codictator 0.0.0-stage → 0.1.2

package/dist/kernel/net.d.ts

@@ -0,0 +1,10 @@
+import type { Net, NetRequest, NetResponse } from "./index.ts";
+import { NET_ALLOWLIST, type NodeNetOptions, netHostAllowed, rejectNetUrl } from "./net-allow.ts";
+import { NET_MAX_BODY_BYTES, NET_MAX_REDIRECTS } from "./net-fetch.ts";
+import { type Result } from "./result.ts";
+export { NET_ALLOWLIST, NET_MAX_BODY_BYTES, NET_MAX_REDIRECTS, type NodeNetOptions, netHostAllowed, rejectNetUrl, };
+export declare class NodeNet implements Net {
+    private readonly extraHosts;
+    constructor(options?: NodeNetOptions);
+    request(req: NetRequest): Promise<Result<NetResponse>>;
+}

package/dist/kernel/net.js

@@ -0,0 +1,24 @@
+import { NET_ALLOWLIST, netHostAllowed, rejectNetUrl, } from "./net-allow.js";
+import { fetchOnce, NET_MAX_BODY_BYTES, NET_MAX_REDIRECTS, } from "./net-fetch.js";
+import { err } from "./result.js";
+export { NET_ALLOWLIST, NET_MAX_BODY_BYTES, NET_MAX_REDIRECTS, netHostAllowed, rejectNetUrl, };
+export class NodeNet {
+    extraHosts;
+    constructor(options = {}) {
+        this.extraHosts = options.extraHosts ?? [];
+    }
+    request(req) {
+        if (req.method === "") {
+            throw new Error("net request must name an HTTP method");
+        }
+        // SPEC §4.1.3 EC-4: rejected before any socket opens.
+        const rejected = rejectNetUrl(req.url, this.extraHosts);
+        if (rejected !== undefined) {
+            return Promise.resolve(err(rejected));
+        }
+        const current = new URL(req.url);
+        return new Promise((resolve) => {
+            fetchOnce(current, req.method, req.headers, req.body, req.timeoutMs, 0, this.extraHosts, resolve);
+        });
+    }
+}

package/dist/kernel/path.d.ts

@@ -0,0 +1,3 @@
+import { type Result } from "./result.ts";
+export declare function toRepoPath(path: string): Result<string>;
+export declare function isGitDirPath(rel: string): boolean;

package/dist/kernel/path.js

@@ -0,0 +1,40 @@
+// SPEC §4.1.2: POSIX-separated, repo-relative, case preserved. A path with
+// .. that normalises inside the repo is allowed and the normalised path is
+// used (EC-2); one that escapes the root fails with CDX-E701 (EC-1).
+import { makeError } from "./errors.js";
+import { err, ok } from "./result.js";
+function escapeError() {
+    return makeError("CDX-E701", "path escapes the repo root", "Keep the path inside the repo root; remove leading .. segments.");
+}
+export function toRepoPath(path) {
+    if (path === "") {
+        return err(escapeError());
+    }
+    const slashed = path.replace(/\\/g, "/");
+    if (slashed.startsWith("/") || /^[A-Za-z]:(\/|$)/.test(slashed)) {
+        return err(escapeError());
+    }
+    const kept = [];
+    for (const part of slashed.split("/")) {
+        if (part === "" || part === ".") {
+            continue;
+        }
+        if (part === "..") {
+            const previous = kept.pop();
+            if (previous === undefined) {
+                return err(escapeError());
+            }
+            continue;
+        }
+        kept.push(part);
+    }
+    if (kept.length === 0) {
+        return ok(".");
+    }
+    return ok(kept.join("/"));
+}
+// SPEC §4.7.3: writes into .git/ are blocked except through git itself.
+// The input is a repo-relative normalised path as toRepoPath returns it.
+export function isGitDirPath(rel) {
+    return rel === ".git" || rel.startsWith(".git/");
+}

package/dist/kernel/pattern.d.ts

@@ -0,0 +1,2 @@
+import { type Result } from "./result.ts";
+export declare function checkPattern(pattern: string): Result<void>;

