newFeedItems,
             // Claude Review is now the Pro `claudeReview` capability (in `pro` below).
             deploymentMode: config.deploymentMode,
-            // Per-account entitlement: local = full capabilities (unchanged); cloud =
-            // full only when the account's plan isn't 'free' (Stripe billing seam).
-            pro: req.account ? entitledProCapabilities(req.account) : EMPTY_CAPABILITIES,
+            pro: entitled,
         };
     });
     app.get('/api/my-turn', async (req) => getMyTurn(accountIdOf(req)));

package/dist/api/routes/timeline.js

@@ -81,6 +81,7 @@ export async function timelineRoutes(app) {
             from: parseDate(q.from, new Date(now.getTime() - 14 * DAY_MS)),
             to: parseDate(q.to, now),
             repoIds: parseIntList(q.repoIds),
+            prIds: parseIntList(q.prIds),
             userIds: parseIntList(q.userIds),
             types: parseTypes(q.types),
             statuses: parseStatuses(q.statuses),

package/dist/auth/account.js

@@ -34,6 +34,7 @@ function rowToAccount(row) {
         isLocal: row.isLocal,
         plan: row.plan === 'pro' ? 'pro' : 'free',
         stripeCustomerId: row.stripeCustomerId,
+        aiCreditAllowance: row.aiCreditAllowance ?? null,
     };
 }
 // Module cache of the local account, set by ensureLocalAccount() at startup so

package/dist/config.js

@@ -135,10 +135,15 @@ export const config = {
     // Webhook signing secret (whsec_…) for POST /api/billing/webhook. Empty = the
     // webhook replies 501 and no billing state ever changes.
     stripeWebhookSecret: process.env.STRIPE_WEBHOOK_SECRET ?? '',
-    // Pro plugin master gate. Pro is local-only for now; bind.ts skips the dynamic
-    // import entirely when false. PRO_DISABLED=true forces pure-OSS mode even when
-    // the submodule is checked out (used to exercise/capture the free tier).
-    proEnabled: !isCloud && process.env.PRO_DISABLED !== 'true',
+    // Pro plugin master gate. bind.ts skips the dynamic import entirely when false.
+    // PRO_DISABLED=true forces pure-OSS mode even when the submodule is checked out (used to
+    // exercise/capture the free tier). Local defaults ON. In CLOUD it stays OFF unless
+    // PRO_CLOUD_ENABLED=true (the paid summary-AI tier — set on the Railway image), so the
+    // public Dockerfile / OSS npm path is byte-identical to before. Even when true in cloud,
+    // per-account entitlement (plan !== 'free') + the /api/pro/* 402 gate decide who actually
+    // gets Pro; agentic AI stays independently gated by PRO_ADVANCED_AI_ENABLED (unset → off).
+    proEnabled: process.env.PRO_DISABLED !== 'true' &&
+        (!isCloud || process.env.PRO_CLOUD_ENABLED === 'true'),
     // Per-repo digest (Pro, Workstream 2) config — consumed by @pierre/pro, kept in
     // core so the model id / budgets live in one place and aren't hardcoded at call
     // sites. Inert until the plugin is present AND digestEnabled.
@@ -235,5 +240,13 @@ export function assertCloudConfig() {
     if (Buffer.from(config.encryptionKey, 'hex').length !== 32) {
         throw new Error('ENCRYPTION_KEY must be 32 bytes as 64 hex chars (generate with `openssl rand -hex 32`).');
     }
+    // When Pro is cloud-enabled the SUMMARY seam needs its OWN metered credential: there is no
+    // ambient logged-in `claude` session on Railway, so without SUMMARY_ANTHROPIC_API_KEY every
+    // summary completion has no credential and silently fails. Fail loud instead.
+    if (config.proEnabled && !process.env.SUMMARY_ANTHROPIC_API_KEY) {
+        throw new Error('Cloud Pro (PRO_CLOUD_ENABLED=true) requires SUMMARY_ANTHROPIC_API_KEY — the metered ' +
+            'Anthropic key the summary seam spends against (no ambient Claude session exists in cloud). ' +
+            'Set it or unset PRO_CLOUD_ENABLED. See docs/DEPLOY-RAILWAY.md.');
+    }
 }
 //# sourceMappingURL=config.js.map

