@veda-hq/dvara 0.0.0-stage → 0.5.4

package/dist/records/git.js

@@ -0,0 +1,312 @@
+// Git access for the record gate: one tree (the index at pre-commit, a commit
+// in CI) read in batches, so a hundred staged files cost one `cat-file`
+// process, not a hundred.
+import { execFileSync, spawnSync } from "node:child_process";
+export const git = (repo, args, input) => execFileSync("git", args, {
+    cwd: repo.cwd,
+    env: repo.env ?? process.env,
+    encoding: "utf8",
+    ...(input === undefined ? {} : { input }),
+    maxBuffer: 512 * 1024 * 1024,
+    // All three piped: stderr goes into the thrown error, not the terminal.
+    stdio: "pipe",
+});
+export const runner = (repo) => (args) => git(repo, args);
+/**
+ * A git question whose "no" is exit 1 (`rev-parse --verify --quiet` on a
+ * missing ref, `merge-base` with no common ancestor): null. Any other failure
+ * is git not answering, and is thrown rather than read as "no".
+ */
+export const tryGit = (repo, args) => {
+    const result = spawnSync("git", args, {
+        cwd: repo.cwd,
+        env: repo.env ?? process.env,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.status === 0)
+        return result.stdout;
+    if (result.status === 1)
+        return null;
+    throw new Error(`git ${args[0] ?? ""} failed (${String(result.status ?? result.error)}): ${result.stderr}`);
+};
+const splitZ = (out) => out.split("\0").filter(Boolean);
+/** Every path in the tree. */
+export const listTree = (repo, ref) => ref === ":"
+    ? splitZ(git(repo, ["ls-files", "-z"]))
+    : splitZ(git(repo, ["ls-tree", "-r", "-z", "--name-only", ref]));
+/**
+ * Every path in the tree with its git mode (`100644`, `120000`, `160000`, …).
+ * The index prints `<mode> <id> <stage>\t<path>`, a commit's tree
+ * `<mode> <type> <id>\t<path>`: the mode leads both, the path follows the tab.
+ */
+export const listModes = (repo, ref) => {
+    const out = ref === ":"
+        ? git(repo, ["ls-files", "-s", "-z"])
+        : git(repo, ["ls-tree", "-r", "-z", ref]);
+    return new Map(splitZ(out).map((entry) => [
+        entry.slice(entry.indexOf("\t") + 1),
+        entry.slice(0, entry.indexOf(" ")),
+    ]));
+};
+/** A symlink (its blob is the target's path) or a submodule's commit. */
+const LINK_MODES = new Set(["120000", "160000"]);
+/**
+ * A path the tree lists whose object git cannot read. Nothing about it can be
+ * vouched for, so the gate stops rather than read it as absent.
+ */
+export class UnreadableObject extends Error {
+    // A plain field: type stripping has no parameter properties.
+    object;
+    constructor(object) {
+        super(`${object} is listed but its object cannot be read`);
+        this.object = object;
+    }
+}
+/** Of these paths, the ones the tree at `rev` lists (read from the root). */
+export const listedIn = (repo, rev, paths) => {
+    if (paths.length === 0)
+        return new Set();
+    const out = git(repo, [
+        "ls-tree",
+        "--full-tree",
+        "--name-only",
+        "-z",
+        rev,
+        "--",
+        ...paths,
+    ]);
+    const wanted = new Set(paths);
+    return new Set(out.split("\0").filter((p) => wanted.has(p)));
+};
+/** Is `path` in the tree at `rev`? Asks the tree, not the blob. */
+export const treeLists = (repo, rev, path) => listedIn(repo, rev, [path]).has(path);
+/**
+ * The most object content one git process may print, in the batch and outside
+ * it alike: a blob the batch reads is not refused when asked on its own.
+ */
+export const OBJECT_BUFFER = 1024 * 1024 * 1024;
+/**
+ * One object question outside the batch: its answer, or null when git has no
+ * such object (cat-file exits 128 for a missing name, as the batch says
+ * "missing").
+ */
+const askOne = (repo, args) => {
+    const result = spawnSync("git", args, {
+        cwd: repo.cwd,
+        env: repo.env ?? process.env,
+        encoding: "utf8",
+        maxBuffer: OBJECT_BUFFER,
+    });
+    return result.status === 0 ? result.stdout : null;
+};
+/**
+ * The byte count in a `git cat-file --batch` header, `<oid> <type> <size>`.
