@owasp-aghast/aghast 0.8.0-beta.0

package/dist/cost-calculator.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Cost calculator: maps token usage to estimated USD cost using per-model pricing.
+ *
+ * Pricing is loaded from `config/pricing.json` (built-in defaults) and may be
+ * overridden via the runtime config `pricing` section. Prices change over time
+ * and are not authoritative — they are estimates for budgeting/dashboarding.
+ */
+import type { TokenUsage } from './types.js';
+/** Per-million-token rates for a single model. */
+export interface ModelPricing {
+    inputPerMillion: number;
+    outputPerMillion: number;
+    cacheReadPerMillion?: number;
+    cacheWritePerMillion?: number;
+}
+/** Pricing config (default file or runtime override). */
+export interface PricingConfig {
+    currency?: string;
+    models: Record<string, ModelPricing>;
+}
+/** Computed cost for a single token-usage record. */
+export interface CostBreakdown {
+    inputCost: number;
+    outputCost: number;
+    cacheReadCost?: number;
+    cacheWriteCost?: number;
+    totalCost: number;
+    currency: string;
+    /** How the cost was determined. */
+    source: 'reported' | 'estimated' | 'estimated-unpriced' | 'legacy';
+    /** When source === 'reported', which provider reported it. */
+    reportedBy?: 'claude-agent-sdk' | 'opencode';
+    /** true when running with AGHAST_LOCAL_CLAUDE=true — amount is API-equivalent, not billed */
+    coveredBySubscription?: boolean;
+}
+/**
+ * Calculate cost for a TokenUsage value.
+ *
+ * Priority:
+ *   1. tokens.reportedCost — provider-reported amount used verbatim (source='reported').
+ *   2. Rate-table fallback — model must exist in pricing.models; includes cache and
+ *      reasoning tokens. Reasoning is billed at output rate (Decision 5).
+ *   3. Rate-table fallback but model unknown → source='estimated-unpriced', cost=$0 + warning.
+ *   4. tokens undefined → source='estimated', cost=$0.
+ */
+export declare function calculateCost(tokens: TokenUsage | undefined, model: string, pricing: PricingConfig): CostBreakdown;
+/**
+ * Sum a list of CostBreakdowns into one total. Returns zeros if list is empty.
+ * Currency is taken from the first non-empty entry (or USD by default).
+ */
+export declare function sumCosts(costs: CostBreakdown[]): CostBreakdown;
+/**
+ * Load the built-in pricing.json shipped with aghast.
+ *
+ * Behaviour:
+ *   - File missing (ENOENT): return empty pricing silently. This is expected
+ *     when running from a build that doesn't ship the file.
+ *   - File present but unreadable / invalid JSON / wrong shape: log a warning
+ *     and return empty pricing so the scan can still run. The empty pricing
+ *     means cost is reported as 0 — distinct from a corrupt pricing file
+ *     producing meaningless costs.
+ */
+export declare function loadDefaultPricing(): Promise<PricingConfig>;
+/**
+ * Merge a runtime-config override into a base pricing config.
+ * Per-model entries from the override replace those in the base. Unspecified
+ * models are inherited from the base.
+ */
+export declare function mergePricing(base: PricingConfig, override?: Partial<PricingConfig>): PricingConfig;
+/**
+ * Format a cost as a fixed-precision string with currency suffix.
+ * Used for CLI summaries.
+ */
+export declare function formatCost(cost: number, currency?: string): string;
+/**
+ * Map a CostBreakdown source (and optional reportedBy) to a human-readable
+ * label for banner / stats / JSON output.
+ */
+export declare function formatCostSourceLabel(source: CostBreakdown['source'] | undefined, reportedBy?: CostBreakdown['reportedBy'], coveredBySubscription?: boolean): string;
+//# sourceMappingURL=cost-calculator.d.ts.map

package/dist/cost-calculator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-calculator.d.ts","sourceRoot":"","sources":["../src/cost-calculator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM7C,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACtC;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IACnE,8DAA8D;IAC9D,UAAU,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAAC;IAC7C,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAID;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GACrB,aAAa,CA+Cf;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,aAAa,CA8C9D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC,CA8CjE;AA4BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAMlG;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,MAAM,CAGpF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,SAAS,EAC3C,UAAU,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,EACxC,qBAAqB,CAAC,EAAE,OAAO,GAC9B,MAAM,CASR"}

