@atbash/cli 0.5.15 → 0.6.1-dev.2

package/dist/commands/github-scan.js

@@ -0,0 +1,1054 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubApiClient = exports.GitHubScanError = void 0;
+exports.resolveGitHubToken = resolveGitHubToken;
+exports.classifyRisks = classifyRisks;
+exports.scanGitHub = scanGitHub;
+exports.executeGitHubScanCommand = executeGitHubScanCommand;
+exports.registerGithubScanCommand = registerGithubScanCommand;
+const chalk_1 = __importDefault(require("chalk"));
+class GitHubScanError extends Error {
+    constructor(kind, message, status) {
+        super(message);
+        this.name = "GitHubScanError";
+        this.kind = kind;
+        this.status = status;
+    }
+}
+exports.GitHubScanError = GitHubScanError;
+const DEFAULT_BASE_URL = "https://api.github.com";
+const DEFAULT_SINCE_DAYS = 30;
+const MAX_PAGES = 1000;
+const API_VERSION = "2022-11-28";
+const DEFAULT_MAX_REPOSITORIES = 1000;
+const DEFAULT_MAX_BRANCHES_PER_REPOSITORY = 1000;
+const DEFAULT_MAX_PULL_REQUESTS_PER_REPOSITORY = 1000;
+const DEFAULT_MAX_COMMITS_PER_BRANCH = 1000;
+const DEFAULT_MAX_FILES_PER_CHANGE = 3000;
+function asRecord(value, context) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new GitHubScanError("malformed_response", `GitHub returned a malformed ${context} response.`);
+    }
+    return value;
+}
+function asArray(value, context) {
+    if (!Array.isArray(value)) {
+        throw new GitHubScanError("malformed_response", `GitHub returned a malformed ${context} response.`);
+    }
+    return value;
+}
+function requiredString(record, key, context) {
+    const value = record[key];
+    if (typeof value !== "string" || value.length === 0) {
+        throw new GitHubScanError("malformed_response", `GitHub returned a malformed ${context} response.`);
+    }
+    return value;
+}
+function requiredNumber(record, key, context) {
+    const value = record[key];
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new GitHubScanError("malformed_response", `GitHub returned a malformed ${context} response.`);
+    }
+    return value;
+}
+function requiredBoolean(record, key, context) {
+    const value = record[key];
+    if (typeof value !== "boolean") {
+        throw new GitHubScanError("malformed_response", `GitHub returned a malformed ${context} response.`);
+    }
+    return value;
+}
+function optionalString(record, key) {
+    const value = record[key];
+    return typeof value === "string" ? value : null;
+}
+function parseIntegerHeader(value) {
+    if (value === null || !/^\d+$/.test(value))
+        return null;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : null;
+}
+function parseResetAt(value) {
+    const seconds = parseIntegerHeader(value);
+    if (seconds === null)
+        return null;
+    const date = new Date(seconds * 1000);
+    return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+function encodePathSegment(value) {
+    return encodeURIComponent(value);
+}
+function normalizedList(values) {
+    return [
+        ...new Set((values ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean)),
+    ].sort((a, b) => a.localeCompare(b));
+}
+function parseLinkHeader(value) {
+    const links = new Map();
+    if (!value)
+        return links;
+    for (const part of value.split(",")) {
+        const match = part.trim().match(/^<([^>]+)>;\s*rel="([^"]+)"$/);
+        if (!match) {
+            throw new GitHubScanError("malformed_response", "GitHub returned a malformed pagination link.");
+        }
+        links.set(match[2], match[1]);
+    }
+    return links;
+}
+function itemIdentity(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return JSON.stringify(value);
+    }
+    const record = value;
+    for (const key of [
+        "id",
+        "node_id",
+        "full_name",
+        "filename",
+        "sha",
+        "name",
+        "number",
+    ]) {
+        const candidate = record[key];
+        if (typeof candidate === "string" || typeof candidate === "number") {
+            return `${key}:${String(candidate)}`;
+        }
+    }
+    return JSON.stringify(value);
+}
+function recordPageItems(page, pageFingerprints, itemIdentities, context) {
+    const fingerprint = JSON.stringify(page);
+    if (pageFingerprints.has(fingerprint)) {
+        throw new GitHubScanError("malformed_response", `GitHub returned a duplicate ${context} page.`);
+    }
+    pageFingerprints.add(fingerprint);
+    for (const item of page) {
+        const identity = itemIdentity(item);
+        if (itemIdentities.has(identity)) {
+            throw new GitHubScanError("malformed_response", `GitHub returned a duplicate item while paginating ${context}.`);
+        }
+        itemIdentities.add(identity);
+    }
+}
+function enforceItemBound(currentCount, additionalCount, options) {
+    if (options.maxItems !== undefined &&
+        currentCount + additionalCount > options.maxItems) {
+        throw new GitHubScanError("limit", `${options.context ?? "GitHub pagination"} exceeded the configured maximum of ${options.maxItems}.`);
+    }
+}
+function repositoryEndpointTail(pathname) {
+    const named = pathname.match(/^\/repos\/[^/]+\/[^/]+(\/.+)$/);
+    if (named)
+        return named[1];
+    const numeric = pathname.match(/^\/repositories\/\d+(\/.+)$/);
+    return numeric ? numeric[1] : null;
+}
+function isSamePaginationEndpoint(current, next) {
+    if (current.pathname === next.pathname)
+        return true;
+    const currentTail = repositoryEndpointTail(current.pathname);
+    const nextTail = repositoryEndpointTail(next.pathname);
+    return currentTail !== null && currentTail === nextTail;
+}
+class GitHubApiClient {
+    constructor(token, options = {}) {
+        this.oauthScopeValues = new Set();
+        this.rateLimit = {
+            limit: null,
+            remaining: null,
+            resetAt: null,
+            resource: null,
+        };
+        if (!token.trim()) {
+            throw new GitHubScanError("configuration", "GitHub token cannot be empty.");
+        }
+        this.token = token;
+        this.baseUrl = new URL(options.baseUrl ?? DEFAULT_BASE_URL);
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.userAgent = options.userAgent ?? "atbash-cli-github-scanner";
+        this.perPage = options.perPage ?? 100;
+        this.requestTimeoutMs = options.requestTimeoutMs ?? 30000;
+        if (!Number.isInteger(this.perPage) ||
+            this.perPage < 1 ||
+            this.perPage > 100) {
