@getfoyer/review-core 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @getfoyer/review-core — frozen schema contract for Foyer run artifacts.
+ *
+ * See `./types.ts` for the full surface. This index re-exports everything
+ * so consumers can `import { RunArtifact } from '@getfoyer/review-core'`
+ * without specifying the subpath.
+ */
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+/**
+ * @getfoyer/review-core — frozen schema contract for Foyer run artifacts.
+ *
+ * See `./types.ts` for the full surface. This index re-exports everything
+ * so consumers can `import { RunArtifact } from '@getfoyer/review-core'`
+ * without specifying the subpath.
+ */
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,cAAc,YAAY,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,360 @@
+/**
+ * RunArtifact v0.1 — the frozen contract for a single Foyer verification run.
+ *
+ * This file is the cross-cutting schema written by the GitHub App, written
+ * by the CLI's `foyer review`, rendered by the hosted report, and consumed
+ * by future PR-comment writers. It is intentionally separate from the
+ * implementation-internal types in `api/src/verification/types.ts` so the
+ * public shape can evolve under semver while internal modules iterate.
+ *
+ * Stability contract:
+ *   - schemaVersion is "0.1". Breaking changes require a version bump.
+ *   - Adding new optional fields is a minor change (no version bump).
+ *   - Removing or renaming fields, or changing semantics of existing
+ *     fields, requires bumping schemaVersion AND maintaining a reader
+ *     for the prior version for one release cycle.
+ *
+ * No runtime code lives here. No I/O, no dependencies. Pure types.
+ */
+/** Frozen schema version. Bump on breaking changes. */
+export declare const SCHEMA_VERSION: "0.1";
+export type SchemaVersion = typeof SCHEMA_VERSION;
+/**
+ * One artifact per verification run (one PR head SHA → one row).
+ *
+ * Produced by both the GitHub App (post-PR, in `api/src/verification/`) and
+ * the CLI (pre-PR, in `packages/cli` via the future `foyer review` command).
+ * The hosted report at app.getfoyer.dev renders this shape directly.
+ *
+ * Partner-visible fields are public. Admin-only fields (see
+ * `AdminAttribution`) are captured unconditionally for abuse detection and
+ * reviewer-model independence enforcement, but the render layer redacts
+ * them from any UI a partner sees — surfaced only to staff Supabase roles.
+ */
+export interface RunArtifact {
+    schemaVersion: SchemaVersion;
+    /** Stable run identifier; format is opaque to consumers. */
+    runId: string;
+    /** Repository + commit state the run executed against. */
+    repo: RepoMeta;
+    /** Overall verdict — drives the headline copy in CLI output and PR comments. */
+    verdict: Verdict;
+    /**
+     * Wall-clock timestamps in ISO-8601 / UTC. `startedAt` is set when the
+     * run is dequeued; `completedAt` is set at terminal status.
+     */
+    startedAt: string;
+    completedAt?: string;
+    /**
+     * Optional plan-review pass (Phase 3 of the CLI MVP). When present, this
+     * is the agent-supervisor gate — checks that a human-approved plan is
+     * coherent against repo context before the agent implements. Absent on
+     * implementation-only runs (GitHub App post-PR, CLI `foyer review` without
+     * an attached plan).
+     */
+    planReview?: PlanReview;
+    /**
+     * The implementation-review pass — runs every signal against the diff.
+     * Always present on a completed run.
+     */
+    implementationReview: ImplementationReview;
+    /** Origin of the run — which client emitted this artifact. */
+    origin: RunOrigin;
+    /** Hosted-report metadata (if uploaded). */
+    report?: ReportMeta;
+    /**
+     * Admin-only attribution. Captured unconditionally. The render layer
+     * MUST redact this from any partner-facing surface; surfaced only to
+     * staff Supabase roles / `/admin` routes. See `AdminAttribution`.
