@codraoss/core 0.9.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (80) hide show
  1. package/LICENSE +625 -0
  2. package/README.md +15 -0
  3. package/dist/chunk-FGXA7JNR.js +57 -0
  4. package/dist/chunk-FGXA7JNR.js.map +1 -0
  5. package/dist/chunk-ILZUCIZH.js +117 -0
  6. package/dist/chunk-ILZUCIZH.js.map +1 -0
  7. package/dist/chunk-JC74XH7Q.js +67 -0
  8. package/dist/chunk-JC74XH7Q.js.map +1 -0
  9. package/dist/chunk-MMVQPGK3.js +341 -0
  10. package/dist/chunk-MMVQPGK3.js.map +1 -0
  11. package/dist/chunk-NSTV4TRP.js +39 -0
  12. package/dist/chunk-NSTV4TRP.js.map +1 -0
  13. package/dist/chunk-OIQRTDYR.js +337 -0
  14. package/dist/chunk-OIQRTDYR.js.map +1 -0
  15. package/dist/chunk-PVXFURDR.js +90 -0
  16. package/dist/chunk-PVXFURDR.js.map +1 -0
  17. package/dist/chunk-R2HRWFRH.js +108 -0
  18. package/dist/chunk-R2HRWFRH.js.map +1 -0
  19. package/dist/chunk-RQ5S67XB.js +82 -0
  20. package/dist/chunk-RQ5S67XB.js.map +1 -0
  21. package/dist/chunk-U3VKVDZ7.js +266 -0
  22. package/dist/chunk-U3VKVDZ7.js.map +1 -0
  23. package/dist/chunk-V3RF6GQW.js +137 -0
  24. package/dist/chunk-V3RF6GQW.js.map +1 -0
  25. package/dist/chunk-WSK45HW4.js +79 -0
  26. package/dist/chunk-WSK45HW4.js.map +1 -0
  27. package/dist/chunk-XD6CGYHO.js +893 -0
  28. package/dist/chunk-XD6CGYHO.js.map +1 -0
  29. package/dist/claim-checks.d.ts +54 -0
  30. package/dist/claim-checks.js +20 -0
  31. package/dist/claim-checks.js.map +1 -0
  32. package/dist/diff/index.d.ts +22 -0
  33. package/dist/diff/index.js +25 -0
  34. package/dist/diff/index.js.map +1 -0
  35. package/dist/fingerprint.d.ts +9 -0
  36. package/dist/fingerprint.js +19 -0
  37. package/dist/fingerprint.js.map +1 -0
  38. package/dist/index-BTDWXDck.d.ts +93 -0
  39. package/dist/index.d.ts +138 -0
  40. package/dist/index.js +1755 -0
  41. package/dist/index.js.map +1 -0
  42. package/dist/logger.d.ts +32 -0
  43. package/dist/logger.js +17 -0
  44. package/dist/logger.js.map +1 -0
  45. package/dist/model-gRDTk8yk.d.ts +117 -0
  46. package/dist/model-output/index.d.ts +4 -0
  47. package/dist/model-output/index.js +32 -0
  48. package/dist/model-output/index.js.map +1 -0
  49. package/dist/ports/index.d.ts +512 -0
  50. package/dist/ports/index.js +13 -0
  51. package/dist/ports/index.js.map +1 -0
  52. package/dist/position-h_jdn6ZH.d.ts +30 -0
  53. package/dist/prompts/file-review.d.ts +6 -0
  54. package/dist/prompts/file-review.js +25 -0
  55. package/dist/prompts/file-review.js.map +1 -0
  56. package/dist/prompts/languages.d.ts +9 -0
  57. package/dist/prompts/languages.js +7 -0
  58. package/dist/prompts/languages.js.map +1 -0
  59. package/dist/prompts/summary.d.ts +12 -0
  60. package/dist/prompts/summary.js +50 -0
  61. package/dist/prompts/summary.js.map +1 -0
  62. package/dist/prompts/verify.d.ts +71 -0
  63. package/dist/prompts/verify.js +15 -0
  64. package/dist/prompts/verify.js.map +1 -0
  65. package/dist/rules/detect.d.ts +32 -0
  66. package/dist/rules/detect.js +13 -0
  67. package/dist/rules/detect.js.map +1 -0
  68. package/dist/rules/table.d.ts +18 -0
  69. package/dist/rules/table.js +7 -0
  70. package/dist/rules/table.js.map +1 -0
  71. package/dist/timeout.d.ts +6 -0
  72. package/dist/timeout.js +26 -0
