@de-otio/repo-aegis-core 0.4.1 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/dist/egress.d.ts +63 -0
  2. package/dist/egress.d.ts.map +1 -0
  3. package/dist/egress.js +0 -0
  4. package/dist/egress.js.map +1 -0
  5. package/dist/egress.test.d.ts +2 -0
  6. package/dist/egress.test.d.ts.map +1 -0
  7. package/dist/egress.test.js +146 -0
  8. package/dist/egress.test.js.map +1 -0
  9. package/dist/index.d.ts +2 -0
  10. package/dist/index.d.ts.map +1 -1
  11. package/dist/index.js +2 -0
  12. package/dist/index.js.map +1 -1
  13. package/package.json +2 -2
  14. package/src/egress.test.ts +175 -0
  15. package/src/egress.ts +0 -0
  16. package/src/index.ts +18 -0
package/dist/egress.d.ts ADDED
@@ -0,0 +1,63 @@
1
+ import type { RepoConfig } from "./repo.js";
2
+ /** A reference to a non-allowed package registry found in a tracked file. */
3
+ export interface RegistryFinding {
4
+ /** Repo-relative (or caller-supplied) path of the offending file. */
5
+ file: string;
6
+ /** The offending registry host (e.g. an account-scoped CodeArtifact host). */
7
+ host: string;
8
+ /** Which file shape produced the finding. */
9
+ kind: "lockfile" | "npmrc";
10
+ /** Lockfile package path / dependency name, when applicable. */
11
+ pkg?: string;
12
+ /** 1-based line number, for `.npmrc` findings. */
13
+ line?: number;
14
+ /** The full offending value (URL or config line), for actionable output. */
15
+ value: string;
16
+ }
17
+ export interface EgressPolicy {
18
+ /**
19
+ * Registry hosts that are allowed in a public-facing tree, in ADDITION to
20
+ * the always-allowed public hosts (npmjs, yarnpkg, and any `*.github.com`
21
+ * — GitHub Packages / codeload). Use for a team's public mirror host.
22
+ */
23
+ readonly allowedHosts: readonly string[];
24
+ }
25
+ /**
26
+ * Public hosts allowed everywhere. `*.github.com` (GitHub Packages,
27
+ * codeload.github.com) is handled by suffix match in {@link isHostAllowed},
28
+ * not listed here.
29
+ */
30
+ export declare const DEFAULT_ALLOWED_REGISTRY_HOSTS: readonly string[];
31
+ export declare function defaultEgressPolicy(): EgressPolicy;
32
+ /** True when `host` is a public/allowed registry under `policy`. */
33
+ export declare function isHostAllowed(host: string, policy: EgressPolicy): boolean;
34
+ export interface EgressInputFile {
35
+ /** Repo-relative path; its basename selects the parser. */
36
+ path: string;
37
+ /** File contents. */
38
+ text: string;
39
+ }
40
+ /** Select a parser by file basename; null when the file is not relevant. */
41
+ export declare function egressParserFor(path: string): ((file: string, text: string, policy: EgressPolicy) => RegistryFinding[]) | null;
42
+ /** True when `path` is a file shape this module knows how to scan. */
43
+ export declare function isEgressRelevant(path: string): boolean;
44
+ /** Scan a set of in-memory files for non-allowed registry references. */
45
+ export declare function scanRegistryEgress(files: readonly EgressInputFile[], policy?: EgressPolicy): RegistryFinding[];
46
+ export type RepoVisibility = "public" | "private" | "unknown";
47
+ /**
48
+ * Read the cached GitHub visibility for the repo from git config
49
+ * (`repo-aegis.visibility`). Populated by `classify` / `status`; absent →
50
+ * "unknown". A single, fast, offline read so hooks never block on the network.
51
+ */
52
+ export declare function readCachedVisibility(cwd: string): RepoVisibility;
53
+ /**
54
+ * Whether egress enforcement applies to this repo. True when the repo is
55
+ * declared `public-eligible`, OR its cached GitHub visibility is `public`
56
+ * (the misclassification safety net: a repo left at the `private-strict`
57
+ * default but actually public on GitHub is still protected). Private repos
58
+ * — where a private-registry URL is intended — return false.
