clud-bug 0.7.0-rc.2 → 0.7.0-rc.21

package/dist/core/auto-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-resolve.js","sourceRoot":"","sources":["../../src/core/auto-resolve.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,kEAAkE;AAClE,iEAAiE;AACjE,iFAAiF;AACjF,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,YAAY;AACZ,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,oEAAoE;AACpE,yCAAyC;AACzC,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BzC,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,IAAI,EAAE,UAAU;IAChB,yBAAyB,EAAE,iBAAiB;CAC7C,CAAC;AA+FF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAY,EACZ,SAAgC,GAAG,EAAE,GAAE,CAAC;IAExC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;IAC7C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,IAAI,GAA8B,QAAQ,CAAC,IAAI,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAClD,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,IAAI,0BAA0B,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GACnB,QAAQ,CAAC,yBAAyB,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;QACtD,IACE,GAAG,CAAC,yBAAyB,KAAK,iBAAiB;YACnD,GAAG,CAAC,yBAAyB,KAAK,YAAY,EAC9C,CAAC;YACD,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,2CAA2C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,iCAAiC,QAAQ,CAAC,yBAAyB,IAAI,CAChK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,yBAAyB,EAAE,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAAoD,EACpD,MAA8B;IAE9B,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,CAAC;IAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAuB;IAEvB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,SAAkB;gBACxB,MAAM,EAAE,KAAc;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC;YACpB,oBAAoB,EAAE,KAAK;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACxC,gEAAgE;QAChE,+DAA+D;QAC/D,uDAAuD;QACvD,MAAM,YAAY,GAAyC;YACzD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,iBAAiB,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,MAAM;YACN,OAAO;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,KAAK;SACvC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,IAAI,KAAK,2BAA2B;YAAE,oBAAoB,GAAG,IAAI,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAMpC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEzC,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,uBAAuB,CAAC;gBAClC,IAAI,EAAE,oBAAoB;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,UAAU;aACrB,CAAC;YACF,OAAO;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,uBAAuB,CAAC;YACzC,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,2BAA2B;gBACjC,UAAU;gBACV,OAAO;gBACP,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACpD,CAAC;IAED,aAAa;IACb,MAAM,UAAU,GAAG,uBAAuB,CAAC;QACzC,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ;KACT,CAAC,CAAC;IACH,IACE,QAAQ,KAAK,UAAU;QACvB,MAAM,CAAC,yBAAyB,KAAK,iBAAiB,EACtD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,UAAU;YACV,OAAO;YACP,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,oBAAoB;YACvB,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,CACL,yCAAyC,IAAI,GAAG;oBAChD,oEAAoE;oBACpE,yEAAyE;oBACzE,qCAAqC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,oDAAoD,IAAI,EAAE,CAAC;QACpE,KAAK,wBAAwB;YAC3B,OAAO,2CAA2C,IAAI,EAAE,CAAC;QAC3D,KAAK,oBAAoB;YACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,sFAAsF,IAAI,EAAE,CAAC;YACtG,CAAC;YACD,OAAO,0DAA0D,IAAI,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAIjC;IACC,MAAM,GAAG,GACP,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,WAAW,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC5F,CAAC;AAKD,MAAM,iBAAiB,GACrB,4FAA4F,CAAC;AAE/F;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAuB,EAAE,GAAW;IACzE,OAAO,2BAA2B,OAAO,QAAQ,GAAG,MAAM,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CACnC,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyC,EACzC,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,yEAAyE;IACzE,sDAAsD;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAEC,EACD,UAAuB;IAEvB,IAAI,MAAM,GAAoD,IAAI,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,MAAM,GAAG,GAAG,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/budget-plan.d.ts

@@ -0,0 +1,125 @@
+import type { ResolvedReviewPasses } from './review-plan.js';
+/**
+ * Default per-PR cap. Real number lives in `env.REVIEW_SPEND_CAP_USD` once
+ * D.4 wires that env var — for now this is the hard-coded ceiling.
+ *
+ * $5 = a 3-pass review across 10 expensive skills (~30 calls × $0.15 avg).
+ * Anything above that is almost certainly a misconfigured `reviewPasses`.
+ */
+export declare const DEFAULT_PER_PR_CAP_USD = 5;
+export interface BudgetEstimateInput {
+    /** Resolved per-skill config — one entry per skill in the catalog. */
+    resolved: ResolvedReviewPasses[];
+    /** Model slugs the orchestrator plans to route to, in pass order. */
+    roleModels: string[];
+    /**
+     * Optional per-PR USD cap override. Defaults to `DEFAULT_PER_PR_CAP_USD`.
+     * D.4 wires per-install caps via `INSTALLS:{id}.spend_cap_usd`.
+     */
+    perPrCapUsd?: number;
+    /**
+     * Installation flag — `billing === 'exempt'` orgs bypass the cap entirely.
+     * D.4 reads this from the install record. For D.2.5, the orchestrator
+     * passes the env-allowlist result here.
