@de-otio/repo-aegis-core 0.2.0

package/dist/repo.test.js

@@ -0,0 +1,234 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Richard Myers and contributors.
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { readRepoConfig, addEngagement, addEngagements, removeEngagement, setClass, unsetClass, REPO_CLASSES, } from "./repo.js";
+import { NotAGitRepoError } from "./exceptions.js";
+// Each describe block owns its own tmp/gitDir/nonGitDir to avoid cross-block
+// state leakage when a test fails mid-cleanup. Previously a single file-level
+// `before` allocated one tmp directory shared across every describe; a
+// failure inside any `it` could leave git config in a state that broke later
+// blocks. Per-describe fresh dirs make each block hermetic.
+function mkGitDir(parent, name) {
+    const dir = join(parent, name);
+    execFileSync("mkdir", ["-p", dir]);
+    execFileSync("git", ["init", "-q", "-b", "main"], { cwd: dir });
+    execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: dir });
+    execFileSync("git", ["config", "user.name", "test"], { cwd: dir });
+    return dir;
+}
+describe("readRepoConfig", () => {
+    let tmp;
+    let nonGitDir;
+    let gitDir;
+    before(() => {
+        tmp = mkdtempSync(join(tmpdir(), "repo-aegis-repo-rrc-"));
+        nonGitDir = join(tmp, "non-git");
+        execFileSync("mkdir", ["-p", nonGitDir]);
+        gitDir = mkGitDir(tmp, "git");
+    });
+    after(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("returns isGitRepo=false outside a git repo", () => {
+        const cfg = readRepoConfig(nonGitDir);
+        assert.equal(cfg.isGitRepo, false);
+        assert.equal(cfg.class, "private-strict");
+        assert.equal(cfg.engagements.length, 0);
+    });
+    it("returns isGitRepo=true with default class inside a git repo without config", () => {
+        const cfg = readRepoConfig(gitDir);
+        assert.equal(cfg.isGitRepo, true);
+        assert.equal(cfg.class, "private-strict");
+        assert.equal(cfg.classExplicit, false);
+    });
+    it("reads class when set", () => {
+        setClass("public-eligible", gitDir);
+        const cfg = readRepoConfig(gitDir);
+        assert.equal(cfg.class, "public-eligible");
+        assert.equal(cfg.classExplicit, true);
+        unsetClass(gitDir);
+    });
+    it("falls back to private-strict when class value is invalid", () => {
+        execFileSync("git", ["config", "repo-aegis.class", "bogus"], { cwd: gitDir });
+        const cfg = readRepoConfig(gitDir);
+        assert.equal(cfg.class, "private-strict");
+        unsetClass(gitDir);
+    });
+});
+describe("addEngagement / removeEngagement", () => {
+    let tmp;
+    let nonGitDir;
+    let gitDir;
+    before(() => {
+        tmp = mkdtempSync(join(tmpdir(), "repo-aegis-repo-eng-"));
+        nonGitDir = join(tmp, "non-git");
+        execFileSync("mkdir", ["-p", nonGitDir]);
+        gitDir = mkGitDir(tmp, "git");
+    });
+    after(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("adds and removes an engagement idempotently", () => {
+        const r1 = addEngagement("customer-a", gitDir);
+        assert.equal(r1, true);
+        const r2 = addEngagement("customer-a", gitDir);
+        assert.equal(r2, false); // already present
+        const cfg = readRepoConfig(gitDir);
+        assert.ok(cfg.engagements.includes("customer-a"));
+        const removed = removeEngagement("customer-a", gitDir);
+        assert.equal(removed, true);
+        const cfg2 = readRepoConfig(gitDir);
+        assert.ok(!cfg2.engagements.includes("customer-a"));
+    });
+    it("removeEngagement returns false when not present", () => {
+        const r = removeEngagement("never-was-set", gitDir);
+        assert.equal(r, false);
+    });
+    it("supports multiple engagements (multi-value config)", () => {
+        addEngagement("customer-a", gitDir);
+        addEngagement("customer-b", gitDir);
+        const cfg = readRepoConfig(gitDir);
+        assert.deepEqual([...cfg.engagements].sort(), ["customer-a", "customer-b"]);
+        removeEngagement("customer-a", gitDir);
+        removeEngagement("customer-b", gitDir);
+    });
+    it("addEngagements multi-add returns only newly-added ids", () => {
+        addEngagement("customer-a", gitDir);
+        const added = addEngagements(["customer-a", "customer-b", "customer-c"], gitDir);
+        assert.deepEqual(added.sort(), ["customer-b", "customer-c"]);
+        removeEngagement("customer-a", gitDir);
