@nanocollective/sentinel 0.1.0-alpha.0

package/dist/config/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../source/config/parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,KAAK,IAAI,SAAS,EAAC,MAAM,MAAM,CAAC;AACxC,OAAO,EAAC,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAU/D,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,MAAM,0BAA0B,GAAa,QAAQ,CAAC;AACtD,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,yDAAyD;AACzD,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,iCAAiC;AACjC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAEvD,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEzC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,KAAa;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CACtB,KAAc,EACd,KAAa,EACb,MAAqB;IAErB,MAAM,KAAK,GAAG,WAAW,KAAK,GAAG,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAC,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;IAC/C,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC;YACX,KAAK;YACL,OAAO,EAAE,qDAAqD;SAC9D,CAAC,CAAC;IACJ,CAAC;IAED,IACC,OAAO;QACP,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAC/D,CAAC;QACF,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,KAAK,OAAO;YACtB,OAAO,EAAE,iCAAiC;SAC1C,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,KAAK,UAAU;YACzB,OAAO,EAAE,oCAAoC;SAC7C,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,KAAK,aAAa;YAC5B,OAAO,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACJ,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,GAAG,KAAK,eAAe,CAAC,GAAG;oBAClC,OAAO,EAAE,wCAAwC;iBACjD,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAW,EAAC,SAAS,EAAC,CAAC;IACnC,IAAI,OAAO,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,IAAI,UAAU,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACrB,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,yCAAyC;SAClD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,4BAA4B;SACrC,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAgB;QAC1B,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAChE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KACvD,CAAC;IAEF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,OAAO,EAAE,kCAAkC;aAC3C,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,4CAA4C;iBACrD,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,QAAQ,GAAG,EAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAC,CAAC;gBAC1D,IAAI,EAAE,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;oBACtC,IAAI,gBAAgB,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;wBAC1C,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,EAAE,CAAC,eAAe,CAAC;oBACpD,CAAC;yBAAM,CAAC;wBACP,MAAM,CAAC,IAAI,CAAC;4BACX,KAAK,EAAE,gCAAgC;4BACvC,OAAO,EAAE,4CAA4C;yBACrD,CAAC,CAAC;oBACJ,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,MAAqB;IAC5D,MAAM,MAAM,GAAiB;QAC5B,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,qBAAqB,EAAE,KAAK;KAC5B,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAC,CAAC,CAAC;QACpE,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC5B,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,kCAAkC;aAC3C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7D,IAAI,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAClC,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,yCAAyC;aAClD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,CAAC,qBAAqB,GAAG,KAAK,CAAC,wBAAwB,CAAC;QAC/D,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,iCAAiC;gBACxC,OAAO,EAAE,4CAA4C;aACrD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,CAAC,EAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAC,CAAC;SAClE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,CAAC,EAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,iCAAiC,EAAC,CAAC;SACzE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,gCAAgC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,2DAA2D;SACpE,CAAC,CAAC;IACJ,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;IACF,CAAC;IAED,iCAAiC;IACjC,IAAI,QAAQ,GAAG,gBAAgB,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,4CAA4C;aACrD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,2CAA2C;IAC3C,IAAI,iBAAiB,GAAG,0BAA0B,CAAC;IACnD,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EACN,gEAAgE;aACjE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,EAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAmB;QAC9B,OAAO;QACP,QAAQ;QACR,iBAAiB;QACjB,KAAK;QACL,MAAM;KACN,CAAC;IACF,OAAO,EAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;AAC1C,CAAC"}

package/dist/config/repo-override.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Parse the opt-in `sentinel.yaml` placed in an audited repo — the most
+ * specific suppression layer (see docs/findings/index.md#suppression). It can
+ * override the org severity threshold for this repo and declare systematic-
+ * noise exemptions.
+ */
+import type { RepoOverrideResult } from './types.js';
+/**
+ * Parse a per-repo override. An empty or absent file is valid and yields an
+ * override with no threshold change and no suppressions.
+ */
+export declare function parseRepoOverride(raw: string): RepoOverrideResult;
+//# sourceMappingURL=repo-override.d.ts.map

package/dist/config/repo-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-override.d.ts","sourceRoot":"","sources":["../../source/config/repo-override.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAGX,kBAAkB,EAElB,MAAM,YAAY,CAAC;AAuEpB;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CA+DjE"}

