@nanocollective/sentinel 0.1.0-alpha.0

package/dist/rule-packs/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The rule pack format. A pack is a single file: a YAML manifest header
+ * followed by a Markdown body that is the audit prompt. The manifest is a
+ * stable v1 contract (see docs/rule-packs/index.md#manifest-fields).
+ *
+ * Manifest keys are snake_case on disk (`applies_to`, `severity_weighting`,
+ * `depends_on`) and normalised to camelCase here.
+ */
+import type { Severity } from '../findings/types.js';
+/** Scopes which files within a repository a pack reads. */
+export interface AppliesTo {
+    /** Glob patterns for files the pack applies to. Empty = the whole repo. */
+    paths: string[];
+    /** Language identifiers the pack targets. A hint for scoping and reporting. */
+    languages: string[];
+}
+/** The validated, normalised manifest of a rule pack. */
+export interface RulePackManifest {
+    /** Unique, kebab-case pack identifier. */
+    name: string;
+    /** Semver. Bumped whenever the audit body changes. */
+    version: string;
+    /** One-line description of what the pack audits for. */
+    description: string;
+    /** File scoping. */
+    appliesTo: AppliesTo;
+    /** Per-finding-type severity overrides, keyed by finding type. */
+    severityWeighting: Record<string, Severity>;
+    /** Other packs that should run alongside this one, by name. */
+    dependsOn: string[];
+    /** The pack's primary category, carried onto findings. */
+    category: string;
+}
+/** A parsed rule pack: its manifest and the Markdown audit prompt. */
+export interface RulePack {
+    manifest: RulePackManifest;
+    /** The Markdown body handed to the model as the audit prompt. */
+    body: string;
+}
+/** A single reason a pack (or a manifest field) failed to parse or validate. */
+export interface RulePackError {
+    /** The offending manifest field, or 'document' for structural errors. */
+    field: string;
+    /** A human-readable explanation. */
+    message: string;
+}
+/** The outcome of parsing a single rule pack file. */
+export interface ParseResult {
+    valid: boolean;
+    /** The parsed pack, or null when validation failed. */
+    pack: RulePack | null;
+    /** Every reason parsing failed. Empty when valid. */
+    errors: RulePackError[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/rule-packs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/rule-packs/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAEnD,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACzB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAChC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,+DAA+D;IAC/D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACxB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;CACb;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC7B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,qDAAqD;IACrD,MAAM,EAAE,aAAa,EAAE,CAAC;CACxB"}

package/dist/rule-packs/types.js

@@ -0,0 +1,10 @@
+/**
+ * The rule pack format. A pack is a single file: a YAML manifest header
+ * followed by a Markdown body that is the audit prompt. The manifest is a
+ * stable v1 contract (see docs/rule-packs/index.md#manifest-fields).
+ *
+ * Manifest keys are snake_case on disk (`applies_to`, `severity_weighting`,
+ * `depends_on`) and normalised to camelCase here.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/rule-packs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/rule-packs/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/run/audit.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Run one rule pack against one repository's gathered files: build the prompt,
+ * run the audit with the auto-fix loop, and map the result into a PackOutcome.
+ */
+import type { ModelConfig } from '../config/types.js';
+import { type AutoFixOptions } from '../orchestrator/auto-fix.js';
+import type { ModelRunner } from '../orchestrator/types.js';
+import type { SourceFile } from '../prompt/types.js';
+import type { RulePack } from '../rule-packs/types.js';
+import type { PackOutcome } from './types.js';
+/** The repository material one pack pass audits. */
+export interface PackAuditContext {
+    repoName?: string;
+    files: SourceFile[];
+    context?: SourceFile[];
+    repoNotes?: string;
+}
+/** Audit one pack against one repo's files. */
+export declare function auditPack(pack: RulePack, context: PackAuditContext, model: ModelConfig, runner: ModelRunner, options?: AutoFixOptions): Promise<PackOutcome>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/run/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../source/run/audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EACN,KAAK,cAAc,EAEnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAE1D,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,YAAY,CAAC;AAE5C,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+CAA+C;AAC/C,wBAAsB,SAAS,CAC9B,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAqBtB"}