+     */
+    billingExempt?: boolean;
+}
+export interface BudgetEstimate {
+    /** Total AI calls = sum(skill_count × pass_count). */
+    estimatedCalls: number;
+    /** Worst-case cost in USD across all planned calls. */
+    estimatedCostUsd: number;
+    /** Per-call ceiling used (max across the role models). */
+    perCallCeilingUsd: number;
+    /** The cap the estimate was checked against. */
+    capUsd: number;
+}
+export type BudgetVerdict = {
+    verdict: 'allow';
+    estimate: BudgetEstimate;
+} | {
+    verdict: 'deny';
+    estimate: BudgetEstimate;
+    /** Friendly reason for the orchestrator's "we paused this review" comment. */
+    reason: string;
+};
+/**
+ * Returns the per-call USD ceiling — max across the role models.
+ */
+export declare function perCallCeiling(models: string[]): number;
+/**
+ * Layer-1 cost gate. Decides whether the planned passes fit under the cap.
+ *
+ * Behavior matrix:
+ *   billingExempt = true             → allow (skip cap entirely)
+ *   estimatedCostUsd > cap           → deny + friendly reason
+ *   estimatedCostUsd <= cap          → allow
+ *   resolved.length === 0            → allow (single-pass D.2.0 path)
+ *
+ * Until D.4 wires real per-install spending, callers see allow on every
+ * normal path — the deny branch only fires on truly absurd estimates.
+ */
+export declare function estimateBudget(input: BudgetEstimateInput): BudgetVerdict;
+/**
+ * Exposed for tests + future D.4 wiring. Lets callers register a cost
+ * ceiling for a newly-routed model without editing this module.
+ */
+export declare function __setModelCeilingForTests(model: string, usd: number | null): void;
+/**
+ * Default per-PR budget for D.2.6 verifier calls. The spec calls $0.10 the
+ * "5 findings × 3 fix-pushes" ceiling; we use 2x that as the cap so a
+ * sufficiently-large PR (20 threads × 3 fix-pushes = 60 calls) still fits.
+ *
+ * D.4 will plumb per-install caps; for D.2.6 we use a single repo-wide
+ * default. Installs in BILLING_EXEMPT_ORGS bypass this entirely.
+ */
+export declare const DEFAULT_VERIFIER_PER_PR_CAP_USD = 0.6;
+export interface VerifierBudgetInput {
+    /** Number of open threads we plan to verify on this fix-push. */
+    threadCount: number;
+    /**
+     * Pass count from D.2.5 multi-pass — we call the verifier once per pass
+     * per thread (see resolve-verifier integration doc). Defaults to 1
+     * for single-pass installs.
+     */
+    passesPerThread?: number;
+    /**
+     * Optional per-PR cap override. Defaults to DEFAULT_VERIFIER_PER_PR_CAP_USD.
+     */
+    perPrCapUsd?: number;
+    /** BILLING_EXEMPT installs bypass the cap. */
+    billingExempt?: boolean;
+}
+export interface VerifierBudgetEstimate {
+    /** Total verifier AI calls = threadCount × passesPerThread. */
+    estimatedCalls: number;
+    /** Worst-case cost. */
+    estimatedCostUsd: number;
+    /** Per-call ceiling used. */
+    perCallCeilingUsd: number;
+    /** Cap checked against. */
+    capUsd: number;
+}
+export type VerifierBudgetVerdict = {
+    verdict: 'allow';
+    estimate: VerifierBudgetEstimate;
+} | {
+    verdict: 'deny';
+    estimate: VerifierBudgetEstimate;
+    /** Friendly reason for the orchestrator's "skipped: verifier-budget" log. */
+    reason: string;
+};
+/**
+ * Pre-flight gate for the D.2.6 fix-verifier. Called once per fix-push,
+ * BEFORE any verifier call runs. If denied, the orchestrator emits
+ * `skipped: budget` for the entire auto-resolve cycle and routes the
+ * threads through the heuristic fallback (see auto-resolve).
+ *
+ * Behavior:
+ *   billingExempt = true  → allow (bypass cap)
+ *   estimated > cap       → deny
+ *   threadCount === 0     → allow with 0 calls (no-op fix-push, no threads to verify)
+ *   otherwise             → allow
+ */
+export declare function estimateVerifierBudget(input: VerifierBudgetInput): VerifierBudgetVerdict;
+//# sourceMappingURL=budget-plan.d.ts.map

package/dist/core/budget-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget-plan.d.ts","sourceRoot":"","sources":["../../src/core/budget-plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA6D7D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAM,CAAC;AAM1C,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,qEAAqE;IACrE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GACrB;IACE,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;CAC1B,GACD;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAMN;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAQvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,aAAa,CA8BxE;AAiBD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,IAAI,CAMN;AAkBD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAA;CAAE,GACtD;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,GACzB,qBAAqB,CAwBvB"}

package/dist/core/budget-plan.js

@@ -0,0 +1,211 @@
+/**
+ * Layer 1 cost gate — pre-flight estimator for multi-pass review.
