vouchington-tooling 0.13.2 → 0.13.4

package/dist/gha-check-run/cli.mjs

@@ -0,0 +1,81 @@
+import { appendFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { createGhExec } from '../gha-post-review/github.mjs';
+import { completeCheckRun, createCheckRun, CheckRunError, } from './github.mjs';
+function requireEnv(name, env) {
+    const value = env[name];
+    if (!value)
+        throw new CheckRunError(`${name} is required.`);
+    return value;
+}
+function parseStatus(value) {
+    if (value !== 'in_progress' && value !== 'completed') {
+        throw new CheckRunError(`STATUS must be "in_progress" or "completed" (got "${value}").`);
+    }
+    return value;
+}
+function parseConclusion(value) {
+    if (value !== 'success' && value !== 'neutral') {
+        throw new CheckRunError(`CONCLUSION must be "success" or "neutral" (got "${value}").`);
+    }
+    return value;
+}
+function appendOutput(name, value, outputPath) {
+    if (!outputPath)
+        return;
+    appendFileSync(outputPath, `${name}=${value}\n`);
+}
+/** Builds a create-check-run input from env, requiring CONCLUSION only when STATUS is completed. */
+function readCreateInput(env) {
+    const status = parseStatus(requireEnv('STATUS', env));
+    const shared = {
+        repository: requireEnv('GITHUB_REPOSITORY', env),
+        name: requireEnv('CHECK_NAME', env),
+        headSha: requireEnv('HEAD_SHA', env),
+        title: requireEnv('TITLE', env),
+        summary: requireEnv('SUMMARY', env),
+    };
+    if (status === 'completed') {
+        return { ...shared, status, conclusion: parseConclusion(requireEnv('CONCLUSION', env)) };
+    }
+    return { ...shared, status };
+}
+function runCreate(env, exec) {
+    const id = createCheckRun(readCreateInput(env), exec);
+    appendOutput('check_run_id', id, env.GITHUB_OUTPUT);
+}
+/** No-ops when CHECK_RUN_ID is unset: the create step may have already finalized the check. */
+function runComplete(env, exec) {
+    const checkRunId = env.CHECK_RUN_ID ?? '';
+    if (checkRunId === '')
+        return;
+    completeCheckRun({
+        repository: requireEnv('GITHUB_REPOSITORY', env),
+        checkRunId,
+        conclusion: parseConclusion(requireEnv('CONCLUSION', env)),
+        title: requireEnv('TITLE', env),
+        summary: requireEnv('SUMMARY', env),
+    }, exec);
+}
+export function runCheckRunCli(argv = process.argv, env = process.env, exec = createGhExec()) {
+    const subcommand = argv[2];
+    try {
+        if (subcommand === 'create') {
+            runCreate(env, exec);
+            return 0;
+        }
+        if (subcommand === 'complete') {
+            runComplete(env, exec);
+            return 0;
+        }
+        throw new CheckRunError(`Unknown subcommand "${String(subcommand)}". Use create or complete.`);
+    }
+    catch (error) {
+        process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+/* v8 ignore next 3 */
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    process.exitCode = runCheckRunCli();
+}

package/dist/gha-check-run/github.d.mts

@@ -0,0 +1,30 @@
+import type { GhExec } from '../gha-post-review/github.mts';
+export declare class CheckRunError extends Error {
+    constructor(message: string);
+}
+export type CheckRunStatus = 'in_progress' | 'completed';
+export type CheckRunConclusion = 'success' | 'neutral';
+export type CreateCheckRunInput = {
+    repository: string;
+    name: string;
+    headSha: string;
+    title: string;
+    summary: string;
+} & ({
+    status: 'in_progress';
+    conclusion?: undefined;
+} | {
+    status: 'completed';
+    conclusion: CheckRunConclusion;
+});
+export type CompleteCheckRunInput = {
+    repository: string;
+    checkRunId: string;
+    conclusion: CheckRunConclusion;
+    title: string;
+    summary: string;
+};
+/** Creates a GitHub check run, returning the API-assigned check run id. */
+export declare function createCheckRun(input: CreateCheckRunInput, exec: GhExec): string;
+/** Transitions an existing check run to `completed` with a final conclusion. */
+export declare function completeCheckRun(input: CompleteCheckRunInput, exec: GhExec): void;

