@trofimyukdev/repo-truth 0.0.0-stage → 0.1.0

package/dist/checks/binary-files.js

@@ -0,0 +1,157 @@
+/**
+ * Binary files.
+ *
+ * A review reads a range line by line and a binary file has no lines: what the
+ * range adds of it enters the history whole and unreviewed. This check reads
+ * the files the range adds, changes or renames, through git at the candidate,
+ * and reports each whose new content is binary by git's own test - a NUL byte
+ * among its first `BINARY_PROBE_BYTES` bytes - and was not already that same
+ * content at the merge base. The file's name and `.gitattributes` decide
+ * nothing, and neither does the working tree.
+ *
+ * A finding is `binary-changed` when the file's source blob at the merge base
+ * is binary too, and `binary-added` otherwise. It is sanctioned by a
+ * `Sanctioned-Weakening: <category>:<path> <reason>` line in a commit message
+ * of the range or by the caller's `sanctions`. A path ending with one of the
+ * caller's `allowedSuffixes` yields no finding.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-55";
+/** The number of leading bytes git looks at for a NUL byte. */
+export const BINARY_PROBE_BYTES = 8000;
+/** The option a configuration file may set for this check. */
+export const optionKinds = { allowedSuffixes: "strings" };
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "buffer" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.toString("utf8").trim() || error.message));
+            else
+                resolve(stdout);
+        });
+    });
+}
+const runText = async (cwd, args) => (await runGit(cwd, args)).toString("utf8");
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runText(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const isNull = (sha) => /^0+$/.test(sha);
+/** A blob's content read through git, or `null` when there is no such blob. */
+async function readBlob(cwd, sha) {
+    return isNull(sha) ? null : runGit(cwd, ["cat-file", "blob", sha]);
+}
+const isBinary = (content) => content.subarray(0, BINARY_PROBE_BYTES).includes(0);
+async function compare(cwd, from, to, allowed) {
+    const out = await runText(cwd, ["diff", "--raw", "-z", "-M", "--no-abbrev", "--no-ext-diff", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const drafts = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [, newMode = "", oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        i++;
+        const moved = status.startsWith("R") || status.startsWith("C");
+        const path = moved ? (fields[++i] ?? "") : (fields[i] ?? "");
+        const letter = status.charAt(0);
+        if (!["A", "M", "R", "C", "T"].includes(letter))
+            continue;
+        if (newMode !== "100644" && newMode !== "100755")
+            continue;
+        // A copy git does not list as a rename is an added file.
+        const sourceSha = letter === "A" || letter === "C" ? "" : oldSha;
+        if (sourceSha !== "" && sourceSha === newSha)
+            continue;
+        if (allowed.some((suffix) => suffix.length > 0 && path.endsWith(suffix)))
+            continue;
+        const content = await readBlob(cwd, newSha);
+        if (content === null || !isBinary(content))
+            continue;
+        const source = sourceSha === "" ? null : await readBlob(cwd, sourceSha);
+        drafts.push({ category: source !== null && isBinary(source) ? "binary-changed" : "binary-added", path, size: content.length });
+    }
+    const order = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+    return drafts.sort((a, b) => order(a.path, b.path) || order(a.category, b.category));
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runText(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+function describeFinding(finding) {
+    const tail = finding.sanction === null ? "" : ` - sanctioned: ${escapeText(finding.sanction)}`;
+    return `${escapeText(finding.path)}: ${finding.category}, ${finding.size} bytes${tail}`;
+}
+/**
+ * Report each file `base..candidate` adds or changes into binary content.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runText(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const drafts = await compare(cwd, ancestor, candidateCommit, options.allowedSuffixes ?? []);
+        const lines = drafts.length === 0 ? [] : await readSanctionLines(cwd, baseCommit, candidateCommit);
+        const findings = drafts.map((draft) => {
+            const id = `${draft.category}:${draft.path}`;
+            return { id, ...draft, sanction: sanctionFor(id, lines, options.sanctions ?? {}) };
+        });
+        if (findings.length === 0)
+            return { name, status: "pass", evidence: ["no binary file added or changed"], findings };
+        const open = findings.some((finding) => finding.sanction === null);
+        return { name, status: open ? "fail" : "pass", evidence: findings.map(describeFinding), findings };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))], findings: [] };
+    }
+}
+//# sourceMappingURL=binary-files.js.map