+ * Any other header throws: reading on from a wrong size would hand every
+ * later blob in the batch the wrong bytes.
+ */
+export const batchObjectSize = (header) => {
+    const field = header.split(" ")[2] ?? "";
+    if (!/^\d+$/.test(field))
+        throw new Error(`git cat-file --batch: unexpected header "${header}"`);
+    return Number(field);
+};
+/**
+ * Contents of many blobs in one process. `names` are `rev:path` object names;
+ * a missing one maps to null. Binary content comes back as text and is the
+ * caller's to skip.
+ */
+export const readBlobs = (repo, names) => {
+    const out = new Map();
+    // The batch protocol is one name per line: a path with a newline in it is
+    // asked on its own.
+    const batch = names.filter((name) => !name.includes("\n"));
+    for (const name of names.filter((n) => n.includes("\n")))
+        out.set(name, askOne(repo, ["cat-file", "blob", name]));
+    if (batch.length === 0)
+        return out;
+    const result = spawnSync("git", ["cat-file", "--batch"], {
+        cwd: repo.cwd,
+        env: repo.env ?? process.env,
+        input: `${batch.join("\n")}\n`,
+        maxBuffer: OBJECT_BUFFER,
+    });
+    if (result.status !== 0)
+        throw new Error(`git cat-file --batch failed: ${String(result.stderr)}`);
+    const buffer = result.stdout;
+    let at = 0;
+    for (const name of batch) {
+        const newline = buffer.indexOf(10, at);
+        const header = buffer.subarray(at, newline).toString("utf8");
+        at = newline + 1;
+        if (header.endsWith(" missing") || header.endsWith(" ambiguous")) {
+            out.set(name, null);
+            continue;
+        }
+        const size = batchObjectSize(header);
+        out.set(name, buffer.subarray(at, at + size).toString("utf8"));
+        at += size + 1;
+    }
+    return out;
+};
+export const objectName = (ref, path) => ref === ":" ? `:${path}` : `${ref}:${path}`;
+/**
+ * The object type (commit, tree, blob, tag) of each of these names (ids or
+ * `rev:path`) the object store has. git answers one line per name, in order;
+ * a found name is echoed as its id, so answers are matched by position.
+ */
+export const objectTypes = (repo, names) => {
+    const types = new Map();
+    // One name per line, as in readBlobs: a newline-bearing name goes alone.
+    const batch = names.filter((name) => !name.includes("\n"));
+    for (const name of names.filter((n) => n.includes("\n"))) {
+        const type = askOne(repo, ["cat-file", "-t", name]);
+        if (type !== null)
+            types.set(name, type.trim());
+    }
+    if (batch.length === 0)
+        return types;
+    const out = git(repo, ["cat-file", "--batch-check"], `${batch.join("\n")}\n`);
+    const lines = out.split("\n");
+    batch.forEach((name, i) => {
+        // `<oid> <type> <size>` for a found name, `<name> missing|ambiguous`
+        // for any other: the type is the field between the first and last space.
+        const line = lines[i];
+        if (line === undefined || / (missing|ambiguous)$/.test(line))
+            return;
+        types.set(name, line.slice(line.indexOf(" ") + 1, line.lastIndexOf(" ")));
+    });
+    return types;
+};
+/**
+ * The merge base of `a` with `b`, or with the merge of every one of `b`:
+ * `git merge-base A B C` answers for A against a hypothetical merge of B, C.
+ */
+export const mergeBase = (repo, a, ...b) => {
+    const out = tryGit(repo, ["merge-base", a, ...b]);
+    return out === null ? null : out.trim();
+};
+export const resolveRef = (repo, ref) => {
+    const out = tryGit(repo, [
+        "rev-parse",
+        "--verify",
+        "--quiet",
+        `${ref}^{commit}`,
+    ]);
+    return out === null ? null : out.trim();
+};
+export const noQuestions = () => ({
+    shas: new Set(),
+    bases: new Set(),
+});
+/**
+ * A context that answers without git and records each question. Running the
+ * rules over it first lets `warm` ask git once per kind of question instead
+ * of once per file.