  73. package/dist/timeout.js.map +1 -0
  74. package/dist/token-tracker.d.ts +38 -0
  75. package/dist/token-tracker.js +8 -0
  76. package/dist/token-tracker.js.map +1 -0
  77. package/dist/verify.d.ts +3 -0
  78. package/dist/verify.js +21 -0
  79. package/dist/verify.js.map +1 -0
  80. package/package.json +181 -0
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../../src/prompts/summary.ts"],"sourcesContent":["export const SUMMARY_SYSTEM_PROMPT = `You are an automated code review bot. Summarize the findings of a PR review.\nCRITICAL: Return ONLY a JSON object with a single \"summary\" key.\n\nConstraints:\n1. NO intro text, NO reasoning, NO meta-commentary like \"Task: Summarize...\".\n2. NO markdown code fences for the JSON itself.\n3. DO NOT include any verdict headers like \"✅ Approved\" or \"💬 Comments posted\".\n4. Format: [File name]: [Concise overview of issues] (lines X-Y).\n5. DO NOT include any priority tags like \"P0\", \"P1\", etc., in the summary text. Mention the impact instead.\n6. If failures occurred, mention: \"⚠️ **[filename]** - automated review could not complete (parse error).\"\n7. Tone: Technical, impact-focused, brief.\n8. Max 200 words. JSON only.`;\n\nexport function buildSummaryPrompt(input: {\n prTitle: string | null;\n verdict: 'approve' | 'comment';\n fileSummaries: Array<{ path: string; summary: string; verdict: string }>;\n}) {\n const successFindings = input.fileSummaries.filter(\n (f) => f.verdict !== 'approve' && !f.summary.startsWith('Review failed'),\n );\n const approved = input.fileSummaries.filter((f) => f.verdict === 'approve');\n const failures = input.fileSummaries.filter((f) => f.summary.startsWith('Review failed'));\n\n const lines: string[] = [\n `PR: \"${input.prTitle ?? 'Untitled PR'}\"`,\n `Verdict: ${input.verdict}`,\n '',\n ];\n\n if (successFindings.length > 0) {\n lines.push('Files with findings:');\n for (const f of successFindings) {\n lines.push(`- \\`${f.path}\\` [${f.verdict}]: ${f.summary}`);\n }\n }\n\n if (approved.length > 0) {\n lines.push(`Files approved with no issues: ${approved.map((f) => `\\`${f.path}\\``).join(', ')}`);\n }\n\n if (failures.length > 0) {\n lines.push('Files where automated review failed (mention as warnings):');\n for (const f of failures) {\n const reason = f.summary.replace('Review failed: ', '');\n lines.push(`- \\`${f.path}\\`: ${reason}`);\n }\n }\n\n if (successFindings.length === 0 && failures.length === 0) {\n lines.push('No significant findings. All files passed review.');\n }\n\n return lines.join('\\n');\n}\n\n\n"],"mappings":";AAAO,IAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAa9B,SAAS,mBAAmB,OAIhC;AACD,QAAM,kBAAkB,MAAM,cAAc;AAAA,IAC1C,CAAC,MAAM,EAAE,YAAY,aAAa,CAAC,EAAE,QAAQ,WAAW,eAAe;AAAA,EACzE;AACA,QAAM,WAAW,MAAM,cAAc,OAAO,CAAC,MAAM,EAAE,YAAY,SAAS;AAC1E,QAAM,WAAW,MAAM,cAAc,OAAO,CAAC,MAAM,EAAE,QAAQ,WAAW,eAAe,CAAC;AAExF,QAAM,QAAkB;AAAA,IACtB,QAAQ,MAAM,WAAW,aAAa;AAAA,IACtC,YAAY,MAAM,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,KAAK,sBAAsB;AACjC,eAAW,KAAK,iBAAiB;AAC/B,YAAM,KAAK,OAAO,EAAE,IAAI,OAAO,EAAE,OAAO,MAAM,EAAE,OAAO,EAAE;AAAA,IAC3D;AAAA,EACF;AAEA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,kCAAkC,SAAS,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAChG;AAEA,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,4DAA4D;AACvE,eAAW,KAAK,UAAU;AACxB,YAAM,SAAS,EAAE,QAAQ,QAAQ,mBAAmB,EAAE;AACtD,YAAM,KAAK,OAAO,EAAE,IAAI,OAAO,MAAM,EAAE;AAAA,IACzC;AAAA,EACF;AAEA,MAAI,gBAAgB,WAAW,KAAK,SAAS,WAAW,GAAG;AACzD,UAAM,KAAK,mDAAmD;AAAA,EAChE;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}
