@0xcraft/powershot 1.1.1 → 1.1.3

package/README.md

@@ -20,13 +20,14 @@ PowerShot reviews the failure modes that plausible-looking generated code tends
 hide: invented APIs, undeclared dependencies, dropped guards, swallowed errors,
 tests that prove nothing, bent expectations, stale callers, and duplicated helpers.
 
-It asks compilers, parsers, manifests, reference graphs, and pre/post ASTs first.
-Optional model judges only handle questions that still require judgement.
+It asks self-contained parsers, manifests, and pre/post ASTs first, then uses compiler
+types and reference graphs when the environment can supply them. Optional model judges
+only handle questions that still require judgement.
 
 <table>
   <tr>
     <td width="33%"><strong>Deterministic first</strong><br>Local checks need no model, key, tokens, or network calls.</td>
-    <td width="33%"><strong>Honest completion</strong><br>A partial run cannot present itself as a clean verdict.</td>
+    <td width="33%"><strong>Honest coverage</strong><br>Portable, full, partial, and failed runs stay distinguishable.</td>
     <td width="33%"><strong>CI-native output</strong><br>One run emits terminal, Markdown, JSON, SARIF, manifest, and Code Quality reports.</td>
   </tr>
 </table>
@@ -89,7 +90,7 @@ flowchart LR
 
 1. **Snapshot** resolves the exact tree the review is about.
 2. **Ground** builds the available type, syntax, dependency, and reference oracles.
-3. **Plan** assigns checks and missing capabilities to each file individually.
+3. **Plan** assigns baseline checks and enriched semantic capabilities to each file individually.
 4. **Verify** runs deterministic checks and records what actually executed.
 5. **Judge** optionally reviews bounded bundles of related files.
 6. **Manifest** decides whether the result is complete, partial, or failed.
@@ -108,8 +109,11 @@ Every finding says where it came from:
 | `verified` | `firm` | A deterministic heuristic fired; inspect the evidence |
 | `judged` | `firm` or `tentative` | A model supplied the judgement and provenance |
 
-PowerShot stays silent when a required oracle is unavailable. The missing capability
-is written to the manifest instead of being counted as a pass.
+Portable coverage is the default: self-contained oracles run without bootstrapping the
+reviewed repository, while unavailable compiler/reference depth stays visible in the
+manifest and reports. Set `"coverage": "strict"`, or explicitly select a check with
+`--checks`, when a missing semantic oracle must make the run partial. An unavailable
+oracle is never counted as a pass in either profile.
 
 ## Deterministic checks
 
@@ -174,33 +178,39 @@ commands.
 
 ```mermaid
 flowchart LR
-    START["Selected files and checks"] --> ACCOUNT{"Everything accounted for?"}
-    ACCOUNT -- "yes" --> FINDINGS{"Findings?"}
+    START["Selected files and checks"] --> ACCOUNT{"Required work accounted for?"}
+    ACCOUNT -- "yes" --> DEPTH{"Enriched semantic depth available?"}
+    DEPTH -- "yes" --> FULL["full coverage"]
+    DEPTH -- "no · portable policy" --> PORTABLE["portable coverage · gaps named"]
+    FULL --> FINDINGS{"Findings?"}
+    PORTABLE --> FINDINGS
     FINDINGS -- "no" --> CLEAN["exit 0 · complete and clean"]
     FINDINGS -- "yes" --> FOUND["exit 1 · complete with findings"]
-    ACCOUNT -- "capability or budget gap" --> PARTIAL["exit 3 · partial"]
+    ACCOUNT -- "required oracle or budget gap" --> PARTIAL["exit 3 · partial"]
     ACCOUNT -- "required stage failed" --> FAILED["exit 3 · failed"]
 
     classDef neutral fill:#172033,stroke:#57a6ff,color:#f0f6fc,stroke-width:2px
     classDef good fill:#17251f,stroke:#4ac58b,color:#f0f6fc,stroke-width:2px
     classDef warn fill:#2a2117,stroke:#f2b84b,color:#f0f6fc,stroke-width:2px
     classDef bad fill:#2a191b,stroke:#ff675c,color:#f0f6fc,stroke-width:2px
-    class START,ACCOUNT,FINDINGS neutral
+    class START,ACCOUNT,DEPTH,FINDINGS neutral
     class CLEAN good
-    class FOUND,PARTIAL warn
+    class FULL,PORTABLE,FOUND,PARTIAL warn
     class FAILED bad
 ```
 
