@nanocollective/sentinel 0.1.0-alpha.0

package/dist/init/templates.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pure content generators for the files `sentinel init` scaffolds. Each returns
+ * a string; the generated sentinel.yaml parses under parseConfig and the
+ * starter pack parses under parseRulePack (both covered by tests).
+ */
+import type { InitOptions } from './types.js';
+/** The `sentinel.yaml` config, seeded from the init options. */
+export declare function sentinelYaml(options: InitOptions): string;
+/** The scheduled GitHub Actions audit workflow. */
+export declare function workflowYaml(options: InitOptions): string;
+/**
+ * The disabled starter pack. The leading underscore in its directory keeps
+ * Sentinel from loading it; the user opts in by copying it to a real path. It
+ * exercises every manifest field and the four body sections from the authoring
+ * guide.
+ */
+export declare function starterPack(): string;
+/**
+ * A nanocoder `agents.config.json` template. Sentinel points nanocoder at this
+ * file (via NANOCODER_CONFIG_DIR) so the provider/model wiring lives in the
+ * config repo — the same shape ContentForest uses. Local providers (Ollama,
+ * LM Studio) are usually auto-detected and need no entry here; the example
+ * below is a cloud provider to edit or delete.
+ */
+export declare function nanocoderConfig(): string;
+/** The config repo README pointing at the pack authoring docs. */
+export declare function configReadme(options: InitOptions): string;
+//# sourceMappingURL=templates.d.ts.map

package/dist/init/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../source/init/templates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,YAAY,CAAC;AAY5C,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAwBzD;AAED,mDAAmD;AACnD,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAgDzD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAmCpC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAkBxC;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAiCzD"}

