@nanocollective/sentinel 0.1.0-alpha.0 → 0.1.0-alpha.2

package/dist/issues/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/issues/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,sBAAsB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACb;AAED,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC5B,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9D;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAChC,UAAU,CAAC,MAAM,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5E,WAAW,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,UAAU,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAE9D,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC7B,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,uDAAuD;AACvD,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACd;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/issues/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,sBAAsB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACtD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACb;AAED,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC5B,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9D;AAED,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAChC;;0CAEsC;IACtC,YAAY,CAAC,MAAM,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,UAAU,CAAC,MAAM,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5E,WAAW,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,UAAU,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAE9D,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC7B,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,uDAAuD;AACvD,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;CACpB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACd;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;CACtB"}

package/dist/observe/dashboard.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Render a self-contained static HTML dashboard from the committed run records.
+ * No database, no build step, no external assets — a single page suitable for
+ * the config repo's GitHub Pages. Pure and tested.
+ */
+import type { RunRecord } from './types.js';
+/** Render the dashboard HTML for a set of run records (newest first). */
+export declare function renderDashboard(records: RunRecord[]): string;
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/observe/dashboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../source/observe/dashboard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AAmC1C,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAsD5D"}

package/dist/observe/dashboard.js

@@ -0,0 +1,87 @@
+/**
+ * Render a self-contained static HTML dashboard from the committed run records.
+ * No database, no build step, no external assets — a single page suitable for
+ * the config repo's GitHub Pages. Pure and tested.
+ */
+const MAX_ROWS = 60;
+function escapeHtml(text) {
+    return text
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+function severityCell(count, className) {
+    const shown = count > 0 ? String(count) : '·';
+    return `<td class="sev ${className}">${shown}</td>`;
+}
+function row(record) {
+    const { bySeverity } = record.totals;
+    const filed = record.filing ? String(record.filing.filed) : '—';
+    return [
+        '<tr>',
+        `<td class="ts">${escapeHtml(record.timestamp)}</td>`,
+        `<td><span class="mode ${record.mode}">${record.mode}</span></td>`,
+        `<td class="num">${record.totals.repos}</td>`,
+        `<td class="num">${record.totals.findings}</td>`,
+        severityCell(bySeverity.critical, 'critical'),
+        severityCell(bySeverity.high, 'high'),
+        severityCell(bySeverity.medium, 'medium'),
+        severityCell(bySeverity.low, 'low'),
+        `<td class="num">${filed}</td>`,
+        '</tr>',
+    ].join('');
+}
+/** Render the dashboard HTML for a set of run records (newest first). */
+export function renderDashboard(records) {
+    const sorted = [...records].sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+    const latest = sorted[0];
+    const rows = sorted.slice(0, MAX_ROWS).map(row).join('\n');
+    const summary = latest
+        ? `Latest run ${escapeHtml(latest.timestamp)} — ${latest.totals.findings} finding(s) across ${latest.totals.repos} repo(s).`
+        : 'No runs recorded yet.';
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sentinel</title>
+<style>
+:root { color-scheme: dark; }
+body { font-family: system-ui, sans-serif; background: #1a1b26; color: #a9b1d6; margin: 0; padding: 2rem; }
+h1 { color: #7aa2f7; margin: 0 0 .25rem; font-size: 1.4rem; }
+p.summary { color: #c0caf5; margin: 0 0 1.5rem; }
+table { border-collapse: collapse; width: 100%; font-size: .9rem; }
+th, td { padding: .5rem .6rem; text-align: left; border-bottom: 1px solid #292e42; }
+th { color: #565f89; font-weight: 600; text-transform: uppercase; font-size: .72rem; letter-spacing: .04em; }
+td.num, td.sev { text-align: right; font-variant-numeric: tabular-nums; }
+.ts { color: #9aa5ce; font-variant-numeric: tabular-nums; }
+.mode { padding: .1rem .45rem; border-radius: 999px; font-size: .72rem; }
+.mode.live { background: #2d3b2d; color: #9ece6a; }
+.mode.dry-run { background: #3b352d; color: #e0af68; }
+.mode.audit-only { background: #2d3242; color: #7dcfff; }
+.sev.critical { color: #f7768e; }
+.sev.high { color: #ff9e64; }
+.sev.medium { color: #e0af68; }
+.sev.low { color: #565f89; }
+footer { margin-top: 1.5rem; color: #565f89; font-size: .8rem; }
+</style>
+</head>
+<body>
+<h1>🛡️ Sentinel</h1>
+<p class="summary">${summary}</p>
+<table>
+<thead><tr>
+<th>Run</th><th>Mode</th><th>Repos</th><th>Findings</th>
+<th>Crit</th><th>High</th><th>Med</th><th>Low</th><th>Filed</th>
+</tr></thead>
+<tbody>
+${rows}
+</tbody>
+</table>
+<footer>Generated by <a href="https://docs.nanocollective.org/sentinel/docs" style="color:#7aa2f7">Sentinel</a> from committed run records.</footer>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=dashboard.js.map