+ *
+ * D.2.5 introduces a cost multiplier — a 3-pass review of a 5-skill catalog
+ * is 15 AI calls instead of 5. Without a gate, a misconfigured `reviewPasses`
+ * block can quietly burn through the AI Gateway budget on a single PR. This
+ * module decides BEFORE any AI call whether the review is cheap enough to
+ * run, and if not, returns a structured "deny" verdict the orchestrator
+ * surfaces as a friendly comment.
+ *
+ * Two layers, only the first lands in D.2.5:
+ *
+ *   - Layer 1 (this module): per-PR estimate. Sums `skill_loads × pass_count`
+ *     to produce an `estimatedCalls` count and an `estimatedCostUsd`
+ *     ceiling. If `estimatedCostUsd > cap`, we deny.
+ *
+ *   - Layer 2 (D.4 — NOT in this module): per-install rolling spend. Reads
+ *     `INSTALLS:{id}.spend_usd_30d` from Redis. D.4 wires the actual gating;
+ *     here we just stub the interface.
+ *
+ * The gate is BEST-EFFORT, intentionally pessimistic. We over-estimate cost
+ * (worst-case tokens × highest-tier model) because the alternative is the
+ * customer eating a surprise bill. A 20% over-estimate that occasionally
+ * causes a "we paused; raise the cap" comment is the right failure mode.
+ *
+ * Until D.4 wires real per-install budgets, this module always returns
+ * `{ verdict: 'allow' }`. The implementation is intentionally complete so
+ * D.4 can flip a single switch without changing the orchestrator surface.
+ */
+// ---------------------------------------------------------------------------
+// Constants — worst-case cost ceilings
+// ---------------------------------------------------------------------------
+/**
+ * Rough USD-per-call ceiling across the model tiers we route to.
+ *
+ * Numbers are deliberately over-stated — we'd rather deny a borderline
+ * review than blow past a billing cap. Reconciled monthly from the AI
+ * Gateway dashboard; the D.4 billing module replaces this with live data.
+ *
+ * Picking the max(model) across the roles array keeps the math local — we
+ * don't need per-pass attribution for the estimate, only for billing
+ * reconciliation later.
+ */
+const MODEL_CEILING_USD = {
+    'anthropic/claude-haiku-4.5': 0.02,
+    'anthropic/claude-sonnet-4.6': 0.08,
+    'anthropic/claude-opus-4.6': 0.4,
+    'anthropic/claude-opus-4.7': 0.5,
+    'openai/gpt-5': 0.4,
+    'openai/gpt-5.2': 0.04,
+    'google/gemini-3-flash': 0.02,
+    'google/gemini-3.1-pro-preview': 0.3,
+};
+/** Fallback ceiling for unknown model slugs. Conservative. */
+const DEFAULT_PER_CALL_USD = 0.5;
+/**
+ * Default per-PR cap. Real number lives in `env.REVIEW_SPEND_CAP_USD` once
+ * D.4 wires that env var — for now this is the hard-coded ceiling.
+ *
+ * $5 = a 3-pass review across 10 expensive skills (~30 calls × $0.15 avg).
+ * Anything above that is almost certainly a misconfigured `reviewPasses`.
+ */
+export const DEFAULT_PER_PR_CAP_USD = 5.0;
+// ---------------------------------------------------------------------------
+// Estimator
+// ---------------------------------------------------------------------------
+/**
+ * Returns the per-call USD ceiling — max across the role models.
+ */
+export function perCallCeiling(models) {
+    if (models.length === 0)
+        return DEFAULT_PER_CALL_USD;
+    let max = 0;
+    for (const m of models) {
+        const c = MODEL_CEILING_USD[m] ?? DEFAULT_PER_CALL_USD;
+        if (c > max)
+            max = c;
+    }
+    return max;
+}
+/**
+ * Layer-1 cost gate. Decides whether the planned passes fit under the cap.
+ *
+ * Behavior matrix:
+ *   billingExempt = true             → allow (skip cap entirely)
+ *   estimatedCostUsd > cap           → deny + friendly reason
+ *   estimatedCostUsd <= cap          → allow
+ *   resolved.length === 0            → allow (single-pass D.2.0 path)
+ *
+ * Until D.4 wires real per-install spending, callers see allow on every
+ * normal path — the deny branch only fires on truly absurd estimates.
+ */
+export function estimateBudget(input) {
+    const cap = input.perPrCapUsd ?? DEFAULT_PER_PR_CAP_USD;
+    const ceiling = perCallCeiling(input.roleModels);
+    // The orchestrator (runMultiPass) sends all skills in a SINGLE prompt
+    // each pass and loops only the max skill's count times. Real call count
+    // is max(counts), not sum(counts). Summing over-estimates linearly with
+    // catalog size, making multi-pass unreachable for medium+ skill sets.
