@compaction/cli 0.1.0

package/dist/core/provider-usage/credential-redaction.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Credential-shaped redaction for the provider-usage capture path.
+ *
+ * Per docs/design/provider-api-secrets-handling.md §4: a single redaction pass
+ * applies to EVERY output path (logs, errors, artifacts, reports, debug dumps).
+ *
+ * The PRIMARY control is that the credential is never placed into any structure
+ * that gets logged or serialized (see provider-usage-adapter.ts). This redaction
+ * pass is the defense-in-depth backstop: it masks the configured secret value (if
+ * present) AND anything matching known credential shapes, before any string is
+ * written to stdout/stderr/log/error/artifact.
+ *
+ * NO real secret ever appears here — tests exercise this with fake sentinels only.
+ */
+export declare const REDACTION_MASK = "***REDACTED***";
+/**
+ * Redact a string for safe output. If `configuredSecret` is provided and present
+ * in the text, every occurrence is masked first (exact match — provider-agnostic),
+ * then known credential shapes are masked as a backstop.
+ */
+export declare function redactSecrets(text: string, configuredSecret?: string): string;
+/** Redact then write to stderr. Use for ALL error/diagnostic output on this path. */
+export declare function redactedError(message: string, configuredSecret?: string): string;

package/dist/core/provider-usage/credential-redaction.js

@@ -0,0 +1,60 @@
+/**
+ * Credential-shaped redaction for the provider-usage capture path.
+ *
+ * Per docs/design/provider-api-secrets-handling.md §4: a single redaction pass
+ * applies to EVERY output path (logs, errors, artifacts, reports, debug dumps).
+ *
+ * The PRIMARY control is that the credential is never placed into any structure
+ * that gets logged or serialized (see provider-usage-adapter.ts). This redaction
+ * pass is the defense-in-depth backstop: it masks the configured secret value (if
+ * present) AND anything matching known credential shapes, before any string is
+ * written to stdout/stderr/log/error/artifact.
+ *
+ * NO real secret ever appears here — tests exercise this with fake sentinels only.
+ */
+export const REDACTION_MASK = "***REDACTED***";
+/**
+ * Known credential-shaped patterns (defense in depth). These are deliberately
+ * conservative shape matchers, NOT a DLP/ML classifier:
+ *  - `Authorization: Bearer <token>` header values
+ *  - `x-api-key: <token>` header values
+ *  - common provider key prefixes followed by a long token body
+ *  - long high-entropy bearer-style tokens
+ */
+const KNOWN_CREDENTIAL_SHAPE_PATTERNS = [
+    // Authorization: Bearer <token>  (mask the token, keep the header name)
+    /(authorization\s*:\s*bearer\s+)[A-Za-z0-9._\-+/=]{8,}/gi,
+    // x-api-key: <token>  (mask the value, keep the header name)
+    /(x-api-key\s*:\s*)[A-Za-z0-9._\-+/=]{8,}/gi,
+    // Common provider key prefixes (sk-, sk-ant-, sk-proj-, anthropic-, etc.) + body
+    /\b(?:sk-(?:ant-|proj-)?|api[-_]?key[-_]|anthropic-|openai-)[A-Za-z0-9._\-]{12,}\b/gi,
+    // Long high-entropy token bodies (>= 32 chars of base64url-ish content)
+    /\b[A-Za-z0-9._\-+/=]{40,}\b/g
+];
+/**
+ * Redact a string for safe output. If `configuredSecret` is provided and present
+ * in the text, every occurrence is masked first (exact match — provider-agnostic),
+ * then known credential shapes are masked as a backstop.
+ */
+export function redactSecrets(text, configuredSecret) {
+    let redacted = text;
+    if (configuredSecret && configuredSecret.length > 0) {
+        // Exact-match mask of the known secret value (provider-agnostic, highest-precision).
+        redacted = redacted.split(configuredSecret).join(REDACTION_MASK);
+    }
+    for (const pattern of KNOWN_CREDENTIAL_SHAPE_PATTERNS) {
+        redacted = redacted.replace(pattern, (match, prefix) => {
+            // Header patterns capture a non-secret prefix we preserve; keep it, mask the value.
+            if (typeof prefix === "string" && prefix.length > 0) {
+                return `${prefix}${REDACTION_MASK}`;
+            }
+            return REDACTION_MASK;
+        });
+    }
+    return redacted;
+}
+/** Redact then write to stderr. Use for ALL error/diagnostic output on this path. */
+export function redactedError(message, configuredSecret) {
+    return redactSecrets(message, configuredSecret);
+}
+//# sourceMappingURL=credential-redaction.js.map

