@nanocollective/sentinel 0.1.0-alpha.0

package/dist/run/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../source/run/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,iBAAiB,EAAC,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAuB,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAC,aAAa,EAAC,MAAM,mBAAmB,CAAC;AAIhD,OAAO,EAAC,mBAAmB,EAAC,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAC,aAAa,EAAC,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAC,SAAS,EAAC,MAAM,YAAY,CAAC;AACrC,OAAO,EAAqB,qBAAqB,EAAC,MAAM,cAAc,CAAC;AACvE,OAAO,EAAC,aAAa,EAAC,MAAM,aAAa,CAAC;AAoD1C,KAAK,UAAU,YAAY,CAC1B,KAAgB,EAChB,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAsB,EACtB,IAAa,EACb,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACpD,CAAC;IAEF,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,MAAM,QAAQ,GAA6C,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,uEAAuE;QACvE,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,SAAS;YACV,CAAC;YACD,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC3C,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjC,CAAC;QACF,CAAC;QAED,MAAM,aAAa,GAAe,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACV,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;QAE3E,MAAM,aAAa,GAAmB;YACrC,GAAG,OAAO,CAAC,OAAO;YAClB,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B,CAAC;QACF,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,YAAY,CAAC,IAAI,CAChB,MAAM,SAAS,CACd,IAAI,EACJ,EAAC,QAAQ,EAAE,KAAK,EAAC,EACjB,MAAM,CAAC,KAAK,EACZ,IAAI,CAAC,MAAM,EACX,aAAa,CACb,CACD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAC,CAAC,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAkB;YAC9B,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC9B,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACrC,QAAQ,EACR,MAAM,EACN,IAAI,CAAC,MAAM,EACX,OAAO,EACP,IAAI,CAAC,GAAG,EACR,EAAC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAC,EAChD,QAAQ,CACR,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC7C,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;aAC1B,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,qBAAqB,CACpC,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,QAAQ,EACR;gBACC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aAC9C,CACD,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO,EAAE,EAAC,KAAK,EAAC;QAChB,UAAU;QACV,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,KAAK,EAAE,MAAM;KACb,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,QAAgB,EAChB,OAAe,EACf,KAA8B,EAC9B,IAAkB,EAClB,UAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;aAC1B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAChD,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,SAAS,CAC9B,IAAI,EACJ,EAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAC,EAC1B,KAAK,EACL,IAAI,CAAC,MAAM,EACX,EAAC,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAC,CAC1B,CAAC;IAEF,OAAO,EAAC,KAAK,EAAE,CAAC,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,EAAE,EAAC,CAAC,EAAC,CAAC;AACvE,CAAC"}

package/dist/run/select.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Pure helpers for selecting pack files and the file patterns to gather. A pack
+ * file is an enabled `.md` whose path contains no underscore-prefixed segment —
+ * the `_starter/` convention that keeps template packs from loading.
+ */
+import type { RulePack } from '../rule-packs/types.js';
+/** True if a rule-packs-relative path is an enabled pack file. */
+export declare function isEnabledPackPath(relativePath: string): boolean;
+/**
+ * The union of applies_to path globs across packs. Returns an empty list if any
+ * pack applies to the whole repository (empty paths), meaning "gather all".
+ */
+export declare function unionPatterns(packs: RulePack[]): string[];
+//# sourceMappingURL=select.d.ts.map

package/dist/run/select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../source/run/select.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAErD,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAO/D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAWzD"}

package/dist/run/select.js

@@ -0,0 +1,31 @@
+/**
+ * Pure helpers for selecting pack files and the file patterns to gather. A pack
+ * file is an enabled `.md` whose path contains no underscore-prefixed segment —
+ * the `_starter/` convention that keeps template packs from loading.
+ */
+/** True if a rule-packs-relative path is an enabled pack file. */
+export function isEnabledPackPath(relativePath) {
+    if (!relativePath.endsWith('.md')) {
+        return false;
+    }
+    return relativePath
+        .split('/')
+        .every(segment => segment.length > 0 && !segment.startsWith('_'));
+}
+/**
+ * The union of applies_to path globs across packs. Returns an empty list if any
+ * pack applies to the whole repository (empty paths), meaning "gather all".
+ */
+export function unionPatterns(packs) {
+    const patterns = new Set();
+    for (const pack of packs) {
+        if (pack.manifest.appliesTo.paths.length === 0) {
+            return [];
+        }
+        for (const pattern of pack.manifest.appliesTo.paths) {
+            patterns.add(pattern);
+        }
+    }
+    return [...patterns];
+}
+//# sourceMappingURL=select.js.map

