@weareikko/code-review 0.0.1 → 0.8.0

package/dist/cli.d.ts

@@ -0,0 +1,56 @@
+import type { Config } from './config.js';
+import { type DiagnosticContext } from './diagnostics.js';
+import type { ReviewUsage } from './gitlab-review.js';
+import type { OtelBridge } from './otel.js';
+import { type ScmResponseInfo } from './platform.js';
+import type { SummaryResult } from './posting.js';
+import type { GeneratedComment, Severity } from './types.js';
+export type { DiagnosticContext, DiagnosticError, DiagnosticPhase, DiagnosticUsage, DiagnosticUsageBreakdown, } from './diagnostics.js';
+export { DIAGNOSTIC_CHANNEL_NAMES, DIAGNOSTIC_CHANNEL_PREFIX, createDiagnosticContext, createDiagnosticRunId, diagnosticChannels, traceDiagnostic, traceDiagnosticPhase, } from './diagnostics.js';
+export type { OtelBridge, OtelBridgeOptions, OtelRuntime } from './otel.js';
+export { isOtelEnabled, startOtelBridge } from './otel.js';
+export interface RunResult {
+    generated: GeneratedComment[];
+    posted: number;
+    usage: ReviewUsage;
+    summary: SummaryResult | null;
+    skipped?: boolean;
+}
+export interface RunBridges {
+    /** Pre-started OTel bridge for per-turn and per-tool-call agent telemetry. */
+    otel?: OtelBridge;
+}
+export declare function run(config: Config, bridges?: RunBridges): Promise<RunResult>;
+export declare function formatSkillsFooter(skills: string[]): string | undefined;
+export declare function formatUsageLine(usage: ReviewUsage): string;
+/**
+ * Render the per-model usage breakdown for heterogeneous `full`-depth runs: one
+ * indented line per pool member with its billable input / output tokens and
+ * cost. Returns `undefined` when there is no breakdown (single-model runs), so
+ * the caller prints nothing extra. Surfaces model ids and numbers only — never
+ * any key or secret.
+ */
+export declare function formatPerModelUsage(usage: ReviewUsage): string | undefined;
+/**
+ * Wraps a phase operation so the phase context gets HTTP semantic-convention
+ * attributes stamped from the most recent platform response — on both success
+ * and error paths. `readLastHttp` returns the platform's latest response holder;
+ * the wrapper snapshots it before the operation and only stamps when the
+ * operation's own request produced a *new* response, so a phase that threw
+ * before any HTTP call never inherits a previous phase's URL/status.
+ *
+ * Used by every traced platform phase, including the write phases
+ * (`scm.post_comments`, `scm.upsert_summary`) so a failure like a 500 on
+ * `bulk_publish` carries http.response.status_code / url.full / server.address.
+ */
+export declare function withHttpStamping<T>(readLastHttp: () => ScmResponseInfo | undefined, operation: (context: DiagnosticContext) => Promise<T>): (context: DiagnosticContext) => Promise<T>;
+/**
+ * Count the comments posted to the MR, grouped by severity. Duplicates are
+ * excluded since they are never posted. The total equals the new-comment count;
+ * in `draft` mode a concurrent run can race-delete some drafts before publish,
+ * so the breakdown reflects posted intent and may slightly exceed the published
+ * count in that rare case.
+ */
+export declare function countPostedBySeverity(generated: GeneratedComment[]): Partial<Record<Severity, number>>;
+export declare function main(argv?: string[]): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAiB,MAAM,YAAY,CAAC;AAE5E,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAuE3D,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiBD,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAuBD,wBAAsB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA0SlF;AAaD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAGvE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAoB1D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAW1E;AAQD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,YAAY,EAAE,MAAM,eAAe,GAAG,SAAS,EAC/C,SAAS,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GACpD,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,CAU5C;AAsBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,gBAAgB,EAAE,GAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAQnC;AAED,wBAAsB,IAAI,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BtE"}

package/dist/cli.js

@@ -0,0 +1,2 @@
+import { C as createDiagnosticContext, D as traceDiagnosticPhase, E as traceDiagnostic, S as DIAGNOSTIC_CHANNEL_PREFIX, T as diagnosticChannels, a as main, d as startOtelBridge, i as formatUsageLine, n as formatPerModelUsage, o as run, r as formatSkillsFooter, s as withHttpStamping, t as countPostedBySeverity, u as isOtelEnabled, w as createDiagnosticRunId, x as DIAGNOSTIC_CHANNEL_NAMES } from "./cli-w8sz3CYl.js";
+export { DIAGNOSTIC_CHANNEL_NAMES, DIAGNOSTIC_CHANNEL_PREFIX, countPostedBySeverity, createDiagnosticContext, createDiagnosticRunId, diagnosticChannels, formatPerModelUsage, formatSkillsFooter, formatUsageLine, isOtelEnabled, main, run, startOtelBridge, traceDiagnostic, traceDiagnosticPhase, withHttpStamping };