package/dist/core/provider-usage/provider-usage-adapter.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Provider-usage capture adapter (Option A, read-only, aggregate-only).
+ *
+ * Normalizes a read-only provider usage/cost API read into a CapturedRun carrying
+ * usage/cost UsageMetadata ONLY (source = "provider_usage"), with NO message
+ * content. See:
+ *  - docs/design/provider-api-capture.md (Option A)
+ *  - docs/design/provider-api-secrets-handling.md (credential: env-only, in-memory,
+ *    never stored/logged/serialized)
+ *  - docs/design/provider-api-privacy-redaction.md (aggregate-only, no content)
+ *  - docs/design/provider-api-tracesource-classification.md (Option 2: provider_usage
+ *    -> provider_reported_usage; cost/spend evidence, caps approval-readiness at
+ *    "conditional", never "ready")
+ *
+ * HARD INVARIANTS enforced here:
+ *  - The credential is read from an env var, held in a local variable, passed ONLY
+ *    to the client's auth header, and NEVER copied into the trace/usage/provenance
+ *    or any returned/serialized structure.
+ *  - Missing/empty credential => clean refusal (clear message naming the env var),
+ *    no artifact, no network read. Never a silent fallback.
+ *  - The produced trace has NO messages (a usage-only read has nothing to compact)
+ *    and NO content fields. UsageMetadata carries aggregate usage/cost only.
+ *  - cost_source: "provider_reported" ONLY when the endpoint genuinely exposed cost;
+ *    otherwise price-table estimate / missing.
+ */
+import type { CapturedRun } from "../capture-adapter.js";
+import { type ProviderUsageClient } from "./provider-usage-client.js";
+export declare const PROVIDER_USAGE_ADAPTER_ID = "provider-usage-read-v1";
+/** Default env var name the credential is read from. A flag may only NAME the var. */
+export declare const DEFAULT_CREDENTIAL_ENV_VAR = "COMPACTION_PROVIDER_USAGE_TOKEN";
+export declare const PROVIDER_USAGE_PRIVACY_NOTE: string;
+/** Thrown when the credential env var is absent/empty. Carries NO secret value. */
+export declare class MissingProviderCredentialError extends Error {
+    readonly envVar: string;
+    constructor(envVar: string);
+}
+export interface ProviderUsageCaptureInput {
+    /** Configurable provider usage/cost endpoint (non-secret descriptor). */
+    endpoint: string;
+    /** Env var name to read the credential from (NAME only — never the value). */
+    credentialEnvVar?: string;
+    /** Optional reporting window start (ISO 8601). */
+    windowStart?: string;
+    /** Optional reporting window end (ISO 8601). */
+    windowEnd?: string;
+    /** Human-readable label for the run/window, if any. */
+    label?: string;
+    /** Injectable client. Tests pass a mock; defaults to the real fetch client. */
+    client?: ProviderUsageClient;
+    /** Override env reader (tests). Defaults to process.env. */
+    env?: Record<string, string | undefined>;
+    /** Fixed timestamp for deterministic artifacts/tests. */
+    capturedAt?: string;
+    /** Fixed run id for deterministic artifacts/tests. */
+    runId?: string;
+}
+/**
+ * Capture aggregate provider usage/cost into a CapturedRun.
+ *
+ * Reads the credential from the named env var (refusing cleanly if absent/empty),
+ * performs the single read via the injectable client, and normalizes the result
+ * into a usage-only CapturedRun. The credential never leaves this function except
+ * as the client's auth header value.
+ */
+export declare function captureProviderUsage(input: ProviderUsageCaptureInput): Promise<CapturedRun>;