@@ -0,0 +1,71 @@
1
+ import { z } from 'zod';
2
+ import { F as FileDiff } from '../position-h_jdn6ZH.js';
3
+
4
+ type VerifyCandidate = {
5
+ index: number;
6
+ path: string;
7
+ line: number | null;
8
+ title: string;
9
+ body: string;
10
+ snippet: string;
11
+ evidence?: string | null;
12
+ };
13
+ declare const verifyResultSchema: z.ZodObject<{
14
+ results: z.ZodDefault<z.ZodArray<z.ZodObject<{
15
+ index: z.ZodNumber;
16
+ reason: z.ZodOptional<z.ZodString>;
17
+ decidable: z.ZodOptional<z.ZodBoolean>;
18
+ verdict: z.ZodEnum<{
19
+ keep: "keep";
20
+ drop: "drop";
21
+ }>;
22
+ confidence: z.ZodOptional<z.ZodNumber>;
23
+ }, z.core.$strip>>>;
24
+ }, z.core.$strip>;
25
+ type VerifyResult = z.infer<typeof verifyResultSchema>['results'][number];
26
+ declare const VERIFY_RESPONSE_SCHEMA: {
27
+ readonly name: "codra_verify_findings";
28
+ readonly schema: {
29
+ readonly type: "object";
30
+ readonly additionalProperties: false;
31
+ readonly required: readonly ["results"];
32
+ readonly properties: {
33
+ readonly results: {
34
+ readonly type: "array";
35
+ readonly items: {
36
+ readonly type: "object";
37
+ readonly additionalProperties: false;
38
+ readonly required: readonly ["index", "reason", "decidable", "verdict"];
39
+ readonly properties: {
40
+ readonly index: {
41
+ readonly type: "integer";
42
+ readonly minimum: 0;
43
+ };
44
+ readonly reason: {
45
+ readonly type: "string";
46
+ readonly maxLength: 300;
47
+ };
48
+ readonly decidable: {
49
+ readonly type: "boolean";
50
+ };
51
+ readonly verdict: {
52
+ readonly type: "string";
53
+ readonly enum: readonly ["keep", "drop"];
54
+ };
55
+ readonly confidence: {
56
+ readonly type: "number";
57
+ readonly minimum: 0;
58
+ readonly maximum: 1;
59
+ };
60
+ };
61
+ };
62
+ };
63
+ };
64
+ };
65
+ };
66
+ declare const VERIFY_SYSTEM_PROMPT = "You are a meticulous senior engineer checking whether each candidate code-review finding is actually supported by the code it points at.\n\nFor EACH finding you are given the claim and a SHORT WINDOW of diff context around the line it was anchored to. That window is all you have: you cannot see the rest of the file, any other file, the project's dependencies and their versions, its build target, or its runtime.\n\nAnswer two questions per finding, in this order.\n\n1. \"decidable\": can this claim be settled from the window you were given?\n - true - the window contains everything needed to say whether the claim holds.\n - false - settling it would need something outside the window: which files import this one, what a function defined elsewhere does, which version of a dependency is installed, what engine or renderer the code runs on, or how a caller uses the result.