package/dist/run/audit.js

@@ -0,0 +1,28 @@
+/**
+ * Run one rule pack against one repository's gathered files: build the prompt,
+ * run the audit with the auto-fix loop, and map the result into a PackOutcome.
+ */
+import { runAuditWithAutoFix, } from '../orchestrator/auto-fix.js';
+import { buildAuditPrompt } from '../prompt/build.js';
+/** Audit one pack against one repo's files. */
+export async function auditPack(pack, context, model, runner, options = {}) {
+    const { prompt } = buildAuditPrompt({
+        pack,
+        files: context.files,
+        repoName: context.repoName,
+        context: context.context,
+        repoNotes: context.repoNotes,
+    });
+    const result = await runAuditWithAutoFix(prompt, model, runner, options);
+    return {
+        pack: pack.manifest.name,
+        version: pack.manifest.version,
+        findings: result.findings,
+        attempts: result.attempts,
+        ok: result.ok,
+        errors: result.errors,
+        runError: result.runError,
+        raw: result.raw,
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/run/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../source/run/audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEN,mBAAmB,GACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAapD,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,IAAc,EACd,OAAyB,EACzB,KAAkB,EAClB,MAAmB,EACnB,UAA0B,EAAE;IAE5B,MAAM,EAAC,MAAM,EAAC,GAAG,gBAAgB,CAAC;QACjC,IAAI;QACJ,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzE,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG;KACf,CAAC;AACH,CAAC"}

package/dist/run/clone.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Clone target repositories into the run workspace. The audited repos are named
+ * in sentinel.yaml, not known to the workflow statically, so `sentinel run`
+ * clones any that are not already present. Arg building is pure and tested; the
+ * gh spawn and fs checks are not.
+ */
+/** Build the `gh repo clone` argv for a shallow single-branch clone. */
+export declare function buildCloneArgs(repo: string, dir: string): string[];
+/** The outcome of ensuring the target repos are present in the workspace. */
+export interface EnsureTargetsResult {
+    cloned: string[];
+    skipped: string[];
+    errors: {
+        repo: string;
+        error: string;
+    }[];
+}
+/**
+ * Ensure each repo is checked out under `workspaceDir/<owner>/<name>`, cloning
+ * any that are missing. Repos already present are left untouched.
+ */
+export declare function ensureTargets(repos: string[], workspaceDir: string): EnsureTargetsResult;
+//# sourceMappingURL=clone.d.ts.map

package/dist/run/clone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone.d.ts","sourceRoot":"","sources":["../../source/run/clone.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;CACxC;AAGD;;;GAGG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,YAAY,EAAE,MAAM,GAClB,mBAAmB,CA+BrB"}

package/dist/run/clone.js

@@ -0,0 +1,51 @@
+/**
+ * Clone target repositories into the run workspace. The audited repos are named
+ * in sentinel.yaml, not known to the workflow statically, so `sentinel run`
+ * clones any that are not already present. Arg building is pure and tested; the
+ * gh spawn and fs checks are not.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/** Build the `gh repo clone` argv for a shallow single-branch clone. */
+export function buildCloneArgs(repo, dir) {
+    return ['repo', 'clone', repo, dir, '--', '--depth', '1', '--single-branch'];
+}
+/* c8 ignore start -- spawns gh and touches the filesystem. */
+/**
+ * Ensure each repo is checked out under `workspaceDir/<owner>/<name>`, cloning
+ * any that are missing. Repos already present are left untouched.
+ */
+export function ensureTargets(repos, workspaceDir) {
+    const result = { cloned: [], skipped: [], errors: [] };
+    for (const repo of repos) {
+        const dir = join(workspaceDir, repo);
+        if (existsSync(dir)) {
+            result.skipped.push(repo);
+            continue;
+        }
+        const run = spawnSync('gh', buildCloneArgs(repo, dir), {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: process.env,
+        });
+        if (run.error) {
+            const code = run.error.code;
+            result.errors.push({
+                repo,
+                error: code === 'ENOENT'
+                    ? '`gh` is not on PATH. Install the GitHub CLI.'
+                    : String(run.error),
+            });
+        }
+        else if (run.status !== 0) {
+            result.errors.push({ repo, error: (run.stderr ?? '').trim() });
+        }
+        else {
+            result.cloned.push(repo);
+        }
+    }
+    return result;
+}
+/* c8 ignore stop */
+//# sourceMappingURL=clone.js.map