59
+ */
60
+ export declare function isPublicFacing(repo: Pick<RepoConfig, "class" | "cwd">, opts?: {
61
+ visibility?: RepoVisibility;
62
+ }): boolean;
63
+ //# sourceMappingURL=egress.d.ts.map
package/dist/egress.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3B,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAG3D,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,YAAY,CAElD;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAOzE;AAyLD,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GACX,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,KAAK,eAAe,EAAE,CAAC,GAAG,IAAI,CAOlF;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,MAAM,GAAE,YAAoC,GAC3C,eAAe,EAAE,CAQnB;AAMD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAYhE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,CAAC,EACvC,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,cAAc,CAAA;CAAO,GACzC,OAAO,CAIT"}
package/dist/egress.js ADDED
Binary file
package/dist/egress.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"egress.js","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,qEAAqE;AACrE,oEAAoE;AACpE,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA4B1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,sBAAsB;CACvB,CAAC;AAEF,MAAM,UAAU,mBAAmB;IACjC,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,8BAA8B,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAoB;IAC9D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC3E,IAAI,8BAA8B,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,2EAA2E;IAC3E,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAiBD,SAAS,WAAW,CAClB,IAAY,EACZ,IAAY,EACZ,MAAoB;IAEpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,8DAA8D;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,QAAiB,EAAQ,EAAE;QACxD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,4CAA4C;QACrE,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO;QACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,sDAAsD;IACtD,MAAM,EAAE,GAAG,MAAmB,CAAC;IAC/B,IAAI,EAAE,CAAC,QAAQ,IAAI,OAAO,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,kCAAkC;IAClC,MAAM,IAAI,GAAG,CAAC,IAA8C,EAAE,MAAc,EAAQ,EAAE;QACpF,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAClD,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAE,MAAoB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE7C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E,SAAS,YAAY,CACnB,IAAY,EACZ,IAAY,EACZ,MAAoB;IAEpB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;eAC5D,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,uEAAuE;QACvE,sCAAsC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,SAAS;QACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,0CAA0C;AAC1C,8EAA8E;AAE9E,SAAS,YAAY,CACnB,IAAY,EACZ,IAAY,EACZ,MAAoB;IAEpB,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAY,EAAQ,EAAE;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO;QACvD,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IACF,0CAA0C;IAC1C,GAAG,CAAC,YAAY,EAAG,GAA8B,CAAC,QAAQ,CAAC,CAAC;IAC5D,iEAAiE;IACjE,MAAM,KAAK,GAA2C,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACxD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;iBAAM,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,oDAAoD;AACpD,8EAA8E;AAE9E,SAAS,SAAS,CAChB,IAAY,EACZ,IAAY,EACZ,MAAoB;IAEpB,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAE1E,sDAAsD;QACtD,MAAM,GAAG,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,MAAM,IAAI,GAAG,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBAChD,uDAAuD;gBACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,WAAW,CAAC;IACvF,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC;IAC9C,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,YAAY,CAAC;IACnD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAChC,KAAiC,EACjC,SAAuB,mBAAmB,EAAE;IAE5C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,uBAAuB,CAAC,EAAE;YAC5E,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAuC,EACvC,OAAwC,EAAE;IAE1C,IAAI,IAAI,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,KAAK,QAAQ,CAAC;AAC1B,CAAC"}
package/dist/egress.test.d.ts ADDED
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=egress.test.d.ts.map
package/dist/egress.test.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"egress.test.d.ts","sourceRoot":"","sources":["../src/egress.test.ts"],"names":[],"mappings":""}
package/dist/egress.test.js ADDED
@@ -0,0 +1,146 @@
1
+ // SPDX-License-Identifier: GPL-3.0-or-later
2
+ // Copyright (C) 2026 Richard Myers and contributors.