\n Watch for claims that assert a CONSEQUENCE somewhere you cannot see: \"this breaks importers\", \"this throws on older runtimes\", \"this fails during server rendering\", \"the caller will not await this\". The anchored line can be exactly as quoted and the consequence still be unverifiable - confirming that the quote is real is NOT confirming the claim.\n When \"decidable\" is false, say in \"reason\" what you would have to look at, e.g. \"would need the importers of this module\".\n\n Two rules, because both have been got wrong on real reviews:\n\n a) A claim of the form \"if X() fails / rejects / throws, this is unhandled\" is NOT decidable unless the\n BODY of X is inside your window. A function whose body you cannot see may well handle its own\n errors, in which case there is nothing to report. Seeing the CALL is not seeing the body. Mark it\n not decidable and say you would need that function's implementation.\n\n b) Read the diff markers before you agree that something was removed or changed. A line prefixed \"-\"\n is the OLD code and a line prefixed \"+\" is the NEW code. A claim that says \"X was replaced by Y\" is\n false if the diff shows Y being replaced by X, and a claim that a safeguard was \"removed\" is false\n if the \"+\" line still carries an equivalent one under a different name. State the direction in your\n reason: \"the + line adds strict validation, so the claim is backwards\".\n\n2. \"verdict\":\n - \"keep\": the code in the window genuinely exhibits the problem the claim describes.\n - \"drop\": the claim is not supported by the code shown - it describes something that isn't there, it is speculative, it is a subjective style preference, or it is not decidable from this window.\n A claim you marked not decidable is always a \"drop\".\n\nJudge the CLAIM against the CODE. Do not defer to the claim's confidence or phrasing; a well-written claim about code that doesn't do what it says is still a drop.\nBe strict: when in doubt, \"drop\". It is better to drop a borderline finding than to keep a wrong one.\n\nOutput MUST be valid JSON, exactly one object, no prose before or after:\n{\n \"results\": [\n { \"index\": <number>, \"reason\": \"<why, and if not decidable what you would need to see>\", \"decidable\": true | false, \"verdict\": \"keep\" | \"drop\", \"confidence\": <float 0.0-1.0> }\n ]\n}\nInclude exactly one result object for every finding index provided, and use the same index numbers you were given.";
67
+ declare function buildVerifyPrompt(candidates: VerifyCandidate[]): string;
68
+ declare function renderDiffSnippet(file: FileDiff | undefined, line: number | undefined, radius?: number): string;
69
+ declare function parseVerifyResponse(raw: string): VerifyResult[];
70
+
71
+ export { VERIFY_RESPONSE_SCHEMA, VERIFY_SYSTEM_PROMPT, type VerifyCandidate, type VerifyResult, buildVerifyPrompt, parseVerifyResponse, renderDiffSnippet };
@@ -0,0 +1,15 @@
1
+ import {
2
+ VERIFY_RESPONSE_SCHEMA,
3
+ VERIFY_SYSTEM_PROMPT,
4
+ buildVerifyPrompt,
5
+ parseVerifyResponse,
6
+ renderDiffSnippet
7
+ } from "../chunk-V3RF6GQW.js";
8
+ export {
9
+ VERIFY_RESPONSE_SCHEMA,
10
+ VERIFY_SYSTEM_PROMPT,
11
+ buildVerifyPrompt,
12
+ parseVerifyResponse,
13
+ renderDiffSnippet
14
+ };
15
+ //# sourceMappingURL=verify.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
@@ -0,0 +1,32 @@
1
+ import { ClaimType, ParsedReviewComment } from '@codraoss/schema';
