vouchington-tooling 0.0.13 → 0.0.14

package/README.md

@@ -50,8 +50,12 @@ import {
 import { initSqlAst, extractCreateTableMetadata } from 'vouchington-tooling/sql-ast'
 import { splitSqlStatements, stripSqlComments } from 'vouchington-tooling/sql-scanner'
 import { auditCiJobRuntime } from 'vouchington-tooling/gha-runtime-audit'
-import { writeVitestBlobManifest } from 'vouchington-tooling/vitest-blob-manifest'
-import { runInstallLifecycle } from 'vouchington-tooling/pnpm-install'
+import {
+  readVitestReportAttempts,
+  writeVitestBlobManifest,
+} from 'vouchington-tooling/vitest-blob-manifest'
+import { prepareVitestReports } from 'vouchington-tooling/vitest-reports'
+import { runInstallLifecycle, validateReleaseAgePolicy } from 'vouchington-tooling/pnpm-install'
 import {
   buildSharedContext,
   installFakeGit,
@@ -69,4 +73,14 @@ import {
   renderSchemaMarkdown,
 } from 'vouchington-tooling/pg-schema-snapshot'
 import { buildOpenApiDocument, writeOpenApi } from 'vouchington-tooling/openapi-document'
+import { decide, deriveRetryAttempt } from 'vouchington-tooling/transient-retry'
+import { parseCsvRows, streamCsvRows } from 'vouchington-tooling/csv'
+import { readResponseBody } from 'vouchington-tooling/http-body'
+import { runAstGrepRule } from 'vouchington-tooling/ast-grep-rule'
+import { parseReviewPayload, remapReviewComments } from 'vouchington-tooling/gha-review-payload'
+import { nextPageUrlFromLinkHeader } from 'vouchington-tooling/http-link-pagination'
 ```
+
+The artifact, review-payload, HTTP body, and pagination APIs validate untrusted inputs at their
+boundaries. They do not include provider credentials, product policy, network transport, or
+repository-specific package names; consumers supply those through their own adapters.

package/dist/ast-grep-rule/index.d.mts

@@ -0,0 +1,13 @@
+export interface AstGrepRuleInvocation {
+    readonly ruleId: string;
+    readonly passthrough: readonly string[];
+}
+export interface RunAstGrepRuleOptions {
+    readonly args: readonly string[];
+    readonly cwd?: string;
+    readonly rulesDirectory?: string;
+    readonly executable?: string;
+    readonly defaultScanArguments?: readonly string[];
+}
+export declare function parseAstGrepRuleArgs(args: readonly string[]): AstGrepRuleInvocation;
+export declare function runAstGrepRule(options: RunAstGrepRuleOptions): Promise<number>;

package/dist/ast-grep-rule/index.mjs

@@ -0,0 +1,43 @@
+import { spawn } from 'node:child_process';
+import { existsSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+export function parseAstGrepRuleArgs(args) {
+    const normalized = args[0] === '--' ? args.slice(1) : args;
+    const [ruleId, ...passthrough] = normalized;
+    if (!ruleId)
+        throw new Error('Expected an AST-grep rule id');
+    if (ruleId.startsWith('-') || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(ruleId)) {
+        throw new Error(`Invalid AST-grep rule id: ${ruleId}`);
+    }
+    return { ruleId, passthrough };
+}
+function containedRulePath(rulesDirectory, ruleId) {
+    const root = realpathSync(rulesDirectory);
+    const path = realpathSync(join(root, `${ruleId}.yml`));
+    if (resolve(path).startsWith(`${resolve(root)}/`))
+        return path;
+    throw new Error(`AST-grep rule resolves outside the rules directory: ${ruleId}`);
+}
+export function runAstGrepRule(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const rulesDirectory = resolve(cwd, options.rulesDirectory ?? 'ast-grep-rules');
+    const { ruleId, passthrough } = parseAstGrepRuleArgs(options.args);
+    const unresolvedRulePath = join(rulesDirectory, `${ruleId}.yml`);
+    if (!existsSync(unresolvedRulePath))
+        throw new Error(`Unknown AST-grep rule id: ${ruleId}`);
+    const rulePath = containedRulePath(rulesDirectory, ruleId);
+    const executable = resolve(cwd, options.executable ?? join('node_modules', '@ast-grep', 'cli', 'ast-grep'));