package/dist/core/provider-usage/provider-usage-adapter.js

@@ -0,0 +1,147 @@
+/**
+ * Provider-usage capture adapter (Option A, read-only, aggregate-only).
+ *
+ * Normalizes a read-only provider usage/cost API read into a CapturedRun carrying
+ * usage/cost UsageMetadata ONLY (source = "provider_usage"), with NO message
+ * content. See:
+ *  - docs/design/provider-api-capture.md (Option A)
+ *  - docs/design/provider-api-secrets-handling.md (credential: env-only, in-memory,
+ *    never stored/logged/serialized)
+ *  - docs/design/provider-api-privacy-redaction.md (aggregate-only, no content)
+ *  - docs/design/provider-api-tracesource-classification.md (Option 2: provider_usage
+ *    -> provider_reported_usage; cost/spend evidence, caps approval-readiness at
+ *    "conditional", never "ready")
+ *
+ * HARD INVARIANTS enforced here:
+ *  - The credential is read from an env var, held in a local variable, passed ONLY
+ *    to the client's auth header, and NEVER copied into the trace/usage/provenance
+ *    or any returned/serialized structure.
+ *  - Missing/empty credential => clean refusal (clear message naming the env var),
+ *    no artifact, no network read. Never a silent fallback.
+ *  - The produced trace has NO messages (a usage-only read has nothing to compact)
+ *    and NO content fields. UsageMetadata carries aggregate usage/cost only.
+ *  - cost_source: "provider_reported" ONLY when the endpoint genuinely exposed cost;
+ *    otherwise price-table estimate / missing.
+ */
+import { createUsageMetadata } from "../usage-metadata.js";
+import { FetchProviderUsageClient } from "./provider-usage-client.js";
+export const PROVIDER_USAGE_ADAPTER_ID = "provider-usage-read-v1";
+/** Default env var name the credential is read from. A flag may only NAME the var. */
+export const DEFAULT_CREDENTIAL_ENV_VAR = "COMPACTION_PROVIDER_USAGE_TOKEN";
+export const PROVIDER_USAGE_PRIVACY_NOTE = "NOTE: This is a read-only, aggregate-only provider usage/cost read. It captures token/cost\n" +
+    "aggregates ONLY — NO prompt/completion content is read or stored. The captured artifact is\n" +
+    "written locally to the output directory only. The credential is read from an environment\n" +
+    "variable, used only for the single read-only request, and is never logged or written to any\n" +
+    "artifact.";
+/** Thrown when the credential env var is absent/empty. Carries NO secret value. */
+export class MissingProviderCredentialError extends Error {
+    envVar;
+    constructor(envVar) {
+        super(`No provider usage credential found. Set the ${envVar} environment variable ` +
+            `(a read-only, usage/cost-scoped token) and re-run. Refusing; no fallback, no artifact written.`);
+        this.name = "MissingProviderCredentialError";
+        this.envVar = envVar;
+    }
+}
+/**
+ * Build the UsageMetadata for an aggregate read. cost_source is "provider_reported"
+ * only when the endpoint genuinely exposed a cost; otherwise the existing estimate
+ * path (price-table when a known model is present, else missing) is used.
+ */
+function buildUsageMetadata(usage) {
+    const endpointExposedCost = typeof usage.cost === "number";
+    const limitations = [
+        "Aggregate usage/cost read from the provider usage/cost reporting API for account-level reporting; this is a usage/cost report, not a per-run invoice reconciliation.",
+        "Aggregate usage only — NO prompt/completion content was captured by this read.",
+        "Not billing-confirmed savings (Tier 3): this is the usage/cost substrate only, not a measured applied-optimization billing delta."
+    ];
+    if (!endpointExposedCost) {
+        limitations.push("Cost not exposed by the endpoint; cost remains a price-table estimate or missing.");
+    }
+    return createUsageMetadata({
+        inputTokens: usage.input_tokens,
+        outputTokens: usage.output_tokens,
+        totalTokens: usage.total_tokens,
+        providerReportedTokens: true,
+        estimatedTokens: false,