+ */
+export const recordingContext = (tree, asked) => ({
+    typesOf: (shas) => {
+        for (const sha of shas)
+            asked.shas.add(sha);
+        return new Map(shas.map((sha) => [sha, "commit"]));
+    },
+    baseText: (path) => {
+        if (typeof tree.base !== "string")
+            return tree.base;
+        asked.bases.add(path);
+        return null;
+    },
+});
+/** A tree context over one git tree, with an optional merge base for branch rules. */
+export const treeContext = (repo, ref, base, 
+/** The path a file had at the base, when the branch renamed it. */
+renamedFrom = () => undefined) => {
+    const modes = listModes(repo, ref);
+    const present = new Set(modes.keys());
+    const cache = new Map();
+    const baseCache = new Map();
+    /** Object type by name; null when the store does not have it. */
+    const objects = new Map();
+    const readInto = (into, rev, wanted) => {
+        const missing = wanted.filter((path) => !into.has(path));
+        const names = missing.map((path) => objectName(rev, path));
+        const blobs = readBlobs(repo, names);
+        missing.forEach((path, i) => into.set(path, blobs.get(names[i] ?? "") ?? null));
+    };
+    const probe = (names) => {
+        const missing = [...new Set(names)].filter((name) => !objects.has(name));
+        if (missing.length === 0)
+            return;
+        const types = objectTypes(repo, missing);
+        for (const name of missing)
+            objects.set(name, types.get(name) ?? null);
+    };
+    // Base texts are read under the base-side path and cached by head path.
+    const readBases = (rev, wanted) => {
+        const missing = wanted.filter((path) => !baseCache.has(path));
+        if (missing.length === 0)
+            return;
+        const direct = new Map();
+        readInto(direct, rev, missing);
+        const renamed = missing.filter((path) => direct.get(path) === null);
+        const sources = new Map();
+        for (const path of renamed) {
+            const from = renamedFrom(path);
+            if (from !== undefined)
+                sources.set(path, from);
+        }
+        const old = new Map();
+        readInto(old, rev, [...new Set(sources.values())]);
+        // Absent is what the base tree does not list: a listed path whose blob
+        // cannot be read is a broken store, not a file the branch adds.
+        const unread = [
+            ...renamed,
+            ...[...sources.values()].filter((from) => old.get(from) === null),
+        ];
+        const listed = listedIn(repo, rev, [...new Set(unread)]);
+        const broken = unread.find((p) => listed.has(p));
+        if (broken !== undefined)
+            throw new UnreadableObject(`${rev}:${broken}`);
+        for (const path of missing) {
+            const from = sources.get(path);
+            baseCache.set(path, direct.get(path) ??
+                (from === undefined ? null : (old.get(from) ?? null)));
+        }
+    };
+    return {
+        base,
+        pathExists: (path) => present.has(path),
+        isLink: (path) => LINK_MODES.has(modes.get(path) ?? ""),
+        read: (path) => {
+            if (!present.has(path))
+                return null;
+            readInto(cache, ref, [path]);
+            const text = cache.get(path) ?? null;
+            // Listed but unreadable is a broken store, not an absent file.
+            if (text === null)
+                throw new UnreadableObject(objectName(ref, path));
+            return text;
+        },
+        typesOf: (shas) => {
+            probe(shas);
+            const types = new Map();
+            for (const sha of shas) {
+                const type = objects.get(sha);
+                if (type)
+                    types.set(sha, type);
+            }
+            return types;
+        },
+        baseText: (path) => {
+            if (typeof base !== "string")
+                return base;
+            readBases(base, [path]);
+            return baseCache.get(path) ?? null;
+        },
+        warm: (asked) => {
+            if (typeof base === "string")
+                readBases(base, [...asked.bases]);
+            probe([...asked.shas]);
+        },
+    };
+};

package/dist/records/identity.js

@@ -0,0 +1,263 @@
+import { fenceKind, group, parseMarkdown } from "./markdown.js";
+// Hex is read in either case: git accepts `ABC1234` as readily as `abc1234`.
+const SHORT = /(?<![\w./=?#-])[0-9a-f]{7,39}(?![\w-])/gi;
+/**
+ * The right endpoint of an `a..b` or `a...b` range. The left one is an id or
+ * a ref (`main`, `origin/main`, `HEAD~2`, `v1.2`): a ref's dots never run
+ * into the range's own. Bounded, as the windows below are: a page's line of
+ * megabytes is not a ref.