package/dist/config/repo-override.js

@@ -0,0 +1,128 @@
+/**
+ * Parse the opt-in `sentinel.yaml` placed in an audited repo — the most
+ * specific suppression layer (see docs/findings/index.md#suppression). It can
+ * override the org severity threshold for this repo and declare systematic-
+ * noise exemptions.
+ */
+import { parse as parseYaml } from 'yaml';
+import { isSeverity } from '../findings/types.js';
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === 'string');
+}
+function validateSuppression(value, index, errors) {
+    const field = `suppress[${index}]`;
+    if (!isObject(value)) {
+        errors.push({ field, message: 'each suppression must be a mapping' });
+        return null;
+    }
+    const hasRule = value.rule !== undefined;
+    const hasPaths = value.paths !== undefined;
+    if (!hasRule && !hasPaths) {
+        errors.push({
+            field,
+            message: 'a suppression must set at least one of rule or paths',
+        });
+    }
+    if (hasRule && !isNonEmptyString(value.rule)) {
+        errors.push({
+            field: `${field}.rule`,
+            message: 'rule must be a non-empty string',
+        });
+    }
+    let paths = [];
+    if (hasPaths) {
+        if (isStringArray(value.paths) && value.paths.length > 0) {
+            paths = value.paths;
+        }
+        else {
+            errors.push({
+                field: `${field}.paths`,
+                message: 'paths must be a non-empty list of glob strings',
+            });
+        }
+    }
+    if (value.reason !== undefined && typeof value.reason !== 'string') {
+        errors.push({ field: `${field}.reason`, message: 'reason must be a string' });
+    }
+    if (errors.some(e => e.field.startsWith(field))) {
+        return null;
+    }
+    const suppression = {
+        paths,
+        reason: typeof value.reason === 'string' ? value.reason : '',
+    };
+    if (isNonEmptyString(value.rule)) {
+        suppression.rule = value.rule;
+    }
+    return suppression;
+}
+/**
+ * Parse a per-repo override. An empty or absent file is valid and yields an
+ * override with no threshold change and no suppressions.
+ */
+export function parseRepoOverride(raw) {
+    let data;
+    try {
+        data = raw.trim().length === 0 ? {} : parseYaml(raw);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            valid: false,
+            override: null,
+            errors: [{ field: 'document', message: `invalid YAML: ${message}` }],
+        };
+    }
+    if (data === null) {
+        return { valid: true, override: { suppress: [] }, errors: [] };
+    }
+    if (!isObject(data)) {
+        return {
+            valid: false,
+            override: null,
+            errors: [
+                {
+                    field: 'document',
+                    message: 'per-repo sentinel.yaml must be a mapping',
+                },
+            ],
+        };
+    }
+    const errors = [];
+    const override = { suppress: [] };
+    if (data.severity_threshold !== undefined) {
+        if (isSeverity(data.severity_threshold)) {
+            override.severityThreshold = data.severity_threshold;
+        }
+        else {
+            errors.push({
+                field: 'severity_threshold',
+                message: 'severity_threshold must be one of: low, medium, high, critical',
+            });
+        }
+    }
+    if (data.suppress !== undefined) {
+        if (!Array.isArray(data.suppress)) {
+            errors.push({ field: 'suppress', message: 'suppress must be a list' });
+        }
+        else {
+            for (const [index, entry] of data.suppress.entries()) {
+                const suppression = validateSuppression(entry, index, errors);
+                if (suppression) {
+                    override.suppress.push(suppression);
+                }
+            }
+        }
+    }
+    if (errors.length > 0) {
+        return { valid: false, override: null, errors };
+    }
+    return { valid: true, override, errors: [] };
+}
+//# sourceMappingURL=repo-override.js.map