+    const defaults = options.defaultScanArguments ?? [
+        '--no-ignore',
+        'hidden',
+        '--off=unused-suppression',
+    ];
+    return new Promise((resolveResult, reject) => {
+        const child = spawn(executable, ['scan', ...defaults, '--rule', rulePath, ...passthrough], {
+            cwd,
+            stdio: 'inherit',
+        });
+        child.once('error', reject);
+        child.once('close', (code) => resolveResult(code ?? 1));
+    });
+}

package/dist/csv/index.d.mts

@@ -0,0 +1,5 @@
+import type { Transform } from 'node:stream';
+export declare function stripCsvBom(text: string): string;
+export declare function parseCsvRows(csvText: string): Record<string, string>[];
+export declare function escapeSpreadsheetFormula(value: string | null | undefined): string;
+export declare function streamCsvRows(rows: readonly Readonly<Record<string, string | null | undefined>>[], columns: readonly string[]): Transform;

package/dist/csv/index.mjs

@@ -0,0 +1,31 @@
+import { parse as parseSync } from 'csv-parse/sync';
+import { stringify } from 'csv-stringify';
+const SPREADSHEET_FORMULA_PREFIX = /^[=+\-@\t\r]/u;
+export function stripCsvBom(text) {
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+export function parseCsvRows(csvText) {
+    return parseSync(stripCsvBom(csvText), {
+        columns: true,
+        skip_empty_lines: true,
+        trim: true,
+        relax_column_count: false,
+    });
+}
+export function escapeSpreadsheetFormula(value) {
+    if (value == null)
+        return '';
+    return SPREADSHEET_FORMULA_PREFIX.test(value) ? `'${value}` : value;
+}
+export function streamCsvRows(rows, columns) {
+    const stringifier = stringify({ header: true, columns: [...columns] });
+    stringifier.on('error', (error) => stringifier.destroy(error));
+    for (const row of rows) {
+        const escaped = {};
+        for (const key of columns)
+            escaped[key] = escapeSpreadsheetFormula(row[key]);
+        stringifier.write(escaped);
+    }
+    stringifier.end();
+    return stringifier;
+}

package/dist/gha-review-payload/diff.d.mts

@@ -0,0 +1,30 @@
+import type { ReviewSide } from './payload.mts';
+export type LineKind = 'add' | 'del' | 'context';
+export type ReviewFile = {
+    filename: string;
+    previous_filename?: string;
+    patch?: string;
+    status?: string;
+};
+export type CommentableIndex = {
+    resolvePath(path: string): string | undefined;
+    hasPatch(path: string): boolean;
+    has(path: string, side: ReviewSide, line: number): boolean;
+    kind(path: string, side: ReviewSide, line: number): LineKind | undefined;
+    candidates(path: string, side: ReviewSide): Array<{
+        line: number;
+        kind: LineKind;
+    }>;
+};
+export type CommentableLine = {
+    path: string;
+    side: ReviewSide;
+    line: number;
+    kind: LineKind;
+};
+/** Indexes added, deleted, and context lines from a unified diff hunk. */
+export declare function parsePatchCommentable(path: string, patch: string): CommentableLine[];
+/** Parses one or concatenated paginated JSON responses, dropping malformed file entries. */
+export declare function parseReviewFilesJson(text: string): ReviewFile[];
+/** Creates a fast path/side/line lookup and retains rename aliases. */
+export declare function indexReviewFiles(files: readonly ReviewFile[]): CommentableIndex;

package/dist/gha-review-payload/diff.mjs

@@ -0,0 +1,121 @@
+const HUNK_RE = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/u;
+/** Indexes added, deleted, and context lines from a unified diff hunk. */
+export function parsePatchCommentable(path, patch) {
+    const lines = [];
+    let oldLine = 0;
+    let newLine = 0;
+    let inHunk = false;
+    for (const raw of patch.split('\n')) {
+        const hunk = HUNK_RE.exec(raw);
+        if (hunk) {
+            oldLine = Number(hunk[1]);
+            newLine = Number(hunk[2]);