package/dist/cost-calculator.js

@@ -0,0 +1,226 @@
+/**
+ * Cost calculator: maps token usage to estimated USD cost using per-model pricing.
+ *
+ * Pricing is loaded from `config/pricing.json` (built-in defaults) and may be
+ * overridden via the runtime config `pricing` section. Prices change over time
+ * and are not authoritative — they are estimates for budgeting/dashboarding.
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { logWarn } from './logging.js';
+const TAG = 'pricing';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_CURRENCY = 'USD';
+/**
+ * Calculate cost for a TokenUsage value.
+ *
+ * Priority:
+ *   1. tokens.reportedCost — provider-reported amount used verbatim (source='reported').
+ *   2. Rate-table fallback — model must exist in pricing.models; includes cache and
+ *      reasoning tokens. Reasoning is billed at output rate (Decision 5).
+ *   3. Rate-table fallback but model unknown → source='estimated-unpriced', cost=$0 + warning.
+ *   4. tokens undefined → source='estimated', cost=$0.
+ */
+export function calculateCost(tokens, model, pricing) {
+    const currency = pricing.currency ?? DEFAULT_CURRENCY;
+    if (tokens?.reportedCost !== undefined) {
+        return {
+            inputCost: 0,
+            outputCost: 0,
+            totalCost: tokens.reportedCost.amountUsd,
+            currency,
+            source: 'reported',
+            reportedBy: tokens.reportedCost.source,
+            ...(tokens.reportedCost.coveredBySubscription ? { coveredBySubscription: true } : {}),
+        };
+    }
+    if (!tokens) {
+        return { inputCost: 0, outputCost: 0, totalCost: 0, currency, source: 'estimated' };
+    }
+    const rates = pricing.models[model];
+    if (!rates) {
+        logWarn(TAG, `Model "${model}" not in pricing table; cost reported as $0`);
+        return { inputCost: 0, outputCost: 0, totalCost: 0, currency, source: 'estimated-unpriced' };
+    }
+    // Reasoning tokens billed at output rate (Decision 5).
+    const billableOutputTokens = tokens.outputTokens + (tokens.reasoningTokens ?? 0);
+    const inputCost = (tokens.inputTokens / 1_000_000) * rates.inputPerMillion;
+    const outputCost = (billableOutputTokens / 1_000_000) * rates.outputPerMillion;
+    const cacheReadCost = rates.cacheReadPerMillion !== undefined && tokens.cacheReadInputTokens !== undefined
+        ? (tokens.cacheReadInputTokens / 1_000_000) * rates.cacheReadPerMillion
+        : undefined;
+    const cacheWriteCost = rates.cacheWritePerMillion !== undefined && tokens.cacheCreationInputTokens !== undefined
+        ? (tokens.cacheCreationInputTokens / 1_000_000) * rates.cacheWritePerMillion
+        : undefined;
+    return {
+        inputCost,
+        outputCost,
+        cacheReadCost,
+        cacheWriteCost,
+        totalCost: inputCost + outputCost + (cacheReadCost ?? 0) + (cacheWriteCost ?? 0),
+        currency,
+        source: 'estimated',
+    };
+}
+/**
+ * Sum a list of CostBreakdowns into one total. Returns zeros if list is empty.
+ * Currency is taken from the first non-empty entry (or USD by default).
+ */
+export function sumCosts(costs) {
+    if (costs.length === 0) {
+        return { inputCost: 0, outputCost: 0, totalCost: 0, currency: DEFAULT_CURRENCY, source: 'estimated' };
+    }
+    let inputCost = 0;
+    let outputCost = 0;
+    let cacheReadCost = 0;
+    let cacheWriteCost = 0;
+    // totalCost must be accumulated directly from each entry rather than derived as
+    // inputCost+outputCost at the end. Two reasons:
+    //   1. For 'reported' breakdowns, calculateCost returns inputCost=0/outputCost=0
+    //      with the full amount in totalCost — deriving from the sub-fields drops it.
+    //   2. For 'estimated' breakdowns, totalCost includes cache costs (cacheReadCost,
+    //      cacheWriteCost) that are not reflected in inputCost or outputCost.
+    let totalCost = 0;
+    for (const c of costs) {
+        inputCost += c.inputCost;
+        outputCost += c.outputCost;
+        cacheReadCost += c.cacheReadCost ?? 0;
+        cacheWriteCost += c.cacheWriteCost ?? 0;
+        totalCost += c.totalCost;
+    }
+    // Pick the most authoritative source across all summands.
+    // Precedence: reported > estimated > estimated-unpriced > legacy.
+    const SOURCE_PRIORITY = {
+        reported: 3,
+        estimated: 2,
+        'estimated-unpriced': 1,
+        legacy: 0,
+    };
+    const dominant = costs.reduce((best, c) => SOURCE_PRIORITY[c.source] > SOURCE_PRIORITY[best.source] ? c : best);
+    // coveredBySubscription is true only when ALL summands are covered.
+    const allCovered = costs.every((c) => c.coveredBySubscription === true);
+    return {
+        inputCost,
+        outputCost,
+        ...(cacheReadCost > 0 ? { cacheReadCost } : {}),
+        ...(cacheWriteCost > 0 ? { cacheWriteCost } : {}),
+        totalCost,
+        currency: costs[0].currency,