package/dist/config/repo-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-override.js","sourceRoot":"","sources":["../../source/config/repo-override.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,KAAK,IAAI,SAAS,EAAC,MAAM,MAAM,CAAC;AACxC,OAAO,EAAC,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAQhD,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAAc,EACd,KAAa,EACb,MAAqB;IAErB,MAAM,KAAK,GAAG,YAAY,KAAK,GAAG,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACX,KAAK;YACL,OAAO,EAAE,sDAAsD;SAC/D,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,KAAK,OAAO;YACtB,OAAO,EAAE,iCAAiC;SAC1C,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,QAAQ,EAAE,CAAC;QACd,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,KAAK,QAAQ;gBACvB,OAAO,EAAE,gDAAgD;aACzD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,GAAG,KAAK,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAgB;QAChC,KAAK;QACL,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KAC5D,CAAC;IACF,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,WAAW,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC5C,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,CAAC,EAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAC,CAAC;SAClE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAC,QAAQ,EAAE,EAAE,EAAC,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACP;oBACC,KAAK,EAAE,UAAU;oBACjB,OAAO,EAAE,0CAA0C;iBACnD;aACD;SACD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAiB,EAAC,QAAQ,EAAE,EAAE,EAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACtD,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EACN,gEAAgE;aACjE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAC,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtD,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC9D,IAAI,WAAW,EAAE,CAAC;oBACjB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrC,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;IAC/C,CAAC;IAED,OAAO,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;AAC5C,CAAC"}

package/dist/config/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The `sentinel.yaml` configuration model. There is one configuration per
+ * install: one file, one workflow, one schedule (see
+ * docs/configuration/index.md). Keys are snake_case on disk and normalised to
+ * camelCase here.
+ */
+import type { Severity } from '../findings/types.js';
+/** A repository (or pattern) to audit, with the packs assigned to it. */
+export interface Target {
+    /** A single `owner/name` repository. Mutually exclusive with `pattern`. */
+    repo?: string;
+    /** A glob over `owner/name` repositories. Mutually exclusive with `repo`. */
+    pattern?: string;
+    /** The rule pack names to run against this target. */
+    rulePacks: string[];
+}
+/** An optional cloud fallback, used only when the primary model struggles. */
+export interface ModelFallback {
+    provider: string;
+    model: string;
+    /** Name of the Actions secret holding the endpoint key. */
+    endpointSecret?: string;
+}
+/** Which Nanocoder provider and model to run. Local-first by default. */
+export interface ModelConfig {
+    provider: string;
+    model: string;
+    fallback?: ModelFallback;
+}
+/** Controls how findings are filed as issues. */
+export interface IssuesConfig {
+    /** Label applied to every filed issue. */
+    label: string;
+    /** GitHub login to assign filed issues to, or null. */
+    assignee: string | null;
+    /** File on the config repo instead of the audited repo. */
+    aggregateToConfigRepo: boolean;
+}
+/** The validated, normalised `sentinel.yaml`. */
+export interface SentinelConfig {
+    targets: Target[];
+    /** Cron expression (UTC) for the scheduled run. */
+    schedule: string;
+    /** The filing floor: findings below this severity do not open issues. */
+    severityThreshold: Severity;
+    model: ModelConfig;
+    issues: IssuesConfig;
+}
+/** One systematic-noise exemption in a per-repo override. */
+export interface Suppression {
+    /** The rule (pack/pattern) to suppress. Optional if `paths` is given. */
+    rule?: string;
+    /** Glob patterns the suppression applies to. Optional if `rule` is given. */
+    paths: string[];
+    /** Why the exemption exists. */
+    reason: string;
+}
+/**
+ * The opt-in `sentinel.yaml` placed in an audited repo — the most specific
+ * suppression layer (see docs/findings/index.md#suppression).
+ */
+export interface RepoOverride {
+    /** Optional per-repo override of the org severity threshold. */
+    severityThreshold?: Severity;
+    /** Systematic-noise exemptions for this repo. */
+    suppress: Suppression[];
+}
+/** A single reason a config file failed to parse or validate. */
+export interface ConfigError {
+    /** The offending field path, or 'document' for structural errors. */
+    field: string;
+    message: string;
+}
+/** The outcome of parsing `sentinel.yaml`. */
+export interface ConfigResult {
+    valid: boolean;
+    config: SentinelConfig | null;
+    errors: ConfigError[];
+}
+/** The outcome of parsing a per-repo override. */
+export interface RepoOverrideResult {
+    valid: boolean;
+    override: RepoOverride | null;
+    errors: ConfigError[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/config/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAEnD,yEAAyE;AACzE,MAAM,WAAW,MAAM;IACtB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2DAA2D;IAC3D,qBAAqB,EAAE,OAAO,CAAC;CAC/B;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;CACrB;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC3B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC5B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,QAAQ,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC3B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,WAAW,EAAE,CAAC;CACtB"}