package/dist/gha-check-run/github.mjs

@@ -0,0 +1,63 @@
+export class CheckRunError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CheckRunError';
+    }
+}
+function isFullCommitSha(value) {
+    return /^[0-9a-f]{40}$/u.test(value);
+}
+function isCheckRunId(value) {
+    return /^[0-9]+$/u.test(value);
+}
+function parseCheckRunId(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CheckRunError('Check run creation response was not valid JSON.');
+    }
+    const id = parsed !== null && typeof parsed === 'object' ? parsed.id : undefined;
+    if (typeof id !== 'number' && typeof id !== 'string') {
+        throw new CheckRunError('Check run creation response did not include an id.');
+    }
+    return String(id);
+}
+/** Creates a GitHub check run, returning the API-assigned check run id. */
+export function createCheckRun(input, exec) {
+    if (!isFullCommitSha(input.headSha)) {
+        throw new CheckRunError('headSha must be a full lowercase 40-character commit SHA.');
+    }
+    const body = {
+        name: input.name,
+        head_sha: input.headSha,
+        status: input.status,
+        output: { title: input.title, summary: input.summary },
+    };
+    if (input.status === 'completed')
+        body.conclusion = input.conclusion;
+    const raw = exec(['api', '--method', 'POST', `repos/${input.repository}/check-runs`, '--input', '-'], {
+        input: JSON.stringify(body),
+    });
+    return parseCheckRunId(raw);
+}
+/** Transitions an existing check run to `completed` with a final conclusion. */
+export function completeCheckRun(input, exec) {
+    if (!isCheckRunId(input.checkRunId)) {
+        throw new CheckRunError('checkRunId must be a positive integer.');
+    }
+    const body = {
+        status: 'completed',
+        conclusion: input.conclusion,
+        output: { title: input.title, summary: input.summary },
+    };
+    exec([
+        'api',
+        '--method',
+        'PATCH',
+        `repos/${input.repository}/check-runs/${input.checkRunId}`,
+        '--input',
+        '-',
+    ], { input: JSON.stringify(body) });
+}

package/dist/gha-check-run/index.d.mts

@@ -0,0 +1,2 @@
+export { CheckRunError, completeCheckRun, createCheckRun, type CheckRunConclusion, type CheckRunStatus, type CompleteCheckRunInput, type CreateCheckRunInput, } from './github.mts';
+export { runCheckRunCli } from './cli.mts';

package/dist/gha-check-run/index.mjs

@@ -0,0 +1,2 @@
+export { CheckRunError, completeCheckRun, createCheckRun, } from './github.mjs';
+export { runCheckRunCli } from './cli.mjs';

package/dist/gha-post-review/cli.mjs

@@ -3,7 +3,7 @@ import { writePostedOutput, postReviewFromEnv } from './github.mjs';
 export async function runPostReviewCli(env = process.env) {
     try {
         const result = await postReviewFromEnv(env);
-        writePostedOutput(result.posted, env.GITHUB_OUTPUT);
+        writePostedOutput(result.posted, result.commentCount, env.GITHUB_OUTPUT);
         return 0;
     }
     catch (error) {