package/dist/config.d.ts

@@ -0,0 +1,205 @@
+import { type PostingMode } from './posting.js';
+import { type ReviewDepth, type Severity, type ThinkingLevel } from './types.js';
+export type GitLabAuthHeader = 'PRIVATE-TOKEN' | 'JOB-TOKEN';
+/** Source-control backends the reviewer can target. */
+export declare const PLATFORMS: readonly ["gitlab", "github"];
+export type Platform = (typeof PLATFORMS)[number];
+/** Default GitHub server (web) URL, honoring `GITHUB_SERVER_URL` on Enterprise. */
+export declare const DEFAULT_GITHUB_SERVER_URL = "https://github.com";
+/**
+ * The single source of truth for the tool's own `CODE_REVIEW_*` settings.
+ *
+ * Each entry is the suffix after the `CODE_REVIEW_` prefix (e.g. `MODEL` for
+ * `CODE_REVIEW_MODEL`). These are read directly across `config.ts`/`otel.ts`
+ * and must NEVER be de-prefixed by {@link applyCodeReviewEnvPrefix}.
+ *
+ * Note: `API_KEY` is reserved. `CODE_REVIEW_API_KEY` was intentionally retired
+ * as the AI provider key and must not be revived as one.
+ */
+export declare const RESERVED_ENV_SUFFIXES: readonly ["API_KEY", "BASE_URL", "DECOMPOSE_HINT_LINES", "MAX_DIFF_CHARS", "MAX_TOKENS", "MIN_SEVERITY", "MODEL", "MODEL_POOL", "PLATFORM", "OTEL", "OTEL_CAPTURE_CONTENT", "POSTING_MODE", "POST_SUMMARY", "FORCE_REVIEW", "VERBOSE", "SKILLS", "REFRESH_SKILLS", "THINKING_LEVEL"];
+/**
+ * Optional namespacing shim for provider/infra environment variables.
+ *
+ * For each `CODE_REVIEW_<NAME>` variable whose `<NAME>` is not a reserved tool
+ * setting (see {@link RESERVED_ENV_SUFFIXES}), this exposes `<NAME>` in the same
+ * env object. The prefixed value wins when both `CODE_REVIEW_<NAME>` and a
+ * plain `<NAME>` are set — the tool's scoped value should override an unrelated
+ * CI-wide variable of the same name.
+ *
+ * This lets credentials and infra vars that `@earendil-works/pi-ai` reads
+ * (`ANTHROPIC_API_KEY`, `CLOUDFLARE_API_KEY`, `CLOUDFLARE_ACCOUNT_ID`,
+ * `OLLAMA_HOST`, ambient AWS/Vertex creds, …) — and the GitLab tokens — be
+ * scoped under `CODE_REVIEW_` in shared CI without enumerating pi-ai's
+ * provider list.
+ *
+ * Must run once at startup BEFORE config/key resolution: `getEnvApiKey` and
+ * pi-ai's request-time reads both read `process.env` directly, so mutating it
+ * in-process is what makes those reads pick up the de-prefixed values.
+ *
+ * Empty prefixed values are ignored (treated as unset). Double-prefixed names
+ * (e.g. `CODE_REVIEW_CODE_REVIEW_MODEL`) are also skipped so a de-prefixed
+ * suffix can never clobber the tool's own reserved `CODE_REVIEW_*` settings.
+ *
+ * @returns the same `env` object it was given, mutated in place.
+ */
+export declare function applyCodeReviewEnvPrefix(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Default pi-ai's prompt-cache retention to `long` when the caller has not set
+ * it. pi-ai reads `PI_CACHE_RETENTION` from `process.env` at request time; `long`
+ * asks providers that support it (e.g. OpenAI's `openai-responses` API, including
+ * via the Cloudflare AI Gateway) to keep the cached system-prompt prefix for up
+ * to 24h so reviews spaced hours apart still reuse it. It is a safe no-op for
+ * providers/models without long-retention support (e.g. Anthropic), where it
+ * behaves exactly like the default `short`.
+ *
+ * Overridable: an explicit `PI_CACHE_RETENTION` (or `CODE_REVIEW_PI_CACHE_RETENTION`,
+ * mapped by {@link applyCodeReviewEnvPrefix} first) is left untouched.
+ */
+export declare function applyDefaultCacheRetention(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export interface Config {
+    /**
+     * The source-control backend to review against. Auto-detected from the
+     * environment by default (see {@link detectPlatform}); `--platform` /
+     * `CODE_REVIEW_PLATFORM` is an explicit override that always wins.
+     */
+    platform: Platform;
+    project: string;
+    mr: string;
+    gitlabUrl: string;
+    gitlabToken: string;
+    gitlabAuthHeader: GitLabAuthHeader;