package/dist/config/types.js

@@ -0,0 +1,8 @@
+/**
+ * The `sentinel.yaml` configuration model. There is one configuration per
+ * install: one file, one workflow, one schedule (see
+ * docs/configuration/index.md). Keys are snake_case on disk and normalised to
+ * camelCase here.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/config/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/dedup/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The content hash that identifies a finding across runs. Computed over the
+ * salient fields (rule, file, line range, category) so the same finding on a
+ * later run produces the same hash and is not filed twice
+ * (see docs/findings/index.md#dedup).
+ */
+import type { Finding } from '../findings/types.js';
+/** A stable 16-hex-char content hash for a finding. */
+export declare function findingHash(finding: Finding): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/dedup/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../source/dedup/hash.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,sBAAsB,CAAC;AAElD,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAQpD"}

package/dist/dedup/hash.js

@@ -0,0 +1,18 @@
+/**
+ * The content hash that identifies a finding across runs. Computed over the
+ * salient fields (rule, file, line range, category) so the same finding on a
+ * later run produces the same hash and is not filed twice
+ * (see docs/findings/index.md#dedup).
+ */
+import { createHash } from 'node:crypto';
+/** A stable 16-hex-char content hash for a finding. */
+export function findingHash(finding) {
+    const salient = [
+        finding.rule,
+        finding.file,
+        `${finding.lineRange.start}-${finding.lineRange.end}`,
+        finding.category,
+    ].join('\n');
+    return createHash('sha256').update(salient).digest('hex').slice(0, 16);
+}
+//# sourceMappingURL=hash.js.map

package/dist/dedup/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../source/dedup/hash.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAGvC,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG;QACf,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI;QACZ,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QACrD,OAAO,CAAC,QAAQ;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/dedup/markers.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Hidden HTML-comment markers embedded in an issue body. They carry the
+ * machine state dedup needs across runs — the finding's content hash, the
+ * last-seen timestamp, and the consecutive-miss counter — without a database.
+ * Implemented with plain string search (no dynamic RegExp) so values are opaque.
+ */
+/** Read a marker's value from a body, or null if absent. */
+export declare function readMarker(body: string, key: string): string | null;
+/** Add or replace a marker, returning the updated body. */
+export declare function upsertMarker(body: string, key: string, value: string): string;
+/** Read the consecutive-miss counter, defaulting to 0. */
+export declare function readMisses(body: string): number;
+//# sourceMappingURL=markers.d.ts.map

package/dist/dedup/markers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../source/dedup/markers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnE;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS7E;AAED,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C"}

package/dist/dedup/markers.js

@@ -0,0 +1,42 @@
+/**
+ * Hidden HTML-comment markers embedded in an issue body. They carry the
+ * machine state dedup needs across runs — the finding's content hash, the
+ * last-seen timestamp, and the consecutive-miss counter — without a database.
+ * Implemented with plain string search (no dynamic RegExp) so values are opaque.
+ */
+const PREFIX = 'sentinel';
+const CLOSE = ' -->';
+function open(key) {
+    return `<!-- ${PREFIX}:${key}=`;
+}
+/** Read a marker's value from a body, or null if absent. */
+export function readMarker(body, key) {
+    const start = body.indexOf(open(key));
+    if (start === -1) {
+        return null;
+    }
+    const valueStart = start + open(key).length;
+    const valueEnd = body.indexOf(CLOSE, valueStart);
+    if (valueEnd === -1) {
+        return null;
+    }
+    return body.slice(valueStart, valueEnd);
+}
+/** Add or replace a marker, returning the updated body. */
+export function upsertMarker(body, key, value) {
+    const marker = `${open(key)}${value}${CLOSE}`;
+    const start = body.indexOf(open(key));
+    if (start === -1) {
+        return `${body}\n${marker}`;
+    }
+    const valueEnd = body.indexOf(CLOSE, start);
+    const end = valueEnd + CLOSE.length;
+    return body.slice(0, start) + marker + body.slice(end);
+}
+/** Read the consecutive-miss counter, defaulting to 0. */
+export function readMisses(body) {
+    const raw = readMarker(body, 'misses');
+    const parsed = raw === null ? 0 : Number.parseInt(raw, 10);
+    return Number.isNaN(parsed) ? 0 : parsed;
+}
+//# sourceMappingURL=markers.js.map

