@zuplo/cli 7.13.3 → 7.13.4

package/dist/cmds/lint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/cmds/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;;;;qBAUV,IAAI,KAAG,IAAI,CAAC,OAAO,CAAC;oBA2Df,OAAO;;AA9D/B,wBAkEE"}
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../src/cmds/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;;;;qBAQV,IAAI,KAAG,IAAI,CAAC,OAAO,CAAC;oBAsDf,OAAO;;AAzD/B,wBA6DE"}

package/dist/cmds/lint.js

@@ -1,7 +1,5 @@
 import { captureEvent } from "../common/analytics/lib.js";
 import { identify } from "../common/middleware/user-identification.js";
-import { ZuploProjectValidator } from "../common/validators/file-system-validator.js";
-import { YargsChecker } from "../common/validators/lib.js";
 import { lint } from "../lint/handler.js";
 export default {
     desc: "Lints your OpenAPI specs and policies for errors and Zuplo conventions",
@@ -54,9 +52,6 @@ export default {
                 "Emit SARIF for GitHub Code Scanning",
             ],
         ])
-            .check(async (argv) => {
-            return await new YargsChecker(new ZuploProjectValidator()).check(argv);
-        })
             .middleware([identify]);
     },
     handler: async (argv) => {

package/dist/cmds/lint.js.map

@@ -1 +1 @@
-{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../src/cmds/lint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,6CAA6C,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAa,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAErD,eAAe;IACb,IAAI,EAAE,wEAAwE;IAC9E,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,CAAC,KAAW,EAAiB,EAAE;QACtC,OAAO,KAAK;aACT,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,KAAK,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,yCAAyC;YACnD,OAAO,EAAE,GAAG;YACZ,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,MAAM,CAAC,QAAQ,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,QAAQ,EACN,uGAAuG;YACzG,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,MAAM,CAAC,QAAQ,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;YAClC,OAAO,EAAE,MAAM;SAChB,CAAC;aACD,MAAM,CAAC,SAAS,EAAE;YACjB,IAAI,EAAE,QAAQ;YACd,QAAQ,EACN,0GAA0G;YAC5G,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC,CAAC;aACD,MAAM,CAAC,KAAK,EAAE;YACb,IAAI,EAAE,SAAS;YACf,QAAQ,EACN,6FAA6F;YAC/F,OAAO,EAAE,KAAK;SACf,CAAC;aACD,MAAM,CAAC,aAAa,EAAE;YACrB,IAAI,EAAE,QAAQ;YACd,QAAQ,EACN,kFAAkF;YACpF,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;SACb,CAAC;aACD,OAAO,CAAC;YACP,CAAC,SAAS,EAAE,2CAA2C,CAAC;YACxD,CAAC,eAAe,EAAE,gDAAgD,CAAC;YACnE;gBACE,wBAAwB;gBACxB,gDAAgD;aACjD;YACD;gBACE,wCAAwC;gBACxC,qCAAqC;aACtC;SACF,CAAC;aACD,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpB,OAAO,MAAM,IAAI,YAAY,CAC3B,IAAI,qBAAqB,EAAE,CAC5B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;aACD,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;QAC/B,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,IAAiB,CAAC,CAAC;IAChC,CAAC;CACF,CAAC","sourcesContent":["import { Argv } from \"yargs\";\nimport { captureEvent } from \"../common/analytics/lib.js\";\nimport { identify } from \"../common/middleware/user-identification.js\";\nimport { ZuploProjectValidator } from \"../common/validators/file-system-validator.js\";\nimport { YargsChecker } from \"../common/validators/lib.js\";\nimport { Arguments, lint } from \"../lint/handler.js\";\n\nexport default {\n  desc: \"Lints your OpenAPI specs and policies for errors and Zuplo conventions\",\n  command: \"lint\",\n  builder: (yargs: Argv): Argv<unknown> => {\n    return yargs\n      .usage(\"$0 lint [options]\")\n      .option(\"dir\", {\n        type: \"string\",\n        describe: \"The directory containing your Zuplo API\",\n        default: \".\",\n        normalize: true,\n      })\n      .option(\"config\", {\n        type: \"string\",\n        describe:\n          \"Path to a lint config file. Defaults to zuplo.lint.jsonc or zuplo.lint.json in the project directory.\",\n        normalize: true,\n      })\n      .option(\"format\", {\n        type: \"string\",\n        describe: \"Output format\",\n        choices: [\"text\", \"json\", \"sarif\"],\n        default: \"text\",\n      })\n      .option(\"fail-on\", {\n        type: \"string\",\n        describe:\n          \"Severity threshold that fails the command. Defaults to the failOn value in your lint config, or 'error'.\",\n        choices: [\"error\", \"warn\", \"none\"],\n      })\n      .option(\"fix\", {\n        type: \"boolean\",\n        describe:\n          \"Rewrite your OpenAPI files to fix what can be fixed automatically, then report what is left\",\n        default: false,\n      })\n      .option(\"lint-binary\", {\n        type: \"string\",\n        describe:\n          \"Path to a zuplo-lint executable to use instead of the one installed with the CLI\",\n        normalize: true,\n        hidden: true,\n      })\n      .example([\n        [\"$0 lint\", \"Lint the project in the current directory\"],\n        [\"$0 lint --fix\", \"Apply the fixes that can be made automatically\"],\n        [\n          \"$0 lint --fail-on warn\",\n          \"Fail the command on warnings as well as errors\",\n        ],\n        [\n          \"$0 lint --format sarif > results.sarif\",\n          \"Emit SARIF for GitHub Code Scanning\",\n        ],\n      ])\n      .check(async (argv) => {\n        return await new YargsChecker<typeof argv>(\n          new ZuploProjectValidator()\n        ).check(argv);\n      })\n      .middleware([identify]);\n  },\n  handler: async (argv: unknown) => {\n    await captureEvent({ argv, event: \"zuplo lint\" });\n    await lint(argv as Arguments);\n  },\n};\n"]}
+{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../src/cmds/lint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,6CAA6C,CAAC;AACvE,OAAO,EAAa,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAErD,eAAe;IACb,IAAI,EAAE,wEAAwE;IAC9E,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,CAAC,KAAW,EAAiB,EAAE;QACtC,OAAO,KAAK;aACT,KAAK,CAAC,mBAAmB,CAAC;aAC1B,MAAM,CAAC,KAAK,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,yCAAyC;YACnD,OAAO,EAAE,GAAG;YACZ,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,MAAM,CAAC,QAAQ,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,QAAQ,EACN,uGAAuG;YACzG,SAAS,EAAE,IAAI;SAChB,CAAC;aACD,MAAM,CAAC,QAAQ,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;YAClC,OAAO,EAAE,MAAM;SAChB,CAAC;aACD,MAAM,CAAC,SAAS,EAAE;YACjB,IAAI,EAAE,QAAQ;YACd,QAAQ,EACN,0GAA0G;YAC5G,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC,CAAC;aACD,MAAM,CAAC,KAAK,EAAE;YACb,IAAI,EAAE,SAAS;YACf,QAAQ,EACN,6FAA6F;YAC/F,OAAO,EAAE,KAAK;SACf,CAAC;aACD,MAAM,CAAC,aAAa,EAAE;YACrB,IAAI,EAAE,QAAQ;YACd,QAAQ,EACN,kFAAkF;YACpF,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;SACb,CAAC;aACD,OAAO,CAAC;YACP,CAAC,SAAS,EAAE,2CAA2C,CAAC;YACxD,CAAC,eAAe,EAAE,gDAAgD,CAAC;YACnE;gBACE,wBAAwB;gBACxB,gDAAgD;aACjD;YACD;gBACE,wCAAwC;gBACxC,qCAAqC;aACtC;SACF,CAAC;aACD,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAa,EAAE,EAAE;QAC/B,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,IAAiB,CAAC,CAAC;IAChC,CAAC;CACF,CAAC","sourcesContent":["import { Argv } from \"yargs\";\nimport { captureEvent } from \"../common/analytics/lib.js\";\nimport { identify } from \"../common/middleware/user-identification.js\";\nimport { Arguments, lint } from \"../lint/handler.js\";\n\nexport default {\n  desc: \"Lints your OpenAPI specs and policies for errors and Zuplo conventions\",\n  command: \"lint\",\n  builder: (yargs: Argv): Argv<unknown> => {\n    return yargs\n      .usage(\"$0 lint [options]\")\n      .option(\"dir\", {\n        type: \"string\",\n        describe: \"The directory containing your Zuplo API\",\n        default: \".\",\n        normalize: true,\n      })\n      .option(\"config\", {\n        type: \"string\",\n        describe:\n          \"Path to a lint config file. Defaults to zuplo.lint.jsonc or zuplo.lint.json in the project directory.\",\n        normalize: true,\n      })\n      .option(\"format\", {\n        type: \"string\",\n        describe: \"Output format\",\n        choices: [\"text\", \"json\", \"sarif\"],\n        default: \"text\",\n      })\n      .option(\"fail-on\", {\n        type: \"string\",\n        describe:\n          \"Severity threshold that fails the command. Defaults to the failOn value in your lint config, or 'error'.\",\n        choices: [\"error\", \"warn\", \"none\"],\n      })\n      .option(\"fix\", {\n        type: \"boolean\",\n        describe:\n          \"Rewrite your OpenAPI files to fix what can be fixed automatically, then report what is left\",\n        default: false,\n      })\n      .option(\"lint-binary\", {\n        type: \"string\",\n        describe:\n          \"Path to a zuplo-lint executable to use instead of the one installed with the CLI\",\n        normalize: true,\n        hidden: true,\n      })\n      .example([\n        [\"$0 lint\", \"Lint the project in the current directory\"],\n        [\"$0 lint --fix\", \"Apply the fixes that can be made automatically\"],\n        [\n          \"$0 lint --fail-on warn\",\n          \"Fail the command on warnings as well as errors\",\n        ],\n        [\n          \"$0 lint --format sarif > results.sarif\",\n          \"Emit SARIF for GitHub Code Scanning\",\n        ],\n      ])\n      .middleware([identify]);\n  },\n  handler: async (argv: unknown) => {\n    await captureEvent({ argv, event: \"zuplo lint\" });\n    await lint(argv as Arguments);\n  },\n};\n"]}

package/dist/lint/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/lint/handler.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,iBAqDzC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/lint/handler.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AASD,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,iBAgEzC"}

package/dist/lint/handler.js

@@ -2,10 +2,19 @@ import path from "node:path";
 import { execa } from "execa";
 import { shutdownAnalytics } from "../common/analytics/lib.js";
 import { printCriticalFailureToConsole } from "../common/output.js";
+import { ZuploProjectValidator } from "../common/validators/file-system-validator.js";
 import { LintBinaryNotFoundError, resolveLintBinary, } from "./resolve-binary.js";
 const EXIT_VIOLATIONS_FOUND = 1;
 const EXIT_RUN_FAILED = 2;
 export async function lint(argv) {
+    const project = await new ZuploProjectValidator().validate({
+        dir: argv.dir,
+    });
+    if (!project.ok) {
+        printCriticalFailureToConsole(project.error.message);
+        await exit(EXIT_RUN_FAILED);
+        return;
+    }
     let binary;
     try {
         binary = resolveLintBinary({ override: argv.lintBinary });

package/dist/lint/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/lint/handler.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAe7B,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAe;IACxC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QAIH,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,6BAA6B,CAC3B,+BAA+B,MAAM,KAAK;gBACxC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAKD,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YACvC,6BAA6B,CAC3B,iCAAiC,QAAQ,IAAI,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,iBAAiB,EAAE,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAOD,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,KAAK,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,GAA4B,CAAC;QAClD,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import path from \"node:path\";\nimport { execa } from \"execa\";\nimport { shutdownAnalytics } from \"../common/analytics/lib.js\";\nimport { printCriticalFailureToConsole } from \"../common/output.js\";\nimport {\n  LintBinaryNotFoundError,\n  resolveLintBinary,\n} from \"./resolve-binary.js\";\n\nexport interface Arguments {\n  dir: string;\n  config?: string;\n  format: string;\n  failOn?: string;\n  fix: boolean;\n  lintBinary?: string;\n}\n\n/**\n * Exit codes, matching the linter's own contract so CI can tell the two apart:\n * 1 means the project has violations, 2 means the linter could not run.\n */\nconst EXIT_VIOLATIONS_FOUND = 1;\nconst EXIT_RUN_FAILED = 2;\n\nexport async function lint(argv: Arguments) {\n  let binary: string;\n  try {\n    binary = resolveLintBinary({ override: argv.lintBinary });\n  } catch (err) {\n    if (err instanceof LintBinaryNotFoundError) {\n      printCriticalFailureToConsole(err.message);\n      await exit(EXIT_RUN_FAILED);\n      return;\n    }\n    throw err;\n  }\n\n  const args = [\"--dir\", path.resolve(argv.dir), \"--format\", argv.format];\n  if (argv.config) {\n    args.push(\"--config\", path.resolve(argv.config));\n  }\n  if (argv.failOn) {\n    args.push(\"--fail-on\", argv.failOn);\n  }\n  if (argv.fix) {\n    args.push(\"--fix\");\n  }\n\n  try {\n    // The linter writes its own report — results to stdout, diagnostics to\n    // stderr — so inherit the streams rather than buffering and re-printing.\n    // That also leaves its color and TTY detection intact.\n    await execa(binary, args, { stdio: \"inherit\" });\n    return;\n  } catch (cause) {\n    const exitCode = childExitCode(cause);\n\n    if (exitCode === undefined) {\n      printCriticalFailureToConsole(\n        `Could not run the linter at ${binary}.\\n` +\n          `${cause instanceof Error ? cause.message : String(cause)}`\n      );\n      await exit(EXIT_RUN_FAILED);\n      return;\n    }\n\n    // Anything other than \"violations found\" means the linter itself failed.\n    // Its diagnostic already went to stderr, but on its own that reads like a\n    // lint result rather than a broken invocation.\n    if (exitCode !== EXIT_VIOLATIONS_FOUND) {\n      printCriticalFailureToConsole(\n        `Lint failed to run (exit code ${exitCode}).`\n      );\n    }\n\n    await exit(exitCode);\n  }\n}\n\n/**\n * Exit with the linter's own status rather than throwing. Throwing would send\n * this through cli.ts's catch, which prints a redundant error and dumps the\n * help text on top of a report the user has already read. Matches how\n * `zuplo test` propagates a failing run.