+        source: dominant.source,
+        reportedBy: dominant.reportedBy,
+        ...(allCovered ? { coveredBySubscription: true } : {}),
+    };
+}
+/**
+ * Load the built-in pricing.json shipped with aghast.
+ *
+ * Behaviour:
+ *   - File missing (ENOENT): return empty pricing silently. This is expected
+ *     when running from a build that doesn't ship the file.
+ *   - File present but unreadable / invalid JSON / wrong shape: log a warning
+ *     and return empty pricing so the scan can still run. The empty pricing
+ *     means cost is reported as 0 — distinct from a corrupt pricing file
+ *     producing meaningless costs.
+ */
+export async function loadDefaultPricing() {
+    // src/cost-calculator.ts -> ../config/pricing.json
+    const pricingPath = resolve(__dirname, '..', 'config', 'pricing.json');
+    let content;
+    try {
+        content = await readFile(pricingPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            logWarn(TAG, `Could not read pricing file at ${pricingPath} (${err instanceof Error ? err.message : String(err)}); cost estimates will be 0.`);
+        }
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (err) {
+        logWarn(TAG, `Pricing file at ${pricingPath} contains invalid JSON (${err instanceof Error ? err.message : String(err)}); cost estimates will be 0.`);
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+    // JSON parsed, but the shape may still be wrong (e.g., null, an array, or a
+    // bare string). Normalize defensively and report shape errors with a
+    // distinct message so the user knows it's not a JSON-syntax problem.
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        logWarn(TAG, `Pricing file at ${pricingPath} did not contain a JSON object; cost estimates will be 0.`);
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+    try {
+        return normalizePricing(parsed);
+    }
+    catch (err) {
+        logWarn(TAG, `Pricing file at ${pricingPath} could not be parsed as a pricing config (${err instanceof Error ? err.message : String(err)}); cost estimates will be 0.`);
+        return { currency: DEFAULT_CURRENCY, models: {} };
+    }
+}
+/**
+ * Normalize a raw object into a PricingConfig, dropping unknown keys.
+ * Tolerant of extra fields (e.g. `_comment`).
+ */
+function normalizePricing(raw) {
+    const currency = typeof raw.currency === 'string' ? raw.currency : DEFAULT_CURRENCY;
+    const models = {};
+    const rawModels = raw.models;
+    if (rawModels && typeof rawModels === 'object' && !Array.isArray(rawModels)) {
+        for (const [name, def] of Object.entries(rawModels)) {
+            if (def && typeof def === 'object' && !Array.isArray(def)) {
+                const d = def;
+                if (typeof d.inputPerMillion === 'number' && typeof d.outputPerMillion === 'number') {
+                    models[name] = {
+                        inputPerMillion: d.inputPerMillion,
+                        outputPerMillion: d.outputPerMillion,
+                        ...(typeof d.cacheReadPerMillion === 'number' ? { cacheReadPerMillion: d.cacheReadPerMillion } : {}),
+                        ...(typeof d.cacheWritePerMillion === 'number' ? { cacheWritePerMillion: d.cacheWritePerMillion } : {}),
+                    };
+                }
+            }
+        }
+    }
+    return { currency, models };
+}
+/**
+ * Merge a runtime-config override into a base pricing config.
+ * Per-model entries from the override replace those in the base. Unspecified
+ * models are inherited from the base.
+ */
+export function mergePricing(base, override) {
+    if (!override)
+        return base;
+    return {
+        currency: override.currency ?? base.currency ?? DEFAULT_CURRENCY,
+        models: { ...base.models, ...(override.models ?? {}) },
+    };
+}
+/**
+ * Format a cost as a fixed-precision string with currency suffix.
+ * Used for CLI summaries.
+ */
+export function formatCost(cost, currency = DEFAULT_CURRENCY) {
+    // 4 decimal places preserves sub-cent precision for individual checks.
+    return `${cost.toFixed(4)} ${currency}`;
+}
+/**
+ * Map a CostBreakdown source (and optional reportedBy) to a human-readable
+ * label for banner / stats / JSON output.
+ */
+export function formatCostSourceLabel(source, reportedBy, coveredBySubscription) {
+    if (source === 'reported') {
+        if (coveredBySubscription)
+            return '(covered by subscription — claude-agent-sdk)';
+        if (reportedBy === 'opencode')
+            return '(reported by opencode — see docs/cost-tracking.md)';
+        return '(reported by claude-agent-sdk)';
+    }
+    if (source === 'estimated-unpriced')
+        return '(estimated — model not in pricing table)';
+    if (source === 'legacy')
+        return '(legacy estimate)';
+    return '(estimated from config/pricing.json)';
+}
+//# sourceMappingURL=cost-calculator.js.map