package/dist/dedup/markers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markers.js","sourceRoot":"","sources":["../../source/dedup/markers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,KAAK,GAAG,MAAM,CAAC;AAErB,SAAS,IAAI,CAAC,GAAW;IACxB,OAAO,QAAQ,MAAM,IAAI,GAAG,GAAG,CAAC;AACjC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IACpE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC"}

package/dist/dedup/plan.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The dedup planner. Given this run's findings and the issues that already
+ * exist on the target repo, decide what to do with each: file a new issue,
+ * touch (reset) an existing one, suppress it (a maintainer closed it with a
+ * suppression label), or resolve a stale issue whose finding has been absent
+ * for enough consecutive runs. Pure and fully tested; the executor
+ * (reconcile.ts) applies the plan.
+ */
+import type { Finding } from '../findings/types.js';
+import type { ExistingIssue } from '../issues/types.js';
+/** Closing an issue with one of these labels means "do not refile". */
+export declare const SUPPRESSION_LABELS: readonly ["sentinel:false-positive", "sentinel:wontfix", "sentinel:accepted"];
+/** Options for planning. */
+export interface ReconcileOptions {
+    /** Consecutive absent runs before an open issue is auto-resolved. Min 1. */
+    resolveAfterMisses?: number;
+}
+/** An open issue matched by a finding this run: reset its miss counter. */
+export interface TouchOp {
+    issue: ExistingIssue;
+    finding: Finding;
+}
+/** An open issue absent this run but not yet stale: bump its miss counter. */
+export interface MissOp {
+    issue: ExistingIssue;
+    misses: number;
+}
+/** What reconcile should do this run. */
+export interface ReconcilePlan {
+    /** Findings with no existing issue: file them. */
+    toCreate: Finding[];
+    /** Findings matching an open issue: touch it. */
+    toTouch: TouchOp[];
+    /** Findings matching a suppression-closed issue: skip. */
+    suppressed: Finding[];
+    /** Open issues absent long enough to auto-resolve. */
+    toResolve: ExistingIssue[];
+    /** Open issues absent this run but below the resolve threshold. */
+    toIncrementMiss: MissOp[];
+}
+/**
+ * Plan the reconciliation of this run's findings against existing issues.
+ */
+export declare function planReconciliation(findings: Finding[], existing: ExistingIssue[], options?: ReconcileOptions): ReconcilePlan;
+//# sourceMappingURL=plan.d.ts.map

package/dist/dedup/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../source/dedup/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAItD,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,+EAIrB,CAAC;AAEX,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAChC,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,OAAO;IACvB,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,MAAM;IACtB,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC7B,kDAAkD;IAClD,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,OAAO,EAAE,CAAC;IACnB,0DAA0D;IAC1D,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,sDAAsD;IACtD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,mEAAmE;IACnE,eAAe,EAAE,MAAM,EAAE,CAAC;CAC1B;AAQD;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,aAAa,EAAE,EACzB,OAAO,GAAE,gBAAqB,GAC5B,aAAa,CA8Df"}

package/dist/dedup/plan.js

@@ -0,0 +1,83 @@
+/**
+ * The dedup planner. Given this run's findings and the issues that already
+ * exist on the target repo, decide what to do with each: file a new issue,
+ * touch (reset) an existing one, suppress it (a maintainer closed it with a
+ * suppression label), or resolve a stale issue whose finding has been absent
+ * for enough consecutive runs. Pure and fully tested; the executor
+ * (reconcile.ts) applies the plan.
+ */
+import { findingHash } from './hash.js';
+import { readMarker, readMisses } from './markers.js';
+/** Closing an issue with one of these labels means "do not refile". */
+export const SUPPRESSION_LABELS = [
+    'sentinel:false-positive',
+    'sentinel:wontfix',
+    'sentinel:accepted',
+];
+function hasSuppressionLabel(issue) {
+    return issue.labels.some(label => SUPPRESSION_LABELS.includes(label));
+}
+/**
+ * Plan the reconciliation of this run's findings against existing issues.
+ */
+export function planReconciliation(findings, existing, options = {}) {
+    const resolveAfterMisses = Math.max(1, options.resolveAfterMisses ?? 3);
+    // Deduplicate findings within this run by hash; first occurrence wins.
+    const findingByHash = new Map();
+    for (const finding of findings) {
+        const hash = findingHash(finding);
+        if (!findingByHash.has(hash)) {
+            findingByHash.set(hash, finding);
+        }
+    }
+    // Index existing issues by their embedded hash.
+    const suppressedHashes = new Set();
+    const openByHash = new Map();
+    for (const issue of existing) {
+        const hash = readMarker(issue.body, 'hash');
+        if (hash === null) {
+            continue;
+        }
+        if (hasSuppressionLabel(issue)) {
+            suppressedHashes.add(hash);
+        }
+        else if (issue.state === 'open') {
+            openByHash.set(hash, issue);
+        }
+    }
+    const plan = {
+        toCreate: [],
+        toTouch: [],
+        suppressed: [],
+        toResolve: [],
+        toIncrementMiss: [],
+    };
+    for (const [hash, finding] of findingByHash) {
+        if (suppressedHashes.has(hash)) {
+            plan.suppressed.push(finding);
+            continue;
+        }
+        const openIssue = openByHash.get(hash);
+        if (openIssue) {
+            plan.toTouch.push({ issue: openIssue, finding });
+        }
+        else {
+            plan.toCreate.push(finding);
+        }
+    }
+    // Open issues whose finding did not recur this run: age them out.
+    for (const [hash, issue] of openByHash) {
+        if (findingByHash.has(hash)) {
+            continue;
+        }
+        const misses = readMisses(issue.body) + 1;
+        if (misses >= resolveAfterMisses) {
+            plan.toResolve.push(issue);
+        }
+        else {
+            plan.toIncrementMiss.push({ issue, misses });
+        }
+    }
+    return plan;
+}
+//# sourceMappingURL=plan.js.map