+    /** `owner/repo` slug of the GitHub repository (`GITHUB_REPOSITORY`). */
+    githubRepository: string;
+    /** Pull-request number as a string, mirroring {@link Config.mr}. */
+    githubPr: string;
+    /** Token used for the GitHub REST API (`GITHUB_TOKEN` / `--github-token`). */
+    githubToken: string;
+    /** GitHub REST API base; defaults to {@link DEFAULT_GITHUB_API_URL}. */
+    githubApiUrl: string;
+    /** GitHub server (web) URL; defaults to {@link DEFAULT_GITHUB_SERVER_URL}. */
+    githubServerUrl: string;
+    model: string;
+    /**
+     * Optional pool of `provider/modelId` models for heterogeneous `full`-depth
+     * review. When non-empty, multi-angle Find maps each angle to a pool member and
+     * the adversarial verifier prefers a member other than the one that authored a
+     * finding. Empty (the default) means the effective pool is just `[model]`, which
+     * reproduces single-model behaviour byte-for-byte. Sourced from `--model-pool`
+     * or `CODE_REVIEW_MODEL_POOL` (comma-separated).
+     */
+    modelPool: string[];
+    minSeverity: Severity;
+    thinkingLevel: ThinkingLevel;
+    /**
+     * How many stages of the review pipeline run. `single` keeps the legacy
+     * single-pass behaviour; `verify` adds an adversarial Verify + Synthesize pass.
+     */
+    reviewDepth: ReviewDepth;
+    /**
+     * Optional `provider/modelId` for the Verify stage (`verify`/`full` depth). When
+     * set, every adversarial verifier runs on this model instead of the pool's
+     * cross-family pick — pairing a cheap, high-recall Find model with a strong,
+     * high-precision verifier. Empty (default) keeps the pool-based selection.
+     * Sourced from `--verify-model` or `CODE_REVIEW_VERIFY_MODEL`.
+     */
+    verifyModel: string;
+    postingMode: PostingMode;
+    apiKey: string;
+    /** Custom base URL for the AI provider API (e.g. Ollama or other OpenAI-compatible endpoints). */
+    baseUrl: string;
+    /** Maximum output tokens to request from the model. 0 uses the model's default. */
+    maxTokens: number;
+    /**
+     * Maximum cumulative diff characters sent to the reviewer. Files past this
+     * budget are dropped and surfaced as a size-skip callout. Defaults to 100_000.
+     */
+    maxDiffChars: number;
+    /**
+     * When > 0, an MR whose reviewed diff changes more lines than this threshold
+     * gets a "consider decomposing this MR" hint in the summary. 0 = off (default).
+     */
+    decomposeHintLines: number;
+    /**
+     * Lines of surrounding context per diff hunk (`git diff --unified`). More
+     * context helps the model reason about each change but inflates tokens and
+     * fits fewer files in the char budget; less context fits more files. 0 uses
+     * the built-in default. Sourced from `--diff-context` / `CODE_REVIEW_DIFF_CONTEXT`.
+     */
+    diffContext: number;
+    /**
+     * When true, diffs for files dropped by the char budget are staged on disk so
+     * the reviewer can read them on demand instead of losing them (retrieval mode).
+     * Default false. Sourced from `--retrieve-skipped` / `CODE_REVIEW_RETRIEVE_SKIPPED`.
+     */
+    retrieveSkipped: boolean;
+    reviewFile: string;
+    output: string;
+    dryRun: boolean;
+    noPost: boolean;
+    postSummary: boolean;
+    forceReview: boolean;
+    verbose: boolean;
+    cwd: string;
+    skills: string[];
+    /** Re-clone `git:` / `git+ssh:` skills, bypassing the on-disk clone cache. */
+    refreshGitSkills: boolean;
+}
+export type ParsedArgs = Record<string, string | boolean | string[]>;
+export declare function parseArgs(argv: string[]): ParsedArgs;
+/**
+ * Extract the provider name from a `"provider/modelId"` model string.
+ * Returns an empty string when the model string contains no slash.
+ */
+export declare function parseModelProvider(model: string): string;
+/**
+ * Resolve the API key for the given model's provider, delegating entirely to