package/dist/run/clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../source/run/clone.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAE/B,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACvD,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9E,CAAC;AASD,8DAA8D;AAC9D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC5B,KAAe,EACf,YAAoB;IAEpB,MAAM,MAAM,GAAwB,EAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;IAE1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACV,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,GAAG,CAAC,KAA+B,CAAC,IAAI,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClB,IAAI;gBACJ,KAAK,EACJ,IAAI,KAAK,QAAQ;oBAChB,CAAC,CAAC,8CAA8C;oBAChD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;aACrB,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AACD,oBAAoB"}

package/dist/run/preview.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Dry-run preview. Computes what a live run *would* do — without mutating
+ * anything — by running the same override, threshold, and dedup planning
+ * read-only, then grouping the findings into the buckets the whitepaper calls
+ * for: would file as new, dedup would have matched, below severity threshold
+ * (see docs/workflow/index.md#run-modes).
+ */
+import type { RepoOverride, SentinelConfig } from '../config/types.js';
+import { type ReconcileOptions } from '../dedup/plan.js';
+import { type Finding } from '../findings/types.js';
+import type { ExistingIssue } from '../issues/types.js';
+/** The grouped outcome a live run would produce. */
+export interface DryRunPreview {
+    /** Findings with no existing issue: a live run would file these. */
+    wouldFileAsNew: Finding[];
+    /** Findings matching an existing open issue: dedup would touch, not refile. */
+    dedupWouldMatch: Finding[];
+    /** Findings below the effective threshold: never filed. */
+    belowThreshold: Finding[];
+    /** Findings removed by the per-repo override's suppress rules. */
+    suppressedByOverride: Finding[];
+    /** Findings matching a dismissed (false-positive/wontfix/accepted) issue. */
+    suppressedByLabel: Finding[];
+    /** Open issues a live run would auto-resolve as stale. */
+    wouldResolve: number;
+}
+/** Compute the dry-run preview for one repo's findings. */
+export declare function previewReconciliation(findings: Finding[], config: SentinelConfig, existing: ExistingIssue[], override?: RepoOverride, options?: ReconcileOptions): DryRunPreview;
+/** Render the dry-run previews for every repo as Markdown. */
+export declare function renderPreview(previews: {
+    repo: string;
+    preview: DryRunPreview;
+}[]): string;
+//# sourceMappingURL=preview.d.ts.map

package/dist/run/preview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../source/run/preview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAC,YAAY,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAqB,KAAK,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAC,KAAK,OAAO,EAAyB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAGtD,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC7B,oEAAoE;IACpE,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,kEAAkE;IAClE,oBAAoB,EAAE,OAAO,EAAE,CAAC;IAChC,6EAA6E;IAC7E,iBAAiB,EAAE,OAAO,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,2DAA2D;AAC3D,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,CAAC,EAAE,YAAY,EACvB,OAAO,GAAE,gBAAqB,GAC5B,aAAa,CA2Bf;AAgBD,8DAA8D;AAC9D,wBAAgB,aAAa,CAC5B,QAAQ,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAC,EAAE,GAChD,MAAM,CAwBR"}