package/dist/run/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../source/run/select.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACrD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,YAAY;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;AACtB,CAAC"}

package/dist/run/sources.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Real filesystem implementations of RepoFiles and PackLoader. Paths come from
+ * the operator's own config repo and the repositories they chose to audit, not
+ * untrusted input, so the fs reads are annotated nosemgrep.
+ */
+import type { PackLoader, RepoFiles } from './types.js';
+/** Read repository files and single files from the local filesystem. */
+export declare const fsRepoFiles: RepoFiles;
+/** Load and parse the enabled rule packs from a directory. */
+export declare const fsPackLoader: PackLoader;
+//# sourceMappingURL=sources.d.ts.map

package/dist/run/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../../source/run/sources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAc,UAAU,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAiDnE,wEAAwE;AACxE,eAAO,MAAM,WAAW,EAAE,SA2BzB,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,YAAY,EAAE,UAoB1B,CAAC"}

package/dist/run/sources.js

@@ -0,0 +1,106 @@
+/**
+ * Real filesystem implementations of RepoFiles and PackLoader. Paths come from
+ * the operator's own config repo and the repositories they chose to audit, not
+ * untrusted input, so the fs reads are annotated nosemgrep.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { matchesGlob } from '../rule-packs/glob.js';
+import { parseRulePack } from '../rule-packs/parse.js';
+import { isEnabledPackPath } from './select.js';
+const IGNORED_DIRS = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    'out',
+    'vendor',
+    'target',
+]);
+/** Skip files larger than this — likely generated or binary, and token-heavy. */
+const MAX_FILE_BYTES = 512 * 1024;
+/** Recursively list files under root, skipping noise directories. */
+function walkFiles(root) {
+    const out = [];
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir); // nosemgrep
+        }
+        catch {
+            /* c8 ignore next 2 -- unreadable directory */
+            continue;
+        }
+        for (const entry of entries) {
+            const full = join(dir, entry);
+            const stats = statSync(full); // nosemgrep
+            if (stats.isDirectory()) {
+                if (!IGNORED_DIRS.has(entry)) {
+                    stack.push(full);
+                }
+            }
+            else if (stats.isFile()) {
+                out.push(full);
+            }
+        }
+    }
+    return out;
+}
+function toPosix(path) {
+    return path.split(sep).join('/');
+}
+/** Read repository files and single files from the local filesystem. */
+export const fsRepoFiles = {
+    async read(repoDir, patterns) {
+        const files = [];
+        for (const full of walkFiles(repoDir)) {
+            const relativePath = toPosix(relative(repoDir, full));
+            if (patterns.length > 0 &&
+                !patterns.some(pattern => matchesGlob(pattern, relativePath))) {
+                continue;
+            }
+            if (statSync(full).size > MAX_FILE_BYTES) {
+                continue;
+            }
+            files.push({ path: relativePath, content: readFileSync(full, 'utf8') }); // nosemgrep
+        }
+        files.sort((a, b) => a.path.localeCompare(b.path));
+        return files;
+    },
+    async readText(path) {
+        try {
+            return readFileSync(path, 'utf8'); // nosemgrep
+        }
+        catch {
+            return null;
+        }
+    },
+};
+/** Load and parse the enabled rule packs from a directory. */
+export const fsPackLoader = {
+    async load(packsDir) {
+        const result = { packs: [], errors: [] };
+        if (!existsSync(packsDir)) {
+            return result;
+        }
+        for (const full of walkFiles(packsDir)) {
+            const relativePath = toPosix(relative(packsDir, full));
+            if (!isEnabledPackPath(relativePath)) {
+                continue;
+            }
+            const parsed = parseRulePack(readFileSync(full, 'utf8')); // nosemgrep
+            if (parsed.valid && parsed.pack) {
+                result.packs.push(parsed.pack);
+            }
+            else {
+                result.errors.push({ file: relativePath, errors: parsed.errors });
+            }
+        }
+        return result;
+    },
+};
+//# sourceMappingURL=sources.js.map