 | Exit | Contract |
 |---:|---|
-| `0` | Review completed and found nothing at the selected severity |
-| `1` | Review completed and reported findings |
+| `0` | Review completed in full or portable coverage and found nothing at the selected severity |
+| `1` | Review completed in full or portable coverage and reported findings |
 | `2` | Command or Git input was invalid |
 | `3` | Review is incomplete; findings may be missing |
 
-“No findings” and “PowerShot could not look” are intentionally different pipeline
-outcomes. Use `--format manifest` to inspect file dispositions, executed checks,
-skips, failures, judge units, and `notLookedAt`.
+A clean report names its effective severity threshold, deterministic/model mode, file
+and check counts, and coverage level. A partial or failed review instead says it is not
+a verdict and keeps the missing work visible. Use `--format manifest` to inspect file
+dispositions, executed and unavailable checks, failures, judge units, and
+`notLookedAt`.
 
 ## CI integration
 
@@ -211,8 +221,6 @@ The composite action is the shortest setup for GitHub:
   with:
     fetch-depth: 0
 
-- run: npm ci --ignore-scripts
-
 - uses: xcrft/powershot@v1
   with:
     verify-only: 'true'
@@ -222,11 +230,11 @@ The composite action is the shortest setup for GitHub:
     fail-on-findings: 'true'
 ```
 
-Install the checked-out project's dependencies before PowerShot so TypeScript can
-resolve its declared ambient types. The example disables lifecycle scripts because
-pull-request code is untrusted; use the equivalent safe install for another package
-manager. In a monorepo, install from the workspace root or add safe install steps for
-the affected package roots.
+The default portable profile needs no install from the checked-out repository. That is
+the safe default for private monorepos and fork pull requests: do not expose a package
+registry credential merely to enrich a review of untrusted code. If a trusted job
+already has dependencies, PowerShot uses their TypeScript declarations automatically.
+Set `"coverage": "strict"` when missing compiler/reference oracles must block instead.
 
 PowerShot discovers `tsconfig.json` and `tsconfig.*.json` along the ancestor chain of
 each changed file. One review can use several independent package projects, skip
@@ -266,6 +274,7 @@ Anthropic, OpenAI, and Gemini providers are supported.
   "judges": {
     "enable": ["plausible-logic", "test-adequacy", "intent"]
   },
+  "coverage": "portable",
   "minSeverity": "low",
   "ignore": ["**/generated/**"],
   "promptCache": true
@@ -300,8 +309,11 @@ psh review --verify-only --absorb /tmp/powershot-findings.json
 | C | Syntax-backed checks that do not require exception semantics |
 | Solidity | Declared syntax-backed checks |
 
-PowerShot loads a bounded number of grammars per run. Unsupported or unavailable
-coverage is named in the manifest.
+Every declared language is parsed in disposable, language-isolated workers. Sources
+are sent in bounded batches, so a mixed-language monorepo does not accumulate every
+compiled WASM grammar in one process. If a declared parser cannot run, the review
+fails loudly; it is never silently waived. All eleven packs plus TypeScript and
+JavaScript are exercised together by the integration suite.
 
 ## Project guide
 

package/dist/cli/reports.js

@@ -4,6 +4,7 @@ import { codeQuality } from '#app/report/codequality.js';
 import { compact } from '#app/report/compact.js';
 import { markdown } from '#app/report/markdown.js';
 import { sarif } from '#app/report/sarif.js';
+import { summarizeRun } from '#app/report/summary.js';
 import { terminal } from '#app/report/terminal.js';
 export const REPORT_FORMATS = ['text', 'compact', 'markdown', 'json', 'sarif', 'codequality', 'manifest'];
 export function isReportFormat(value) {
@@ -37,13 +38,13 @@ export function renderReport(format, result, manifest, target) {
         return sarif(result.findings);
     if (format === 'json')
         return jsonResult(result);
+    const summary = summarizeRun(manifest);
     if (format === 'markdown')
-        return markdown(result.findings, manifest);
+        return markdown(result.findings, summary);