+    const calls = input.resolved.length === 0
+        ? 0
+        : input.resolved.reduce((max, r) => Math.max(max, r.count), 0);
+    const cost = calls * ceiling;
+    const estimate = {
+        estimatedCalls: calls,
+        estimatedCostUsd: cost,
+        perCallCeilingUsd: ceiling,
+        capUsd: cap,
+    };
+    if (input.billingExempt) {
+        return { verdict: 'allow', estimate };
+    }
+    if (cost > cap) {
+        return {
+            verdict: 'deny',
+            estimate,
+            reason: friendlyDenyReason({ cost, cap, calls, ceiling }),
+        };
+    }
+    return { verdict: 'allow', estimate };
+}
+function friendlyDenyReason(args) {
+    return [
+        `clud-bug paused this review — estimated cost \`$${args.cost.toFixed(2)}\``,
+        `exceeds the per-PR cap of \`$${args.cap.toFixed(2)}\`.`,
+        `(${args.calls} planned AI call${args.calls === 1 ? '' : 's'} ×`,
+        `worst-case \`$${args.ceiling.toFixed(2)}\` per call.)`,
+        'Lower `reviewPasses.count` in `.claude/skills/.clud-bug.json` and re-trigger.',
+    ].join(' ');
+}
+/**
+ * Exposed for tests + future D.4 wiring. Lets callers register a cost
+ * ceiling for a newly-routed model without editing this module.
+ */
+export function __setModelCeilingForTests(model, usd) {
+    if (usd === null) {
+        delete MODEL_CEILING_USD[model];
+        return;
+    }
+    MODEL_CEILING_USD[model] = usd;
+}
+// ---------------------------------------------------------------------------
+// D.2.6 — auto-resolve verifier cost surface
+// ---------------------------------------------------------------------------
+/**
+ * Per-call ceiling for the D.2.6 fix-verifier. Each verifier call is small —
+ * ~500 token I/O at Sonnet rates — so a more aggressive ceiling makes sense
+ * vs the main-review per-call ceiling. We over-state by ~2x to keep the
+ * "$0.10 per PR with 5 findings × 3 fix-pushes" plan budget honest.
+ *
+ * Sonnet 4.6 at $3/$15 per million tokens × 500 token I/O ≈ $0.005;
+ * we use $0.01 as the gate ceiling so a borderline-overbudget verifier doesn't
+ * silently silently flip the install over the cap.
+ */
+const VERIFIER_PER_CALL_CEILING_USD = 0.01;
+/**
+ * Default per-PR budget for D.2.6 verifier calls. The spec calls $0.10 the
+ * "5 findings × 3 fix-pushes" ceiling; we use 2x that as the cap so a
+ * sufficiently-large PR (20 threads × 3 fix-pushes = 60 calls) still fits.
+ *
+ * D.4 will plumb per-install caps; for D.2.6 we use a single repo-wide
+ * default. Installs in BILLING_EXEMPT_ORGS bypass this entirely.
+ */
+export const DEFAULT_VERIFIER_PER_PR_CAP_USD = 0.6;
+/**
+ * Pre-flight gate for the D.2.6 fix-verifier. Called once per fix-push,
+ * BEFORE any verifier call runs. If denied, the orchestrator emits
+ * `skipped: budget` for the entire auto-resolve cycle and routes the
+ * threads through the heuristic fallback (see auto-resolve).
+ *
+ * Behavior:
+ *   billingExempt = true  → allow (bypass cap)
+ *   estimated > cap       → deny
+ *   threadCount === 0     → allow with 0 calls (no-op fix-push, no threads to verify)
+ *   otherwise             → allow
+ */
+export function estimateVerifierBudget(input) {
+    const cap = input.perPrCapUsd ?? DEFAULT_VERIFIER_PER_PR_CAP_USD;
+    const passes = input.passesPerThread ?? 1;
+    const calls = input.threadCount * Math.max(1, passes);
+    const cost = calls * VERIFIER_PER_CALL_CEILING_USD;
+    const estimate = {
+        estimatedCalls: calls,
+        estimatedCostUsd: cost,
+        perCallCeilingUsd: VERIFIER_PER_CALL_CEILING_USD,
+        capUsd: cap,
+    };
+    if (input.billingExempt) {
+        return { verdict: 'allow', estimate };
+    }
+    if (cost > cap) {
+        return {
+            verdict: 'deny',
+            estimate,
+            reason: friendlyVerifierDenyReason({ cost, cap, calls }),
+        };
+    }
+    return { verdict: 'allow', estimate };
+}
+function friendlyVerifierDenyReason(args) {
+    return [
+        `clud-bug paused D.2.6 fix-verification — estimated cost`,
+        `\`$${args.cost.toFixed(2)}\` exceeds the per-PR cap of`,
+        `\`$${args.cap.toFixed(2)}\`. (${args.calls} planned verifier call${args.calls === 1 ? '' : 's'} ×`,
+        `worst-case \`$${VERIFIER_PER_CALL_CEILING_USD.toFixed(2)}\` per call.)`,
+        'Lower `autoResolve.max_threads_per_fix_push` in',
+        '`.claude/skills/.clud-bug.json` or set `autoResolve.mode = "heuristic"`',
+        'to opt out of verified-mode for this install.',
+    ].join(' ');
+}
+//# sourceMappingURL=budget-plan.js.map

