@diffci.com/diffci 0.1.0-alpha.3

package/dist-client/src/client/context.js

@@ -0,0 +1,173 @@
+/**
+ * Where am I, and which two commits am I being asked about? (Phase 02, 2026-08-26.)
+ *
+ * Running inside someone else's CI means the commit range is not a parameter a human chose - it has to
+ * be recovered from the environment, and the environment lies in specific, well-known ways:
+ *
+ *   - `actions/checkout` defaults to `fetch-depth: 1`. The base commit of a pull request is then simply
+ *     absent from the local object store, and `git diff base..head` fails with a message about a bad
+ *     revision that reads, to anyone who has not seen it before, like a DiffCI bug.
+ *   - On a pull request, the checked-out HEAD is a MERGE commit GitHub created, not the head of the
+ *     contributor's branch. Diffing HEAD^..HEAD there compares against the base branch tip, which is a
+ *     different question from "what did this pull request change".
+ *   - On the first push to a new branch, `event.before` is forty zeros. Treating that as a commit SHA
+ *     produces an empty diff, and an empty diff reads downstream as "nothing changed, skip everything".
+ *
+ * Every one of those has the same shape: a plausible-looking range that answers the wrong question. So
+ * this module resolves a range only when it can name where both ends came from and verify both exist
+ * locally, and otherwise REFUSES with a reason that says what to change. It never falls back to a range
+ * it had to guess.
+ */
+import { existsSync, readFileSync } from "node:fs";
+/** Triggers that carry no inherent "what changed" - a range for these would have to be invented. */
+const SYNTHETIC_TRIGGERS = new Set(["schedule", "workflow_dispatch", "repository_dispatch", "release"]);
+const ZERO_SHA = "0000000000000000000000000000000000000000";
+function readEventPayload(env) {
+    const path = env.GITHUB_EVENT_PATH;
+    if (!path || !existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return parsed !== null && typeof parsed === "object" ? parsed : undefined;
+    }
+    catch {
+        // A malformed event payload is the runner's problem, not ours. Callers degrade to the flat
+        // GITHUB_* variables, which is strictly less information but never wrong information.
+        return undefined;
+    }
+}
+function nested(record, ...keys) {
+    let current = record;
+    for (const key of keys) {
+        if (current === null || typeof current !== "object")
+            return undefined;
+        current = current[key];
+    }
+    return current;
+}
+function asString(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+export function readCiEnvironment(env) {
+    if (env.GITHUB_ACTIONS !== "true") {
+        return { provider: env.CI === "true" ? "unknown" : "local" };
+    }
+    const payload = readEventPayload(env);
+    const event = asString(env.GITHUB_EVENT_NAME);
+    return {
+        provider: "github-actions",
+        ownerName: asString(env.GITHUB_REPOSITORY),
+        providerRepositoryId: asString(env.GITHUB_REPOSITORY_ID),
+        defaultBranch: asString(nested(payload, "repository", "default_branch")) ?? asString(env.GITHUB_DEFAULT_BRANCH),
+        runId: asString(env.GITHUB_RUN_ID),
+        runAttempt: asString(env.GITHUB_RUN_ATTEMPT),
+        workflow: asString(env.GITHUB_WORKFLOW),
+        job: asString(env.GITHUB_JOB),
+        event,
+        ref: asString(env.GITHUB_REF),
+        syntheticTrigger: event !== undefined && SYNTHETIC_TRIGGERS.has(event),
+    };
+}
+function commitExists(git, sha) {
+    if (!/^[0-9a-f]{7,40}$/i.test(sha))
+        return false;
+    return git(["cat-file", "-e", `${sha}^{commit}`]).ok;
+}
+/**
+ * `--verify <rev>^{commit}` rather than a bare `rev-parse`: a bare rev-parse hands back any
+ * well-formed 40-character hex string unchanged, whether or not that commit exists in this clone. A
+ * `--base` naming a commit the shallow checkout does not have would then sail through here and fail
+ * three stages later, as a delta error, which reads like a DiffCI defect rather than a missing fetch.