3
+ import { describe, it } from "node:test";
4
+ import assert from "node:assert/strict";
5
+ import { scanRegistryEgress, egressParserFor, isEgressRelevant, isHostAllowed, defaultEgressPolicy, isPublicFacing, } from "./egress.js";
6
+ const CA = "dot-981025486549.d.codeartifact.eu-central-1.amazonaws.com";
7
+ const policy = defaultEgressPolicy();
8
+ describe("isHostAllowed", () => {
9
+ it("allows the public hosts", () => {
10
+ for (const h of ["registry.npmjs.org", "registry.yarnpkg.com"]) {
11
+ assert.equal(isHostAllowed(h, policy), true);
12
+ }
13
+ });
14
+ it("allows GitHub Packages and codeload by suffix", () => {
15
+ assert.equal(isHostAllowed("npm.pkg.github.com", policy), true);
16
+ assert.equal(isHostAllowed("codeload.github.com", policy), true);
17
+ assert.equal(isHostAllowed("github.com", policy), true);
18
+ });
19
+ it("denies a private CodeArtifact host", () => {
20
+ assert.equal(isHostAllowed(CA, policy), false);
21
+ });
22
+ it("honours an extra allowed host from policy", () => {
23
+ const p = { allowedHosts: ["mirror.example.org"] };
24
+ assert.equal(isHostAllowed("mirror.example.org", p), true);
25
+ assert.equal(isHostAllowed(CA, p), false);
26
+ });
27
+ });
28
+ describe("scanRegistryEgress — package-lock.json", () => {
29
+ it("flags a v3 resolved URL from a private registry, allows public ones", () => {
30
+ const lock = JSON.stringify({
31
+ lockfileVersion: 3,
32
+ packages: {
33
+ "": { name: "x" },
34
+ "node_modules/a": { resolved: `https://${CA}/npm/npm/a/-/a-1.0.0.tgz` },
35
+ "node_modules/b": { resolved: "https://registry.npmjs.org/b/-/b-1.0.0.tgz" },
36
+ "node_modules/c": { resolved: "https://npm.pkg.github.com/c/-/c-1.0.0.tgz" },
37
+ "node_modules/local": { resolved: undefined },
38
+ },
39
+ });
40
+ const f = scanRegistryEgress([{ path: "package-lock.json", text: lock }]);
41
+ assert.equal(f.length, 1);
42
+ assert.equal(f[0]?.host, CA);
43
+ assert.equal(f[0]?.pkg, "node_modules/a");
44
+ assert.equal(f[0]?.kind, "lockfile");
45
+ });
46
+ it("walks the v1 nested dependencies tree", () => {
47
+ const lock = JSON.stringify({
48
+ lockfileVersion: 1,
49
+ dependencies: {
50
+ a: {
51
+ resolved: "https://registry.npmjs.org/a/-/a-1.0.0.tgz",
52
+ dependencies: {
53
+ b: { resolved: `https://${CA}/npm/npm/b/-/b-2.0.0.tgz` },
54
+ },
55
+ },
56
+ },
57
+ });
58
+ const f = scanRegistryEgress([{ path: "package-lock.json", text: lock }]);
59
+ assert.equal(f.length, 1);
60
+ assert.equal(f[0]?.host, CA);
61
+ assert.match(f[0]?.pkg ?? "", /a > b/);
62
+ });
63
+ it("ignores file:/link: and malformed JSON (fails soft)", () => {
64
+ const lock = JSON.stringify({
65
+ packages: { "node_modules/x": { resolved: "file:../x" } },
66
+ });
67
+ assert.equal(scanRegistryEgress([{ path: "package-lock.json", text: lock }]).length, 0);
68
+ assert.equal(scanRegistryEgress([{ path: "package-lock.json", text: "{not json" }]).length, 0);
69
+ });
70
+ });
71
+ describe("scanRegistryEgress — yarn.lock", () => {
72
+ it("flags a private resolved URL, strips the #hash, allows public", () => {
73
+ const yarn = [
74
+ 'a@^1.0.0:',
75
+ ' version "1.0.0"',
76
+ ` resolved "https://${CA}/npm/npm/a/-/a-1.0.0.tgz#abc123"`,
77
+ 'b@^1.0.0:',
78
+ ' version "1.0.0"',
79
+ ' resolved "https://registry.yarnpkg.com/b/-/b-1.0.0.tgz#def"',
80
+ ].join("\n");
81
+ const f = scanRegistryEgress([{ path: "yarn.lock", text: yarn }]);
82
+ assert.equal(f.length, 1);
83
+ assert.equal(f[0]?.host, CA);
84
+ assert.ok(!f[0]?.value.includes("#"));
85
+ });
86
+ });
87
+ describe("scanRegistryEgress — pnpm-lock.yaml", () => {
88
+ it("flags a tarball URL and a top-level registry from a private host", () => {
89
+ const pnpm = [
90
+ `registry: https://${CA}/npm/npm/`,
91
+ "packages:",
92
+ " /a@1.0.0:",
93
+ " resolution:",
94
