@trofimyukdev/repo-truth 0.0.0-stage → 0.1.0

package/dist/checks/action-pins.js

@@ -0,0 +1,196 @@
+/**
+ * Unpinned actions.
+ *
+ * A `uses: owner/repo@v4` runs whatever commit the tag names on the day the job
+ * runs, with the job's token and secrets. This check reads, whole and through
+ * git at the merge base of `base` and `candidate` and at `candidate` (never the
+ * working tree), every workflow file the range adds, changes or renames onto -
+ * `.github/workflows/<name>.yml` or `.yaml` directly in that directory - and
+ * every file named `action.yml` or `action.yaml` at any depth.
+ *
+ * The YAML is not parsed. A `uses:` line is a line whose text, white space at
+ * both ends removed, opens `uses:` or `- uses:`; its value is the rest of the
+ * line with a trailing comment (a `#` after white space) removed, then white
+ * space at both ends, then one pair of matching surrounding quotes. A line is
+ * added when the candidate's file holds its text more often than its source
+ * file (the file at the merge base, the one a rename came from, or none) did;
+ * a line moved or re-indented is not, and a text added more than once is one
+ * finding.
+ *
+ * Pinned: a local reference (opening `./`), a `docker://` image by digest
+ * (`@sha256:` and sixty-four hexadecimal digits), and a repository reference
+ * `<owner>/<repo>[/<path>]@<commit>` whose commit is exactly forty hexadecimal
+ * digits. Every other value - a tag, a branch, no `@`, a short commit id, a
+ * `docker://` image by tag - is unpinned and is a finding `unpinned-action`.
+ *
+ * The option `allowedOwners` (strings): a repository reference whose owner, the
+ * text before its first `/`, is one of them, compared exactly, yields no
+ * finding. `docker://` and local references are judged as above regardless.
+ *
+ * A finding's id is `unpinned-action:<file>`; it is sanctioned by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range
+ * or by the caller's `sanctions`.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-88";
+export const optionKinds = { allowedOwners: "strings" };
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "buffer" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.toString("utf8").trim() || error.message));
+            else
+                resolve(stdout.toString("utf8"));
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const isReadPath = (path) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(path) || /(?:^|\/)action\.ya?ml$/.test(path);
+const isNull = (sha) => /^0+$/.test(sha);
+/** A blob read whole through git; an absent blob is an empty file. */
+const readBlob = async (cwd, sha) => isNull(sha) ? "" : runGit(cwd, ["cat-file", "blob", sha]);
+/** How many times each line's text occurs, lines being split at line feeds, one CR dropped, white space trimmed. */
+function countLines(content) {
+    const counts = new Map();
+    for (const raw of content.split("\n")) {
+        const text = (raw.endsWith("\r") ? raw.slice(0, -1) : raw).trim();
+        if (text.length > 0)
+            counts.set(text, (counts.get(text) ?? 0) + 1);
+    }
+    return counts;
+}
+/** The value of a `uses:` line's text, or null when the text is not such a line. */
+function usesValue(text) {
+    const match = /^(?:-\s+)?uses:(.*)$/.exec(text);
+    if (match === null)
+        return null;
+    let value = (match[1] ?? "").replace(/(?:^|\s)#.*$/, "").trim();
+    const quote = value.charAt(0);
+    if (value.length >= 2 && (quote === '"' || quote === "'") && value.endsWith(quote))
+        value = value.slice(1, -1);
+    return value;
+}
+/** Whether a value is unpinned and, if it is a repository reference, not by an allowed owner. */
+function isFinding(value, allowed) {
+    if (value.length === 0 || value.startsWith("./"))
+        return false;
+    if (value.startsWith("docker://"))
+        return !/@sha256:[0-9a-fA-F]{64}$/.test(value);
+    const at = value.lastIndexOf("@");
+    const pinned = at > 0 && /^[0-9a-fA-F]{40}$/.test(value.slice(at + 1)) && value.slice(0, at).includes("/");
+    if (pinned)
+        return false;
+    const slash = value.indexOf("/");
+    return !(slash > 0 && allowed.includes(value.slice(0, slash)));
+}
+async function compare(cwd, from, to, allowed) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "-M", "--no-abbrev", "--no-ext-diff", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const drafts = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [, , oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const moved = status.startsWith("R") || status.startsWith("C");
+        const oldPath = fields[++i] ?? "";
+        const newPath = moved ? (fields[++i] ?? "") : oldPath;
+        const letter = status.charAt(0);
+        if (!["A", "M", "R", "C", "T"].includes(letter) || !isReadPath(newPath))
+            continue;
+        const fromRead = letter === "M" || letter === "T" || letter === "R";
+        const before = countLines(fromRead ? await readBlob(cwd, oldSha) : "");
+        const after = countLines(await readBlob(cwd, newSha));
+        for (const [text, count] of after) {
+            if (count <= (before.get(text) ?? 0))
+                continue;
+            const value = usesValue(text);
+            if (value !== null && isFinding(value, allowed))
+                drafts.push({ file: newPath, value });
+        }
+    }
+    return drafts;
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+/**
+ * Report each unpinned `uses:` reference `base..candidate` adds. Fails while any
+ * finding is unsanctioned, and fails closed: a revision that names no commit,
+ * or any git invocation that fails, is a `fail` record naming the cause.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const allowed = Array.isArray(options.allowedOwners) ? options.allowedOwners.filter((o) => typeof o === "string") : [];
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const drafts = await compare(cwd, ancestor, candidateCommit, allowed);
+        if (drafts.length === 0)
+            return { name, status: "pass", evidence: ["no unpinned action reference added"] };
+        const lines = await readSanctionLines(cwd, baseCommit, candidateCommit);
+        let open = false;
+        const evidence = drafts.map((draft) => {
+            const reason = sanctionFor(`unpinned-action:${draft.file}`, lines, options.sanctions ?? {});
+            if (reason === null)
+                open = true;
+            const tail = reason === null ? "" : ` - sanctioned: ${escapeText(reason)}`;
+            return `${escapeText(draft.file)}: unpinned-action ${escapeText(draft.value)}${tail}`;
+        });
+        return { name, status: open ? "fail" : "pass", evidence };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))] };
+    }
+}
+//# sourceMappingURL=action-pins.js.map