     return terminal(result.findings, {
         subtitle: target,
         ...result.stats,
-        state: manifest.state,
-        notLookedAt: manifest.notLookedAt,
+        ...summary,
     });
 }
 export function publishReports(options) {

package/dist/cli/review-command.js

@@ -10,6 +10,7 @@ import { Trace } from '#app/otel.js';
 import { PACKAGE_VERSION } from '#app/package-meta.js';
 import { dim, yellow } from '#app/report/ansi.js';
 import { progress, stage } from '#app/report/terminal.js';
+import { summarizeRun } from '#app/report/summary.js';
 import { review } from '#app/review.js';
 import { scanPaths } from '#app/scan.js';
 import { Session } from '#app/session.js';
@@ -222,9 +223,11 @@ export async function runReviewCommand(command, values, positionals) {
             model: config.model,
             tools: values.tools,
             verifyOnly: values['verify-only'],
+            minSeverity: config.minSeverity,
         },
         files: result.plan?.items() ?? [],
         skippedChecks: result.skippedChecks ?? [],
+        unavailableChecks: result.unavailableChecks ?? [],
         findings: {
             total: result.findings.length,
             verified: result.stats.verified,
@@ -246,7 +249,7 @@ export async function runReviewCommand(command, values, positionals) {
         record.notLookedAt.push(failure);
         process.stderr.write(yellow(' ◇ manifest') + dim(' ' + gaps.join('; ')) + '\n');
     }
-    session?.saveReport(result.findings, { state: record.state, notLookedAt: record.notLookedAt });
+    session?.saveReport(result.findings, summarizeRun(record));
     writeManifest(root, record);
     publishReports({
         format: values.format,

package/dist/cli/session-command.js

@@ -42,6 +42,12 @@ export function runSessionCommand(positionals) {
             started: session.started,
             state: session.report.state ?? 'unknown',
             notLookedAt: session.report.notLookedAt ?? ['session predates verdict recording'],
+            coverage: session.report.coverage,
+            verifyOnly: session.report.verifyOnly,
+            minSeverity: session.report.minSeverity,
+            filesReviewed: session.report.filesReviewed,
+            deterministicChecks: session.report.deterministicChecks,
+            scopeDetails: session.report.scopeDetails,
         }));
         process.stdout.write(output + '\n');
         return 0;

package/dist/config.js

@@ -9,6 +9,7 @@ const DEFAULTS = {
     // security may duplicate SAST; convention needs repository idioms in the diff
     judges: ['plausible-logic', 'test-adequacy', 'intent'],
     minSeverity: 'low',
+    coverage: 'portable',
     // findings in vendored trees are not decisions made by this repository
     ignore: [
         '**/node_modules/**', '**/dist/**', '**/build/**', '**/*.generated.*', '**/*.min.js',
@@ -33,6 +34,7 @@ export function policyChanged(root, baseRef) {
 }
 const KEYS = new Set([...Object.keys(DEFAULTS), 'checks']);
 const PROVIDERS = new Set(['anthropic', 'openai', 'gemini']);
+const COVERAGE = new Set(['portable', 'strict']);
 /** A misspelled name in the config is the quietest way to get a clean review. */
 export function validateConfig(raw, known) {
     const problems = [];
@@ -50,6 +52,9 @@ export function validateConfig(raw, known) {
     if (raw.minSeverity !== undefined && !SEVERITIES.includes(raw.minSeverity)) {
         problems.push('minSeverity "' + String(raw.minSeverity) + '" is not one of: ' + SEVERITIES.join(', '));
     }
+    if (raw.coverage !== undefined && !COVERAGE.has(String(raw.coverage))) {
+        problems.push('coverage "' + String(raw.coverage) + '" is not one of: ' + [...COVERAGE].join(', '));
+    }
     for (const [field, names] of [['verifiers', known.verifiers], ['judges', known.judges]]) {
         const value = raw[field];
         if (value === undefined)

package/dist/github/api.js

@@ -0,0 +1,198 @@
+import { stripControl } from '#app/text.js';
+const API_VERSION = '2022-11-28';
+const API_TIMEOUT_MS = 20_000;
+const MAX_API_PAGES = 100;
+export function createReviewPayload(commitId, comments) {
+    return {
+        commit_id: commitId,