2
+ import { D as DiffLine, F as FileDiff } from '../position-h_jdn6ZH.js';
3
+ import { Rule } from './table.js';
4
+
5
+ type RuleHit = {
6
+ rule: Rule;
7
+ line: DiffLine;
8
+ shadow: boolean;
9
+ };
10
+ type RuleScanStats = {
11
+ addedLinesScanned: number;
12
+ sievePassed: number;
13
+ hits: number;
14
+ shadowHits: number;
15
+ suppressedAsMoved: number;
16
+ unstrippable: number;
17
+ truncated: boolean;
18
+ byRule: Record<string, number>;
19
+ };
20
+ type RuleScanResult = {
21
+ hits: RuleHit[];
22
+ stats: RuleScanStats;
23
+ };
24
+ type RuleScanOptions = {
25
+ disabledRuleIds?: readonly string[];
26
+ shadowRuleIds?: readonly string[];
27
+ deniedClaimTypes?: readonly ClaimType[];
28
+ };
29
+ declare function scanFileForRuleHits(file: FileDiff, options?: RuleScanOptions): RuleScanResult;
30
+ declare function ruleHitsToComments(file: FileDiff, result: RuleScanResult): ParsedReviewComment[];
31
+
32
+ export { type RuleHit, type RuleScanOptions, type RuleScanResult, type RuleScanStats, ruleHitsToComments, scanFileForRuleHits };
@@ -0,0 +1,13 @@
1
+ import {
2
+ ruleHitsToComments,
3
+ scanFileForRuleHits
4
+ } from "../chunk-ILZUCIZH.js";
5
+ import "../chunk-FGXA7JNR.js";
6
+ import "../chunk-R2HRWFRH.js";
7
+ import "../chunk-U3VKVDZ7.js";
8
+ import "../chunk-NSTV4TRP.js";
9
+ export {
10
+ ruleHitsToComments,
11
+ scanFileForRuleHits
12
+ };
13
+ //# sourceMappingURL=detect.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
@@ -0,0 +1,18 @@
1
+ import { ClaimType, reviewSeverities } from '@codraoss/schema';
2
+
3
+ type ReviewSeverity = typeof reviewSeverities[number];
4
+ type Rule = {
5
+ id: string;
6
+ claimType: ClaimType;
7
+ severity: ReviewSeverity;
8
+ title: string;
9
+ body: string;
10
+ triggers: readonly string[];
11
+ pattern: RegExp;
12
+ rejectRaw?: RegExp;
13
+ extensions?: readonly string[];
14
+ enabled: boolean;
15
+ };
16
+ declare const RULES: readonly Rule[];
17
+
18
+ export { RULES, type Rule };
@@ -0,0 +1,7 @@
1
+ import {
2
+ RULES
3
+ } from "../chunk-R2HRWFRH.js";
4
+ export {
5
+ RULES
6
+ };
7
+ //# sourceMappingURL=table.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
@@ -0,0 +1,6 @@
1
+ declare class TimeoutError extends Error {
2
+ constructor(label: string, ms: number);
3
+ }
4
+ declare function withTimeout<T>(label: string, ms: number, fn: (signal: AbortSignal) => Promise<T>): Promise<T>;
5
+
6
+ export { TimeoutError, withTimeout };
@@ -0,0 +1,26 @@
1
+ // src/timeout.ts
2
+ var TimeoutError = class extends Error {
3
+ constructor(label, ms) {
4
+ super(`${label} timed out after ${ms}ms`);
5
+ this.name = "TimeoutError";
6
+ }
7
+ };
8
+ async function withTimeout(label, ms, fn) {
9
+ const controller = new AbortController();
10
+ const timer = setTimeout(() => controller.abort(), ms);
11
+ try {
12
+ return await fn(controller.signal);
13
+ } catch (err) {
14
+ if (controller.signal.aborted || err?.name === "AbortError") {
15
+ throw new TimeoutError(label, ms);
16
+ }
17
+ throw err;
18
+ } finally {
19
+ clearTimeout(timer);
20
+ }
21
+ }
22
+ export {
23
+ TimeoutError,
24
+ withTimeout
25
+ };
26