package/dist/dedup/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../source/dedup/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAC,WAAW,EAAC,MAAM,WAAW,CAAC;AACtC,OAAO,EAAC,UAAU,EAAE,UAAU,EAAC,MAAM,cAAc,CAAC;AAEpD,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,yBAAyB;IACzB,kBAAkB;IAClB,mBAAmB;CACV,CAAC;AAkCX,SAAS,mBAAmB,CAAC,KAAoB;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC/B,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACzD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CACjC,QAAmB,EACnB,QAAyB,EACzB,UAA4B,EAAE;IAE9B,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAExE,uEAAuE;IACvE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAmB,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAED,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACnC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IAED,MAAM,IAAI,GAAkB;QAC3B,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,eAAe,EAAE,EAAE;KACnB,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;QAC7C,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IAED,kEAAkE;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,kBAAkB,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,MAAM,EAAC,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/dedup/reconcile.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The dedup executor. Fetches existing Sentinel issues on the target repo,
+ * plans the reconciliation, then applies it: file new findings, touch matched
+ * issues (reset misses + last-seen), age out absent ones, and auto-resolve the
+ * stale. Below-threshold findings are filtered out before planning, so they
+ * neither create nor touch.
+ */
+import type { RepoOverride, SentinelConfig } from '../config/types.js';
+import { type Finding } from '../findings/types.js';
+import type { CreatedIssue, FilingContext, ReconcileClient } from '../issues/types.js';
+import { type ReconcileOptions } from './plan.js';
+/** A summary of what one reconcile run did. */
+export interface ReconcileResult {
+    targetRepo: string;
+    created: CreatedIssue[];
+    touched: number;
+    incremented: number;
+    resolved: number;
+    /** Findings suppressed by a label-closed issue (dedup layer). */
+    suppressed: number;
+    /** Findings removed by the per-repo override's suppress rules. */
+    suppressedByOverride: number;
+}
+/**
+ * Reconcile this run's findings against the issues already on the target repo.
+ * `now` is passed in (ISO string) so the executor stays deterministic.
+ */
+export declare function reconcileFindings(findings: Finding[], config: SentinelConfig, client: ReconcileClient, context: FilingContext, now: string, options?: ReconcileOptions, override?: RepoOverride): Promise<ReconcileResult>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/dedup/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../source/dedup/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAC,YAAY,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAC,KAAK,OAAO,EAAyB,MAAM,sBAAsB,CAAC;AAE1E,OAAO,KAAK,EACX,YAAY,EACZ,aAAa,EACb,eAAe,EACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEpE,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,oBAAoB,EAAE,MAAM,CAAC;CAC7B;AAMD;;;GAGG;AACH,wBAAsB,iBAAiB,CACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,gBAAqB,EAC9B,QAAQ,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,eAAe,CAAC,CAiE1B"}