package/dist/gha-post-review/github.d.mts

@@ -1,29 +1,13 @@
 import { execFileSync } from 'node:child_process';
-import { type PostResult, type PostReviewIo, type SanitizedReview } from './post.mts';
+import { type PostReviewResult } from './post.mts';
+export { createGhPostReviewIo, postWithGh } from './pull-io.mts';
 export type GhExec = (args: readonly string[], options?: {
     input?: string;
     env?: NodeJS.ProcessEnv;
 }) => string;
 export declare function createGhExec(exec?: typeof execFileSync): GhExec;
-export declare function postWithGh(repository: string, prNumber: string, payload: SanitizedReview, token: string, exec: GhExec): PostResult;
-export declare function writePostedOutput(posted: boolean, outputPath?: string | undefined): void;
-export declare function createGhPostReviewIo(options: {
-    repository: string;
-    prNumber: string;
-    payloadPath: string;
-    payloadBytes: Buffer;
-    token: string;
-    exec: GhExec;
-    expectedHeadSha?: string;
-    expectedBaseSha?: string;
-}): PostReviewIo;
+export declare function writePostedOutput(posted: boolean, commentCount: number, outputPath?: string | undefined): void;
 /** @deprecated Use postReviewWithTokenFromEnv or postClaudeReviewFromEnv explicitly. */
-export declare function postReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<{
-    posted: boolean;
-}>;
-export declare function postReviewWithTokenFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, token?: string | undefined): {
-    posted: boolean;
-};
-export declare function postClaudeReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<{
-    posted: boolean;
-}>;
+export declare function postReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<PostReviewResult>;
+export declare function postReviewWithTokenFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, token?: string | undefined): PostReviewResult;
+export declare function postClaudeReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<PostReviewResult>;