+ */
+const RANGE_RIGHT = /(?<![\w-])[\w-]{1,64}(?:[/.][\w-]{1,64}){0,8}(?:[~^]\d{0,4}){0,4}\.{2,3}([0-9a-f]{7,40})(?![\w-])/gi;
+const FULL = /(?<![0-9a-f])[0-9a-f]{40}(?![0-9a-f])/gi;
+const TEST_MERGE = /(?<![0-9a-f])([0-9a-f]{40})(?::refs\/(?:remotes\/)?| +-> +(?:refs\/(?:remotes\/)?)?)pull\/\d+\/merge\b/gi;
+const COMMIT_WORD = /(?<![\w-])(commits?|committed|sha1?|head|main|merged?|merges|push(ed)?|revert(ed)?|cherry-pick(ed)?|resolved-by|rebased?|checkout|checked out|built from|landed|shipped|fix(ed)? in|tip)\b|"(sha|commit|head|base|merge)"\s*:/i;
+const OTHER_HASH = /\b(sha-?256|sha-?512|md5|digests?|fingerprints?|checksums?|etags?|hash(es)?|keys?|nonces?|uuids?|run[- ]?ids?|versions?|state[- ]list)\b/i;
+/** Turbo prints 16-hex task hashes: `cache miss, executing 40896a8f6fe567b8`. */
+const TASK_HASH = /(cache (hit|miss)|executing|replaying)\W*$/i;
+/** Bounded like the windows below: a command is short, a page's line is not. */
+const ABBREVIATING_COMMAND = /\bgit\b[^\n]{0,300}?(--oneline|%h\b|--abbrev-commit|rev-parse\s+--short)/;
+const DIFF_INDEX = /^\s*index\s/;
+/** A shell line that a trailing backslash continues onto the next. */
+const CONTINUED = /\\$/;
+/** A commit word right before the token: `commit 1234567`, `sha: abcdefa`. */
+const IMMEDIATE = new RegExp(`(?:${COMMIT_WORD.source})[\\s:=\`"'(]*$`, "i");
+/** Raw captured output kept as a file: a log, not prose anyone edits. */
+const CAPTURED = /\.(txt|log|diff|patch)$/;
+const hasLetterAndDigit = (token) => /[a-f]/i.test(token) && /\d/.test(token);
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * A hex token's role on its line, for abbreviated and full ids alike:
+ * `explicit` when a commit word stands right before it or it is a range end
+ * or cut off; `label` when a checksum-like label (or a task hash's prefix)
+ * names it; `implied` when a commit word farther back only suggests it;
+ * `none` when nothing on the line names it.
+ */
+export const hexRole = (line, index, token) => {
+    // Bounded windows: a generated HTML page is one line of megabytes, and a
+    // copy of the rest of the line per token made that quadratic.
+    const before = line.slice(Math.max(0, index - 48), index);
+    const after = line.slice(index + token.length, index + token.length + 48);
+    // A diff's `index a..b` header pairs blobs, not commits.
+    const range = !DIFF_INDEX.test(line) &&
+        (/^\.{2,3}[0-9a-f]{7,}/i.test(after) ||
+            /[0-9a-f]{7,}\.{2,3}$/i.test(before));
+    const cut = /^(…|\.\.\.)(?!\.)/.test(after) && !range;
+    if (TASK_HASH.test(before))
+        return "label";
+    if (range || cut || IMMEDIATE.test(before))
+        return "explicit";
+    // A label at the token ("checksum `abc1234def`") outranks a commit word
+    // farther back on the line ("the merged archive has checksum …").
+    if (OTHER_HASH.test(before.slice(-20)) || OTHER_HASH.test(after.slice(0, 24)))
+        return "label";
+    if (COMMIT_WORD.test(before))
+        return "implied";
+    return OTHER_HASH.test(before) ? "label" : "none";
+};
+/**
+ * How an abbreviated token is cited as a commit: `explicit` (every hex token counts),
+ * `implied` (a token needs a letter and a digit: `1234567` is a number,
+ * `deadbeef` a word), or null when it is not a commit.
+ */
+export const citesAsCommit = (line, index, token) => {
+    const role = hexRole(line, index, token);
+    if (role === "explicit" || role === "implied")
+        return role;
+    if (role === "label")
+        return null;
+    // Sixteen hex digits with no commit word is a Turbo task hash's length.