package/dist/checks/action-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-pins.js","sourceRoot":"","sources":["../../src/checks/action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAE5B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAWxD,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1F,MAAM,MAAM,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,GAAW,EAAmB,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AAE5D,oHAAoH;AACpH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,KAAa,EAAE,OAA0B;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3G,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAOD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU,EAAE,OAA0B;IACtF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,EAAE,AAAD,EAAG,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAClF,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA0B;IACpD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,oCAAoC,CAAC,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC5F,IAAI,MAAM,KAAK,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/checks/autosquash.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Autosquash leftovers.
+ *
+ * `git commit --fixup`, `--squash` and `--fixup=amend:` write a commit whose
+ * subject begins with `fixup! `, `squash! ` or `amend! `, a note that
+ * `git rebase --autosquash` is to fold it into an earlier commit. This check
+ * reads the subject of every commit of `base..candidate` as `git log --format=%s`
+ * prints it (the first paragraph, its lines joined by spaces) and reports each
+ * commit whose subject begins with one of `AUTOSQUASH_PREFIXES`.
+ *
+ * The list is read each time the check runs: a consumer appends its own entry.
+ * There is no sanction; the fix is to squash the commits before the range lands.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-29";
+/** The prefixes git's autosquash reads, compared character for character. */
+export declare const AUTOSQUASH_PREFIXES: string[];
+export interface AutosquashOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+}
+export declare function check(options: AutosquashOptions): Promise<CheckRecord>;