+     */
+    adminAttribution: AdminAttribution;
+}
+export interface RepoMeta {
+    /** Internal Foyer repo id (links to `repos` table). */
+    repoId: string;
+    /** Canonical clone URL. */
+    url: string;
+    /** Default branch, used when computing the diff base. */
+    defaultBranch: string;
+    /** Branch the run was triggered against. */
+    branch?: string;
+    /** Merge-base commit SHA. */
+    baseSha: string;
+    /** Head commit SHA the run executed against. */
+    headSha: string;
+    /** PR number when the run was triggered from a PR webhook. */
+    prNumber?: number;
+}
+/**
+ * Headline verdict for the run.
+ *
+ *  - 'clean'        — all signals passed (or unavailable + no failures).
+ *  - 'warnings'     — at least one signal warned, no failures.
+ *  - 'blocked'      — at least one signal failed; merging is risky.
+ *  - 'needs_human'  — signals couldn't be evaluated and a human judgment
+ *                    call is required (e.g., intent text is ambiguous).
+ *  - 'stale'        — head SHA moved after the run produced this artifact;
+ *                    the artifact remains useful for history but should not
+ *                    drive merge decisions.
+ */
+export type Verdict = 'clean' | 'warnings' | 'blocked' | 'needs_human' | 'stale';
+/**
+ * Which client wrote this artifact. Future-proofs the schema for additional
+ * surfaces (e.g., CI-runner direct upload) without bumping schemaVersion.
+ */
+export type RunOrigin = 'github_app' | 'cli' | 'eval_script' | 'mcp_tool';
+export interface ImplementationReview {
+    /** Per-signal results. One entry per `SignalKey` that ran. */
+    signals: SignalResult[];
+    /**
+     * Files changed in the diff between baseSha and headSha. Path is repo-
+     * relative, posix-style.
+     */
+    changedFiles: ChangedFile[];
+    /**
+     * Symbol-level changes when AST analysis succeeded. Empty when the
+     * languages in the diff aren't supported (currently TypeScript /
+     * JavaScript only).
+     */
+    changedSymbols: ChangedSymbol[];
+    /** Risk-area classifications applied to the diff. */
+    riskAreas: RiskArea[];
+    /** Aggregated findings across all signals (de-duped for renderer use). */
+    findings: Finding[];
+    /**
+     * Diff narrative — a plain-English summary of what the diff does. Drives
+     * non-technical audience rendering. Optional; absent on tiny / structural
+     * diffs where the narrative would be noise.
+     */
+    narrative?: string;
+}
+export interface ChangedFile {
+    /** Repo-relative posix path. */
+    path: string;
+    /** Lines added / removed in this file relative to baseSha. */
+    added: number;
+    removed: number;
+    /**
+     * Optional language tag from tree-sitter / detection. Absent when
+     * detection failed or the file type isn't supported.
+     */
+    language?: string;
+}
+export interface ChangedSymbol {
+    /** Repo-relative posix path of the file the symbol lives in. */
+    file: string;
+    /** Symbol kind. */
+    kind: 'function' | 'method' | 'class' | 'interface' | 'type' | 'enum' | 'variable' | 'export' | 'import';
+    /** Fully-qualified name within the file (e.g., 'ClassName.methodName'). */
+    name: string;
+    /** What happened to this symbol in the diff. */
+    change: 'added' | 'modified' | 'removed';
+}
+/**
+ * Risk-area tags assigned to changed files. Drives reviewer prompt
+ * structuring (e.g., auth-touching diffs get a tighter review pass).
+ */
+export type RiskArea = 'auth' | 'session' | 'permissions' | 'billing' | 'payments' | 'db_schema' | 'db_migration' | 'queues' | 'background_jobs' | 'external_provider' | 'env_config' | 'api_routes' | 'api_contracts' | 'data_deletion' | 'destructive_update' | 'large_deletion' | 'tests_only' | 'generated_files';
+/**
+ * The set of signals Foyer evaluates. Stable identifiers — renderers
+ * branch on these strings.