package/dist/cost-calculator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-calculator.js","sourceRoot":"","sources":["../src/cost-calculator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,MAAM,GAAG,GAAG,SAAS,CAAC;AAEtB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAgC1D,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA8B,EAC9B,KAAa,EACb,OAAsB;IAEtB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IAEtD,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO;YACL,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS;YACxC,QAAQ;YACR,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM;YACtC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,EAAE,UAAU,KAAK,6CAA6C,CAAC,CAAC;QAC3E,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/F,CAAC;IAED,uDAAuD;IACvD,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;IAC3E,MAAM,UAAU,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC/E,MAAM,aAAa,GACjB,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS;QAClF,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,mBAAmB;QACvE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,cAAc,GAClB,KAAK,CAAC,oBAAoB,KAAK,SAAS,IAAI,MAAM,CAAC,wBAAwB,KAAK,SAAS;QACvF,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,oBAAoB;QAC5E,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,SAAS;QACT,UAAU;QACV,aAAa;QACb,cAAc;QACd,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC;QAChF,QAAQ;QACR,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAsB;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,gFAAgF;IAChF,gDAAgD;IAChD,iFAAiF;IACjF,kFAAkF;IAClF,kFAAkF;IAClF,0EAA0E;IAC1E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;QACzB,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC;QAC3B,aAAa,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;QACtC,cAAc,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC;QACxC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,0DAA0D;IAC1D,kEAAkE;IAClE,MAAM,eAAe,GAA4C;QAC/D,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,oBAAoB,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACxC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACpE,CAAC;IACF,oEAAoE;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC;IACxE,OAAO;QACL,SAAS;QACT,UAAU;QACV,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,mDAAmD;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,CACL,GAAG,EACH,kCAAkC,WAAW,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CACjI,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,GAAG,EACH,mBAAmB,WAAW,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CACxI,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,CACL,GAAG,EACH,mBAAmB,WAAW,2DAA2D,CAC1F,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAiC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,GAAG,EACH,mBAAmB,WAAW,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAC1J,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAA4B;IACpD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACpF,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7B,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;YAC/E,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;oBACpF,MAAM,CAAC,IAAI,CAAC,GAAG;wBACb,eAAe,EAAE,CAAC,CAAC,eAAe;wBAClC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;wBACpC,GAAG,CAAC,OAAO,CAAC,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpG,GAAG,CAAC,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxG,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB,EAAE,QAAiC;IACjF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,gBAAgB;QAChE,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAAmB,gBAAgB;IAC1E,uEAAuE;IACvE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA2C,EAC3C,UAAwC,EACxC,qBAA+B;IAE/B,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,qBAAqB;YAAE,OAAO,8CAA8C,CAAC;QACjF,IAAI,UAAU,KAAK,UAAU;YAAE,OAAO,oDAAoD,CAAC;QAC3F,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,KAAK,oBAAoB;QAAE,OAAO,0CAA0C,CAAC;IACvF,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC;IACpD,OAAO,sCAAsC,CAAC;AAChD,CAAC"}