package/dist/gha-post-review/github.mjs

@@ -1,11 +1,12 @@
 import { execFileSync } from 'node:child_process';
-import { appendFileSync, rmSync } from 'node:fs';
-import { parseReviewFilesJson } from '../gha-review-payload/index.mjs';
+import { appendFileSync } from 'node:fs';
 import { ReviewPayloadError } from '../gha-review-payload/index.mjs';
+import { readRegularReviewPayload } from '../gha-review-payload/index.mjs';
 import { createActionsClaudeTokenIo, withClaudeAppToken } from './claude-token.mjs';
 import { runPostReview } from './post.mjs';
+import { createGhPostReviewIo } from './pull-io.mjs';
 import { requireEnv, resolveReviewPostToken } from './token.mjs';
-import { readRegularReviewPayload } from '../gha-review-payload/index.mjs';
+export { createGhPostReviewIo, postWithGh } from './pull-io.mjs';
 export function createGhExec(exec = execFileSync) {
     return (args, options) => exec('gh', [...args], {
         encoding: 'utf8',
@@ -13,96 +14,10 @@ export function createGhExec(exec = execFileSync) {
         env: options?.env ?? process.env,
     }).trim();
 }
-export function postWithGh(repository, prNumber, payload, token, exec) {
-    try {
-        exec(['api', '--method', 'POST', `repos/${repository}/pulls/${prNumber}/reviews`, '--input', '-'], {
-            input: JSON.stringify(payload),
-            env: { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token },
-        });
-        return { ok: true, status: 201, body: '' };
-    }
-    catch (error) {
-        // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- isolate the process-error shape assertion at the catch boundary
-        const err = error;
-        const text = `${err.stdout ?? ''}${err.stderr ?? ''}${err.message ?? ''}`;
-        const status = Number(/HTTP\s+(\d{3})/u.exec(text)?.[1] ?? 0);
-        return { ok: false, status, body: text };
-    }
-}
-export function writePostedOutput(posted, outputPath = process.env.GITHUB_OUTPUT) {
+export function writePostedOutput(posted, commentCount, outputPath = process.env.GITHUB_OUTPUT) {
     if (!outputPath)
         return;
-    appendFileSync(outputPath, `posted=${posted ? 'true' : 'false'}\n`);
-}
-function readPullState(repository, prNumber, exec) {
-    let lastError;
-    for (let attempt = 1; attempt <= 3; attempt += 1) {
-        try {
-            return exec([
-                'api',
-                `repos/${repository}/pulls/${prNumber}`,
-                '--jq',
-                '[.head.sha, .base.sha, .draft, .state] | @tsv',
-            ]).split('\t');
-        }
-        catch (error) {
-            lastError = error;
-        }
-    }
-    throw lastError;
-}
-export function createGhPostReviewIo(options) {
-    const { repository, prNumber, payloadBytes, token, exec, expectedHeadSha, expectedBaseSha } = options;
-    return {
-        readFile() {
-            return payloadBytes;
-        },
-        removeFile(path) {
-            rmSync(path, { force: true });
-        },
-        getHeadSha() {
-            if (!/^[1-9][0-9]*$/u.test(prNumber)) {
-                throw new ReviewPayloadError('PR_NUMBER must be a positive integer.');
-            }
-            if (Boolean(expectedHeadSha) !== Boolean(expectedBaseSha)) {
-                throw new ReviewPayloadError('EXPECTED_HEAD_SHA and EXPECTED_BASE_SHA must be provided together.');
-            }
-            if (expectedHeadSha && !/^[0-9a-f]{40}$/u.test(expectedHeadSha)) {
-                throw new ReviewPayloadError('EXPECTED_HEAD_SHA must be a full lowercase commit SHA.');
-            }
-            if (expectedBaseSha && !/^[0-9a-f]{40}$/u.test(expectedBaseSha)) {
-                throw new ReviewPayloadError('EXPECTED_BASE_SHA must be a full lowercase commit SHA.');
-            }
-            const state = readPullState(repository, prNumber, exec);
-            const [headSha = '', baseSha = '', draft = '', pullState = ''] = state;
-            if (!/^[0-9a-f]{40}$/u.test(headSha)) {
-                throw new ReviewPayloadError(`Could not resolve PR head SHA (got "${headSha}").`);
-            }
-            if (!/^[0-9a-f]{40}$/u.test(baseSha)) {
-                throw new ReviewPayloadError(`Could not resolve PR base SHA (got "${baseSha}").`);
-            }
-            if (draft !== 'false') {
-                throw new ReviewPayloadError('Pull request became a draft before posting the review.');
-            }
-            if (pullState !== 'open') {
-                throw new ReviewPayloadError('Pull request closed before posting the review.');
-            }
-            if (expectedHeadSha && headSha !== expectedHeadSha) {
-                throw new ReviewPayloadError('PR head changed before posting the selected review.');
-            }
-            if (expectedBaseSha && baseSha !== expectedBaseSha) {
-                throw new ReviewPayloadError('PR base changed before posting the selected review.');
-            }
-            // Preserve the orchestrator-selected revision as the review commit_id after equality checks.
-            return expectedHeadSha || headSha;
-        },
-        listPullFiles() {
-            return parseReviewFilesJson(exec(['api', '--paginate', `repos/${repository}/pulls/${prNumber}/files?per_page=100`]));
-        },
-        postReview(payload) {
-            return postWithGh(repository, prNumber, payload, token, exec);
-        },
-    };
+    appendFileSync(outputPath, `posted=${posted ? 'true' : 'false'}\ncomment_count=${commentCount}\n`);
 }
 /** @deprecated Use postReviewWithTokenFromEnv or postClaudeReviewFromEnv explicitly. */
 export async function postReviewFromEnv(env = process.env, exec = createGhExec(), claudeIo = createActionsClaudeTokenIo(env)) {
@@ -116,6 +31,7 @@ function createPostWithToken(env, exec) {
     const prNumber = requireEnv('PR_NUMBER', env);
     const payloadPath = requireEnv('CODE_REVIEW_PAYLOAD_PATH', env);
     const payloadBytes = readRegularReviewPayload(payloadPath, 'required');
+    const providerName = env.PROVIDER_NAME || undefined;
     return (token) => runPostReview(payloadPath, createGhPostReviewIo({
         repository,
         prNumber,
@@ -125,7 +41,7 @@ function createPostWithToken(env, exec) {
         exec,
         expectedHeadSha: env.EXPECTED_HEAD_SHA ?? '',
         expectedBaseSha: env.EXPECTED_BASE_SHA ?? '',
-    }));
+    }), providerName);
 }
 function withTokenEnv(exec, env, token) {
     const tokenEnv = { ...env, GH_TOKEN: token, GITHUB_TOKEN: token };

