@trofimyukdev/repo-truth 0.0.0-stage → 0.1.0

package/dist/checks/install-scripts.js

@@ -0,0 +1,173 @@
+/**
+ * Install scripts added.
+ *
+ * `npm ci` and `npm install` run a package's `preinstall`, `install` and
+ * `postinstall` scripts on the machine that installs it, and npm's lockfile
+ * says which packages have one: the entry of such a package under `packages`
+ * holds `"hasInstallScript": true`. This check reads every file the range adds,
+ * changes or renames onto whose last path segment is exactly `package-lock.json`
+ * or `npm-shrinkwrap.json`, at any depth, whole through git at the merge base
+ * of `base` and `candidate` and at `candidate` (never the working tree, renames
+ * detected), and parses each with `JSON.parse`. The source is the file at the
+ * merge base, the one a rename came from, or none for a file the range adds.
+ *
+ * A finding is a key of the candidate's `packages` object whose entry holds
+ * `hasInstallScript` equal to `true` while the source's `packages` does not
+ * hold that key with such an entry (whatever its version). A lockfile of
+ * version 1 has no `packages` object and yields nothing. A lockfile, candidate
+ * or source, that `JSON.parse` refuses fails the record and names the file.
+ *
+ * A finding's id is `install-script:<file>`, which sanctions every finding of
+ * that file, by a `Sanctioned-Weakening: <id> <reason>` line in a commit
+ * message of the range or by the caller's `sanctions`.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-94";
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "utf8" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.trim() || error.message));
+            else
+                resolve(stdout);
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const isLockfile = (path) => /(^|\/)(package-lock|npm-shrinkwrap)\.json$/.test(path);
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+async function readPackages(cwd, mode, sha) {
+    if (!mode.startsWith("100"))
+        return { problem: "is not a regular file" };
+    let parsed;
+    try {
+        parsed = JSON.parse(await runGit(cwd, ["cat-file", "blob", sha]));
+    }
+    catch (error) {
+        return { problem: `is not JSON: ${error.message}` };
+    }
+    const packages = isObject(parsed) && Object.hasOwn(parsed, "packages") ? parsed["packages"] : null;
+    return { packages: isObject(packages) ? packages : null };
+}
+/** Whether an entry of `packages` is an object holding `hasInstallScript: true`. */
+const flagged = (entry) => isObject(entry) && entry["hasInstallScript"] === true;
+async function compare(cwd, from, to) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "--no-abbrev", "--find-renames", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const drafts = [];
+    const problems = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [oldMode = "", newMode = "", oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const first = fields[++i] ?? "";
+        const renamed = status.startsWith("R") || status.startsWith("C");
+        const second = renamed ? (fields[++i] ?? "") : first;
+        if (status.startsWith("D"))
+            continue;
+        const oldPath = status.startsWith("A") ? null : first;
+        const file = second;
+        if (!isLockfile(file))
+            continue;
+        const after = await readPackages(cwd, newMode, newSha);
+        const before = oldPath === null ? { packages: null } : await readPackages(cwd, oldMode, oldSha);
+        if ("problem" in after)
+            problems.push(`${escapeText(file)}: at the candidate the lockfile ${escapeText(after.problem)}`);
+        if ("problem" in before)
+            problems.push(`${escapeText(oldPath ?? file)}: at the merge base the lockfile ${escapeText(before.problem)}`);
+        if ("problem" in after || "problem" in before || after.packages === null)
+            continue;
+        for (const [key, entry] of Object.entries(after.packages)) {
+            if (!flagged(entry))
+                continue;
+            if (before.packages !== null && Object.hasOwn(before.packages, key) && flagged(before.packages[key]))
+                continue;
+            const version = entry["version"];
+            drafts.push({ file, text: `${escapeText(file)}: install-script ${escapeText(key)}${typeof version === "string" ? `@${escapeText(version)}` : ""}` });
+        }
+    }
+    return { drafts, problems };
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+/**
+ * Report each package `base..candidate` adds to a lockfile with an install
+ * script. Fails while any finding is unsanctioned or a lockfile cannot be read,
+ * and fails closed: a revision that names no commit, or any git invocation that
+ * fails, is a `fail` record naming the cause - never a `pass`, never a throw.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const { drafts, problems } = await compare(cwd, ancestor, candidateCommit);
+        if (drafts.length === 0 && problems.length === 0)
+            return { name, status: "pass", evidence: ["no install script added"] };
+        const lines = drafts.length === 0 ? [] : await readSanctionLines(cwd, ancestor, candidateCommit);
+        let open = problems.length > 0;
+        const evidence = drafts.map((draft) => {
+            const reason = sanctionFor(`install-script:${draft.file}`, lines, options.sanctions ?? {});
+            if (reason === null)
+                open = true;
+            return reason === null ? draft.text : `${draft.text} - sanctioned: ${escapeText(reason)}`;
+        });
+        return { name, status: open ? "fail" : "pass", evidence: [...problems, ...evidence] };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))] };
+    }
+}
+//# sourceMappingURL=install-scripts.js.map