package/dist/kernel/pattern.js

@@ -0,0 +1,116 @@
+// SPEC §9.2: every regex from a pack, config or generator is checked before
+// use. Length is capped at 1,000, nested quantifiers over overlapping groups
+// ((a+)+-class) and backreferences are rejected, and matching runs per line
+// with a 10 ms per-file budget enforced by the caller. Violations fail with
+// CDX-E902, never a throw.
+import { makeError } from "./errors.js";
+import { err, ok } from "./result.js";
+const MAX_PATTERN_LENGTH = 1000;
+function tooLongError() {
+    return err(makeError("CDX-E902", "pattern exceeds the 1,000-character safety budget", "Shorten the pattern or split it into several anchored patterns."));
+}
+function nestedError() {
+    return err(makeError("CDX-E902", "pattern nests a quantifier inside a quantified group", "Rewrite without nested quantifiers; match per line instead."));
+}
+function backreferenceError() {
+    return err(makeError("CDX-E902", "pattern uses a backreference", "Rewrite the pattern without backreferences."));
+}
+function invalidError() {
+    return err(makeError("CDX-E902", "pattern has unbalanced parentheses", "Balance every opening parenthesis before using the pattern."));
+}
+// SPEC §9.2: scan with escape and character-class awareness so an escaped
+// parenthesis or a bracketed quantifier cannot hide a nested quantifier.
+export function checkPattern(pattern) {
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+        return tooLongError();
+    }
+    const groups = [];
+    let quantifiedInside = false;
+    let index = 0;
+    while (index < pattern.length) {
+        const current = pattern.charAt(index);
+        if (current === "\\") {
+            const next = pattern.charAt(index + 1);
+            if (next !== "" && next >= "1" && next <= "9") {
+                return backreferenceError();
+            }
+            if (next === "k") {
+                return backreferenceError();
+            }
+            index += 2;
+            continue;
+        }
+        if (current === "[") {
+            index += 1;
+            if (pattern.charAt(index) === "^") {
+                index += 1;
+            }
+            if (pattern.charAt(index) === "]") {
+                index += 1;
+            }
+            while (index < pattern.length && pattern.charAt(index) !== "]") {
+                if (pattern.charAt(index) === "\\") {
+                    index += 1;
+                }
+                index += 1;
+            }
+            index += 1;
+            continue;
+        }
+        if (current === "(") {
+            groups.push({ quantifiedInside });
+            quantifiedInside = false;
+            index += 1;
+            // SPEC §9.2: a ? directly after ( opens a non-capturing or
+            // lookaround group; it quantifies nothing.
+            if (pattern.charAt(index) === "?") {
+                index += 1;
+                const marker = pattern.charAt(index);
+                if (marker === ":" || marker === "=" || marker === "!") {
+                    index += 1;
+                }
+                else if (marker === "<") {
+                    const close = pattern.indexOf(">", index);
+                    if (close >= 0) {
+                        index = close + 1;
+                    }
+                }
+            }
+            continue;
+        }
+        if (current === ")") {
+            const frame = groups.pop();
+            if (frame === undefined) {
+                return invalidError();
+            }
+            const quantifier = pattern.charAt(index + 1);
+            const groupQuantified = quantifier === "+" || quantifier === "*" || quantifier === "?";
+            const braceQuantified = quantifier === "{";
+            if ((groupQuantified || braceQuantified) && quantifiedInside) {
+                return nestedError();
+            }
+            quantifiedInside =
+                frame.quantifiedInside || groupQuantified || braceQuantified;
+            index += 1;
+            continue;
+        }
+        if (current === "+" || current === "*" || current === "?") {
+            quantifiedInside = true;
+            index += 1;
+            continue;
+        }
+        if (current === "{") {
+            const rest = pattern.slice(index);
+            if (/^\{\d+(,\d*)?\}/.test(rest)) {
+                quantifiedInside = true;
+            }
+            index += 1;
+            continue;
+        }
+        index += 1;
+    }
+    if (groups.length > 0) {
+        return invalidError();
+    }
+    return ok(undefined);
+}

package/dist/kernel/proc.d.ts

@@ -0,0 +1,6 @@
+import type { Proc, ProcOptions, ProcResult } from "./index.ts";
+export declare const PROC_ENV_ALLOWLIST: ReadonlyArray<string>;
+export declare function buildProcEnv(requested: Readonly<Record<string, string>>): Record<string, string>;
+export declare class NodeProc implements Proc {
+    run(argv: ReadonlyArray<string>, options: ProcOptions): Promise<ProcResult>;
+}