+            throw new GitHubScanError("configuration", "GitHub page size must be an integer from 1 to 100.");
+        }
+        if (!Number.isInteger(this.requestTimeoutMs) ||
+            this.requestTimeoutMs < 1 ||
+            this.requestTimeoutMs > 300000) {
+            throw new GitHubScanError("configuration", "GitHub request timeout must be an integer from 1 to 300000 milliseconds.");
+        }
+    }
+    get scopes() {
+        return [...this.oauthScopeValues].sort((a, b) => a.localeCompare(b));
+    }
+    async get(path, params = {}) {
+        return (await this.request(path, params)).data;
+    }
+    async paginate(path, params = {}, options = {}) {
+        const initial = this.buildUrl(path, { ...params, per_page: this.perPage });
+        const visited = new Set();
+        const pageFingerprints = new Set();
+        const itemIdentities = new Set();
+        const items = [];
+        let next = initial;
+        let pages = 0;
+        while (next) {
+            if (visited.has(next.href) || pages >= MAX_PAGES) {
+                throw new GitHubScanError("malformed_response", "GitHub pagination was cyclic or exceeded the safety limit.");
+            }
+            visited.add(next.href);
+            pages += 1;
+            const response = await this.requestUrl(next);
+            const page = asArray(response.data, options.context ?? "paginated");
+            recordPageItems(page, pageFingerprints, itemIdentities, options.context ?? "items");
+            enforceItemBound(items.length, page.length, options);
+            items.push(...page);
+            next = this.resolveNextPage(next, response.headers, page.length);
+        }
+        return items;
+    }
+    async paginateWhile(path, params, shouldContinue, options = {}) {
+        const initial = this.buildUrl(path, { ...params, per_page: this.perPage });
+        const visited = new Set();
+        const pageFingerprints = new Set();
+        const itemIdentities = new Set();
+        const items = [];
+        let next = initial;
+        let pages = 0;
+        while (next) {
+            if (visited.has(next.href) || pages >= MAX_PAGES) {
+                throw new GitHubScanError("malformed_response", "GitHub pagination was cyclic or exceeded the safety limit.");
+            }
+            visited.add(next.href);
+            pages += 1;
+            const response = await this.requestUrl(next);
+            const page = asArray(response.data, options.context ?? "paginated");
+            recordPageItems(page, pageFingerprints, itemIdentities, options.context ?? "items");
+            enforceItemBound(items.length, page.length, options);
+            items.push(...page);
+            if (!shouldContinue(page))
+                break;
+            next = this.resolveNextPage(next, response.headers, page.length);
+        }
+        return items;
+    }
+    async paginateObjectField(path, field, params = {}, options = {}) {
+        const initial = this.buildUrl(path, { ...params, per_page: this.perPage });
+        const visited = new Set();
+        const pageFingerprints = new Set();
+        const itemIdentities = new Set();
+        const items = [];
+        let stableSha = null;
+        let next = initial;
+        let pages = 0;
+        while (next) {
+            if (visited.has(next.href) || pages >= MAX_PAGES) {
+                throw new GitHubScanError("malformed_response", "GitHub pagination was cyclic or exceeded the safety limit.");
+            }
+            visited.add(next.href);
+            pages += 1;
+            const response = await this.requestUrl(next);
+            const page = asRecord(response.data, `paginated ${field}`);
+            if (typeof page.sha === "string") {
+                if (stableSha === null)
+                    stableSha = page.sha;
+                if (page.sha !== stableSha) {
+                    throw new GitHubScanError("malformed_response", `GitHub changed the object identity while paginating ${field}.`);
+                }
+            }
+            const pageItems = asArray(page[field], `paginated ${field}`);
+            recordPageItems(pageItems, pageFingerprints, itemIdentities, options.context ?? field);
+            enforceItemBound(items.length, pageItems.length, options);
+            items.push(...pageItems);
+            next = this.resolveNextPage(next, response.headers, pageItems.length);
+        }
+        return items;
+    }
+    async paginateInstallationRepositories(params = {}, options = {}) {
+        const initial = this.buildUrl("/installation/repositories", {
+            ...params,
+            per_page: this.perPage,
+        });
+        const visited = new Set();
+        const pageFingerprints = new Set();
+        const itemIdentities = new Set();
+        const repositories = [];
+        let expectedTotal = null;
+        let next = initial;
+        let pages = 0;
+        while (next) {
+            if (visited.has(next.href) || pages >= MAX_PAGES) {
+                throw new GitHubScanError("malformed_response", "GitHub pagination was cyclic or exceeded the safety limit.");
+            }
+            visited.add(next.href);
+            pages += 1;
+            const response = await this.requestUrl(next);
+            const page = asRecord(response.data, "installation repositories");
+            const total = requiredNumber(page, "total_count", "installation repositories");
+            if (expectedTotal === null)
+                expectedTotal = total;
+            if (expectedTotal !== total) {
+                throw new GitHubScanError("malformed_response", "GitHub changed the repository total during pagination.");
+            }
+            if (options.maxItems !== undefined && total > options.maxItems) {
+                throw new GitHubScanError("limit", `Installation repository total ${total} exceeds the configured maximum of ${options.maxItems}.`);
+            }
+            const pageRepositories = asArray(page.repositories, "installation repositories");
+            recordPageItems(pageRepositories, pageFingerprints, itemIdentities, "installation repositories");
+            enforceItemBound(repositories.length, pageRepositories.length, options);
+            repositories.push(...pageRepositories);
+            if (repositories.length > total) {
+                throw new GitHubScanError("malformed_response", "GitHub returned more installation repositories than total_count.");
+            }