package/dist/observe/dashboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../source/observe/dashboard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,SAAS,UAAU,CAAC,IAAY;IAC/B,OAAO,IAAI;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,SAAiB;IACrD,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,OAAO,kBAAkB,SAAS,KAAK,KAAK,OAAO,CAAC;AACrD,CAAC;AAED,SAAS,GAAG,CAAC,MAAiB;IAC7B,MAAM,EAAC,UAAU,EAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChE,OAAO;QACN,MAAM;QACN,kBAAkB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO;QACrD,yBAAyB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,cAAc;QAClE,mBAAmB,MAAM,CAAC,MAAM,CAAC,KAAK,OAAO;QAC7C,mBAAmB,MAAM,CAAC,MAAM,CAAC,QAAQ,OAAO;QAChD,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC7C,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;QACrC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC;QACzC,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;QACnC,mBAAmB,KAAK,OAAO;QAC/B,OAAO;KACP,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,OAAoB;IACnD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CACtC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,MAAM;QACrB,CAAC,CAAC,cAAc,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,sBAAsB,MAAM,CAAC,MAAM,CAAC,KAAK,WAAW;QAC5H,CAAC,CAAC,uBAAuB,CAAC;IAE3B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6Ba,OAAO;;;;;;;EAO1B,IAAI;;;;;;CAML,CAAC;AACF,CAAC"}

package/dist/observe/record.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Build a durable {@link RunRecord} from a run's {@link RunReport}. Pure — the
+ * CLI stamps the timestamp and mode and writes the JSON.
+ */
+import type { RunReport } from '../run/run.js';
+import type { RunMode, RunRecord } from './types.js';
+/** Build a run record from a report, a timestamp, and the run mode. */
+export declare function buildRunRecord(report: RunReport, timestamp: string, mode: RunMode): RunRecord;
+/** A filesystem-safe filename for a run record from its timestamp. */
+export declare function recordFilename(timestamp: string): string;
+//# sourceMappingURL=record.d.ts.map

package/dist/observe/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../source/observe/record.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAGX,OAAO,EACP,SAAS,EAET,MAAM,YAAY,CAAC;AA8BpB,uEAAuE;AACvE,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACX,SAAS,CAiCX;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/observe/record.js

@@ -0,0 +1,66 @@
+/**
+ * Build a durable {@link RunRecord} from a run's {@link RunReport}. Pure — the
+ * CLI stamps the timestamp and mode and writes the JSON.
+ */
+import { SEVERITIES } from '../findings/types.js';
+function emptyCounts() {
+    return { low: 0, medium: 0, high: 0, critical: 0 };
+}
+function addCounts(into, from) {
+    for (const severity of SEVERITIES) {
+        into[severity] += from[severity];
+    }
+}
+function repoRecord(outcome) {
+    const bySeverity = emptyCounts();
+    let findings = 0;
+    const packs = outcome.packs.map(pack => {
+        for (const finding of pack.findings) {
+            bySeverity[finding.severity] += 1;
+        }
+        findings += pack.findings.length;
+        return {
+            pack: pack.pack,
+            version: pack.version,
+            findings: pack.findings.length,
+            ok: pack.ok,
+        };
+    });
+    return { repo: outcome.repo, findings, bySeverity, packs };
+}
+/** Build a run record from a report, a timestamp, and the run mode. */
+export function buildRunRecord(report, timestamp, mode) {
+    const repos = report.outcome.repos.map(repoRecord);
+    const totalsBySeverity = emptyCounts();
+    let totalFindings = 0;
+    for (const repo of repos) {
+        addCounts(totalsBySeverity, repo.bySeverity);
+        totalFindings += repo.findings;
+    }
+    const record = {
+        timestamp,
+        mode,
+        repos,
+        totals: {
+            repos: repos.length,
+            findings: totalFindings,
+            bySeverity: totalsBySeverity,
+        },
+        targetErrors: report.targetErrors,
+    };
+    if (report.filed) {
+        const filing = { filed: 0, touched: 0, resolved: 0 };
+        for (const { result } of report.reconciled) {
+            filing.filed += result.created.length;
+            filing.touched += result.touched;
+            filing.resolved += result.resolved;
+        }
+        record.filing = filing;
+    }
+    return record;
+}
+/** A filesystem-safe filename for a run record from its timestamp. */
+export function recordFilename(timestamp) {
+    return `${timestamp.replace(/[:.]/g, '-')}.json`;
+}
+//# sourceMappingURL=record.js.map