package/dist/run/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../source/run/sources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AACxE,OAAO,EAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAC,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAC,aAAa,EAAC,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAC,iBAAiB,EAAC,MAAM,aAAa,CAAC;AAG9C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAElC,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,8CAA8C;YAC9C,SAAS;QACV,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;YAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACF,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAc;IACrC,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,QAAkB;QAC7C,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACtD,IACC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAC5D,CAAC;gBACF,SAAS;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC1C,SAAS;YACV,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAC,CAAC,CAAC,CAAC,YAAY;QACpF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QAC1B,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAe;IACvC,KAAK,CAAC,IAAI,CAAC,QAAgB;QAC1B,MAAM,MAAM,GAAgB,EAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC;QACf,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY;YACtE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAC,CAAC,CAAC;YACjE,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAC"}

package/dist/run/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Types for `sentinel run`, the audit runtime. The orchestrator (run.ts)
+ * depends on these injectable sources so the whole pipeline is testable with
+ * fakes; the real filesystem/gh/nanocoder implementations live at the edges.
+ */
+import type { Finding } from '../findings/types.js';
+import type { ValidationError } from '../findings/validate.js';
+import type { SourceFile } from '../prompt/types.js';
+import type { RulePack, RulePackError } from '../rule-packs/types.js';
+/** Reads repository source files and single files from disk (injectable). */
+export interface RepoFiles {
+    /** Read files under `repoDir` matching any of the glob patterns. An empty
+     * pattern list means the whole repository. */
+    read(repoDir: string, patterns: string[]): Promise<SourceFile[]>;
+    /** Read a single file's text, or null if it does not exist. */
+    readText(path: string): Promise<string | null>;
+}
+/** A pack that failed to parse while loading the rule-packs directory. */
+export interface PackLoadError {
+    file: string;
+    errors: RulePackError[];
+}
+/** The result of loading the rule-packs directory. */
+export interface LoadedPacks {
+    packs: RulePack[];
+    errors: PackLoadError[];
+}
+/** Loads and parses the enabled rule packs from a directory (injectable). */
+export interface PackLoader {
+    load(packsDir: string): Promise<LoadedPacks>;
+}
+/** The outcome of one pack's audit pass against one repository. */
+export interface PackOutcome {
+    pack: string;
+    version: string;
+    findings: Finding[];
+    attempts: number;
+    ok: boolean;
+    errors: ValidationError[];
+    runError?: string;
+    /** The raw model output, kept for diagnosing a failed audit. */
+    raw?: string;
+}
+/** All pack outcomes for one repository. */
+export interface RepoOutcome {
+    repo: string;
+    packs: PackOutcome[];
+    /** Packs named by the target but missing from the rule-packs directory. */
+    missingPacks: string[];
+}
+/** Everything one run produced. */
+export interface RunOutcome {
+    repos: RepoOutcome[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/run/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/run/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAC,QAAQ,EAAE,aAAa,EAAC,MAAM,wBAAwB,CAAC;AAEpE,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACzB;kDAC8C;IAC9C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC/C;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,MAAM,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IAC1B,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,WAAW,EAAE,CAAC;CACrB"}