package/dist/init/templates.js

@@ -0,0 +1,187 @@
+/**
+ * Pure content generators for the files `sentinel init` scaffolds. Each returns
+ * a string; the generated sentinel.yaml parses under parseConfig and the
+ * starter pack parses under parseRulePack (both covered by tests).
+ */
+function targetsBlock(targets) {
+    const list = targets.length > 0 ? targets : ['your-org/your-repo'];
+    return list
+        .map(repo => `  - repo: ${repo}\n    rule_packs: [example] # replace with your pack names`)
+        .join('\n');
+}
+/** The `sentinel.yaml` config, seeded from the init options. */
+export function sentinelYaml(options) {
+    return `# Sentinel configuration — one file per install.
+# Docs: https://docs.nanocollective.org/sentinel/docs/configuration
+
+# Repositories to audit and the rule packs that apply to each.
+targets:
+${targetsBlock(options.targets)}
+
+# When the scheduled audit runs (cron, UTC).
+schedule: "${options.schedule}"
+
+# Findings below this severity appear in the summary but do not file issues.
+severity_threshold: ${options.severityThreshold} # low | medium | high | critical
+
+# Which Nanocoder provider and model to use. Local-first by default.
+model:
+  provider: ${options.provider}
+  model: ${options.model}
+
+# How findings are filed as issues.
+issues:
+  label: ${options.label}
+  aggregate_to_config_repo: false
+`;
+}
+/** The scheduled GitHub Actions audit workflow. */
+export function workflowYaml(options) {
+    return `name: Sentinel
+
+on:
+  schedule:
+    - cron: "${options.schedule}"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Run the full audit but file no issues"
+        type: boolean
+        default: false
+
+# One audit at a time; never cancel an in-progress run.
+concurrency:
+  group: sentinel
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out configuration
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Run Sentinel
+        env:
+          # A token that can read the audited repos and open issues on them.
+          # The default GITHUB_TOKEN only reaches THIS repository, so to audit
+          # other repos add a PAT (or GitHub App token) as the SENTINEL_TOKEN
+          # secret with repo + issues scope.
+          GH_TOKEN: \${{ secrets.SENTINEL_TOKEN || secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: \${{ secrets.SENTINEL_TOKEN || secrets.GITHUB_TOKEN }}
+        run: >-
+          npx -y @nanocollective/sentinel@latest run
+          --workspace "$RUNNER_TEMP/sentinel"
+          --output "$GITHUB_STEP_SUMMARY"
+          \${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}
+`;
+}
+/**
+ * The disabled starter pack. The leading underscore in its directory keeps
+ * Sentinel from loading it; the user opts in by copying it to a real path. It
+ * exercises every manifest field and the four body sections from the authoring
+ * guide.
+ */
+export function starterPack() {
+    return `---
+name: example
+version: 0.1.0
+description: "Illustrative starter pack — demonstrates every manifest field. Not enabled."
+applies_to:
+  paths: ["src/**/*.ts"]
+  languages: ["typescript"]
+severity_weighting:
+  sql-injection: critical
+  unbounded-query: medium
+depends_on: []
+category: security
+---
+
+# What this pack audits
+
+You are reviewing a TypeScript service. This is an illustrative example — replace
+it with rules that describe the code your organisation actually ships.
+
+## Flag these
+
+- **SQL injection.** User input reaching a database query without parameterisation.
+- **Unbounded query.** A query that can return an entire table with no limit.
+
+## Severity guidance
+
+- SQL injection on a user-facing path: **critical**.
+- An unbounded query in a hot path: **medium**.
+
+## Do not flag
+
+- Parameterised queries built with the project's query builder — those are safe.
+- Queries in \`**/*.spec.ts\` test files.
+`;
+}
+/**
+ * A nanocoder `agents.config.json` template. Sentinel points nanocoder at this
+ * file (via NANOCODER_CONFIG_DIR) so the provider/model wiring lives in the
+ * config repo — the same shape ContentForest uses. Local providers (Ollama,
+ * LM Studio) are usually auto-detected and need no entry here; the example
+ * below is a cloud provider to edit or delete.
+ */
+export function nanocoderConfig() {
+    return `${JSON.stringify({
+        nanocoder: {
+            providers: [
+                {
+                    name: 'Example cloud provider — edit or remove',
+                    sdkProvider: 'anthropic',
+                    baseUrl: 'https://api.example.com/anthropic/v1',
+                    apiKey: '${SENTINEL_MODEL_KEY}',
+                    models: ['example-model'],
+                },
+            ],
+        },
+    }, null, 2)}\n`;
+}
+/** The config repo README pointing at the pack authoring docs. */
+export function configReadme(options) {
+    return `# Sentinel configuration
+
+This repository configures [Sentinel](https://docs.nanocollective.org/sentinel/docs)
+for your organisation. It audits the repositories listed in \`sentinel.yaml\` on a
+schedule and files findings as issues.
+
+## Getting started
+
+Sentinel ships **no rule packs** — it does nothing until you write one.
+
+1. Edit \`sentinel.yaml\`: set your real \`targets\` and the model you want.
+2. Write your first rule pack in \`rule-packs/\`. A disabled example lives in
+   \`rule-packs/_starter/example.md\`; copy it to \`rule-packs/<name>.md\` and edit.
+   See the [authoring guide](https://docs.nanocollective.org/sentinel/docs/rule-packs/authoring).
+3. Commit and push. The audit runs on its schedule (\`${options.schedule}\`), or
+   dispatch the **Sentinel** workflow manually (use dry-run first).
+
+## Model configuration
+
+\`sentinel.yaml\` names *which* model to use (id + provider). The provider
+*wiring* (endpoint, API key) lives in \`agents.config.json\`, which Sentinel hands
+to Nanocoder — the same shape ContentForest uses. Local providers (Ollama, LM
+Studio) are usually auto-detected and need no entry; for a cloud provider, edit
+the example block and set its key as an environment variable / Actions secret.
+
+## Layout
+
+- \`sentinel.yaml\` — targets, schedule, model, and issue routing.
+- \`agents.config.json\` — Nanocoder provider/model wiring.
+- \`rule-packs/\` — your rule packs (you author these).
+- \`.github/workflows/sentinel.yml\` — the scheduled audit.
+`;
+}
+//# sourceMappingURL=templates.js.map