\n */\nasync function exit(code: number): Promise<never> {\n  await shutdownAnalytics();\n  process.exit(code);\n}\n\n/**\n * The child's exit status, or undefined when the process never ran. execa types\n * `exitCode` as a number, but a spawn failure — the file is not executable, or\n * is a binary for another architecture — produces an error without one.\n */\nfunction childExitCode(err: unknown): number | undefined {\n  if (err instanceof Error && \"exitCode\" in err) {\n    const { exitCode } = err as { exitCode: unknown };\n    return typeof exitCode === \"number\" ? exitCode : undefined;\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/lint/handler.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAe7B,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAe;IAGxC,MAAM,OAAO,GAAG,MAAM,IAAI,qBAAqB,EAAE,CAAC,QAAQ,CAAC;QACzD,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,6BAA6B,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,6BAA6B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QAIH,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,6BAA6B,CAC3B,+BAA+B,MAAM,KAAK;gBACxC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;YACF,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAKD,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;YACvC,6BAA6B,CAC3B,iCAAiC,QAAQ,IAAI,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,iBAAiB,EAAE,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAOD,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,KAAK,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,GAA4B,CAAC;QAClD,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import path from \"node:path\";\nimport { execa } from \"execa\";\nimport { shutdownAnalytics } from \"../common/analytics/lib.js\";\nimport { printCriticalFailureToConsole } from \"../common/output.js\";\nimport { ZuploProjectValidator } from \"../common/validators/file-system-validator.js\";\nimport {\n  LintBinaryNotFoundError,\n  resolveLintBinary,\n} from \"./resolve-binary.js\";\n\nexport interface Arguments {\n  dir: string;\n  config?: string;\n  format: string;\n  failOn?: string;\n  fix: boolean;\n  lintBinary?: string;\n}\n\n/**\n * Exit codes, matching the linter's own contract so CI can tell the two apart:\n * 1 means the project has violations, 2 means the linter could not run.\n */\nconst EXIT_VIOLATIONS_FOUND = 1;\nconst EXIT_RUN_FAILED = 2;\n\nexport async function lint(argv: Arguments) {\n  // Checked here rather than in a yargs .check(): a failed check exits 1 via\n  // cli.ts, which CI cannot tell apart from \"violations found\".\n  const project = await new ZuploProjectValidator().validate({\n    dir: argv.dir,\n  });\n  if (!project.ok) {\n    printCriticalFailureToConsole(project.error.message);\n    await exit(EXIT_RUN_FAILED);\n    return;\n  }\n\n  let binary: string;\n  try {\n    binary = resolveLintBinary({ override: argv.lintBinary });\n  } catch (err) {\n    if (err instanceof LintBinaryNotFoundError) {\n      printCriticalFailureToConsole(err.message);\n      await exit(EXIT_RUN_FAILED);\n      return;\n    }\n    throw err;\n  }\n\n  const args = [\"--dir\", path.resolve(argv.dir), \"--format\", argv.format];\n  if (argv.config) {\n    args.push(\"--config\", path.resolve(argv.config));\n  }\n  if (argv.failOn) {\n    args.push(\"--fail-on\", argv.failOn);\n  }\n  if (argv.fix) {\n    args.push(\"--fix\");\n  }\n\n  try {\n    // The linter writes its own report — results to stdout, diagnostics to\n    // stderr — so inherit the streams rather than buffering and re-printing.\n    // That also leaves its color and TTY detection intact.\n    await execa(binary, args, { stdio: \"inherit\" });\n    return;\n  } catch (cause) {\n    const exitCode = childExitCode(cause);\n\n    if (exitCode === undefined) {\n      printCriticalFailureToConsole(\n        `Could not run the linter at ${binary}.\\n` +\n          `${cause instanceof Error ? cause.message : String(cause)}`\n      );\n      await exit(EXIT_RUN_FAILED);\n      return;\n    }\n\n    // Anything other than \"violations found\" means the linter itself failed.\n    // Its diagnostic already went to stderr, but on its own that reads like a\n    // lint result rather than a broken invocation.\n    if (exitCode !== EXIT_VIOLATIONS_FOUND) {\n      printCriticalFailureToConsole(\n        `Lint failed to run (exit code ${exitCode}).`\n      );\n    }\n\n    await exit(exitCode);\n  }\n}\n\n/**\n * Exit with the linter's own status rather than throwing. Throwing would send\n * this through cli.ts's catch, which prints a redundant error and dumps the\n * help text on top of a report the user has already read. Matches how\n * `zuplo test` propagates a failing run.\n */\nasync function exit(code: number): Promise<never> {\n  await shutdownAnalytics();\n  process.exit(code);\n}\n\n/**\n * The child's exit status, or undefined when the process never ran. execa types\n * `exitCode` as a number, but a spawn failure — the file is not executable, or\n * is a binary for another architecture — produces an error without one.\n */\nfunction childExitCode(err: unknown): number | undefined {\n  if (err instanceof Error && \"exitCode\" in err) {\n    const { exitCode } = err as { exitCode: unknown };\n    return typeof exitCode === \"number\" ? exitCode : undefined;\n  }\n  return undefined;\n}\n"]}

package/node_modules/@simple-git/argv-parser/LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Steve King
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/@simple-git/argv-parser/dist/index.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const h=require("@simple-git/args-pathspec");function*v(e,t){const n=t==="global";for(const o of e)o.isGlobal===n&&(yield o)}const S=new Set(["--add","--edit","--remove-section","--rename-section","--replace-all","--unset","--unset-all","-e"]),P=new Set(["--get","--get-all","--get-color","--get-colorbool","--get-regexp","--get-urlmatch","--list","-l"]),E=new Set(["edit","remove-section","rename-section","set","unset"]),A=new Set(["get","get-color","get-colorbool","list"]);function F(e,t){for(const{name:o}of v(e,"task")){if(S.has(o))return p(!0,t);if(P.has(o))return p(!1,t)}const n=t.at(0)?.toLowerCase();return n===void 0?null:E.has(n)?p(!0,t.slice(1)):A.has(n)?p(!1,t.slice(1)):t.length===1?p(!1,t):p(!0,t)}function p(e=!1,t=[]){const n=t.at(0)?.toLowerCase();return n===void 0?null:{isWrite:e,isRead:!e,key:n,value:t.at(1)}}function M(e,t){return t.isWrite&&t.value!==void 0?{key:t.key,value:t.value,scope:e}:{key:t.key,scope:e}}function N(e){const t=e?.indexOf("=")||-1;return!e||t<0?null:{key:e.slice(0,t).trim().toLowerCase(),value:e.slice(t+1)}}function O(e){for(const{name:t}of v(e,"task"))switch(t){case"--global":return"global";case"--system":return"system";case"--worktree":return"worktree";case"--local":return"local";case"--file":case"-f":return"file"}return"local"}function G({name:e}){if(e==="-c"||e==="--config")return"inline";if(e==="--config-env")return"env"}function*L(e){for(const t of e){const n=G(t),o=n&&N(t.value);o&&(yield{...o,scope:n})}}function $(e,t,n){const o={read:[],write:[...L(t)]};return e==="config"&&D(o,O(t),F(t,n)),o}function D(e,t,n){if(n===null)return;const o=M(t,n);n.isWrite?e.write.push(o):e.read.push(o)}const U={short:new Map([["c",!0]])},T={short:new Map([["C",!0],["P",!1],["h",!1],["p",!1],["v",!1],...U.short.entries()]),long:new Set(["attr-source","config-env","exec-path","git-dir","list-cmds","namespace","super-prefix","work-tree"])},R={clone:{short:new Map([["b",!0],["j",!0],["l",!1],["n",!1],["o",!0],["q",!1],["s",!1],["u",!0]]),long:new Set(["branch","config","jobs","origin","upload-pack","u","template"])},commit:{short:new Map([["C",!0],["F",!0],["c",!0],["m",!0],["t",!0]]),long:new Set(["file","message","reedit-message","reuse-message","template"])},config:{short:new Map([["e",!1],["f",!0],["l",!1]]),long:new Set(["blob","comment","default","file","type","value"])},fetch:{short:new Map,long:new Set(["upload-pack"])},init:{short:new Map,long:new Set(["template"])},pull:{short:new Map,long:new Set(["upload-pack"])},push:{short:new Map,long:new Set(["exec","receive-pack"])}},I={short:new Map,long:new Set};function j(e){const t=R[e??""]??I;return{short:new Map([...U.short.entries(),...t.short.entries()]),long:t.long}}function b(e,t=T){if(e.startsWith("--")){const n=e.indexOf("=");if(n>2)return[{name:e.slice(0,n),value:e.slice(n+1),needsNext:!1}];const o=e.slice(2);return[{name:e,needsNext:t.long.has(o)}]}if(e.length===2){const n=e.charAt(1),o=t.short.get(n);return[{name:e,needsNext:o===!0}]}return W(e,t.short)}function W(e,t){const n=e.slice(1).split(""),o=[];for(let s=0;s<n.length;s++){const r=n[s],a=t.get(r);if(a===void 0)return[{name:e,needsNext:!1}];if(a){const l=n.slice(s+1).join("");if(l&&![...l].every(m=>t.has(m)))return o.push({name:`-${r}`,value:l,needsNext:!1}),o}o.push({name:`-${r}`,needsNext:a})}return o}function B(e,t=[]){let n=0;for(;n<e.length;){const o=String(e[n]);if(!o.startsWith("-")||o.length<2)break;const s=b(o);let r=n+1;for(const a of s){const l={name:a.name,value:a.value,absorbedNext:!1,isGlobal:!0};a.needsNext&&l.value===void 0&&r<e.length&&(l.value=String(e[r]),l.absorbedNext=!0,r++),t.push(l)}n=r}return{flags:t,taskIndex:n}}function q(e,t,n=[]){const o=j(t),s=[],r=[];let a=0;for(;a<e.length;){const l=e[a];if(h.isPathSpec(l)){r.push(...h.toPaths(l)),a++;continue}const f=String(l);if(f==="--"){for(let g=a+1;g<e.length;g++){const u=e[g];h.isPathSpec(u)?r.push(...h.toPaths(u)):r.push(String(u))}break}if(!f.startsWith("-")||f.length<2){s.push(f),a++;continue}const m=b(f,o);let d=a+1;for(const g of m){const u={name:g.name,value:g.value,absorbedNext:!1,isGlobal:!1};g.needsNext&&u.value===void 0&&d<e.length&&!h.isPathSpec(e[d])&&(u.value=String(e[d]),u.absorbedNext=!0,d++),n.push(u)}a=d}return{flags:n,positionals:s,pathspecs:r}}function*V({write:e}){for(const t of e)for(const n of K){const o=n(t.key);o&&(yield o)}}function c(e,t,n=String(e)){const o=typeof e=="string"?new RegExp(`\\s*${e.toLowerCase()}`):e;return function(r){if(o.test(r))return{category:t,message:`Configuring ${n} is not permitted without enabling ${t}`}}}function i(e,t){const n=new RegExp(`\\s*${e.toLowerCase().replace(/\./g,"(..+)?.")}`);return c(n,t,e)}const K=[c("alias","allowUnsafeAlias"),c("core.askPass","allowUnsafeAskPass"),c("core.editor","allowUnsafeEditor"),c("core.fsmonitor","allowUnsafeFsMonitor"),c("core.gitProxy","allowUnsafeGitProxy"),c("core.hooksPath","allowUnsafeHooksPath"),c("core.pager","allowUnsafePager"),c("core.sshCommand","allowUnsafeSshCommand"),i("credential.helper","allowUnsafeCredentialHelper"),i("diff.command","allowUnsafeDiffExternal"),c("diff.external","allowUnsafeDiffExternal"),i("diff.textconv","allowUnsafeDiffTextConv"),i("filter.clean","allowUnsafeFilter"),i("filter.smudge","allowUnsafeFilter"),i("gpg.program","allowUnsafeGpgProgram"),c("init.templateDir","allowUnsafeTemplateDir"),i("merge.driver","allowUnsafeMergeDriver"),i("mergetool.path","allowUnsafeMergeDriver"),i("mergetool.cmd","allowUnsafeMergeDriver"),i("protocol.allow","allowUnsafeProtocolOverride"),i("remote.receivepack","allowUnsafePack"),i("remote.uploadpack","allowUnsafePack"),c("sequence.editor","allowUnsafeEditor")];function*H(e,t){for(const n of t)for(const o of Y){const s=o(e,n.name);s&&(yield s)}}function w(e,t,n,o=String(t)){const s=typeof t=="string"?new RegExp(`\\s*${t.toLowerCase()}`):t,r=`Use of ${e?`${e} with option `:""}${o} is not permitted without enabling ${n}`;return function(l,f){if((!e||l===e)&&s.test(f))return{category:n,message:r}}}const Y=[w(null,/--(upload|receive)-pack/,"allowUnsafePack","--upload-pack or --receive-pack"),w("clone",/^-\w*u/,"allowUnsafePack"),w("clone","--u","allowUnsafePack"),w("push","--exec","allowUnsafePack"),w(null,"--template","allowUnsafeTemplateDir")];function C(e,t,n){return[...H(e,t),...V(n)]}function x(...e){const{flags:t,taskIndex:n}=B(e),o=n<e.length?String(e[n]).toLowerCase():null,s=o!==null?e.slice(n+1):[],{positionals:r,pathspecs:a}=q(s,o,t),l=$(o,t,r);return{task:o,flags:t.map(J),paths:a,config:l,vulnerabilities:z(C(o,t,l))}}function z(e){return Object.defineProperty(e,"vulnerabilities",{value:e})}function J({value:e,name:t}){return e!==void 0?{name:t,value:e}:{name:t}}const y={editor:"allowUnsafeEditor",git_askpass:"allowUnsafeAskPass",git_config_global:"allowUnsafeConfigPaths",git_config_system:"allowUnsafeConfigPaths",git_config_count:"allowUnsafeConfigEnvCount",git_config:"allowUnsafeConfigPaths",git_editor:"allowUnsafeEditor",git_exec_path:"allowUnsafeConfigPaths",git_external_diff:"allowUnsafeDiffExternal",git_pager:"allowUnsafePager",git_proxy_command:"allowUnsafeGitProxy",git_template_dir:"allowUnsafeTemplateDir",git_sequence_editor:"allowUnsafeEditor",git_ssh:"allowUnsafeSshCommand",git_ssh_command:"allowUnsafeSshCommand",pager:"allowUnsafePager",prefix:"allowUnsafeConfigPaths",ssh_askpass:"allowUnsafeAskPass"};function*Q(e){const t=parseInt(e.git_config_count??"0",10);for(let n=0;n<t;n++){const o=e[`git_config_key_${n}`],s=e[`git_config_value_${n}`];o!==void 0&&(yield{key:o.toLowerCase().trim(),value:s,scope:"env"})}}function*X(e){for(const t of Object.keys(e))if(k(t)){const n=y[t];yield{category:n,message:`Use of "${t.toUpperCase()}" is not permitted without enabling ${n}`}}}function k(e){return Object.hasOwn(y,e)}function Z(e){const t={};for(const[n,o]of Object.entries(e)){const s=n.toLowerCase().trim();(k(s)||s.startsWith("git"))&&(t[s]=String(o))}return t}function _(e){const t=Z(e),n={read:[],write:[...Q(t)]},o=[...X(t),...C(null,[],n)];return{config:n,vulnerabilities:o}}function ee(e,t){return[...x(...e).vulnerabilities,..._(t).vulnerabilities]}exports.parseArgv=x;exports.parseEnv=_;exports.vulnerabilityCheck=ee;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const m=require("@simple-git/args-pathspec");function*x(e,t){const n=t==="global";for(const a of e)a.isGlobal===n&&(yield a)}const S=new Set(["--add","--edit","--remove-section","--rename-section","--replace-all","--unset","--unset-all","-e"]),E=new Set(["--get","--get-all","--get-color","--get-colorbool","--get-regexp","--get-urlmatch","--list","-l"]),F=new Set(["edit","remove-section","rename-section","set","unset"]),A=new Set(["get","get-color","get-colorbool","list"]);function O(e,t){for(const{name:a}of x(e,"task")){if(S.has(a))return w(!0,t);if(E.has(a))return w(!1,t)}const n=t.at(0)?.toLowerCase();return n===void 0?null:F.has(n)?w(!0,t.slice(1)):A.has(n)?w(!1,t.slice(1)):t.length===1?w(!1,t):w(!0,t)}function w(e=!1,t=[]){const n=t.at(0)?.toLowerCase();return n===void 0?null:{isWrite:e,isRead:!e,key:n,value:t.at(1)}}function G(e,t){return t.isWrite&&t.value!