package/dist/checks/binary-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-files.js","sourceRoot":"","sources":["../../src/checks/binary-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AA2B1D,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACzE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAE,IAAuB,EAAmB,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAE5H,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1D,+EAA+E;AAC/E,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAW;IAC9C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAQnG,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU,EAAE,OAA0B;IACtF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/H,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC,EAAE,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1D,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ;YAAE,SAAS;QAC3D,yDAAyD;QACzD,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM;YAAE,SAAS;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QACnF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrD,MAAM,MAAM,GAAG,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/F,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,SAAS,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA2B;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAoB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACrD,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,iCAAiC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACpH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;AACH,CAAC"}

package/dist/checks/config-changes.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Configuration file changed.
+ *
+ * The command reads its settings from one file, so a range that loosens that
+ * file is judged by what it found, and every later range by the loosened
+ * settings. This check fails a range that adds, changes, deletes or renames the
+ * file the run's settings were read from.
+ *
+ * The file it watches: with no `config` option (no `--config`), repo-truth.json
+ * at the top directory of the repository, by that path, from any directory of
+ * the repository; with `config`, that path, read against `cwd` when relative, when
+ * its directory (symbolic links resolved) is the top directory or below it. A
+ * file outside the repository is one no range can change: a `skip` naming it.
+ * A revision that names no commit, a git that fails or a `config` path whose
+ * directory cannot be read is a `fail`.
+ *
+ * The range is read through git, from the merge base of `base` and `candidate`
+ * to `candidate`, renames detected; the working tree is never read. An entry
+ * that names the watched path, on either side of a rename, is a finding of
+ * category `config-added`, `config-changed`, `config-deleted` or
+ * `config-renamed`, in one evidence line `<file>: <category>`.
+ *
+ * A finding is sanctioned by a `Sanctioned-Weakening: <id> <reason>` line in a
+ * commit message of the range or by the caller's `sanctions`. Its id is
+ * `<category>:<file>`. The check declares no options.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-66";
+export type ConfigCategory = "config-added" | "config-changed" | "config-deleted" | "config-renamed";
+export interface ConfigChangesOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** The path `--config` named; absent when the settings were read from repo-truth.json. */
+    readonly config?: string | undefined;
+    /** Ids mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+}
+export interface ConfigFinding {
+    readonly id: string;
+    readonly category: ConfigCategory;
+    readonly file: string;
+    /** The other path of a rename; `null` otherwise. */
+    readonly other: string | null;
+    /** The sanction's reason, or `null` while unsanctioned. */
+    readonly sanction: string | null;
+}
+export interface ConfigChangesRecord extends CheckRecord {
+    readonly findings: readonly ConfigFinding[];
+}
+/**
+ * Report a change `base..candidate` makes to the configuration file the run
+ * read. Fails while a finding is unsanctioned, and fails closed: a revision
+ * that names no commit, or any git invocation that fails, is a `fail` record
+ * naming the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: ConfigChangesOptions): Promise<ConfigChangesRecord>;