package/dist/dedup/reconcile.js

@@ -0,0 +1,73 @@
+/**
+ * The dedup executor. Fetches existing Sentinel issues on the target repo,
+ * plans the reconciliation, then applies it: file new findings, touch matched
+ * issues (reset misses + last-seen), age out absent ones, and auto-resolve the
+ * stale. Below-threshold findings are filtered out before planning, so they
+ * neither create nor touch.
+ */
+import { meetsSeverityThreshold } from '../findings/types.js';
+import { buildIssueContent, targetRepoFor } from '../issues/file.js';
+import { applyRepoOverride } from '../suppression/apply.js';
+import { upsertMarker } from './markers.js';
+import { planReconciliation } from './plan.js';
+function trackedBody(body, now) {
+    return upsertMarker(upsertMarker(body, 'last-seen', now), 'misses', '0');
+}
+/**
+ * Reconcile this run's findings against the issues already on the target repo.
+ * `now` is passed in (ISO string) so the executor stays deterministic.
+ */
+export async function reconcileFindings(findings, config, client, context, now, options = {}, override) {
+    const targetRepo = targetRepoFor(config, context);
+    const existing = await client.listIssues({
+        repo: targetRepo,
+        label: config.issues.label,
+    });
+    // Layer 3: apply the per-repo override (threshold + suppress rules), then
+    // gate by the effective threshold before planning.
+    const { kept, suppressed: overrideSuppressed, threshold, } = applyRepoOverride(findings, config, override);
+    const qualifying = kept.filter(finding => meetsSeverityThreshold(finding.severity, threshold));
+    const plan = planReconciliation(qualifying, existing, options);
+    const created = [];
+    for (const finding of plan.toCreate) {
+        const content = buildIssueContent(finding, config, context);
+        const issue = await client.createIssue({
+            repo: targetRepo,
+            ...content,
+            body: trackedBody(content.body, now),
+        });
+        created.push(issue);
+    }
+    for (const { issue } of plan.toTouch) {
+        await client.updateIssue({
+            repo: targetRepo,
+            number: issue.number,
+            body: trackedBody(issue.body, now),
+        });
+    }
+    for (const { issue, misses } of plan.toIncrementMiss) {
+        await client.updateIssue({
+            repo: targetRepo,
+            number: issue.number,
+            body: upsertMarker(issue.body, 'misses', String(misses)),
+        });
+    }
+    for (const issue of plan.toResolve) {
+        await client.closeIssue({
+            repo: targetRepo,
+            number: issue.number,
+            reason: 'completed',
+            comment: 'Sentinel is auto-resolving this finding: it has not recurred across recent audit runs.',
+        });
+    }
+    return {
+        targetRepo,
+        created,
+        touched: plan.toTouch.length,
+        incremented: plan.toIncrementMiss.length,
+        resolved: plan.toResolve.length,
+        suppressed: plan.suppressed.length,
+        suppressedByOverride: overrideSuppressed.length,
+    };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/dedup/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../../source/dedup/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAe,sBAAsB,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,iBAAiB,EAAE,aAAa,EAAC,MAAM,mBAAmB,CAAC;AAMnE,OAAO,EAAC,iBAAiB,EAAC,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAC,YAAY,EAAC,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAC,kBAAkB,EAAwB,MAAM,WAAW,CAAC;AAepE,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC7C,OAAO,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,QAAmB,EACnB,MAAsB,EACtB,MAAuB,EACvB,OAAsB,EACtB,GAAW,EACX,UAA4B,EAAE,EAC9B,QAAuB;IAEvB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;QACxC,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;KAC1B,CAAC,CAAC;IAEH,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,EACL,IAAI,EACJ,UAAU,EAAE,kBAAkB,EAC9B,SAAS,GACT,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CACxC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CACnD,CAAC;IACF,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,IAAI,EAAE,UAAU;YAChB,GAAG,OAAO;YACV,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,MAAM,EAAC,KAAK,EAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,WAAW,CAAC;YACxB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;SAClC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,EAAC,KAAK,EAAE,MAAM,EAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,WAAW,CAAC;YACxB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,UAAU,CAAC;YACvB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,WAAW;YACnB,OAAO,EACN,wFAAwF;SACzF,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,UAAU;QACV,OAAO;QACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAC5B,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM;QACxC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;QAC/B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;QAClC,oBAAoB,EAAE,kBAAkB,CAAC,MAAM;KAC/C,CAAC;AACH,CAAC"}