+        body: `PowerShot posted ${comments.length} proven verified finding(s) on changed lines.`,
+        event: 'COMMENT',
+        comments,
+    };
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requiredString(value, name) {
+    if (typeof value !== 'string' || value.length === 0)
+        throw new Error(`GitHub API returned no ${name}`);
+    return value;
+}
+function nextLink(value) {
+    if (value === null)
+        return undefined;
+    for (const part of value.split(',')) {
+        const match = /^\s*<([^>]+)>;\s*rel="([^"]+)"\s*$/.exec(part);
+        if (match?.[2] === 'next')
+            return match[1];
+    }
+    return undefined;
+}
+function errorDetail(value) {
+    return stripControl(value).replace(/\r?\n/g, ' ').slice(0, 500);
+}
+function issueComment(value, index) {
+    if (!record(value) ||
+        !Number.isSafeInteger(value.id) ||
+        (value.body !== null && typeof value.body !== 'string')) {
+        throw new Error(`GitHub API issue comment ${index + 1} has an invalid contract`);
+    }
+    const user = record(value.user) && typeof value.user.login === 'string'
+        ? { login: value.user.login }
+        : undefined;
+    return { id: Number(value.id), body: value.body ?? '', user };
+}
+/** Shared REST transport for the two pull-request publication adapters. */
+export class GitHubPullRequestApi {
+    token;
+    pullNumber;
+    base;
+    pullPath;
+    issuePath;
+    issueCommentPath;
+    constructor(apiUrl, token, owner, repository, pullNumber) {
+        this.token = token;
+        this.pullNumber = pullNumber;
+        this.base = apiUrl.replace(/\/$/, '');
+        const repositoryPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`;
+        this.pullPath = `${repositoryPath}/pulls`;
+        this.issuePath = `${repositoryPath}/issues/${pullNumber}`;
+        this.issueCommentPath = `${repositoryPath}/issues/comments`;
+    }
+    url(endpoint) {
+        if (!endpoint.startsWith('http://') && !endpoint.startsWith('https://'))
+            return this.base + endpoint;
+        if (endpoint !== this.base && !endpoint.startsWith(this.base + '/')) {
+            throw new Error('GitHub pagination left the configured API origin');
+        }
+        return endpoint;
+    }
+    async request(method, endpoint, body, acceptedStatuses = []) {
+        const response = await fetch(this.url(endpoint), {
+            method,
+            headers: {
+                Accept: 'application/vnd.github+json',
+                Authorization: `Bearer ${this.token}`,
+                'User-Agent': 'PowerShot',
+                'X-GitHub-Api-Version': API_VERSION,
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(API_TIMEOUT_MS),
+        });
+        const source = await response.text();
+        if (!response.ok) {
+            if (acceptedStatuses.includes(response.status))
+                return { data: undefined };
+            throw new Error(`GitHub API ${method} failed with ${response.status}: ${errorDetail(source)}`);
+        }
+        const data = source.length === 0 ? undefined : JSON.parse(source);
+        return { data, next: nextLink(response.headers.get('link')) };
+    }
+    async all(endpoint) {
+        const out = [];
+        const seen = new Set();
+        let next = endpoint + (endpoint.includes('?') ? '&' : '?') + 'per_page=100';
+        for (let page = 0; next !== undefined; page++) {
+            if (page >= MAX_API_PAGES)
+                throw new Error('GitHub API pagination exceeded its safety limit');
+            if (seen.has(next))
+                throw new Error('GitHub API returned a pagination cycle');
+            seen.add(next);
+            const response = await this.request('GET', next);
+            if (!Array.isArray(response.data))
+                throw new Error('GitHub API returned a non-array page');
+            out.push(...response.data);
+            next = response.next;
+        }
+        return out;
+    }
+    async headSha() {
+        const { data } = await this.request('GET', `${this.pullPath}/${this.pullNumber}`);
+        if (!record(data) || !record(data.head))
+            throw new Error('GitHub API returned no pull request head');