+            const links = parseLinkHeader(response.headers.get("link"));
+            if (repositories.length === total) {
+                if (links.has("next")) {
+                    throw new GitHubScanError("malformed_response", "GitHub returned a next page after the installation total was reached.");
+                }
+                next = null;
+            }
+            else {
+                next = this.resolveNextPage(next, response.headers, pageRepositories.length);
+                if (!next) {
+                    throw new GitHubScanError("malformed_response", "GitHub returned a partial installation repository listing.");
+                }
+            }
+        }
+        if (expectedTotal === null || repositories.length !== expectedTotal) {
+            throw new GitHubScanError("malformed_response", "GitHub returned a partial installation repository listing.");
+        }
+        return repositories;
+    }
+    buildUrl(path, params) {
+        const url = new URL(path, this.baseUrl);
+        for (const key of Object.keys(params).sort((a, b) => a.localeCompare(b))) {
+            const value = params[key];
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        }
+        return url;
+    }
+    resolveNextPage(current, headers, pageLength) {
+        const rawLink = headers.get("link");
+        const links = parseLinkHeader(rawLink);
+        const nextValue = links.get("next");
+        if (pageLength < this.perPage) {
+            if (nextValue) {
+                throw new GitHubScanError("malformed_response", "GitHub returned a next link after a short terminal page.");
+            }
+            return null;
+        }
+        if (nextValue)
+            return this.validateNextUrl(nextValue, current);
+        if (rawLink !== null)
+            return null;
+        const explicit = new URL(current);
+        const currentPage = Number(current.searchParams.get("page") ?? "1");
+        if (!Number.isSafeInteger(currentPage) || currentPage < 1) {
+            throw new GitHubScanError("malformed_response", "GitHub pagination contained an invalid page number.");
+        }
+        explicit.searchParams.set("page", String(currentPage + 1));
+        explicit.searchParams.sort();
+        return explicit;
+    }
+    validateNextUrl(value, current) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            throw new GitHubScanError("malformed_response", "GitHub returned an invalid pagination URL.");
+        }
+        if (url.origin !== this.baseUrl.origin) {
+            throw new GitHubScanError("malformed_response", "GitHub returned a cross-origin pagination URL.");
+        }
+        if (!isSamePaginationEndpoint(current, url)) {
+            throw new GitHubScanError("malformed_response", "GitHub changed the endpoint during pagination.");
+        }
+        const currentPage = Number(current.searchParams.get("page") ?? "1");
+        const nextPage = Number(url.searchParams.get("page"));
+        if (!Number.isSafeInteger(currentPage) ||
+            !Number.isSafeInteger(nextPage) ||
+            nextPage !== currentPage + 1) {
+            throw new GitHubScanError("malformed_response", "GitHub returned a non-sequential pagination link.");
+        }
+        const parameterNames = new Set([
+            ...current.searchParams.keys(),
+            ...url.searchParams.keys(),
+        ]);
+        parameterNames.delete("page");
+        for (const name of parameterNames) {
+            if (current.searchParams.getAll(name).join("\u0000") !==
+                url.searchParams.getAll(name).join("\u0000")) {
+                throw new GitHubScanError("malformed_response", "GitHub changed request filters during pagination.");
+            }
+        }
+        return url;
+    }
+    async request(path, params) {
+        return this.requestUrl(this.buildUrl(path, params));
+    }
+    async requestUrl(url) {
+        let response;
+        try {
+            response = await this.fetchImpl(url, {
+                method: "GET",
+                redirect: "error",
+                signal: AbortSignal.timeout(this.requestTimeoutMs),
+                headers: {
+                    accept: "application/vnd.github+json",
+                    authorization: `Bearer ${this.token}`,
+                    "user-agent": this.userAgent,
+                    "x-github-api-version": API_VERSION,
+                },
+            });
+        }
+        catch (error) {
+            throw new GitHubScanError("api", `GitHub request failed: ${safeErrorMessage(error, this.token)}`);
+        }
+        this.captureHeaders(response.headers);
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch {
+            throw new GitHubScanError("malformed_response", `GitHub returned invalid JSON (HTTP ${response.status}).`, response.status);
+        }
+        if (!response.ok) {
+            const remaining = parseIntegerHeader(response.headers.get("x-ratelimit-remaining"));
+            const kind = response.status === 401
+                ? "auth"
+                : response.status === 429 ||
+                    (response.status === 403 && remaining === 0)
+                    ? "rate_limit"
+                    : response.status === 403 || response.status === 404
+                        ? "permission"
+                        : "api";
+            throw new GitHubScanError(kind, `GitHub ${kind.replace("_", " ")} error (HTTP ${response.status}).`, response.status);
+        }
+        return { data: data, headers: response.headers };
+    }
+    captureHeaders(headers) {
+        const scopes = headers.get("x-oauth-scopes");
+        if (scopes) {
+            for (const scope of scopes
+                .split(",")
+                .map((value) => value.trim())
+                .filter(Boolean)) {
+                this.oauthScopeValues.add(scope);
+            }
+        }
+        const limit = parseIntegerHeader(headers.get("x-ratelimit-limit"));
+        const remaining = parseIntegerHeader(headers.get("x-ratelimit-remaining"));
+        const currentRemaining = this.rateLimit.remaining;
+        this.rateLimit = {
+            limit: limit ?? this.rateLimit.limit,
+            remaining: remaining === null
+                ? currentRemaining
+                : currentRemaining === null
+                    ? remaining
+                    : Math.min(currentRemaining, remaining),
+            resetAt: parseResetAt(headers.get("x-ratelimit-reset")) ??