package/dist/defaults.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Central registry of scanner defaults used when a value is absent from CLI flags,
+ * environment variables, and runtime-config.json.
+ *
+ * These are surfaced to users by `aghast build-config`, and applied at runtime by
+ * the scanner. Single source of truth — do not duplicate these literals elsewhere.
+ *
+ * (Provider and model defaults live alongside their respective registries:
+ *  `DEFAULT_PROVIDER_NAME` in `provider-registry.ts`, `DEFAULT_MODEL` in `types.ts`.)
+ */
+/** Default output format for scan reports. */
+export declare const DEFAULT_OUTPUT_FORMAT = "json";
+/** Default console log level when none is specified. */
+export declare const DEFAULT_LOG_LEVEL = "info";
+/** Default log file handler type when --log-file is set without --log-type. */
+export declare const DEFAULT_LOG_TYPE = "file";
+/** Default generic prompt template filename prepended to check instructions. */
+export declare const DEFAULT_GENERIC_PROMPT = "generic-instructions.md";
+/** Default for whether the scan should exit non-zero on FAIL/ERROR results. */
+export declare const DEFAULT_FAIL_ON_CHECK_FAILURE = false;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,6BAA6B,QAAQ,CAAC"}

package/dist/defaults.js

@@ -0,0 +1,21 @@
+/**
+ * Central registry of scanner defaults used when a value is absent from CLI flags,
+ * environment variables, and runtime-config.json.
+ *
+ * These are surfaced to users by `aghast build-config`, and applied at runtime by
+ * the scanner. Single source of truth — do not duplicate these literals elsewhere.
+ *
+ * (Provider and model defaults live alongside their respective registries:
+ *  `DEFAULT_PROVIDER_NAME` in `provider-registry.ts`, `DEFAULT_MODEL` in `types.ts`.)
+ */
+/** Default output format for scan reports. */
+export const DEFAULT_OUTPUT_FORMAT = 'json';
+/** Default console log level when none is specified. */
+export const DEFAULT_LOG_LEVEL = 'info';
+/** Default log file handler type when --log-file is set without --log-type. */
+export const DEFAULT_LOG_TYPE = 'file';
+/** Default generic prompt template filename prepended to check instructions. */
+export const DEFAULT_GENERIC_PROMPT = 'generic-instructions.md';
+/** Default for whether the scan should exit non-zero on FAIL/ERROR results. */
+export const DEFAULT_FAIL_ON_CHECK_FAILURE = false;
+//# sourceMappingURL=defaults.js.map