+        return requiredString(data.head.sha, 'pull request head SHA');
+    }
+    async listFiles() {
+        const values = await this.all(`${this.pullPath}/${this.pullNumber}/files`);
+        return values.map((value, index) => {
+            if (!record(value) || typeof value.filename !== 'string') {
+                throw new Error(`GitHub API pull file ${index + 1} has an invalid contract`);
+            }
+            if (value.patch !== undefined && typeof value.patch !== 'string') {
+                throw new Error(`GitHub API pull file ${index + 1} has an invalid patch`);
+            }
+            return { filename: value.filename, patch: value.patch };
+        });
+    }
+    async listReviewComments() {
+        const values = await this.all(`${this.pullPath}/${this.pullNumber}/comments`);
+        return values.map((value, index) => {
+            if (!record(value) ||
+                !Number.isSafeInteger(value.id) ||
+                typeof value.path !== 'string' ||
+                (value.line !== null && !Number.isSafeInteger(value.line)) ||
+                (value.body !== null && typeof value.body !== 'string') ||
+                (value.in_reply_to_id !== undefined && value.in_reply_to_id !== null && !Number.isSafeInteger(value.in_reply_to_id))) {
+                throw new Error(`GitHub API review comment ${index + 1} has an invalid contract`);
+            }
+            const user = record(value.user) && typeof value.user.login === 'string'
+                ? { login: value.user.login }
+                : undefined;
+            return {
+                id: Number(value.id),
+                path: value.path,
+                line: value.line === null ? null : Number(value.line),
+                body: value.body ?? '',
+                user,
+                inReplyToId: value.in_reply_to_id === undefined || value.in_reply_to_id === null
+                    ? undefined
+                    : Number(value.in_reply_to_id),
+            };
+        });
+    }
+    async createReview(commitId, comments) {
+        await this.request('POST', `${this.pullPath}/${this.pullNumber}/reviews`, createReviewPayload(commitId, comments));
+    }
+    async deleteReviewComment(id) {
+        await this.request('DELETE', `${this.pullPath}/comments/${id}`, undefined, [404]);
+    }
+    async listIssueComments() {
+        const values = await this.all(`${this.issuePath}/comments`);
+        return values.map(issueComment);
+    }
+    async createIssueComment(body) {
+        const { data } = await this.request('POST', `${this.issuePath}/comments`, { body });
+        return issueComment(data, 0);
+    }
+    async updateIssueComment(id, body) {
+        await this.request('PATCH', `${this.issueCommentPath}/${id}`, { body });
+    }
+    async deleteIssueComment(id) {
+        await this.request('DELETE', `${this.issueCommentPath}/${id}`, undefined, [404]);
+    }
+}
+export function requiredEnvironment(name) {
+    const value = process.env[name];
+    if (value === undefined || value.length === 0)
+        throw new Error(`${name} is required`);
+    return value;
+}
+export function expectedHeadShaFromEnvironment() {
+    const value = requiredEnvironment('POWERSHOT_HEAD_SHA');
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(value))
+        throw new Error('POWERSHOT_HEAD_SHA is invalid');
+    return value;
+}
+export function githubPullRequestApiFromEnvironment() {
+    const repository = requiredEnvironment('GITHUB_REPOSITORY').split('/');
+    if (repository.length !== 2 || !repository[0] || !repository[1]) {
+        throw new Error('GITHUB_REPOSITORY must be owner/repository');
+    }
+    const pullNumber = Number(requiredEnvironment('POWERSHOT_PR_NUMBER'));
+    if (!Number.isSafeInteger(pullNumber) || pullNumber < 1) {
+        throw new Error('POWERSHOT_PR_NUMBER must be positive');
+    }
+    return new GitHubPullRequestApi(requiredEnvironment('GITHUB_API_URL'), requiredEnvironment('GITHUB_TOKEN'), repository[0], repository[1], pullNumber);
+}
+//# sourceMappingURL=api.js.map

package/dist/github/inline-comments.js