+                this.rateLimit.resetAt,
+            resource: headers.get("x-ratelimit-resource") ?? this.rateLimit.resource,
+        };
+    }
+}
+exports.GitHubApiClient = GitHubApiClient;
+function resolveGitHubToken(env) {
+    const githubToken = env.GITHUB_TOKEN?.trim();
+    const ghToken = env.GH_TOKEN?.trim();
+    if (githubToken && ghToken && githubToken !== ghToken) {
+        throw new GitHubScanError("configuration", "GITHUB_TOKEN and GH_TOKEN contain different values; set only one.");
+    }
+    if (githubToken)
+        return { source: "GITHUB_TOKEN", token: githubToken };
+    if (ghToken)
+        return { source: "GH_TOKEN", token: ghToken };
+    throw new GitHubScanError("configuration", "Set GITHUB_TOKEN or GH_TOKEN to a read-only GitHub token.");
+}
+function redactResolvedToken(value, token) {
+    if (!token)
+        return value;
+    let redacted = value.split(token).join("<redacted>");
+    const fragments = new Set();
+    for (let length = token.length - 1; length >= 4; length -= 1) {
+        for (let start = 0; start + length <= token.length; start += 1) {
+            fragments.add(token.slice(start, start + length));
+        }
+    }
+    for (const fragment of fragments) {
+        redacted = redacted.split(fragment).join("<redacted>");
+    }
+    return redacted;
+}
+function safeErrorMessage(error, token) {
+    const raw = error instanceof Error ? error.message : String(error);
+    return redactResolvedToken(raw, token)
+        .replace(/(?:ghp|github_pat|ghs|ghu|gho|ghr)_[A-Za-z0-9_]+/gi, "<redacted>")
+        .replace(/Bearer\s+\S+/gi, "Bearer <redacted>")
+        .replace(/([?&](?:access_token|api_key|key|secret|token)=)[^&\s]+/gi, "$1<redacted>")
+        .slice(0, 300);
+}
+const RISK_RULES = [
+    {
+        category: "rell_contracts",
+        matches: (path) => path.endsWith(".rell") || /(^|\/)(contracts?|rell)(\/|$)/.test(path),
+    },
+    {
+        category: "encryption_keys_auth",
+        matches: (path) => /(^|[\/_.-])(auth|oauth|oidc|crypto|cryptography|encrypt|decrypt|cipher|key|keys|secret|signer|signature)([\/_.-]|$)/.test(path),
+    },
+    {
+        category: "decision_semantics",
+        matches: (path) => /(^|[\/_.-])(decision|verdict|judge|judgment|policy|guard|allow|deny|hold|block)([\/_.-]|$)/.test(path),
+    },
+    {
+        category: "sdk_plugin_api",
+        matches: (path) => /(^|\/)(sdk|plugins?|bindings?|api)(\/|$)/.test(path) ||
+            /(^|[_.-])(sdk|plugin|api)([_.-]|$)/.test(path),
+    },
+    {
+        category: "workflows_releases_dependencies",
+        matches: (path) => path.startsWith(".github/workflows/") ||
+            /(^|\/)(release|releases|changelog|dependencies|deps)([\/_.-]|$)/.test(path) ||
+            /(^|\/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|cargo\.lock|go\.sum|requirements[^/]*\.txt|pyproject\.toml)$/.test(path),
+    },
+];
+function classifyRisks(input) {
+    const files = [
+        ...new Set(input.files.map((path) => path.replace(/\\/g, "/").toLowerCase())),
+    ].sort((a, b) => a.localeCompare(b));
+    const risks = [];
+    for (const rule of RISK_RULES) {
+        const reasons = files.filter(rule.matches);
+        if (reasons.length > 0)
+            risks.push({ category: rule.category, reasons });
+    }
+    if (input.protectedBranch && input.directCommit) {
+        risks.push({
+            category: "direct_protected_branch_commit",
+            reasons: [input.branch],
+        });
+    }
+    return risks;
+}
+function resolvePositiveInteger(value, fallback, label) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved < 1) {
+        throw new GitHubScanError("configuration", `${label} must be a positive integer.`);
+    }
+    return resolved;
+}
+function resolveScanLimits(options) {
+    return {
+        repositories: resolvePositiveInteger(options.maxRepositories, DEFAULT_MAX_REPOSITORIES, "Maximum repositories"),
+        branchesPerRepository: resolvePositiveInteger(options.maxBranchesPerRepository, DEFAULT_MAX_BRANCHES_PER_REPOSITORY, "Maximum branches per repository"),
+        pullRequestsPerRepository: resolvePositiveInteger(options.maxPullRequestsPerRepository, DEFAULT_MAX_PULL_REQUESTS_PER_REPOSITORY, "Maximum pull requests per repository"),
+        commitsPerBranch: resolvePositiveInteger(options.maxCommitsPerBranch, DEFAULT_MAX_COMMITS_PER_BRANCH, "Maximum commits per branch"),
+        filesPerChange: resolvePositiveInteger(options.maxFilesPerChange, DEFAULT_MAX_FILES_PER_CHANGE, "Maximum files per change"),
+    };
+}
+function parseRepository(value) {
+    const record = asRecord(value, "repository");
+    const owner = asRecord(record.owner, "repository owner");
+    const permissions = record.permissions === undefined
+        ? {}
+        : asRecord(record.permissions, "repository permissions");
+    return {
+        name: requiredString(record, "name", "repository"),
+        fullName: requiredString(record, "full_name", "repository"),
+        owner: requiredString(owner, "login", "repository owner"),
+        ownerType: requiredString(owner, "type", "repository owner"),
+        private: requiredBoolean(record, "private", "repository"),
+        archived: requiredBoolean(record, "archived", "repository"),
+        defaultBranch: requiredString(record, "default_branch", "repository"),
+        permissions: {
+            pull: permissions.pull === true,
+            push: permissions.push === true,
+            admin: permissions.admin === true,
+        },
+    };
+}