+ */
+export type SignalKey = 'intent_fidelity' | 'plan_fidelity' | 'code_review' | 'tests_build' | 'deploy_build' | 'security' | 'browser_smoke' | 'dead_code' | 'hallucinated_api' | 'template_cruft' | 'dependency_hygiene';
+/**
+ * Status of a single signal. `unavailable` is a real value — emitted when
+ * the runner couldn't evaluate (e.g., no CI for `deploy_build`, language
+ * not supported for `dead_code`). Never absent: every signal that ran
+ * has a status.
+ */
+export type SignalStatus = 'passed' | 'warning' | 'failed' | 'unavailable';
+export interface SignalResult {
+    key: SignalKey;
+    status: SignalStatus;
+    /** Technical summary (always present). */
+    summary: string;
+    /**
+     * Plain-English counterpart to `summary`. Populated by LLM-backed
+     * runners when the partner's audience is non-technical. Renderer picks
+     * this when the audience flag warrants; repair packets always use the
+     * technical `summary`.
+     */
+    audienceSummary?: string;
+    evidence: Evidence[];
+    /** Optional routing hint shown under the signal row in the PR comment. */
+    routingHint?: string;
+    /**
+     * Cross-agent repair packet for `failed` signals. The CLI surfaces this
+     * via `get_blockers` MCP tool; the PR comment renders it inline.
+     */
+    repairPacket?: RepairPacket;
+}
+export interface Evidence {
+    kind: 'log' | 'screenshot' | 'command' | 'diff' | 'repro';
+    /** Technical label. */
+    label: string;
+    /** Plain-English counterpart to `label` for non-technical audiences. */
+    audienceLabel?: string;
+    /**
+     * For inline evidence: the value itself (truncated). For separate-table
+     * evidence: the storage URL or row id reference. Renderer treats both
+     * the same way.
+     */
+    value: string;
+    /** Severity tag for findings that have one. */
+    severity?: 'P1' | 'P2' | 'P3';
+    /** Repo-relative posix path when the evidence is file-anchored. */
+    file?: string;
+    /** Line number (1-indexed) when the evidence is line-anchored. */
+    line?: number;
+    /** Reviewer confidence in this finding (1-10). */
+    confidence?: number;
+    /** Reviewer rationale (technical voice). */
+    rationale?: string;
+    /** Plain-English counterpart to `rationale`. */
+    audienceRationale?: string;
+    /** For requirement-style evidence (intent_fidelity rows): satisfied or not. */
+    met?: boolean;
+}
+/**
+ * A finding is a renderer-ready item lifted out of `Evidence`. The
+ * implementation-review aggregator de-dupes across signals so the same
+ * code issue surfaces once in the PR comment / hosted report.
+ */
+export interface Finding {
+    /** Stable id within this run (e.g., 'F001'). */
+    id: string;
+    severity: 'blocker' | 'warning' | 'info';
+    /** Originating signal that emitted the underlying evidence. */
+    signalKey: SignalKey;
+    /** Repo-relative posix path. */
+    file?: string;
+    line?: number;
+    /** Human-readable problem description. */
+    problem: string;
+    /** Evidence backing the finding (excerpts, links). */
+    evidence?: string;
+    /** Concrete change required to clear the finding. */
+    requiredChange?: string;
+    /** How to verify the fix landed. */
+    verification?: string;
+    /** Reviewer confidence (1-10). */
+    confidence?: number;
+}
+export interface Intent {
+    source: 'linear_issue' | 'github_issue' | 'pr_body' | 'pasted_spec' | 'plan_artifact';
+    confidence: 'high' | 'medium';
+    text: string;
+    /**
+     * Atomic verifiable claims extracted from `text`. Each claim is scored
+     * independently by intent_fidelity, not `text` as a whole.
+     * Imperative voice, one claim per string.
+     */
+    requirements: string[];
+    /** Source-specific metadata. */
+    sourceId?: string;
+    sourceUrl?: string;
+}
+/**
+ * Repair packet keyed to the partner's coding agent. The CLI MVP's
+ * Phase 2 MCP `get_blockers` tool inlines these. The PR comment renders
+ * them as markdown sections.