+ //# sourceMappingURL=timeout.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/timeout.ts"],"sourcesContent":["export class TimeoutError extends Error {\n constructor(label: string, ms: number) {\n super(`${label} timed out after ${ms}ms`);\n this.name = 'TimeoutError';\n }\n}\n\nexport async function withTimeout<T>(label: string, ms: number, fn: (signal: AbortSignal) => Promise<T>): Promise<T> {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), ms);\n\n try {\n return await fn(controller.signal);\n } catch (err: any) {\n if (controller.signal.aborted || err?.name === 'AbortError') {\n throw new TimeoutError(label, ms);\n }\n throw err;\n } finally {\n clearTimeout(timer);\n }\n}\n"],"mappings":";AAAO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YAAY,OAAe,IAAY;AACrC,UAAM,GAAG,KAAK,oBAAoB,EAAE,IAAI;AACxC,SAAK,OAAO;AAAA,EACd;AACF;AAEA,eAAsB,YAAe,OAAe,IAAY,IAAqD;AACnH,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,EAAE;AAErD,MAAI;AACF,WAAO,MAAM,GAAG,WAAW,MAAM;AAAA,EACnC,SAAS,KAAU;AACjB,QAAI,WAAW,OAAO,WAAW,KAAK,SAAS,cAAc;AAC3D,YAAM,IAAI,aAAa,OAAO,EAAE;AAAA,IAClC;AACA,UAAM;AAAA,EACR,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;","names":[]}
@@ -0,0 +1,38 @@
1
+ interface TokenUsage {
2
+ input: number;
3
+ output: number;
4
+ }
5
+ interface ModelUsage extends TokenUsage {
6
+ model: string;
7
+ calls: number;
8
+ }
9
+ type WastedAttemptReason = 'rate-limited' | 'error';
10
+ interface WastedUsage {
11
+ attempts: number;
12
+ estimatedInput: number;
13
+ skips: number;
14
+ byReason: Record<string, number>;
15
+ }
16
+ declare class TokenTracker {
17
+ private usage;
18
+ private wasted;
19
+ private wastedByReason;
20
+ private subrequests;
21
+ private readonly MAX_SUBREQUESTS;
22
+ private readonly SAFE_MARGIN;
23
+ incrementSubrequests(count?: number): void;
24
+ getSubrequestCount(): number;
25
+ hasRemainingSubrequests(needed?: number): boolean;
26
+ isNearLimit(): boolean;
27
+ remainingSafeBudget(): number;
28
+ record(model: string, input: number, output: number): void;
29
+ recordFailedAttempt(model: string, estimatedInputTokens: number, reason: WastedAttemptReason): void;
30
+ recordSkippedCall(model: string, reason: string): void;
31
+ getWasted(): WastedUsage;
32
+ getTotalUsage(): TokenUsage;
33
+ getBreakdown(): ModelUsage[];
34
+ merge(other: TokenTracker): void;
35
+ reset(): void;
36
+ }
37
+
38
+ export { type ModelUsage, TokenTracker, type TokenUsage, type WastedAttemptReason, type WastedUsage };
@@ -0,0 +1,8 @@
1
+ import {
2
+ TokenTracker
3
+ } from "./chunk-PVXFURDR.js";
4
+ import "./chunk-WSK45HW4.js";
5
+ export {
6
+ TokenTracker
7
+ };
8
+ //# sourceMappingURL=token-tracker.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
@@ -0,0 +1,3 @@
1
+ declare function verifyGitHubWebhookSignature(secret: string, headerValue: string | null, rawBody: string): Promise<boolean>;
2
+
3
+ export { verifyGitHubWebhookSignature };
package/dist/verify.js ADDED
@@ -0,0 +1,21 @@
1
+ // src/verify.ts
2
+ import { hexToBytes } from "@codraoss/schema/hex";
3
+ var encoder = new TextEncoder();
4
+ async function verifyGitHubWebhookSignature(secret, headerValue, rawBody) {
5
+ if (!headerValue?.startsWith("sha256=")) {
6
+ return false;
7
+ }
8
+ const signature = headerValue.slice("sha256=".length);
9
+ const key = await crypto.subtle.importKey(
10
+ "raw",
11