package/dist/core/budget-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget-plan.js","sourceRoot":"","sources":["../../src/core/budget-plan.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAA2B;IAChD,4BAA4B,EAAE,IAAI;IAClC,6BAA6B,EAAE,IAAI;IACnC,2BAA2B,EAAE,GAAG;IAChC,2BAA2B,EAAE,GAAG;IAChC,cAAc,EAAE,GAAG;IACnB,gBAAgB,EAAE,IAAI;IACtB,uBAAuB,EAAE,IAAI;IAC7B,+BAA+B,EAAE,GAAG;CACrC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AA+C1C,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACrD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG;YAAE,GAAG,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,sBAAsB,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,KAAK,GAAG,OAAO,CAAC;IAE7B,MAAM,QAAQ,GAAmB;QAC/B,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,OAAO;QAC1B,MAAM,EAAE,GAAG;KACZ,CAAC;IAEF,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,MAAM;YACf,QAAQ;YACR,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAK3B;IACC,OAAO;QACL,mDAAmD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC3E,gCAAgC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;QACxD,IAAI,IAAI,CAAC,KAAK,mBAAmB,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QAChE,iBAAiB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;QACvD,+EAA+E;KAChF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,GAAkB;IAElB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,iBAAiB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAuCnD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA0B;IAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,+BAA+B,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,GAAG,6BAA6B,CAAC;IAEnD,MAAM,QAAQ,GAA2B;QACvC,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,6BAA6B;QAChD,MAAM,EAAE,GAAG;KACZ,CAAC;IAEF,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,MAAM;YACf,QAAQ;YACR,MAAM,EAAE,0BAA0B,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CAAC,IAInC;IACC,OAAO;QACL,yDAAyD;QACzD,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;QACxD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,yBAAyB,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACnG,iBAAiB,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;QACxE,iDAAiD;QACjD,yEAAyE;QACzE,+CAA+C;KAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/core/check-verdict.d.ts

@@ -0,0 +1,31 @@
+/** The check name MUST match consumer branch-protection rules. Do not rename. */
+export declare const CLUD_BUG_CHECK_NAME = "clud-bug-review";
+/** Outcome of a review, as the posting surface sees it. */
+export type ReviewVerdict = 'clean' | 'critical' | 'failed';
+/** The narrowed check-run conclusion set we emit. */
+export type CheckConclusion = 'success' | 'neutral' | 'failure';
+/** Which surface attested the review (drives the title + trust note). */
+export type CheckSource = 'local' | 'ci';
+export interface DerivedCheck {
+    conclusion: CheckConclusion;
+    title: string;
+    summary: string;
+}
+export interface DeriveCheckInput {
+    verdict: ReviewVerdict;
+    /** `.clud-bug.json` strictMode at the BASE ref. Default false (advisory). */
+    strictMode?: boolean;
+    /** Number of critical findings (for the title). */
+    criticalCount?: number;
+    /** 'local' (self-attested in-session) or 'ci' (Action). Default 'ci'. */
+    source?: CheckSource;
+}
+/**
+ * Derive the `clud-bug-review` check conclusion + title/summary from a review
+ * verdict. Pure. A `local` source appends a self-attested trust note so a
+ * reviewer can tell an in-session attestation from an independent CI check.
+ */
+export declare function deriveCheck(input: DeriveCheckInput): DerivedCheck;
+/** Normalize a free-form verdict string (CLI input) to a `ReviewVerdict`. */
+export declare function normalizeVerdict(raw: string | undefined): ReviewVerdict;
+//# sourceMappingURL=check-verdict.d.ts.map

package/dist/core/check-verdict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-verdict.d.ts","sourceRoot":"","sources":["../../src/core/check-verdict.ts"],"names":[],"mappings":"AAkBA,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,2DAA2D;AAC3D,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5D,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,IAAI,CAAC;AAEzC,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,eAAe,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CAkCjE;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAIvE"}

package/dist/core/check-verdict.js

@@ -0,0 +1,66 @@
+// Merge-gate verdict → GitHub check-run conclusion (H3). Shared, pure brain so
+// every surface that posts the `clud-bug-review` check derives the same
+// conclusion from a review outcome.
+//
+// The check name is HARD-CODED `clud-bug-review` everywhere — consumers attach
+// branch-protection rules by that exact string (see clud-bug-app/lib/check-runs.ts).
+//
+// CONCLUSION MODEL for the local + Action surfaces (this module):
+//   clean              → success  (review ran, no critical findings)
+//   critical + strict  → failure  (BLOCKS merge — fix the criticals)
+//   critical + !strict → neutral  (advisory; does not block)
+//   failed             → neutral  (couldn't run; never blocks — add signal, not outages)
+//
+// This intentionally differs from the HOSTED bot, whose check is success-on-run
+// and whose strict-mode block is a separate `request_changes` formal review. In
+// local/Action mode there is no formal review, so the check IS the gate — its
+// conclusion reflects the findings directly.