package/dist/db/credits.js

@@ -0,0 +1,46 @@
+import { getAiUsageSummary } from './usage.js';
+// USD → credits conversion, MIRRORED from @pierre-review/shared AI_CREDITS_PER_USD. Inlined
+// here (not imported) because the release guard forbids a real runtime import of the
+// types-only shared package into release/dist — the same reason the pro plugin inlines its
+// own copy. Keep all three in lockstep (shared + this + packages/pro/src/insights/routes.ts).
+// $1 of model cost = 1250 credits, so the paid plan's 2,500-credit allowance ≈ $2.00 of spend.
+export const AI_CREDITS_PER_USD = 1250;
+// The default monthly SUMMARY-AI credit allowance for a paid cloud account. Overridable per
+// account via accounts.aiCreditAllowance (a forward hook for top-ups / alternate plans).
+export const DEFAULT_AI_CREDIT_ALLOWANCE = 2500;
+const toCredits = (usd) => Math.round(usd * AI_CREDITS_PER_USD);
+// UTC first-of-month epoch ms — the month-to-date window start (matches the /api/pro/ai-usage
+// route). Monthly reset is automatic: the window rolls at the UTC month boundary.
+export function monthStartMs(nowMs) {
+    const d = new Date(nowMs);
+    return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), 1);
+}
+// The account's allowance in credits, or null when unmetered.
+// - local (isLocal): unmetered — null (never blocked; today's behavior).
+// - paid cloud (plan !== 'free'): the per-account override, else the plan default (2,500).
+// - free cloud: a zero allowance (belt-and-braces — the /api/pro/* 402 gate already blocks
+//   these accounts before any Pro route runs).
+function allowanceFor(account) {
+    if (account.isLocal)
+        return null;
+    if (account.plan !== 'free')
+        return account.aiCreditAllowance ?? DEFAULT_AI_CREDIT_ALLOWANCE;
+    return 0;
+}
+// The PURE credit-ledger computation (no I/O) — month-to-date spend vs. the allowance. Split
+// out from aiCreditStatus so the budget math is unit-testable without a DB. usedCredits sums
+// each seam rounded independently, matching the /api/pro/ai-usage meter exactly.
+export function computeAiCreditStatus(account, usage) {
+    const allowanceCredits = allowanceFor(account);
+    const usedCredits = toCredits(usage.summaryUsd) + toCredits(usage.agentUsd);
+    const remainingCredits = allowanceCredits == null ? null : Math.max(0, allowanceCredits - usedCredits);
+    const blocked = remainingCredits != null && remainingCredits <= 0;
+    return { allowanceCredits, usedCredits, remainingCredits, blocked };
+}
+// The per-account credit-ledger status: reads the month-to-date ledger and applies the pure
+// computation above. This is what ctx.aiCredits.check calls per generation.
+export async function aiCreditStatus(account, nowMs) {
+    const usage = await getAiUsageSummary(account.id, monthStartMs(nowMs));
+    return computeAiCreditStatus(account, usage);
+}
+//# sourceMappingURL=credits.js.map

package/dist/db/migrations/0026_ai_credit_allowance.sql

@@ -0,0 +1,5 @@
+-- Per-account monthly SUMMARY-AI credit allowance override (metered cloud plan). Nullable,
+-- no default: null = use the plan default (2,500 for a paid cloud account); local/unlimited
+-- accounts ignore it. A forward hook for top-ups / alternate plans without another migration.
+-- The Postgres baseline is regenerated separately via `pnpm db:generate:pg`.
+ALTER TABLE `accounts` ADD `ai_credit_allowance` integer;

package/dist/db/migrations/meta/_journal.json

@@ -183,6 +183,13 @@
       "when": 1783296000000,
       "tag": "0025_account_billing",
       "breakpoints": true
+    },
+    {
+      "idx": 26,
+      "version": "6",
+      "when": 1783382400000,
+      "tag": "0026_ai_credit_allowance",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0015_aspiring_black_tom.sql

@@ -0,0 +1 @@
+ALTER TABLE "accounts" ADD COLUMN "ai_credit_allowance" integer;