package/dist/observe/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../source/observe/record.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAC,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAW/D,SAAS,WAAW;IACnB,OAAO,EAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,IAAoB,EAAE,IAAoB;IAC5D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,OAAoB;IACvC,MAAM,UAAU,GAAG,WAAW,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,UAAU,CAAC,OAAO,CAAC,QAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;SACX,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAC,CAAC;AAC1D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAC7B,MAAiB,EACjB,SAAiB,EACjB,IAAa;IAEb,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,gBAAgB,GAAG,WAAW,EAAE,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAc;QACzB,SAAS;QACT,IAAI;QACJ,KAAK;QACL,MAAM,EAAE;YACP,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,gBAAgB;SAC5B;QACD,YAAY,EAAE,MAAM,CAAC,YAAY;KACjC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAkB,EAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAC,CAAC;QAClE,KAAK,MAAM,EAAC,MAAM,EAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;YACjC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC/C,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;AAClD,CAAC"}

package/dist/observe/types.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The durable per-run record and the shapes the dashboard renders from. One
+ * record is committed to the config repo per run (the durable store); the
+ * dashboard is the read-side surface generated from the records
+ * (see docs/workflow/index.md#observability-and-run-history).
+ */
+import type { Severity } from '../findings/types.js';
+/** Finding counts broken down by severity. */
+export type SeverityCounts = Record<Severity, number>;
+/** One pack's contribution within a repo, for the record. */
+export interface PackRunRecord {
+    pack: string;
+    version: string;
+    findings: number;
+    ok: boolean;
+}
+/** One repository's result within a run. */
+export interface RepoRunRecord {
+    repo: string;
+    findings: number;
+    bySeverity: SeverityCounts;
+    packs: PackRunRecord[];
+}
+/** The mode a run executed in. */
+export type RunMode = 'live' | 'dry-run' | 'audit-only';
+/** Issue-filing totals for a live run. */
+export interface FilingSummary {
+    filed: number;
+    touched: number;
+    resolved: number;
+}
+/** A committed record of one Sentinel run. */
+export interface RunRecord {
+    /** ISO timestamp of the run. */
+    timestamp: string;
+    mode: RunMode;
+    repos: RepoRunRecord[];
+    totals: {
+        repos: number;
+        findings: number;
+        bySeverity: SeverityCounts;
+    };
+    /** Present on a live run. */
+    filing?: FilingSummary;
+    /** Target-expansion / clone failures, carried for visibility. */
+    targetErrors: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/observe/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/observe/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAEnD,8CAA8C;AAC9C,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;CACZ;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,kCAAkC;AAClC,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAExD,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,SAAS;IACzB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,cAAc,CAAC;KAC3B,CAAC;IACF,6BAA6B;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,iEAAiE;IACjE,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB"}

package/dist/observe/types.js

@@ -0,0 +1,8 @@
+/**
+ * The durable per-run record and the shapes the dashboard renders from. One
+ * record is committed to the config repo per run (the durable store); the
+ * dashboard is the read-side surface generated from the records
+ * (see docs/workflow/index.md#observability-and-run-history).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/observe/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/observe/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/orchestrator/extract.d.ts