package/dist/checks/autosquash.js

@@ -0,0 +1,85 @@
+/**
+ * Autosquash leftovers.
+ *
+ * `git commit --fixup`, `--squash` and `--fixup=amend:` write a commit whose
+ * subject begins with `fixup! `, `squash! ` or `amend! `, a note that
+ * `git rebase --autosquash` is to fold it into an earlier commit. This check
+ * reads the subject of every commit of `base..candidate` as `git log --format=%s`
+ * prints it (the first paragraph, its lines joined by spaces) and reports each
+ * commit whose subject begins with one of `AUTOSQUASH_PREFIXES`.
+ *
+ * The list is read each time the check runs: a consumer appends its own entry.
+ * There is no sanction; the fix is to squash the commits before the range lands.
+ */
+import { execFile } from "node:child_process";
+export const name = "RT-29";
+/** The prefixes git's autosquash reads, compared character for character. */
+export const AUTOSQUASH_PREFIXES = ["fixup! ", "squash! ", "amend! "];
+const ID_LENGTH = 12;
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "utf8" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.trim() || error.message));
+            else
+                resolve(stdout);
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+/** The commit a revision names; throws a message that names the revision when it names none. */
+async function resolveCommit(cwd, revision) {
+    try {
+        const out = await runGit(cwd, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${revision}^{commit}`]);
+        const id = out.trim();
+        if (id !== "")
+            return id;
+    }
+    catch {
+        // a revision that does not resolve is reported by name below
+    }
+    throw new Error(`revision ${revision} names no commit`);
+}
+export async function check(options) {
+    try {
+        const base = await resolveCommit(options.cwd, options.base);
+        const candidate = await resolveCommit(options.cwd, options.candidate);
+        const log = await runGit(options.cwd, [
+            "log",
+            "-z",
+            "--topo-order",
+            "--reverse",
+            "--encoding=UTF-8",
+            "--format=%H %s",
+            `${base}..${candidate}`,
+            "--",
+        ]);
+        const prefixes = AUTOSQUASH_PREFIXES.filter((prefix) => prefix !== "");
+        const findings = [];
+        for (const entry of log.split("\0")) {
+            if (entry === "")
+                continue;
+            const space = entry.indexOf(" ");
+            const id = entry.slice(0, space);
+            const subject = entry.slice(space + 1);
+            if (prefixes.some((prefix) => subject.startsWith(prefix))) {
+                findings.push(`${id.slice(0, ID_LENGTH)} ${escapeText(subject)}`);
+            }
+        }
+        if (findings.length > 0)
+            return { name, status: "fail", evidence: findings };
+        return { name, status: "pass", evidence: ["no autosquash subject in the range"] };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [`git failed: ${escapeText(error instanceof Error ? error.message : String(error))}`] };
+    }
+}
+//# sourceMappingURL=autosquash.js.map

package/dist/checks/autosquash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autosquash.js","sourceRoot":"","sources":["../../src/checks/autosquash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI9C,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAE5B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAa,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAQhF,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACxD,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC;QAChH,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,kBAAkB,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA0B;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;YACpC,KAAK;YACL,IAAI;YACJ,cAAc;YACd,WAAW;YACX,kBAAkB;YAClB,gBAAgB;YAChB,GAAG,IAAI,KAAK,SAAS,EAAE;YACvB,IAAI;SACL,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,oCAAoC,CAAC,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,eAAe,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnI,CAAC;AACH,CAAC"}

package/dist/checks/bidi-controls.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Bidirectional controls.
+ *
+ * Nine Unicode characters - U+202A, U+202B, U+202C, U+202D, U+202E (the
+ * embeddings and overrides) and U+2066, U+2067, U+2068, U+2069 (the isolates) -
+ * reorder the text around them when it is shown and do nothing when a compiler
+ * reads it, so a line holding them reads one way to a reviewer and runs another
+ * (CVE-2021-42574, "Trojan Source"). This check reads every path
+ * `base..candidate` adds, changes or renames onto whose entry at the candidate
+ * is a regular file (mode 100644 or 100755), whole through git at the merge
+ * base of `base` and `candidate` and at the candidate, renames detected, never
+ * from the working tree. A symbolic link or a gitlink is never read, and a file
+ * holding a NUL byte is not text: such a candidate yields nothing and such a
+ * source counts as none.
+ *
+ * Text is read as UTF-8 and split at line feeds, one carriage return at a
+ * line's end dropped. A line is added when the candidate's file holds its text,
+ * white space at both ends removed, more often than the source file held it -
+ * the file at the merge base, the one a rename came from, or none for a file
+ * the range adds. A moved or re-indented line is not added, and a text added
+ * more than once counts once.
+ *
+ * A file whose added lines hold at least one of the nine is one finding
+ * `bidi-control`, its evidence line `<file>: bidi-control <characters>`: each
+ * distinct character, `U+` and four upper-case hexadecimal digits, ascending,
+ * joined by a comma. The finding's id is `bidi-control:<file>`, sanctioned by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range
+ * or by the caller's `sanctions`; the reason ends the evidence line.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-93";
+export interface BidiControlsOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (or `bidi-control:<file>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+}
+/** One file whose added lines hold the nine. */
+export interface BidiControlFinding {
+    readonly id: string;
+    readonly category: "bidi-control";
+    readonly file: string;
+    /** Each distinct character, as `U+XXXX`, ascending. */
+    readonly characters: readonly string[];
+    /** The sanction's reason, or `null` while unsanctioned. */
+    readonly sanction: string | null;
+}
+export interface BidiControlsRecord extends CheckRecord {
+    readonly findings: readonly BidiControlFinding[];
+}
+/**
+ * Report each file `base..candidate` adds a line holding one of the nine to.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: BidiControlsOptions): Promise<BidiControlsRecord>;