+ */
+function resolveSha(git, rev) {
+    const result = git(["rev-parse", "--verify", `${rev}^{commit}`]);
+    return result.ok ? result.stdout.trim() || undefined : undefined;
+}
+function mergeBase(git, a, b) {
+    const result = git(["merge-base", a, b]);
+    return result.ok ? result.stdout.trim() || undefined : undefined;
+}
+/** The one sentence every "commit missing locally" refusal ends with, so the fix is never a guess. */
+const DEEPEN_HINT = "the commit is not in this checkout - add `fetch-depth: 0` to the actions/checkout step in the job that runs DiffCI (this does not affect any other job)";
+export function resolveCommitRange(options) {
+    const { env, git, baseOverride, headOverride } = options;
+    if (baseOverride !== undefined || headOverride !== undefined) {
+        if (baseOverride === undefined || headOverride === undefined) {
+            return { ok: false, reason: "--base and --head must be given together" };
+        }
+        const base = resolveSha(git, baseOverride);
+        const head = resolveSha(git, headOverride);
+        if (!base)
+            return { ok: false, reason: `base revision ${baseOverride} could not be resolved: ${DEEPEN_HINT}` };
+        if (!head)
+            return { ok: false, reason: `head revision ${headOverride} could not be resolved: ${DEEPEN_HINT}` };
+        return { ok: true, range: { baseSha: base, headSha: head, source: "explicit-flags" } };
+    }
+    const payload = readEventPayload(env);
+    const event = env.GITHUB_EVENT_NAME;
+    if (event === "pull_request" || event === "pull_request_target") {
+        const headSha = asString(nested(payload, "pull_request", "head", "sha"));
+        const baseSha = asString(nested(payload, "pull_request", "base", "sha"));
+        if (!headSha || !baseSha) {
+            return { ok: false, reason: "pull_request event payload carried no head/base SHA" };
+        }
+        if (!commitExists(git, headSha)) {
+            return {
+                ok: false,
+                reason: `pull request head ${headSha.slice(0, 12)} is not present locally: ${DEEPEN_HINT}`,
+            };
+        }
+        if (!commitExists(git, baseSha)) {
+            return {
+                ok: false,
+                reason: `pull request base ${baseSha.slice(0, 12)} is not present locally: ${DEEPEN_HINT}`,
+            };
+        }
+        // GitHub's base.sha is the base branch tip as of the event. When the branch has moved on since,
+        // diffing from it attributes other people's commits to this pull request, so the merge base is
+        // used when git can compute one - and the fact that it was used is recorded, not hidden.
+        const common = mergeBase(git, baseSha, headSha);
+        const effectiveBase = common ?? baseSha;
+        return {
+            ok: true,
+            range: {
+                baseSha: effectiveBase,
+                headSha,
+                source: "pull-request-event",
+                mergeBaseSha: common && common !== baseSha ? common : undefined,
+            },
+        };
+    }
+    if (event === "push") {
+        const headSha = asString(env.GITHUB_SHA) ?? resolveSha(git, "HEAD");
+        if (!headSha)
+            return { ok: false, reason: "could not determine the head commit of this push" };
+        const before = asString(nested(payload, "before"));
+        if (before && before !== ZERO_SHA && commitExists(git, before)) {
+            return { ok: true, range: { baseSha: before, headSha, source: "push-event" } };
+        }
+        // A branch's first push has no `before`. The head's own parent is the honest substitute and is
+        // labelled as such - it answers "what did this commit change", not "what did this push change".
+        const parent = resolveSha(git, `${headSha}^`);
+        if (!parent) {
+            return {
+                ok: false,
+                reason: before === ZERO_SHA
+                    ? `this push created the branch and its head commit has no parent in this checkout: ${DEEPEN_HINT}`
+                    : `no usable base commit for this push: ${DEEPEN_HINT}`,
+            };
+        }
+        return { ok: true, range: { baseSha: parent, headSha, source: "head-parent" } };
+    }
+    const head = resolveSha(git, "HEAD");
+    if (!head)
+        return { ok: false, reason: "not a git repository, or HEAD could not be resolved" };
+    const parent = resolveSha(git, "HEAD^");
+    if (!parent) {
+        return {
+            ok: false,
+            reason: `HEAD has no parent commit in this checkout, so there is no range to analyse: ${DEEPEN_HINT}`,
+        };
+    }
+    return { ok: true, range: { baseSha: parent, headSha: head, source: "head-parent" } };
+}

package/dist-client/src/client/observe.js

@@ -0,0 +1,230 @@
+/**
+ * The client-side observation run (Phase 02, 2026-08-26).