@@ -8,7 +8,8 @@
  */
 /**
  * Return the last top-level JSON array in the output that parses to an array,
- * as a string, or null if there is none.
+ * as a string, or null if there is none. Falls back to salvaging a truncated
+ * array of objects.
  */
 export declare function extractJsonArray(output: string): string | null;
 //# sourceMappingURL=extract.d.ts.map

package/dist/orchestrator/extract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../source/orchestrator/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6CH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa9D"}
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../source/orchestrator/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkIH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa9D"}

package/dist/orchestrator/extract.js

@@ -48,9 +48,101 @@ function topLevelArraySpans(text) {
     }
     return spans;
 }
+/**
+ * Recover complete objects from a truncated array-of-objects. Models
+ * occasionally cut off mid-array (max tokens), leaving `[{...},{...},{incomp`
+ * which parses as nothing. This finds the last `[` that opens an object array
+ * and keeps the leading complete `{...}` objects. Returns null if nothing
+ * recoverable. Only used as a fallback when a clean array was not found.
+ */
+function salvageTruncatedArray(output) {
+    // Find the last top-level `[` immediately followed by `{` (an object array),
+    // tracking string state so brackets inside strings are ignored.
+    let inString = false;
+    let escaped = false;
+    let start = -1;
+    for (let i = 0; i < output.length; i++) {
+        const char = output[i];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === '\\') {
+                escaped = true;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+        }
+        else if (char === '[') {
+            const next = output.slice(i + 1).match(/^\s*\{/);
+            if (next) {
+                start = i;
+            }
+        }
+    }
+    if (start === -1) {
+        return null;
+    }
+    // Collect balanced top-level {...} objects from just after the `[`.
+    const objects = [];
+    let depth = 0;
+    let objectStart = -1;
+    inString = false;
+    escaped = false;
+    for (let i = start + 1; i < output.length; i++) {
+        const char = output[i];
+        if (inString) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === '\\') {
+                escaped = true;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+        }
+        else if (char === '{') {
+            if (depth === 0) {
+                objectStart = i;
+            }
+            depth++;
+        }
+        else if (char === '}') {
+            depth--;
+            if (depth === 0 && objectStart !== -1) {
+                objects.push(output.slice(objectStart, i + 1));
+                objectStart = -1;
+            }
+        }
+        else if (char === ']' && depth === 0) {
+            break;
+        }
+    }
+    if (objects.length === 0) {
+        return null;
+    }
+    const salvaged = `[${objects.join(',')}]`;
+    try {
+        return Array.isArray(JSON.parse(salvaged)) ? salvaged : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Return the last top-level JSON array in the output that parses to an array,
- * as a string, or null if there is none.
+ * as a string, or null if there is none. Falls back to salvaging a truncated
+ * array of objects.
  */
 export function extractJsonArray(output) {
     const spans = topLevelArraySpans(output);
@@ -65,6 +157,6 @@ export function extractJsonArray(output) {
             // Not valid JSON on its own; try the next candidate.
         }
     }
-    return null;
+    return salvageTruncatedArray(output);
 }
 //# sourceMappingURL=extract.js.map

package/dist/orchestrator/extract.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../source/orchestrator/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjB,KAAK,GAAG,CAAC,CAAC;YACX,CAAC;YACD,KAAK,EAAE,CAAC;QACT,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACrC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACZ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qDAAqD;QACtD,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}
+{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../source/orchestrator/extract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjB,KAAK,GAAG,CAAC,CAAC;YACX,CAAC;YACD,KAAK,EAAE,CAAC;QACT,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACrC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACZ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC5C,6EAA6E;IAC7E,gEAAgE;IAChE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACV,KAAK,GAAG,CAAC,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,oEAAoE;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,QAAQ,GAAG,KAAK,CAAC;IACjB,OAAO,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjB,WAAW,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,KAAK,EAAE,CAAC;QACT,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/C,WAAW,GAAG,CAAC,CAAC,CAAC;YAClB,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM;QACP,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,IAAI,CAAC;QACJ,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qDAAqD;QACtD,CAAC;IACF,CAAC;IACD,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/run/clone.d.ts

@@ -6,18 +6,16 @@
  */
 /** Build the `gh repo clone` argv for a shallow single-branch clone. */
 export declare function buildCloneArgs(repo: string, dir: string): string[];
-/** The outcome of ensuring the target repos are present in the workspace. */
-export interface EnsureTargetsResult {
-    cloned: string[];
-    skipped: string[];
-    errors: {
-        repo: string;
-        error: string;
-    }[];
+/** The outcome of ensuring one repo is present in the workspace. */
+export interface PrepareResult {
+    ok: boolean;
+    /** True if the repo was already present and no clone was attempted. */
+    skipped: boolean;
+    error?: string;
 }
 /**
- * Ensure each repo is checked out under `workspaceDir/<owner>/<name>`, cloning
- * any that are missing. Repos already present are left untouched.
+ * Ensure a single repo is checked out at `dir`, cloning it if missing. Returns
+ * a result rather than throwing so one failure does not abort a run.
  */
-export declare function ensureTargets(repos: string[], workspaceDir: string): EnsureTargetsResult;
+export declare function prepareRepo(repo: string, dir: string): Promise<PrepareResult>;
 //# sourceMappingURL=clone.d.ts.map