==void 0?{key:t.key,value:t.value,scope:e}:{key:t.key,scope:e}}function M(e){const t=e?.indexOf("=")||-1;return!e||t<0?null:{key:e.slice(0,t).trim().toLowerCase(),value:e.slice(t+1)}}function N(e){for(const{name:t}of x(e,"task"))switch(t){case"--global":return"global";case"--system":return"system";case"--worktree":return"worktree";case"--local":return"local";case"--file":case"-f":return"file"}return"local"}function $({name:e}){if(e==="-c"||e==="--config")return"inline";if(e==="--config-env")return"env"}function*D(e){for(const t of e){const n=$(t),a=n&&M(t.value);a&&(yield{...a,scope:n})}}function L(e,t,n){const a={read:[],write:[...D(t)]};return e==="config"&&I(a,N(t),O(t,n)),a}function I(e,t,n){if(n===null)return;const a=G(t,n);n.isWrite?e.write.push(a):e.read.push(a)}const b={short:new Map([["c",!0]])},T={short:new Map([["C",!0],["P",!1],["h",!1],["p",!1],["v",!1],...b.short.entries()]),long:new Set(["attr-source","config-env","exec-path","git-dir","list-cmds","namespace","super-prefix","work-tree"])},R={clone:{short:new Map([["b",!0],["j",!0],["l",!1],["n",!1],["o",!0],["q",!1],["s",!1],["u",!0]]),long:new Set(["branch","config","jobs","origin","upload-pack","u","template"])},commit:{short:new Map([["C",!0],["F",!0],["c",!0],["m",!0],["t",!0]]),long:new Set(["file","message","reedit-message","reuse-message","template"])},config:{short:new Map([["e",!1],["f",!0],["l",!1]]),long:new Set(["blob","comment","default","file","type","value"])},fetch:{short:new Map,long:new Set(["upload-pack"])},init:{short:new Map,long:new Set(["template"])},pull:{short:new Map,long:new Set(["upload-pack"])},push:{short:new Map,long:new Set(["exec","receive-pack"])},rebase:{short:new Map([["X",!0],["f",!1],["i",!1],["k",!1],["m",!1],["n",!1],["q",!1],["r",!1],["s",!0],["v",!1],["x",!0]]),long:new Set(["exec","onto","strategy","strategy-option"])}},j={short:new Map,long:new Set};function B(e){const t=R[e??""]??j;return{short:new Map([...b.short.entries(),...t.short.entries()]),long:t.long}}function C(e,t=T){if(e.startsWith("--")){const n=e.indexOf("=");if(n>2)return[{name:e.slice(0,n),value:e.slice(n+1),needsNext:!1}];const a=e.slice(2);return[{name:e,needsNext:t.long.has(a)}]}if(e.length===2){const n=e.charAt(1),a=t.short.get(n);return[{name:e,needsNext:a===!0}]}return W(e,t.short)}function W(e,t){const n=e.slice(1).split(""),a=[];for(let o=0;o<n.length;o++){const s=n[o],r=t.get(s);if(r===void 0)return[{name:e,needsNext:!1}];if(r){const i=n.slice(o+1).join("");if(i&&![...i].every(h=>t.has(h)))return a.push({name:`-${s}`,value:i,needsNext:!1}),a}a.push({name:`-${s}`,needsNext:r})}return a}function q(e,t=[]){let n=0;for(;n<e.length;){const a=String(e[n]);if(!a.startsWith("-")||a.length<2)break;const o=C(a);let s=n+1;for(const r of o){const i={name:r.name,value:r.value,absorbedNext:!1,isGlobal:!0};r.needsNext&&i.value===void 0&&s<e.length&&(i.value=String(e[s]),i.absorbedNext=!0,s++),t.push(i)}n=s}return{flags:t,taskIndex:n}}function V(e,t,n=[]){const a=B(t),o=[],s=[];let r=0;for(;r<e.length;){const i=e[r];if(m.isPathSpec(i)){s.push(...m.toPaths(i)),r++;continue}const p=String(i);if(p==="--"){for(let d=r+1;d<e.length;d++){const g=e[d];m.isPathSpec(g)?s.push(...m.toPaths(g)):s.push(String(g))}break}if(!p.startsWith("-")||p.length<2){o.push(p),r++;continue}const h=C(p,a);let u=r+1;for(const d of h){const g={name:d.name,value:d.value,absorbedNext:!1,isGlobal:!1};d.needsNext&&g.value===void 0&&u<e.length&&!m.isPathSpec(e[u])&&(g.value=String(e[u]),g.absorbedNext=!0,u++),n.push(g)}r=u}return{flags:n,positionals:o,pathspecs:s}}function*K({write:e}){for(const t of e)for(const n of H){const a=n(t.key);a&&(yield a)}}function f(e,t,n=String(e)){const a=typeof e=="string"?new RegExp(`\\s*${e.toLowerCase()}`):e;return function(s){if(a.test(s))return{category:t,message:`Configuring ${n} is not permitted without enabling ${t}`}}}function l(e,t){const n=new RegExp(`\\s*${e.toLowerCase().replace(/\./g,"(..+)?.")}`);return f(n,t,e)}const H=[f("alias","allowUnsafeAlias"),f("core.askPass","allowUnsafeAskPass"),f("core.editor","allowUnsafeEditor"),f("core.fsmonitor","allowUnsafeFsMonitor"),f("core.gitProxy","allowUnsafeGitProxy"),f("core.hooksPath","allowUnsafeHooksPath"),f("core.pager","allowUnsafePager"),f("core.sshCommand","allowUnsafeSshCommand"),l("credential.helper","allowUnsafeCredentialHelper"),l("diff.command","allowUnsafeDiffExternal"),f("diff.external","allowUnsafeDiffExternal"),l("difftool.cmd","allowUnsafeDiffExternal"),l("diff.textconv","allowUnsafeDiffTextConv"),l("filter.clean","allowUnsafeFilter"),l("filter.process","allowUnsafeFilter"),l("filter.smudge","allowUnsafeFilter"),l("gpg.program","allowUnsafeGpgProgram"),f("include.path","allowUnsafeInclude"),l("includeIf","allowUnsafeInclude"),f("init.templateDir","allowUnsafeTemplateDir"),l("pager.","allowUnsafePager"),l("merge.driver","allowUnsafeMergeDriver"),l("mergetool.path","allowUnsafeMergeDriver"),l("mergetool.cmd","allowUnsafeMergeDriver"),l("protocol.allow","allowUnsafeProtocolOverride"),l("remote.receivepack","allowUnsafePack"),l("remote.uploadpack","allowUnsafePack"),f("uploadpack.packObjectsHook","allowUnsafePack"),f("sequence.editor","allowUnsafeEditor"),l("submodule.update","allowUnsafeSubmodule"),l("tar.command","allowUnsafeCommandBinaries"),l("trailer.cmd","allowUnsafeCommandBinaries"),l("trailer.command","allowUnsafeCommandBinaries"),l("url.insteadOf","allowUnsafeUrlRewrite")];function*X(e,t){for(const n of t)for(const a of Y){const o=a(e,n);o&&(yield o)}}function c(e,t,n,{name:a=String(t),globalOnly:o=!1,withValue:s=!1}={}){const r=typeof t=="string"?new RegExp(`\\s*${t.toLowerCase()}`):t,i=`Use of ${e?`${e} with option `:""}${a} is not permitted without enabling ${n}`;return function(h,u){if(!(e&&h!==e)&&!(o&&!u.isGlobal)&&!(s&&u.value===void 0)&&r.test(u.name))return{category:n,message:i}}}const v={globalOnly:!0,withValue:!0},Y=[c(null,/--(upload|receive)-pack/,"allowUnsafePack",{name:"--upload-pack or --receive-pack"}),c("clone",/^-\w*u/,"allowUnsafePack"),c("clone","--u","allowUnsafePack"),c("push",/^--exec$/,"allowUnsafePack",{name:"--exec"}),c("rebase",/^(-x|--ex(ec?)?)$/,"allowUnsafeExec",{name:"-x or --exec"}),c(null,"--template","allowUnsafeTemplateDir"),c(null,"--exec-path","allowUnsafeExec",v),c(null,"--git-dir","allowUnsafeConfigPaths",v),c(null,"--work-tree","allowUnsafeConfigPaths",v),c(null,/^-C$/,"allowUnsafeConfigPaths",{...v,name:"-C"})];function k(e,t,n){return[...X(e,t),...K(n)]}function y(...e){const{flags:t,taskIndex:n}=q(e),a=n<e.length?String(e[n]).toLowerCase():null,o=a!==null?e.slice(n+1):[],{positionals:s,pathspecs:r}=V(o,a,t),i=L(a,t,s);return{task:a,flags:t.map(J),paths:r,config:i,vulnerabilities:z(k(a,t,i))}}function z(e){return Object.defineProperty(e,"vulnerabilities",{value:e})}function J({value:e,name:t}){return e!==void 0?{name:t,value:e}:{name:t}}const _={editor:"allowUnsafeEditor",git_askpass:"allowUnsafeAskPass",git_config_global:"allowUnsafeConfigPaths",git_config_system:"allowUnsafeConfigPaths",git_config_count:"allowUnsafeConfigEnvCount",git_config_parameters:"allowUnsafeConfigEnvCount",git_config:"allowUnsafeConfigPaths",git_editor:"allowUnsafeEditor",git_exec_path:"allowUnsafeExec",git_external_diff:"allowUnsafeDiffExternal",git_pager:"allowUnsafePager",git_proxy_command:"allowUnsafeGitProxy",git_template_dir:"allowUnsafeTemplateDir",git_sequence_editor:"allowUnsafeEditor",git_ssh:"allowUnsafeSshCommand",git_ssh_command:"allowUnsafeSshCommand",pager:"allowUnsafePager",prefix:"allowUnsafeConfigPaths",ssh_askpass:"allowUnsafeAskPass",visual:"allowUnsafeEditor"};function*Q(e){const t=parseInt(e.git_config_count??"0",10);for(let n=0;n<t;n++){const a=e[`git_config_key_${n}`],o=e[`git_config_value_${n}`];a!==void 0&&(yield{key:a.toLowerCase().trim(),value:o,scope:"env"})}}function*Z(e){for(const t of Object.keys(e))if(U(t)){const n=_[t];yield{category:n,message:`Use of "${t.toUpperCase()}" is not permitted without enabling ${n}`}}}function U(e){return Object.hasOwn(_,e)}function ee(e){const t={};for(const[n,a]of Object.entries(e)){const o=n.toLowerCase().trim();(U(o)||o.startsWith("git"))&&(t[o]=String(a))}return t}function P(e){const t=ee(e),n={read:[],write:[...Q(t)]},a=[...Z(t),...k(null,[],n)];return{config:n,vulnerabilities:a}}function te(e,t){return[...y(...e).vulnerabilities,...P(t).vulnerabilities]}exports.isGitEnvKey=U;exports.parseArgv=y;exports.parseEnv=P;exports.vulnerabilityCheck=te;
 //# sourceMappingURL=index.cjs.map

package/node_modules/@simple-git/argv-parser/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":["../src/flags/flags.helpers.ts","../src/config/config-operands.ts","../src/config/detect-config-action.ts","../src/config/analyse-config.ts","../src/tokens/flag-specs.ts","../src/tokens/token-expander.ts","../src/flags/parse-global-flags.ts","../src/flags/parse-task-flags.ts","../src/vulnerabilities/detect-vulnerable-config-writes.ts","../src/vulnerabilities/detect-vulnerable-flags.ts","../src/vulnerabilities/vulnerability-analysis.ts","../src/args/parse-argv.ts","../src/env/parse-env.ts","../src/vulnerabilities/vulnerability-check.ts"],"sourcesContent":["export interface Flag {\n   name: string;\n   value?: string;\n   /** Value came from the next token rather than being embedded after `=`. */\n   absorbedNext: boolean;\n   /** Switch appeared before the git sub-command. */\n   isGlobal: boolean;\n}\n\nexport function* scopedFlags(flags: Flag[], scope: 'global' | 'task') {\n   const findGlobal = scope === 'global';\n   for (const flag of flags) {\n      if (flag.isGlobal === findGlobal) {\n         yield flag;\n      }\n   }\n}\n","// Flags that unambiguously signal a write operation on git config.\nexport const CONFIG_WRITE_FLAGS = new Set([\n   '--add',\n   '--edit',\n   '--remove-section',\n   '--rename-section',\n   '--replace-all',\n   '--unset',\n   '--unset-all',\n   '-e',\n]);\n\n// Flags that unambiguously signal a read operation.\nexport const CONFIG_READ_FLAGS = new Set([\n   '--get',\n   '--get-all',\n   '--get-color',\n   '--get-colorbool',\n   '--get-regexp',\n   '--get-urlmatch',\n   '--list',\n   '-l',\n]);\n\n// Sub-command verbs accepted as the first positional by newer git versions.\nexport const CONFIG_WRITE_VERBS = new Set([\n   'edit',\n   'remove-section',\n   'rename-section',\n   'set',\n   'unset',\n]);\nexport const CONFIG_READ_VERBS = new Set(['get', 'get-color', 'get-colorbool', 'list']);\n","import type { ConfigScope } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport {\n   CONFIG_READ_FLAGS,\n   CONFIG_READ_VERBS,\n   CONFIG_WRITE_FLAGS,\n   CONFIG_WRITE_VERBS,\n} from './config-operands';\n\nexport function detectConfigAction(flags: Flag[], positionals: string[]): ConfigOperation | null {\n   for (const { name } of scopedFlags(flags, 'task')) {\n      if (CONFIG_WRITE_FLAGS.has(name)) {\n         return configOperation(true, positionals);\n      }\n      if (CONFIG_READ_FLAGS.has(name)) {\n         return configOperation(false, positionals);\n      }\n   }\n\n   const verb = positionals.at(0)?.toLowerCase();\n\n   if (verb === undefined) {\n      return null;\n   }\n\n   if (CONFIG_WRITE_VERBS.has(verb)) {\n      return configOperation(true, positionals.slice(1));\n   }\n\n   if (CONFIG_READ_VERBS.has(verb)) {\n      return configOperation(false, positionals.slice(1));\n   }\n\n   if (positionals.length === 1) {\n      return configOperation(false, positionals);\n   }\n\n   return configOperation(true, positionals);\n}\n\nfunction configOperation(isWrite = false, positionals: string[] = []): ConfigOperation | null {\n   const key = positionals.at(0)?.toLowerCase();\n\n   if (key === undefined) {\n      return null;\n   }\n\n   return {\n      isWrite,\n      isRead: !isWrite,\n      key,\n      value: positionals.at(1),\n   };\n}\n\nexport function toOperation(scope: ConfigScope, operation: ConfigOperation) {\n   if (operation.isWrite && operation.value !== undefined) {\n      return { key: operation.key, value: operation.value, scope };\n   }\n   return { key: operation.key, scope };\n}\n","import type { ConfigScope, ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport { detectConfigAction, toOperation } from './detect-config-action';\n\nfunction parseAssignment(raw: string | undefined): { key: string; value: string } | null {\n   const eq = raw?.indexOf('=') || -1;\n\n   if (!raw || eq < 0) {\n      return null;\n   }\n\n   return {\n      key: raw.slice(0, eq).trim().toLowerCase(),\n      value: raw.slice(eq + 1),\n   };\n}\n\nfunction detectConfigScope(flags: Flag[]): ConfigScope {\n   for (const { name } of scopedFlags(flags, 'task')) {\n      switch (name) {\n         case '--global':\n            return 'global';\n         case '--system':\n            return 'system';\n         case '--worktree':\n            return 'worktree';\n         case '--local':\n            return 'local';\n         case '--file':\n         case '-f':\n            return 'file';\n      }\n   }\n   return 'local';\n}\n\nfunction detectConfigOverrideScope({ name }: Flag): ConfigScope | void {\n   if (name === '-c' || name === '--config') {\n      return 'inline';\n   }\n   if (name === '--config-env') {\n      return 'env';\n   }\n}\n\n/**\n * Generates the stream of ConfigWrite settings found in the supplied flags,\n * triggered by `-c` and `--config` for inline configuration and `--config-env`\n * to set a config setting based on environment variable.