+ * `@earendil-works/pi-ai`'s `getEnvApiKey`. That helper reads the provider's
+ * standard environment variable (e.g. `ANTHROPIC_API_KEY` / `ANTHROPIC_OAUTH_TOKEN`,
+ * `OPENAI_API_KEY`, `GEMINI_API_KEY`, `OPENROUTER_API_KEY`, …) and resolves
+ * ambient credentials (Amazon Bedrock, Google Vertex ADC). The key is therefore
+ * always provider-specific — a key for provider X is never used for provider Y.
+ *
+ * Ollama is a local OpenAI-compatible endpoint that needs no key, so a
+ * placeholder is returned. The `--api-key` flag takes precedence in
+ * `resolveConfig`.
+ *
+ * NOTE: `getEnvApiKey` reads `process.env` directly (not a passed-in env), so
+ * tests stub `process.env` or pass `--api-key` to control the resolved key.
+ */
+export declare function resolveProviderApiKey(model: string): string;
+/**
+ * Extract a pull-request number from a GitHub Actions event payload JSON string
+ * (the file `GITHUB_EVENT_PATH` points at). Prefers `.pull_request.number`, then
+ * the top-level `.number` (present on `issue_comment` events). Returns `''` when
+ * the JSON is unparsable or carries no number.
+ */
+export declare function parsePrNumberFromEvent(json: string): string;
+/**
+ * Extract a pull-request number from a `GITHUB_REF` of the form
+ * `refs/pull/<N>/merge` (or `/head`). Returns `''` for any other ref shape.
+ */
+export declare function parsePrNumberFromRef(ref: string | undefined): string;
+/**
+ * Resolve the GitHub pull-request number, in priority order: `--pr` flag, then
+ * the `GITHUB_EVENT_PATH` payload (`.pull_request.number` ?? `.number`), then a
+ * `refs/pull/<N>/merge` `GITHUB_REF`. Returns `''` when none apply.
+ */
+export declare function resolveGitHubPr(args: ParsedArgs, env: NodeJS.ProcessEnv, readEventFile?: (path: string) => string | undefined): string;
+/**
+ * Determine the review platform for this run.
+ *
+ * Precedence:
+ *   1. Explicit `--platform` / `CODE_REVIEW_PLATFORM` (throws on an unknown value).
+ *   2. CI markers: `GITHUB_ACTIONS === 'true'` → github; `GITLAB_CI === 'true'`
+ *      or a present `CI_PROJECT_ID` / `CI_SERVER_URL` → gitlab.
+ *   3. Inference from which platform's required identifiers are present
+ *      (`GITHUB_REPOSITORY` + a PR number vs. `CI_PROJECT_ID` + `CI_MERGE_REQUEST_IID`).
+ *
+ * Throws a {@link ConfigError} when both platforms' identifiers are present
+ * (ambiguous) or neither is (undetectable), with a hint to set `--platform`.
+ */
+export declare function detectPlatform(args: ParsedArgs, env: NodeJS.ProcessEnv, readEventFile?: (path: string) => string | undefined): Platform;
+export declare function resolveConfig(argv?: string[], env?: NodeJS.ProcessEnv): Config;
+export declare function validateConfig(config: Config): void;
+export { type Severity, type ThinkingLevel };
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAAC;AAE7D,uDAAuD;AACvD,eAAO,MAAM,SAAS,+BAAgC,CAAC;AACvD,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,sRAmBxB,CAAC;AAKX;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,oBAAc,GAAG,MAAM,CAAC,UAAU,CAW7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,oBAAc,GAAG,MAAM,CAAC,UAAU,CAK/E;AAED,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,QAAQ,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8EAA8E;IAC9E,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;AAerE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA4CpD;AA2BD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM3D;AAgDD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAa3D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGpE;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,aAAa,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAA6B,GACtE,MAAM,CAWR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,aAAa,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAA6B,GACtE,QAAQ,CA6BV;AAED,wBAAgB,aAAa,CAAC,IAAI,WAAwB,EAAE,GAAG,oBAAc,GAAG,MAAM,CAoGrF;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAsFnD;AAED,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,CAAC"}