package/dist/run/clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clone.d.ts","sourceRoot":"","sources":["../../source/run/clone.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;CACxC;AAGD;;;GAGG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,YAAY,EAAE,MAAM,GAClB,mBAAmB,CA+BrB"}
+{"version":3,"file":"clone.d.ts","sourceRoot":"","sources":["../../source/run/clone.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAGD;;;GAGG;AACH,wBAAsB,WAAW,CAChC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,aAAa,CAAC,CAwBxB"}

package/dist/run/clone.js

@@ -6,46 +6,38 @@
  */
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
 /** Build the `gh repo clone` argv for a shallow single-branch clone. */
 export function buildCloneArgs(repo, dir) {
     return ['repo', 'clone', repo, dir, '--', '--depth', '1', '--single-branch'];
 }
 /* c8 ignore start -- spawns gh and touches the filesystem. */
 /**
- * Ensure each repo is checked out under `workspaceDir/<owner>/<name>`, cloning
- * any that are missing. Repos already present are left untouched.
+ * Ensure a single repo is checked out at `dir`, cloning it if missing. Returns
+ * a result rather than throwing so one failure does not abort a run.
  */
-export function ensureTargets(repos, workspaceDir) {
-    const result = { cloned: [], skipped: [], errors: [] };
-    for (const repo of repos) {
-        const dir = join(workspaceDir, repo);
-        if (existsSync(dir)) {
-            result.skipped.push(repo);
-            continue;
-        }
-        const run = spawnSync('gh', buildCloneArgs(repo, dir), {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'pipe'],
-            env: process.env,
-        });
-        if (run.error) {
-            const code = run.error.code;
-            result.errors.push({
-                repo,
-                error: code === 'ENOENT'
-                    ? '`gh` is not on PATH. Install the GitHub CLI.'
-                    : String(run.error),
-            });
-        }
-        else if (run.status !== 0) {
-            result.errors.push({ repo, error: (run.stderr ?? '').trim() });
-        }
-        else {
-            result.cloned.push(repo);
-        }
+export async function prepareRepo(repo, dir) {
+    if (existsSync(dir)) {
+        return { ok: true, skipped: true };
     }
-    return result;
+    const run = spawnSync('gh', buildCloneArgs(repo, dir), {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: process.env,
+    });
+    if (run.error) {
+        const code = run.error.code;
+        return {
+            ok: false,
+            skipped: false,
+            error: code === 'ENOENT'
+                ? '`gh` is not on PATH. Install the GitHub CLI.'
+                : String(run.error),
+        };
+    }
+    if (run.status !== 0) {
+        return { ok: false, skipped: false, error: (run.stderr ?? '').trim() };
+    }
+    return { ok: true, skipped: false };
 }
 /* c8 ignore stop */
 //# sourceMappingURL=clone.js.map

package/dist/run/clone.js.map

@@ -1 +1 @@
-{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../source/run/clone.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAE/B,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACvD,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9E,CAAC;AASD,8DAA8D;AAC9D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC5B,KAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAwB,EAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;IAE1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACV,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,GAAG,CAAC,KAA+B,CAAC,IAAI,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,IAAI;gBACJ,KAAK,EACJ,IAAI,KAAK,QAAQ;oBAChB,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AACD,oBAAoB"}
+{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../source/run/clone.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AAEnC,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACvD,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9E,CAAC;AAUD,8DAA8D;AAC9D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,IAAY,EACZ,GAAW;IAEX,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;IAClC,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;QACtD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;KAChB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,GAAG,CAAC,KAA+B,CAAC,IAAI,CAAC;QACvD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK;YACd,KAAK,EACJ,IAAI,KAAK,QAAQ;gBAChB,CAAC,CAAC,8CAA8C;gBAChD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;SACrB,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAC,CAAC;AACnC,CAAC;AACD,oBAAoB"}