package/dist/init/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../source/init/templates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,SAAS,YAAY,CAAC,OAAiB;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACnE,OAAO,IAAI;SACT,GAAG,CACH,IAAI,CAAC,EAAE,CACN,aAAa,IAAI,4DAA4D,CAC9E;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,OAAoB;IAChD,OAAO;;;;;EAKN,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;;;aAGlB,OAAO,CAAC,QAAQ;;;sBAGP,OAAO,CAAC,iBAAiB;;;;cAIjC,OAAO,CAAC,QAAQ;WACnB,OAAO,CAAC,KAAK;;;;WAIb,OAAO,CAAC,KAAK;;CAEvB,CAAC;AACF,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,YAAY,CAAC,OAAoB;IAChD,OAAO;;;;eAIO,OAAO,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0C9B,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IAC1B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCP,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC9B,OAAO,GAAG,IAAI,CAAC,SAAS,CACvB;QACC,SAAS,EAAE;YACV,SAAS,EAAE;gBACV;oBACC,IAAI,EAAE,yCAAyC;oBAC/C,WAAW,EAAE,WAAW;oBACxB,OAAO,EAAE,sCAAsC;oBAC/C,MAAM,EAAE,uBAAuB;oBAC/B,MAAM,EAAE,CAAC,eAAe,CAAC;iBACzB;aACD;SACD;KACD,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CAAC;AACP,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,OAAoB;IAChD,OAAO;;;;;;;;;;;;;;wDAcgD,OAAO,CAAC,QAAQ;;;;;;;;;;;;;;;;;CAiBvE,CAAC;AACF,CAAC"}

package/dist/init/types.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Types for `sentinel init`, the scaffolder. The resolved options drive pure
+ * content generation (templates.ts) and a file plan (plan.ts); the writer
+ * (scaffold.ts) puts them on disk.
+ */
+import type { Severity } from '../findings/types.js';
+/** The fully-resolved options an init run scaffolds from. */
+export interface InitOptions {
+    /** Nanocoder model provider (ollama, lmstudio, a cloud provider, …). */
+    provider: string;
+    /** Model identifier for that provider. */
+    model: string;
+    /** Cron schedule (UTC) for the audit workflow. */
+    schedule: string;
+    /** Repositories to seed `targets` with, as owner/name. */
+    targets: string[];
+    /** Filing threshold to seed the config with. */
+    severityThreshold: Severity;
+    /** Label applied to filed issues. */
+    label: string;
+}
+/** Defaults applied to anything the user does not supply. */
+export declare const DEFAULT_INIT_OPTIONS: InitOptions;
+/** One file the scaffolder will write, as a repo-relative path and content. */
+export interface ScaffoldFile {
+    path: string;
+    content: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/init/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/init/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAEnD,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC3B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gDAAgD;IAChD,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;CACd;AAED,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,EAAE,WAOlC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB"}

package/dist/init/types.js

@@ -0,0 +1,15 @@
+/**
+ * Types for `sentinel init`, the scaffolder. The resolved options drive pure
+ * content generation (templates.ts) and a file plan (plan.ts); the writer
+ * (scaffold.ts) puts them on disk.
+ */
+/** Defaults applied to anything the user does not supply. */
+export const DEFAULT_INIT_OPTIONS = {
+    provider: 'ollama',
+    model: 'llama3.1:70b',
+    schedule: '0 6 * * *',
+    targets: [],
+    severityThreshold: 'medium',
+    label: 'sentinel',
+};
+//# sourceMappingURL=types.js.map

package/dist/init/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/init/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAChD,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,EAAE;IACX,iBAAiB,EAAE,QAAQ;IAC3B,KAAK,EAAE,UAAU;CACjB,CAAC"}

package/dist/issues/body.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Build the title and Markdown body of an issue from a finding. Pure and
+ * heavily tested — this is the human-facing surface of the whole tool, so it
+ * degrades gracefully when the optional model-authored fields are absent.
+ */
+import type { Finding } from '../findings/types.js';
+import type { FilingContext } from './types.js';
+/** A concise, scannable issue title. */
+export declare function buildIssueTitle(finding: Finding): string;
+/** The full issue body. */
+export declare function buildIssueBody(finding: Finding, context: FilingContext): string;
+//# sourceMappingURL=body.d.ts.map

package/dist/issues/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../source/issues/body.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,YAAY,CAAC;AAkB9C,wCAAwC;AACxC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAMxD;AAED,2BAA2B;AAC3B,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,aAAa,GACpB,MAAM,CA+CR"}