package/dist/diagnostics.d.ts

@@ -0,0 +1,118 @@
+import { type TracingChannel } from 'node:diagnostics_channel';
+import type { Config } from './config.js';
+import type { Severity } from './types.js';
+export type DiagnosticPhase = 'run' | 'scm.get_merge_request' | 'scm.get_latest_version' | 'git.prepare_history' | 'git.get_merge_diff' | 'git.get_commit_log' | 'reviewer.run' | 'review.parse' | 'scm.get_discussions' | 'comments.build' | 'artifact.write_output' | 'scm.post_comments' | 'scm.upsert_summary';
+export interface DiagnosticError {
+    name?: string;
+    message: string;
+    code?: string;
+    /** True when the failure was a deadline/abort, so the bridge can label it `timeout`. */
+    timeout?: boolean;
+    /**
+     * HTTP status code when the failure came from a GitLab API response (e.g. a
+     * 500 on `bulk_publish`). Propagates up the phase chain so the OTel bridge can
+     * refine `error.type` and label the error counter with the status.
+     */
+    status?: number;
+}
+/**
+ * Value-based secret redaction: removes the *known* secret values this run holds
+ * (the GitLab token and the provider API key) from a string, in every encoding
+ * they might appear under. Unlike pattern matching it cannot over-redact ordinary
+ * text, cannot miss a token because of its format, and uses literal replacement
+ * (no regex), so there is no catastrophic-backtracking risk on large messages.
+ */
+export declare function scrubSecrets(input: string, secretValues: readonly string[]): string;
+/** Collects the run's secret values (non-empty) for {@link scrubSecrets}. */
+export declare function collectSecrets(config: Config): string[];
+export interface DiagnosticUsageBreakdown {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    total: number;
+}
+export interface DiagnosticUsage {
+    model: string;
+    tokens: DiagnosticUsageBreakdown;
+    cost: DiagnosticUsageBreakdown;
+}
+export interface DiagnosticContext {
+    version: 1;
+    runId: string;
+    phase: DiagnosticPhase;
+    project: string;
+    mr: string;
+    gitlabUrl: string;
+    cwd: string;
+    model: string;
+    minSeverity: string;
+    dryRun: boolean;
+    noPost: boolean;
+    startedAt: string;
+    completedAt?: string;
+    durationMs?: number;
+    generated?: number;
+    newComments?: number;
+    duplicateComments?: number;
+    posted?: number;
+    /**
+     * Breakdown of posted comments by severity, populated on the `run` context so
+     * the OTel bridge can split `gitlab_review_comments_total` by severity. Counts
+     * the non-duplicate (posted-intent) comments; absent on dry-run/skip paths.
+     */
+    postedBySeverity?: Partial<Record<Severity, number>>;
+    warnings?: number;
+    /** Why the reviewer JSON could not be parsed, on the `review.parse` phase when it fails. */
+    malformedReason?: string;
+    reviewFile?: string;
+    output?: string;
+    /** Number of files in the merge diff (set on the `git.get_merge_diff` phase). */
+    diffFilesChanged?: number;
+    /** Added content lines in the merge diff. */
+    diffLinesAdded?: number;
+    /** Removed content lines in the merge diff. */
+    diffLinesRemoved?: number;
+    /** HTTP method of the GitLab API call traced by this phase. */
+    httpRequestMethod?: string;
+    /** Full URL of the (last) GitLab API request in this phase; carries no secrets. */
+    httpUrl?: string;
+    /** HTTP status code of the (last) GitLab API response in this phase. */
+    httpStatusCode?: number;
+    /** Response Content-Length in bytes, when present. */
+    httpResponseBodySize?: number;
+    /** Host of the GitLab server the request targeted. */
+    serverAddress?: string;
+    draftsAbandoned?: number;
+    draftsCreated?: number;
+    draftsDeletedPrePublish?: number;
+    draftsPublished?: number;
+    /** Drafts that could not be published on the per-draft fallback path (silent comment drops). */
+    draftsPublishFailed?: number;
+    summaryAction?: 'created' | 'updated' | 'skipped';
+    summaryNoteId?: number;
+    usage?: DiagnosticUsage;
+    errorInfo?: DiagnosticError;
+}
+export declare const DIAGNOSTIC_CHANNEL_PREFIX = "@weareikko/code-review";
+export declare const DIAGNOSTIC_CHANNEL_NAMES: {
+    readonly run: "@weareikko/code-review:run";
+    readonly getMergeRequest: "@weareikko/code-review:scm.get_merge_request";
+    readonly getLatestVersion: "@weareikko/code-review:scm.get_latest_version";
+    readonly prepareGitHistory: "@weareikko/code-review:git.prepare_history";
+    readonly getMergeDiff: "@weareikko/code-review:git.get_merge_diff";
+    readonly getCommitLog: "@weareikko/code-review:git.get_commit_log";
+    readonly runReviewer: "@weareikko/code-review:reviewer.run";
+    readonly parseReview: "@weareikko/code-review:review.parse";
+    readonly getDiscussions: "@weareikko/code-review:scm.get_discussions";
+    readonly buildComments: "@weareikko/code-review:comments.build";
+    readonly writeOutput: "@weareikko/code-review:artifact.write_output";
+    readonly postComments: "@weareikko/code-review:scm.post_comments";
+    readonly upsertSummary: "@weareikko/code-review:scm.upsert_summary";
+};
+export declare const diagnosticChannels: Record<"buildComments" | "getCommitLog" | "getDiscussions" | "getLatestVersion" | "getMergeDiff" | "getMergeRequest" | "parseReview" | "postComments" | "prepareGitHistory" | "run" | "runReviewer" | "upsertSummary" | "writeOutput", TracingChannel<DiagnosticContext, DiagnosticContext>>;
+export declare function createDiagnosticRunId(): string;
+export declare function createDiagnosticContext(phase: DiagnosticPhase, config: Config, runId: string, overrides?: Partial<DiagnosticContext>): DiagnosticContext;
+export declare function traceDiagnostic<T>(channel: TracingChannel<DiagnosticContext>, context: DiagnosticContext, operation: (context: DiagnosticContext) => Promise<T>, secretValues?: readonly string[]): Promise<T>;
+export declare function traceDiagnosticPhase<T>(phase: DiagnosticPhase, config: Config, runId: string, operation: (context: DiagnosticContext) => Promise<T>, overrides?: Partial<DiagnosticContext>): Promise<T>;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../src/diagnostics.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,uBAAuB,GACvB,wBAAwB,GACxB,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAanF;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,wBAAwB,CAAC;IACjC,IAAI,EAAE,wBAAwB,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;CAc3B,CAAC;AAEX,eAAO,MAAM,kBAAkB,8RAQ9B,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,OAAO,CAAC,iBAAiB,CAAM,GACzC,iBAAiB,CAkBnB;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,OAAO,EAAE,cAAc,CAAC,iBAAiB,CAAC,EAC1C,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,EACrD,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,EACrD,SAAS,GAAE,OAAO,CAAC,iBAAiB,CAAM,GACzC,OAAO,CAAC,CAAC,CAAC,CAaZ"}