+        providerReportedCost: endpointExposedCost,
+        currency: usage.currency,
+        model: usage.model,
+        provider: usage.provider,
+        limitations
+    });
+}
+/** A usage-only read produces a trace with NO messages and NO content. */
+function buildUsageOnlyTrace(usage, input, capturedAt, runId) {
+    return {
+        id: runId,
+        title: input.label ?? `Provider usage/cost read (${input.endpoint})`,
+        artifactVersion: "agent-trace-v1",
+        source: "provider_usage",
+        createdAt: capturedAt,
+        generatedAt: capturedAt,
+        model: usage.model ?? "unknown",
+        // Aggregate-only: NO messages. A usage-only trace has nothing to compact.
+        messages: []
+    };
+}
+/**
+ * Build a non-secret provenance descriptor of the read. Records the endpoint and
+ * window and the explicit "aggregate usage only, no content" note. NEVER records
+ * the credential or any credential-derived value.
+ */
+function buildProvenance(input, usage, capturedAt) {
+    const windowStart = input.windowStart ?? usage.window_start ?? null;
+    const windowEnd = input.windowEnd ?? usage.window_end ?? null;
+    const windowDescriptor = windowStart || windowEnd ? `window ${windowStart ?? "unspecified"} .. ${windowEnd ?? "unspecified"}` : "window unspecified";
+    return {
+        captureAdapter: PROVIDER_USAGE_ADAPTER_ID,
+        // Non-secret descriptor ONLY: endpoint + window. Never the credential.
+        sourcePath: `${input.endpoint} (${windowDescriptor})`,
+        capturedAt,
+        sessionId: null,
+        warnings: [PROVIDER_USAGE_PRIVACY_NOTE],
+        limitations: [
+            "Read-only, aggregate-only provider usage/cost read (Option A).",
+            "NO prompt/completion content was captured by this read.",
+            "Credential was read from an environment variable, used only for the single read-only request, and is not recorded here.",
+            `Provider-reported usage; cost is ${typeof usage.cost === "number" ? "provider-reported" : "price-table estimated or missing"}.`,
+            "Billing-confirmed savings (Tier 3) are NOT claimed."
+        ]
+    };
+}
+/**
+ * Capture aggregate provider usage/cost into a CapturedRun.
+ *
+ * Reads the credential from the named env var (refusing cleanly if absent/empty),
+ * performs the single read via the injectable client, and normalizes the result
+ * into a usage-only CapturedRun. The credential never leaves this function except
+ * as the client's auth header value.
+ */
+export async function captureProviderUsage(input) {
+    const envVar = input.credentialEnvVar ?? DEFAULT_CREDENTIAL_ENV_VAR;
+    const env = input.env ?? process.env;
+    // Credential acquisition: env var ONLY. Clean refusal on absence — never a fallback.
+    const credential = env[envVar];
+    if (typeof credential !== "string" || credential.length === 0) {
+        throw new MissingProviderCredentialError(envVar);
+    }
+    const capturedAt = input.capturedAt ?? new Date().toISOString();
+    const runId = input.runId ?? `provider-usage-${Date.parse(capturedAt) || Date.now()}`;
+    const client = input.client ?? new FetchProviderUsageClient();
+    // The single read-only request. The credential is passed in-memory only and is
+    // NOT retained after this call (no copy into any returned structure below).
+    const usage = await client.fetchUsage({
+        endpoint: input.endpoint,
+        credential,
+        windowStart: input.windowStart,
+        windowEnd: input.windowEnd
+    });
+    const trace = buildUsageOnlyTrace(usage, input, capturedAt, runId);
+    const usageMetadata = buildUsageMetadata(usage);
+    const provenance = buildProvenance(input, usage, capturedAt);
+    // The returned CapturedRun carries usage/cost + non-secret descriptors ONLY.
+    // The credential is never part of trace, usage, or provenance.
+    return { trace, usage: usageMetadata, provenance };
+}
+//# sourceMappingURL=provider-usage-adapter.js.map