+            inHunk = true;
+            continue;
+        }
+        if (!inHunk || raw.length === 0 || raw.startsWith('\\'))
+            continue;
+        const marker = raw[0];
+        if (marker === '-') {
+            lines.push({ path, side: 'LEFT', line: oldLine, kind: 'del' });
+            oldLine += 1;
+        }
+        else if (marker === '+') {
+            lines.push({ path, side: 'RIGHT', line: newLine, kind: 'add' });
+            newLine += 1;
+        }
+        else {
+            lines.push({ path, side: 'LEFT', line: oldLine, kind: 'context' });
+            lines.push({ path, side: 'RIGHT', line: newLine, kind: 'context' });
+            oldLine += 1;
+            newLine += 1;
+        }
+    }
+    return lines;
+}
+function asReviewFiles(parsed) {
+    const items = Array.isArray(parsed) ? parsed : [parsed];
+    return items.flatMap((item) => {
+        if (item === null || typeof item !== 'object')
+            return [];
+        const record = item;
+        if (typeof record.filename !== 'string' || record.filename.length === 0)
+            return [];
+        const file = { filename: record.filename };
+        if (typeof record.previous_filename === 'string')
+            file.previous_filename = record.previous_filename;
+        if (typeof record.patch === 'string')
+            file.patch = record.patch;
+        if (typeof record.status === 'string')
+            file.status = record.status;
+        return [file];
+    });
+}
+/** Parses one or concatenated paginated JSON responses, dropping malformed file entries. */
+export function parseReviewFilesJson(text) {
+    const trimmed = text.trim();
+    if (trimmed.length === 0)
+        return [];
+    try {
+        return asReviewFiles(JSON.parse(trimmed));
+    }
+    catch {
+        try {
+            const wrapped = `[${trimmed
+                .replace(/^\[/u, '')
+                .replace(/\]$/u, '')
+                .replace(/\]\s*\[/gu, ',')}]`;
+            return asReviewFiles(JSON.parse(wrapped));
+        }
+        catch {
+            return [];
+        }
+    }
+}
+function entryKey(path, side, line) {
+    return `${path}\0${side}\0${line}`;
+}
+/** Creates a fast path/side/line lookup and retains rename aliases. */
+export function indexReviewFiles(files) {
+    const byKey = new Map();
+    const aliases = new Map();
+    const patched = new Set();
+    const known = new Set();
+    for (const file of files) {
+        known.add(file.filename);
+        if (file.previous_filename)
+            aliases.set(file.previous_filename, file.filename);
+        if (file.patch === undefined || file.patch.length === 0)
+            continue;
+        patched.add(file.filename);
+        for (const entry of parsePatchCommentable(file.filename, file.patch)) {
+            byKey.set(entryKey(entry.path, entry.side, entry.line), entry.kind);
+        }
+    }
+    return {
+        resolvePath(path) {
+            if (known.has(path))
+                return path;
+            return aliases.get(path);
+        },
+        hasPatch(path) {
+            return patched.has(path);
+        },
+        has(path, side, line) {
+            return byKey.has(entryKey(path, side, line));
+        },
+        kind(path, side, line) {
+            return byKey.get(entryKey(path, side, line));
+        },
+        candidates(path, side) {
+            const prefix = `${path}\0${side}\0`;
+            const found = [];
+            for (const [key, kind] of byKey) {
+                if (!key.startsWith(prefix))
+                    continue;
+                found.push({ line: Number(key.slice(prefix.length)), kind });
+            }
+            return found;
+        },
+    };
+}

package/dist/gha-review-payload/file.d.mts

@@ -0,0 +1,7 @@
+export type PayloadRequirement = 'optional' | 'required';
+/** Reads a bounded regular file through an O_NOFOLLOW descriptor. */