\n */\nfunction* collectWriteFlags(flags: Flag[]): Generator<ConfigWrite> {\n   for (const flag of flags) {\n      const scope = detectConfigOverrideScope(flag);\n      const assignment = scope && parseAssignment(flag.value);\n\n      if (assignment) {\n         yield {\n            ...assignment,\n            scope,\n         };\n      }\n   }\n}\n\nexport function collectConfigAccess(\n   task: string | null,\n   flags: Flag[],\n   positionals: string[]\n): ParsedConfigActivity {\n   const parsedConfig: ParsedConfigActivity = {\n      read: [],\n      write: [...collectWriteFlags(flags)],\n   };\n\n   if (task === 'config') {\n      appendParsedConfigAction(\n         parsedConfig,\n         detectConfigScope(flags),\n         detectConfigAction(flags, positionals)\n      );\n   }\n\n   return parsedConfig;\n}\n\nfunction appendParsedConfigAction(\n   parsedConfig: ParsedConfigActivity,\n   scope: ConfigScope,\n   action: ConfigOperation | null\n) {\n   if (action === null) {\n      return;\n   }\n\n   const config = toOperation(scope, action);\n   if (action.isWrite) {\n      parsedConfig.write.push(config);\n   } else {\n      parsedConfig.read.push(config);\n   }\n}\n","// ── Option tables ─────────────────────────────────────────────────────────────\n//\n// Each scope has:\n//   short  – Map<char, consumesNext>  (known single-letter switches; true = takes next token)\n//   long   – Set<stem>                (long switch stems, without --, that take the next token)\n//\n// Only switches listed here are \"known\". An unknown char anywhere in a combined\n// cluster causes the entire cluster to be kept as one opaque token.\n\nexport interface FlagSpec {\n   readonly short: ReadonlyMap<string, boolean>;\n   readonly long: ReadonlySet<string>;\n}\n\nconst UNIVERSAL: FlagSpec = {\n   short: new Map([\n      ['c', true], //  -c <k=v>    set config key for this invocation\n   ]),\n   long: new Set(),\n};\n\nexport const GLOBAL: FlagSpec = {\n   short: new Map([\n      ['C', true], //  -C <path>   change working directory\n      ['P', false], // -P          no pager (alias for --no-pager)\n      ['h', false], // -h          help\n      ['p', false], // -p          paginate\n      ['v', false], // -v          version\n      ...UNIVERSAL.short.entries(),\n   ]),\n   long: new Set([\n      'attr-source',\n      'config-env',\n      'exec-path',\n      'git-dir',\n      'list-cmds',\n      'namespace',\n      'super-prefix',\n      'work-tree',\n   ]),\n};\n\nconst COMMANDS: Record<string, FlagSpec> = {\n   clone: {\n      short: new Map([\n         ['b', true], // -b <branch>\n         ['j', true], // -j <n>          parallel jobs\n         ['l', false], // -l local\n         ['n', false], // -n no-checkout\n         ['o', true], // -o <name>       remote name\n         ['q', false], // -q quiet\n         ['s', false], // -s shared\n         ['u', true], // -u <upload-pack>\n      ]),\n      long: new Set(['branch', 'config', 'jobs', 'origin', 'upload-pack', 'u', 'template']),\n   },\n   commit: {\n      short: new Map([\n         ['C', true], // -C <commit>  reuse message\n         ['F', true], // -F <file>    read message from file\n         ['c', true], // -c <commit>  reedit message\n         ['m', true], // -m <msg>\n         ['t', true], // -t <template>\n      ]),\n      long: new Set(['file', 'message', 'reedit-message', 'reuse-message', 'template']),\n   },\n   config: {\n      short: new Map([\n         ['e', false], // -e  open editor\n         ['f', true], //  -f <file>\n         ['l', false], // -l  list\n      ]),\n      long: new Set(['blob', 'comment', 'default', 'file', 'type', 'value']),\n   },\n   fetch: {\n      short: new Map(),\n      long: new Set(['upload-pack']),\n   },\n   init: {\n      short: new Map(),\n      long: new Set(['template']),\n   },\n   pull: {\n      short: new Map(),\n      long: new Set(['upload-pack']),\n   },\n   push: {\n      short: new Map(),\n      long: new Set(['exec', 'receive-pack']),\n   },\n};\n\nconst EMPTY: FlagSpec = { short: new Map(), long: new Set() };\n\nexport function getFlagSpecForTask(task?: string | null) {\n   const spec = COMMANDS[task ?? ''] ?? EMPTY;\n\n   return {\n      short: new Map([...UNIVERSAL.short.entries(), ...spec.short.entries()]),\n      long: spec.long,\n   };\n}\n","import { GLOBAL } from './flag-specs';\n\n/** Parse a single raw token (e.g. `'-m'`, `'--amend'`, `'-uc'`) into one or\n *  more switch descriptors.  Values are not yet resolved for needsNext=true. */\nexport function expandToken(\n   raw: string,\n   spec = GLOBAL\n): Array<{\n   name: string;\n   value?: string;\n   needsNext: boolean;\n}> {\n   if (raw.startsWith('--')) {\n      const eq = raw.indexOf('=');\n      if (eq > 2) {\n         return [{ name: raw.slice(0, eq), value: raw.slice(eq + 1), needsNext: false }];\n      }\n      const stem = raw.slice(2);\n      return [{ name: raw, needsNext: spec.long.has(stem) }];\n   }\n\n   // Single short switch\n   if (raw.length === 2) {\n      const char = raw.charAt(1);\n      const consumes = spec.short.get(char);\n      return [{ name: raw, needsNext: consumes === true }];\n   }\n\n   // Combined short cluster: try to expand char-by-char\n   return expandCluster(raw, spec.short);\n}\n\nfunction expandCluster(\n   raw: string,\n   shortSpec: ReadonlyMap<string, boolean>\n): Array<{ name: string; value?: string; needsNext: boolean }> {\n   const chars = raw.slice(1).split('');\n   const result: Array<{ name: string; value?: string; needsNext: boolean }> = [];\n\n   for (let i = 0; i < chars.length; i++) {\n      const char = chars[i];\n      const consumes = shortSpec.get(char);\n\n      if (consumes === undefined) {\n         // Unknown char: keep the whole raw token as opaque\n         return [{ name: raw, needsNext: false }];\n      }\n\n      if (consumes) {\n         const remainder = chars.slice(i + 1).join('');\n         if (remainder) {\n            const remainderAllKnown = [...remainder].every((c) => shortSpec.has(c));\n            if (!remainderAllKnown) {\n               // Remaining chars are the embedded value, not separate flags\n               result.push({ name: `-${char}`, value: remainder, needsNext: false });\n               return result;\n            }\n         }\n      }\n\n      result.push({ name: `-${char}`, needsNext: consumes });\n   }\n\n   return result;\n}\n","import { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\nexport interface GlobalFlags {\n   flags: Flag[];\n   taskIndex: number;\n}\n\nexport function parseGlobalFlags(tokens: readonly unknown[], flags: Flag[] = []): GlobalFlags {\n   let i = 0;\n\n   while (i < tokens.length) {\n      const raw = String(tokens[i]);\n      if (!raw.startsWith('-') || raw.length < 2) break;\n\n      const parsed = expandToken(raw);\n      let next = i + 1;\n\n      for (const token of parsed) {\n         const flag: Flag = {\n            name: token.name,\n            value: token.value,\n            absorbedNext: false,\n            isGlobal: true,\n         };\n         if (token.needsNext && flag.value === undefined && next < tokens.length) {\n            flag.value = String(tokens[next]);\n            flag.absorbedNext = true;\n            next++;\n         }\n         flags.push(flag);\n      }\n\n      i = next;\n   }\n\n   return { flags, taskIndex: i };\n}\n","import { isPathSpec, toPaths } from '@simple-git/args-pathspec';\n\nimport { getFlagSpecForTask } from '../tokens/flag-specs';\nimport { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\ntype TaskFlags = {\n   flags: Flag[];\n   positionals: string[];\n   pathspecs: string[];\n};\n\nexport function parseTaskFlags(\n   tokens: readonly unknown[],\n   task: string | null,\n   flags: Flag[] = []\n): TaskFlags {\n   const spec = getFlagSpecForTask(task);\n   const positionals: string[] = [];\n   const pathspecs: string[] = [];\n\n   let i = 0;\n   while (i < tokens.length) {\n      const current = tokens[i];\n\n      if (isPathSpec(current)) {\n         pathspecs.push(...toPaths(current as string));\n         i++;\n         continue;\n      }\n\n      const raw = String(current);\n\n      if (raw === '--') {\n         for (let j = i + 1; j < tokens.length; j++) {\n            const t = tokens[j];\n            isPathSpec(t) ? pathspecs.push(...toPaths(t as string)) : pathspecs.push(String(t));\n         }\n         break;\n      }\n\n      if (!raw.startsWith('-') || raw.length < 2) {\n         positionals.push(raw);\n         i++;\n         continue;\n      }\n\n      const parsed = expandToken(raw, spec);\n      let next = i + 1;\n\n      for (const token of parsed) {\n         const flag: Flag = {\n            name: token.name,\n            value: token.value,\n            absorbedNext: false,\n            isGlobal: false,\n         };\n         if (\n            token.needsNext &&\n            flag.value === undefined &&\n            next < tokens.length &&\n            !isPathSpec(tokens[next])\n         ) {\n            flag.value = String(tokens[next]);\n            flag.absorbedNext = true;\n            next++;\n         }\n         flags.push(flag);\n      }\n\n      i = next;\n   }\n\n   return { flags, positionals, pathspecs };\n}\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function* detectVulnerableConfigWrites({\n   write,\n}: ParsedConfigActivity): Generator<Vulnerability> {\n   for (const config of write) {\n      for (const helper of preventUnsafeConfig) {\n         const vulnerability = helper(config.key);\n         if (vulnerability) {\n            yield vulnerability;\n         }\n      }\n   }\n}\n\nfunction preventConfigBuilder(\n   config: string | RegExp,\n   category: VulnerabilityCategory,\n   message = String(config)\n) {\n   const regex = typeof config === 'string' ? new RegExp(`\\\\s*${config.toLowerCase()}`) : config;\n\n   return function preventCommand(key: string): Vulnerability | void {\n      if (regex.test(key)) {\n         return {\n            category,\n            message: `Configuring ${message} is not permitted without enabling ${category}`,\n         };\n      }\n   };\n}\n\nfunction preventExpandedConfigBuilder(config: string, category: VulnerabilityCategory) {\n   const regex = new RegExp(`\\\\s*${config.toLowerCase().replace(/\\./g, '(\\..+)?.')}`);\n   return preventConfigBuilder(regex, category, config);\n}\n\nconst preventUnsafeConfig = [\n   preventConfigBuilder('alias', 'allowUnsafeAlias'),\n   preventConfigBuilder('core.askPass', 'allowUnsafeAskPass'),\n   preventConfigBuilder('core.editor', 'allowUnsafeEditor'),\n   preventConfigBuilder('core.fsmonitor', 'allowUnsafeFsMonitor'),\n   preventConfigBuilder('core.gitProxy', 'allowUnsafeGitProxy'),\n   preventConfigBuilder('core.hooksPath', 'allowUnsafeHooksPath'),\n   preventConfigBuilder('core.pager', 'allowUnsafePager'),\n   preventConfigBuilder('core.sshCommand', 'allowUnsafeSshCommand'),\n   preventExpandedConfigBuilder('credential.helper', 'allowUnsafeCredentialHelper'),\n   preventExpandedConfigBuilder('diff.command', 'allowUnsafeDiffExternal'),\n   preventConfigBuilder('diff.external', 'allowUnsafeDiffExternal'),\n   preventExpandedConfigBuilder('diff.textconv', 'allowUnsafeDiffTextConv'),\n   preventExpandedConfigBuilder('filter.clean', 'allowUnsafeFilter'),\n   preventExpandedConfigBuilder('filter.smudge', 'allowUnsafeFilter'),\n   preventExpandedConfigBuilder('gpg.program', 'allowUnsafeGpgProgram'),\n   preventConfigBuilder('init.templateDir', 'allowUnsafeTemplateDir'),\n   preventExpandedConfigBuilder('merge.driver', 'allowUnsafeMergeDriver'),\n   preventExpandedConfigBuilder('mergetool.path', 'allowUnsafeMergeDriver'),\n   preventExpandedConfigBuilder('mergetool.cmd', 'allowUnsafeMergeDriver'),\n   preventExpandedConfigBuilder('protocol.allow', 'allowUnsafeProtocolOverride'),\n   preventExpandedConfigBuilder('remote.receivepack', 'allowUnsafePack'),\n   preventExpandedConfigBuilder('remote.uploadpack', 'allowUnsafePack'),\n   preventConfigBuilder('sequence.editor', 'allowUnsafeEditor'),\n];\n","import type { Flag } from '../flags/flags.helpers';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function* detectVulnerableFlags(\n   task: null | string,\n   flags: Flag[]\n): Generator<Vulnerability> {\n   for (const flag of flags) {\n      for (const helper of preventUnsafeFlags) {\n         const vulnerability = helper(task, flag.name);\n         if (vulnerability) {\n            yield vulnerability;\n         }\n      }\n   }\n}\n\nfunction preventFlagBuilder(\n   task: string | null,\n   flag: string | RegExp,\n   category: VulnerabilityCategory,\n   name = String(flag)\n) {\n   const regex = typeof flag === 'string' ? new RegExp(`\\\\s*${flag.toLowerCase()}`) : flag;\n   const message = `Use of ${task ? `${task} with option ` : ''}${name} is not permitted without enabling ${category}`;\n\n   return function preventFlag(currentTask: string | null, flagName: string): Vulnerability | void {\n      if ((!task || currentTask === task) && regex.test(flagName)) {\n         return {\n            category,\n            message,\n         };\n      }\n   };\n}\n\nconst preventUnsafeFlags = [\n   preventFlagBuilder(\n      null,\n      /--(upload|receive)-pack/,\n      'allowUnsafePack',\n      '--upload-pack or --receive-pack'\n   ),\n   preventFlagBuilder('clone', /^-\\w*u/, 'allowUnsafePack'),\n   preventFlagBuilder('clone', '--u', 'allowUnsafePack'),\n   preventFlagBuilder('push', '--exec', 'allowUnsafePack'),\n   preventFlagBuilder(null, '--template', 'allowUnsafeTemplateDir'),\n];\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Flag } from '../flags/flags.helpers';\nimport { detectVulnerableConfigWrites } from './detect-vulnerable-config-writes';\nimport { detectVulnerableFlags } from './detect-vulnerable-flags';\nimport type { Vulnerability } from './vulnerability.types';\n\nexport function vulnerabilityAnalysis(\n   task: null | string,\n   flags: Flag[],\n   config: ParsedConfigActivity\n): Vulnerability[] {\n   return [...detectVulnerableFlags(task, flags), ...detectVulnerableConfigWrites(config)];\n}\n","import { collectConfigAccess } from '../config/analyse-config';\nimport type { Flag } from '../flags/flags.helpers';\nimport { parseGlobalFlags } from '../flags/parse-global-flags';\nimport { parseTaskFlags } from '../flags/parse-task-flags';\nimport type { Vulnerability } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\nimport type { ParsedArgv, ParsedFlag } from './parse-argv.types';\n\n/**\n * Parse the tokens that would be forwarded to a `git` child-process and\n * return a structured summary of what the invocation does.