+function parseBranch(value) {
+    const record = asRecord(value, "branch");
+    const commit = asRecord(record.commit, "branch commit");
+    return {
+        name: requiredString(record, "name", "branch"),
+        protected: requiredBoolean(record, "protected", "branch"),
+        headSha: requiredString(commit, "sha", "branch commit"),
+    };
+}
+function actorIsBot(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const actor = value;
+    const login = typeof actor.login === "string" ? actor.login : "";
+    return actor.type === "Bot" || /\[bot\]$/i.test(login);
+}
+function commitIsBot(record) {
+    if (actorIsBot(record.author) || actorIsBot(record.committer))
+        return true;
+    const commit = asRecord(record.commit, "commit");
+    for (const key of ["author", "committer"]) {
+        if (typeof commit[key] === "object" &&
+            commit[key] !== null &&
+            !Array.isArray(commit[key])) {
+            const identity = commit[key];
+            const email = typeof identity.email === "string" ? identity.email : "";
+            const name = typeof identity.name === "string" ? identity.name : "";
+            if (/\[bot\]|bot@|noreply\.github\.com$/i.test(`${name} ${email}`))
+                return true;
+        }
+    }
+    return false;
+}
+function parseFiles(value) {
+    return asArray(value, "files")
+        .map((item) => requiredString(asRecord(item, "file"), "filename", "file"))
+        .sort((a, b) => a.localeCompare(b));
+}
+async function authenticate(client, maxRepositories) {
+    try {
+        const user = asRecord(await client.get("/user"), "authenticated user");
+        const repositories = await client.paginate("/user/repos", {
+            affiliation: "owner,collaborator,organization_member",
+            sort: "full_name",
+            direction: "asc",
+            visibility: "all",
+        }, {
+            maxItems: maxRepositories,
+            context: "user repository inventory",
+        });
+        return {
+            kind: "user",
+            login: requiredString(user, "login", "authenticated user"),
+            id: requiredNumber(user, "id", "authenticated user"),
+            repositories,
+        };
+    }
+    catch (error) {
+        if (!(error instanceof GitHubScanError) ||
+            error.kind !== "permission" ||
+            error.status !== 403) {
+            throw error;
+        }
+    }
+    const installation = asRecord(await client.get("/installation"), "GitHub App installation");
+    const account = asRecord(installation.account, "GitHub App installation account");
+    return {
+        kind: "github_app_installation",
+        login: optionalString(account, "login"),
+        id: requiredNumber(installation, "id", "GitHub App installation"),
+        repositories: await client.paginateInstallationRepositories({}, {
+            maxItems: maxRepositories,
+            context: "installation repository inventory",
+        }),
+    };
+}
+async function verifyOrganizations(client, repositories) {
+    const owners = [
+        ...new Set(repositories
+            .filter((repo) => repo.ownerType === "Organization")
+            .map((repo) => repo.owner)),
+    ].sort((a, b) => a.localeCompare(b));
+    const organizations = [];
+    for (const owner of owners) {
+        const record = asRecord(await client.get(`/orgs/${encodePathSegment(owner)}`), "organization");
+        organizations.push({
+            login: requiredString(record, "login", "organization"),
+            id: requiredNumber(record, "id", "organization"),
+            access: "repository_metadata_read",
+        });
+    }
+    return organizations;
+}
+async function listBranches(client, repository, branchFilter, maxBranches) {
+    const repoPath = `/repos/${encodePathSegment(repository.owner)}/${encodePathSegment(repository.name)}`;
+    if (branchFilter) {
+        return [
+            parseBranch(await client.get(`${repoPath}/branches/${encodePathSegment(branchFilter)}`)),
+        ];
+    }
+    return (await client.paginate(`${repoPath}/branches`, {}, {
+        maxItems: maxBranches,
+        context: `branches for ${repository.fullName}`,
+    }))
+        .map(parseBranch)
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+async function listPullRequests(client, repository, options, maxPullRequests) {
+    const repoPath = `/repos/${encodePathSegment(repository.owner)}/${encodePathSegment(repository.name)}`;
+    const since = options.since.getTime();
+    const pulls = await client.paginateWhile(`${repoPath}/pulls`, {
+        state: "closed",
+        sort: "updated",
+        direction: "desc",
+        base: options.branch,
+    }, (page) => {
+        if (page.length === 0)
+            return false;
+        const last = asRecord(page[page.length - 1], "pull request");
+        const updatedAt = Date.parse(requiredString(last, "updated_at", "pull request"));
+        if (Number.isNaN(updatedAt)) {
+            throw new GitHubScanError("malformed_response", "GitHub returned a malformed pull request timestamp.");
+        }
+        return updatedAt >= since;
+    }, {
+        maxItems: maxPullRequests,
+        context: `pull requests for ${repository.fullName}`,
+    });
+    const merged = pulls
+        .map((value) => asRecord(value, "pull request"))
+        .filter((pull) => {
+        const mergedAt = optionalString(pull, "merged_at");
+        if (!mergedAt)
+            return false;
+        const timestamp = Date.parse(mergedAt);
+        if (Number.isNaN(timestamp)) {