+export declare function readRegularReviewPayload(source: string, requirement: PayloadRequirement): Buffer | undefined;
+/** Replaces a private staging directory and writes a 0600 payload from descriptor-read bytes. */
+export declare function stageReviewPayload(source: string, destinationDirectory: string, requirement: PayloadRequirement): string | undefined;
+/** Writes a single output value for a caller that exposes GitHub Actions outputs. */
+export declare function writeStagedOutput(name: string, value: string, outputPath?: string | undefined): void;

package/dist/gha-review-payload/file.mjs

@@ -0,0 +1,62 @@
+import { appendFileSync, chmodSync, closeSync, constants, fstatSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
+import { basename, join } from 'node:path';
+import { MAX_REVIEW_PAYLOAD_BYTES, ReviewPayloadError } from './payload.mjs';
+/** Reads a bounded regular file through an O_NOFOLLOW descriptor. */
+export function readRegularReviewPayload(source, requirement) {
+    let descriptor;
+    try {
+        descriptor = openSync(source, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOENT' && requirement === 'optional')
+            return undefined;
+        if (code === 'ENOENT')
+            throw new ReviewPayloadError('Review payload is required.');
+        if (code === 'ELOOP') {
+            throw new ReviewPayloadError('Review payload must be a regular non-symlink file.');
+        }
+        throw error;
+    }
+    try {
+        const stat = fstatSync(descriptor);
+        if (!stat.isFile()) {
+            throw new ReviewPayloadError('Review payload must be a regular non-symlink file.');
+        }
+        if (stat.size === 0 || stat.size > MAX_REVIEW_PAYLOAD_BYTES) {
+            throw new ReviewPayloadError(`Review payload must be 1..${MAX_REVIEW_PAYLOAD_BYTES} bytes.`);
+        }
+        const bytes = readFileSync(descriptor);
+        if (bytes.length === 0 || bytes.length > MAX_REVIEW_PAYLOAD_BYTES) {
+            throw new ReviewPayloadError(`Review payload must be 1..${MAX_REVIEW_PAYLOAD_BYTES} bytes.`);
+        }
+        return bytes;
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+/** Replaces a private staging directory and writes a 0600 payload from descriptor-read bytes. */
+export function stageReviewPayload(source, destinationDirectory, requirement) {
+    rmSync(destinationDirectory, { force: true, recursive: true });
+    const bytes = readRegularReviewPayload(source, requirement);
+    if (!bytes)
+        return undefined;
+    mkdirSync(destinationDirectory, { recursive: true, mode: 0o700 });
+    const destination = join(destinationDirectory, basename(source));
+    writeFileSync(destination, bytes, { flag: 'wx', mode: 0o600 });
+    chmodSync(destination, 0o600);
+    return destination;
+}
+/** Writes a single output value for a caller that exposes GitHub Actions outputs. */
+export function writeStagedOutput(name, value, outputPath = process.env.GITHUB_OUTPUT) {
+    if (!outputPath)
+        throw new ReviewPayloadError('GITHUB_OUTPUT is required.');
+    if (!/^[A-Za-z_][A-Za-z0-9_-]*$/u.test(name)) {
+        throw new ReviewPayloadError('Output name must contain only letters, numbers, underscores, and hyphens.');
+    }
+    if (/[\r\n]/u.test(value)) {
+        throw new ReviewPayloadError('Output value must not contain CR or LF characters.');
+    }
+    appendFileSync(outputPath, `${name}=${value}\n`);
+}

package/dist/gha-review-payload/index.d.mts

@@ -0,0 +1,7 @@
+export { MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, ReviewPayloadError, bodyOnlyReviewFallback, parseReviewPayload, reviewCommentSubject, } from './payload.mts';
+export type { ReviewComment, ReviewSide, SanitizedReview } from './payload.mts';
+export { indexReviewFiles, parsePatchCommentable, parseReviewFilesJson } from './diff.mts';
+export type { CommentableIndex, CommentableLine, LineKind, ReviewFile } from './diff.mts';