+/** The check name MUST match consumer branch-protection rules. Do not rename. */
+export const CLUD_BUG_CHECK_NAME = 'clud-bug-review';
+/**
+ * Derive the `clud-bug-review` check conclusion + title/summary from a review
+ * verdict. Pure. A `local` source appends a self-attested trust note so a
+ * reviewer can tell an in-session attestation from an independent CI check.
+ */
+export function deriveCheck(input) {
+    const { verdict, strictMode = false, criticalCount = 0, source = 'ci' } = input;
+    const selfAttested = source === 'local'
+        ? ' (self-attested by a local max-mode review in the author’s session — not an independent CI check)'
+        : '';
+    let conclusion;
+    let title;
+    let summary;
+    if (verdict === 'clean') {
+        conclusion = 'success';
+        title = 'clud-bug review — clean';
+        summary = `No critical findings.${selfAttested}`;
+    }
+    else if (verdict === 'critical') {
+        const n = criticalCount > 0 ? `${criticalCount} ` : '';
+        if (strictMode) {
+            conclusion = 'failure';
+            title = `clud-bug review — ${n}critical (blocking)`;
+            summary = `${n}critical finding(s); strict mode blocks merge until they are resolved.${selfAttested}`;
+        }
+        else {
+            conclusion = 'neutral';
+            title = `clud-bug review — ${n}critical (advisory)`;
+            summary = `${n}critical finding(s); advisory only (strict mode off) — does not block merge.${selfAttested}`;
+        }
+    }
+    else {
+        // failed — never block on our own inability to run.
+        conclusion = 'neutral';
+        title = 'clud-bug review — could not run';
+        summary = `The review could not complete; the PR is not blocked. Re-run to retry.${selfAttested}`;
+    }
+    return { conclusion, title, summary };
+}
+/** Normalize a free-form verdict string (CLI input) to a `ReviewVerdict`. */
+export function normalizeVerdict(raw) {
+    if (raw === 'clean' || raw === 'critical' || raw === 'failed')
+        return raw;
+    // Unknown/empty → 'failed' (safe: neutral check, never a false-green).
+    return 'failed';
+}
+//# sourceMappingURL=check-verdict.js.map

package/dist/core/check-verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-verdict.js","sourceRoot":"","sources":["../../src/core/check-verdict.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,+EAA+E;AAC/E,qFAAqF;AACrF,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,qEAAqE;AACrE,6DAA6D;AAC7D,yFAAyF;AACzF,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,6CAA6C;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AA2BrD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,KAAK,EAAE,aAAa,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAChF,MAAM,YAAY,GAChB,MAAM,KAAK,OAAO;QAChB,CAAC,CAAC,mGAAmG;QACrG,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,UAA2B,CAAC;IAChC,IAAI,KAAa,CAAC;IAClB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,UAAU,GAAG,SAAS,CAAC;QACvB,KAAK,GAAG,yBAAyB,CAAC;QAClC,OAAO,GAAG,wBAAwB,YAAY,EAAE,CAAC;IACnD,CAAC;SAAM,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,SAAS,CAAC;YACvB,KAAK,GAAG,qBAAqB,CAAC,qBAAqB,CAAC;YACpD,OAAO,GAAG,GAAG,CAAC,yEAAyE,YAAY,EAAE,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,SAAS,CAAC;YACvB,KAAK,GAAG,qBAAqB,CAAC,qBAAqB,CAAC;YACpD,OAAO,GAAG,GAAG,CAAC,+EAA+E,YAAY,EAAE,CAAC;QAC9G,CAAC;IACH,CAAC;SAAM,CAAC;QACN,oDAAoD;QACpD,UAAU,GAAG,SAAS,CAAC;QACvB,KAAK,GAAG,iCAAiC,CAAC;QAC1C,OAAO,GAAG,yEAAyE,YAAY,EAAE,CAAC;IACpG,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1E,uEAAuE;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/core/configure-github.d.ts

@@ -0,0 +1,179 @@
+/**
+ * The canonical-v1.json structure. Frozen at v1; major bumps require
+ * coordinated tool releases per the protocol repo's `$comment` field.
+ */
+export interface CanonicalRuleset {
+    version: 'v1';
+    spec_version: string;
+    branch_protection: {
+        required_status_checks: {
+            strict: boolean;
+            contexts: string[];
+        };
+        required_pull_request_reviews: {
+            required_approving_review_count: number;
+            dismiss_stale_reviews: boolean;
+            require_code_owner_reviews: boolean;
+        };
+        required_conversation_resolution: boolean;
+        enforce_admins: boolean;
+        allow_force_pushes: boolean;
+        allow_deletions: boolean;
+        required_linear_history: boolean;
+        allow_auto_merge: boolean;
+        delete_branch_on_merge: boolean;
+        squash_merge_commit_title: string;
+        squash_merge_commit_message: string;
+    };
+}
+/**
+ * Loads the bundled canonical-v1 ruleset from `data/canonical-v1.json`.