package/dist/run/types.js

@@ -0,0 +1,7 @@
+/**
+ * Types for `sentinel run`, the audit runtime. The orchestrator (run.ts)
+ * depends on these injectable sources so the whole pipeline is testable with
+ * fakes; the real filesystem/gh/nanocoder implementations live at the edges.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/run/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/run/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/suppression/apply.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The third suppression layer: the opt-in per-repo `sentinel.yaml` override
+ * (see docs/findings/index.md#suppression). It can lower or raise the filing
+ * threshold for one repo and declare systematic-noise exemptions matched by
+ * rule and/or path glob. The content-hash floor and the label layer live in the
+ * dedup planner; this is the escape hatch layered on top.
+ */
+import type { RepoOverride, SentinelConfig, Suppression } from '../config/types.js';
+import type { Finding, Severity } from '../findings/types.js';
+/**
+ * A finding matches a suppression when its rule matches (if the suppression
+ * names one) and its file matches (if the suppression lists paths). Rule and
+ * path patterns are globs, so `solana-anchor/*` or `programs/vault/**` work.
+ */
+export declare function matchesSuppression(finding: Finding, suppression: Suppression): boolean;
+/** True if any of the override's suppressions match the finding. */
+export declare function isSuppressed(finding: Finding, override: RepoOverride): boolean;
+/** The effect of applying a per-repo override to a run's findings. */
+export interface OverrideOutcome {
+    /** Findings that survive the override, in input order. */
+    kept: Finding[];
+    /** Findings removed by a suppression rule. */
+    suppressed: Finding[];
+    /** The threshold to file at: the override's, or the org default. */
+    threshold: Severity;
+}
+/**
+ * Apply a per-repo override to a run's findings: partition out the suppressed
+ * ones and resolve the effective severity threshold. With no override, every
+ * finding is kept and the org threshold stands.
+ */
+export declare function applyRepoOverride(findings: Finding[], config: SentinelConfig, override?: RepoOverride): OverrideOutcome;
+//# sourceMappingURL=apply.d.ts.map

package/dist/suppression/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../source/suppression/apply.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACX,YAAY,EACZ,cAAc,EACd,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,sBAAsB,CAAC;AAG5D;;;;GAIG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,GACtB,OAAO,CAcT;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAC3B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,YAAY,GACpB,OAAO,CAIT;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC/B,0DAA0D;IAC1D,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,8CAA8C;IAC9C,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,oEAAoE;IACpE,SAAS,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,CAAC,EAAE,YAAY,GACrB,eAAe,CAgBjB"}

package/dist/suppression/apply.js

@@ -0,0 +1,55 @@
+/**
+ * The third suppression layer: the opt-in per-repo `sentinel.yaml` override
+ * (see docs/findings/index.md#suppression). It can lower or raise the filing
+ * threshold for one repo and declare systematic-noise exemptions matched by
+ * rule and/or path glob. The content-hash floor and the label layer live in the
+ * dedup planner; this is the escape hatch layered on top.
+ */
+import { matchesGlob } from '../rule-packs/glob.js';
+/**
+ * A finding matches a suppression when its rule matches (if the suppression
+ * names one) and its file matches (if the suppression lists paths). Rule and
+ * path patterns are globs, so `solana-anchor/*` or `programs/vault/**` work.
+ */
+export function matchesSuppression(finding, suppression) {
+    const hasRule = suppression.rule !== undefined && suppression.rule.length > 0;
+    const hasPaths = suppression.paths.length > 0;
+    // Defensive: a suppression with neither clause never matches anything.
+    if (!hasRule && !hasPaths) {
+        return false;
+    }
+    const ruleMatches = hasRule
+        ? matchesGlob(suppression.rule, finding.rule)
+        : true;
+    const pathMatches = hasPaths
+        ? suppression.paths.some(pattern => matchesGlob(pattern, finding.file))
+        : true;
+    return ruleMatches && pathMatches;
+}
+/** True if any of the override's suppressions match the finding. */
+export function isSuppressed(finding, override) {
+    return override.suppress.some(suppression => matchesSuppression(finding, suppression));
+}
+/**
+ * Apply a per-repo override to a run's findings: partition out the suppressed
+ * ones and resolve the effective severity threshold. With no override, every
+ * finding is kept and the org threshold stands.
+ */
+export function applyRepoOverride(findings, config, override) {
+    const threshold = override?.severityThreshold ?? config.severityThreshold;
+    if (!override || override.suppress.length === 0) {
+        return { kept: findings, suppressed: [], threshold };
+    }
+    const kept = [];
+    const suppressed = [];
+    for (const finding of findings) {
+        if (isSuppressed(finding, override)) {
+            suppressed.push(finding);
+        }
+        else {
+            kept.push(finding);
+        }
+    }
+    return { kept, suppressed, threshold };
+}
+//# sourceMappingURL=apply.js.map