+    if (token.length === 16)
+        return null;
+    const backticked = line[index - 1] === "`" && line[index + token.length] === "`";
+    return backticked ? "implied" : null;
+};
+/**
+ * Lines the token rule reads: all of a data file (JSON a script wrote names
+ * its commits in keys); prose and commands of Markdown; nothing of a captured
+ * log, which is output exactly as the tool printed it.
+ */
+const readable = (path, text) => {
+    if (CAPTURED.test(path))
+        return [];
+    const lines = text.split(/\r?\n/);
+    if (!/\.mdx?$/.test(path)) {
+        return lines.map((line, i) => ({ n: i + 1, text: line }));
+    }
+    const doc = parseMarkdown(text);
+    // A script fence holds commands, every line; a transcript's `$ ` lines are
+    // commands and the rest is what they printed; a source fence quotes a
+    // file. A body is read as the parser unquoted it: `> $ git log` in a
+    // quoted transcript is a command.
+    const script = new Map();
+    const transcript = new Map();
+    for (const fence of doc.fences) {
+        const kind = fenceKind(fence);
+        if (kind === "source")
+            continue;
+        const into = kind === "script" ? script : transcript;
+        for (const line of fence.body)
+            into.set(line.n, line.text);
+    }
+    const out = [];
+    // A transcript command ending in `\` goes on: its next line is the same
+    // command, though it has no `$ `.
+    let continues = false;
+    lines.forEach((line, i) => {
+        const n = i + 1;
+        if (!doc.inFence[n]) {
+            out.push({ n, text: line });
+            return;
+        }
+        const scripted = script.get(n);
+        if (scripted !== undefined) {
+            out.push({ n, text: scripted });
+            return;
+        }
+        const body = transcript.get(n);
+        const command = body !== undefined && (continues || /^\s*\$ /.test(body));
+        if (command)
+            out.push({ n, text: body });
+        continues = command && CONTINUED.test(body);
+    });
+    return out;
+};
+/**
+ * Each line's command with the lines a trailing `\` continues it onto joined
+ * in, keyed by its first line; a continuation line maps to null. Lines join
+ * only when adjacent in the file, so a skipped line breaks the command.
+ */
+const commands = (lines) => {
+    const out = [];
+    let open = null;
+    lines.forEach((line, i) => {
+        const previous = lines[i - 1];
+        if (open !== null && previous !== undefined && previous.n + 1 === line.n) {
+            open.text = `${open.text.slice(0, -1)} ${line.text}`;
+            out[open.at] = open.text;
+            out.push(null);
+        }
+        else {
+            open = { at: i, text: line.text };
+            out.push(line.text);
+        }
+        if (!CONTINUED.test(line.text))
+            open = null;
+    });
+    return out;
+};
+/** The 40-hex ids a text cites as this repository's objects. */
+const citedIds = (text, repository) => {
+    const cited = [];
+    // GitHub's test merge of a pull request is fetched by id and kept by no
+    // branch, so no clone resolves it once the job ends. A log that names an
+    // id as that ref also prints it bare, as the checked-out head.
+    const testMerges = new Set([...text.matchAll(TEST_MERGE)].map((m) => group(m, 1).toLowerCase()));
+    const own = repository?.toLowerCase();
+    text.split(/\r?\n/).forEach((line, i) => {
+        for (const match of line.matchAll(FULL)) {
+            const sha = match[0].toLowerCase();
+            // Git's null id names the absent side of an added or deleted file.
+            if (testMerges.has(sha) || /^0+$/.test(sha))
+                continue;
+            const role = hexRole(line, match.index, match[0]);
+            if (role === "label")
+                continue;
+            const before = line.slice(Math.max(0, match.index - 120), match.index);
+            // Another repository's commit URL resolves on GitHub, not here; so
+            // does an Actions log's downloaded action.
+            const other = /github\.com\/([\w.-]+\/[\w.-]+)\/(commit|tree|blob)\/$/.exec(before) ??