+            throw new GitHubScanError("malformed_response", "GitHub returned a malformed pull request timestamp.");
+        }
+        return timestamp >= since;
+    });
+    const filteredBots = options.includeBots
+        ? 0
+        : merged.filter((pull) => actorIsBot(pull.user)).length;
+    return {
+        items: options.includeBots
+            ? merged
+            : merged.filter((pull) => !actorIsBot(pull.user)),
+        filteredBots,
+    };
+}
+async function scanPullRequest(client, repository, pull, maxFiles) {
+    const number = requiredNumber(pull, "number", "pull request");
+    const repoPath = `/repos/${encodePathSegment(repository.owner)}/${encodePathSegment(repository.name)}`;
+    const files = parseFiles(await client.paginate(`${repoPath}/pulls/${number}/files`, {}, {
+        maxItems: maxFiles,
+        context: `files for ${repository.fullName} pull request ${number}`,
+    }));
+    const user = asRecord(pull.user, "pull request user");
+    const base = asRecord(pull.base, "pull request base");
+    const head = asRecord(pull.head, "pull request head");
+    return {
+        number,
+        title: requiredString(pull, "title", "pull request"),
+        author: requiredString(user, "login", "pull request user"),
+        mergedAt: requiredString(pull, "merged_at", "pull request"),
+        baseBranch: requiredString(base, "ref", "pull request base"),
+        headBranch: requiredString(head, "ref", "pull request head"),
+        mergeCommitSha: optionalString(pull, "merge_commit_sha"),
+        files,
+        risks: classifyRisks({
+            branch: requiredString(base, "ref", "pull request base"),
+            protectedBranch: false,
+            directCommit: false,
+            files,
+        }),
+    };
+}
+async function associatedWithMergedPullRequest(client, repoPath, sha, maxPullRequests) {
+    const pulls = await client.paginate(`${repoPath}/commits/${encodePathSegment(sha)}/pulls`, {}, {
+        maxItems: maxPullRequests,
+        context: "pull requests associated with a commit",
+    });
+    return pulls
+        .map((value) => asRecord(value, "associated pull request"))
+        .some((pull) => optionalString(pull, "merged_at") !== null);
+}
+async function scanCommit(client, repository, branch, commit, limits) {
+    const sha = requiredString(commit, "sha", "commit");
+    const repoPath = `/repos/${encodePathSegment(repository.owner)}/${encodePathSegment(repository.name)}`;
+    const files = parseFiles(await client.paginateObjectField(`${repoPath}/commits/${encodePathSegment(sha)}`, "files", {}, {
+        maxItems: limits.filesPerChange,
+        context: `files for ${repository.fullName} commit ${sha}`,
+    }));
+    const commitData = asRecord(commit.commit, "commit");
+    const authorData = asRecord(commitData.author, "commit author");
+    const actor = typeof commit.author === "object" &&
+        commit.author !== null &&
+        !Array.isArray(commit.author)
+        ? commit.author
+        : null;
+    const directCommit = branch.protected &&
+        !(await associatedWithMergedPullRequest(client, repoPath, sha, limits.pullRequestsPerRepository));
+    return {
+        sha,
+        branch: branch.name,
+        message: requiredString(commitData, "message", "commit").split(/\r?\n/, 1)[0],
+        authoredAt: requiredString(authorData, "date", "commit author"),
+        author: actor
+            ? optionalString(actor, "login")
+            : optionalString(authorData, "name"),
+        url: optionalString(commit, "html_url"),
+        directCommit,
+        files,
+        risks: classifyRisks({
+            branch: branch.name,
+            protectedBranch: branch.protected,
+            directCommit,
+            files,
+        }),
+    };
+}
+async function scanGitHub(client, options) {
+    if (Number.isNaN(options.since.getTime())) {
+        throw new GitHubScanError("configuration", "The --since value is invalid.");
+    }
+    if (options.expectRepositories !== undefined &&
+        (!Number.isSafeInteger(options.expectRepositories) ||
+            options.expectRepositories < 0)) {
+        throw new GitHubScanError("configuration", "--expect-repos must be a non-negative integer.");
+    }
+    const limits = resolveScanLimits(options);
+    const auth = await authenticate(client, limits.repositories);
+    const ownerFilters = normalizedList(options.owners);
+    const repositoryFilters = normalizedList(options.repositories);
+    const allRepositories = auth.repositories.map(parseRepository);
+    for (const owner of ownerFilters) {
+        if (!allRepositories.some((repository) => repository.owner.toLowerCase() === owner)) {
+            throw new GitHubScanError("permission", "An explicitly requested GitHub owner is not accessible to this token.");
+        }
+    }
+    for (const filter of repositoryFilters) {
+        if (!allRepositories.some((repository) => repository.name.toLowerCase() === filter ||
+            repository.fullName.toLowerCase() === filter)) {
+            throw new GitHubScanError("permission", "An explicitly requested GitHub repository is not accessible to this token.");
+        }
+    }
+    const repositories = allRepositories
+        .filter((repository) => ownerFilters.length === 0
+        ? true
+        : ownerFilters.includes(repository.owner.toLowerCase()))
+        .filter((repository) => repositoryFilters.length === 0
+        ? true
+        : repositoryFilters.includes(repository.name.toLowerCase()) ||
+            repositoryFilters.includes(repository.fullName.toLowerCase()))