\n */\nexport function parseArgv(...tokens: readonly unknown[]): ParsedArgv {\n   const { flags, taskIndex } = parseGlobalFlags(tokens);\n\n   const task = taskIndex < tokens.length ? String(tokens[taskIndex]).toLowerCase() : null;\n   const taskTokens = task !== null ? tokens.slice(taskIndex + 1) : [];\n\n   const { positionals, pathspecs } = parseTaskFlags(taskTokens, task, flags);\n   const config = collectConfigAccess(task, flags, positionals);\n\n   return {\n      task,\n      flags: flags.map(toParsedFlag),\n      paths: pathspecs,\n      config,\n      vulnerabilities: vulnerabilityList(vulnerabilityAnalysis(task, flags, config)),\n   };\n}\n\nfunction vulnerabilityList(vulnerabilities: Vulnerability[]) {\n   return Object.defineProperty(vulnerabilities, 'vulnerabilities', {\n      value: vulnerabilities,\n   });\n}\n\nfunction toParsedFlag({ value, name }: Flag): ParsedFlag {\n   return value !== undefined ? { name, value } : { name };\n}\n","import type { ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\n\nconst GitEnvKeys = {\n   'editor': 'allowUnsafeEditor',\n   'git_askpass': 'allowUnsafeAskPass',\n   'git_config_global': 'allowUnsafeConfigPaths',\n   'git_config_system': 'allowUnsafeConfigPaths',\n   'git_config_count': 'allowUnsafeConfigEnvCount',\n   'git_config': 'allowUnsafeConfigPaths',\n   'git_editor': 'allowUnsafeEditor',\n   'git_exec_path': 'allowUnsafeConfigPaths',\n   'git_external_diff': 'allowUnsafeDiffExternal',\n   'git_pager': 'allowUnsafePager',\n   'git_proxy_command': 'allowUnsafeGitProxy',\n   'git_template_dir': 'allowUnsafeTemplateDir',\n   'git_sequence_editor': 'allowUnsafeEditor',\n   'git_ssh': 'allowUnsafeSshCommand',\n   'git_ssh_command': 'allowUnsafeSshCommand',\n   'pager': 'allowUnsafePager',\n   'prefix': 'allowUnsafeConfigPaths',\n   'ssh_askpass': 'allowUnsafeAskPass',\n} as const satisfies Record<string, VulnerabilityCategory>;\n\ntype GitEnv = Record<string, string> & {\n   git_config_count?: string;\n};\n\nfunction* collectConfigByCount(env: GitEnv): Generator<ConfigWrite> {\n   const count = parseInt(env.git_config_count ?? '0', 10);\n   for (let index = 0; index < count; index++) {\n      const key = env[`git_config_key_${index}`];\n      const value = env[`git_config_value_${index}`];\n\n      if (key !== undefined) {\n         yield { key: key.toLowerCase().trim(), value, scope: 'env' };\n      }\n   }\n}\n\nfunction* collectConfigVulnerabilities(env: GitEnv): Generator<Vulnerability> {\n   for (const key of Object.keys(env)) {\n      if (isGitEnvKey(key)) {\n         const category = GitEnvKeys[key];\n         yield {\n            category,\n            message: `Use of \"${key.toUpperCase()}\" is not permitted without enabling ${category}`,\n         };\n      }\n   }\n}\n\nfunction isGitEnvKey(key: string): key is keyof typeof GitEnvKeys {\n   return Object.hasOwn(GitEnvKeys, key);\n}\n\nfunction prepareEnv(env: Record<string, unknown>): GitEnv {\n   const gitEnv: GitEnv = {};\n   for (const [key, value] of Object.entries(env)) {\n      const envKey = key.toLowerCase().trim();\n      if (isGitEnvKey(envKey) || envKey.startsWith('git')) {\n         gitEnv[envKey] = String(value);\n      }\n   }\n   return gitEnv;\n}\n\nexport function parseEnv(raw: Record<string, unknown>) {\n   const env = prepareEnv(raw);\n   const config: ParsedConfigActivity = {\n      read: [],\n      write: [...collectConfigByCount(env)],\n   };\n   const vulnerabilities = [\n      ...collectConfigVulnerabilities(env),\n      ...vulnerabilityAnalysis(null, [], config),\n   ];\n\n   return {\n      config,\n      vulnerabilities,\n   };\n}\n","import { parseArgv } from '../args/parse-argv';\nimport { parseEnv } from '../env/parse-env';\n\n/**\n * Retrieves just the vulnerabilities identified in the supplied varargs tokens\n * and environment variables.\n */\nexport function vulnerabilityCheck(tokens: readonly string[], env: Record<string, unknown>) {\n   return [...parseArgv(...tokens).vulnerabilities, ...parseEnv(env).vulnerabilities];\n}\n"],"names":["scopedFlags","flags","scope","findGlobal","flag","CONFIG_WRITE_FLAGS","CONFIG_READ_FLAGS","CONFIG_WRITE_VERBS","CONFIG_READ_VERBS","detectConfigAction","positionals","name","configOperation","verb","isWrite","key","toOperation","operation","parseAssignment","raw","eq","detectConfigScope","detectConfigOverrideScope","collectWriteFlags","assignment","collectConfigAccess","task","parsedConfig","appendParsedConfigAction","action","config","UNIVERSAL","GLOBAL","COMMANDS","EMPTY","getFlagSpecForTask","spec","expandToken","stem","char","consumes","expandCluster","shortSpec","chars","result","i","remainder","c","parseGlobalFlags","tokens","parsed","next","token","parseTaskFlags","pathspecs","current","isPathSpec","toPaths","j","t","detectVulnerableConfigWrites","write","helper","preventUnsafeConfig","vulnerability","preventConfigBuilder","category","message","regex","preventExpandedConfigBuilder","detectVulnerableFlags","preventUnsafeFlags","preventFlagBuilder","currentTask","flagName","vulnerabilityAnalysis","parseArgv","taskIndex","taskTokens","toParsedFlag","vulnerabilityList","vulnerabilities","value","GitEnvKeys","collectConfigByCount","env","count","index","collectConfigVulnerabilities","isGitEnvKey","prepareEnv","gitEnv","envKey","parseEnv","vulnerabilityCheck"],"mappings":"6HASO,SAAUA,EAAYC,EAAeC,EAA0B,CACnE,MAAMC,EAAaD,IAAU,SAC7B,UAAWE,KAAQH,EACZG,EAAK,WAAaD,IACnB,MAAMC,EAGf,CCfO,MAAMC,MAAyB,IAAI,CACvC,QACA,SACA,mBACA,mBACA,gBACA,UACA,cACA,IACH,CAAC,EAGYC,MAAwB,IAAI,CACtC,QACA,YACA,cACA,kBACA,eACA,iBACA,SACA,IACH,CAAC,EAGYC,MAAyB,IAAI,CACvC,OACA,iBACA,iBACA,MACA,OACH,CAAC,EACYC,MAAwB,IAAI,CAAC,MAAO,YAAa,gBAAiB,MAAM,CAAC,ECtB/E,SAASC,EAAmBR,EAAeS,EAA+C,CAC9F,SAAW,CAAE,KAAAC,CAAA,IAAUX,EAAYC,EAAO,MAAM,EAAG,CAChD,GAAII,EAAmB,IAAIM,CAAI,EAC5B,OAAOC,EAAgB,GAAMF,CAAW,EAE3C,GAAIJ,EAAkB,IAAIK,CAAI,EAC3B,OAAOC,EAAgB,GAAOF,CAAW,CAE/C,CAEA,MAAMG,EAAOH,EAAY,GAAG,CAAC,GAAG,YAAA,EAEhC,OAAIG,IAAS,OACH,KAGNN,EAAmB,IAAIM,CAAI,EACrBD,EAAgB,GAAMF,EAAY,MAAM,CAAC,CAAC,EAGhDF,EAAkB,IAAIK,CAAI,EACpBD,EAAgB,GAAOF,EAAY,MAAM,CAAC,CAAC,EAGjDA,EAAY,SAAW,EACjBE,EAAgB,GAAOF,CAAW,EAGrCE,EAAgB,GAAMF,CAAW,CAC3C,CAEA,SAASE,EAAgBE,EAAU,GAAOJ,EAAwB,CAAA,EAA4B,CAC3F,MAAMK,EAAML,EAAY,GAAG,CAAC,GAAG,YAAA,EAE/B,OAAIK,IAAQ,OACF,KAGH,CACJ,QAAAD,EACA,OAAQ,CAACA,EACT,IAAAC,EACA,MAAOL,EAAY,GAAG,CAAC,CAAA,CAE7B,CAEO,SAASM,EAAYd,EAAoBe,EAA4B,CACzE,OAAIA,EAAU,SAAWA,EAAU,QAAU,OACnC,CAAE,IAAKA,EAAU,IAAK,MAAOA,EAAU,MAAO,MAAAf,CAAA,EAEjD,CAAE,IAAKe,EAAU,IAAK,MAAAf,CAAA,CAChC,CCxDA,SAASgB,EAAgBC,EAAgE,CACtF,MAAMC,EAAKD,GAAK,QAAQ,GAAG,GAAK,GAEhC,MAAI,CAACA,GAAOC,EAAK,EACP,KAGH,CACJ,IAAKD,EAAI,MAAM,EAAGC,CAAE,EAAE,KAAA,EAAO,YAAA,EAC7B,MAAOD,EAAI,MAAMC,EAAK,CAAC,CAAA,CAE7B,CAEA,SAASC,EAAkBpB,EAA4B,CACpD,SAAW,CAAE,KAAAU,CAAA,IAAUX,EAAYC,EAAO,MAAM,EAC7C,OAAQU,EAAA,CACL,IAAK,WACF,MAAO,SACV,IAAK,WACF,MAAO,SACV,IAAK,aACF,MAAO,WACV,IAAK,UACF,MAAO,QACV,IAAK,SACL,IAAK,KACF,MAAO,MAAA,CAGhB,MAAO,OACV,CAEA,SAASW,EAA0B,CAAE,KAAAX,GAAkC,CACpE,GAAIA,IAAS,MAAQA,IAAS,WAC3B,MAAO,SAEV,GAAIA,IAAS,eACV,MAAO,KAEb,CAOA,SAAUY,EAAkBtB,EAAuC,CAChE,UAAWG,KAAQH,EAAO,CACvB,MAAMC,EAAQoB,EAA0BlB,CAAI,EACtCoB,EAAatB,GAASgB,EAAgBd,EAAK,KAAK,EAElDoB,IACD,KAAM,CACH,GAAGA,EACH,MAAAtB,CAAA,EAGT,CACH,CAEO,SAASuB,EACbC,EACAzB,EACAS,EACqB,CACrB,MAAMiB,EAAqC,CACxC,KAAM,CAAA,EACN,MAAO,CAAC,GAAGJ,EAAkBtB,CAAK,CAAC,CAAA,EAGtC,OAAIyB,IAAS,UACVE,EACGD,EACAN,EAAkBpB,CAAK,EACvBQ,EAAmBR,EAAOS,CAAW,CAAA,EAIpCiB,CACV,CAEA,SAASC,EACND,EACAzB,EACA2B,EACD,CACC,GAAIA,IAAW,KACZ,OAGH,MAAMC,EAASd,EAAYd,EAAO2B,CAAM,EACpCA,EAAO,QACRF,EAAa,MAAM,KAAKG,CAAM,EAE9BH,EAAa,KAAK,KAAKG,CAAM,CAEnC,CCvFA,MAAMC,EAAsB,CACzB,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,CAAA,CACZ,CAEJ,EAEaC,EAAmB,CAC7B,MAAO,IAAI,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,GAAGD,EAAU,MAAM,QAAA,CAAQ,CAC7B,EACD,SAAU,IAAI,CACX,cACA,aACA,YACA,UACA,YACA,YACA,eACA,WAAA,CACF,CACJ,EAEME,EAAqC,CACxC,MAAO,CACJ,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,CAAA,CACZ,EACD,KAAM,IAAI,IAAI,CAAC,SAAU,SAAU,OAAQ,SAAU,cAAe,IAAK,UAAU,CAAC,CAAA,EAEvF,OAAQ,CACL,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,CAAA,CACZ,EACD,SAAU,IAAI,CAAC,OAAQ,UAAW,iBAAkB,gBAAiB,UAAU,CAAC,CAAA,EAEnF,OAAQ,CACL,UAAW,IAAI,CACZ,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,CAAA,CACb,EACD,KAAM,IAAI,IAAI,CAAC,OAAQ,UAAW,UAAW,OAAQ,OAAQ,OAAO,CAAC,CAAA,EAExE,MAAO,CACJ,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAA,EAEhC,KAAM,CACH,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAA,EAE7B,KAAM,CACH,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAA,EAEhC,KAAM,CACH,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,OAAQ,cAAc,CAAC,CAAA,CAE5C,EAEMC,EAAkB,CAAE,MAAO,IAAI,IAAO,KAAM,IAAI,GAAI,EAEnD,SAASC,EAAmBT,EAAsB,CACtD,MAAMU,EAAOH,EAASP,GAAQ,EAAE,GAAKQ,EAErC,MAAO,CACJ,MAAO,IAAI,IAAI,CAAC,GAAGH,EAAU,MAAM,QAAA,EAAW,GAAGK,EAAK,MAAM,QAAA,CAAS,CAAC,EACtE,KAAMA,EAAK,IAAA,CAEjB,CCjGO,SAASC,EACblB,EACAiB,EAAOJ,EAKP,CACA,GAAIb,EAAI,WAAW,IAAI,EAAG,CACvB,MAAMC,EAAKD,EAAI,QAAQ,GAAG,EAC1B,GAAIC,EAAK,EACN,MAAO,CAAC,CAAE,KAAMD,EAAI,MAAM,EAAGC,CAAE,EAAG,MAAOD,EAAI,MAAMC,EAAK,CAAC,EAAG,UAAW,GAAO,EAEjF,MAAMkB,EAAOnB,EAAI,MAAM,CAAC,EACxB,MAAO,CAAC,CAAE,KAAMA,EAAK,UAAWiB,EAAK,KAAK,IAAIE,CAAI,EAAG,CACxD,CAGA,GAAInB,EAAI,SAAW,EAAG,CACnB,MAAMoB,EAAOpB,EAAI,OAAO,CAAC,EACnBqB,EAAWJ,EAAK,MAAM,IAAIG,CAAI,EACpC,MAAO,CAAC,CAAE,KAAMpB,EAAK,UAAWqB,IAAa,GAAM,CACtD,CAGA,OAAOC,EAActB,EAAKiB,EAAK,KAAK,CACvC,CAEA,SAASK,EACNtB,EACAuB,EAC4D,CAC5D,MAAMC,EAAQxB,EAAI,MAAM,CAAC,EAAE,MAAM,EAAE,EAC7ByB,EAAsE,CAAA,EAE5E,QAASC,EAAI,EAAGA,EAAIF,EAAM,OAAQE,IAAK,CACpC,MAAMN,EAAOI,EAAME,CAAC,EACdL,EAAWE,EAAU,IAAIH,CAAI,EAEnC,GAAIC,IAAa,OAEd,MAAO,CAAC,CAAE,KAAMrB,EAAK,UAAW,GAAO,EAG1C,GAAIqB,EAAU,CACX,MAAMM,EAAYH,EAAM,MAAME,EAAI,CAAC,EAAE,KAAK,EAAE,EAC5C,GAAIC,GAEG,CADsB,CAAC,GAAGA,CAAS,EAAE,MAAOC,GAAML,EAAU,IAAIK,CAAC,CAAC,EAGnE,OAAAH,EAAO,KAAK,CAAE,KAAM,IAAIL,CAAI,GAAI,MAAOO,EAAW,UAAW,EAAA,CAAO,EAC7DF,CAGhB,CAEAA,EAAO,KAAK,CAAE,KAAM,IAAIL,CAAI,GAAI,UAAWC,EAAU,CACxD,CAEA,OAAOI,CACV,CCxDO,SAASI,EAAiBC,EAA4BhD,EAAgB,GAAiB,CAC3F,IAAI4C,EAAI,EAER,KAAOA,EAAII,EAAO,QAAQ,CACvB,MAAM9B,EAAM,OAAO8B,EAAOJ,CAAC,CAAC,EAC5B,GAAI,CAAC1B,EAAI,WAAW,GAAG,GAAKA,EAAI,OAAS,EAAG,MAE5C,MAAM+B,EAASb,EAAYlB,CAAG,EAC9B,IAAIgC,EAAON,EAAI,EAEf,UAAWO,KAASF,EAAQ,CACzB,MAAM9C,EAAa,CAChB,KAAMgD,EAAM,KACZ,MAAOA,EAAM,MACb,aAAc,GACd,SAAU,EAAA,EAETA,EAAM,WAAahD,EAAK,QAAU,QAAa+C,EAAOF,EAAO,SAC9D7C,EAAK,MAAQ,OAAO6C,EAAOE,CAAI,CAAC,EAChC/C,EAAK,aAAe,GACpB+C,KAEHlD,EAAM,KAAKG,CAAI,CAClB,CAEAyC,EAAIM,CACP,CAEA,MAAO,CAAE,MAAAlD,EAAO,UAAW4C,CAAA,CAC9B,CCzBO,SAASQ,EACbJ,EACAvB,EACAzB,EAAgB,CAAA,EACN,CACV,MAAMmC,EAAOD,EAAmBT,CAAI,EAC9BhB,EAAwB,CAAA,EACxB4C,EAAsB,CAAA,EAE5B,IAAIT,EAAI,EACR,KAAOA,EAAII,EAAO,QAAQ,CACvB,MAAMM,EAAUN,EAAOJ,CAAC,EAExB,GAAIW,EAAAA,WAAWD,CAAO,EAAG,CACtBD,EAAU,KAAK,GAAGG,EAAAA,QAAQF,CAAiB,CAAC,EAC5CV,IACA,QACH,CAEA,MAAM1B,EAAM,OAAOoC,CAAO,EAE1B,GAAIpC,IAAQ,KAAM,CACf,QAASuC,EAAIb,EAAI,EAAGa,EAAIT,EAAO,OAAQS,IAAK,CACzC,MAAMC,EAAIV,EAAOS,CAAC,EAClBF,EAAAA,WAAWG,CAAC,EAAIL,EAAU,KAAK,GAAGG,EAAAA,QAAQE,CAAW,CAAC,EAAIL,EAAU,KAAK,OAAOK,CAAC,CAAC,CACrF,CACA,KACH,CAEA,GAAI,CAACxC,EAAI,WAAW,GAAG,GAAKA,EAAI,OAAS,EAAG,CACzCT,EAAY,KAAKS,CAAG,EACpB0B,IACA,QACH,CAEA,MAAMK,EAASb,EAAYlB,EAAKiB,CAAI,EACpC,IAAIe,EAAON,EAAI,EAEf,UAAWO,KAASF,EAAQ,CACzB,MAAM9C,EAAa,CAChB,KAAMgD,EAAM,KACZ,MAAOA,EAAM,MACb,aAAc,GACd,SAAU,EAAA,EAGVA,EAAM,WACNhD,EAAK,QAAU,QACf+C,EAAOF,EAAO,QACd,CAACO,EAAAA,WAAWP,EAAOE,CAAI,CAAC,IAExB/C,EAAK,MAAQ,OAAO6C,EAAOE,CAAI,CAAC,EAChC/C,EAAK,aAAe,GACpB+C,KAEHlD,EAAM,KAAKG,CAAI,CAClB,CAEAyC,EAAIM,CACP,CAEA,MAAO,CAAE,MAAAlD,EAAO,YAAAS,EAAa,UAAA4C,CAAA,CAChC,CCvEO,SAAUM,EAA6B,CAC3C,MAAAC,CACH,EAAmD,CAChD,UAAW/B,KAAU+B,EAClB,UAAWC,KAAUC,EAAqB,CACvC,MAAMC,EAAgBF,EAAOhC,EAAO,GAAG,EACnCkC,IACD,MAAMA,EAEZ,CAEN,CAEA,SAASC,EACNnC,EACAoC,EACAC,EAAU,OAAOrC,CAAM,EACxB,CACC,MAAMsC,EAAQ,OAAOtC,GAAW,SAAW,IAAI,OAAO,OAAOA,EAAO,aAAa,EAAE,EAAIA,EAEvF,OAAO,SAAwBf,EAAmC,CAC/D,GAAIqD,EAAM,KAAKrD,CAAG,EACf,MAAO,CACJ,SAAAmD,EACA,QAAS,eAAeC,CAAO,sCAAsCD,CAAQ,EAAA,CAGtF,CACH,CAEA,SAASG,EAA6BvC,EAAgBoC,EAAiC,CACpF,MAAME,EAAQ,IAAI,OAAO,OAAOtC,EAAO,YAAA,EAAc,QAAQ,MAAO,SAAU,CAAC,EAAE,EACjF,OAAOmC,EAAqBG,EAAOF,EAAUpC,CAAM,CACtD,CAEA,MAAMiC,EAAsB,CACzBE,EAAqB,QAAS,kBAAkB,EAChDA,EAAqB,eAAgB,oBAAoB,EACzDA,EAAqB,cAAe,mBAAmB,EACvDA,EAAqB,iBAAkB,sBAAsB,EAC7DA,EAAqB,gBAAiB,qBAAqB,EAC3DA,EAAqB,iBAAkB,sBAAsB,EAC7DA,EAAqB,aAAc,kBAAkB,EACrDA,EAAqB,kBAAmB,uBAAuB,EAC/DI,EAA6B,oBAAqB,6BAA6B,EAC/EA,EAA6B,eAAgB,yBAAyB,EACtEJ,EAAqB,gBAAiB,yBAAyB,EAC/DI,EAA6B,gBAAiB,yBAAyB,EACvEA,EAA6B,eAAgB,mBAAmB,EAChEA,EAA6B,gBAAiB,mBAAmB,EACjEA,EAA6B,cAAe,uBAAuB,EACnEJ,EAAqB,mBAAoB,wBAAwB,EACjEI,EAA6B,eAAgB,wBAAwB,EACrEA,EAA6B,iBAAkB,wBAAwB,EACvEA,EAA6B,gBAAiB,wBAAwB,EACtEA,EAA6B,iBAAkB,6BAA6B,EAC5EA,EAA6B,qBAAsB,iBAAiB,EACpEA,EAA6B,oBAAqB,iBAAiB,EACnEJ,EAAqB,kBAAmB,mBAAmB,CAC9D,EC3DO,SAAUK,EACd5C,EACAzB,EACyB,CACzB,UAAWG,KAAQH,EAChB,UAAW6D,KAAUS,EAAoB,CACtC,MAAMP,EAAgBF,EAAOpC,EAAMtB,EAAK,IAAI,EACxC4D,IACD,MAAMA,EAEZ,CAEN,CAEA,SAASQ,EACN9C,EACAtB,EACA8D,EACAvD,EAAO,OAAOP,CAAI,EACnB,CACC,MAAMgE,EAAQ,OAAOhE,GAAS,SAAW,IAAI,OAAO,OAAOA,EAAK,aAAa,EAAE,EAAIA,EAC7E+D,EAAU,UAAUzC,EAAO,GAAGA,CAAI,gBAAkB,EAAE,GAAGf,CAAI,sCAAsCuD,CAAQ,GAEjH,OAAO,SAAqBO,EAA4BC,EAAwC,CAC7F,IAAK,CAAChD,GAAQ+C,IAAgB/C,IAAS0C,EAAM,KAAKM,CAAQ,EACvD,MAAO,CACJ,SAAAR,EACA,QAAAC,CAAA,CAGT,CACH,CAEA,MAAMI,EAAqB,CACxBC,EACG,KACA,0BACA,kBACA,iCAAA,EAEHA,EAAmB,QAAS,SAAU,iBAAiB,EACvDA,EAAmB,QAAS,MAAO,iBAAiB,EACpDA,EAAmB,OAAQ,SAAU,iBAAiB,EACtDA,EAAmB,KAAM,aAAc,wBAAwB,CAClE,ECzCO,SAASG,EACbjD,EACAzB,EACA6B,EACgB,CAChB,MAAO,CAAC,GAAGwC,EAAsB5C,EAAMzB,CAAK,EAAG,GAAG2D,EAA6B9B,CAAM,CAAC,CACzF,CCAO,SAAS8C,KAAa3B,EAAwC,CAClE,KAAM,CAAE,MAAAhD,EAAO,UAAA4E,GAAc7B,EAAiBC,CAAM,EAE9CvB,EAAOmD,EAAY5B,EAAO,OAAS,OAAOA,EAAO4B,CAAS,CAAC,EAAE,YAAA,EAAgB,KAC7EC,EAAapD,IAAS,KAAOuB,EAAO,MAAM4B,EAAY,CAAC,EAAI,CAAA,EAE3D,CAAE,YAAAnE,EAAa,UAAA4C,CAAA,EAAcD,EAAeyB,EAAYpD,EAAMzB,CAAK,EACnE6B,EAASL,EAAoBC,EAAMzB,EAAOS,CAAW,EAE3D,MAAO,CACJ,KAAAgB,EACA,MAAOzB,EAAM,IAAI8E,CAAY,EAC7B,MAAOzB,EACP,OAAAxB,EACA,gBAAiBkD,EAAkBL,EAAsBjD,EAAMzB,EAAO6B,CAAM,CAAC,CAAA,CAEnF,CAEA,SAASkD,EAAkBC,EAAkC,CAC1D,OAAO,OAAO,eAAeA,EAAiB,kBAAmB,CAC9D,MAAOA,CAAA,CACT,CACJ,CAEA,SAASF,EAAa,CAAE,MAAAG,EAAO,KAAAvE,GAA0B,CACtD,OAAOuE,IAAU,OAAY,CAAE,KAAAvE,EAAM,MAAAuE,CAAA,EAAU,CAAE,KAAAvE,CAAA,CACpD,CClCA,MAAMwE,EAAa,CAChB,OAAU,oBACV,YAAe,qBACf,kBAAqB,yBACrB,kBAAqB,yBACrB,iBAAoB,4BACpB,WAAc,yBACd,WAAc,oBACd,cAAiB,yBACjB,kBAAqB,0BACrB,UAAa,mBACb,kBAAqB,sBACrB,iBAAoB,yBACpB,oBAAuB,oBACvB,QAAW,wBACX,gBAAmB,wBACnB,MAAS,mBACT,OAAU,yBACV,YAAe,oBAClB,EAMA,SAAUC,EAAqBC,EAAqC,CACjE,MAAMC,EAAQ,SAASD,EAAI,kBAAoB,IAAK,EAAE,EACtD,QAASE,EAAQ,EAAGA,EAAQD,EAAOC,IAAS,CACzC,MAAMxE,EAAMsE,EAAI,kBAAkBE,CAAK,EAAE,EACnCL,EAAQG,EAAI,oBAAoBE,CAAK,EAAE,EAEzCxE,IAAQ,SACT,KAAM,CAAE,IAAKA,EAAI,YAAA,EAAc,OAAQ,MAAAmE,EAAO,MAAO,KAAA,EAE3D,CACH,CAEA,SAAUM,EAA6BH,EAAuC,CAC3E,UAAWtE,KAAO,OAAO,KAAKsE,CAAG,EAC9B,GAAII,EAAY1E,CAAG,EAAG,CACnB,MAAMmD,EAAWiB,EAAWpE,CAAG,EAC/B,KAAM,CACH,SAAAmD,EACA,QAAS,WAAWnD,EAAI,YAAA,CAAa,uCAAuCmD,CAAQ,EAAA,CAE1F,CAEN,CAEA,SAASuB,EAAY1E,EAA6C,CAC/D,OAAO,OAAO,OAAOoE,EAAYpE,CAAG,CACvC,CAEA,SAAS2E,EAAWL,EAAsC,CACvD,MAAMM,EAAiB,CAAA,EACvB,SAAW,CAAC5E,EAAKmE,CAAK,IAAK,OAAO,QAAQG,CAAG,EAAG,CAC7C,MAAMO,EAAS7E,EAAI,YAAA,EAAc,KAAA,GAC7B0E,EAAYG,CAAM,GAAKA,EAAO,WAAW,KAAK,KAC/CD,EAAOC,CAAM,EAAI,OAAOV,CAAK,EAEnC,CACA,OAAOS,CACV,CAEO,SAASE,EAAS1E,EAA8B,CACpD,MAAMkE,EAAMK,EAAWvE,CAAG,EACpBW,EAA+B,CAClC,KAAM,CAAA,EACN,MAAO,CAAC,GAAGsD,EAAqBC,CAAG,CAAC,CAAA,EAEjCJ,EAAkB,CACrB,GAAGO,EAA6BH,CAAG,EACnC,GAAGV,EAAsB,KAAM,CAAA,EAAI7C,CAAM,CAAA,EAG5C,MAAO,CACJ,OAAAA,EACA,gBAAAmD,CAAA,CAEN,CC5EO,SAASa,GAAmB7C,EAA2BoC,EAA8B,CACzF,MAAO,CAAC,GAAGT,EAAU,GAAG3B,CAAM,EAAE,gBAAiB,GAAG4C,EAASR,CAAG,EAAE,eAAe,CACpF"}
+{"version":3,"file":"index.cjs","sources":["../src/flags/flags.helpers.ts","../src/config/config-operands.ts","../src/config/detect-config-action.ts","../src/config/analyse-config.ts","../src/tokens/flag-specs.ts","../src/tokens/token-expander.ts","../src/flags/parse-global-flags.ts","../src/flags/parse-task-flags.ts","../src/vulnerabilities/detect-vulnerable-config-writes.ts","../src/vulnerabilities/detect-vulnerable-flags.ts","../src/vulnerabilities/vulnerability-analysis.ts","../src/args/parse-argv.ts","../src/env/parse-env.ts","../src/vulnerabilities/vulnerability-check.ts"],"sourcesContent":["export interface Flag {\n   name: string;\n   value?: string;\n   /** Value came from the next token rather than being embedded after `=`. */\n   absorbedNext: boolean;\n   /** Switch appeared before the git sub-command. */\n   isGlobal: boolean;\n}\n\nexport function* scopedFlags(flags: Flag[], scope: 'global' | 'task') {\n   const findGlobal = scope === 'global';\n   for (const flag of flags) {\n      if (flag.isGlobal === findGlobal) {\n         yield flag;\n      }\n   }\n}\n","// Flags that unambiguously signal a write operation on git config.\nexport const CONFIG_WRITE_FLAGS = new Set([\n   '--add',\n   '--edit',\n   '--remove-section',\n   '--rename-section',\n   '--replace-all',\n   '--unset',\n   '--unset-all',\n   '-e',\n]);\n\n// Flags that unambiguously signal a read operation.\nexport const CONFIG_READ_FLAGS = new Set([\n   '--get',\n   '--get-all',\n   '--get-color',\n   '--get-colorbool',\n   '--get-regexp',\n   '--get-urlmatch',\n   '--list',\n   '-l',\n]);\n\n// Sub-command verbs accepted as the first positional by newer git versions.\nexport const CONFIG_WRITE_VERBS = new Set([\n   'edit',\n   'remove-section',\n   'rename-section',\n   'set',\n   'unset',\n]);\nexport const CONFIG_READ_VERBS = new Set(['get', 'get-color', 'get-colorbool', 'list']);\n","import type { ConfigScope } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport {\n   CONFIG_READ_FLAGS,\n   CONFIG_READ_VERBS,\n   CONFIG_WRITE_FLAGS,\n   CONFIG_WRITE_VERBS,\n} from './config-operands';\n\nexport function detectConfigAction(flags: Flag[], positionals: string[]): ConfigOperation | null {\n   for (const { name } of scopedFlags(flags, 'task')) {\n      if (CONFIG_WRITE_FLAGS.has(name)) {\n         return configOperation(true, positionals);\n      }\n      if (CONFIG_READ_FLAGS.has(name)) {\n         return configOperation(false, positionals);\n      }\n   }\n\n   const verb = positionals.at(0)?.toLowerCase();\n\n   if (verb === undefined) {\n      return null;\n   }\n\n   if (CONFIG_WRITE_VERBS.has(verb)) {\n      return configOperation(true, positionals.slice(1));\n   }\n\n   if (CONFIG_READ_VERBS.has(verb)) {\n      return configOperation(false, positionals.slice(1));\n   }\n\n   if (positionals.length === 1) {\n      return configOperation(false, positionals);\n   }\n\n   return configOperation(true, positionals);\n}\n\nfunction configOperation(isWrite = false, positionals: string[] = []): ConfigOperation | null {\n   const key = positionals.at(0)?.toLowerCase();\n\n   if (key === undefined) {\n      return null;\n   }\n\n   return {\n      isWrite,\n      isRead: !isWrite,\n      key,\n      value: positionals.at(1),\n   };\n}\n\nexport function toOperation(scope: ConfigScope, operation: ConfigOperation) {\n   if (operation.isWrite && operation.value !== undefined) {\n      return { key: operation.key, value: operation.value, scope };\n   }\n   return { key: operation.key, scope };\n}\n","import type { ConfigScope, ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport { detectConfigAction, toOperation } from './detect-config-action';\n\nfunction parseAssignment(raw: string | undefined): { key: string; value: string } | null {\n   const eq = raw?.indexOf('=') || -1;\n\n   if (!raw || eq < 0) {\n      return null;\n   }\n\n   return {\n      key: raw.slice(0, eq).trim().toLowerCase(),\n      value: raw.slice(eq + 1),\n   };\n}\n\nfunction detectConfigScope(flags: Flag[]): ConfigScope {\n   for (const { name } of scopedFlags(flags, 'task')) {\n      switch (name) {\n         case '--global':\n            return 'global';\n         case '--system':\n            return 'system';\n         case '--worktree':\n            return 'worktree';\n         case '--local':\n            return 'local';\n         case '--file':\n         case '-f':\n            return 'file';\n      }\n   }\n   return 'local';\n}\n\nfunction detectConfigOverrideScope({ name }: Flag): ConfigScope | void {\n   if (name === '-c' || name === '--config') {\n      return 'inline';\n   }\n   if (name === '--config-env') {\n      return 'env';\n   }\n}\n\n/**\n * Generates the stream of ConfigWrite settings found in the supplied flags,\n * triggered by `-c` and `--config` for inline configuration and `--config-env`\n * to set a config setting based on environment variable.\n */\nfunction* collectWriteFlags(flags: Flag[]): Generator<ConfigWrite> {\n   for (const flag of flags) {\n      const scope = detectConfigOverrideScope(flag);\n      const assignment = scope && parseAssignment(flag.value);\n\n      if (assignment) {\n         yield {\n            ...assignment,\n            scope,\n         };\n      }\n   }\n}\n\nexport function collectConfigAccess(\n   task: string | null,\n   flags: Flag[],\n   positionals: string[]\n): ParsedConfigActivity {\n   const parsedConfig: ParsedConfigActivity = {\n      read: [],\n      write: [...collectWriteFlags(flags)],\n   };\n\n   if (task === 'config') {\n      appendParsedConfigAction(\n         parsedConfig,\n         detectConfigScope(flags),\n         detectConfigAction(flags, positionals)\n      );\n   }\n\n   return parsedConfig;\n}\n\nfunction appendParsedConfigAction(\n   parsedConfig: ParsedConfigActivity,\n   scope: ConfigScope,\n   action: ConfigOperation | null\n) {\n   if (action === null) {\n      return;\n   }\n\n   const config = toOperation(scope, action);\n   if (action.isWrite) {\n      parsedConfig.write.push(config);\n   } else {\n      parsedConfig.read.push(config);\n   }\n}\n","// ── Option tables ─────────────────────────────────────────────────────────────\n//\n// Each scope has:\n//   short  – Map<char, consumesNext>  (known single-letter switches; true = takes next token)\n//   long   – Set<stem>                (long switch stems, without --, that take the next token)\n//\n// Only switches listed here are \"known\". An unknown char anywhere in a combined\n// cluster causes the entire cluster to be kept as one opaque token.\n\nexport interface FlagSpec {\n   readonly short: ReadonlyMap<string, boolean>;\n   readonly long: ReadonlySet<string>;\n}\n\nconst UNIVERSAL: FlagSpec = {\n   short: new Map([\n      ['c', true], //  -c <k=v>    set config key for this invocation\n   ]),\n   long: new Set(),\n};\n\nexport const GLOBAL: FlagSpec = {\n   short: new Map([\n      ['C', true], //  -C <path>   change working directory\n      ['P', false], // -P          no pager (alias for --no-pager)\n      ['h', false], // -h          help\n      ['p', false], // -p          paginate\n      ['v', false], // -v          version\n      ...UNIVERSAL.short.entries(),\n   ]),\n   long: new Set([\n      'attr-source',\n      'config-env',\n      'exec-path',\n      'git-dir',\n      'list-cmds',\n      'namespace',\n      'super-prefix',\n      'work-tree',\n   ]),\n};\n\nconst COMMANDS: Record<string, FlagSpec> = {\n   clone: {\n      short: new Map([\n         ['b', true], // -b <branch>\n         ['j', true], // -j <n>          parallel jobs\n         ['l', false], // -l local\n         ['n', false], // -n no-checkout\n         ['o', true], // -o <name>       remote name\n         ['q', false], // -q quiet\n         ['s', false], // -s shared\n         ['u', true], // -u <upload-pack>\n      ]),\n      long: new Set(['branch', 'config', 'jobs', 'origin', 'upload-pack', 'u', 'template']),\n   },\n   commit: {\n      short: new Map([\n         ['C', true], // -C <commit>  reuse message\n         ['F', true], // -F <file>    read message from file\n         ['c', true], // -c <commit>  reedit message\n         ['m', true], // -m <msg>\n         ['t', true], // -t <template>\n      ]),\n      long: new Set(['file', 'message', 'reedit-message', 'reuse-message', 'template']),\n   },\n   config: {\n      short: new Map([\n         ['e', false], // -e  open editor\n         ['f', true], //  -f <file>\n         ['l', false], // -l  list\n      ]),\n      long: new Set(['blob', 'comment', 'default', 'file', 'type', 'value']),\n   },\n   fetch: {\n      short: new Map(),\n      long: new Set(['upload-pack']),\n   },\n   init: {\n      short: new Map(),\n      long: new Set(['template']),\n   },\n   pull: {\n      short: new Map(),\n      long: new Set(['upload-pack']),\n   },\n   push: {\n      short: new Map(),\n      long: new Set(['exec', 'receive-pack']),\n   },\n   rebase: {\n      short: new Map([\n         ['X', true], // -X <option>   strategy option\n         ['f', false], // -f force-rebase\n         ['i', false], // -i interactive\n         ['k', false], // -k keep-base\n         ['m', false], // -m merge\n         ['n', false], // -n no-stat\n         ['q', false], // -q quiet\n         ['r', false], // -r rebase-merges\n         ['s', true], // -s <strategy>\n         ['v', false], // -v verbose\n         ['x', true], // -x <cmd>      exec\n      ]),\n      long: new Set(['exec', 'onto', 'strategy', 'strategy-option']),\n   },\n};\n\nconst EMPTY: FlagSpec = { short: new Map(), long: new Set() };\n\nexport function getFlagSpecForTask(task?: string | null) {\n   const spec = COMMANDS[task ?? ''] ?? EMPTY;\n\n   return {\n      short: new Map([...UNIVERSAL.short.entries(), ...spec.short.entries()]),\n      long: spec.long,\n   };\n}\n","import { GLOBAL } from './flag-specs';\n\n/** Parse a single raw token (e.g. `'-m'`, `'--amend'`, `'-uc'`) into one or\n *  more switch descriptors.  