package/dist/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC"}

package/dist/diff-filter.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Diff filter.
+ *
+ * Post-discovery transformation that narrows a set of DiscoveredTargets to
+ * those touching code changed in a git diff. Uses OpenAnt's call graph to
+ * widen scope to callers/callees of directly-changed units (flow adjacency).
+ *
+ * Applied by the scan runner when `checkTarget.diffFilter` is true on a
+ * discovery that opts in via `supportsDiffFilter`.
+ *
+ * Pipeline:
+ * 1. Resolve diff source (--diff-file > --diff-ref > check-level diffRef).
+ * 2. Parse diff into changed regions per file.
+ * 3. Run OpenAnt to get units + call graph.
+ * 4. Find touched units: direct overlap plus `diffFlowDepth` call-graph hops.
+ * 5. Filter the input targets to those inside a touched unit, OR in a file
+ *    with no OpenAnt coverage but present in the diff.
+ * 6. Reindex labels and append a note to each surviving target's prompt so
+ *    the AI knows this target was selected via diff scoping.
+ */
+import type { DiscoveredTarget } from './discovery.js';
+import type { OpenAntFilterConfig, SecurityCheck } from './types.js';
+export interface DiffFilterOptions {
+    /** Git ref to diff against (e.g. 'main', 'HEAD~1'). */
+    diffRef?: string;
+    /** Path to a pre-generated unified diff file. */
+    diffFile?: string;
+    /** Filter applied to OpenAnt units before touched-unit detection. */
+    openant?: OpenAntFilterConfig;
+    /**
+     * Preloaded OpenAnt dataset path. When provided, skip the internal
+     * runOpenAnt call and read from this path. Lets the scan runner share
+     * one OpenAnt invocation across discovery + diff filter.
+     */
+    openantDatasetPath?: string;
+    /**
+     * Run in depth-0 mode without OpenAnt. Targets are kept iff their file
+     * appears in the diff AND their line range overlaps a diff hunk.
+     * Call-graph adjacency (direct callers/callees of changed units) is
+     * not applied. Used as a graceful fallback when OpenAnt is unavailable.
+     */
+    depthZero?: boolean;
+}
+/**
+ * Apply diff filtering to a set of discovered targets.
+ * Returns the subset whose file/lines fall inside a diff-touched code unit
+ * (or in an uncovered file that appears in the diff).
+ */
+export declare function applyDiffFilter(check: SecurityCheck, targets: DiscoveredTarget[], repoPath: string, options: DiffFilterOptions): Promise<DiscoveredTarget[]>;
+//# sourceMappingURL=diff-filter.d.ts.map

package/dist/diff-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-filter.d.ts","sourceRoot":"","sources":["../src/diff-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAYH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIrE,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAaD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,gBAAgB,EAAE,EAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiF7B"}