+ */
+export interface RepairPacket {
+    agent: 'claude-code' | 'codex' | 'cursor' | 'windsurf' | 'generic';
+    /** Agent-ready prompt. May include code-fence blocks, file paths, etc. */
+    prompt: string;
+    /** Free-form context the renderer may pass through to the agent. */
+    context: Record<string, unknown>;
+}
+/**
+ * Output of a plan-review pass. Stored alongside the implementation review
+ * so the eventual diff can be checked against the approved plan
+ * (plan_fidelity).
+ */
+export interface PlanReview {
+    verdict: 'approved' | 'approved_with_warnings' | 'needs_revision' | 'blocked';
+    /** Files the plan said it would touch. */
+    approvedScope: string[];
+    /** Symbols the plan said it would introduce or modify. */
+    expectedSymbols: string[];
+    /** Nearby context the implementation should respect (files / modules). */
+    relatedContext: string[];
+    /** Tests the plan expects to update or add. */
+    requiredTests: string[];
+    /** Out-of-scope items the implementation must NOT touch. */
+    nonGoals: string[];
+    /** Risk areas implicated by the planned changes. */
+    riskAreas: RiskArea[];
+    /** Findings against the plan itself (missing tests, wrong abstraction). */
+    findings: Finding[];
+}
+export interface ReportMeta {
+    /** Whether the artifact was uploaded to the hosted report renderer. */
+    uploaded: boolean;
+    /** Public URL for the hosted report. Present iff uploaded. */
+    url?: string;
+    /**
+     * Whether raw source snippets are included in the upload. Default false
+     * per the privacy policy; opt-in via `--include-source-snippets`.
+     */
+    includesSourceSnippets?: boolean;
+    /** Whether the diff itself was uploaded. Always true when uploaded=true. */
+    includesDiff?: boolean;
+}
+/**
+ * Internal-only attribution for every LLM call made during the run.
+ *
+ * CAPTURED UNCONDITIONALLY for:
+ *   - abuse / cost-overrun forensics
+ *   - reviewer-model independence enforcement (the reviewer must differ
+ *     from whatever model the partner's coding agent used)
+ *   - per-call cost attribution against `prVerifications.cost_usd`
+ *
+ * NOT VISIBLE TO PARTNERS. The render layer (PR comment writer, hosted
+ * report, CLI output) must redact this entire object. Surfaced only to
+ * staff Supabase roles via `/admin` routes.
+ */
+export interface AdminAttribution {
+    /** Per-LLM-call attribution. One entry per call made during the run. */
+    calls: LLMCallAttribution[];
+    /** Aggregated totals across all calls in this run. */
+    totals: UsageTotals;
+}
+export interface LLMCallAttribution {
+    /** Stable id for this call within the run. Format opaque. */
+    callId: string;
+    /** Model name as reported by the provider (e.g., 'claude-sonnet-4-6'). */
+    model: string;
+    /**
+     * Stable hash of model + provider config, used to detect drift. Useful
+     * when prompts span model versions or when a partner declares their
+     * coding agent's model and we want to confirm reviewer independence.