+ encoder.encode(secret),
12
+ { name: "HMAC", hash: "SHA-256" },
13
+ false,
14
+ ["verify"]
15
+ );
16
+ return crypto.subtle.verify("HMAC", key, hexToBytes(signature), encoder.encode(rawBody));
17
+ }
18
+ export {
19
+ verifyGitHubWebhookSignature
20
+ };
21
+ //# sourceMappingURL=verify.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/verify.ts"],"sourcesContent":["import { hexToBytes } from '@codraoss/schema/hex';\n\nconst encoder = new TextEncoder();\n\nexport async function verifyGitHubWebhookSignature(secret: string, headerValue: string | null, rawBody: string) {\n if (!headerValue?.startsWith('sha256=')) {\n return false;\n }\n\n const signature = headerValue.slice('sha256='.length);\n const key = await crypto.subtle.importKey(\n 'raw',\n encoder.encode(secret),\n { name: 'HMAC', hash: 'SHA-256' },\n false,\n ['verify'],\n );\n\n return crypto.subtle.verify('HMAC', key, hexToBytes(signature), encoder.encode(rawBody));\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAE3B,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAsB,6BAA6B,QAAgB,aAA4B,SAAiB;AAC9G,MAAI,CAAC,aAAa,WAAW,SAAS,GAAG;AACvC,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,YAAY,MAAM,UAAU,MAAM;AACpD,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,OAAO,OAAO,OAAO,QAAQ,KAAK,WAAW,SAAS,GAAG,QAAQ,OAAO,OAAO,CAAC;AACzF;","names":[]}
package/package.json ADDED
@@ -0,0 +1,181 @@
1
+ {
2
+ "name": "@codraoss/core",
3
+ "version": "0.9.4",
4
+ "description": "The Codra review engine: pure, transport- and platform-agnostic code review logic behind ports.",
5
+ "author": "Devarshi Shimpi",
6
+ "license": "AGPL-3.0-only",
7
+ "homepage": "https://codra.run",
8
+ "repository": {
9
+ "type": "git",
10
+ "url": "git+https://github.com/devarshishimpi/codra.git",
11
+ "directory": "packages/core"
12
+ },
13
+ "bugs": {
14
+ "url": "https://github.com/devarshishimpi/codra/issues"
15
+ },
16
+ "type": "module",
17
+ "sideEffects": false,
18
+ "exports": {
19
+ ".": {
20
+ "types": "./dist/index.d.ts",
21
+ "import": "./dist/index.js"
22
+ },
23
+ "./ports": {
24
+ "types": "./dist/ports/index.d.ts",
25
+ "import": "./dist/ports/index.js"
26
+ },
27
+ "./logger": {
28
+ "types": "./dist/logger.d.ts",
29
+ "import": "./dist/logger.js"
30
+ },
31
+ "./diff": {
32
+ "types": "./dist/diff/index.d.ts",
33
+ "import": "./dist/diff/index.js"
34
+ },
35
+ "./model-output": {
36
+ "types": "./dist/model-output/index.d.ts",
37
+ "import": "./dist/model-output/index.js"
38
+ },
39
+ "./rules/detect": {
40
+ "types": "./dist/rules/detect.d.ts",
41
+ "import": "./dist/rules/detect.js"
42
+ },
43
+ "./rules/table": {
44
+ "types": "./dist/rules/table.d.ts",
45
+ "import": "./dist/rules/table.js"
46
+ },
47
+ "./claim-checks": {
48
+ "types": "./dist/claim-checks.d.ts",
49
+ "import": "./dist/claim-checks.js"
50
+ },
51
+ "./verify": {
52
+ "types": "./dist/verify.d.ts",
53
+ "import": "./dist/verify.js"
54
+ },
55
+ "./fingerprint": {
56
+ "types": "./dist/fingerprint.d.ts",
57
+ "import": "./dist/fingerprint.js"
58
+ },
59
+ "./timeout": {
60
+ "types": "./dist/timeout.d.ts",
61
+ "import": "./dist/timeout.js"
62
+ },
63
+ "./token-tracker": {
64
+ "types": "./dist/token-tracker.d.ts",
65
+ "import": "./dist/token-tracker.js"
66
+ },
67