+ ` tarball: https://${CA}/npm/npm/a/-/a-1.0.0.tgz`,
95
+ " /b@1.0.0:",
96
+ " resolution:",
97
+ " integrity: sha512-deadbeef",
98
+ ].join("\n");
99
+ const f = scanRegistryEgress([{ path: "pnpm-lock.yaml", text: pnpm }]);
100
+ assert.ok(f.length >= 1);
101
+ assert.ok(f.every(x => x.host === CA));
102
+ });
103
+ });
104
+ describe("scanRegistryEgress — .npmrc", () => {
105
+ it("flags registry=, @scope:registry= and //host auth lines; allows public; redacts creds", () => {
106
+ const npmrc = [
107
+ "# comment",
108
+ `registry=https://${CA}/npm/npm/`,
109
+ `@de-otio:registry=https://${CA}/npm/npm/`,
110
+ "//registry.npmjs.org/:_authToken=npm_public_ok",
111
+ `//${CA}/npm/npm/:_authToken=secret-token-value`,
112
+ "registry=https://registry.npmjs.org/",
113
+ ].join("\n");
114
+ const f = scanRegistryEgress([{ path: ".npmrc", text: npmrc }]);
115
+ // two registry= lines for CA + one auth line for CA = 3; npmjs lines allowed
116
+ assert.equal(f.length, 3);
117
+ assert.ok(f.every(x => x.host === CA && x.kind === "npmrc"));
118
+ const auth = f.find(x => x.value.includes("_authToken"));
119
+ assert.ok(auth, "auth line flagged");
120
+ assert.ok(!auth.value.includes("secret-token-value"), "credential redacted");
121
+ });
122
+ });
123
+ describe("parser dispatch", () => {
124
+ it("selects parsers by basename and ignores irrelevant files", () => {
125
+ assert.ok(egressParserFor("a/b/package-lock.json"));
126
+ assert.ok(egressParserFor("yarn.lock"));
127
+ assert.ok(egressParserFor("sub/.npmrc"));
128
+ assert.equal(egressParserFor("README.md"), null);
129
+ assert.equal(isEgressRelevant("npm-shrinkwrap.json"), true);
130
+ assert.equal(isEgressRelevant("index.ts"), false);
131
+ });
132
+ });
133
+ describe("isPublicFacing", () => {
134
+ it("enforces for public-eligible without any visibility probe", () => {
135
+ assert.equal(isPublicFacing({ class: "public-eligible", cwd: "/x" }), true);
136
+ });
137
+ it("enforces for a private-strict repo whose actual visibility is public", () => {
138
+ assert.equal(isPublicFacing({ class: "private-strict", cwd: "/x" }, { visibility: "public" }), true);
139
+ });
140
+ it("does NOT enforce for private/unknown (CodeArtifact URLs are intended there)", () => {
141
+ assert.equal(isPublicFacing({ class: "private-strict", cwd: "/x" }, { visibility: "private" }), false);
142
+ assert.equal(isPublicFacing({ class: "private-strict", cwd: "/x" }, { visibility: "unknown" }), false);
143
+ assert.equal(isPublicFacing({ class: "customer-coupled", cwd: "/x" }, { visibility: "unknown" }), false);
144
+ });
145
+ });
146
+ //# sourceMappingURL=egress.test.js.map
package/dist/egress.test.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"egress.test.js","sourceRoot":"","sources":["../src/egress.test.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,cAAc,GAEf,MAAM,aAAa,CAAC;AAErB,MAAM,EAAE,GAAG,4DAA4D,CAAC;AACxE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;AAErC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAiB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE;gBACR,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;gBACjB,gBAAgB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;gBACvE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,4CAA4C,EAAE;gBAC5E,gBAAgB,EAAE,EAAE,QAAQ,EAAE,4CAA4C,EAAE;gBAC5E,oBAAoB,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;aAC9C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,eAAe,EAAE,CAAC;YAClB,YAAY,EAAE;gBACZ,CAAC,EAAE;oBACD,QAAQ,EAAE,4CAA4C;oBACtD,YAAY,EAAE;wBACZ,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;qBACzD;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG;YACX,WAAW;YACX,mBAAmB;YACnB,uBAAuB,EAAE,kCAAkC;YAC3D,WAAW;YACX,mBAAmB;YACnB,+DAA+D;SAChE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,IAAI,GAAG;YACX,qBAAqB,EAAE,WAAW;YAClC,WAAW;YACX,aAAa;YACb,iBAAiB;YACjB,0BAA0B,EAAE,0BAA0B;YACtD,aAAa;YACb,iBAAiB;YACjB,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,KAAK,GAAG;YACZ,WAAW;YACX,oBAAoB,EAAE,WAAW;YACjC,6BAA6B,EAAE,WAAW;YAC1C,gDAAgD;YAChD,KAAK,EAAE,yCAAyC;YAChD,sCAAsC;SACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAChE,6EAA6E;QAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,KAAK,CACV,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAChF,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,KAAK,CACV,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EACjF,KAAK,CACN,CAAC;QACF,MAAM,CAAC,KAAK,CACV,cAAc,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EACjF,KAAK,CACN,CAAC;QACF,MAAM,CAAC,KAAK,CACV,cAAc,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EACnF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
package/dist/index.d.ts CHANGED
@@ -20,6 +20,8 @@ export { scanText, scanFile, scanStagedDiff, scanRange, scanHistory, ALLOW_COMME
20
20
  export type { ScanHit, SkippedFile, HistoryHit, ScanOptions } from "./scan.js";
21
21
  export { scanForSecrets, summariseHits } from "./secret-markers.js";
22
22
  export type { SecretMarkerKind, SecretMarkerHit } from "./secret-markers.js";
23
+ export { scanRegistryEgress, egressParserFor, isEgressRelevant, isHostAllowed, defaultEgressPolicy, DEFAULT_ALLOWED_REGISTRY_HOSTS, readCachedVisibility, isPublicFacing, } from "./egress.js";
24
+ export type { RegistryFinding, EgressPolicy, EgressInputFile, RepoVisibility, } from "./egress.js";
23
25
  export { renderMarkers, MARKER_FORMAT_VERSION } from "./render.js";
24
26
  export type { RenderOptions, RenderedFile, RenderResult } from "./render.js";
25
27
  export { redactMatch, revealMatch } from "./redaction.js";
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,SAAS,EACT,WAAW,EACX,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAQpD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOhE,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAO3D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,GACb,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,SAAS,EACT,WAAW,EACX,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG7E,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,EACpB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,YAAY,EACZ,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAQpD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOhE,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAO3D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
package/dist/index.js CHANGED
@@ -36,6 +36,8 @@ export { computeDenySet, ALWAYS_FILE_STEM } from "./deny-set.js";
36
36
  export { scanText, scanFile, scanStagedDiff, scanRange, scanHistory, ALLOW_COMMENT, } from "./scan.js";
37
37
  // ---- secret-shaped markers (universal, not engagement-scoped) -----------
38
38
  export { scanForSecrets, summariseHits } from "./secret-markers.js";
39
+ // ---- public-repo egress hygiene (private-registry URL leak prevention) ---
40
+ export { scanRegistryEgress, egressParserFor, isEgressRelevant, isHostAllowed, defaultEgressPolicy, DEFAULT_ALLOWED_REGISTRY_HOSTS, readCachedVisibility, isPublicFacing, } from "./egress.js";
39
41
  // ---- render --------------------------------------------------------------
40
42
  export { renderMarkers, MARKER_FORMAT_VERSION } from "./render.js";
41
43
  // ---- redaction -----------------------------------------------------------