+        removeEngagement("customer-b", gitDir);
+        removeEngagement("customer-c", gitDir);
+    });
+    it("escapes regex-special characters in engagement id when removing", () => {
+        // ids shouldn't typically have special chars, but verify the escape works
+        addEngagement("customer.a", gitDir);
+        addEngagement("customer-a", gitDir);
+        removeEngagement("customer.a", gitDir);
+        const cfg = readRepoConfig(gitDir);
+        // customer-a should still be present; only customer.a removed
+        assert.ok(cfg.engagements.includes("customer-a"));
+        assert.ok(!cfg.engagements.includes("customer.a"));
+        removeEngagement("customer-a", gitDir);
+    });
+    it("throws NotAGitRepoError outside a git repo", () => {
+        assert.throws(() => addEngagement("x", nonGitDir), NotAGitRepoError);
+        assert.throws(() => removeEngagement("x", nonGitDir), NotAGitRepoError);
+    });
+});
+describe("setClass / unsetClass", () => {
+    let tmp;
+    let nonGitDir;
+    let gitDir;
+    before(() => {
+        tmp = mkdtempSync(join(tmpdir(), "repo-aegis-repo-cls-"));
+        nonGitDir = join(tmp, "non-git");
+        execFileSync("mkdir", ["-p", nonGitDir]);
+        gitDir = mkGitDir(tmp, "git");
+    });
+    after(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("each REPO_CLASSES value can round-trip", () => {
+        for (const cls of REPO_CLASSES) {
+            setClass(cls, gitDir);
+            const cfg = readRepoConfig(gitDir);
+            assert.equal(cfg.class, cls);
+        }
+        unsetClass(gitDir);
+    });
+    it("unsetClass on already-unset config does not throw", () => {
+        unsetClass(gitDir);
+        unsetClass(gitDir);
+        const cfg = readRepoConfig(gitDir);
+        assert.equal(cfg.classExplicit, false);
+    });
+    it("setClass throws NotAGitRepoError outside a git repo", () => {
+        assert.throws(() => setClass("public-eligible", nonGitDir), NotAGitRepoError);
+    });
+});
+describe(".repo-aegis.yml overrides", () => {
+    let tmp;
+    let overrideRepo;
+    const yamlPath = (dir) => join(dir, ".repo-aegis.yml");
+    const writeOverride = (dir, body) => {
+        writeFileSync(yamlPath(dir), body);
+    };
+    before(() => {
+        tmp = mkdtempSync(join(tmpdir(), "repo-aegis-repo-yml-"));
+        overrideRepo = mkGitDir(tmp, "override-repo");
+    });
+    after(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("yml provides class when git config does not", () => {
+        writeOverride(overrideRepo, "class: customer-coupled\nengagements: [from-yml]\n");
+        const cfg = readRepoConfig(overrideRepo);
+        assert.equal(cfg.class, "customer-coupled");
+        assert.equal(cfg.classExplicit, true);
+        assert.equal(cfg.classFromOverride, true);
+        assert.deepEqual(cfg.engagements, ["from-yml"]);
+        assert.equal(cfg.engagementsFromOverride, true);
+        rmSync(yamlPath(overrideRepo));
+        unsetClass(overrideRepo);
+    });
+    it("git config wins over yml when both set", () => {
+        execFileSync("git", ["config", "repo-aegis.class", "private-strict"], {
+            cwd: overrideRepo,
+        });
+        execFileSync("git", ["config", "--add", "repo-aegis.engagement", "from-config"], {
+            cwd: overrideRepo,
+        });
+        writeOverride(overrideRepo, "class: customer-coupled\nengagements: [from-yml]\n");
+        const cfg = readRepoConfig(overrideRepo);
+        assert.equal(cfg.class, "private-strict", "git config class wins");
+        assert.equal(cfg.classFromOverride, undefined);
+        assert.deepEqual(cfg.engagements, ["from-config"]);
+        assert.equal(cfg.engagementsFromOverride, undefined);
+        execFileSync("git", ["config", "--unset-all", "repo-aegis.class"], { cwd: overrideRepo });
+        execFileSync("git", ["config", "--unset-all", "repo-aegis.engagement"], { cwd: overrideRepo });
+        rmSync(yamlPath(overrideRepo));
+    });
+    it("invalid class in yml throws RepoOverrideError", async () => {
+        const { RepoOverrideError } = await import("./repo.js");
+        writeOverride(overrideRepo, "class: not-a-real-class\n");
+        assert.throws(() => readRepoConfig(overrideRepo), RepoOverrideError);
+        rmSync(yamlPath(overrideRepo));
+    });
+    it("non-array engagements throws RepoOverrideError", async () => {
+        const { RepoOverrideError } = await import("./repo.js");