package/dist/checks/bidi-controls.js

@@ -0,0 +1,172 @@
+/**
+ * Bidirectional controls.
+ *
+ * Nine Unicode characters - U+202A, U+202B, U+202C, U+202D, U+202E (the
+ * embeddings and overrides) and U+2066, U+2067, U+2068, U+2069 (the isolates) -
+ * reorder the text around them when it is shown and do nothing when a compiler
+ * reads it, so a line holding them reads one way to a reviewer and runs another
+ * (CVE-2021-42574, "Trojan Source"). This check reads every path
+ * `base..candidate` adds, changes or renames onto whose entry at the candidate
+ * is a regular file (mode 100644 or 100755), whole through git at the merge
+ * base of `base` and `candidate` and at the candidate, renames detected, never
+ * from the working tree. A symbolic link or a gitlink is never read, and a file
+ * holding a NUL byte is not text: such a candidate yields nothing and such a
+ * source counts as none.
+ *
+ * Text is read as UTF-8 and split at line feeds, one carriage return at a
+ * line's end dropped. A line is added when the candidate's file holds its text,
+ * white space at both ends removed, more often than the source file held it -
+ * the file at the merge base, the one a rename came from, or none for a file
+ * the range adds. A moved or re-indented line is not added, and a text added
+ * more than once counts once.
+ *
+ * A file whose added lines hold at least one of the nine is one finding
+ * `bidi-control`, its evidence line `<file>: bidi-control <characters>`: each
+ * distinct character, `U+` and four upper-case hexadecimal digits, ascending,
+ * joined by a comma. The finding's id is `bidi-control:<file>`, sanctioned by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range
+ * or by the caller's `sanctions`; the reason ends the evidence line.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-93";
+const CONTROLS = /[\u202a-\u202e\u2066-\u2069]/g;
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "buffer" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.toString("utf8").trim() || error.message));
+            else
+                resolve(stdout);
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).toString("utf8").trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const REGULAR = new Set(["100644", "100755"]);
+/** A blob's lines, trimmed, counted; `null` for no entry, or a file holding a NUL byte. */
+async function readTexts(cwd, mode, sha) {
+    if (!REGULAR.has(mode))
+        return null;
+    const bytes = await runGit(cwd, ["cat-file", "blob", sha]);
+    if (bytes.includes(0))
+        return null;
+    const counts = new Map();
+    for (const raw of bytes.toString("utf8").split("\n")) {
+        const text = raw.replace(/\r$/, "").trim();
+        counts.set(text, (counts.get(text) ?? 0) + 1);
+    }
+    return counts;
+}
+async function readDrafts(cwd, from, to) {
+    const out = (await runGit(cwd, ["diff", "--raw", "-z", "--no-abbrev", "--find-renames", "--no-relative", from, to, "--"])).toString("utf8");
+    const fields = out.split("\0");
+    const drafts = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [oldMode = "", newMode = "", oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const first = fields[++i] ?? "";
+        const renamed = status.startsWith("R") || status.startsWith("C");
+        const file = renamed ? (fields[++i] ?? "") : first;
+        if (status.startsWith("D"))
+            continue;
+        const now = await readTexts(cwd, newMode, newSha);
+        if (now === null)
+            continue;
+        const before = status.startsWith("A") ? null : await readTexts(cwd, oldMode, oldSha);
+        const found = new Set();
+        for (const [text, count] of now) {
+            if (count <= (before?.get(text) ?? 0))
+                continue;
+            for (const char of text.match(CONTROLS) ?? [])
+                found.add(`U+${(char.codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(4, "0")}`);
+        }
+        if (found.size > 0)
+            drafts.push({ file, characters: [...found].sort() });
+    }
+    return drafts.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = (await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"])).toString("utf8");
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+function describeFinding(finding) {
+    const tail = finding.sanction === null ? "" : ` - sanctioned: ${escapeText(finding.sanction)}`;
+    return `${escapeText(finding.file)}: bidi-control ${finding.characters.join(",")}${tail}`;
+}
+/**
+ * Report each file `base..candidate` adds a line holding one of the nine to.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).toString("utf8").trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const drafts = await readDrafts(cwd, ancestor, candidateCommit);
+        const lines = drafts.length === 0 ? [] : await readSanctionLines(cwd, baseCommit, candidateCommit);
+        const findings = drafts.map((draft) => {
+            const id = `bidi-control:${draft.file}`;
+            return { id, category: "bidi-control", ...draft, sanction: sanctionFor(id, lines, options.sanctions ?? {}) };
+        });
+        if (findings.length === 0)
+            return { name, status: "pass", evidence: ["no bidirectional control character added"], findings };
+        const open = findings.some((finding) => finding.sanction === null);
+        return { name, status: open ? "fail" : "pass", evidence: findings.map(describeFinding), findings };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))], findings: [] };
+    }
+}
+//# sourceMappingURL=bidi-controls.js.map