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,6DAA6D;AAC7D,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,6BAA6B;AAC7B,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AAExD,6EAA6E;AAC7E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,6EAA6E;AAC7E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,6EAA6E;AAC7E,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,eAAe,CAAC;AAGvB,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjD,4EAA4E;AAC5E,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAG7B,4EAA4E;AAC5E,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAWjE,4EAA4E;AAC5E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAM9B,6EAA6E;AAC7E,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAGnB,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjE,6EAA6E;AAC7E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,SAAS,EACT,WAAW,EACX,aAAa,GACd,MAAM,WAAW,CAAC;AAGnB,4EAA4E;AAC5E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,6EAA6E;AAC7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGnE,6EAA6E;AAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6EAA6E;AAC7E,uEAAuE;AACvE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,iCAAiC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAO3B,6EAA6E;AAC7E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAEzB,6EAA6E;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,4EAA4E;AAC5E,2DAA2D;AAC3D,8DAA8D;AAC9D,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,QAAQ,GACT,MAAM,UAAU,CAAC;AAGlB,6EAA6E;AAC7E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAMnD,6EAA6E;AAC7E,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,oCAAoC;AACpC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,6DAA6D;AAC7D,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,6BAA6B;AAC7B,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AAExD,6EAA6E;AAC7E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,6EAA6E;AAC7E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,6EAA6E;AAC7E,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,eAAe,CAAC;AAGvB,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjD,4EAA4E;AAC5E,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAG7B,4EAA4E;AAC5E,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAWjE,4EAA4E;AAC5E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAM9B,6EAA6E;AAC7E,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAGnB,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjE,6EAA6E;AAC7E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,SAAS,EACT,WAAW,EACX,aAAa,GACd,MAAM,WAAW,CAAC;AAGnB,4EAA4E;AAC5E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpE,6EAA6E;AAC7E,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,8BAA8B,EAC9B,oBAAoB,EACpB,cAAc,GACf,MAAM,aAAa,CAAC;AAQrB,6EAA6E;AAC7E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGnE,6EAA6E;AAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG1D,6EAA6E;AAC7E,uEAAuE;AACvE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,iCAAiC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAO3B,6EAA6E;AAC7E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AAEzB,6EAA6E;AAC7E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,4EAA4E;AAC5E,2DAA2D;AAC3D,8DAA8D;AAC9D,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,QAAQ,GACT,MAAM,UAAU,CAAC;AAGlB,6EAA6E;AAC7E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAMnD,6EAA6E;AAC7E,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,oCAAoC;AACpC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@de-otio/repo-aegis-core",
3
- "version": "0.4.1",
3
+ "version": "0.5.0",
4
4
  "description": "Core library for repo-aegis: engagement registry, deny-set computation, marker scanner",
5
5
  "license": "GPL-3.0-or-later",
6
6
  "author": "Richard Myers",
@@ -32,7 +32,7 @@
32
32
  "zod": "^4.4.3"
33
33
  },
34
34
  "optionalDependencies": {
35
- "re2": "^1.24.1"
35
+ "re2": "^1.25.0"
36
36
  },
37
37
  "devDependencies": {
38
38
  "@types/proper-lockfile": "^4.1.4"
package/src/egress.test.ts ADDED
@@ -0,0 +1,175 @@
1
+ // SPDX-License-Identifier: GPL-3.0-or-later
2
+ // Copyright (C) 2026 Richard Myers and contributors.
3
+ import { describe, it } from "node:test";
4