package/dist/run/preview.js

@@ -0,0 +1,68 @@
+/**
+ * Dry-run preview. Computes what a live run *would* do — without mutating
+ * anything — by running the same override, threshold, and dedup planning
+ * read-only, then grouping the findings into the buckets the whitepaper calls
+ * for: would file as new, dedup would have matched, below severity threshold
+ * (see docs/workflow/index.md#run-modes).
+ */
+import { planReconciliation } from '../dedup/plan.js';
+import { meetsSeverityThreshold } from '../findings/types.js';
+import { applyRepoOverride } from '../suppression/apply.js';
+/** Compute the dry-run preview for one repo's findings. */
+export function previewReconciliation(findings, config, existing, override, options = {}) {
+    const { kept, suppressed: suppressedByOverride, threshold, } = applyRepoOverride(findings, config, override);
+    const belowThreshold = [];
+    const qualifying = [];
+    for (const finding of kept) {
+        if (meetsSeverityThreshold(finding.severity, threshold)) {
+            qualifying.push(finding);
+        }
+        else {
+            belowThreshold.push(finding);
+        }
+    }
+    const plan = planReconciliation(qualifying, existing, options);
+    return {
+        wouldFileAsNew: plan.toCreate,
+        dedupWouldMatch: plan.toTouch.map(op => op.finding),
+        belowThreshold,
+        suppressedByOverride,
+        suppressedByLabel: plan.suppressed,
+        wouldResolve: plan.toResolve.length,
+    };
+}
+function findingLine(finding) {
+    return `- **${finding.severity}** ${finding.summary ?? finding.rule} — \`${finding.file}\`:${finding.lineRange.start}`;
+}
+function group(title, findings) {
+    if (findings.length === 0) {
+        return `**${title}:** none`;
+    }
+    return [
+        `**${title}** (${findings.length}):`,
+        ...findings.map(findingLine),
+    ].join('\n');
+}
+/** Render the dry-run previews for every repo as Markdown. */
+export function renderPreview(previews) {
+    const parts = ['# Sentinel dry run', '', 'No issues were filed.'];
+    for (const { repo, preview } of previews) {
+        parts.push([
+            `## ${repo}`,
+            '',
+            group('Would file as new', preview.wouldFileAsNew),
+            '',
+            group('Dedup would have matched', preview.dedupWouldMatch),
+            '',
+            group('Below severity threshold', preview.belowThreshold),
+            '',
+            group('Suppressed by per-repo override', preview.suppressedByOverride),
+            '',
+            group('Suppressed by a prior dismissal', preview.suppressedByLabel),
+            '',
+            `**Would auto-resolve:** ${preview.wouldResolve} stale issue(s)`,
+        ].join('\n'));
+    }
+    return parts.join('\n\n');
+}
+//# sourceMappingURL=preview.js.map

package/dist/run/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../source/run/preview.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAC,kBAAkB,EAAwB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAe,sBAAsB,EAAC,MAAM,sBAAsB,CAAC;AAE1E,OAAO,EAAC,iBAAiB,EAAC,MAAM,yBAAyB,CAAC;AAkB1D,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CACpC,QAAmB,EACnB,MAAsB,EACtB,QAAyB,EACzB,QAAuB,EACvB,UAA4B,EAAE;IAE9B,MAAM,EACL,IAAI,EACJ,UAAU,EAAE,oBAAoB,EAChC,SAAS,GACT,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAElD,MAAM,cAAc,GAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,sBAAsB,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACzD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO;QACN,cAAc,EAAE,IAAI,CAAC,QAAQ;QAC7B,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC;QACnD,cAAc;QACd,oBAAoB;QACpB,iBAAiB,EAAE,IAAI,CAAC,UAAU;QAClC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;KACnC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACpC,OAAO,OAAO,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,QAAQ,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,KAAK,CAAC,KAAa,EAAE,QAAmB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,KAAK,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO;QACN,KAAK,KAAK,OAAO,QAAQ,CAAC,MAAM,IAAI;QACpC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;KAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAC5B,QAAkD;IAElD,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAElE,KAAK,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACT;YACC,MAAM,IAAI,EAAE;YACZ,EAAE;YACF,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,cAAc,CAAC;YAClD,EAAE;YACF,KAAK,CAAC,0BAA0B,EAAE,OAAO,CAAC,eAAe,CAAC;YAC1D,EAAE;YACF,KAAK,CAAC,0BAA0B,EAAE,OAAO,CAAC,cAAc,CAAC;YACzD,EAAE;YACF,KAAK,CAAC,iCAAiC,EAAE,OAAO,CAAC,oBAAoB,CAAC;YACtE,EAAE;YACF,KAAK,CAAC,iCAAiC,EAAE,OAAO,CAAC,iBAAiB,CAAC;YACnE,EAAE;YACF,2BAA2B,OAAO,CAAC,YAAY,iBAAiB;SAChE,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/run/report.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Render a run's outcome as Markdown — the local `--output` file and the
+ * Actions step summary. Pure and tested.
+ */
+import type { RunOutcome } from './types.js';
+/** Count the findings across a run. */
+export declare function countFindings(run: RunOutcome): number;
+/** Render a full run as a Markdown report. */
+export declare function renderReport(run: RunOutcome): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/run/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../source/run/report.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAA2B,UAAU,EAAC,MAAM,YAAY,CAAC;AA2DrE,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAMrD;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAapD"}