+     */
+    modelHash: string;
+    /** Which stage of the run made this call. */
+    stage: 'intent_extract' | 'intent_judge' | 'code_review' | 'plan_fidelity' | 'diff_narrative' | 'repair_packet' | 'audience_voice' | 'other';
+    usage: TokenUsage;
+    /** Wall-clock duration of this call in milliseconds. */
+    durationMs?: number;
+}
+export interface TokenUsage {
+    tokensIn: number;
+    tokensOut: number;
+    /** Anthropic-style cache write tokens. */
+    cacheCreation?: number;
+    /** Anthropic-style cache read tokens. */
+    cacheRead?: number;
+    /** USD cost computed from per-model pricing. */
+    costCents: number;
+}
+export interface UsageTotals {
+    tokensIn: number;
+    tokensOut: number;
+    cacheCreation: number;
+    cacheRead: number;
+    /** Sum across all `calls[].usage.costCents`. */
+    costCents: number;
+    /** Number of LLM calls in this run. */
+    callCount: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,uDAAuD;AACvD,eAAO,MAAM,cAAc,EAAG,KAAc,CAAC;AAC7C,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC;AAMlD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,aAAa,CAAC;IAE7B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IAEd,0DAA0D;IAC1D,IAAI,EAAE,QAAQ,CAAC;IAEf,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;;OAGG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;IAE3C,8DAA8D;IAC9D,MAAM,EAAE,SAAS,CAAC;IAElB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,UAAU,CAAC;IAEpB;;;;OAIG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;CACpC;AAMD,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,OAAO,GACf,OAAO,GACP,UAAU,GACV,SAAS,GACT,aAAa,GACb,OAAO,CAAC;AAMZ;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,YAAY,GACZ,KAAK,GACL,aAAa,GACb,UAAU,CAAC;AAMf,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,OAAO,EAAE,YAAY,EAAE,CAAC;IAExB;;;OAGG;IACH,YAAY,EAAE,WAAW,EAAE,CAAC;IAE5B;;;;OAIG;IACH,cAAc,EAAE,aAAa,EAAE,CAAC;IAEhC,qDAAqD;IACrD,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEtB,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,EAAE,CAAC;IAEpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,IAAI,EACA,UAAU,GACV,QAAQ,GACR,OAAO,GACP,WAAW,GACX,MAAM,GACN,MAAM,GACN,UAAU,GACV,QAAQ,GACR,QAAQ,CAAC;IACb,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,SAAS,GACT,aAAa,GACb,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,QAAQ,GACR,iBAAiB,GACjB,mBAAmB,GACnB,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,iBAAiB,CAAC;AAMtB;;;GAGG;AACH,MAAM,MAAM,SAAS,GACjB,iBAAiB,GACjB,eAAe,GACf,aAAa,GACb,aAAa,GACb,cAAc,GACd,UAAU,GACV,eAAe,GACf,WAAW,GACX,kBAAkB,GAClB,gBAAgB,GAChB,oBAAoB,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE3E,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IAC1D,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAC9B,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAMD;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IACzC,+DAA+D;IAC/D,SAAS,EAAE,SAAS,CAAC;IACrB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,MAAM;IACrB,MAAM,EACF,cAAc,GACd,cAAc,GACd,SAAS,GACT,aAAa,GACb,eAAe,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACnE,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAMD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EACH,UAAU,GACV,wBAAwB,GACxB,gBAAgB,GAChB,SAAS,CAAC;IACd,0CAA0C;IAC1C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oDAAoD;IACpD,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAMD,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,sDAAsD;IACtD,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EACD,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,gBAAgB,GAChB,OAAO,CAAC;IACZ,KAAK,EAAE,UAAU,CAAC;IAClB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types.js

@@ -0,0 +1,24 @@
+/**
+ * RunArtifact v0.1 — the frozen contract for a single Foyer verification run.
+ *
+ * This file is the cross-cutting schema written by the GitHub App, written
+ * by the CLI's `foyer review`, rendered by the hosted report, and consumed
+ * by future PR-comment writers. It is intentionally separate from the
+ * implementation-internal types in `api/src/verification/types.ts` so the
+ * public shape can evolve under semver while internal modules iterate.
+ *
+ * Stability contract:
+ *   - schemaVersion is "0.1". Breaking changes require a version bump.
+ *   - Adding new optional fields is a minor change (no version bump).
+ *   - Removing or renaming fields, or changing semantics of existing
+ *     fields, requires bumping schemaVersion AND maintaining a reader
+ *     for the prior version for one release cycle.
+ *
+ * No runtime code lives here. No I/O, no dependencies. Pure types.
+ */
+// ---------------------------------------------------------------------------
+// Schema version
+// ---------------------------------------------------------------------------
+/** Frozen schema version. Bump on breaking changes. */
+export const SCHEMA_VERSION = '0.1';
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,KAAc,CAAC"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@getfoyer/review-core",
+  "version": "0.1.0",
+  "description": "Frozen contract for Foyer run artifacts (RunArtifact v0.1) — the shared shape consumed by the GitHub App, the CLI, the hosted report, and PR-comment writers.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js"
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.js.map",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "typescript": "^5.5.0"
+  }
+}