package/dist/diff-filter.js

@@ -0,0 +1,130 @@
+/**
+ * Diff filter.
+ *
+ * Post-discovery transformation that narrows a set of DiscoveredTargets to
+ * those touching code changed in a git diff. Uses OpenAnt's call graph to
+ * widen scope to callers/callees of directly-changed units (flow adjacency).
+ *
+ * Applied by the scan runner when `checkTarget.diffFilter` is true on a
+ * discovery that opts in via `supportsDiffFilter`.
+ *
+ * Pipeline:
+ * 1. Resolve diff source (--diff-file > --diff-ref > check-level diffRef).
+ * 2. Parse diff into changed regions per file.
+ * 3. Run OpenAnt to get units + call graph.
+ * 4. Find touched units: direct overlap plus `diffFlowDepth` call-graph hops.
+ * 5. Filter the input targets to those inside a touched unit, OR in a file
+ *    with no OpenAnt coverage but present in the diff.
+ * 6. Reindex labels and append a note to each surviving target's prompt so
+ *    the AI knows this target was selected via diff scoping.
+ */
+import { parseDiff, getDiff, loadDiffFromFile } from './diff-parser.js';
+import { runOpenAnt } from './openant-runner.js';
+import { loadDatasetFromFile, filterUnits } from './openant-loader.js';
+import { findTouchedUnits, filterFindingsByScope, diffMapGet, rangesOverlap, } from './diff-unit-matcher.js';
+import { logProgress, logDebug } from './logging.js';
+const TAG = 'diff-filter';
+/**
+ * Call-graph hops applied when widening diff scope beyond directly-changed units.
+ * Depth 1 means "include direct callers and callees of changed units" — the sweet
+ * spot for security review (captures broken contracts in adjacent functions
+ * without the noise of chained fan-out). Not user-configurable.
+ */
+const DIFF_FLOW_DEPTH = 1;
+const DIFF_SCOPE_NOTE = '\n\nNote: this target was selected by diff filtering. It corresponds to code that was directly changed in the diff, or is in the immediate call-graph flow of a change. Focus your analysis on whether the change introduces or affects the vulnerability at this location.';
+/**
+ * Apply diff filtering to a set of discovered targets.
+ * Returns the subset whose file/lines fall inside a diff-touched code unit
+ * (or in an uncovered file that appears in the diff).
+ */
+export async function applyDiffFilter(check, targets, repoPath, options) {
+    logProgress(TAG, 'Parsing diff...');
+    const diffMap = await resolveDiff(check, repoPath, options);
+    if (diffMap.size === 0) {
+        logProgress(TAG, 'Diff is empty — no changed files, returning no targets');
+        return [];
+    }
+    logDebug(TAG, `Diff contains changes in ${diffMap.size} files`);
+    if (targets.length === 0) {
+        logDebug(TAG, 'No discovered targets to filter');
+        return [];
+    }
+    // Depth-0 fallback: skip OpenAnt entirely and filter by file/line overlap only.
+    // Invoked when OpenAnt is unavailable and the scan runner has opted in.
+    if (options.depthZero) {
+        const filtered = targets.filter((target) => {
+            const regions = diffMapGet(diffMap, target.file);
+            if (!regions)
+                return false;
+            return regions.some((r) => rangesOverlap(target.startLine, target.endLine, r.startLine, r.endLine));
+        });
+        logProgress(TAG, `Diff filter (depth-0, no call graph): ${targets.length} discovered targets → ${filtered.length} in diff scope`);
+        return filtered.map((target, idx) => ({
+            ...target,
+            label: relabel(target.label, idx, filtered.length),
+            promptEnrichment: (target.promptEnrichment ?? '') + DIFF_SCOPE_NOTE,
+        }));
+    }
+    // Use the preloaded dataset if the scan runner provided one; otherwise run
+    // OpenAnt ourselves (with cleanup responsibility).
+    let datasetPath;
+    let cleanup;
+    if (options.openantDatasetPath) {
+        logDebug(TAG, `Reusing preloaded OpenAnt dataset: ${options.openantDatasetPath}`);
+        datasetPath = options.openantDatasetPath;
+    }
+    else {
+        logProgress(TAG, 'Running OpenAnt for code unit discovery...');
+        ({ datasetPath, cleanup } = await runOpenAnt(repoPath));
+    }
+    try {
+        const dataset = await loadDatasetFromFile(datasetPath);
+        const allUnits = filterUnits(dataset.units, options.openant);
+        logDebug(TAG, `Loaded ${dataset.units.length} units (${allUnits.length} after filtering)`);
+        const directlyTouched = findTouchedUnits(allUnits, diffMap, 0);
+        const touchedUnits = findTouchedUnits(allUnits, diffMap, DIFF_FLOW_DEPTH);
+        const flowTouched = touchedUnits.length - directlyTouched.length;
+        logProgress(TAG, `Diff scope: ${directlyTouched.length} of ${allUnits.length} units directly changed` +
+            `${flowTouched > 0 ? `, ${flowTouched} more via call graph` : ''}` +
+            ` — ${touchedUnits.length} units in scope`);
+        const filtered = filterFindingsByScope(targets, touchedUnits, allUnits, diffMap);
+        logProgress(TAG, `Diff filter: ${targets.length} discovered targets → ${filtered.length} in diff scope`);
+        return filtered.map((target, idx) => ({
+            ...target,
+            label: relabel(target.label, idx, filtered.length),
+            promptEnrichment: (target.promptEnrichment ?? '') + DIFF_SCOPE_NOTE,
+        }));
+    }
+    finally {
+        if (cleanup) {
+            await cleanup();
+            logDebug(TAG, 'Cleaned up temporary OpenAnt output');
+        }
+    }
+}
+/**
+ * Produce a new label that keeps the original kind word ("target", "finding",
+ * "unit") but uses the post-filter indices. Falls back to "[target N/M]".
+ */
+function relabel(original, idx, total) {
+    const match = original.match(/^\[([a-zA-Z]+)\s/);
+    const kind = match ? match[1] : 'target';
+    return `[${kind} ${idx + 1}/${total}]`;
+}
+async function resolveDiff(check, repoPath, options) {
+    if (options.diffFile) {
+        logDebug(TAG, `Using diff file: ${options.diffFile}`);
+        const diffText = await loadDiffFromFile(options.diffFile);
+        return parseDiff(diffText);
+    }
+    const diffRef = options.diffRef ?? check.checkTarget?.diffRef;
+    if (diffRef) {
+        logDebug(TAG, `Running git diff against ref: ${diffRef}`);
+        const diffText = await getDiff(repoPath, diffRef);
+        return parseDiff(diffText);
+    }
+    // Unreachable in normal flow — the scan runner only calls applyDiffFilter
+    // when a diff source is available. Defensive guard for direct callers.
+    throw new Error(`applyDiffFilter called for check "${check.id}" with no diff source. This is a bug; the scan runner gates invocation on source availability.`);
+}
+//# sourceMappingURL=diff-filter.js.map