package/dist/core/provider-usage/provider-usage-client.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Injectable provider-usage read client (Option A, read-only, aggregate-only).
+ *
+ * Per docs/design/provider-api-capture.md and the secrets/privacy designs:
+ *  - The provider HTTP read is abstracted behind this small interface so tests
+ *    inject a MOCK returning a fixture aggregate-usage response (NO real network,
+ *    NO real secret).
+ *  - The real implementation uses Node's global `fetch` (built-in — NO new npm
+ *    dependency) to a configurable endpoint with the credential in the auth header.
+ *  - The credential is passed in-memory only and is NEVER stored, logged, or
+ *    placed into any serialized structure (see provider-usage-adapter.ts).
+ *
+ * Aggregate-only invariant: the response carries usage/cost AGGREGATES ONLY.
+ * There is NO field for prompt/completion/message content anywhere in this contract.
+ */
+/**
+ * Expected aggregate-usage input contract — the JSON shape the read expects from a
+ * provider usage/cost reporting endpoint. Parsed defensively (parseAggregateUsage).
+ *
+ * NOTE: the exact per-provider response schema mapping is only validated when an
+ * operator runs this against a real provider; here it is the documented contract
+ * the read normalizes into, exercised with mock fixtures only. There is NO content
+ * field in this contract by construction.
+ */
+export interface ProviderAggregateUsage {
+    /** Model identifier the aggregate is reported for (e.g. "claude-3-5-sonnet"). */
+    model?: string;
+    /** Provider identifier (e.g. "anthropic", "openai"). */
+    provider?: string;
+    /** Aggregate input token count for the window. */
+    input_tokens?: number;
+    /** Aggregate output token count for the window. */
+    output_tokens?: number;
+    /** Aggregate total token count for the window (derived if absent). */
+    total_tokens?: number;
+    /** Aggregate request count for the window, if the endpoint reports it. */
+    request_count?: number;
+    /**
+     * Aggregate cost for the window, ONLY when the endpoint genuinely exposes cost.
+     * When present, cost is labeled provider-reported; when absent, cost stays a
+     * price-table estimate. Never guessed.
+     */
+    cost?: number;
+    /** Currency code for `cost` (e.g. "USD"), when cost is exposed. */
+    currency?: string;
+    /** Start of the reporting window (ISO 8601), if reported. */
+    window_start?: string;
+    /** End of the reporting window (ISO 8601), if reported. */
+    window_end?: string;
+}
+export interface FetchUsageInput {
+    /** Configurable provider usage/cost endpoint (non-secret). */
+    endpoint: string;
+    /**
+     * The read-only credential, held in memory only for the single request.
+     * Supplied as the auth header value; NEVER logged, stored, or serialized.
+     */
+    credential: string;
+    /** Optional reporting window start (ISO 8601). */
+    windowStart?: string;
+    /** Optional reporting window end (ISO 8601). */
+    windowEnd?: string;
+}
+export interface ProviderUsageClient {
+    /**
+     * Read aggregate usage/cost from the provider's own usage/cost reporting API.
+     * Returns aggregate usage/cost ONLY — never prompt/completion content.
+     */
+    fetchUsage(input: FetchUsageInput): Promise<ProviderAggregateUsage>;
+}
+/**
+ * Defensive parser for the aggregate-usage contract. Accepts an unknown JSON value
+ * (e.g. a provider response body) and extracts ONLY the aggregate usage/cost fields.
+ * Any content-shaped or unexpected fields are dropped — they never reach the trace.
+ */
+export declare function parseAggregateUsage(raw: unknown): ProviderAggregateUsage;
+/**
+ * Real provider-usage client using Node's built-in global `fetch` (NO new npm
+ * dependency). Performs exactly ONE read-only GET to the configured endpoint with
+ * the credential in the auth header. The credential is used only for this request
+ * and is never logged or returned. The response is parsed defensively to aggregate
+ * usage/cost only.
+ *
+ * This live path is unit-tested with a MOCK client; it is NOT dogfooded against a
+ * real provider in this environment (no credential/endpoint available).
+ */
+export declare class FetchProviderUsageClient implements ProviderUsageClient {
+    fetchUsage(input: FetchUsageInput): Promise<ProviderAggregateUsage>;
+}