+        writeOverride(overrideRepo, "engagements: customer-a\n");
+        assert.throws(() => readRepoConfig(overrideRepo), RepoOverrideError);
+        rmSync(yamlPath(overrideRepo));
+    });
+    it("malformed YAML throws RepoOverrideError", async () => {
+        const { RepoOverrideError } = await import("./repo.js");
+        writeOverride(overrideRepo, "class: customer-coupled\n  unindented: bad\n");
+        assert.throws(() => readRepoConfig(overrideRepo), RepoOverrideError);
+        rmSync(yamlPath(overrideRepo));
+    });
+    it("yml is found via git toplevel even from a subdirectory", () => {
+        const sub = join(overrideRepo, "src", "deep");
+        execFileSync("mkdir", ["-p", sub]);
+        writeOverride(overrideRepo, "class: scratch\n");
+        const cfg = readRepoConfig(sub);
+        assert.equal(cfg.class, "scratch");
+        assert.equal(cfg.classFromOverride, true);
+        rmSync(yamlPath(overrideRepo));
+    });
+    it("works in non-git dirs (yml at cwd)", () => {
+        const dir = join(tmp, "non-git-with-yml");
+        execFileSync("mkdir", ["-p", dir]);
+        writeOverride(dir, "class: scratch\n");
+        const cfg = readRepoConfig(dir);
+        assert.equal(cfg.isGitRepo, false);
+        assert.equal(cfg.class, "scratch");
+        assert.equal(cfg.classFromOverride, true);
+    });
+});
+//# sourceMappingURL=repo.test.js.map

package/dist/repo.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo.test.js","sourceRoot":"","sources":["../src/repo.test.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,4DAA4D;AAE5D,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,GAAW,CAAC;IAChB,IAAI,SAAiB,CAAC;IACtB,IAAI,MAAc,CAAC;IAEnB,MAAM,CAAC,GAAG,EAAE;QACV,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1D,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACtC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,IAAI,GAAW,CAAC;IAChB,IAAI,SAAiB,CAAC;IACtB,IAAI,MAAc,CAAC;IAEnB,MAAM,CAAC,GAAG,EAAE;QACV,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1D,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,GAAG,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB;QAC3C,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5E,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,0EAA0E;QAC1E,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,8DAA8D;QAC9D,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACnD,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,SAAiB,CAAC;IACtB,IAAI,MAAc,CAAC;IAEnB,MAAM,CAAC,GAAG,EAAE;QACV,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1D,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,GAAW,CAAC;IAChB,IAAI,YAAoB,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,IAAY,EAAQ,EAAE;QACxD,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,EAAE;QACV,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1D,YAAY,GAAG,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,aAAa,CAAC,YAAY,EAAE,oDAAoD,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/B,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,EAAE;YACpE,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,aAAa,CAAC,EAAE;YAC/E,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;QACH,aAAa,CAAC,YAAY,EAAE,oDAAoD,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;QACrD,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1F,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,uBAAuB,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACrE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACrE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,aAAa,CAAC,YAAY,EAAE,8CAA8C,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACrE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9C,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnC,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC1C,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnC,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,103 @@
+import type { DenySet } from "./deny-set.js";
+import type { RepoConfig } from "./repo.js";
+import { type RedactionMode } from "./redaction.js";
+export interface ScanHit {
+    path?: string;
+    line: number;
+    column: number;
+    matchPreview: string;
+    /**
+     * The marker file stem (engagement id, or `_always`) the matched pattern
+     * was loaded from. Filled in by scanText when the deny set carries
+     * `patternSources`. Optional for backward compatibility with deny sets
+     * that don't supply attribution (synthetic test fixtures, older callers).