+                /Download action repository '([\w.-]+\/[\w.-]+)(?:\/[^@']*)?@[^']*' \(SHA:$/.exec(before);
+            if (other && group(other, 1).toLowerCase() !== own)
+                continue;
+            cited.push({ n: i + 1, sha, asCommit: role !== "none" });
+        }
+    });
+    return cited;
+};
+/** EVIDENCE-01 under these settings: `identityPaths` and `repository`. */
+export const commitIdentity = (records) => {
+    const shortUrl = records.repository === null
+        ? null
+        : new RegExp(`github\\.com\\/${escape(records.repository)}\\/commit\\/([0-9a-f]{7,39})(?![0-9a-f])`, "gi");
+    const finding = (path, n, check, message) => ({
+        rule: "EVIDENCE-01",
+        check,
+        file: path,
+        line: n,
+        message,
+    });
+    return (path, text, tree) => {
+        if (!records.identityPaths.some((p) => p.test(path)))
+            return [];
+        const found = [];
+        const lines = readable(path, text);
+        // A command continued with `\` is read whole, reported at its first line.
+        const joined = commands(lines);
+        lines.forEach(({ n, text: line }, i) => {
+            const command = joined[i] ?? null;
+            const abbreviating = command === null ? null : ABBREVIATING_COMMAND.exec(command);
+            // `--no-abbrev-commit` after `--oneline` or `--abbrev-commit` restores
+            // full ids; `%h` is abbreviated whatever follows.
+            const restored = command !== null &&
+                abbreviating !== null &&
+                /^--(oneline|abbrev-commit)$/.test(group(abbreviating, 1)) &&
+                !/%h\b/.test(command) &&
+                /--no-abbrev(-commit)?\b/.test(command.slice(abbreviating.index + abbreviating[0].length));
+            if (abbreviating !== null && !restored) {
+                found.push(finding(path, n, "abbreviating-command", "a git command that prints abbreviated commits (--oneline, %h, --abbrev-commit, rev-parse --short); use %H or git rev-parse"));
+            }
+            for (const match of line.matchAll(SHORT)) {
+                const token = match[0];
+                const cited = citesAsCommit(line, match.index, token);
+                if (cited === null)
+                    continue;
+                if (cited === "implied" && !hasLetterAndDigit(token))
+                    continue;
+                found.push(finding(path, n, "abbreviated-id", `abbreviated commit "${token}": cite the full 40-hex sha (git rev-parse ${token})`));
+            }
+            // SHORT's boundary skips a token after `..`; a range's right endpoint
+            // is a commit as surely as its left.
+            for (const match of line.matchAll(RANGE_RIGHT)) {
+                const token = group(match, 1);
+                if (token.length === 40 || DIFF_INDEX.test(line))
+                    continue;
+                found.push(finding(path, n, "abbreviated-id", `abbreviated commit "${token}" ends a range: cite the full 40-hex sha (git rev-parse ${token})`));
+            }
+            for (const match of shortUrl === null ? [] : line.matchAll(shortUrl)) {
+                const token = group(match, 1);
+                found.push(finding(path, n, "abbreviated-id", `abbreviated commit URL "${token}": link the full 40-hex sha (git rev-parse ${token})`));
+            }
+        });
+        // Full ids anywhere, fences included, but only those the change adds:
+        // what a clone has differs by machine (a laptop keeps commits of deleted
+        // branches, a CI clone does not), so no baseline could hold legacy ones
+        // the same way everywhere. With no branch to compare, none are asked.
+        const baseText = tree.baseText(path);
+        if (baseText === undefined)
+            return found;
+        // Legacy means cited before in the same role: an id the base only printed
+        // as an object is new again once a line calls it a commit.
+        const old = baseText === null ? [] : citedIds(baseText, records.repository);
+        const legacyAny = new Set(old.map((c) => c.sha));
+        const legacyCommit = new Set(old.filter((c) => c.asCommit).map((c) => c.sha));
+        const full = citedIds(text, records.repository).filter((c) => c.asCommit ? !legacyCommit.has(c.sha) : !legacyAny.has(c.sha));
+        if (full.length === 0)
+            return found;
+        const types = tree.typesOf([...new Set(full.map((f) => f.sha))]);
+        for (const { n, sha, asCommit } of full) {
+            const type = types.get(sha);
+            // Git prints blob and tree ids too: every object resolves, unless the
+            // line names it a commit.
+            if (type !== undefined && (!asCommit || type === "commit"))
+                continue;
+            found.push({
+                ...finding(path, n, "unresolved-id", type === undefined
+                    ? `${sha} does not resolve in this repository (git cat-file -t ${sha})`
+                    : `${sha} is cited as a commit but is a ${type} (git cat-file -t ${sha})`),
+                // New by construction, so no legacy allowance may absorb it.
+                ratchet: false,
+            });
+        }
+        return found;
+    };
+};