+export { nearestReviewLine, remapReviewComments, rewriteSnappedSuggestion, snapReviewNote, } from './remap.mts';
+export { readRegularReviewPayload, stageReviewPayload, writeStagedOutput } from './file.mts';
+export type { PayloadRequirement } from './file.mts';

package/dist/gha-review-payload/index.mjs

@@ -0,0 +1,4 @@
+export { MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, ReviewPayloadError, bodyOnlyReviewFallback, parseReviewPayload, reviewCommentSubject, } from './payload.mjs';
+export { indexReviewFiles, parsePatchCommentable, parseReviewFilesJson } from './diff.mjs';
+export { nearestReviewLine, remapReviewComments, rewriteSnappedSuggestion, snapReviewNote, } from './remap.mjs';
+export { readRegularReviewPayload, stageReviewPayload, writeStagedOutput } from './file.mjs';

package/dist/gha-review-payload/payload.d.mts

@@ -0,0 +1,30 @@
+/** Maximum serialized review payload accepted at the credential boundary. */
+export declare const MAX_REVIEW_PAYLOAD_BYTES: number;
+/** Maximum inline comments emitted in one review request. */
+export declare const MAX_REVIEW_COMMENTS = 15;
+export declare class ReviewPayloadError extends Error {
+    constructor(message: string);
+}
+export type ReviewSide = 'LEFT' | 'RIGHT';
+export type ReviewComment = {
+    path: string;
+    line: number;
+    side: ReviewSide;
+    body: string;
+    start_line?: number;
+    start_side?: ReviewSide;
+};
+export type SanitizedReview = {
+    event: 'COMMENT';
+    commit_id: string;
+    body: string;
+    comments: ReviewComment[];
+};
+export declare function reviewCommentSubject(comment: ReviewComment): string;
+/**
+ * Parses untrusted JSON into the exact review wire shape accepted by the caller's poster.
+ * Unknown fields and malformed comments are dropped; the supplied commit id always wins.
+ */
+export declare function parseReviewPayload(bytes: Buffer, commitId: string): SanitizedReview;
+/** Builds the body-only fallback used when inline review placement is rejected. */
+export declare function bodyOnlyReviewFallback(review: SanitizedReview, status: number): SanitizedReview;

package/dist/gha-review-payload/payload.mjs

@@ -0,0 +1,111 @@
+/** Maximum serialized review payload accepted at the credential boundary. */
+export const MAX_REVIEW_PAYLOAD_BYTES = 256 * 1024;
+/** Maximum inline comments emitted in one review request. */
+export const MAX_REVIEW_COMMENTS = 15;
+export class ReviewPayloadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ReviewPayloadError';
+    }
+}
+function isPositiveInt(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0;
+}
+function isCommitId(value) {
+    return /^[0-9a-f]{40}$/u.test(value);
+}
+function sanitizeComment(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const record = raw;
+    if (typeof record.path !== 'string' || record.path.length === 0 || record.path.includes('\0')) {
+        return null;
+    }
+    if (!isPositiveInt(record.line))
+        return null;
+    if (record.side !== 'LEFT' && record.side !== 'RIGHT')
+        return null;
+    if (typeof record.body !== 'string' || record.body.length === 0)
+        return null;
+    const comment = {
+        path: record.path,
+        line: record.line,
+        side: record.side,
+        body: record.body,
+    };
+    if (!('start_line' in record))
+        return comment;
+    if (!isPositiveInt(record.start_line) || record.start_line > record.line)
+        return null;
+    if (record.start_side !== 'LEFT' && record.start_side !== 'RIGHT')
+        return null;
+    comment.start_line = record.start_line;
+    comment.start_side = record.start_side;
+    return comment;
+}
+export function reviewCommentSubject(comment) {
+    const firstLine = comment.body.split('\n', 1)[0] ?? '';
+    return `${comment.path}:${comment.line} - ${firstLine}`;
+}
+/**
+ * Parses untrusted JSON into the exact review wire shape accepted by the caller's poster.