+        .sort((a, b) => a.fullName.localeCompare(b.fullName));
+    if (repositories.length === 0 &&
+        (ownerFilters.length > 0 || repositoryFilters.length > 0)) {
+        throw new GitHubScanError("permission", "The requested GitHub owner/repository filter combination is not accessible.");
+    }
+    if (options.expectRepositories !== undefined &&
+        repositories.length !== options.expectRepositories) {
+        throw new GitHubScanError("limit", `Expected ${options.expectRepositories} repositories but verified ${repositories.length}.`);
+    }
+    const organizations = await verifyOrganizations(client, repositories);
+    const outputRepositories = [];
+    let filteredBots = 0;
+    for (const repository of repositories) {
+        const branches = await listBranches(client, repository, options.branch, limits.branchesPerRepository);
+        const pulls = await listPullRequests(client, repository, options, limits.pullRequestsPerRepository);
+        filteredBots += pulls.filteredBots;
+        const pullRequests = [];
+        for (const pull of pulls.items) {
+            pullRequests.push(await scanPullRequest(client, repository, pull, limits.filesPerChange));
+        }
+        pullRequests.sort((a, b) => {
+            const dateOrder = String(a.mergedAt).localeCompare(String(b.mergedAt));
+            return dateOrder || Number(a.number) - Number(b.number);
+        });
+        const commits = [];
+        for (const branch of branches) {
+            const repoPath = `/repos/${encodePathSegment(repository.owner)}/${encodePathSegment(repository.name)}`;
+            const values = await client.paginate(`${repoPath}/commits`, {
+                sha: branch.name,
+                since: options.since.toISOString(),
+            }, {
+                maxItems: limits.commitsPerBranch,
+                context: `commits for ${repository.fullName} branch ${branch.name}`,
+            });
+            for (const value of values) {
+                const commit = asRecord(value, "commit");
+                if (!options.includeBots && commitIsBot(commit)) {
+                    filteredBots += 1;
+                    continue;
+                }
+                commits.push(await scanCommit(client, repository, branch, commit, limits));
+            }
+        }
+        commits.sort((a, b) => {
+            const branchOrder = String(a.branch).localeCompare(String(b.branch));
+            const dateOrder = String(a.authoredAt).localeCompare(String(b.authoredAt));
+            return (branchOrder || dateOrder || String(a.sha).localeCompare(String(b.sha)));
+        });
+        outputRepositories.push({
+            name: repository.name,
+            fullName: repository.fullName,
+            owner: repository.owner,
+            private: repository.private,
+            archived: repository.archived,
+            defaultBranch: repository.defaultBranch,
+            permissions: repository.permissions,
+            branches,
+            pullRequests,
+            commits,
+        });
+    }
+    const privateRepositories = repositories.filter((repository) => repository.private).length;
+    return {
+        schemaVersion: 1,
+        classifier: {
+            kind: "deterministic_rule_based",
+            fullSast: false,
+            note: "Path-based triage only; this is not a full static application security test.",
+        },
+        auth: {
+            kind: auth.kind,
+            login: auth.login,
+            id: auth.id,
+            scopes: client.scopes,
+            scopeVerification: client.scopes.length > 0 ? "x_oauth_scopes" : "endpoint_access",
+            organizations,
+        },
+        filters: {
+            owners: ownerFilters,
+            repositories: repositoryFilters,
+            branch: options.branch ?? null,
+            since: options.since.toISOString(),
+            includeBots: options.includeBots,
+            expectRepositories: options.expectRepositories ?? null,
+        },
+        completeness: {
+            status: "complete_for_authenticated_api_view",
+            userRepositoryInventory: "explicit_page_probe_to_verified_terminal",
+            installationRepositoryInventory: "exact_total_count",
+            duplicateDetection: "page_and_item_identity",
+            snapshotConsistency: "not_guaranteed_by_github_rest_during_concurrent_mutation",
+            maxPagesPerEndpoint: MAX_PAGES,
+            limits,
+        },
+        summary: {
+            repositories: repositories.length,
+            privateRepositories,
+            publicRepositories: repositories.length - privateRepositories,
+            branches: outputRepositories.reduce((count, repository) => count + repository.branches.length, 0),
+            mergedPullRequests: outputRepositories.reduce((count, repository) => count + repository.pullRequests.length, 0),
+            commits: outputRepositories.reduce((count, repository) => count + repository.commits.length, 0),
+            filteredBots,
+        },
+        rateLimit: client.rateLimit,
+        repositories: outputRepositories,
+    };
+}
+function collectOption(value, previous) {
+    previous.push(value);
+    return previous;
+}
+function parseSince(value) {
+    if (!value) {
+        return new Date(Date.now() - DEFAULT_SINCE_DAYS * 24 * 60 * 60 * 1000);
+    }
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) {
+        throw new GitHubScanError("configuration", "--since must be an ISO-8601 date or timestamp.");
+    }