package/dist/checks/bidi-controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bidi-controls.js","sourceRoot":"","sources":["../../src/checks/bidi-controls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAE5B,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAyBjD,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACzE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9C,2FAA2F;AAC3F,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC7D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5I,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;YAChC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/F,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA4B;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1D,MAAM,EAAE,GAAG,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,0CAA0C,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC7H,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;AACH,CAAC"}

package/dist/checks/binary-files.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Binary files.
+ *
+ * A review reads a range line by line and a binary file has no lines: what the
+ * range adds of it enters the history whole and unreviewed. This check reads
+ * the files the range adds, changes or renames, through git at the candidate,
+ * and reports each whose new content is binary by git's own test - a NUL byte
+ * among its first `BINARY_PROBE_BYTES` bytes - and was not already that same
+ * content at the merge base. The file's name and `.gitattributes` decide
+ * nothing, and neither does the working tree.
+ *
+ * A finding is `binary-changed` when the file's source blob at the merge base
+ * is binary too, and `binary-added` otherwise. It is sanctioned by a
+ * `Sanctioned-Weakening: <category>:<path> <reason>` line in a commit message
+ * of the range or by the caller's `sanctions`. A path ending with one of the
+ * caller's `allowedSuffixes` yields no finding.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-55";
+/** The number of leading bytes git looks at for a NUL byte. */
+export declare const BINARY_PROBE_BYTES = 8000;
+/** The option a configuration file may set for this check. */
+export declare const optionKinds: {
+    allowedSuffixes: string;
+};
+export type BinaryCategory = "binary-added" | "binary-changed";
+export interface BinaryFilesOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (`<category>:<path>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+    /** Paths ending with one of these strings yield no finding. */
+    readonly allowedSuffixes?: readonly string[] | undefined;
+}
+export interface BinaryFinding {
+    readonly id: string;
+    readonly category: BinaryCategory;
+    readonly path: string;
+    readonly size: number;
+    /** The sanction's reason, or `null` while unsanctioned. */
+    readonly sanction: string | null;
+}
+export interface BinaryFilesRecord extends CheckRecord {
+    readonly findings: readonly BinaryFinding[];
+}
+/**
+ * Report each file `base..candidate` adds or changes into binary content.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: BinaryFilesOptions): Promise<BinaryFilesRecord>;