+ import assert from "node:assert/strict";
5
+ import {
6
+ scanRegistryEgress,
7
+ egressParserFor,
8
+ isEgressRelevant,
9
+ isHostAllowed,
10
+ defaultEgressPolicy,
11
+ isPublicFacing,
12
+ type EgressPolicy,
13
+ } from "./egress.js";
14
+
15
+ const CA = "dot-981025486549.d.codeartifact.eu-central-1.amazonaws.com";
16
+ const policy = defaultEgressPolicy();
17
+
18
+ describe("isHostAllowed", () => {
19
+ it("allows the public hosts", () => {
20
+ for (const h of ["registry.npmjs.org", "registry.yarnpkg.com"]) {
21
+ assert.equal(isHostAllowed(h, policy), true);
22
+ }
23
+ });
24
+ it("allows GitHub Packages and codeload by suffix", () => {
25
+ assert.equal(isHostAllowed("npm.pkg.github.com", policy), true);
26
+ assert.equal(isHostAllowed("codeload.github.com", policy), true);
27
+ assert.equal(isHostAllowed("github.com", policy), true);
28
+ });
29
+ it("denies a private CodeArtifact host", () => {
30
+ assert.equal(isHostAllowed(CA, policy), false);
31
+ });
32
+ it("honours an extra allowed host from policy", () => {
33
+ const p: EgressPolicy = { allowedHosts: ["mirror.example.org"] };
34
+ assert.equal(isHostAllowed("mirror.example.org", p), true);
35
+ assert.equal(isHostAllowed(CA, p), false);
36
+ });
37
+ });
38
+
39
+ describe("scanRegistryEgress — package-lock.json", () => {
40
+ it("flags a v3 resolved URL from a private registry, allows public ones", () => {
41
+ const lock = JSON.stringify({
42
+ lockfileVersion: 3,
43
+ packages: {
44
+ "": { name: "x" },
45
+ "node_modules/a": { resolved: `https://${CA}/npm/npm/a/-/a-1.0.0.tgz` },
46
+ "node_modules/b": { resolved: "https://registry.npmjs.org/b/-/b-1.0.0.tgz" },
47
+ "node_modules/c": { resolved: "https://npm.pkg.github.com/c/-/c-1.0.0.tgz" },
48
+ "node_modules/local": { resolved: undefined },
49
+ },
50
+ });
51
+ const f = scanRegistryEgress([{ path: "package-lock.json", text: lock }]);
52
+ assert.equal(f.length, 1);
53
+ assert.equal(f[0]?.host, CA);
54
+ assert.equal(f[0]?.pkg, "node_modules/a");
55
+ assert.equal(f[0]?.kind, "lockfile");
56
+ });
57
+
58
+ it("walks the v1 nested dependencies tree", () => {
59
+ const lock = JSON.stringify({
60
+ lockfileVersion: 1,
61
+ dependencies: {
62
+ a: {
63
+ resolved: "https://registry.npmjs.org/a/-/a-1.0.0.tgz",
64
+ dependencies: {
65
+ b: { resolved: `https://${CA}/npm/npm/b/-/b-2.0.0.tgz` },
66
+ },
67
+ },
68
+ },
69
+ });
70
+ const f = scanRegistryEgress([{ path: "package-lock.json", text: lock }]);
71
+ assert.equal(f.length, 1);
72
+ assert.equal(f[0]?.host, CA);
73
+ assert.match(f[0]?.pkg ?? "", /a > b/);
74
+ });
75
+
76
+ it("ignores file:/link: and malformed JSON (fails soft)", () => {
77
+ const lock = JSON.stringify({
78
+ packages: { "node_modules/x": { resolved: "file:../x" } },
79
+ });
80
+ assert.equal(scanRegistryEgress([{ path: "package-lock.json", text: lock }]).length, 0);
81
+ assert.equal(scanRegistryEgress([{ path: "package-lock.json", text: "{not json" }]).length, 0);
82
+ });
83
+ });
84
+
85
+ describe("scanRegistryEgress — yarn.lock", () => {
86
+ it("flags a private resolved URL, strips the #hash, allows public", () => {
87
+ const yarn = [
88
+ 'a@^1.0.0:',
89
+ ' version "1.0.0"',
90
+ ` resolved "https://${CA}/npm/npm/a/-/a-1.0.0.tgz#abc123"`,
91
+ 'b@^1.0.0:',
92
+ ' version "1.0.0"',
93
+ ' resolved "https://registry.yarnpkg.com/b/-/b-1.0.0.tgz#def"',
94
+ ].join("\n");
95
+ const f = scanRegistryEgress([{ path: "yarn.lock", text: yarn }]);
96
+ assert.equal(f.length, 1);
97
+ assert.equal(f[0]?.host, CA);
98
+ assert.ok(!f[0]?.value.includes("#"));
99
+ });
100
+ });
101
+
102
+ describe("scanRegistryEgress — pnpm-lock.yaml", () => {
103
+ it("flags a tarball URL and a top-level registry from a private host", () => {
104
+ const pnpm = [
105
+ `registry: https://${CA}/npm/npm/`,
106
+ "packages:",
107