package/dist/gha-post-review/post.d.mts

@@ -13,6 +13,12 @@ export type PostReviewIo = {
     listPullFiles(): PullFile[];
     postReview(payload: SanitizedReview): PostResult;
 };
-export declare function runPostReview(payloadPath: string, io: PostReviewIo): {
+export type PostReviewResult = {
     posted: boolean;
+    commentCount: number;
 };
+/**
+ * Posts a validated review, optionally prefixing the body with a provider attribution line.
+ * The attribution is cosmetic (final posted text only); it never affects staged payload bytes.
+ */
+export declare function runPostReview(payloadPath: string, io: PostReviewIo, providerName?: string): PostReviewResult;

package/dist/gha-post-review/post.mjs

@@ -6,7 +6,11 @@ MAX_REVIEW_COMMENTS as MAX_COMMENTS,
 MAX_REVIEW_PAYLOAD_BYTES as MAX_PAYLOAD_BYTES, 
 // oxlint-disable-next-line no-mistakes/ts-no-export-renaming -- preserve the package's established public compatibility name
 ReviewPayloadError as PostReviewError, } from '../gha-review-payload/index.mjs';
-export function runPostReview(payloadPath, io) {
+/**
+ * Posts a validated review, optionally prefixing the body with a provider attribution line.
+ * The attribution is cosmetic (final posted text only); it never affects staged payload bytes.
+ */
+export function runPostReview(payloadPath, io, providerName) {
     try {
         const selectedHeadSha = io.getHeadSha();
         let review = parseReviewPayload(io.readFile(payloadPath), selectedHeadSha);
@@ -20,9 +24,13 @@ export function runPostReview(payloadPath, io) {
         if (io.getHeadSha() !== selectedHeadSha) {
             throw new ReviewPayloadError('PR head changed while preparing the selected review.');
         }
-        const first = io.postReview(review);
+        const commentCount = review.comments.length;
+        const attributedReview = providerName
+            ? { ...review, body: `**${providerName} review**\n\n${review.body}` }
+            : review;
+        const first = io.postReview(attributedReview);
         if (first.ok)
-            return { posted: true };
+            return { posted: true, commentCount };
         throw new ReviewPayloadError(`GitHub review POST failed (HTTP ${first.status}).`);
     }
     finally {

package/dist/gha-post-review/pull-io.d.mts

@@ -0,0 +1,13 @@
+import type { GhExec } from './github.mts';
+import type { PostResult, PostReviewIo, SanitizedReview } from './post.mts';
+export declare function postWithGh(repository: string, prNumber: string, payload: SanitizedReview, token: string, exec: GhExec): PostResult;
+export declare function createGhPostReviewIo(options: {
+    repository: string;
+    prNumber: string;
+    payloadPath: string;
+    payloadBytes: Buffer;
+    token: string;
+    exec: GhExec;
+    expectedHeadSha?: string;
+    expectedBaseSha?: string;
+}): PostReviewIo;