package/dist/diff-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-filter.js","sourceRoot":"","sources":["../src/diff-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,UAAU,EACV,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIrD,MAAM,GAAG,GAAG,aAAa,CAAC;AAwB1B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,eAAe,GACnB,6QAA6Q,CAAC;AAEhR;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoB,EACpB,OAA2B,EAC3B,QAAgB,EAChB,OAA0B;IAE1B,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,WAAW,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,4BAA4B,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;IAEhE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;QACjD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtG,CAAC,CAAC,CAAC;QAEH,WAAW,CACT,GAAG,EACH,yCAAyC,OAAO,CAAC,MAAM,yBAAyB,QAAQ,CAAC,MAAM,gBAAgB,CAChH,CAAC;QAEF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpC,GAAG,MAAM;YACT,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;YAClD,gBAAgB,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,eAAe;SACpE,CAAC,CAAC,CAAC;IACN,CAAC;IAED,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,WAAmB,CAAC;IACxB,IAAI,OAA0C,CAAC;IAC/C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,EAAE,sCAAsC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAClF,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;QAC/D,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,QAAQ,CAAC,GAAG,EAAE,UAAU,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAE3F,MAAM,eAAe,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QAEjE,WAAW,CACT,GAAG,EACH,eAAe,eAAe,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,yBAAyB;YAClF,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE;YAClE,MAAM,YAAY,CAAC,MAAM,iBAAiB,CAC7C,CAAC;QAEF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjF,WAAW,CACT,GAAG,EACH,gBAAgB,OAAO,CAAC,MAAM,yBAAyB,QAAQ,CAAC,MAAM,gBAAgB,CACvF,CAAC;QAEF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACpC,GAAG,MAAM;YACT,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;YAClD,gBAAgB,EAAE,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,eAAe;SACpE,CAAC,CAAC,CAAC;IACN,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,EAAE,CAAC;YAChB,QAAQ,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzC,OAAO,IAAI,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAoB,EACpB,QAAgB,EAChB,OAA0B;IAE1B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,oBAAoB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9D,IAAI,OAAO,EAAE,CAAC;QACZ,QAAQ,CAAC,GAAG,EAAE,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,EAAE,gGAAgG,CAC9I,CAAC;AACJ,CAAC"}

package/dist/diff-parser.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Git diff parsing utility.
+ *
+ * Parses unified diff format (output of `git diff`) into a structured
+ * map of changed regions per file. Used by the diff filter to
+ * determine which code was changed.
+ */
+export interface DiffHunk {
+    /** Relative path from repo root. */
+    file: string;
+    /** 1-based start line of the changed region (new file side). */
+    startLine: number;
+    /** 1-based end line of the changed region (new file side). */
+    endLine: number;
+}
+/** Changed regions keyed by file path for fast lookup. */
+export type DiffMap = Map<string, DiffHunk[]>;
+/**
+ * Parse a unified diff string into a DiffMap.
+ *
+ * Extracts file paths and hunk headers, using the new-file line numbers
+ * (the `+` side) since we analyze the current state of the code.
+ *
+ * Handles:
+ * - Regular file modifications
+ * - Renames (maps to new path)
+ * - New files (entire file is changed)
+ * - Deleted files (excluded — no code to analyze)
+ * - Binary files (skipped)
+ */
+export declare function parseDiff(diffText: string): DiffMap;
+/**
+ * Run `git diff <ref>` against a repository and return the raw unified diff.
+ */
+export declare function getDiff(repoPath: string, ref: string): Promise<string>;
+/**
+ * Load a diff from a file path.
+ */
+export declare function loadDiffFromFile(filePath: string): Promise<string>;
+//# sourceMappingURL=diff-parser.d.ts.map

package/dist/diff-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-parser.d.ts","sourceRoot":"","sources":["../src/diff-parser.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAI9C;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuEnD;AAID;;GAEG;AACH,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMxE"}