+ *
+ * This is the whole product, executed on someone else's runner: resolve a commit range, build the real
+ * dependency graph from the checkout that is already there, work out which tests DiffCI would have run,
+ * work out what a simple path-rule CI would have run, and write a report. It runs nothing, changes
+ * nothing, and cancels nothing.
+ *
+ * Two properties are load-bearing, and both are enforced here rather than promised:
+ *
+ * READ-ONLY. The engine modules called below only read (verified: no write in src/repo, src/git). This
+ * function additionally records HEAD and `git status --porcelain` before and after itself, so a run that
+ * DID dirty the tree says so in its own report instead of being discovered weeks later.
+ *
+ * NEVER THROWS. A crash inside an observer that a repository installed on trust must not take their CI
+ * step down with it, and must not be silent either. Every failure becomes a report with status ERROR or
+ * REFUSED and the stage it happened at. The distinction is deliberate and is preserved everywhere:
+ * REFUSED is a limit DiffCI is stating (no TypeScript project, base commit not fetched), ERROR is a
+ * defect in DiffCI. Counting them together would let a week of crashes read as a week of honest limits.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { relative, resolve } from "node:path";
+import { analyzeGitDelta } from "../git/git-diff.js";
+import { classifyTypeScriptProject, buildDependencyGraph } from "../repo/graph.js";
+import { ImpactAnalyzer } from "../repo/impact.js";
+import { runPathBaseline } from "../planner/path-baseline.js";
+import { commandSpecToString, planSelectiveTestCommands } from "../planner/test-command.js";
+import { readCiEnvironment, resolveCommitRange, } from "./context.js";
+import { OBSERVATION_SCHEMA, redactPath, } from "./report.js";
+import { auditWorkflows } from "./workflow-guard.js";
+/** Build output and dependencies are never sources of truth about a repository's own structure. */
+const EXCLUDE_DIRS = ["node_modules", ".next", "dist", "build"];
+function makeGitRunner(repoPath) {
+    return (args) => {
+        try {
+            const stdout = execFileSync("git", args, {
+                cwd: repoPath,
+                encoding: "utf8",
+                maxBuffer: 64 * 1024 * 1024,
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            return { ok: true, stdout };
+        }
+        catch (error) {
+            return { ok: false, error: error.message.split("\n")[0] ?? "git failed" };
+        }
+    };
+}
+function sha256(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+/** A digest rather than the porcelain text itself: the point is only whether it changed. */
+function worktreeDigest(git) {
+    const result = git(["status", "--porcelain"]);
+    return result.ok ? sha256(result.stdout) : undefined;
+}
+function headSha(git) {
+    const result = git(["rev-parse", "HEAD"]);
+    return result.ok ? result.stdout.trim() || undefined : undefined;
+}
+/**
+ * True when the report would land inside the observed checkout. That is not a style preference: an
+ * untracked file in the working tree changes `git status`, and CI jobs that assert a clean tree (a
+ * generated-code check, a lockfile check, `git diff --exit-code`) would start failing because DiffCI
+ * was installed. The report is written outside the repository by default for exactly that reason.
+ */
+export function isInsideRepository(repoPath, candidate) {
+    const rel = relative(resolve(repoPath), resolve(candidate));
+    return rel !== "" && !rel.startsWith("..") && !/^[a-zA-Z]:/.test(rel);
+}
+export async function observe(options) {
+    const startedAt = Date.now();
+    const repoPath = resolve(options.repoPath);
+    const git = options.git ?? makeGitRunner(repoPath);
+    const ci = readCiEnvironment(options.env);
+    const [owner, name] = (ci.ownerName ?? "").split("/");
+    const before = { head: headSha(git), worktree: worktreeDigest(git) };
+    const hashPath = (path) => (options.redactPaths ? redactPath(path, sha256) : path);
+    // Declared before `finish` closes over it: the range is part of every report, including the reports
+    // produced by failures that happen after it was resolved.