package/dist/gha-post-review/pull-io.mjs

@@ -0,0 +1,88 @@
+import { rmSync } from 'node:fs';
+import { parseReviewFilesJson, ReviewPayloadError } from '../gha-review-payload/index.mjs';
+export function postWithGh(repository, prNumber, payload, token, exec) {
+    try {
+        exec(['api', '--method', 'POST', `repos/${repository}/pulls/${prNumber}/reviews`, '--input', '-'], {
+            input: JSON.stringify(payload),
+            env: { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token },
+        });
+        return { ok: true, status: 201, body: '' };
+    }
+    catch (error) {
+        // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- isolate the process-error shape assertion at the catch boundary
+        const err = error;
+        const text = `${err.stdout ?? ''}${err.stderr ?? ''}${err.message ?? ''}`;
+        const status = Number(/HTTP\s+(\d{3})/u.exec(text)?.[1] ?? 0);
+        return { ok: false, status, body: text };
+    }
+}
+function readPullState(repository, prNumber, exec) {
+    let lastError;
+    for (let attempt = 1; attempt <= 3; attempt += 1) {
+        try {
+            return exec([
+                'api',
+                `repos/${repository}/pulls/${prNumber}`,
+                '--jq',
+                '[.head.sha, .base.sha, .draft, .state] | @tsv',
+            ]).split('\t');
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError;
+}
+export function createGhPostReviewIo(options) {
+    const { repository, prNumber, payloadBytes, token, exec, expectedHeadSha, expectedBaseSha } = options;
+    return {
+        readFile() {
+            return payloadBytes;
+        },
+        removeFile(path) {
+            rmSync(path, { force: true });
+        },
+        getHeadSha() {
+            if (!/^[1-9][0-9]*$/u.test(prNumber)) {
+                throw new ReviewPayloadError('PR_NUMBER must be a positive integer.');
+            }
+            if (Boolean(expectedHeadSha) !== Boolean(expectedBaseSha)) {
+                throw new ReviewPayloadError('EXPECTED_HEAD_SHA and EXPECTED_BASE_SHA must be provided together.');
+            }
+            if (expectedHeadSha && !/^[0-9a-f]{40}$/u.test(expectedHeadSha)) {
+                throw new ReviewPayloadError('EXPECTED_HEAD_SHA must be a full lowercase commit SHA.');
+            }
+            if (expectedBaseSha && !/^[0-9a-f]{40}$/u.test(expectedBaseSha)) {
+                throw new ReviewPayloadError('EXPECTED_BASE_SHA must be a full lowercase commit SHA.');
+            }
+            const state = readPullState(repository, prNumber, exec);
+            const [headSha = '', baseSha = '', draft = '', pullState = ''] = state;
+            if (!/^[0-9a-f]{40}$/u.test(headSha)) {
+                throw new ReviewPayloadError(`Could not resolve PR head SHA (got "${headSha}").`);
+            }
+            if (!/^[0-9a-f]{40}$/u.test(baseSha)) {
+                throw new ReviewPayloadError(`Could not resolve PR base SHA (got "${baseSha}").`);
+            }
+            if (draft !== 'false') {
+                throw new ReviewPayloadError('Pull request became a draft before posting the review.');
+            }
+            if (pullState !== 'open') {
+                throw new ReviewPayloadError('Pull request closed before posting the review.');
+            }
+            if (expectedHeadSha && headSha !== expectedHeadSha) {
+                throw new ReviewPayloadError('PR head changed before posting the selected review.');
+            }
+            if (expectedBaseSha && baseSha !== expectedBaseSha) {
+                throw new ReviewPayloadError('PR base changed before posting the selected review.');
+            }
+            // Preserve the orchestrator-selected revision as the review commit_id after equality checks.
+            return expectedHeadSha || headSha;
+        },
+        listPullFiles() {
+            return parseReviewFilesJson(exec(['api', '--paginate', `repos/${repository}/pulls/${prNumber}/files?per_page=100`]));
+        },
+        postReview(payload) {
+            return postWithGh(repository, prNumber, payload, token, exec);
+        },
+    };
+}

package/dist/index.d.mts

@@ -25,7 +25,8 @@ export { requireUpToDate } from './require-up-to-date/index.mts';
 export type { GitExecutor, RequireUpToDateOptions } from './require-up-to-date/index.mts';
 export { gitleaksDirectoryScanArguments, runGitleaksDirectoryScan, } from './gitleaks-directory-scan/index.mts';
 export type { DirectoryScanExecutor, GitleaksDirectoryScanOptions, } from './gitleaks-directory-scan/index.mts';
-export { astGrepExamplesArguments, runAstGrepExamples } from './ast-grep-examples/index.mts';
+export { astGrepExamplesArguments, compareAstGrepCompanions, runAstGrepExamples, } from './ast-grep-examples/index.mts';
+export type { AstGrepCompanionContext, AstGrepCompanionDifference, AstGrepCompanionParityOptions, } from './ast-grep-examples/index.mts';
 export type { AstGrepExamplesExecutor, AstGrepExamplesOptions } from './ast-grep-examples/index.mts';
 export { astGrepPackPaths, astGrepPackPathsFrom } from './ast-grep-pack/index.mts';
 export type { AstGrepPackPaths } from './ast-grep-pack/index.mts';