+    return date;
+}
+function parseIntegerOption(value, label, allowZero = false) {
+    if (!/^\d+$/.test(value)) {
+        throw new GitHubScanError("configuration", `${label} must be ${allowZero ? "a non-negative" : "a positive"} integer.`);
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || (allowZero ? parsed < 0 : parsed < 1)) {
+        throw new GitHubScanError("configuration", `${label} must be ${allowZero ? "a non-negative" : "a positive"} integer.`);
+    }
+    return parsed;
+}
+function printHuman(result, write = (message) => console.log(message)) {
+    const auth = result.auth;
+    const summary = result.summary;
+    const rateLimit = result.rateLimit;
+    write(chalk_1.default.bold("GitHub Repository Scan"));
+    write(`  Identity: ${chalk_1.default.cyan(String(auth.login ?? auth.kind))} (${String(auth.kind)})`);
+    write(`  Repositories: ${summary.repositories} (${summary.privateRepositories} private, ${summary.publicRepositories} public)`);
+    write(`  Surface: ${summary.branches} branches, ${summary.mergedPullRequests} merged PRs, ${summary.commits} commits`);
+    write(`  Bots filtered: ${summary.filteredBots}`);
+    write("  Completeness: terminal pages verified; GitHub snapshot isolation is not guaranteed");
+    write(`  Rate limit: ${String(rateLimit.remaining ?? "unknown")}/${String(rateLimit.limit ?? "unknown")} remaining`);
+    write("");
+    for (const value of result.repositories) {
+        const visibility = value.private
+            ? chalk_1.default.yellow("private")
+            : chalk_1.default.green("public");
+        write(chalk_1.default.bold(`${String(value.fullName)} `) + visibility);
+        write(chalk_1.default.dim(`  ${value.branches.length} branches · ${value.pullRequests.length} merged PRs · ${value.commits.length} commits`));
+        const risks = [
+            ...value.pullRequests.flatMap((item) => item.risks),
+            ...value.commits.flatMap((item) => item.risks),
+        ];
+        const categories = [...new Set(risks.map((risk) => risk.category))].sort();
+        if (categories.length > 0) {
+            write(`  Risk flags: ${chalk_1.default.yellow(categories.join(", "))}`);
+        }
+    }
+    write("");
+    write(chalk_1.default.dim("Classifier is deterministic path-based triage, not a full SAST analysis. No repository file contents were fetched."));
+}
+async function executeGitHubScanCommand(opts, runtime = {
+    env: process.env,
+    createClient: (token) => new GitHubApiClient(token),
+    scan: scanGitHub,
+    stdout: (message) => console.log(message),
+    stderr: (message) => console.error(message),
+}) {
+    let credential;
+    try {
+        credential = resolveGitHubToken(runtime.env);
+        const client = runtime.createClient(credential.token);
+        const result = await runtime.scan(client, {
+            owners: opts.owner,
+            repositories: opts.repo,
+            branch: opts.branch,
+            since: parseSince(opts.since),
+            includeBots: opts.includeBots === true,
+            expectRepositories: opts.expectRepos,
+            maxRepositories: opts.maxRepos,
+            maxBranchesPerRepository: opts.maxBranches,
+            maxPullRequestsPerRepository: opts.maxPrs,
+            maxCommitsPerBranch: opts.maxCommits,
+            maxFilesPerChange: opts.maxFiles,
+        });
+        if (opts.json) {
+            runtime.stdout(JSON.stringify(result, null, 2));
+        }
+        else {
+            printHuman(result, runtime.stdout);
+        }
+        return 0;
+    }
+    catch (error) {
+        const message = safeErrorMessage(error, credential?.token ?? "");
+        runtime.stderr(chalk_1.default.red(`GitHub scan failed: ${message}`));
+        return 1;
+    }
+}
+function registerGithubScanCommand(program) {
+    program
+        .command("github-scan")
+        .description("Scan accessible GitHub repository metadata without modifying GitHub")
+        .option("--owner <owner>", "Limit to an owner (repeatable)", collectOption, [])
+        .option("--repo <repository>", "Limit to a repository name or owner/name (repeatable)", collectOption, [])
+        .option("--branch <branch>", "Limit branch, commits, and merged PR base")
+        .option("--since <date>", `Include merged PRs and commits since ISO date (default: ${DEFAULT_SINCE_DAYS} days)`)
+        .option("--expect-repos <count>", "Fail unless the filtered repository count matches", (value) => parseIntegerOption(value, "--expect-repos", true))
+        .option("--max-repos <count>", "Fail above repository bound", (value) => parseIntegerOption(value, "--max-repos"))
+        .option("--max-branches <count>", "Fail above branches per repository bound", (value) => parseIntegerOption(value, "--max-branches"))
+        .option("--max-prs <count>", "Fail above recent PRs per repository bound", (value) => parseIntegerOption(value, "--max-prs"))
+        .option("--max-commits <count>", "Fail above commits per branch bound", (value) => parseIntegerOption(value, "--max-commits"))
+        .option("--max-files <count>", "Fail above files per PR or commit bound", (value) => parseIntegerOption(value, "--max-files"))
+        .option("--include-bots", "Include bot-authored PRs and commits", false)
+        .option("--json", "Output deterministic machine-readable JSON")
+        .action(async (opts) => {
+        const exitCode = await executeGitHubScanCommand(opts);
+        if (exitCode !== 0) {
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=github-scan.js.map