+    let range;
+    const finish = (status, stage, extra) => {
+        const after = { head: headSha(git), worktree: worktreeDigest(git) };
+        const nonInterference = {
+            headShaBefore: before.head,
+            headShaAfter: after.head,
+            worktreeDigestBefore: before.worktree,
+            worktreeDigestAfter: after.worktree,
+            worktreeUnchanged: before.head !== undefined &&
+                before.worktree !== undefined &&
+                before.head === after.head &&
+                before.worktree === after.worktree,
+            reportWrittenOutsideRepository: options.reportPath === undefined ? true : !isInsideRepository(repoPath, options.reportPath),
+            workflowFindings: safeAuditWorkflows(repoPath),
+        };
+        return {
+            schema: OBSERVATION_SCHEMA,
+            producedAt: new Date().toISOString(),
+            observer: {
+                version: options.version,
+                engineSha: options.engineSha,
+                node: process.version,
+                platform: process.platform,
+            },
+            repository: {
+                provider: ci.provider === "github-actions" ? "github" : "unknown",
+                ownerName: owner && name ? `${owner}/${name}` : undefined,
+                defaultBranch: ci.defaultBranch,
+                providerRepositoryId: ci.providerRepositoryId,
+            },
+            ci: {
+                provider: ci.provider,
+                runId: ci.runId,
+                runAttempt: ci.runAttempt,
+                workflow: ci.workflow,
+                job: ci.job,
+                event: ci.event,
+                ref: ci.ref,
+                syntheticTrigger: ci.syntheticTrigger,
+            },
+            commitRange: range ? { ...range } : undefined,
+            status,
+            stage,
+            reason: extra.reason,
+            result: extra.result,
+            payload: {
+                includesFilePaths: options.redactPaths !== true,
+                includesFileContents: false,
+                includesEnvironment: false,
+                includesCredentials: false,
+                pathRedaction: options.redactPaths ? "sha256-12" : undefined,
+            },
+            nonInterference,
+            timings: { totalMs: Date.now() - startedAt },
+        };
+    };
+    try {
+        const resolved = resolveCommitRange({
+            env: options.env,
+            git,
+            baseOverride: options.baseOverride,
+            headOverride: options.headOverride,
+        });
+        if (!resolved.ok)
+            return finish("REFUSED", "context", { reason: resolved.reason });
+        range = resolved.range;
+        // The eligibility gate is asked of the graph builder itself (classifyTypeScriptProject), not of a
+        // separate list of conditions that can drift away from it. Phase 01 F3 is what that drift costs.
+        const capability = classifyTypeScriptProject(repoPath);
+        if (!capability.capable) {
+            return finish("REFUSED", "eligibility", {
+                reason: `DiffCI can only analyse TypeScript/JavaScript projects today: ${capability.reason}`,
+            });
+        }
+        const deltaResult = await analyzeGitDelta({ baseSha: range.baseSha, headSha: range.headSha, repoPath });
+        if (!deltaResult.success) {
+            return finish("REFUSED", "delta", { reason: deltaResult.error });
+        }
+        const delta = deltaResult.delta;
+        const graphResult = await buildDependencyGraph({ repoPath, excludeDirs: EXCLUDE_DIRS });
+        if (graphResult.graph.nodes.length === 0) {
+            return finish("REFUSED", "graph", {
+                reason: "the dependency graph came back empty - DiffCI will not propose a selection from a graph that sees none of this repository",
+            });
+        }
+        const profile = graphResult.profile;
+        const impact = new ImpactAnalyzer().analyze(delta, graphResult, profile, {
+            repositoryFiles: deltaResult.inventory?.files,
+        });
+        const baseline = runPathBaseline(profile.testFilePaths, delta.files, profile);
+        const selectedTests = impact.affectedTests.map((test) => test.path).sort();
+        // The comparator's own identities, sorted and redacted identically so the two arms of an economics
+        // experiment are executed the same way rather than merely counted the same way.