+ * Memoized so repeated calls don't re-hit the filesystem.
+ *
+ * Throws a wrapped error if the JSON file is missing — that's an
+ * install-time defect (package.json `files` excluded `data/`), not a
+ * runtime concern, and the loud failure surfaces it immediately.
+ */
+export declare function loadCanonicalV1(): Promise<CanonicalRuleset>;
+/**
+ * Minimal structural Octokit interface — only the methods we actually call.
+ *
+ * We intentionally don't import `@octokit/rest` types: that would force
+ * every consumer (App, CLI, future tools) to install Octokit at runtime
+ * even when they pass a `gh`-CLI-backed adapter. Keeping the shape
+ * structural lets the CLI's `gh`-wrapping adapter satisfy it without
+ * pulling in a 200KB dep.
+ *
+ * If `@octokit/rest`'s real method shapes ever drift, the adapter +
+ * runtime call sites are the only files that need updating; the rule
+ * table here stays Octokit-version-agnostic.
+ */
+export interface OctokitLike {
+    repos: {
+        /** Read branch protection state. Throws on 404 (no protection rule). */
+        getBranchProtection(params: {
+            owner: string;
+            repo: string;
+            branch: string;
+        }): Promise<{
+            data: {
+                required_status_checks?: {
+                    strict?: boolean;
+                    contexts?: string[];
+                } | null;
+                required_pull_request_reviews?: {
+                    required_approving_review_count?: number;
+                    dismiss_stale_reviews?: boolean;
+                    require_code_owner_reviews?: boolean;
+                } | null;
+                required_conversation_resolution?: {
+                    enabled?: boolean;
+                } | null;
+                enforce_admins?: {
+                    enabled?: boolean;
+                } | null;
+                allow_force_pushes?: {
+                    enabled?: boolean;
+                } | null;
+                allow_deletions?: {
+                    enabled?: boolean;
+                } | null;
+                required_linear_history?: {
+                    enabled?: boolean;
+                } | null;
+            };
+        }>;
+        /** PUT branch protection (the REST API does NOT support PATCH). */
+        updateBranchProtection(params: {
+            owner: string;
+            repo: string;
+            branch: string;
+            required_status_checks: {
+                strict: boolean;
+                contexts: string[];
+            } | null;
+            enforce_admins: boolean | null;
+            required_pull_request_reviews: {
+                required_approving_review_count: number;
+                dismiss_stale_reviews: boolean;
+                require_code_owner_reviews: boolean;
+            } | null;
+            restrictions: null;
+            required_conversation_resolution?: boolean;
+            required_linear_history?: boolean;
+            allow_force_pushes?: boolean;
+            allow_deletions?: boolean;
+        }): Promise<unknown>;
+        /** Read repo-level settings (delete_branch_on_merge, allow_auto_merge, etc). */
+        get(params: {
+            owner: string;
+            repo: string;
+        }): Promise<{
+            data: {
+                delete_branch_on_merge?: boolean;
+                allow_auto_merge?: boolean;
+                squash_merge_commit_title?: string;
+                squash_merge_commit_message?: string;
+            };
+        }>;
+        /** PATCH repo-level settings. */
+        update(params: {
+            owner: string;
+            repo: string;
+            delete_branch_on_merge?: boolean;
+            allow_auto_merge?: boolean;
+            squash_merge_commit_title?: string;
+            squash_merge_commit_message?: string;
+        }): Promise<unknown>;
+    };
+}
+export interface ApplyCanonicalRulesetParams {
+    owner: string;
+    repo: string;
+    /**
+     * Target branch (default: `main`). Most consumers will use `main`; this
+     * is exposed for downstream tools that converge non-`main` defaults.
+     */
+    branch?: string;
+    /**
+     * The ruleset to apply. Defaults to the bundled `canonical-v1.json`
+     * (loaded via `loadCanonicalV1()` if absent). Future v2 callers pass
+     * an explicit ruleset; the type system pins the shape.
+     */
+    ruleset?: CanonicalRuleset;
+    /**
+     * If true, compute diff only and skip all PATCH calls. The result still
+     * reports `changes: string[]` so the CLI can render the human-readable
+     * diff before applying.
+     */
+    dryRun?: boolean;
+}
+export interface ApplyResult {
+    /** Human-readable diff lines, one per detected difference. Empty when alreadyCanonical. */
+    changes: string[];
+    /** True when the live state already matches every canonical setting. */
+    alreadyCanonical: boolean;
+    /** Schema version applied (always 'canonical-v1' for this build). */
+    ruleset: 'canonical-v1';
+}
+/**
+ * Applies the canonical ruleset to a GitHub repo. Reads current state via
+ * the Octokit-like instance, diffs against `ruleset` (default
+ * `CANONICAL_V1`), and PATCHes only what differs. Idempotent: second call
+ * returns `alreadyCanonical: true` with no PATCH side effects.