package/dist/checks/install-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-scripts.js","sourceRoot":"","sources":["../../src/checks/install-scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAU5B,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACxD,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEtG,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAK5I,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACzE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,gBAAiB,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAAC;AAO5H,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,MAAM,GAAa,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1G,IAAI,SAAS,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,mCAAmC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzH,IAAI,SAAS,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,oCAAoC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvI,IAAI,SAAS,IAAI,KAAK,IAAI,SAAS,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QACnF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC/G,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,oBAAoB,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA8B;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACzH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QACjG,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC3F,IAAI,MAAM,KAAK,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;YACjC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,kBAAkB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/checks/lint-rules.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Lint rules turned off.
+ *
+ * A lint run goes green as surely when a rule is turned off in the lint
+ * configuration as when the code is fixed. This check reads every path the range
+ * adds, changes or renames onto whose last path segment is exactly one of
+ * `LINT_FILES` (`.eslintrc*`, `eslint.config.*`, `biome.json`, `biome.jsonc`,
+ * `.oxlintrc.json`), at any depth, whole and through git at the merge base of
+ * `base` and `candidate` and at `candidate`, renames detected. The working tree
+ * is never read, and no file is parsed or run.
+ *
+ * An off pair is, in a file's text, a rule name, white space or none, a colon,
+ * white space or none, then an off value (`"off"`, `'off'`, `off` or `0`, or
+ * `[` and white space before one of them), the value not followed by a letter, a
+ * digit, `_` or `.`. A name is written in double quotes, in single quotes or
+ * bare. A pair is counted wherever it stands, a comment included. For each file,
+ * each name's pairs are counted at the candidate and in the source file (the
+ * file at the merge base, the one a rename came from, or none for a file the
+ * range adds); a name counted more often at the candidate is one finding
+ * `rule-off`, whatever the count. A rule moved or a line re-indented says
+ * nothing; a rule changed from `error` or `warn` to `off` is a finding.
+ *
+ * Each finding is the evidence line `<file>: rule-off <name>`. A finding's id is
+ * `rule-off:<file>`, which sanctions every finding of that file by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range or
+ * by the caller's `sanctions`; the evidence line then ends ` - sanctioned:
+ * <reason>`.
+ *
+ * What it does not see: a rule set to `warn`, a rule deleted, a rule turned off
+ * by a configuration named in `extends`, `package.json`'s `eslintConfig`, ignore
+ * patterns, biome's `"recommended": false` and `"enabled": false`, and other
+ * linters' files.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-92";
+export interface LintRulesOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (`rule-off:<file>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * Report each rule `base..candidate` turns off in a lint configuration file.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: LintRulesOptions): Promise<CheckRecord>;