package/dist/core/provider-usage/provider-usage-client.js

@@ -0,0 +1,96 @@
+/**
+ * Injectable provider-usage read client (Option A, read-only, aggregate-only).
+ *
+ * Per docs/design/provider-api-capture.md and the secrets/privacy designs:
+ *  - The provider HTTP read is abstracted behind this small interface so tests
+ *    inject a MOCK returning a fixture aggregate-usage response (NO real network,
+ *    NO real secret).
+ *  - The real implementation uses Node's global `fetch` (built-in — NO new npm
+ *    dependency) to a configurable endpoint with the credential in the auth header.
+ *  - The credential is passed in-memory only and is NEVER stored, logged, or
+ *    placed into any serialized structure (see provider-usage-adapter.ts).
+ *
+ * Aggregate-only invariant: the response carries usage/cost AGGREGATES ONLY.
+ * There is NO field for prompt/completion/message content anywhere in this contract.
+ */
+function coerceNonNegativeNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+function coerceString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/**
+ * Defensive parser for the aggregate-usage contract. Accepts an unknown JSON value
+ * (e.g. a provider response body) and extracts ONLY the aggregate usage/cost fields.
+ * Any content-shaped or unexpected fields are dropped — they never reach the trace.
+ */
+export function parseAggregateUsage(raw) {
+    const obj = (raw && typeof raw === "object" ? raw : {});
+    const result = {};
+    const model = coerceString(obj.model);
+    if (model !== undefined)
+        result.model = model;
+    const provider = coerceString(obj.provider);
+    if (provider !== undefined)
+        result.provider = provider;
+    const inputTokens = coerceNonNegativeNumber(obj.input_tokens);
+    if (inputTokens !== undefined)
+        result.input_tokens = inputTokens;
+    const outputTokens = coerceNonNegativeNumber(obj.output_tokens);
+    if (outputTokens !== undefined)
+        result.output_tokens = outputTokens;
+    const totalTokens = coerceNonNegativeNumber(obj.total_tokens);
+    if (totalTokens !== undefined)
+        result.total_tokens = totalTokens;
+    const requestCount = coerceNonNegativeNumber(obj.request_count);
+    if (requestCount !== undefined)
+        result.request_count = requestCount;
+    const cost = coerceNonNegativeNumber(obj.cost);
+    if (cost !== undefined)
+        result.cost = cost;
+    const currency = coerceString(obj.currency);
+    if (currency !== undefined)
+        result.currency = currency;
+    const windowStart = coerceString(obj.window_start);
+    if (windowStart !== undefined)
+        result.window_start = windowStart;
+    const windowEnd = coerceString(obj.window_end);
+    if (windowEnd !== undefined)
+        result.window_end = windowEnd;
+    return result;
+}
+/**
+ * Real provider-usage client using Node's built-in global `fetch` (NO new npm
+ * dependency). Performs exactly ONE read-only GET to the configured endpoint with
+ * the credential in the auth header. The credential is used only for this request
+ * and is never logged or returned. The response is parsed defensively to aggregate
+ * usage/cost only.
+ *
+ * This live path is unit-tested with a MOCK client; it is NOT dogfooded against a
+ * real provider in this environment (no credential/endpoint available).
+ */
+export class FetchProviderUsageClient {
+    async fetchUsage(input) {
+        const url = new URL(input.endpoint);
+        if (input.windowStart)
+            url.searchParams.set("window_start", input.windowStart);
+        if (input.windowEnd)
+            url.searchParams.set("window_end", input.windowEnd);
+        const response = await fetch(url, {
+            method: "GET",
+            headers: {
+                // Auth header carries the credential for this single read only.
+                Authorization: `Bearer ${input.credential}`,
+                Accept: "application/json"
+            }
+        });
+        if (!response.ok) {
+            // Surface status WITHOUT echoing the request auth header or the credential.
+            // The caller redacts before printing as a backstop.
+            throw new Error(`Provider usage endpoint returned HTTP ${response.status} ${response.statusText}.`);
+        }
+        const body = await response.json();
+        return parseAggregateUsage(body);
+    }
+}
+//# sourceMappingURL=provider-usage-client.js.map

package/dist/core/report-generator.d.ts

@@ -0,0 +1,7 @@
+import type { SkillInjectionAdvisory } from "./skill-injection-detector.js";
+import type { AgentTrace, CompactionPolicy, CompactionReport, CostEstimate, TokenEstimate, WasteFinding } from "./types.js";
+import type { UsageMetadata } from "./usage-metadata.js";
+export declare function formatAnalyzeReport(trace: AgentTrace, tokens: TokenEstimate, cost: CostEstimate, findings?: WasteFinding[], usage?: UsageMetadata, skillInjectionAdvisory?: SkillInjectionAdvisory): string;
+export declare function formatCompactionReport(report: CompactionReport): string;
+export declare function formatCompactionMarkdownReport(report: CompactionReport, policy: CompactionPolicy): string;
+export declare function formatPrCommentReport(report: CompactionReport, policy: CompactionPolicy, artifactNames: string[]): string;