@@ -3,21 +3,11 @@ import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import { stripControl } from '#app/text.js';
 import { SEVERITIES } from '#app/types.js';
+import { githubPullRequestApiFromEnvironment, requiredEnvironment, } from './api.js';
 const INLINE_COMMENT_LIMIT = 10;
-const API_VERSION = '2022-11-28';
-const API_TIMEOUT_MS = 20_000;
-const MAX_API_PAGES = 100;
 const BOT_LOGIN = 'github-actions[bot]';
 const MARKER_PATTERN = /<!-- powershot:inline:v1:[a-f0-9]{24} -->/;
 const COMMONMARK_PUNCTUATION = new Set(`!"#$%&'()*+,-./:;<=>?@[\\]^_\`{|}~`);
-export function createReviewPayload(commitId, comments) {
-    return {
-        commit_id: commitId,
-        body: `PowerShot posted ${comments.length} proven verified finding(s) on changed lines.`,
-        event: 'COMMENT',
-        comments,
-    };
-}
 function oneLine(value, limit) {
     return stripControl(value).replace(/\r?\n/g, ' ').slice(0, limit);
 }
@@ -189,11 +179,6 @@ export async function syncInlineComments(api, findings, expectedHeadSha, limit =
 function record(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-function requiredString(value, name) {
-    if (typeof value !== 'string' || value.length === 0)
-        throw new Error(`GitHub API returned no ${name}`);
-    return value;
-}
 export function parseReviewFindings(source) {
     const document = JSON.parse(source);
     if (!record(document) || !Array.isArray(document.findings)) {
@@ -232,148 +217,12 @@ export function parseReviewFindings(source) {
         };
     });
 }
-function nextLink(value) {
-    if (value === null)
-        return undefined;
-    for (const part of value.split(',')) {
-        const match = /^\s*<([^>]+)>;\s*rel="([^"]+)"\s*$/.exec(part);
-        if (match?.[2] === 'next')
-            return match[1];
-    }
-    return undefined;
-}
-function errorDetail(value) {
-    return oneLine(value, 500);
-}
-export class GitHubPullRequestApi {
-    token;
-    pullNumber;
-    base;
-    pullPath;
-    constructor(apiUrl, token, owner, repository, pullNumber) {
-        this.token = token;
-        this.pullNumber = pullNumber;
-        this.base = apiUrl.replace(/\/$/, '');
-        this.pullPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/pulls`;
-    }
-    url(endpoint) {
-        if (!endpoint.startsWith('http://') && !endpoint.startsWith('https://'))
-            return this.base + endpoint;
-        if (endpoint !== this.base && !endpoint.startsWith(this.base + '/')) {
-            throw new Error('GitHub pagination left the configured API origin');
-        }
-        return endpoint;
-    }
-    async request(method, endpoint, body, acceptedStatuses = []) {
-        const response = await fetch(this.url(endpoint), {
-            method,
-            headers: {
-                Accept: 'application/vnd.github+json',
-                Authorization: `Bearer ${this.token}`,
-                'User-Agent': 'PowerShot',
-                'X-GitHub-Api-Version': API_VERSION,
-                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
-            },
-            body: body === undefined ? undefined : JSON.stringify(body),
-            signal: AbortSignal.timeout(API_TIMEOUT_MS),
-        });
-        const source = await response.text();
-        if (!response.ok) {
-            if (acceptedStatuses.includes(response.status))
-                return { data: undefined };
-            throw new Error(`GitHub API ${method} failed with ${response.status}: ${errorDetail(source)}`);
-        }
-        const data = source.length === 0 ? undefined : JSON.parse(source);
-        return { data, next: nextLink(response.headers.get('link')) };
-    }
-    async all(endpoint) {
-        const out = [];
-        const seen = new Set();
-        let next = endpoint + (endpoint.includes('?') ? '&' : '?') + 'per_page=100';
-        for (let page = 0; next !== undefined; page++) {
-            if (page >= MAX_API_PAGES)
-                throw new Error('GitHub API pagination exceeded its safety limit');
-            if (seen.has(next))
-                throw new Error('GitHub API returned a pagination cycle');
-            seen.add(next);
-            const response = await this.request('GET', next);