package/dist/checks/config-changes.js

@@ -0,0 +1,175 @@
+/**
+ * Configuration file changed.
+ *
+ * The command reads its settings from one file, so a range that loosens that
+ * file is judged by what it found, and every later range by the loosened
+ * settings. This check fails a range that adds, changes, deletes or renames the
+ * file the run's settings were read from.
+ *
+ * The file it watches: with no `config` option (no `--config`), repo-truth.json
+ * at the top directory of the repository, by that path, from any directory of
+ * the repository; with `config`, that path, read against `cwd` when relative, when
+ * its directory (symbolic links resolved) is the top directory or below it. A
+ * file outside the repository is one no range can change: a `skip` naming it.
+ * A revision that names no commit, a git that fails or a `config` path whose
+ * directory cannot be read is a `fail`.
+ *
+ * The range is read through git, from the merge base of `base` and `candidate`
+ * to `candidate`, renames detected; the working tree is never read. An entry
+ * that names the watched path, on either side of a rename, is a finding of
+ * category `config-added`, `config-changed`, `config-deleted` or
+ * `config-renamed`, in one evidence line `<file>: <category>`.
+ *
+ * A finding is sanctioned by a `Sanctioned-Weakening: <id> <reason>` line in a
+ * commit message of the range or by the caller's `sanctions`. Its id is
+ * `<category>:<file>`. The check declares no options.
+ */
+import { execFile } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-66";
+function runGit(cwd, args) {
+    return new Promise((resolvePromise, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "utf8" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.trim() || error.message));
+            else
+                resolvePromise(stdout);
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+/** The watched path from the top directory, or `null` when the file is outside the repository. */
+async function watchedPath(cwd, config) {
+    if (config === undefined)
+        return "repo-truth.json";
+    const top = await realpath((await runGit(cwd, ["rev-parse", "--show-toplevel"])).replace(/\n$/, ""));
+    const absolute = isAbsolute(config) ? config : resolve(cwd, config);
+    let directory;
+    try {
+        directory = await realpath(dirname(absolute));
+    }
+    catch (error) {
+        throw new Error(`${escapeText(config)}: cannot read the directory of the configuration file (${error.message})`);
+    }
+    const path = relative(top, join(directory, basename(absolute)));
+    if (path === "" || path === ".." || path.startsWith("../") || isAbsolute(path))
+        return null;
+    return path.split("\\").join("/");
+}
+async function compare(cwd, from, to, file) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "--no-abbrev", "--find-renames", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const drafts = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const status = head.slice(1).split(" ")[4] ?? "";
+        const first = fields[++i] ?? "";
+        const pair = status.startsWith("R") || status.startsWith("C");
+        const second = pair ? (fields[++i] ?? "") : first;
+        if (first !== file && second !== file)
+            continue;
+        if (status.startsWith("R"))
+            drafts.push({ category: "config-renamed", other: first === file ? second : first });
+        else if (status.startsWith("A") || status.startsWith("C"))
+            drafts.push({ category: "config-added", other: null });
+        else if (status.startsWith("D"))
+            drafts.push({ category: "config-deleted", other: null });
+        else
+            drafts.push({ category: "config-changed", other: null });
+    }
+    return drafts;
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+function describeFinding(finding) {
+    const other = finding.other === null ? "" : ` (other path: ${escapeText(finding.other)})`;
+    const tail = finding.sanction === null ? "" : ` - sanctioned: ${escapeText(finding.sanction)}`;
+    return `${escapeText(finding.file)}: ${finding.category}${other}${tail}`;
+}
+/**
+ * Report a change `base..candidate` makes to the configuration file the run
+ * read. Fails while a finding is unsanctioned, and fails closed: a revision
+ * that names no commit, or any git invocation that fails, is a `fail` record
+ * naming the cause - never a `pass`, never a throw.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate, config } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const file = await watchedPath(cwd, config);
+        if (file === null) {
+            const named = escapeText(String(config));
+            return { name, status: "skip", evidence: [`${named}: outside the repository, no range can change it`], findings: [] };
+        }
+        const drafts = await compare(cwd, ancestor, candidateCommit, file);
+        if (drafts.length === 0) {
+            return { name, status: "pass", evidence: [`${escapeText(file)}: not added, changed, deleted or renamed`], findings: [] };
+        }
+        const lines = await readSanctionLines(cwd, ancestor, candidateCommit);
+        const findings = drafts.map((draft) => {
+            const id = `${draft.category}:${file}`;
+            return { id, category: draft.category, file, other: draft.other, sanction: sanctionFor(id, lines, options.sanctions ?? {}) };
+        });
+        const open = findings.some((finding) => finding.sanction === null);
+        return { name, status: open ? "fail" : "pass", evidence: findings.map(describeFinding), findings };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))], findings: [] };
+    }
+}
+//# sourceMappingURL=config-changes.js.map