package/dist/run/report.js

@@ -0,0 +1,73 @@
+/**
+ * Render a run's outcome as Markdown — the local `--output` file and the
+ * Actions step summary. Pure and tested.
+ */
+import { findingHash } from '../dedup/hash.js';
+function findingSection(finding) {
+    const lines = [
+        `#### ${finding.severity.toUpperCase()} — ${finding.summary ?? finding.rule}`,
+        '',
+        `- **File:** \`${finding.file}\` lines ${finding.lineRange.start}–${finding.lineRange.end}`,
+        `- **Rule:** \`${finding.rule}\` · **Confidence:** ${finding.confidence} · **Category:** ${finding.category}`,
+        `- **Hash:** \`${findingHash(finding)}\``,
+    ];
+    if (finding.rationale) {
+        lines.push(`- **Why:** ${finding.rationale}`);
+    }
+    if (finding.suggestedNextSteps) {
+        lines.push(`- **Next:** ${finding.suggestedNextSteps}`);
+    }
+    return lines.join('\n');
+}
+function packSection(outcome) {
+    const header = `### Pack \`${outcome.pack}\` (v${outcome.version})`;
+    if (outcome.runError) {
+        return `${header}\n\n> Run error: ${outcome.runError}${rawBlock(outcome.raw)}`;
+    }
+    if (!outcome.ok) {
+        const detail = outcome.errors
+            .map(error => `${error.field}: ${error.message}`)
+            .join('; ');
+        return `${header}\n\n> Findings were malformed after ${outcome.attempts} attempt(s): ${detail}${rawBlock(outcome.raw)}`;
+    }
+    if (outcome.findings.length === 0) {
+        return `${header}\n\nNo findings.`;
+    }
+    return [header, '', ...outcome.findings.map(findingSection)].join('\n\n');
+}
+/** A collapsible block with the raw model output, for diagnosing a failure. */
+function rawBlock(raw) {
+    if (!raw) {
+        return '';
+    }
+    const capped = raw.length > 6000 ? `${raw.slice(0, 6000)}\n…(truncated)` : raw;
+    return `\n\n<details><summary>Raw model output</summary>\n\n\`\`\`\n${capped}\n\`\`\`\n</details>`;
+}
+function repoSection(outcome) {
+    const parts = [`## ${outcome.repo}`];
+    if (outcome.missingPacks.length > 0) {
+        parts.push(`> Missing packs (not in rule-packs/): ${outcome.missingPacks.join(', ')}`);
+    }
+    for (const pack of outcome.packs) {
+        parts.push(packSection(pack));
+    }
+    return parts.join('\n\n');
+}
+/** Count the findings across a run. */
+export function countFindings(run) {
+    return run.repos.reduce((total, repo) => total + repo.packs.reduce((sum, pack) => sum + pack.findings.length, 0), 0);
+}
+/** Render a full run as a Markdown report. */
+export function renderReport(run) {
+    const total = countFindings(run);
+    const header = [
+        '# Sentinel audit report',
+        '',
+        `${total} finding(s) across ${run.repos.length} repository(ies).`,
+    ].join('\n');
+    if (run.repos.length === 0) {
+        return `${header}\n\nNo repositories were audited.`;
+    }
+    return [header, ...run.repos.map(repoSection)].join('\n\n');
+}
+//# sourceMappingURL=report.js.map