Values are not yet resolved for needsNext=true. */\nexport function expandToken(\n   raw: string,\n   spec = GLOBAL\n): Array<{\n   name: string;\n   value?: string;\n   needsNext: boolean;\n}> {\n   if (raw.startsWith('--')) {\n      const eq = raw.indexOf('=');\n      if (eq > 2) {\n         return [{ name: raw.slice(0, eq), value: raw.slice(eq + 1), needsNext: false }];\n      }\n      const stem = raw.slice(2);\n      return [{ name: raw, needsNext: spec.long.has(stem) }];\n   }\n\n   // Single short switch\n   if (raw.length === 2) {\n      const char = raw.charAt(1);\n      const consumes = spec.short.get(char);\n      return [{ name: raw, needsNext: consumes === true }];\n   }\n\n   // Combined short cluster: try to expand char-by-char\n   return expandCluster(raw, spec.short);\n}\n\nfunction expandCluster(\n   raw: string,\n   shortSpec: ReadonlyMap<string, boolean>\n): Array<{ name: string; value?: string; needsNext: boolean }> {\n   const chars = raw.slice(1).split('');\n   const result: Array<{ name: string; value?: string; needsNext: boolean }> = [];\n\n   for (let i = 0; i < chars.length; i++) {\n      const char = chars[i];\n      const consumes = shortSpec.get(char);\n\n      if (consumes === undefined) {\n         // Unknown char: keep the whole raw token as opaque\n         return [{ name: raw, needsNext: false }];\n      }\n\n      if (consumes) {\n         const remainder = chars.slice(i + 1).join('');\n         if (remainder) {\n            const remainderAllKnown = [...remainder].every((c) => shortSpec.has(c));\n            if (!remainderAllKnown) {\n               // Remaining chars are the embedded value, not separate flags\n               result.push({ name: `-${char}`, value: remainder, needsNext: false });\n               return result;\n            }\n         }\n      }\n\n      result.push({ name: `-${char}`, needsNext: consumes });\n   }\n\n   return result;\n}\n","import { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\nexport interface GlobalFlags {\n   flags: Flag[];\n   taskIndex: number;\n}\n\nexport function parseGlobalFlags(tokens: readonly unknown[], flags: Flag[] = []): GlobalFlags {\n   let i = 0;\n\n   while (i < tokens.length) {\n      const raw = String(tokens[i]);\n      if (!raw.startsWith('-') || raw.length < 2) break;\n\n      const parsed = expandToken(raw);\n      let next = i + 1;\n\n      for (const token of parsed) {\n         const flag: Flag = {\n            name: token.name,\n            value: token.value,\n            absorbedNext: false,\n            isGlobal: true,\n         };\n         if (token.needsNext && flag.value === undefined && next < tokens.length) {\n            flag.value = String(tokens[next]);\n            flag.absorbedNext = true;\n            next++;\n         }\n         flags.push(flag);\n      }\n\n      i = next;\n   }\n\n   return { flags, taskIndex: i };\n}\n","import { isPathSpec, toPaths } from '@simple-git/args-pathspec';\n\nimport { getFlagSpecForTask } from '../tokens/flag-specs';\nimport { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\ntype TaskFlags = {\n   flags: Flag[];\n   positionals: string[];\n   pathspecs: string[];\n};\n\nexport function parseTaskFlags(\n   tokens: readonly unknown[],\n   task: string | null,\n   flags: Flag[] = []\n): TaskFlags {\n   const spec = getFlagSpecForTask(task);\n   const positionals: string[] = [];\n   const pathspecs: string[] = [];\n\n   let i = 0;\n   while (i < tokens.length) {\n      const current = tokens[i];\n\n      if (isPathSpec(current)) {\n         pathspecs.push(...toPaths(current as string));\n         i++;\n         continue;\n      }\n\n      const raw = String(current);\n\n      if (raw === '--') {\n         for (let j = i + 1; j < tokens.length; j++) {\n            const t = tokens[j];\n            isPathSpec(t) ? pathspecs.push(...toPaths(t as string)) : pathspecs.push(String(t));\n         }\n         break;\n      }\n\n      if (!raw.startsWith('-') || raw.length < 2) {\n         positionals.push(raw);\n         i++;\n         continue;\n      }\n\n      const parsed = expandToken(raw, spec);\n      let next = i + 1;\n\n      for (const token of parsed) {\n         const flag: Flag = {\n            name: token.name,\n            value: token.value,\n            absorbedNext: false,\n            isGlobal: false,\n         };\n         if (\n            token.needsNext &&\n            flag.value === undefined &&\n            next < tokens.length &&\n            !isPathSpec(tokens[next])\n         ) {\n            flag.value = String(tokens[next]);\n            flag.absorbedNext = true;\n            next++;\n         }\n         flags.push(flag);\n      }\n\n      i = next;\n   }\n\n   return { flags, positionals, pathspecs };\n}\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function* detectVulnerableConfigWrites({\n   write,\n}: ParsedConfigActivity): Generator<Vulnerability> {\n   for (const config of write) {\n      for (const helper of preventUnsafeConfig) {\n         const vulnerability = helper(config.key);\n         if (vulnerability) {\n            yield vulnerability;\n         }\n      }\n   }\n}\n\nfunction preventConfigBuilder(\n   config: string | RegExp,\n   category: VulnerabilityCategory,\n   message = String(config)\n) {\n   const regex = typeof config === 'string' ? new RegExp(`\\\\s*${config.toLowerCase()}`) : config;\n\n   return function preventCommand(key: string): Vulnerability | void {\n      if (regex.test(key)) {\n         return {\n            category,\n            message: `Configuring ${message} is not permitted without enabling ${category}`,\n         };\n      }\n   };\n}\n\nfunction preventExpandedConfigBuilder(config: string, category: VulnerabilityCategory) {\n   const regex = new RegExp(`\\\\s*${config.toLowerCase().replace(/\\./g, '(..+)?.')}`);\n   return preventConfigBuilder(regex, category, config);\n}\n\nconst preventUnsafeConfig = [\n   preventConfigBuilder('alias', 'allowUnsafeAlias'),\n   preventConfigBuilder('core.askPass', 'allowUnsafeAskPass'),\n   preventConfigBuilder('core.editor', 'allowUnsafeEditor'),\n   preventConfigBuilder('core.fsmonitor', 'allowUnsafeFsMonitor'),\n   preventConfigBuilder('core.gitProxy', 'allowUnsafeGitProxy'),\n   preventConfigBuilder('core.hooksPath', 'allowUnsafeHooksPath'),\n   preventConfigBuilder('core.pager', 'allowUnsafePager'),\n   preventConfigBuilder('core.sshCommand', 'allowUnsafeSshCommand'),\n   preventExpandedConfigBuilder('credential.helper', 'allowUnsafeCredentialHelper'),\n   preventExpandedConfigBuilder('diff.command', 'allowUnsafeDiffExternal'),\n   preventConfigBuilder('diff.external', 'allowUnsafeDiffExternal'),\n   preventExpandedConfigBuilder('difftool.cmd', 'allowUnsafeDiffExternal'),\n   preventExpandedConfigBuilder('diff.textconv', 'allowUnsafeDiffTextConv'),\n   preventExpandedConfigBuilder('filter.clean', 'allowUnsafeFilter'),\n   preventExpandedConfigBuilder('filter.process', 'allowUnsafeFilter'),\n   preventExpandedConfigBuilder('filter.smudge', 'allowUnsafeFilter'),\n   preventExpandedConfigBuilder('gpg.program', 'allowUnsafeGpgProgram'),\n   preventConfigBuilder('include.path', 'allowUnsafeInclude'),\n   preventExpandedConfigBuilder('includeIf', 'allowUnsafeInclude'),\n   preventConfigBuilder('init.templateDir', 'allowUnsafeTemplateDir'),\n   preventExpandedConfigBuilder('pager.', 'allowUnsafePager'),\n   preventExpandedConfigBuilder('merge.driver', 'allowUnsafeMergeDriver'),\n   preventExpandedConfigBuilder('mergetool.path', 'allowUnsafeMergeDriver'),\n   preventExpandedConfigBuilder('mergetool.cmd', 'allowUnsafeMergeDriver'),\n   preventExpandedConfigBuilder('protocol.allow', 'allowUnsafeProtocolOverride'),\n   preventExpandedConfigBuilder('remote.receivepack', 'allowUnsafePack'),\n   preventExpandedConfigBuilder('remote.uploadpack', 'allowUnsafePack'),\n   preventConfigBuilder('uploadpack.packObjectsHook', 'allowUnsafePack'),\n   preventConfigBuilder('sequence.editor', 'allowUnsafeEditor'),\n   preventExpandedConfigBuilder('submodule.update', 'allowUnsafeSubmodule'),\n   preventExpandedConfigBuilder('tar.command', 'allowUnsafeCommandBinaries'),\n   preventExpandedConfigBuilder('trailer.cmd', 'allowUnsafeCommandBinaries'),\n   preventExpandedConfigBuilder('trailer.command', 'allowUnsafeCommandBinaries'),\n   preventExpandedConfigBuilder('url.insteadOf', 'allowUnsafeUrlRewrite'),\n];\n","import type { Flag } from '../flags/flags.helpers';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function* detectVulnerableFlags(\n   task: null | string,\n   flags: Flag[]\n): Generator<Vulnerability> {\n   for (const flag of flags) {\n      for (const helper of preventUnsafeFlags) {\n         const vulnerability = helper(task, flag);\n         if (vulnerability) {\n            yield vulnerability;\n         }\n      }\n   }\n}\n\ninterface PreventFlagOptions {\n   /** Label to use in the error message in place of the matcher itself */\n   name?: string;\n\n   /** Only match when the switch appears before the git sub-command */\n   globalOnly?: boolean;\n\n   /**\n    * Only match when the switch was supplied with a value - without one switches\n    * such as `--git-dir` and `--exec-path` are getters rather than setters.\n    */\n   withValue?: boolean;\n}\n\nfunction preventFlagBuilder(\n   task: string | null,\n   flag: string | RegExp,\n   category: VulnerabilityCategory,\n   { name = String(flag), globalOnly = false, withValue = false }: PreventFlagOptions = {}\n) {\n   const regex = typeof flag === 'string' ? new RegExp(`\\\\s*${flag.toLowerCase()}`) : flag;\n   const message = `Use of ${task ? `${task} with option ` : ''}${name} is not permitted without enabling ${category}`;\n\n   return function preventFlag(currentTask: string | null, flag: Flag): Vulnerability | void {\n      if (task && currentTask !== task) {\n         return;\n      }\n\n      if (globalOnly && !flag.isGlobal) {\n         return;\n      }\n\n      if (withValue && flag.value === undefined) {\n         return;\n      }\n\n      if (regex.test(flag.name)) {\n         return {\n            category,\n            message,\n         };\n      }\n   };\n}\n\nconst pathTakingGlobal: PreventFlagOptions = { globalOnly: true, withValue: true };\n\nconst preventUnsafeFlags = [\n   preventFlagBuilder(null, /--(upload|receive)-pack/, 'allowUnsafePack', {\n      name: '--upload-pack or --receive-pack',\n   }),\n   preventFlagBuilder('clone', /^-\\w*u/, 'allowUnsafePack'),\n   preventFlagBuilder('clone', '--u', 'allowUnsafePack'),\n   preventFlagBuilder('push', /^--exec$/, 'allowUnsafePack', { name: '--exec' }),\n   // `git` accepts unambiguous abbreviations of long options, so `--ex` and `--exe` are `--exec`\n   preventFlagBuilder('rebase', /^(-x|--ex(ec?)?)$/, 'allowUnsafeExec', { name: '-x or --exec' }),\n   preventFlagBuilder(null, '--template', 'allowUnsafeTemplateDir'),\n   preventFlagBuilder(null, '--exec-path', 'allowUnsafeExec', pathTakingGlobal),\n   // `git` reads the configuration of whichever repository these name, so the\n   // directory alone is enough to deliver config the argv guards never see\n   preventFlagBuilder(null, '--git-dir', 'allowUnsafeConfigPaths', pathTakingGlobal),\n   preventFlagBuilder(null, '--work-tree', 'allowUnsafeConfigPaths', pathTakingGlobal),\n   preventFlagBuilder(null, /^-C$/, 'allowUnsafeConfigPaths', { ...pathTakingGlobal, name: '-C' }),\n];\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Flag } from '../flags/flags.helpers';\nimport { detectVulnerableConfigWrites } from './detect-vulnerable-config-writes';\nimport { detectVulnerableFlags } from './detect-vulnerable-flags';\nimport type { Vulnerability } from './vulnerability.types';\n\nexport function vulnerabilityAnalysis(\n   task: null | string,\n   flags: Flag[],\n   config: ParsedConfigActivity\n): Vulnerability[] {\n   return [...detectVulnerableFlags(task, flags), ...detectVulnerableConfigWrites(config)];\n}\n","import { collectConfigAccess } from '../config/analyse-config';\nimport type { Flag } from '../flags/flags.helpers';\nimport { parseGlobalFlags } from '../flags/parse-global-flags';\nimport { parseTaskFlags } from '../flags/parse-task-flags';\nimport type { Vulnerability } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\nimport type { ParsedArgv, ParsedFlag } from './parse-argv.types';\n\n/**\n * Parse the tokens that would be forwarded to a `git` child-process and\n * return a structured summary of what the invocation does.\n */\nexport function parseArgv(...tokens: readonly unknown[]): ParsedArgv {\n   const { flags, taskIndex } = parseGlobalFlags(tokens);\n\n   const task = taskIndex < tokens.length ? String(tokens[taskIndex]).toLowerCase() : null;\n   const taskTokens = task !== null ? tokens.slice(taskIndex + 1) : [];\n\n   const { positionals, pathspecs } = parseTaskFlags(taskTokens, task, flags);\n   const config = collectConfigAccess(task, flags, positionals);\n\n   return {\n      task,\n      flags: flags.map(toParsedFlag),\n      paths: pathspecs,\n      config,\n      vulnerabilities: vulnerabilityList(vulnerabilityAnalysis(task, flags, config)),\n   };\n}\n\nfunction vulnerabilityList(vulnerabilities: Vulnerability[]) {\n   return Object.defineProperty(vulnerabilities, 'vulnerabilities', {\n      value: vulnerabilities,\n   });\n}\n\nfunction toParsedFlag({ value, name }: Flag): ParsedFlag {\n   return value !== undefined ? { name, value } : { name };\n}\n","import type { ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\n\nconst GitEnvKeys = {\n   'editor': 'allowUnsafeEditor',\n   'git_askpass': 'allowUnsafeAskPass',\n   'git_config_global': 'allowUnsafeConfigPaths',\n   'git_config_system': 'allowUnsafeConfigPaths',\n   'git_config_count': 'allowUnsafeConfigEnvCount',\n   'git_config_parameters': 'allowUnsafeConfigEnvCount',\n   'git_config': 'allowUnsafeConfigPaths',\n   'git_editor': 'allowUnsafeEditor',\n   'git_exec_path': 'allowUnsafeExec',\n   'git_external_diff': 'allowUnsafeDiffExternal',\n   'git_pager': 'allowUnsafePager',\n   'git_proxy_command': 'allowUnsafeGitProxy',\n   'git_template_dir': 'allowUnsafeTemplateDir',\n   'git_sequence_editor': 'allowUnsafeEditor',\n   'git_ssh': 'allowUnsafeSshCommand',\n   'git_ssh_command': 'allowUnsafeSshCommand',\n   'pager': 'allowUnsafePager',\n   'prefix': 'allowUnsafeConfigPaths',\n   'ssh_askpass': 'allowUnsafeAskPass',\n   'visual': 'allowUnsafeEditor',\n} as const satisfies Record<string, VulnerabilityCategory>;\n\ntype GitEnv = Record<string, string> & {\n   git_config_count?: string;\n};\n\nfunction* collectConfigByCount(env: GitEnv): Generator<ConfigWrite> {\n   const count = parseInt(env.git_config_count ?? '0', 10);\n   for (let index = 0; index < count; index++) {\n      const key = env[`git_config_key_${index}`];\n      const value = env[`git_config_value_${index}`];\n\n      if (key !== undefined) {\n         yield { key: key.toLowerCase().trim(), value, scope: 'env' };\n      }\n   }\n}\n\nfunction* collectConfigVulnerabilities(env: GitEnv): Generator<Vulnerability> {\n   for (const key of Object.keys(env)) {\n      if (isGitEnvKey(key)) {\n         const category = GitEnvKeys[key];\n         yield {\n            category,\n            message: `Use of \"${key.toUpperCase()}\" is not permitted without enabling ${category}`,\n         };\n      }\n   }\n}\n\nexport function isGitEnvKey(key: string): key is keyof typeof GitEnvKeys {\n   return Object.hasOwn(GitEnvKeys, key);\n}\n\nfunction prepareEnv(env: Record<string, unknown>): GitEnv {\n   const gitEnv: GitEnv = {};\n   for (const [key, value] of Object.entries(env)) {\n      const envKey = key.toLowerCase().trim();\n      if (isGitEnvKey(envKey) || envKey.startsWith('git')) {\n         gitEnv[envKey] = String(value);\n      }\n   }\n   return gitEnv;\n}\n\nexport function parseEnv(raw: Record<string, unknown>) {\n   const env = prepareEnv(raw);\n   const config: ParsedConfigActivity = {\n      read: [],\n      write: [...collectConfigByCount(env)],\n   };\n   const vulnerabilities = [\n      ...collectConfigVulnerabilities(env),\n      ...vulnerabilityAnalysis(null, [], config),\n   ];\n\n   return {\n      config,\n      vulnerabilities,\n   };\n}\n","import { parseArgv } from '../args/parse-argv';\nimport { parseEnv } from '../env/parse-env';\n\n/**\n * Retrieves just the vulnerabilities identified in the supplied varargs tokens\n * and environment variables.