-            if (!Array.isArray(response.data))
-                throw new Error('GitHub API returned a non-array page');
-            out.push(...response.data);
-            next = response.next;
-        }
-        return out;
-    }
-    async headSha() {
-        const { data } = await this.request('GET', `${this.pullPath}/${this.pullNumber}`);
-        if (!record(data) || !record(data.head))
-            throw new Error('GitHub API returned no pull request head');
-        return requiredString(data.head.sha, 'pull request head SHA');
-    }
-    async listFiles() {
-        const values = await this.all(`${this.pullPath}/${this.pullNumber}/files`);
-        return values.map((value, index) => {
-            if (!record(value) || typeof value.filename !== 'string') {
-                throw new Error(`GitHub API pull file ${index + 1} has an invalid contract`);
-            }
-            if (value.patch !== undefined && typeof value.patch !== 'string') {
-                throw new Error(`GitHub API pull file ${index + 1} has an invalid patch`);
-            }
-            return { filename: value.filename, patch: value.patch };
-        });
-    }
-    async listReviewComments() {
-        const values = await this.all(`${this.pullPath}/${this.pullNumber}/comments`);
-        return values.map((value, index) => {
-            if (!record(value) ||
-                !Number.isSafeInteger(value.id) ||
-                typeof value.path !== 'string' ||
-                (value.line !== null && !Number.isSafeInteger(value.line)) ||
-                (value.body !== null && typeof value.body !== 'string') ||
-                (value.in_reply_to_id !== undefined && value.in_reply_to_id !== null && !Number.isSafeInteger(value.in_reply_to_id))) {
-                throw new Error(`GitHub API review comment ${index + 1} has an invalid contract`);
-            }
-            const user = record(value.user) && typeof value.user.login === 'string'
-                ? { login: value.user.login }
-                : undefined;
-            return {
-                id: Number(value.id),
-                path: value.path,
-                line: value.line === null ? null : Number(value.line),
-                body: value.body ?? '',
-                user,
-                inReplyToId: value.in_reply_to_id === undefined || value.in_reply_to_id === null
-                    ? undefined
-                    : Number(value.in_reply_to_id),
-            };
-        });
-    }
-    async createReview(commitId, comments) {
-        await this.request('POST', `${this.pullPath}/${this.pullNumber}/reviews`, createReviewPayload(commitId, comments));
-    }
-    async deleteReviewComment(id) {
-        await this.request('DELETE', `${this.pullPath}/comments/${id}`, undefined, [404]);
-    }
-}
-function environment(name) {
-    const value = process.env[name];
-    if (value === undefined || value.length === 0)
-        throw new Error(`${name} is required`);
-    return value;
-}
 async function main() {
-    const repository = environment('GITHUB_REPOSITORY').split('/');
-    if (repository.length !== 2 || !repository[0] || !repository[1]) {
-        throw new Error('GITHUB_REPOSITORY must be owner/repository');
-    }
-    const pullNumber = Number(environment('POWERSHOT_PR_NUMBER'));
-    if (!Number.isSafeInteger(pullNumber) || pullNumber < 1)
-        throw new Error('POWERSHOT_PR_NUMBER must be positive');
-    const expectedHeadSha = environment('POWERSHOT_HEAD_SHA');
+    const expectedHeadSha = requiredEnvironment('POWERSHOT_HEAD_SHA');
     if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(expectedHeadSha))
         throw new Error('POWERSHOT_HEAD_SHA is invalid');
     const findings = parseReviewFindings(await readFile('powershot.json', 'utf8'));
-    const api = new GitHubPullRequestApi(environment('GITHUB_API_URL'), environment('GITHUB_TOKEN'), repository[0], repository[1], pullNumber);
+    const api = githubPullRequestApiFromEnvironment();
     const result = await syncInlineComments(api, findings, expectedHeadSha);
     if (result.outdated) {
         process.stdout.write('PowerShot skipped inline comments because the pull request head changed.\n');