package/dist/run/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../source/run/report.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAI7C,SAAS,cAAc,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAG;QACb,QAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE;QAC7E,EAAE;QACF,iBAAiB,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;QAC3F,iBAAiB,OAAO,CAAC,IAAI,wBAAwB,OAAO,CAAC,UAAU,oBAAoB,OAAO,CAAC,QAAQ,EAAE;QAC7G,iBAAiB,WAAW,CAAC,OAAO,CAAC,IAAI;KACzC,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,OAAoB;IACxC,MAAM,MAAM,GAAG,cAAc,OAAO,CAAC,IAAI,QAAQ,OAAO,CAAC,OAAO,GAAG,CAAC;IACpE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,GAAG,MAAM,oBAAoB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;aAC3B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,GAAG,MAAM,uCAAuC,OAAO,CAAC,QAAQ,gBAAgB,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,MAAM,kBAAkB,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GACX,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC;IACjE,OAAO,+DAA+D,MAAM,sBAAsB,CAAC;AACpG,CAAC;AAED,SAAS,WAAW,CAAC,OAAoB;IACxC,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACT,yCAAyC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,aAAa,CAAC,GAAe;IAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CACtB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACf,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EACxE,CAAC,CACD,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,YAAY,CAAC,GAAe;IAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG;QACd,yBAAyB;QACzB,EAAE;QACF,GAAG,KAAK,sBAAsB,GAAG,CAAC,KAAK,CAAC,MAAM,mBAAmB;KACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,MAAM,mCAAmC,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC"}