package/dist/run/expand.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Expand a config's targets into concrete repositories. Explicit `repo:`
+ * targets pass through; `pattern:` targets are matched against the owner's
+ * repositories (listed via an injected {@link RepoLister}). A repo that matches
+ * several targets is audited once, with the union of their rule packs.
+ */
+import type { Target } from '../config/types.js';
+import type { RepoLister } from './repo-lister.js';
+/** A concrete repository to audit, with its assigned rule packs. */
+export interface ResolvedRepoTarget {
+    repo: string;
+    rulePacks: string[];
+}
+/** The outcome of expanding targets. */
+export interface ExpandResult {
+    targets: ResolvedRepoTarget[];
+    /** Reasons a target could not be expanded (missing lister, list failure). */
+    errors: string[];
+}
+/**
+ * Expand `config.targets`. Pattern targets need a lister; without one they are
+ * recorded as errors and skipped. The owner is the segment before the first
+ * `/` in the pattern (e.g. `my-org` for `my-org/web-*`).
+ */
+export declare function expandTargets(targets: Target[], lister?: RepoLister): Promise<ExpandResult>;
+//# sourceMappingURL=expand.d.ts.map

package/dist/run/expand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand.d.ts","sourceRoot":"","sources":["../../source/run/expand.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAcD;;;;GAIG;AACH,wBAAsB,aAAa,CAClC,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,CAAC,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,CAAC,CAkDvB"}

package/dist/run/expand.js

@@ -0,0 +1,62 @@
+/**
+ * Expand a config's targets into concrete repositories. Explicit `repo:`
+ * targets pass through; `pattern:` targets are matched against the owner's
+ * repositories (listed via an injected {@link RepoLister}). A repo that matches
+ * several targets is audited once, with the union of their rule packs.
+ */
+import { matchesGlob } from '../rule-packs/glob.js';
+function addRepo(byRepo, repo, rulePacks) {
+    const packs = byRepo.get(repo) ?? new Set();
+    for (const pack of rulePacks) {
+        packs.add(pack);
+    }
+    byRepo.set(repo, packs);
+}
+/**
+ * Expand `config.targets`. Pattern targets need a lister; without one they are
+ * recorded as errors and skipped. The owner is the segment before the first
+ * `/` in the pattern (e.g. `my-org` for `my-org/web-*`).
+ */
+export async function expandTargets(targets, lister) {
+    const byRepo = new Map();
+    const errors = [];
+    const listed = new Map();
+    for (const target of targets) {
+        if (target.repo) {
+            addRepo(byRepo, target.repo, target.rulePacks);
+            continue;
+        }
+        if (!target.pattern) {
+            continue;
+        }
+        const pattern = target.pattern;
+        if (!lister) {
+            errors.push(`cannot expand pattern "${pattern}" — no repo lister available (needs a GitHub token)`);
+            continue;
+        }
+        const owner = pattern.split('/')[0];
+        if (!owner) {
+            errors.push(`invalid pattern "${pattern}" — expected owner/glob`);
+            continue;
+        }
+        let repos = listed.get(owner);
+        if (!repos) {
+            try {
+                repos = await lister.list(owner);
+                listed.set(owner, repos);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                errors.push(`failed to list repos for "${owner}": ${message}`);
+                continue;
+            }
+        }
+        const matched = repos.filter(repo => matchesGlob(pattern, repo));
+        for (const repo of matched) {
+            addRepo(byRepo, repo, target.rulePacks);
+        }
+    }
+    const resolved = [...byRepo.entries()].map(([repo, packs]) => ({ repo, rulePacks: [...packs] }));
+    return { targets: resolved, errors };
+}
+//# sourceMappingURL=expand.js.map

package/dist/run/expand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand.js","sourceRoot":"","sources":["../../source/run/expand.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAC,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAgBlD,SAAS,OAAO,CACf,MAAgC,EAChC,IAAY,EACZ,SAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAiB,EACjB,MAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/C,SAAS;QACV,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,SAAS;QACV,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACV,0BAA0B,OAAO,qDAAqD,CACtF,CAAC;YACF,SAAS;QACV,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,oBAAoB,OAAO,yBAAyB,CAAC,CAAC;YAClE,SAAS;QACV,CAAC;QAED,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC;gBACJ,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,6BAA6B,KAAK,MAAM,OAAO,EAAE,CAAC,CAAC;gBAC/D,SAAS;YACV,CAAC;QACF,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAyB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC/D,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,EAAC,CAAC,CAClD,CAAC;IACF,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAC,CAAC;AACpC,CAAC"}