+ "./prompts/file-review": {
68
+ "types": "./dist/prompts/file-review.d.ts",
69
+ "import": "./dist/prompts/file-review.js"
70
+ },
71
+ "./prompts/languages": {
72
+ "types": "./dist/prompts/languages.d.ts",
73
+ "import": "./dist/prompts/languages.js"
74
+ },
75
+ "./prompts/summary": {
76
+ "types": "./dist/prompts/summary.d.ts",
77
+ "import": "./dist/prompts/summary.js"
78
+ },
79
+ "./prompts/verify": {
80
+ "types": "./dist/prompts/verify.d.ts",
81
+ "import": "./dist/prompts/verify.js"
82
+ }
83
+ },
84
+ "files": [
85
+ "dist",
86
+ "LICENSE",
87
+ "README.md"
88
+ ],
89
+ "publishConfig": {
90
+ "access": "public",
91
+ "main": "./dist/index.js",
92
+ "module": "./dist/index.js",
93
+ "types": "./dist/index.d.ts",
94
+ "exports": {
95
+ ".": {
96
+ "types": "./dist/index.d.ts",
97
+ "import": "./dist/index.js"
98
+ },
99
+ "./ports": {
100
+ "types": "./dist/ports/index.d.ts",
101
+ "import": "./dist/ports/index.js"
102
+ },
103
+ "./logger": {
104
+ "types": "./dist/logger.d.ts",
105
+ "import": "./dist/logger.js"
106
+ },
107
+ "./diff": {
108
+ "types": "./dist/diff/index.d.ts",
109
+ "import": "./dist/diff/index.js"
110
+ },
111
+ "./model-output": {
112
+ "types": "./dist/model-output/index.d.ts",
113
+ "import": "./dist/model-output/index.js"
114
+ },
115
+ "./rules/detect": {
116
+ "types": "./dist/rules/detect.d.ts",
117
+ "import": "./dist/rules/detect.js"
118
+ },
119
+ "./rules/table": {
120
+ "types": "./dist/rules/table.d.ts",
121
+ "import": "./dist/rules/table.js"
122
+ },
123
+ "./claim-checks": {
124
+ "types": "./dist/claim-checks.d.ts",
125
+ "import": "./dist/claim-checks.js"
126
+ },
127
+ "./verify": {
128
+ "types": "./dist/verify.d.ts",
129
+ "import": "./dist/verify.js"
130
+ },
131
+ "./fingerprint": {
132
+ "types": "./dist/fingerprint.d.ts",
133
+ "import": "./dist/fingerprint.js"
134
+ },
135
+ "./timeout": {
136
+ "types": "./dist/timeout.d.ts",
137
+ "import": "./dist/timeout.js"
138
+ },
139
+ "./token-tracker": {
140
+ "types": "./dist/token-tracker.d.ts",
141
+ "import": "./dist/token-tracker.js"
142
+ },
143
+ "./prompts/file-review": {
144
+ "types": "./dist/prompts/file-review.d.ts",
145
+ "import": "./dist/prompts/file-review.js"
146
+ },
147
+ "./prompts/languages": {
148
+ "types": "./dist/prompts/languages.d.ts",
149
+ "import": "./dist/prompts/languages.js"
150
+ },
151
+ "./prompts/summary": {
152
+ "types": "./dist/prompts/summary.d.ts",
153
+ "import": "./dist/prompts/summary.js"
154
+ },
155
+ "./prompts/verify": {
156
+ "types": "./dist/prompts/verify.d.ts",
157
+ "import": "./dist/prompts/verify.js"
158
+ }
159
+ }
160
+ },
161
+ "scripts": {
162
+ "build": "tsup",
163
+ "typecheck": "tsc -p tsconfig.json",
164
+ "test": "vitest run",
165
+ "prepack": "node ../../scripts/swap-publish-exports.mjs promote",
166
+ "postpack": "node ../../scripts/swap-publish-exports.mjs restore"
167
+ },
168
+ "dependencies": {
169
+ "@codraoss/schema": "^0.9.4",
170
+ "jsonrepair": "^3.15.0",
171
+ "picomatch": "^4.0.5",
172
+ "zod": "^4.3.6"
173
+ },
174
+ "devDependencies": {
175
+ "@types/picomatch": "^4.0.3",
176
+ "tsup": "^8.0.0"
177
+ },
178
+ "main": "./dist/index.js",
179
+ "module": "./dist/index.js",
180
+ "types": "./dist/index.d.ts"
181
+ }