package/dist/run/run.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The `sentinel run` orchestrator. Drives the whole engine over a config:
+ * load packs, resolve each target's packs (+depends_on), gather the repo's
+ * files, audit each pack, then either reconcile findings into issues (Actions
+ * path) or leave the outcome for a Markdown report (local / dry-run path).
+ *
+ * All I/O is injected (RepoFiles, PackLoader, ModelRunner, ReconcileClient) so
+ * the orchestration is testable end-to-end with fakes.
+ */
+import type { SentinelConfig } from '../config/types.js';
+import { type ReconcileResult } from '../dedup/reconcile.js';
+import type { ReconcileClient } from '../issues/types.js';
+import type { AutoFixOptions } from '../orchestrator/auto-fix.js';
+import type { ModelRunner } from '../orchestrator/types.js';
+import { type DryRunPreview } from './preview.js';
+import type { PackLoadError, PackLoader, RepoFiles, RunOutcome } from './types.js';
+/** Injected dependencies for a run. */
+export interface RunDeps {
+    runner: ModelRunner;
+    files: RepoFiles;
+    packs: PackLoader;
+    /** Present only when filing issues (the Actions path). */
+    client?: ReconcileClient;
+    /** ISO timestamp for deterministic reconciliation. */
+    now: string;
+}
+/** Options for a config-driven run. */
+export interface RunConfigOptions {
+    /** Directory the target repos are checked out under. */
+    workspaceDir: string;
+    /** The config repo's rule-packs directory. */
+    packsDir: string;
+    /** The config repo's owner/name, for issue routing and footers. */
+    configRepo?: string;
+    /**
+     * The config repo directory holding nanocoder's agents.config.json. Passed
+     * to the runner as NANOCODER_CONFIG_DIR so provider wiring lives there.
+     */
+    configDir?: string;
+    /** Audit but file nothing. */
+    dryRun?: boolean;
+    autoFix?: AutoFixOptions;
+    resolveAfterMisses?: number;
+}
+/** Everything a config-driven run produced. */
+export interface RunReport {
+    outcome: RunOutcome;
+    /** Live-run reconciliation results (empty on a dry run). */
+    reconciled: {
+        repo: string;
+        result: ReconcileResult;
+    }[];
+    /** Dry-run previews (empty on a live run). */
+    previews: {
+        repo: string;
+        preview: DryRunPreview;
+    }[];
+    packLoadErrors: PackLoadError[];
+    /** True if issues were filed (client present and not a dry run). */
+    filed: boolean;
+}
+/** Run an audit driven by a Sentinel config. */
+export declare function runFromConfig(config: SentinelConfig, deps: RunDeps, options: RunConfigOptions): Promise<RunReport>;
+/** Dependencies for an ad-hoc local run of a single pack. */
+export interface RunLocalDeps {
+    runner: ModelRunner;
+    files: RepoFiles;
+}
+/**
+ * Run a single pack against a repository directory for off-cycle calibration.
+ * Never files issues. Throws if the pack file is missing or invalid.
+ */
+export declare function runLocal(packPath: string, repoDir: string, model: SentinelConfig['model'], deps: RunLocalDeps, options?: AutoFixOptions): Promise<RunOutcome>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../source/run/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAe,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAC,KAAK,eAAe,EAAoB,MAAM,uBAAuB,CAAC;AAE9E,OAAO,KAAK,EAAgB,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACvE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,0BAA0B,CAAC;AAK1D,OAAO,EAAC,KAAK,aAAa,EAAwB,MAAM,cAAc,CAAC;AAEvE,OAAO,KAAK,EACX,aAAa,EACb,UAAU,EAEV,SAAS,EAET,UAAU,EACV,MAAM,YAAY,CAAC;AAEpB,uCAAuC;AACvC,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAChC,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,UAAU,CAAC;IACpB,4DAA4D;IAC5D,UAAU,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAC,EAAE,CAAC;IACtD,8CAA8C;IAC9C,QAAQ,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAC,EAAE,CAAC;IACnD,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,oEAAoE;IACpE,KAAK,EAAE,OAAO,CAAC;CACf;AAcD,gDAAgD;AAChD,wBAAsB,aAAa,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,gBAAgB,GACvB,OAAO,CAAC,SAAS,CAAC,CAkHpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAC9B,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAwBrB"}