package/dist/checks/config-changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-changes.js","sourceRoot":"","sources":["../../src/checks/config-changes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGnF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AA4B5B,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACxD,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,MAA0B;IAChE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,0DAA2D,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAOD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU,EAAE,IAAY;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAChD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;aAC3G,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;aAC7G,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;YACrF,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;IAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/F,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA6B;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,kDAAkD,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,0CAA0C,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC3H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAoB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACrD,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/H,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;AACH,CAAC"}

package/dist/checks/credentials.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Credentials.
+ *
+ * A credential committed once is published to every clone for good. This check
+ * reads the lines `base..candidate` adds, in every file git can read as text,
+ * and reports each line that holds a credential in a form only a real one has:
+ * the file, the line and the kind - never the text it matched, because a report
+ * that prints a credential has published it a second time. A credential the
+ * base already holds, a line the range removes and a binary file say nothing.
+ * There is no sanction: remove the credential and revoke it.
+ *
+ * The forms live in the exported `CREDENTIAL_SHAPES`, read each time the check
+ * runs: a consumer appends its own entry. They are regular expressions only.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-26";
+/** One form of credential. */
+export interface CredentialShape {
+    /** The kind a finding names. */
+    readonly name: string;
+    /** Tested against each line the range adds. */
+    readonly pattern: RegExp;
+}
+export interface CredentialsOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+}
+export declare const CREDENTIAL_SHAPES: CredentialShape[];
+/**
+ * Report each credential-shaped line `base..candidate` adds. Fails closed: a
+ * revision that names no commit, or any git invocation that fails, is a `fail`
+ * record naming the cause - never a `pass`, and never a thrown error.
+ */
+export declare function check(options: CredentialsOptions): Promise<CheckRecord>;