+ " /a@1.0.0:",
108
+ " resolution:",
109
+ ` tarball: https://${CA}/npm/npm/a/-/a-1.0.0.tgz`,
110
+ " /b@1.0.0:",
111
+ " resolution:",
112
+ " integrity: sha512-deadbeef",
113
+ ].join("\n");
114
+ const f = scanRegistryEgress([{ path: "pnpm-lock.yaml", text: pnpm }]);
115
+ assert.ok(f.length >= 1);
116
+ assert.ok(f.every(x => x.host === CA));
117
+ });
118
+ });
119
+
120
+ describe("scanRegistryEgress — .npmrc", () => {
121
+ it("flags registry=, @scope:registry= and //host auth lines; allows public; redacts creds", () => {
122
+ const npmrc = [
123
+ "# comment",
124
+ `registry=https://${CA}/npm/npm/`,
125
+ `@de-otio:registry=https://${CA}/npm/npm/`,
126
+ "//registry.npmjs.org/:_authToken=npm_public_ok",
127
+ `//${CA}/npm/npm/:_authToken=secret-token-value`,
128
+ "registry=https://registry.npmjs.org/",
129
+ ].join("\n");
130
+ const f = scanRegistryEgress([{ path: ".npmrc", text: npmrc }]);
131
+ // two registry= lines for CA + one auth line for CA = 3; npmjs lines allowed
132
+ assert.equal(f.length, 3);
133
+ assert.ok(f.every(x => x.host === CA && x.kind === "npmrc"));
134
+ const auth = f.find(x => x.value.includes("_authToken"));
135
+ assert.ok(auth, "auth line flagged");
136
+ assert.ok(!auth!.value.includes("secret-token-value"), "credential redacted");
137
+ });
138
+ });
139
+
140
+ describe("parser dispatch", () => {
141
+ it("selects parsers by basename and ignores irrelevant files", () => {
142
+ assert.ok(egressParserFor("a/b/package-lock.json"));
143
+ assert.ok(egressParserFor("yarn.lock"));
144
+ assert.ok(egressParserFor("sub/.npmrc"));
145
+ assert.equal(egressParserFor("README.md"), null);
146
+ assert.equal(isEgressRelevant("npm-shrinkwrap.json"), true);
147
+ assert.equal(isEgressRelevant("index.ts"), false);
148
+ });
149
+ });
150
+
151
+ describe("isPublicFacing", () => {
152
+ it("enforces for public-eligible without any visibility probe", () => {
153
+ assert.equal(isPublicFacing({ class: "public-eligible", cwd: "/x" }), true);
154
+ });
155
+ it("enforces for a private-strict repo whose actual visibility is public", () => {
156
+ assert.equal(
157
+ isPublicFacing({ class: "private-strict", cwd: "/x" }, { visibility: "public" }),
158
+ true,
159
+ );
160
+ });
161
+ it("does NOT enforce for private/unknown (CodeArtifact URLs are intended there)", () => {
162
+ assert.equal(
163
+ isPublicFacing({ class: "private-strict", cwd: "/x" }, { visibility: "private" }),
164
+ false,
165
+ );
166
+ assert.equal(
167
+ isPublicFacing({ class: "private-strict", cwd: "/x" }, { visibility: "unknown" }),
168
+ false,
169
+ );
170
+ assert.equal(
171
+ isPublicFacing({ class: "customer-coupled", cwd: "/x" }, { visibility: "unknown" }),
172
+ false,
173
+ );
174
+ });
175
+ });
package/src/egress.ts ADDED
Binary file
package/src/index.ts CHANGED
@@ -119,6 +119,24 @@ export type { ScanHit, SkippedFile, HistoryHit, ScanOptions } from "./scan.js";
119
119
  export { scanForSecrets, summariseHits } from "./secret-markers.js";
120
120
  export type { SecretMarkerKind, SecretMarkerHit } from "./secret-markers.js";
121
121
 
122
+ // ---- public-repo egress hygiene (private-registry URL leak prevention) ---
123
+ export {
124
+ scanRegistryEgress,
125
+ egressParserFor,
126
+ isEgressRelevant,
127
+ isHostAllowed,
128
+ defaultEgressPolicy,
129
+ DEFAULT_ALLOWED_REGISTRY_HOSTS,
130
+ readCachedVisibility,
131
+ isPublicFacing,
132
+ } from "./egress.js";
133
+ export type {
134
+ RegistryFinding,
135
+ EgressPolicy,
136
+ EgressInputFile,
137
+ RepoVisibility,
138
+ } from "./egress.js";
139
+
122
140
  // ---- render --------------------------------------------------------------
123
141
  export { renderMarkers, MARKER_FORMAT_VERSION } from "./render.js";
124
142
  export type { RenderOptions, RenderedFile, RenderResult } from "./render.js";