package/dist/issues/body.js

@@ -0,0 +1,53 @@
+/**
+ * Build the title and Markdown body of an issue from a finding. Pure and
+ * heavily tested — this is the human-facing surface of the whole tool, so it
+ * degrades gracefully when the optional model-authored fields are absent.
+ */
+const TITLE_HEADLINE_MAX = 80;
+function truncate(text, max) {
+    const clean = text.replace(/\s+/g, ' ').trim();
+    return clean.length > max ? `${clean.slice(0, max - 1)}…` : clean;
+}
+/** A code fence longer than any backtick run in the snippet, so it can't break. */
+function fenceFor(snippet) {
+    const longestRun = Math.max(0, ...[...snippet.matchAll(/`+/g)].map(match => match[0].length));
+    return '`'.repeat(Math.max(3, longestRun + 1));
+}
+/** A concise, scannable issue title. */
+export function buildIssueTitle(finding) {
+    const headline = truncate(finding.summary ?? finding.rule, TITLE_HEADLINE_MAX);
+    return `Sentinel [${finding.severity}] ${headline} (${finding.file}:${finding.lineRange.start})`;
+}
+/** The full issue body. */
+export function buildIssueBody(finding, context) {
+    const { file, lineRange, rule, severity, confidence, category } = finding;
+    const parts = [];
+    parts.push(finding.summary ?? `A ${category} finding produced by rule \`${rule}\`.`);
+    parts.push([
+        `**Severity:** ${severity} · **Confidence:** ${confidence} · **Category:** ${category}`,
+        `**Location:** \`${file}\` lines ${lineRange.start}–${lineRange.end}`,
+        `**Rule:** \`${rule}\`${context.packVersion ? ` (pack ${context.packVersion})` : ''}`,
+    ].join('\n'));
+    if (finding.rationale) {
+        parts.push(['### Why this severity', '', finding.rationale].join('\n'));
+    }
+    const fence = fenceFor(finding.offendingSnippet);
+    parts.push([
+        '### Offending code',
+        `${fence}`,
+        finding.offendingSnippet,
+        `${fence}`,
+    ].join('\n'));
+    if (finding.suggestedNextSteps) {
+        parts.push(['### Suggested next steps', '', finding.suggestedNextSteps].join('\n'));
+    }
+    const configLink = context.configRepo
+        ? ` Configured in [\`${context.configRepo}\`](https://github.com/${context.configRepo}).`
+        : '';
+    parts.push([
+        '---',
+        `🛡️ Filed by Sentinel.${configLink} If this is a false positive, close this issue as \`sentinel:false-positive\` (or add that label) and Sentinel will not refile it.`,
+    ].join('\n'));
+    return parts.join('\n\n');
+}
+//# sourceMappingURL=body.js.map

package/dist/issues/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../source/issues/body.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,OAAe;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAC1B,CAAC,EACD,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAC7D,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC/C,MAAM,QAAQ,GAAG,QAAQ,CACxB,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAC/B,kBAAkB,CAClB,CAAC;IACF,OAAO,aAAa,OAAO,CAAC,QAAQ,KAAK,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC;AAClG,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,cAAc,CAC7B,OAAgB,EAChB,OAAsB;IAEtB,MAAM,EAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAC,GAAG,OAAO,CAAC;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CACT,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,+BAA+B,IAAI,KAAK,CACxE,CAAC;IAEF,KAAK,CAAC,IAAI,CACT;QACC,iBAAiB,QAAQ,sBAAsB,UAAU,oBAAoB,QAAQ,EAAE;QACvF,mBAAmB,IAAI,YAAY,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,GAAG,EAAE;QACrE,eAAe,IAAI,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACrF,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;IAEF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CACT;QACC,oBAAoB;QACpB,GAAG,KAAK,EAAE;QACV,OAAO,CAAC,gBAAgB;QACxB,GAAG,KAAK,EAAE;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;IAEF,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACT,CAAC,0BAA0B,EAAE,EAAE,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACvE,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;QACpC,CAAC,CAAC,qBAAqB,OAAO,CAAC,UAAU,0BAA0B,OAAO,CAAC,UAAU,IAAI;QACzF,CAAC,CAAC,EAAE,CAAC;IACN,KAAK,CAAC,IAAI,CACT;QACC,KAAK;QACL,yBAAyB,UAAU,oIAAoI;KACvK,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/issues/file.d.ts