package/dist/diff-lines.d.ts

@@ -0,0 +1,48 @@
+import type { Side } from './types.js';
+/**
+ * A diff line resolved to the old/new line numbers it maps to. GitLab consumes
+ * both (`old_line`/`new_line`); GitHub consumes one plus a `side`. Shared by both
+ * platforms so line resolution lives in one place.
+ */
+export interface ResolvedDiffLine {
+    newLine?: number;
+    oldLine?: number;
+}
+/**
+ * Classify a target line in a unified diff into the old/new line numbers it maps
+ * to, tracking which side(s) apply:
+ *   - an **added** line resolves to `newLine` only,
+ *   - a **removed** line resolves to `oldLine` only,
+ *   - an **unchanged (context)** line resolves to BOTH `oldLine` and `newLine`.
+ *
+ * GitLab needs both sides for context lines: a one-sided position is accepted by
+ * the draft-notes API but makes `bulk_publish` return 500 (GitLab skips position
+ * validation on draft creation — gitlab-org/gitlab#579609). GitHub uses a single
+ * `line` + `side`, taking `newLine`/`RIGHT` or `oldLine`/`LEFT`. We feed the
+ * reviewer ±20 lines of context, so it routinely anchors comments on unchanged
+ * lines; resolving them here is what lets both platforms place the comment.
+ *
+ * Returns `null` when the line is not part of the diff for `file`, so the caller
+ * can fall back (GitLab) or drop the comment (GitHub avoids a 422 on off-diff
+ * lines) rather than emit a position the platform cannot place.
+ */
+export declare function resolveDiffLine(diff: string, file: string, target: number, side: Side): ResolvedDiffLine | null;
+/** Context lines GitHub renders around each hunk change in a PR diff by default. */
+export declare const GITHUB_DIFF_CONTEXT = 3;
+/**
+ * True when the context line `target` (on `side`) is within `maxDistance` rows
+ * of the nearest added/removed line in its hunk.
+ *
+ * The reviewer runs against our LOCAL merge diff, generated with a wide context
+ * (`--unified=20`, see `git.ts`), so it routinely anchors findings on unchanged
+ * lines up to 20 rows from a change. GitHub's PR diff, however, shows only 3
+ * context lines: a review comment on a line outside GitHub's diff gets a 422,
+ * and because the review is posted as one atomic batch, a single 422 sinks every
+ * inline comment. This lets the GitHub payload builder drop such an off-diff
+ * context line (returning `null`) instead of 422-ing the whole review.
+ *
+ * Only meaningful for context lines (added/removed lines are always inside
+ * GitHub's diff); the caller checks that before calling.
+ */
+export declare function contextLineWithinGitHubDiff(diff: string, file: string, target: number, side: Side, maxDistance?: number): boolean;
+//# sourceMappingURL=diff-lines.d.ts.map