+     */
+    engagement?: string;
+}
+export interface SkippedFile {
+    path: string;
+    reason: "binary" | "too-large" | "unreadable";
+    bytes?: number;
+}
+export interface ScanOptions {
+    revealMatches?: boolean;
+    redactionMode?: RedactionMode;
+    maxFileBytes?: number;
+    /** When true, treat lines containing `repo-aegis: allow` as suppressed. Default: true. */
+    respectAllowComments?: boolean;
+}
+/**
+ * A line is allowed-by-comment if it contains the literal token
+ * `repo-aegis: allow` (case-insensitive). Optional reason can follow,
+ * e.g. `// repo-aegis: allow — synthetic test fixture`. The token is
+ * intentionally explicit (not just `allow`) to avoid accidental
+ * suppression by unrelated comments.
+ */
+export declare const ALLOW_COMMENT: RegExp;
+/**
+ * Scan an arbitrary text body. The most general primitive; called by
+ * the more specific scanners after they've extracted text from their
+ * input (staged diff, file contents, commit range diff).
+ */
+export declare function scanText(text: string, denySet: DenySet, path?: string, opts?: ScanOptions): ScanHit[];
+/**
+ * Scan a single file from disk. Canonicalises the path via realpath to
+ * defeat symlink-tricks. Rejects paths outside the repo working tree
+ * (or current cwd if not in a git repo).
+ */
+export declare function scanFile(path: string, denySet: DenySet, opts?: ScanOptions, workingTree?: string): {
+    hits: ScanHit[];
+    skipped: SkippedFile[];
+};
+/**
+ * Scan the staged diff in a git repo. Pre-commit hook entry point.
+ * Streams the diff through a temp file rather than buffering it whole
+ * — multi-GB pushes that previously OOM'd are now bounded by disk
+ * temp space and a small read buffer.
+ */
+export declare function scanStagedDiff(repo: RepoConfig, denySet: DenySet, opts?: ScanOptions): {
+    hits: ScanHit[];
+    skipped: SkippedFile[];
+};
+/**
+ * Scan the diff over an arbitrary git range (e.g. `main..HEAD`,
+ * `<remote-sha>..<local-sha>`). Pre-push hook entry point.
+ *
+ * Only added-line content is scanned. The caller is responsible for
+ * passing a syntactically valid range; if `git diff` exits non-zero,
+ * the throw propagates. Streams the diff (see scanStagedDiff).
+ */
+export declare function scanRange(repo: RepoConfig, denySet: DenySet, range: string, opts?: ScanOptions): {
+    hits: ScanHit[];
+    skipped: SkippedFile[];
+};
+export interface HistoryHit {
+    pattern: string;
+    commitSha: string;
+    commitSummary: string;
+}
+export interface ScanHistoryOptions extends ScanOptions {
+    /** Lower bound revspec; only commits reachable from the bound forward
+     * are scanned. e.g. "main", "v1.0.0", "HEAD~100". When omitted, scans
+     * the full history (the design's default). */
+    since?: string;
+}
+/**
+ * Scan the full git history with a single `git log -G <combined> -p`
+ * invocation, then attribute matches per-pattern by walking each
+ * commit's diff text. Returns one HistoryHit per (pattern, commit)
+ * match. Pass `--since` to bound the lower edge.
+ *
+ * Cost scales as O(history-size + patterns × hits). Patterns are
+ * combined via `|` into a single regex passed to `git log -G`, so we
+ * pay one git invocation regardless of pattern count. Per-pattern
+ * attribution happens in-process by re-testing each diff line against
+ * the individual patterns — cheap because git already filtered to
+ * commits where at least one pattern matched.
+ *
+ * The pattern field is redacted by default (preview mode) — same
+ * policy as scan hits. Pass `revealMatches: true` to opt into
+ * literals (NEVER from a hook).
+ */
+export declare function scanHistory(repo: RepoConfig, denySet: DenySet, opts?: ScanHistoryOptions): HistoryHit[];
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAU9E,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,YAAY,CAAC;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,QAA2B,CAAC;AAiCtD;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB,OAAO,EAAE,CAsBX;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,WAAgB,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,CAuC7C;AA6KD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,WAAgB,GACrB;IAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,CAU7C;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,WAAgB,GACrB;IAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,CAU7C;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD;;kDAE8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,kBAAuB,GAC5B,UAAU,EAAE,CAwFd"}