sealevel-insight 0.8.1

package/DISCLOSURE

@@ -0,0 +1,5 @@
+Sealevel Insight is a defensive, local code-analysis utility for Solana programs. It is published as dual-use software because its reports include security-relevant architecture and audit-scoping evidence such as externally reachable instructions, account privileges, CPIs, PDA signing, state mutation, and token or asset-flow relationships.
+
+The CLI parses source and metadata locally and produces deterministic JSON, Markdown, or HTML reports. It does not execute analyzed programs, exploit systems, access wallets or private keys, contact Solana RPC endpoints, upload source code, collect telemetry, invoke AI services, or provide offensive payloads. The intended use is software architecture review, audit scoping, defensive research, and reproducible CI quality checks on code the user is authorized to inspect.
+
+Dynamic dispatch, opaque macros, unavailable dependencies, and runtime-selected values remain explicit unresolved evidence rather than being guessed or acted upon.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sealevel Insight contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,62 @@
+# Sealevel Insight CLI
+
+Sealevel Insight is a local, deterministic architecture and code-metrics CLI for Solana programs. It reads Rust, Anchor, Native Rust, Pinocchio, Steel, Quasar, Solang Solidity, and hand-written sBPF assembly source without executing the target program or contacting a network.
+
+## Install
+
+```bash
+npm install --global sealevel-insight
+```
+
+For a one-off run:
+
+```bash
+npx sealevel-insight analyze . --format json --output report.json
+```
+
+Node.js 18 or newer is required. Analysis is local and offline; the parser grammars are shipped in the package. The optional real-world validation scripts in the source repository are separate development workflows and are not run by the CLI.
+
+## Commands
+
+```text
+sealevel-insight analyze [root] [options]
+sealevel-insight scope [root] [options]
+sealevel-insight diff <before.json> <after.json> [--format json|markdown|html]
+sealevel-insight baseline save [root] [--output baseline.json]
+sealevel-insight cache clear [root]
+```
+
+Useful options include `--enable-idl`, `--cargo-metadata`, `--target`, repeated `--cfg`, `--cfg-complete`, `--no-cache`, `--format`, and `--output`. Exit code `0` means success, `1` means an analysis/configuration failure, and `2` means a configured quality policy failed.
+
+Reports include metrics, programs, modules, functions, instruction reachability, call paths, accounts, CPIs, PDAs, state and asset-flow evidence, IDL reconciliation, semantic coverage, and explicit unresolved limitations. Review signals are not vulnerability findings or a security verdict.
+
+## Publishing
+
+The source repository also contains the VS Code extension, so its root manifest is private. The public CLI is generated and validated separately:
+
+```bash
+npm run package:cli
+npm run test:cli-package
+npm publish ./dist-cli-package --access public
+```
+
+The generated package declares its dual-use content policy and includes `DISCLOSURE` at its root. Use npm's required interactive two-factor-authenticated publish or staged publishing flow for this package.
+
+## Cargo workspaces
+
+The CLI understands Cargo workspaces and reads `Cargo.toml` files without running Cargo. For reproducible CI, provide saved metadata with `--cargo-metadata cargo-metadata.json`. A Rust installation is not required to run the analyzer.
+
+To create that metadata outside the analyzer, use Cargo's locked/offline mode when the dependency cache is available, then pass the resulting file to Sealevel Insight:
+
+```bash
+cargo metadata --format-version 1 --locked --offline > cargo-metadata.json
+sealevel-insight analyze . --cargo-metadata cargo-metadata.json --no-cache
+```
+
+Cargo is an input and metadata source here, not a runtime dependency. The published CLI remains a Node.js package; a future `cargo install` package would require a separately maintained native Rust engine or launcher.
+
+## Privacy and safety
+
+Normal execution reads the selected local files and writes the requested report/cache. It does not upload source code, use telemetry, access wallets or private keys, call Solana RPC, invoke AI APIs, or execute the analyzed program.
+
+See the repository's `SECURITY.md`, `SUPPORT.md`, and `THIRD_PARTY_NOTICES.md` for reporting and dependency information.

package/SECURITY.md

@@ -0,0 +1,5 @@
+# Security policy
+
+Report security issues in Sealevel Insight privately through the repository security contact or issue tracker described in the project repository. Include the extension version, VS Code version, operating system, reproduction steps, and a minimal fixture when possible.
+
+Sealevel Insight reports review-surface signals in analyzed Solana code. Those signals are not vulnerability findings. A bug in the extension itself, such as unsafe source handling or arbitrary command execution, is a product security issue and should be reported separately.

package/SUPPORT.md

@@ -0,0 +1,3 @@
+# Support
+
+Use the repository issue tracker for questions and reproducible bugs. Include the Sealevel Insight version, VS Code version, operating system, relevant settings, command used, and a small project or synthetic fixture that reproduces the behavior. Do not upload private source code or secrets.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,57 @@
+# Third-party notices
+
+Sealevel Insight bundles `@iarna/toml` and `web-tree-sitter` into its JavaScript entrypoints and distributes the Web Tree-sitter runtime plus Tree-sitter Rust and Solidity grammars as WebAssembly assets. It does not redistribute third-party source repositories.
+
+## @iarna/toml 3.0.0
+
+Source: https://github.com/iarna/iarna-toml
+
+Copyright (c) 2016, Rebecca Turner <me@re-becca.org>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+## web-tree-sitter 0.25.10
+
+Source: https://github.com/tree-sitter/tree-sitter/tree/master/lib/binding_web
+
+The MIT License (MIT)
+
+Copyright (c) 2018-2024 Max Brunsfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## tree-sitter-solidity 1.2.13
+
+Source: https://github.com/JoranHonig/tree-sitter-solidity
+
+Reproducible source package: `tree-sitter-solidity@1.2.13`, npm integrity `sha512-nO2AbcAuz2Qba8JnPNe/3FVjRRvGY3ApxSJ8UPIzfynJm4PYCMbBoXxxbprvMgjCbGYR/ZrHGIPKzXV7zBa+lQ==`
+
+Copyright (c) 2020 Joran Honig
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## tree-sitter-rust 0.24.0
+
+Source: https://github.com/tree-sitter/tree-sitter-rust
+
+The MIT License (MIT)
+
+Copyright (c) 2017 Maxim Sokolov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+The Marketplace icon is original artwork generated specifically for Sealevel Insight and does not copy a third-party logo.