package/dist/run/run.js

@@ -0,0 +1,131 @@
+/**
+ * The `sentinel run` orchestrator. Drives the whole engine over a config:
+ * load packs, resolve each target's packs (+depends_on), gather the repo's
+ * files, audit each pack, then either reconcile findings into issues (Actions
+ * path) or leave the outcome for a Markdown report (local / dry-run path).
+ *
+ * All I/O is injected (RepoFiles, PackLoader, ModelRunner, ReconcileClient) so
+ * the orchestration is testable end-to-end with fakes.
+ */
+import { join } from 'node:path';
+import { parseRepoOverride } from '../config/repo-override.js';
+import { reconcileFindings } from '../dedup/reconcile.js';
+import { targetRepoFor } from '../issues/file.js';
+import { resolveDependencies } from '../rule-packs/dependencies.js';
+import { parseRulePack } from '../rule-packs/parse.js';
+import { auditPack } from './audit.js';
+import { previewReconciliation } from './preview.js';
+import { unionPatterns } from './select.js';
+async function readOverride(files, repoDir) {
+    const text = await files.readText(join(repoDir, 'sentinel.yaml'));
+    if (text === null) {
+        return undefined;
+    }
+    const parsed = parseRepoOverride(text);
+    return parsed.valid && parsed.override ? parsed.override : undefined;
+}
+/** Run an audit driven by a Sentinel config. */
+export async function runFromConfig(config, deps, options) {
+    const loaded = await deps.packs.load(options.packsDir);
+    const packByName = new Map(loaded.packs.map(pack => [pack.manifest.name, pack]));
+    const repos = [];
+    const reconciled = [];
+    const previews = [];
+    const filing = Boolean(deps.client) && !options.dryRun;
+    for (const target of config.targets) {
+        // Pattern targets need org repo enumeration (a GitHub API concern); v1
+        // audits explicit repos.
+        if (!target.repo) {
+            continue;
+        }
+        const repoName = target.repo;
+        const repoDir = join(options.workspaceDir, repoName);
+        const resolvedNames = new Set();
+        const missingPacks = [];
+        for (const name of target.rulePacks) {
+            if (!packByName.has(name)) {
+                missingPacks.push(name);
+                continue;
+            }
+            const resolved = resolveDependencies(loaded.packs, name);
+            if (resolved.errors.length > 0) {
+                missingPacks.push(name);
+                continue;
+            }
+            for (const resolvedName of resolved.order) {
+                resolvedNames.add(resolvedName);
+            }
+        }
+        const resolvedPacks = [];
+        for (const name of resolvedNames) {
+            const pack = packByName.get(name);
+            if (pack) {
+                resolvedPacks.push(pack);
+            }
+        }
+        const files = await deps.files.read(repoDir, unionPatterns(resolvedPacks));
+        const runnerOptions = {
+            ...options.autoFix,
+            cwd: repoDir,
+            configDir: options.configDir,
+        };
+        const packOutcomes = [];
+        for (const pack of resolvedPacks) {
+            packOutcomes.push(await auditPack(pack, { repoName, files }, config.model, deps.runner, runnerOptions));
+        }
+        repos.push({ repo: repoName, packs: packOutcomes, missingPacks });
+        if (!deps.client) {
+            continue;
+        }
+        const findings = packOutcomes.flatMap(outcome => outcome.findings);
+        const override = await readOverride(deps.files, repoDir);
+        const context = {
+            auditedRepo: repoName,
+            configRepo: options.configRepo,
+        };
+        if (filing) {
+            const result = await reconcileFindings(findings, config, deps.client, context, deps.now, { resolveAfterMisses: options.resolveAfterMisses }, override);
+            reconciled.push({ repo: repoName, result });
+        }
+        else {
+            // Dry run: read existing issues and compute the preview, mutating nothing.
+            const existing = await deps.client.listIssues({
+                repo: targetRepoFor(config, context),
+                label: config.issues.label,
+            });
+            const preview = previewReconciliation(findings, config, existing, override, {
+                resolveAfterMisses: options.resolveAfterMisses,
+            });
+            previews.push({ repo: repoName, preview });
+        }
+    }
+    return {
+        outcome: { repos },
+        reconciled,
+        previews,
+        packLoadErrors: loaded.errors,
+        filed: filing,
+    };
+}
+/**
+ * Run a single pack against a repository directory for off-cycle calibration.
+ * Never files issues. Throws if the pack file is missing or invalid.
+ */
+export async function runLocal(packPath, repoDir, model, deps, options = {}) {
+    const text = await deps.files.readText(packPath);
+    if (text === null) {
+        throw new Error(`rule pack not found: ${packPath}`);
+    }
+    const parsed = parseRulePack(text);
+    if (!parsed.valid || !parsed.pack) {
+        const detail = parsed.errors
+            .map(error => `${error.field}: ${error.message}`)
+            .join('; ');
+        throw new Error(`invalid rule pack ${packPath}: ${detail}`);
+    }
+    const pack = parsed.pack;
+    const files = await deps.files.read(repoDir, pack.manifest.appliesTo.paths);
+    const outcome = await auditPack(pack, { repoName: repoDir, files }, model, deps.runner, { ...options, cwd: repoDir });
+    return { repos: [{ repo: repoDir, packs: [outcome], missingPacks: [] }] };
+}
+//# sourceMappingURL=run.js.map