package/dist/suppression/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../source/suppression/apply.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,EAAC,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAgB,EAChB,WAAwB;IAExB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,uEAAuE;IACvE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,OAAO;QAC1B,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,IAAc,EAAE,OAAO,CAAC,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,WAAW,GAAG,QAAQ;QAC3B,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,IAAI,CAAC;IACR,OAAO,WAAW,IAAI,WAAW,CAAC;AACnC,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAC3B,OAAgB,EAChB,QAAsB;IAEtB,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAC3C,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CACxC,CAAC;AACH,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAChC,QAAmB,EACnB,MAAsB,EACtB,QAAuB;IAEvB,MAAM,SAAS,GAAG,QAAQ,EAAE,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC;IAC1E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IACD,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAC,CAAC;AACtC,CAAC"}

package/package.json

@@ -0,0 +1,118 @@
+{
+	"name": "@nanocollective/sentinel",
+	"version": "0.1.0-alpha.0",
+	"description": "An installable, Nanocoder-driven workflow that runs continuous, configurable security and code audits across a GitHub organisation's repositories and files findings as issues.",
+	"keywords": [
+		"security",
+		"audit",
+		"sast",
+		"github-actions",
+		"nanocoder",
+		"local-first",
+		"code-review",
+		"typescript"
+	],
+	"author": "Nano Collective",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/Nano-Collective/sentinel.git"
+	},
+	"homepage": "https://github.com/Nano-Collective/sentinel#readme",
+	"bugs": {
+		"url": "https://github.com/Nano-Collective/sentinel/issues"
+	},
+	"type": "module",
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
+	"bin": {
+		"sentinel": "dist/cli.js"
+	},
+	"packageManager": "pnpm@11.0.9",
+	"engines": {
+		"node": ">=22"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"files": [
+		"dist",
+		"README.md",
+		"LICENSE"
+	],
+	"scripts": {
+		"build": "tsc && tsc-alias && chmod +x dist/cli.js",
+		"dev": "tsc --watch",
+		"start": "node dist/cli.js",
+		"prepublishOnly": "pnpm build",
+		"test:all": "./scripts/test.sh",
+		"test:ava": "ava",
+		"test:ava:coverage": "c8 ava",
+		"test:format": "biome check --no-errors-on-unmatched .",
+		"test:types": "tsc --noEmit",
+		"test:lint": "biome lint .",
+		"test:lint:fix": "biome check --write --unsafe .",
+		"test:knip": "knip",
+		"test:audit": "pnpm audit --audit-level=high --ignore-unfixable",
+		"test:security": "semgrep scan --config auto --error",
+		"format": "biome check --write .",
+		"format:check": "biome check .",
+		"prepare": "husky"
+	},
+	"dependencies": {
+		"yaml": "^2.8.3"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.5.0",
+		"@types/node": "^25.9.3",
+		"ava": "^7.0.0",
+		"c8": "^11.0.0",
+		"husky": "^9.1.7",
+		"knip": "^6.0.0",
+		"lint-staged": "^17.0.7",
+		"tsc-alias": "^1.8.16",
+		"tsx": "^4.20.6",
+		"typescript": "^5.0.3"
+	},
+	"lint-staged": {
+		"*.{js,ts,jsx,tsx,json,md}": [
+			"biome check --write --no-errors-on-unmatched"
+		]
+	},
+	"ava": {
+		"extensions": {
+			"ts": "module"
+		},
+		"nodeArguments": [
+			"--import=tsx",
+			"--no-warnings"
+		],
+		"files": [
+			"source/**/*.spec.ts",
+			"!source/**/*-helpers.ts",
+			"!source/**/test-helpers.ts"
+		],
+		"workerThreads": false,
+		"serial": true,
+		"environmentVariables": {
+			"NODE_ENV": "test"
+		}
+	},
+	"c8": {
+		"exclude": [
+			"source/cli.ts",
+			"source/index.ts",
+			"source/**/*.spec.ts"
+		],
+		"reporter": [
+			"text",
+			"json-summary",
+			"lcov"
+		],
+		"check-coverage": true,
+		"lines": 80,
+		"functions": 0,
+		"branches": 0,
+		"statements": 0
+	}
+}