+ *
+ * Behavior on partial mismatch:
+ *
+ *   - `required_status_checks.contexts`: canonical contexts that are
+ *     missing get added; extra contexts on the repo are preserved (superset
+ *     contract — a repo that runs more CI gates legitimately needs them).
+ *   - `required_approving_review_count`: canonical floor is 1; if the repo
+ *     already requires more, we don't lower (raise-only contract).
+ *   - All booleans (allow_force_pushes, allow_deletions, etc.): converge
+ *     to the canonical value exactly.
+ *
+ * Throws on Octokit transport failure (auth, network, 403). The CLI
+ * wraps these with a friendly error message.
+ */
+export declare function applyCanonicalRuleset(octokit: OctokitLike, params: ApplyCanonicalRulesetParams): Promise<ApplyResult>;
+//# sourceMappingURL=configure-github.d.ts.map

package/dist/core/configure-github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-github.d.ts","sourceRoot":"","sources":["../../src/core/configure-github.ts"],"names":[],"mappings":"AA+CA;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,IAAI,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE;QACjB,sBAAsB,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC;YAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;SACpB,CAAC;QACF,6BAA6B,EAAE;YAC7B,+BAA+B,EAAE,MAAM,CAAC;YACxC,qBAAqB,EAAE,OAAO,CAAC;YAC/B,0BAA0B,EAAE,OAAO,CAAC;SACrC,CAAC;QACF,gCAAgC,EAAE,OAAO,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,eAAe,EAAE,OAAO,CAAC;QACzB,uBAAuB,EAAE,OAAO,CAAC;QACjC,gBAAgB,EAAE,OAAO,CAAC;QAC1B,sBAAsB,EAAE,OAAO,CAAC;QAChC,yBAAyB,EAAE,MAAM,CAAC;QAClC,2BAA2B,EAAE,MAAM,CAAC;KACrC,CAAC;CACH;AAYD;;;;;;;GAOG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAajE;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE;QACL,wEAAwE;QACxE,mBAAmB,CAAC,MAAM,EAAE;YAC1B,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,EAAE,MAAM,CAAC;SAChB,GAAG,OAAO,CAAC;YACV,IAAI,EAAE;gBACJ,sBAAsB,CAAC,EACnB;oBAAE,MAAM,CAAC,EAAE,OAAO,CAAC;oBAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;iBAAE,GACzC,IAAI,CAAC;gBACT,6BAA6B,CAAC,EAC1B;oBACE,+BAA+B,CAAC,EAAE,MAAM,CAAC;oBACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;oBAChC,0BAA0B,CAAC,EAAE,OAAO,CAAC;iBACtC,GACD,IAAI,CAAC;gBACT,gCAAgC,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE,OAAO,CAAA;iBAAE,GAAG,IAAI,CAAC;gBAChE,cAAc,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE,OAAO,CAAA;iBAAE,GAAG,IAAI,CAAC;gBAC9C,kBAAkB,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE,OAAO,CAAA;iBAAE,GAAG,IAAI,CAAC;gBAClD,eAAe,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE,OAAO,CAAA;iBAAE,GAAG,IAAI,CAAC;gBAC/C,uBAAuB,CAAC,EAAE;oBAAE,OAAO,CAAC,EAAE,OAAO,CAAA;iBAAE,GAAG,IAAI,CAAC;aACxD,CAAC;SACH,CAAC,CAAC;QACH,mEAAmE;QACnE,sBAAsB,CAAC,MAAM,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,EAAE,MAAM,CAAC;YACf,sBAAsB,EAAE;gBAAE,MAAM,EAAE,OAAO,CAAC;gBAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;aAAE,GAAG,IAAI,CAAC;YACvE,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;YAC/B,6BAA6B,EAAE;gBAC7B,+BAA+B,EAAE,MAAM,CAAC;gBACxC,qBAAqB,EAAE,OAAO,CAAC;gBAC/B,0BAA0B,EAAE,OAAO,CAAC;aACrC,GAAG,IAAI,CAAC;YACT,YAAY,EAAE,IAAI,CAAC;YACnB,gCAAgC,CAAC,EAAE,OAAO,CAAC;YAC3C,uBAAuB,CAAC,EAAE,OAAO,CAAC;YAClC,kBAAkB,CAAC,EAAE,OAAO,CAAC;YAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;SAC3B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,gFAAgF;QAChF,GAAG,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YACpD,IAAI,EAAE;gBACJ,sBAAsB,CAAC,EAAE,OAAO,CAAC;gBACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;gBAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;gBACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;aACtC,CAAC;SACH,CAAC,CAAC;QACH,iCAAiC;QACjC,MAAM,CAAC,MAAM,EAAE;YACb,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,sBAAsB,CAAC,EAAE,OAAO,CAAC;YACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;YAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;YACnC,2BAA2B,CAAC,EAAE,MAAM,CAAC;SACtC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,WAAW,CAAC,CAmOtB"}