package/dist/checks/lint-rules.js

@@ -0,0 +1,184 @@
+/**
+ * Lint rules turned off.
+ *
+ * A lint run goes green as surely when a rule is turned off in the lint
+ * configuration as when the code is fixed. This check reads every path the range
+ * adds, changes or renames onto whose last path segment is exactly one of
+ * `LINT_FILES` (`.eslintrc*`, `eslint.config.*`, `biome.json`, `biome.jsonc`,
+ * `.oxlintrc.json`), at any depth, whole and through git at the merge base of
+ * `base` and `candidate` and at `candidate`, renames detected. The working tree
+ * is never read, and no file is parsed or run.
+ *
+ * An off pair is, in a file's text, a rule name, white space or none, a colon,
+ * white space or none, then an off value (`"off"`, `'off'`, `off` or `0`, or
+ * `[` and white space before one of them), the value not followed by a letter, a
+ * digit, `_` or `.`. A name is written in double quotes, in single quotes or
+ * bare. A pair is counted wherever it stands, a comment included. For each file,
+ * each name's pairs are counted at the candidate and in the source file (the
+ * file at the merge base, the one a rename came from, or none for a file the
+ * range adds); a name counted more often at the candidate is one finding
+ * `rule-off`, whatever the count. A rule moved or a line re-indented says
+ * nothing; a rule changed from `error` or `warn` to `off` is a finding.
+ *
+ * Each finding is the evidence line `<file>: rule-off <name>`. A finding's id is
+ * `rule-off:<file>`, which sanctions every finding of that file by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range or
+ * by the caller's `sanctions`; the evidence line then ends ` - sanctioned:
+ * <reason>`.
+ *
+ * What it does not see: a rule set to `warn`, a rule deleted, a rule turned off
+ * by a configuration named in `extends`, `package.json`'s `eslintConfig`, ignore
+ * patterns, biome's `"recommended": false` and `"enabled": false`, and other
+ * linters' files.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-92";
+const LINT_FILES = new Set([
+    ".eslintrc",
+    ".eslintrc.json",
+    ".eslintrc.yml",
+    ".eslintrc.yaml",
+    ".eslintrc.js",
+    ".eslintrc.cjs",
+    "eslint.config.js",
+    "eslint.config.mjs",
+    "eslint.config.cjs",
+    "eslint.config.ts",
+    "eslint.config.mts",
+    "eslint.config.cts",
+    "biome.json",
+    "biome.jsonc",
+    ".oxlintrc.json",
+]);
+const OFF_PAIR = new RegExp(String.raw `(?:"([^"]*)"|'([^']*)'|([A-Za-z@_$][A-Za-z0-9@/\-_.$]*))\s*:\s*(?:\[\s*)?(?:"off"|'off'|off|0)(?![A-Za-z0-9_.])`, "g");
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "buffer" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.toString("utf8").trim() || error.message));
+            else
+                resolve(stdout.toString("utf8"));
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const isLintPath = (path) => LINT_FILES.has(path.slice(path.lastIndexOf("/") + 1));
+const isNull = (sha) => /^0+$/.test(sha);
+/** A blob read whole through git; an absent blob is an empty file. */
+const readBlob = async (cwd, sha) => isNull(sha) ? "" : runGit(cwd, ["cat-file", "blob", sha]);
+/** How many off pairs each rule name has in a file's text. */
+function countOffPairs(content) {
+    const counts = new Map();
+    for (const match of content.matchAll(OFF_PAIR)) {
+        const rule = match[1] ?? match[2] ?? match[3] ?? "";
+        counts.set(rule, (counts.get(rule) ?? 0) + 1);
+    }
+    return counts;
+}
+async function compare(cwd, from, to) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "-M", "--no-abbrev", "--no-ext-diff", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const drafts = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [, , oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const renamed = status.startsWith("R") || status.startsWith("C");
+        i++;
+        const newPath = renamed ? (fields[++i] ?? "") : (fields[i] ?? "");
+        const letter = status.charAt(0);
+        if (!["A", "M", "R", "C", "T"].includes(letter) || !isLintPath(newPath))
+            continue;
+        const before = countOffPairs(letter === "A" ? "" : await readBlob(cwd, oldSha));
+        const after = countOffPairs(await readBlob(cwd, newSha));
+        for (const [rule, count] of after) {
+            if (count > (before.get(rule) ?? 0))
+                drafts.push({ file: newPath, rule });
+        }
+    }
+    return drafts;
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+/**
+ * Report each rule `base..candidate` turns off in a lint configuration file.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const drafts = await compare(cwd, ancestor, candidateCommit);
+        if (drafts.length === 0)
+            return { name, status: "pass", evidence: ["no lint rule turned off"] };
+        const lines = await readSanctionLines(cwd, ancestor, candidateCommit);
+        let open = false;
+        const evidence = drafts.map((draft) => {
+            const reason = sanctionFor(`rule-off:${draft.file}`, lines, options.sanctions ?? {});
+            if (reason === null)
+                open = true;
+            const tail = reason === null ? "" : ` - sanctioned: ${escapeText(reason)}`;
+            return `${escapeText(draft.file)}: rule-off ${escapeText(draft.rule)}${tail}`;
+        });
+        return { name, status: open ? "fail" : "pass", evidence };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))] };
+    }
+}
+//# sourceMappingURL=lint-rules.js.map

package/dist/checks/lint-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-rules.js","sourceRoot":"","sources":["../../src/checks/lint-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAE5B,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAC;AAUH,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,MAAM,CAAC,GAAG,CAAA,iHAAiH,EAC3H,GAAG,CACJ,CAAC;AAEF,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,GAAW,EAAmB,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AAE5D,8DAA8D;AAC9D,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,EAAE,AAAD,EAAG,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,EAAE,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAClF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAyB;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACrF,IAAI,MAAM,KAAK,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAChF,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/checks/path-policy.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Path policy.
+ *
+ * Which paths a change should not reach without a second look is the
+ * repository's to say, so this check holds no list: it reads `forbidden` and
+ * `allowed` from its options and reports each path the range adds, changes,
+ * deletes or renames - both ends of a rename - that a `forbidden` pattern
+ * matches or, when `allowed` is given, that no `allowed` pattern matches.
+ *
+ * Paths come from git's list of the changes between the merge base and the
+ * candidate, never from the working tree. A pattern is matched against a whole
+ * path: `?` is one character but `/`, `*` is any run but `/`, a segment that
+ * is exactly `**` is any number of whole segments (none included), and every
+ * other character - case included - matches only itself.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-57";
+/** The options a configuration file may set for this check. */
+export declare const optionKinds: {
+    forbidden: string;
+    allowed: string;
+};
+export interface PathPolicyOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (`<category>:<path>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+    readonly forbidden?: readonly string[] | undefined;
+    readonly allowed?: readonly string[] | undefined;
+}
+/** Whether one pattern matches one whole path. */
+export declare function matchesPattern(pattern: string, path: string): boolean;
+/**
+ * Report each path `base..candidate` touches that the policy forbids or does
+ * not allow. Fails while any finding is unsanctioned, and fails closed: a bad
+ * revision, a bad option or a failing git invocation is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: PathPolicyOptions): Promise<CheckRecord>;