\n */\nexport function vulnerabilityCheck(tokens: readonly string[], env: Record<string, unknown>) {\n   return [...parseArgv(...tokens).vulnerabilities, ...parseEnv(env).vulnerabilities];\n}\n"],"names":["scopedFlags","flags","scope","findGlobal","flag","CONFIG_WRITE_FLAGS","CONFIG_READ_FLAGS","CONFIG_WRITE_VERBS","CONFIG_READ_VERBS","detectConfigAction","positionals","name","configOperation","verb","isWrite","key","toOperation","operation","parseAssignment","raw","eq","detectConfigScope","detectConfigOverrideScope","collectWriteFlags","assignment","collectConfigAccess","task","parsedConfig","appendParsedConfigAction","action","config","UNIVERSAL","GLOBAL","COMMANDS","EMPTY","getFlagSpecForTask","spec","expandToken","stem","char","consumes","expandCluster","shortSpec","chars","result","i","remainder","c","parseGlobalFlags","tokens","parsed","next","token","parseTaskFlags","pathspecs","current","isPathSpec","toPaths","j","t","detectVulnerableConfigWrites","write","helper","preventUnsafeConfig","vulnerability","preventConfigBuilder","category","message","regex","preventExpandedConfigBuilder","detectVulnerableFlags","preventUnsafeFlags","preventFlagBuilder","globalOnly","withValue","currentTask","pathTakingGlobal","vulnerabilityAnalysis","parseArgv","taskIndex","taskTokens","toParsedFlag","vulnerabilityList","vulnerabilities","value","GitEnvKeys","collectConfigByCount","env","count","index","collectConfigVulnerabilities","isGitEnvKey","prepareEnv","gitEnv","envKey","parseEnv","vulnerabilityCheck"],"mappings":"6HASO,SAAUA,EAAYC,EAAeC,EAA0B,CACnE,MAAMC,EAAaD,IAAU,SAC7B,UAAWE,KAAQH,EACZG,EAAK,WAAaD,IACnB,MAAMC,EAGf,CCfO,MAAMC,MAAyB,IAAI,CACvC,QACA,SACA,mBACA,mBACA,gBACA,UACA,cACA,IACH,CAAC,EAGYC,MAAwB,IAAI,CACtC,QACA,YACA,cACA,kBACA,eACA,iBACA,SACA,IACH,CAAC,EAGYC,MAAyB,IAAI,CACvC,OACA,iBACA,iBACA,MACA,OACH,CAAC,EACYC,MAAwB,IAAI,CAAC,MAAO,YAAa,gBAAiB,MAAM,CAAC,ECtB/E,SAASC,EAAmBR,EAAeS,EAA+C,CAC9F,SAAW,CAAE,KAAAC,CAAA,IAAUX,EAAYC,EAAO,MAAM,EAAG,CAChD,GAAII,EAAmB,IAAIM,CAAI,EAC5B,OAAOC,EAAgB,GAAMF,CAAW,EAE3C,GAAIJ,EAAkB,IAAIK,CAAI,EAC3B,OAAOC,EAAgB,GAAOF,CAAW,CAE/C,CAEA,MAAMG,EAAOH,EAAY,GAAG,CAAC,GAAG,YAAA,EAEhC,OAAIG,IAAS,OACH,KAGNN,EAAmB,IAAIM,CAAI,EACrBD,EAAgB,GAAMF,EAAY,MAAM,CAAC,CAAC,EAGhDF,EAAkB,IAAIK,CAAI,EACpBD,EAAgB,GAAOF,EAAY,MAAM,CAAC,CAAC,EAGjDA,EAAY,SAAW,EACjBE,EAAgB,GAAOF,CAAW,EAGrCE,EAAgB,GAAMF,CAAW,CAC3C,CAEA,SAASE,EAAgBE,EAAU,GAAOJ,EAAwB,CAAA,EAA4B,CAC3F,MAAMK,EAAML,EAAY,GAAG,CAAC,GAAG,YAAA,EAE/B,OAAIK,IAAQ,OACF,KAGH,CACJ,QAAAD,EACA,OAAQ,CAACA,EACT,IAAAC,EACA,MAAOL,EAAY,GAAG,CAAC,CAAA,CAE7B,CAEO,SAASM,EAAYd,EAAoBe,EAA4B,CACzE,OAAIA,EAAU,SAAWA,EAAU,QAAU,OACnC,CAAE,IAAKA,EAAU,IAAK,MAAOA,EAAU,MAAO,MAAAf,CAAA,EAEjD,CAAE,IAAKe,EAAU,IAAK,MAAAf,CAAA,CAChC,CCxDA,SAASgB,EAAgBC,EAAgE,CACtF,MAAMC,EAAKD,GAAK,QAAQ,GAAG,GAAK,GAEhC,MAAI,CAACA,GAAOC,EAAK,EACP,KAGH,CACJ,IAAKD,EAAI,MAAM,EAAGC,CAAE,EAAE,KAAA,EAAO,YAAA,EAC7B,MAAOD,EAAI,MAAMC,EAAK,CAAC,CAAA,CAE7B,CAEA,SAASC,EAAkBpB,EAA4B,CACpD,SAAW,CAAE,KAAAU,CAAA,IAAUX,EAAYC,EAAO,MAAM,EAC7C,OAAQU,EAAA,CACL,IAAK,WACF,MAAO,SACV,IAAK,WACF,MAAO,SACV,IAAK,aACF,MAAO,WACV,IAAK,UACF,MAAO,QACV,IAAK,SACL,IAAK,KACF,MAAO,MAAA,CAGhB,MAAO,OACV,CAEA,SAASW,EAA0B,CAAE,KAAAX,GAAkC,CACpE,GAAIA,IAAS,MAAQA,IAAS,WAC3B,MAAO,SAEV,GAAIA,IAAS,eACV,MAAO,KAEb,CAOA,SAAUY,EAAkBtB,EAAuC,CAChE,UAAWG,KAAQH,EAAO,CACvB,MAAMC,EAAQoB,EAA0BlB,CAAI,EACtCoB,EAAatB,GAASgB,EAAgBd,EAAK,KAAK,EAElDoB,IACD,KAAM,CACH,GAAGA,EACH,MAAAtB,CAAA,EAGT,CACH,CAEO,SAASuB,EACbC,EACAzB,EACAS,EACqB,CACrB,MAAMiB,EAAqC,CACxC,KAAM,CAAA,EACN,MAAO,CAAC,GAAGJ,EAAkBtB,CAAK,CAAC,CAAA,EAGtC,OAAIyB,IAAS,UACVE,EACGD,EACAN,EAAkBpB,CAAK,EACvBQ,EAAmBR,EAAOS,CAAW,CAAA,EAIpCiB,CACV,CAEA,SAASC,EACND,EACAzB,EACA2B,EACD,CACC,GAAIA,IAAW,KACZ,OAGH,MAAMC,EAASd,EAAYd,EAAO2B,CAAM,EACpCA,EAAO,QACRF,EAAa,MAAM,KAAKG,CAAM,EAE9BH,EAAa,KAAK,KAAKG,CAAM,CAEnC,CCvFA,MAAMC,EAAsB,CACzB,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,CAAA,CACZ,CAEJ,EAEaC,EAAmB,CAC7B,MAAO,IAAI,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,GAAGD,EAAU,MAAM,QAAA,CAAQ,CAC7B,EACD,SAAU,IAAI,CACX,cACA,aACA,YACA,UACA,YACA,YACA,eACA,WAAA,CACF,CACJ,EAEME,EAAqC,CACxC,MAAO,CACJ,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,CAAA,CACZ,EACD,KAAM,IAAI,IAAI,CAAC,SAAU,SAAU,OAAQ,SAAU,cAAe,IAAK,UAAU,CAAC,CAAA,EAEvF,OAAQ,CACL,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAI,CAAA,CACZ,EACD,SAAU,IAAI,CAAC,OAAQ,UAAW,iBAAkB,gBAAiB,UAAU,CAAC,CAAA,EAEnF,OAAQ,CACL,UAAW,IAAI,CACZ,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,CAAA,CACb,EACD,KAAM,IAAI,IAAI,CAAC,OAAQ,UAAW,UAAW,OAAQ,OAAQ,OAAO,CAAC,CAAA,EAExE,MAAO,CACJ,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAA,EAEhC,KAAM,CACH,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAA,EAE7B,KAAM,CACH,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAA,EAEhC,KAAM,CACH,UAAW,IACX,KAAM,IAAI,IAAI,CAAC,OAAQ,cAAc,CAAC,CAAA,EAEzC,OAAQ,CACL,UAAW,IAAI,CACZ,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,EACV,CAAC,IAAK,EAAK,EACX,CAAC,IAAK,EAAI,CAAA,CACZ,EACD,SAAU,IAAI,CAAC,OAAQ,OAAQ,WAAY,iBAAiB,CAAC,CAAA,CAEnE,EAEMC,EAAkB,CAAE,MAAO,IAAI,IAAO,KAAM,IAAI,GAAI,EAEnD,SAASC,EAAmBT,EAAsB,CACtD,MAAMU,EAAOH,EAASP,GAAQ,EAAE,GAAKQ,EAErC,MAAO,CACJ,MAAO,IAAI,IAAI,CAAC,GAAGH,EAAU,MAAM,QAAA,EAAW,GAAGK,EAAK,MAAM,QAAA,CAAS,CAAC,EACtE,KAAMA,EAAK,IAAA,CAEjB,CCjHO,SAASC,EACblB,EACAiB,EAAOJ,EAKP,CACA,GAAIb,EAAI,WAAW,IAAI,EAAG,CACvB,MAAMC,EAAKD,EAAI,QAAQ,GAAG,EAC1B,GAAIC,EAAK,EACN,MAAO,CAAC,CAAE,KAAMD,EAAI,MAAM,EAAGC,CAAE,EAAG,MAAOD,EAAI,MAAMC,EAAK,CAAC,EAAG,UAAW,GAAO,EAEjF,MAAMkB,EAAOnB,EAAI,MAAM,CAAC,EACxB,MAAO,CAAC,CAAE,KAAMA,EAAK,UAAWiB,EAAK,KAAK,IAAIE,CAAI,EAAG,CACxD,CAGA,GAAInB,EAAI,SAAW,EAAG,CACnB,MAAMoB,EAAOpB,EAAI,OAAO,CAAC,EACnBqB,EAAWJ,EAAK,MAAM,IAAIG,CAAI,EACpC,MAAO,CAAC,CAAE,KAAMpB,EAAK,UAAWqB,IAAa,GAAM,CACtD,CAGA,OAAOC,EAActB,EAAKiB,EAAK,KAAK,CACvC,CAEA,SAASK,EACNtB,EACAuB,EAC4D,CAC5D,MAAMC,EAAQxB,EAAI,MAAM,CAAC,EAAE,MAAM,EAAE,EAC7ByB,EAAsE,CAAA,EAE5E,QAASC,EAAI,EAAGA,EAAIF,EAAM,OAAQE,IAAK,CACpC,MAAMN,EAAOI,EAAME,CAAC,EACdL,EAAWE,EAAU,IAAIH,CAAI,EAEnC,GAAIC,IAAa,OAEd,MAAO,CAAC,CAAE,KAAMrB,EAAK,UAAW,GAAO,EAG1C,GAAIqB,EAAU,CACX,MAAMM,EAAYH,EAAM,MAAME,EAAI,CAAC,EAAE,KAAK,EAAE,EAC5C,GAAIC,GAEG,CADsB,CAAC,GAAGA,CAAS,EAAE,MAAOC,GAAML,EAAU,IAAIK,CAAC,CAAC,EAGnE,OAAAH,EAAO,KAAK,CAAE,KAAM,IAAIL,CAAI,GAAI,MAAOO,EAAW,UAAW,EAAA,CAAO,EAC7DF,CAGhB,CAEAA,EAAO,KAAK,CAAE,KAAM,IAAIL,CAAI,GAAI,UAAWC,EAAU,CACxD,CAEA,OAAOI,CACV,CCxDO,SAASI,EAAiBC,EAA4BhD,EAAgB,GAAiB,CAC3F,IAAI4C,EAAI,EAER,KAAOA,EAAII,EAAO,QAAQ,CACvB,MAAM9B,EAAM,OAAO8B,EAAOJ,CAAC,CAAC,EAC5B,GAAI,CAAC1B,EAAI,WAAW,GAAG,GAAKA,EAAI,OAAS,EAAG,MAE5C,MAAM+B,EAASb,EAAYlB,CAAG,EAC9B,IAAIgC,EAAON,EAAI,EAEf,UAAWO,KAASF,EAAQ,CACzB,MAAM9C,EAAa,CAChB,KAAMgD,EAAM,KACZ,MAAOA,EAAM,MACb,aAAc,GACd,SAAU,EAAA,EAETA,EAAM,WAAahD,EAAK,QAAU,QAAa+C,EAAOF,EAAO,SAC9D7C,EAAK,MAAQ,OAAO6C,EAAOE,CAAI,CAAC,EAChC/C,EAAK,aAAe,GACpB+C,KAEHlD,EAAM,KAAKG,CAAI,CAClB,CAEAyC,EAAIM,CACP,CAEA,MAAO,CAAE,MAAAlD,EAAO,UAAW4C,CAAA,CAC9B,CCzBO,SAASQ,EACbJ,EACAvB,EACAzB,EAAgB,CAAA,EACN,CACV,MAAMmC,EAAOD,EAAmBT,CAAI,EAC9BhB,EAAwB,CAAA,EACxB4C,EAAsB,CAAA,EAE5B,IAAIT,EAAI,EACR,KAAOA,EAAII,EAAO,QAAQ,CACvB,MAAMM,EAAUN,EAAOJ,CAAC,EAExB,GAAIW,EAAAA,WAAWD,CAAO,EAAG,CACtBD,EAAU,KAAK,GAAGG,EAAAA,QAAQF,CAAiB,CAAC,EAC5CV,IACA,QACH,CAEA,MAAM1B,EAAM,OAAOoC,CAAO,EAE1B,GAAIpC,IAAQ,KAAM,CACf,QAASuC,EAAIb,EAAI,EAAGa,EAAIT,EAAO,OAAQS,IAAK,CACzC,MAAMC,EAAIV,EAAOS,CAAC,EAClBF,EAAAA,WAAWG,CAAC,EAAIL,EAAU,KAAK,GAAGG,EAAAA,QAAQE,CAAW,CAAC,EAAIL,EAAU,KAAK,OAAOK,CAAC,CAAC,CACrF,CACA,KACH,CAEA,GAAI,CAACxC,EAAI,WAAW,GAAG,GAAKA,EAAI,OAAS,EAAG,CACzCT,EAAY,KAAKS,CAAG,EACpB0B,IACA,QACH,CAEA,MAAMK,EAASb,EAAYlB,EAAKiB,CAAI,EACpC,IAAIe,EAAON,EAAI,EAEf,UAAWO,KAASF,EAAQ,CACzB,MAAM9C,EAAa,CAChB,KAAMgD,EAAM,KACZ,MAAOA,EAAM,MACb,aAAc,GACd,SAAU,EAAA,EAGVA,EAAM,WACNhD,EAAK,QAAU,QACf+C,EAAOF,EAAO,QACd,CAACO,EAAAA,WAAWP,EAAOE,CAAI,CAAC,IAExB/C,EAAK,MAAQ,OAAO6C,EAAOE,CAAI,CAAC,EAChC/C,EAAK,aAAe,GACpB+C,KAEHlD,EAAM,KAAKG,CAAI,CAClB,CAEAyC,EAAIM,CACP,CAEA,MAAO,CAAE,MAAAlD,EAAO,YAAAS,EAAa,UAAA4C,CAAA,CAChC,CCvEO,SAAUM,EAA6B,CAC3C,MAAAC,CACH,EAAmD,CAChD,UAAW/B,KAAU+B,EAClB,UAAWC,KAAUC,EAAqB,CACvC,MAAMC,EAAgBF,EAAOhC,EAAO,GAAG,EACnCkC,IACD,MAAMA,EAEZ,CAEN,CAEA,SAASC,EACNnC,EACAoC,EACAC,EAAU,OAAOrC,CAAM,EACxB,CACC,MAAMsC,EAAQ,OAAOtC,GAAW,SAAW,IAAI,OAAO,OAAOA,EAAO,aAAa,EAAE,EAAIA,EAEvF,OAAO,SAAwBf,EAAmC,CAC/D,GAAIqD,EAAM,KAAKrD,CAAG,EACf,MAAO,CACJ,SAAAmD,EACA,QAAS,eAAeC,CAAO,sCAAsCD,CAAQ,EAAA,CAGtF,CACH,CAEA,SAASG,EAA6BvC,EAAgBoC,EAAiC,CACpF,MAAME,EAAQ,IAAI,OAAO,OAAOtC,EAAO,YAAA,EAAc,QAAQ,MAAO,SAAS,CAAC,EAAE,EAChF,OAAOmC,EAAqBG,EAAOF,EAAUpC,CAAM,CACtD,CAEA,MAAMiC,EAAsB,CACzBE,EAAqB,QAAS,kBAAkB,EAChDA,EAAqB,eAAgB,oBAAoB,EACzDA,EAAqB,cAAe,mBAAmB,EACvDA,EAAqB,iBAAkB,sBAAsB,EAC7DA,EAAqB,gBAAiB,qBAAqB,EAC3DA,EAAqB,iBAAkB,sBAAsB,EAC7DA,EAAqB,aAAc,kBAAkB,EACrDA,EAAqB,kBAAmB,uBAAuB,EAC/DI,EAA6B,oBAAqB,6BAA6B,EAC/EA,EAA6B,eAAgB,yBAAyB,EACtEJ,EAAqB,gBAAiB,yBAAyB,EAC/DI,EAA6B,eAAgB,yBAAyB,EACtEA,EAA6B,gBAAiB,yBAAyB,EACvEA,EAA6B,eAAgB,mBAAmB,EAChEA,EAA6B,iBAAkB,mBAAmB,EAClEA,EAA6B,gBAAiB,mBAAmB,EACjEA,EAA6B,cAAe,uBAAuB,EACnEJ,EAAqB,eAAgB,oBAAoB,EACzDI,EAA6B,YAAa,oBAAoB,EAC9DJ,EAAqB,mBAAoB,wBAAwB,EACjEI,EAA6B,SAAU,kBAAkB,EACzDA,EAA6B,eAAgB,wBAAwB,EACrEA,EAA6B,iBAAkB,wBAAwB,EACvEA,EAA6B,gBAAiB,wBAAwB,EACtEA,EAA6B,iBAAkB,6BAA6B,EAC5EA,EAA6B,qBAAsB,iBAAiB,EACpEA,EAA6B,oBAAqB,iBAAiB,EACnEJ,EAAqB,6BAA8B,iBAAiB,EACpEA,EAAqB,kBAAmB,mBAAmB,EAC3DI,EAA6B,mBAAoB,sBAAsB,EACvEA,EAA6B,cAAe,4BAA4B,EACxEA,EAA6B,cAAe,4BAA4B,EACxEA,EAA6B,kBAAmB,4BAA4B,EAC5EA,EAA6B,gBAAiB,uBAAuB,CACxE,ECtEO,SAAUC,EACd5C,EACAzB,EACyB,CACzB,UAAWG,KAAQH,EAChB,UAAW6D,KAAUS,EAAoB,CACtC,MAAMP,EAAgBF,EAAOpC,EAAMtB,CAAI,EACnC4D,IACD,MAAMA,EAEZ,CAEN,CAgBA,SAASQ,EACN9C,EACAtB,EACA8D,EACA,CAAE,KAAAvD,EAAO,OAAOP,CAAI,EAAG,WAAAqE,EAAa,GAAO,UAAAC,EAAY,EAAA,EAA8B,CAAA,EACtF,CACC,MAAMN,EAAQ,OAAOhE,GAAS,SAAW,IAAI,OAAO,OAAOA,EAAK,aAAa,EAAE,EAAIA,EAC7E+D,EAAU,UAAUzC,EAAO,GAAGA,CAAI,gBAAkB,EAAE,GAAGf,CAAI,sCAAsCuD,CAAQ,GAEjH,OAAO,SAAqBS,EAA4BvE,EAAkC,CACvF,GAAI,EAAAsB,GAAQiD,IAAgBjD,IAIxB,EAAA+C,GAAc,CAACrE,EAAK,WAIpB,EAAAsE,GAAatE,EAAK,QAAU,SAI5BgE,EAAM,KAAKhE,EAAK,IAAI,EACrB,MAAO,CACJ,SAAA8D,EACA,QAAAC,CAAA,CAGT,CACH,CAEA,MAAMS,EAAuC,CAAE,WAAY,GAAM,UAAW,EAAA,EAEtEL,EAAqB,CACxBC,EAAmB,KAAM,0BAA2B,kBAAmB,CACpE,KAAM,iCAAA,CACR,EACDA,EAAmB,QAAS,SAAU,iBAAiB,EACvDA,EAAmB,QAAS,MAAO,iBAAiB,EACpDA,EAAmB,OAAQ,WAAY,kBAAmB,CAAE,KAAM,SAAU,EAE5EA,EAAmB,SAAU,oBAAqB,kBAAmB,CAAE,KAAM,eAAgB,EAC7FA,EAAmB,KAAM,aAAc,wBAAwB,EAC/DA,EAAmB,KAAM,cAAe,kBAAmBI,CAAgB,EAG3EJ,EAAmB,KAAM,YAAa,yBAA0BI,CAAgB,EAChFJ,EAAmB,KAAM,cAAe,yBAA0BI,CAAgB,EAClFJ,EAAmB,KAAM,OAAQ,yBAA0B,CAAE,GAAGI,EAAkB,KAAM,IAAA,CAAM,CACjG,EC1EO,SAASC,EACbnD,EACAzB,EACA6B,EACgB,CAChB,MAAO,CAAC,GAAGwC,EAAsB5C,EAAMzB,CAAK,EAAG,GAAG2D,EAA6B9B,CAAM,CAAC,CACzF,CCAO,SAASgD,KAAa7B,EAAwC,CAClE,KAAM,CAAE,MAAAhD,EAAO,UAAA8E,GAAc/B,EAAiBC,CAAM,EAE9CvB,EAAOqD,EAAY9B,EAAO,OAAS,OAAOA,EAAO8B,CAAS,CAAC,EAAE,YAAA,EAAgB,KAC7EC,EAAatD,IAAS,KAAOuB,EAAO,MAAM8B,EAAY,CAAC,EAAI,CAAA,EAE3D,CAAE,YAAArE,EAAa,UAAA4C,CAAA,EAAcD,EAAe2B,EAAYtD,EAAMzB,CAAK,EACnE6B,EAASL,EAAoBC,EAAMzB,EAAOS,CAAW,EAE3D,MAAO,CACJ,KAAAgB,EACA,MAAOzB,EAAM,IAAIgF,CAAY,EAC7B,MAAO3B,EACP,OAAAxB,EACA,gBAAiBoD,EAAkBL,EAAsBnD,EAAMzB,EAAO6B,CAAM,CAAC,CAAA,CAEnF,CAEA,SAASoD,EAAkBC,EAAkC,CAC1D,OAAO,OAAO,eAAeA,EAAiB,kBAAmB,CAC9D,MAAOA,CAAA,CACT,CACJ,CAEA,SAASF,EAAa,CAAE,MAAAG,EAAO,KAAAzE,GAA0B,CACtD,OAAOyE,IAAU,OAAY,CAAE,KAAAzE,EAAM,MAAAyE,CAAA,EAAU,CAAE,KAAAzE,CAAA,CACpD,CClCA,MAAM0E,EAAa,CAChB,OAAU,oBACV,YAAe,qBACf,kBAAqB,yBACrB,kBAAqB,yBACrB,iBAAoB,4BACpB,sBAAyB,4BACzB,WAAc,yBACd,WAAc,oBACd,cAAiB,kBACjB,kBAAqB,0BACrB,UAAa,mBACb,kBAAqB,sBACrB,iBAAoB,yBACpB,oBAAuB,oBACvB,QAAW,wBACX,gBAAmB,wBACnB,MAAS,mBACT,OAAU,yBACV,YAAe,qBACf,OAAU,mBACb,EAMA,SAAUC,EAAqBC,EAAqC,CACjE,MAAMC,EAAQ,SAASD,EAAI,kBAAoB,IAAK,EAAE,EACtD,QAASE,EAAQ,EAAGA,EAAQD,EAAOC,IAAS,CACzC,MAAM1E,EAAMwE,EAAI,kBAAkBE,CAAK,EAAE,EACnCL,EAAQG,EAAI,oBAAoBE,CAAK,EAAE,EAEzC1E,IAAQ,SACT,KAAM,CAAE,IAAKA,EAAI,YAAA,EAAc,OAAQ,MAAAqE,EAAO,MAAO,KAAA,EAE3D,CACH,CAEA,SAAUM,EAA6BH,EAAuC,CAC3E,UAAWxE,KAAO,OAAO,KAAKwE,CAAG,EAC9B,GAAII,EAAY5E,CAAG,EAAG,CACnB,MAAMmD,EAAWmB,EAAWtE,CAAG,EAC/B,KAAM,CACH,SAAAmD,EACA,QAAS,WAAWnD,EAAI,YAAA,CAAa,uCAAuCmD,CAAQ,EAAA,CAE1F,CAEN,CAEO,SAASyB,EAAY5E,EAA6C,CACtE,OAAO,OAAO,OAAOsE,EAAYtE,CAAG,CACvC,CAEA,SAAS6E,GAAWL,EAAsC,CACvD,MAAMM,EAAiB,CAAA,EACvB,SAAW,CAAC9E,EAAKqE,CAAK,IAAK,OAAO,QAAQG,CAAG,EAAG,CAC7C,MAAMO,EAAS/E,EAAI,YAAA,EAAc,KAAA,GAC7B4E,EAAYG,CAAM,GAAKA,EAAO,WAAW,KAAK,KAC/CD,EAAOC,CAAM,EAAI,OAAOV,CAAK,EAEnC,CACA,OAAOS,CACV,CAEO,SAASE,EAAS5E,EAA8B,CACpD,MAAMoE,EAAMK,GAAWzE,CAAG,EACpBW,EAA+B,CAClC,KAAM,CAAA,EACN,MAAO,CAAC,GAAGwD,EAAqBC,CAAG,CAAC,CAAA,EAEjCJ,EAAkB,CACrB,GAAGO,EAA6BH,CAAG,EACnC,GAAGV,EAAsB,KAAM,CAAA,EAAI/C,CAAM,CAAA,EAG5C,MAAO,CACJ,OAAAA,EACA,gBAAAqD,CAAA,CAEN,CC9EO,SAASa,GAAmB/C,EAA2BsC,EAA8B,CACzF,MAAO,CAAC,GAAGT,EAAU,GAAG7B,CAAM,EAAE,gBAAiB,GAAG8C,EAASR,CAAG,EAAE,eAAe,CACpF"}

package/node_modules/@simple-git/argv-parser/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { parseArgv } from './src/args/parse-argv';
 export type { ConfigRead, ConfigScope, ConfigWrite, ParsedArgv, ParsedFlag, } from './src/args/parse-argv.types';
-export { parseEnv } from './src/env/parse-env';
+export { isGitEnvKey, parseEnv } from './src/env/parse-env';
 export type { Vulnerability, VulnerabilityCategory, VulnerabilityCategoryFlags, } from './src/vulnerabilities/vulnerability.types';
 export { vulnerabilityCheck } from './src/vulnerabilities/vulnerability-check';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,YAAY,EACT,UAAU,EACV,WAAW,EACX,WAAW,EACX,UAAU,EACV,UAAU,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EACT,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC5B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC"}