+        const comparatorSelectedTests = [...baseline.selectedTests].sort().map(hashPath);
+        const commandPlan = impact.fallbackRequired
+            ? undefined
+            : planSelectiveTestCommands(profile, selectedTests);
+        return finish("OBSERVED", "complete", {
+            result: {
+                mode: impact.fallbackRequired ? "FULL" : "SELECTIVE",
+                changedFileCount: delta.files.length,
+                changedFiles: delta.files.map((file) => hashPath(file.path)),
+                affectedSourceFileCount: impact.affectedSourceFiles.length,
+                selectedTests: selectedTests.map(hashPath),
+                totalTestCount: profile.testFilePaths.length,
+                fallbackReasons: impact.fallbackReasons,
+                proposedCommands: (commandPlan?.commands ?? []).map(commandSpecToString),
+                commandRefusalReason: commandPlan?.refusalReason,
+                unroutedTestPaths: (commandPlan?.unroutedPaths ?? []).map(hashPath),
+                blindSpot: profile.testUniverse?.blindSpot === true,
+                riskSignals: impact.riskSignals.map((signal) => ({ level: signal.level, reason: signal.reason })),
+                graph: {
+                    nodes: graphResult.graph.nodes.length,
+                    edges: graphResult.graph.edges.length,
+                    confidence: graphResult.confidence,
+                    effectiveConfidence: impact.effectiveGraphConfidence,
+                    durationMs: Math.round(graphResult.performance.durationMs),
+                },
+                pathBaseline: {
+                    mode: baseline.fallbackRequired ? "FULL" : "SELECTIVE",
+                    // Count and list derived from ONE array, so they cannot disagree. Sorted and redacted exactly
+                    // like DiffCI's own `selectedTests` above, so a harness can execute either arm identically.
+                    selectedTestCount: comparatorSelectedTests.length,
+                    selectedTests: comparatorSelectedTests,
+                    matchedRules: baseline.matchedRules,
+                },
+                analysisStatus: impact.analysisStatus,
+            },
+        });
+    }
+    catch (error) {
+        return finish("ERROR", "complete", {
+            reason: `${error.name}: ${error.message.split("\n")[0]}`,
+        });
+    }
+}
+/**
+ * The workflow audit runs on every observation so the byte-identical claim is re-checked continuously,
+ * not once at install. It is best-effort: a repository whose workflows cannot be read still gets its
+ * observation, with the audit absent rather than the run lost.
+ */
+function safeAuditWorkflows(repoPath) {
+    try {
+        return auditWorkflows(repoPath).findings;
+    }
+    catch {
+        return [];
+    }
+}

package/dist-client/src/client/report.js

@@ -0,0 +1,63 @@
+/**
+ * The observation report - DiffCI's client-side wire format (Phase 02, 2026-08-26).
+ *
+ * WHY THIS EXISTS. Every earlier pipeline in this repository analysed OTHER people's repositories on
+ * DiffCI's own infrastructure: a container cloned the source, built the graph, and kept the evidence.
+ * That shape cannot be installed by a stranger - it asks them to hand a private tree to a service they
+ * have not evaluated, before they have seen a single number. Phase 02 inverts it. The analysis runs on
+ * the repository's own runner, inside its own CI, against a checkout it already has, and the only thing
+ * that ever leaves is this document.
+ *
+ * So this file is the privacy boundary as much as it is a type. Everything DiffCI could learn about a
+ * repository it does not host is a field below, and `payload` states in the document itself what the
+ * document contains. If a future field would carry file CONTENT, an environment variable, or anything
+ * a `git show` would print, it does not belong here - it belongs in a design conversation first.
+ *
+ * VERSIONING. `schema` is checked by consumers before anything else is read. A change that removes or
+ * repurposes a field is a new version, not an edit to this one: reports are produced by a pinned action
+ * inside someone else's CI, and old producers keep sending v1 long after the server has moved on.
+ */
+/** Wire identifier. Consumers MUST reject a document whose `schema` they do not recognise. */
+export const OBSERVATION_SCHEMA = "diffci.observation.v1";
+/**
+ * Path redaction for repositories that will observe but will not send paths off their runner.
+ *
+ * A truncated SHA-256 is stable across runs and across repositories, which is exactly the trade being
+ * made: the same file redacts to the same digest every time (so selection ratios and per-file trends
+ * still work), and a holder of the digest can confirm a GUESSED path but cannot enumerate paths from
+ * the digest alone. It is redaction, not anonymisation, and is described that way.
+ */
+export function redactPath(path, hash) {
+    return hash(path).slice(0, 12);
+}
+/**
+ * Minimal structural validation, shared by the producer's own tests and (from Phase 03) by ingest.