@@ -0,0 +1,24 @@
+/**
+ * File findings as issues: gate by the severity threshold, build issue content,
+ * route to the audited repo (or the config repo when aggregating), and create
+ * each issue through the injected {@link GitHubClient}.
+ *
+ * Dedup (task #7) will slot in front of the create call; this module is the
+ * plain filing path it wraps.
+ */
+import type { SentinelConfig } from '../config/types.js';
+import { type Finding } from '../findings/types.js';
+import type { FilingContext, FilingResult, GitHubClient, IssueContent } from './types.js';
+/** Findings at or above the configured filing threshold. */
+export declare function qualifyingFindings(findings: Finding[], config: SentinelConfig): Finding[];
+/** Which repository issues are filed on for this config. */
+export declare function targetRepoFor(config: SentinelConfig, context: FilingContext): string;
+/** Render one finding into filable issue content. */
+export declare function buildIssueContent(finding: Finding, config: SentinelConfig, context: FilingContext): IssueContent;
+/**
+ * File every qualifying finding. Findings below the threshold are returned in
+ * `skipped`; a create that throws is captured in `errors` so one bad issue does
+ * not abort the batch.
+ */
+export declare function fileFindings(findings: Finding[], config: SentinelConfig, client: GitHubClient, context: FilingContext): Promise<FilingResult>;
+//# sourceMappingURL=file.d.ts.map

package/dist/issues/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../source/issues/file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAGvD,OAAO,EAAC,KAAK,OAAO,EAAyB,MAAM,sBAAsB,CAAC;AAE1E,OAAO,KAAK,EACX,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,MAAM,YAAY,CAAC;AAEpB,4DAA4D;AAC5D,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,GACpB,OAAO,EAAE,CAIX;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAC5B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,aAAa,GACpB,MAAM,CAKR;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,aAAa,GACpB,YAAY,CAYd;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CACjC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,GACpB,OAAO,CAAC,YAAY,CAAC,CAuBvB"}

package/dist/issues/file.js

@@ -0,0 +1,61 @@
+/**
+ * File findings as issues: gate by the severity threshold, build issue content,
+ * route to the audited repo (or the config repo when aggregating), and create
+ * each issue through the injected {@link GitHubClient}.
+ *
+ * Dedup (task #7) will slot in front of the create call; this module is the
+ * plain filing path it wraps.
+ */
+import { findingHash } from '../dedup/hash.js';
+import { upsertMarker } from '../dedup/markers.js';
+import { meetsSeverityThreshold } from '../findings/types.js';
+import { buildIssueBody, buildIssueTitle } from './body.js';
+/** Findings at or above the configured filing threshold. */
+export function qualifyingFindings(findings, config) {
+    return findings.filter(finding => meetsSeverityThreshold(finding.severity, config.severityThreshold));
+}
+/** Which repository issues are filed on for this config. */
+export function targetRepoFor(config, context) {
+    if (config.issues.aggregateToConfigRepo && context.configRepo) {
+        return context.configRepo;
+    }
+    return context.auditedRepo;
+}
+/** Render one finding into filable issue content. */
+export function buildIssueContent(finding, config, context) {
+    const body = upsertMarker(buildIssueBody(finding, context), 'hash', findingHash(finding));
+    return {
+        title: buildIssueTitle(finding),
+        body,
+        labels: [config.issues.label],
+        assignees: config.issues.assignee ? [config.issues.assignee] : [],
+    };
+}
+/**
+ * File every qualifying finding. Findings below the threshold are returned in
+ * `skipped`; a create that throws is captured in `errors` so one bad issue does
+ * not abort the batch.
+ */
+export async function fileFindings(findings, config, client, context) {
+    const targetRepo = targetRepoFor(config, context);
+    const result = { targetRepo, filed: [], skipped: [], errors: [] };
+    for (const finding of findings) {
+        if (!meetsSeverityThreshold(finding.severity, config.severityThreshold)) {
+            result.skipped.push(finding);
+            continue;
+        }
+        const content = buildIssueContent(finding, config, context);
+        try {
+            const issue = await client.createIssue({ repo: targetRepo, ...content });
+            result.filed.push({ finding, issue });
+        }
+        catch (error) {
+            result.errors.push({
+                finding,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=file.js.map