package/dist/index.mjs

@@ -13,7 +13,7 @@ export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/i
 export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mjs';
 export { requireUpToDate } from './require-up-to-date/index.mjs';
 export { gitleaksDirectoryScanArguments, runGitleaksDirectoryScan, } from './gitleaks-directory-scan/index.mjs';
-export { astGrepExamplesArguments, runAstGrepExamples } from './ast-grep-examples/index.mjs';
+export { astGrepExamplesArguments, compareAstGrepCompanions, runAstGrepExamples, } from './ast-grep-examples/index.mjs';
 export { astGrepPackPaths, astGrepPackPathsFrom } from './ast-grep-pack/index.mjs';
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mjs';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mjs';

package/dist/scc-complexity/baseline.mjs

@@ -1,4 +1,5 @@
-import { canonicalRepoPath, isInScope } from './paths.mjs';
+import { assertWorkflowCommandData, canonicalRepoPath, isInScope } from './paths.mjs';
+import { SCC_COMPLEXITY_LIMIT } from './constants.mjs';
 export const SCC_COMPLEXITY_BASELINE_VERSION = 1;
 export function parseSccComplexityBaseline(json) {
     const parsed = JSON.parse(json);
@@ -41,7 +42,7 @@ export function validateSccComplexityBaseline(baseline, scopes, trackedFileSet,
                 throw new Error(`baseline entry ${key} is out of scope`);
             throw new Error(`baseline entry ${key} is stale`);
         }
-        if (value.complexity <= (scope.limit ?? 50))
+        if (value.complexity <= (scope.limit ?? SCC_COMPLEXITY_LIMIT))
             throw new Error(`baseline entry ${key} is stale`);
     }
 }
@@ -76,6 +77,8 @@ function parseEntry(value, index) {
         throw new Error(`baseline entry ${index} has an invalid scope`);
     if (typeof value.file !== 'string' || value.file.length === 0)
         throw new Error(`baseline entry ${index} has an invalid file`);
+    assertWorkflowCommandData(value.scope, `baseline entry ${index}`);
+    assertWorkflowCommandData(value.file, `baseline entry ${index}`);
     if (typeof value.complexity !== 'number' ||
         !Number.isSafeInteger(value.complexity) ||
         value.complexity < 0)

package/dist/scc-complexity/constants.d.mts

@@ -0,0 +1 @@
+export declare const SCC_COMPLEXITY_LIMIT = 50;

package/dist/scc-complexity/constants.mjs

@@ -0,0 +1 @@
+export const SCC_COMPLEXITY_LIMIT = 50;

package/dist/scc-complexity/index.d.mts

@@ -1,8 +1,8 @@
 import type { SharedContext } from '../shared-context/index.mts';
 import type { SccComplexityOptions, SccComplexityScope, SccComplexityViolation } from './types.mts';
 export { parseSccComplexityBaseline, SCC_COMPLEXITY_BASELINE_VERSION } from './baseline.mts';
+export { SCC_COMPLEXITY_LIMIT } from './constants.mts';
 export type { SccComplexityBaseline, SccComplexityBaselineEntry, SccComplexityOptions, SccComplexityScope, SccComplexityViolation, } from './types.mts';
-export declare const SCC_COMPLEXITY_LIMIT = 50;
 type RunScc = (outputPath: string, scope?: SccComplexityScope) => Promise<string>;
 export declare function buildSccArgs(options?: SccComplexityOptions): string[];
 export declare function checkSccComplexity(ctx: SharedContext, options?: SccComplexityOptions, runScc?: RunScc): Promise<{