+ * Unknown fields and malformed comments are dropped; the supplied commit id always wins.
+ */
+export function parseReviewPayload(bytes, commitId) {
+    if (!isCommitId(commitId)) {
+        throw new ReviewPayloadError('commitId must be a 40-character lowercase hexadecimal commit SHA.');
+    }
+    if (bytes.length === 0 || bytes.length > MAX_REVIEW_PAYLOAD_BYTES) {
+        throw new ReviewPayloadError(`Payload must be a non-empty JSON object of at most ${MAX_REVIEW_PAYLOAD_BYTES} bytes.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        throw new ReviewPayloadError('Payload is not valid JSON.');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new ReviewPayloadError('Payload must be a JSON object.');
+    }
+    const record = parsed;
+    const body = typeof record.body === 'string' ? record.body : '';
+    const rawComments = Array.isArray(record.comments) ? record.comments : [];
+    const valid = rawComments.flatMap((comment) => {
+        const sanitized = sanitizeComment(comment);
+        return sanitized ? [sanitized] : [];
+    });
+    const kept = valid.slice(0, MAX_REVIEW_COMMENTS);
+    const overflow = valid.slice(MAX_REVIEW_COMMENTS);
+    const parts = [body];
+    if (overflow.length > 0) {
+        parts.push(`## Comments over the ${MAX_REVIEW_COMMENTS}-comment cap`, ...overflow.map((comment) => `- ${reviewCommentSubject(comment)}`));
+    }
+    const reviewBody = parts.filter((part) => part.length > 0).join('\n\n');
+    if (reviewBody.length === 0 && kept.length === 0) {
+        throw new ReviewPayloadError('Payload has no review body and no valid comments.');
+    }
+    return {
+        event: 'COMMENT',
+        commit_id: commitId,
+        body: reviewBody.length > 0 ? reviewBody : 'Inline findings only.',
+        comments: kept,
+    };
+}
+/** Builds the body-only fallback used when inline review placement is rejected. */
+export function bodyOnlyReviewFallback(review, status) {
+    const listed = review.comments.length === 0
+        ? []
+        : [
+            '## Inline findings not posted',
+            `The inline comments were rejected (HTTP ${status}). The findings were:`,
+            ...review.comments.map((comment) => `- ${reviewCommentSubject(comment)}`),
+        ];
+    const body = [review.body, ...listed].filter((part) => part.length > 0).join('\n\n');
+    return {
+        event: 'COMMENT',
+        commit_id: review.commit_id,
+        body: body.length > 0 ? body : `Inline findings not posted (HTTP ${status}).`,
+        comments: [],
+    };
+}

package/dist/gha-review-payload/remap.d.mts

@@ -0,0 +1,13 @@
+import { type SanitizedReview } from './payload.mts';
+import type { CommentableIndex, LineKind } from './diff.mts';
+export declare function snapReviewNote(path: string, line: number): string;
+export declare function rewriteSnappedSuggestion(body: string): string;
+export declare function nearestReviewLine(candidates: Array<{
+    line: number;
+    kind: LineKind;
+}>, line: number): {
+    line: number;
+    kind: LineKind;
+} | undefined;
+/** Places comments on commentable diff lines, remapping renames and recording dropped findings. */
+export declare function remapReviewComments(review: SanitizedReview, index: CommentableIndex): SanitizedReview;

package/dist/gha-review-payload/remap.mjs

@@ -0,0 +1,89 @@
+import { reviewCommentSubject } from './payload.mjs';
+export function snapReviewNote(path, line) {
+    return `_Regarding \`${path}:${line}\` (not in the diff hunk; posted on the nearest commentable line)._`;
+}
+export function rewriteSnappedSuggestion(body) {
+    return body.replace(/```suggestion\b/gu, '```');
+}
+function otherSide(side) {
+    return side === 'LEFT' ? 'RIGHT' : 'LEFT';
+}
+export function nearestReviewLine(candidates, line) {
+    if (candidates.length === 0)
+        return undefined;
+    return candidates.reduce((best, current) => {