package/dist/issues/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../source/issues/file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,YAAY,EAAC,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAe,sBAAsB,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,cAAc,EAAE,eAAe,EAAC,MAAM,WAAW,CAAC;AAQ1D,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CACjC,QAAmB,EACnB,MAAsB;IAEtB,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAChC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAClE,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAC5B,MAAsB,EACtB,OAAsB;IAEtB,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAChC,OAAgB,EAChB,MAAsB,EACtB,OAAsB;IAEtB,MAAM,IAAI,GAAG,YAAY,CACxB,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,EAChC,MAAM,EACN,WAAW,CAAC,OAAO,CAAC,CACpB,CAAC;IACF,OAAO;QACN,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;QAC/B,IAAI;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KACjE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,QAAmB,EACnB,MAAsB,EACtB,MAAoB,EACpB,OAAsB;IAEtB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAiB,EAAC,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;IAE9E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,SAAS;QACV,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAC,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,EAAC,CAAC,CAAC;YACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,KAAK,EAAC,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,OAAO;gBACP,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/issues/gh-client.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The real {@link GitHubClient}, backed by the `gh` CLI. In GitHub Actions `gh`
+ * is preinstalled and authenticated from the workflow token; locally it uses
+ * the user's `gh auth` session. Arg building is pure and tested; the spawn and
+ * URL parsing are not.
+ */
+import type { CreatedIssue, CreateIssueParams, ExistingIssue, ReconcileClient } from './types.js';
+/** Build the `gh issue create` argv for the given params. Pure and tested. */
+export declare function buildGhIssueArgs(params: CreateIssueParams): string[];
+/** Parse the issue number from the URL `gh issue create` prints on success. */
+export declare function parseIssueUrl(output: string): CreatedIssue | null;
+/** Build the `gh issue list` argv that returns the JSON dedup needs. */
+export declare function buildGhListArgs(repo: string, label: string): string[];
+/** Build the `gh issue edit` argv that replaces an issue body. */
+export declare function buildGhEditArgs(repo: string, issueNumber: number, body: string): string[];
+/** Build the `gh issue close` argv. */
+export declare function buildGhCloseArgs(repo: string, issueNumber: number, reason?: string, comment?: string): string[];
+/** Parse the JSON `gh issue list --json ...` prints into ExistingIssues. */
+export declare function parseIssueList(json: string): ExistingIssue[];
+export declare const ghIssueClient: ReconcileClient;
+//# sourceMappingURL=gh-client.d.ts.map

package/dist/issues/gh-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-client.d.ts","sourceRoot":"","sources":["../../source/issues/gh-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAkBpE;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAOjE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAerE;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAC9B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACV,MAAM,EAAE,CAEV;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACd,MAAM,EAAE,CASV;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAe5D;AA2BD,eAAO,MAAM,aAAa,EAAE,eA4C3B,CAAC"}