package/dist/diff-lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-lines.d.ts","sourceRoot":"","sources":["../src/diff-lines.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,GACT,gBAAgB,GAAG,IAAI,CAyCzB;AAED,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,EACV,WAAW,SAAsB,GAChC,OAAO,CAqDT"}

package/dist/errors.d.ts

@@ -0,0 +1,69 @@
+export type ErrorCode = 'CONFIG_ERROR' | 'GITLAB_API_ERROR' | 'GITHUB_API_ERROR' | 'GIT_ERROR' | 'REVIEWER_ERROR' | 'PARSE_ERROR' | 'RUNTIME_ERROR';
+export interface GitlabReviewErrorOptions extends ErrorOptions {
+    code: ErrorCode;
+    hint?: string;
+    /**
+     * Marks a deadline-exceeded failure. The CLI's `code` taxonomy stays coarse
+     * (one code per subsystem), so timeouts are flagged here rather than via a
+     * separate code; the OTel bridge reads it to label runs `status=timeout`.
+     */
+    timeout?: boolean;
+    /**
+     * Marks a provider credit/quota-exhaustion failure (e.g. HTTP 402). The review
+     * could not run for reasons outside the MR's control, so the CLI treats it as
+     * a non-fatal skip (warn, exit 0) rather than failing the pipeline.
+     */
+    quotaExceeded?: boolean;
+}
+export declare class GitlabReviewError extends Error {
+    readonly code: ErrorCode;
+    readonly hint?: string;
+    readonly timeout: boolean;
+    readonly quotaExceeded: boolean;
+    constructor(message: string, options: GitlabReviewErrorOptions);
+}
+/** True when `message` looks like a provider credit/quota-exhaustion error. */
+export declare function isQuotaExceededMessage(message: string | undefined): boolean;
+/** True when `error` is (or reports) a provider credit/quota-exhaustion failure. */
+export declare function isQuotaExceededError(error: unknown): boolean;
+export declare class ConfigError extends GitlabReviewError {
+    constructor(message: string, options?: Omit<GitlabReviewErrorOptions, 'code'>);
+}
+export declare class GitLabApiError extends GitlabReviewError {
+    readonly method: string;
+    readonly path: string;
+    readonly status?: number;
+    readonly responseBody?: string;
+    constructor(message: string, options: Omit<GitlabReviewErrorOptions, 'code'> & {
+        method: string;
+        path: string;
+        status?: number;
+        responseBody?: string;
+    });
+}
+export declare class GitHubApiError extends GitlabReviewError {
+    readonly method: string;
+    readonly path: string;
+    readonly status?: number;
+    readonly responseBody?: string;
+    constructor(message: string, options: Omit<GitlabReviewErrorOptions, 'code'> & {
+        method: string;
+        path: string;
+        status?: number;
+        responseBody?: string;
+    });
+}
+export declare class GitError extends GitlabReviewError {
+    constructor(message: string, options?: Omit<GitlabReviewErrorOptions, 'code'>);
+}
+export declare class ReviewerError extends GitlabReviewError {
+    constructor(message: string, options?: Omit<GitlabReviewErrorOptions, 'code'>);
+}
+export declare class ParseError extends GitlabReviewError {
+    constructor(message: string, options?: Omit<GitlabReviewErrorOptions, 'code'>);
+}
+export declare class RuntimeError extends GitlabReviewError {
+    constructor(message: string, options?: Omit<GitlabReviewErrorOptions, 'code'>);
+}
+export declare function formatError(error: unknown): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,kBAAkB,GAClB,kBAAkB,GAClB,WAAW,GACX,gBAAgB,GAChB,aAAa,GACb,eAAe,CAAC;AAEpB,MAAM,WAAW,wBAAyB,SAAQ,YAAY;IAC5D,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAEhC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAO7D;CACF;AAkBD,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI5D;AAED,qBAAa,WAAY,SAAQ,iBAAiB;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAM,EAEhF;CACF;AAED,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EAOF;CACF;AAED,qBAAa,cAAe,SAAQ,iBAAiB;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,GAAG;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,EAOF;CACF;AAED,qBAAa,QAAS,SAAQ,iBAAiB;IAC7C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAM,EAEhF;CACF;AAED,qBAAa,aAAc,SAAQ,iBAAiB;IAClD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAM,EAEhF;CACF;AAED,qBAAa,UAAW,SAAQ,iBAAiB;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAM,EAEhF;CACF;AAED,qBAAa,YAAa,SAAQ,iBAAiB;IACjD,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAM,EAEhF;CACF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAclD"}