package/dist/checks/credentials.js

@@ -0,0 +1,138 @@
+/**
+ * Credentials.
+ *
+ * A credential committed once is published to every clone for good. This check
+ * reads the lines `base..candidate` adds, in every file git can read as text,
+ * and reports each line that holds a credential in a form only a real one has:
+ * the file, the line and the kind - never the text it matched, because a report
+ * that prints a credential has published it a second time. A credential the
+ * base already holds, a line the range removes and a binary file say nothing.
+ * There is no sanction: remove the credential and revoke it.
+ *
+ * The forms live in the exported `CREDENTIAL_SHAPES`, read each time the check
+ * runs: a consumer appends its own entry. They are regular expressions only.
+ */
+import { execFile } from "node:child_process";
+export const name = "RT-26";
+export const CREDENTIAL_SHAPES = [
+    { name: "private key", pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----/ },
+    { name: "cloud access key id", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/ },
+    { name: "code host token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,})/ },
+    { name: "chat token", pattern: /xox[abposr]-[A-Za-z0-9-]{10,}/ },
+    {
+        name: "assigned secret",
+        pattern: /(?:api_key|api-key|apikey|secret_key|access_token|auth_token|oauth_token|password)["']?\s*[:=]\s*(?:"[^"'\s]{20,}"|'[^"'\s]{20,}')/i,
+    },
+];
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "utf8" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.trim() || error.message));
+            else
+                resolve(stdout);
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+/** The lines a change adds to a file; a missing old side (`null`) means every line is added. */
+async function addedLines(cwd, oldBlob, newBlob) {
+    const text = await runGit(cwd, ["cat-file", "blob", newBlob]);
+    if (text.includes("\0"))
+        return [];
+    const all = () => text.replace(/\n$/, "").split("\n").map((t, i) => ({ number: i + 1, text: t.replace(/\r$/, "") }));
+    if (oldBlob === null)
+        return all();
+    const out = await runGit(cwd, ["diff", "-U0", "--no-color", "--no-ext-diff", "--no-textconv", oldBlob, newBlob]);
+    const added = [];
+    let newLine = 0;
+    let inHunk = false;
+    for (const raw of out.split("\n")) {
+        const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+        if (hunk !== null) {
+            newLine = Number(hunk[1]);
+            inHunk = true;
+        }
+        else if (inHunk && raw.startsWith("+"))
+            added.push({ number: newLine++, text: raw.slice(1).replace(/\r$/, "") });
+    }
+    return added;
+}
+async function findings(cwd, from, to) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "--no-abbrev", "--find-renames", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const shapes = CREDENTIAL_SHAPES.map((shape) => ({
+        name: shape.name,
+        pattern: new RegExp(shape.pattern.source, shape.pattern.flags.replace(/[gy]/g, "")),
+    }));
+    const lines = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [oldMode = "", newMode = "", oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const first = fields[++i] ?? "";
+        const path = status.startsWith("R") || status.startsWith("C") ? (fields[++i] ?? "") : first;
+        if (status.startsWith("D") || !newMode.startsWith("100"))
+            continue;
+        const oldBlob = status.startsWith("A") || !oldMode.startsWith("100") ? null : oldSha;
+        for (const line of await addedLines(cwd, oldBlob, newSha)) {
+            for (const shape of shapes) {
+                if (shape.pattern.test(line.text))
+                    lines.push(`${escapeText(path)}:${line.number}: ${escapeText(shape.name)}`);
+            }
+        }
+    }
+    return lines;
+}
+/**
+ * Report each credential-shaped line `base..candidate` adds. Fails closed: a
+ * revision that names no commit, or any git invocation that fails, is a `fail`
+ * record naming the cause - never a `pass`, and never a thrown error.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const found = await findings(cwd, ancestor, candidateCommit);
+        if (found.length === 0)
+            return { name, status: "pass", evidence: ["no credential in the lines the range adds"] };
+        return { name, status: "fail", evidence: found };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))] };
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/checks/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/checks/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI9C,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAgB5B,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE;IAC3E,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+BAA+B,EAAE;IACzE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,+DAA+D,EAAE;IACrG,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAChE;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,qIAAqI;KAC/I;CACF,CAAC;AAEF,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACxD,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,gGAAgG;AAChG,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAAsB,EAAE,OAAe;IAC5E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7H,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACjH,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;KACpF,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5F,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,KAAK,MAAM,IAAI,IAAI,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA2B;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,2CAA2C,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/checks/install-scripts.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Install scripts added.
+ *
+ * `npm ci` and `npm install` run a package's `preinstall`, `install` and
+ * `postinstall` scripts on the machine that installs it, and npm's lockfile
+ * says which packages have one: the entry of such a package under `packages`
+ * holds `"hasInstallScript": true`. This check reads every file the range adds,
+ * changes or renames onto whose last path segment is exactly `package-lock.json`
+ * or `npm-shrinkwrap.json`, at any depth, whole through git at the merge base
+ * of `base` and `candidate` and at `candidate` (never the working tree, renames
+ * detected), and parses each with `JSON.parse`. The source is the file at the
+ * merge base, the one a rename came from, or none for a file the range adds.
+ *
+ * A finding is a key of the candidate's `packages` object whose entry holds
+ * `hasInstallScript` equal to `true` while the source's `packages` does not
+ * hold that key with such an entry (whatever its version). A lockfile of
+ * version 1 has no `packages` object and yields nothing. A lockfile, candidate
+ * or source, that `JSON.parse` refuses fails the record and names the file.
+ *
+ * A finding's id is `install-script:<file>`, which sanctions every finding of
+ * that file, by a `Sanctioned-Weakening: <id> <reason>` line in a commit
+ * message of the range or by the caller's `sanctions`.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-94";
+export interface InstallScriptsOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (`install-script:<file>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * Report each package `base..candidate` adds to a lockfile with an install
+ * script. Fails while any finding is unsanctioned or a lockfile cannot be read,
+ * and fails closed: a revision that names no commit, or any git invocation that
+ * fails, is a `fail` record naming the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: InstallScriptsOptions): Promise<CheckRecord>;