package/dist/issues/gh-client.js

@@ -0,0 +1,133 @@
+/**
+ * The real {@link GitHubClient}, backed by the `gh` CLI. In GitHub Actions `gh`
+ * is preinstalled and authenticated from the workflow token; locally it uses
+ * the user's `gh auth` session. Arg building is pure and tested; the spawn and
+ * URL parsing are not.
+ */
+import { spawnSync } from 'node:child_process';
+/** Build the `gh issue create` argv for the given params. Pure and tested. */
+export function buildGhIssueArgs(params) {
+    const args = [
+        'issue',
+        'create',
+        '--repo',
+        params.repo,
+        '--title',
+        params.title,
+        '--body',
+        params.body,
+    ];
+    for (const label of params.labels) {
+        args.push('--label', label);
+    }
+    for (const assignee of params.assignees) {
+        args.push('--assignee', assignee);
+    }
+    return args;
+}
+/** Parse the issue number from the URL `gh issue create` prints on success. */
+export function parseIssueUrl(output) {
+    const url = output.trim().split('\n').pop()?.trim() ?? '';
+    const match = url.match(/\/issues\/(\d+)\s*$/);
+    if (!match) {
+        return null;
+    }
+    return { number: Number(match[1]), url };
+}
+/** Build the `gh issue list` argv that returns the JSON dedup needs. */
+export function buildGhListArgs(repo, label) {
+    return [
+        'issue',
+        'list',
+        '--repo',
+        repo,
+        '--label',
+        label,
+        '--state',
+        'all',
+        '--limit',
+        '1000',
+        '--json',
+        'number,url,state,labels,body',
+    ];
+}
+/** Build the `gh issue edit` argv that replaces an issue body. */
+export function buildGhEditArgs(repo, issueNumber, body) {
+    return ['issue', 'edit', String(issueNumber), '--repo', repo, '--body', body];
+}
+/** Build the `gh issue close` argv. */
+export function buildGhCloseArgs(repo, issueNumber, reason, comment) {
+    const args = ['issue', 'close', String(issueNumber), '--repo', repo];
+    if (reason) {
+        args.push('--reason', reason);
+    }
+    if (comment) {
+        args.push('--comment', comment);
+    }
+    return args;
+}
+/** Parse the JSON `gh issue list --json ...` prints into ExistingIssues. */
+export function parseIssueList(json) {
+    const raw = JSON.parse(json);
+    return raw.map(item => ({
+        number: item.number,
+        url: item.url,
+        state: item.state.toLowerCase() === 'open' ? 'open' : 'closed',
+        labels: item.labels.map(label => label.name),
+        body: item.body,
+    }));
+}
+/* c8 ignore start -- spawns the gh CLI; not exercised in unit tests. */
+function runGh(args) {
+    const result = spawnSync('gh', args, {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: process.env,
+    });
+    if (result.error) {
+        const code = result.error.code;
+        if (code === 'ENOENT') {
+            throw new Error('`gh` is not on PATH. Install the GitHub CLI.');
+        }
+        throw result.error;
+    }
+    return {
+        status: result.status ?? 1,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+}
+export const ghIssueClient = {
+    async createIssue(params) {
+        const result = runGh(buildGhIssueArgs(params));
+        if (result.status !== 0) {
+            throw new Error(`gh issue create failed (status ${result.status}): ${result.stderr}`.trim());
+        }
+        const created = parseIssueUrl(result.stdout);
+        if (!created) {
+            throw new Error(`could not parse issue URL from gh output: ${result.stdout}`);
+        }
+        return created;
+    },
+    async listIssues({ repo, label }) {
+        const result = runGh(buildGhListArgs(repo, label));
+        if (result.status !== 0) {
+            throw new Error(`gh issue list failed (status ${result.status}): ${result.stderr}`.trim());
+        }
+        return parseIssueList(result.stdout);
+    },
+    async updateIssue({ repo, number, body }) {
+        const result = runGh(buildGhEditArgs(repo, number, body));
+        if (result.status !== 0) {
+            throw new Error(`gh issue edit failed (status ${result.status}): ${result.stderr}`.trim());
+        }
+    },
+    async closeIssue({ repo, number, reason, comment }) {
+        const result = runGh(buildGhCloseArgs(repo, number, reason, comment));
+        if (result.status !== 0) {
+            throw new Error(`gh issue close failed (status ${result.status}): ${result.stderr}`.trim());
+        }
+    },
+};
+/* c8 ignore stop */
+//# sourceMappingURL=gh-client.js.map

package/dist/issues/gh-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh-client.js","sourceRoot":"","sources":["../../source/issues/gh-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAQ7C,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACzD,MAAM,IAAI,GAAG;QACZ,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,MAAM,CAAC,IAAI;QACX,SAAS;QACT,MAAM,CAAC,KAAK;QACZ,QAAQ;QACR,MAAM,CAAC,IAAI;KACX,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,EAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAC,CAAC;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,IAAI;QACJ,SAAS;QACT,KAAK;QACL,SAAS;QACT,KAAK;QACL,SAAS;QACT,MAAM;QACN,QAAQ;QACR,8BAA8B;KAC9B,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,WAAmB,EACnB,IAAY;IAEZ,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,gBAAgB,CAC/B,IAAY,EACZ,WAAmB,EACnB,MAAe,EACf,OAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAMzB,CAAC;IACH,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,IAAI,EAAE,IAAI,CAAC,IAAI;KACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,SAAS,KAAK,CAAC,IAAc;IAK5B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;QACpC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,OAAO,CAAC,GAAG;KAChB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,GAAI,MAAM,CAAC,KAA+B,CAAC,IAAI,CAAC;QAC1D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO;QACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;KAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC7C,KAAK,CAAC,WAAW,CAAC,MAAyB;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACd,kCAAkC,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAC3E,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACd,6CAA6C,MAAM,CAAC,MAAM,EAAE,CAC5D,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAC,IAAI,EAAE,KAAK,EAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACd,gCAAgC,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CACzE,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACd,gCAAgC,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CACzE,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACd,iCAAiC,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAC1E,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC;AACF,oBAAoB"}