package/dist/fingerprints.d.ts

@@ -0,0 +1,22 @@
+import type { Discussion } from './gitlab.js';
+import type { Fingerprints, ReviewComment, Side } from './types.js';
+/**
+ * Pattern source for the hidden fingerprint marker, capturing the hash group.
+ * Shared with the parser and prior-thread detection so the marker format is
+ * defined in one place; each call site builds its own RegExp with the flags it
+ * needs (the capture group is harmless when only stripping or testing). This is
+ * a stable wire contract — see CLAUDE.md before changing it.
+ *
+ * Reads match BOTH the current `code-review:` prefix and the legacy
+ * `gitlab-review:` prefix so findings posted under the old product identity are
+ * still recognised and deduplicated after the rename. Writes emit the current
+ * prefix (see {@link appendFingerprintMarkers}).
+ */
+export declare const FINGERPRINT_MARKER_PATTERN: string;
+export declare function sha256(input: string): string;
+export declare function normalizeBody(body: string): string;
+export declare function extractDiffHunkContext(diff: string, file: string, line: number, side: Side): string;
+export declare function fingerprints(comment: ReviewComment, hunkContext: string): Fingerprints;
+export declare function appendFingerprintMarkers(body: string, fp: Fingerprints): string;
+export declare function extractExistingFingerprints(discussions: Discussion[]): Set<string>;
+//# sourceMappingURL=fingerprints.d.ts.map

package/dist/fingerprints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprints.d.ts","sourceRoot":"","sources":["../src/fingerprints.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,QAAuG,CAAC;AAI/I,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAsCD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,IAAI,GACT,MAAM,CAqCR;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAetF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,GAAG,MAAM,CAE/E;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlF"}

package/dist/git.d.ts

@@ -0,0 +1,50 @@
+export interface GitOptions {
+    cwd?: string;
+}
+export interface PrepareGitHistoryOptions extends GitOptions {
+    remote?: string;
+    codeQualityArtifacts?: string[];
+}
+export declare function git(args: string[], options?: GitOptions): Promise<string>;
+export declare function getMergeDiffArguments(targetBranch: string, options?: {
+    remote?: string;
+    context?: number;
+}): string[];
+/**
+ * Full git argv for the merge diff. `-c core.quotepath=false` keeps non-ASCII
+ * paths literal instead of git's default octal-escaped + double-quoted form
+ * (`"a/caf\303\251.ts"`), which the comment-position parser cannot match —
+ * leaving such comments with invalid one-sided positions that 500 on
+ * `bulk_publish`. Diffing literally also gives the reviewer readable paths.
+ */
+export declare function getMergeDiffCommand(targetBranch: string, options?: {
+    remote?: string;
+    context?: number;
+}): string[];
+export declare function removeGeneratedCodeQualityArtifacts(paths?: string[], options?: GitOptions): Promise<string[]>;
+export declare function prepareGitHistory(sourceBranch: string, targetBranch: string, options?: PrepareGitHistoryOptions): Promise<void>;
+export declare function getMergeDiff(targetBranch: string, options?: GitOptions & {
+    remote?: string;
+    context?: number;
+}): Promise<string>;
+export declare function getMergeCommitLogArguments(targetBranch: string, options?: {
+    remote?: string;
+}): string[];
+export declare function getMergeCommitLog(targetBranch: string, options?: GitOptions & {
+    remote?: string;
+}): Promise<string>;
+export interface DiffSummary {
+    filesChanged: number;
+    linesAdded: number;
+    linesRemoved: number;
+}
+/**
+ * Summarize a unified diff into file/line counts for telemetry. Counts one file
+ * per `diff --git` header and counts `+`/`-` lines only inside a hunk (after a
+ * `@@` header), so the `--- a/file` / `+++ b/file` header lines are excluded and
+ * a genuine content line whose text starts with `++`/`--` is still counted. Pure
+ * and allocation-light so it can run on the full merge diff without an extra git
+ * invocation.
+ */
+export declare function summarizeDiff(diff: string): DiffSummary;
+//# sourceMappingURL=git.d.ts.map

package/dist/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAyB,SAAQ,UAAU;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAgBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAanF;AAMD,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAClD,MAAM,EAAE,CAIV;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAClD,MAAM,EAAE,CAEV;AAkBD,wBAAsB,mCAAmC,CACvD,KAAK,WAAgC,EACrC,OAAO,GAAE,UAAe,GACvB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAED,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/D,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,MAAM,EAAE,CAQV;AAED,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAkBvD"}