+        const bestDist = Math.abs(best.line - line);
+        const currentDist = Math.abs(current.line - line);
+        if (currentDist !== bestDist)
+            return currentDist < bestDist ? current : best;
+        const currentChanged = current.kind !== 'context';
+        const bestChanged = best.kind !== 'context';
+        if (currentChanged !== bestChanged)
+            return currentChanged ? current : best;
+        return current.line > best.line ? current : best;
+    });
+}
+function withSnap(comment, originalPath, originalLine) {
+    const body = `${snapReviewNote(originalPath, originalLine)}\n\n${rewriteSnappedSuggestion(comment.body)}`;
+    return { ...comment, body };
+}
+function withoutRange(comment) {
+    return {
+        path: comment.path,
+        line: comment.line,
+        side: comment.side,
+        body: comment.body,
+    };
+}
+function placeComment(comment, index) {
+    const resolved = index.resolvePath(comment.path);
+    if (resolved === undefined || !index.hasPatch(resolved))
+        return null;
+    const originalPath = comment.path;
+    const originalLine = comment.line;
+    const placed = { ...comment, path: resolved };
+    const rangeOk = placed.start_line === undefined ||
+        (placed.start_side !== undefined &&
+            index.has(resolved, placed.start_side, placed.start_line) &&
+            index.has(resolved, placed.side, placed.line));
+    const target = rangeOk ? placed : withoutRange(placed);
+    if (index.has(resolved, target.side, target.line)) {
+        return target;
+    }
+    const alt = otherSide(target.side);
+    if (index.has(resolved, alt, target.line)) {
+        return withSnap({ ...target, side: alt }, originalPath, originalLine);
+    }
+    const near = nearestReviewLine(index.candidates(resolved, target.side), target.line);
+    if (near)
+        return withSnap({ ...target, line: near.line }, originalPath, originalLine);
+    const nearAlt = nearestReviewLine(index.candidates(resolved, alt), target.line);
+    if (nearAlt)
+        return withSnap({ ...target, side: alt, line: nearAlt.line }, originalPath, originalLine);
+    return null;
+}
+/** Places comments on commentable diff lines, remapping renames and recording dropped findings. */
+export function remapReviewComments(review, index) {
+    const kept = [];
+    const dropped = [];
+    for (const comment of review.comments) {
+        const placed = placeComment(comment, index);
+        if (placed)
+            kept.push(placed);
+        else
+            dropped.push(comment);
+    }
+    const extras = dropped.length === 0
+        ? []
+        : [
+            '## Inline findings not posted',
+            'These comments could not be placed on a diff hunk:',
+            ...dropped.map((comment) => `- ${reviewCommentSubject(comment)}`),
+        ];
+    const body = [review.body, ...extras].filter((part) => part.length > 0).join('\n\n');
+    return {
+        ...review,
+        body: body.length > 0 ? body : 'Inline findings only.',
+        comments: kept,
+    };
+}

package/dist/http-body/index.d.mts

@@ -0,0 +1,18 @@
+export interface ReadResponseBodyOptions {
+    readonly response: Response;
+    readonly url: string;
+    readonly maxSizeBytes: number;
+    readonly signal?: AbortSignal;
+}
+export declare class MissingResponseBodyError extends Error {
+    readonly url: string;
+    constructor(url: string);
+}
+export declare class ResponseBodyTooLargeError extends Error {
+    readonly url: string;
+    readonly sizeBytes: number;
+    readonly maxSizeBytes: number;
+    constructor(url: string, sizeBytes: number, maxSizeBytes: number);
+}
+export declare function readResponseBodyAsBuffer({ response, url, maxSizeBytes, signal, }: ReadResponseBodyOptions): Promise<Buffer>;
+export declare function readResponseBody(options: ReadResponseBodyOptions): Promise<string>;