+ * Deliberately shallow: it checks that a document is the shape this version promises, not that its
+ * numbers are true.
+ */
+export function validateObservationReport(value) {
+    if (value === null || typeof value !== "object")
+        return { ok: false, error: "report is not an object" };
+    const record = value;
+    if (record.schema !== OBSERVATION_SCHEMA) {
+        return { ok: false, error: `unsupported schema ${String(record.schema)} (expected ${OBSERVATION_SCHEMA})` };
+    }
+    for (const field of ["producedAt", "status", "stage"]) {
+        if (typeof record[field] !== "string")
+            return { ok: false, error: `missing or non-string field "${field}"` };
+    }
+    if (!["OBSERVED", "REFUSED", "ERROR"].includes(record.status)) {
+        return { ok: false, error: `unknown status ${String(record.status)}` };
+    }
+    if (record.payload === null || typeof record.payload !== "object") {
+        return { ok: false, error: "missing payload description" };
+    }
+    const payload = record.payload;
+    if (payload.includesFileContents !== false || payload.includesCredentials !== false) {
+        return { ok: false, error: "payload claims to carry file contents or credentials, which this schema forbids" };
+    }
+    if (record.nonInterference === null || typeof record.nonInterference !== "object") {
+        return { ok: false, error: "missing non-interference evidence" };
+    }
+    return { ok: true, report: value };
+}

package/dist-client/src/client/submit.js

@@ -0,0 +1,89 @@
+const DEFAULT_TIMEOUT_MS = 15_000;
+function isLoopback(url) {
+    return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+}
+async function defaultSleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function submitObservation(options) {
+    if (!options.token) {
+        return { ok: false, kind: "misconfigured", message: "No ingest token was given, so the report was not sent." };
+    }
+    let url;
+    try {
+        url = new URL(options.apiUrl);
+    }
+    catch {
+        return { ok: false, kind: "misconfigured", message: `"${options.apiUrl}" is not a valid URL.` };
+    }
+    if (url.protocol !== "https:" && !isLoopback(url)) {
+        return {
+            ok: false,
+            kind: "misconfigured",
+            message: `Refusing to send an ingest token over ${url.protocol}// to ${url.host}. Use https.`,
+        };
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sleep = options.sleep ?? defaultSleep;
+    const attempts = 1 + Math.max(0, options.retries ?? 1);
+    const body = JSON.stringify(options.report);
+    let last = { ok: false, kind: "unreachable", message: "no attempt was made" };
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        if (attempt > 1)
+            await sleep(options.delayMs ?? 1000);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+        try {
+            const response = await fetchImpl(url.toString(), {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${options.token}`,
+                    "user-agent": `diffci-observer/${options.report.observer?.version ?? "unknown"}`,
+                },
+                body,
+                signal: controller.signal,
+            });
+            const text = await response.text().catch(() => "");
+            const parsed = (() => {
+                try {
+                    return JSON.parse(text);
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            if (response.ok) {
+                return { ok: true, duplicate: parsed?.duplicate === true, status: response.status };
+            }
+            if (response.status >= 500) {
+                last = {
+                    ok: false,
+                    kind: "unreachable",
+                    status: response.status,
+                    message: `DiffCI returned ${response.status}. The report is on disk and can be sent again.`,
+                };
+                continue;
+            }
+            // 4xx: the server has told us what is wrong with this request. Its message is written for the
+            // person reading this CI log, so it is passed through rather than summarised.
+            return {
+                ok: false,
+                kind: "rejected",
+                status: response.status,
+                rejection: typeof parsed?.rejection === "string" ? parsed.rejection : undefined,
+                message: typeof parsed?.error === "string" ? parsed.error : `DiffCI rejected the report (${response.status}).`,
+            };
+        }
+        catch (error) {
+            // Deliberately does not include the request in the message: on some runtimes a thrown fetch error
+            // stringifies the whole request, headers included.
+            const reason = error instanceof Error && error.name === "AbortError" ? "timed out" : "failed";
+            last = { ok: false, kind: "unreachable", message: `The request to ${url.host} ${reason}. The report is on disk and can be sent again.` };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    return last;
+}