package/dist/kernel/proc.js

@@ -0,0 +1,207 @@
+// SPEC §4.1.1 and §9.2: the real Proc port. argv arrays only, shell:false
+// always, the child env built from the §9.2 allowlist (plus a tool's envPass
+// restricted to that allowlist, GITHUB_* only when CI is set). Output past
+// maxOutputBytes kills the tree and returns truncated:true; a timeout kills
+// the process tree (SIGTERM, then SIGKILL or taskkill /T /F within 1 s) and
+// returns timedOut:true.
+import { spawn, spawnSync } from "node:child_process";
+// SPEC §9.2: the only names a child process may inherit or receive.
+export const PROC_ENV_ALLOWLIST = [
+    "CI",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "PATH",
+    "SystemRoot",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "USERPROFILE",
+];
+function takeEnv(into, name, value) {
+    if (value !== undefined) {
+        into[name] = value;
+    }
+}
+export function buildProcEnv(requested) {
+    const child = {};
+    const { CI: requestedCI } = requested;
+    const { CI: ambientCI } = process.env;
+    const ciActive = (requestedCI ?? ambientCI ?? "") !== "";
+    for (const name of PROC_ENV_ALLOWLIST) {
+        takeEnv(child, name, requested[name] ?? process.env[name]);
+    }
+    if (ciActive) {
+        for (const [name, value] of Object.entries(process.env)) {
+            if (name.startsWith("GITHUB_")) {
+                takeEnv(child, name, value);
+            }
+        }
+        for (const [name, value] of Object.entries(requested)) {
+            if (name.startsWith("GITHUB_")) {
+                takeEnv(child, name, value);
+            }
+        }
+    }
+    return child;
+}
+const KILL_GRACE_MS = 500;
+function signalOne(pid, signal) {
+    try {
+        process.kill(pid, signal);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// SPEC §4.1.3 EC-6: the tree dies within 1 s even when the child ignores
+// SIGTERM. POSIX kills the process group (SIGTERM, then SIGKILL after the
+// grace); Windows has no SIGTERM semantics, so the first action is already
+// taskkill /T /F, repeated on escalation to catch late grandchildren.
+function killTree(pid, escalate) {
+    if (pid === undefined) {
+        return;
+    }
+    try {
+        if (process.platform === "win32") {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], {
+                stdio: "ignore",
+            });
+            return;
+        }
+        if (escalate) {
+            if (!signalOne(-pid, "SIGKILL")) {
+                signalOne(pid, "SIGKILL");
+            }
+            return;
+        }
+        if (!signalOne(-pid, "SIGTERM")) {
+            signalOne(pid, "SIGTERM");
+        }
+    }
+    catch {
+        return;
+    }
+}
+function pushChunk(state, store, chunk, max, kill) {
+    if (state.keptBytes >= max) {
+        return;
+    }
+    const room = max - state.keptBytes;
+    if (chunk.length <= room) {
+        store.push(chunk);
+        state.keptBytes += chunk.length;
+        return;
+    }
+    store.push(chunk.subarray(0, room));
+    state.keptBytes += room;
+    state.truncated = true;
+    kill();
+}
+function clearRunTimers(state) {
+    if (state.timer !== undefined) {
+        clearTimeout(state.timer);
+        state.timer = undefined;
+    }
+    if (state.grace !== undefined) {
+        clearTimeout(state.grace);
+        state.grace = undefined;
+    }
+}
+function makeRunState() {
+    return {
+        out: [],
+        err: [],
+        keptBytes: 0,
+        truncated: false,
+        timedOut: false,
+        settled: false,
+        timer: undefined,
+        grace: undefined,
+    };
+}
+function armTimeout(state, timeoutMs, onTimeout) {
+    state.timer = setTimeout(() => {
+        state.timedOut = true;
+        onTimeout();
+    }, timeoutMs);
+}
+function wireOutput(child, state, maxOutputBytes, ensureDead) {
+    child.stdout?.on("data", (chunk) => {
+        pushChunk(state, state.out, chunk, maxOutputBytes, ensureDead);
+    });
+    child.stderr?.on("data", (chunk) => {
+        pushChunk(state, state.err, chunk, maxOutputBytes, ensureDead);
+    });
+}
+function wireCompletion(child, finish) {
+    child.on("error", () => {
+        finish(-1);
+    });
+    child.on("close", (code) => {
+        finish(code ?? -1);
+    });
+}
+function feedStdin(child, stdin) {
+    if (stdin === undefined) {
+        child.stdin?.end();
+        return;
+    }
+    child.stdin?.on("error", () => {
+        child.stdin?.destroy();
+    });
+    child.stdin?.write(stdin, () => {
+        child.stdin?.end();
+    });
+}
+function runNodeProcess(file, args, options) {
+    return new Promise((resolve) => {
+        const state = makeRunState();
+        const finish = (code) => {
+            if (state.settled) {
+                return;
+            }
+            state.settled = true;
+            clearRunTimers(state);
+            resolve({
+                code,
+                stdout: Buffer.concat(state.out).toString("utf8"),
+                stderr: Buffer.concat(state.err).toString("utf8"),
+                timedOut: state.timedOut,
+                truncated: state.truncated,
+            });
+        };
+        // SPEC §4.1.1: argv array only, shell:false; detached on POSIX so the
+        // timeout kill reaches the whole process group (EC-6).
+        const child = spawn(file, [...args], {
+            cwd: options.cwd,
+            env: buildProcEnv(options.env),
+            shell: false,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+            detached: process.platform !== "win32",
+        });
+        const ensureDead = () => {
+            killTree(child.pid, false);
+            if (state.grace === undefined) {
+                state.grace = setTimeout(() => {
+                    killTree(child.pid, true);
+                }, KILL_GRACE_MS);
+            }
+        };
+        armTimeout(state, options.timeoutMs, ensureDead);
+        wireOutput(child, state, options.maxOutputBytes, ensureDead);
+        wireCompletion(child, finish);
+        feedStdin(child, options.stdin);
+    });
+}
+export class NodeProc {
+    run(argv, options) {
+        const [file, ...args] = argv;
+        if (file === undefined) {
+            throw new Error("proc argv must list an executable first");
+        }
+        return runNodeProcess(file, args, options);
+    }
+}

package/dist/kernel/read-cache.d.ts

@@ -0,0 +1,6 @@
+import type { Fs, Result } from "./index.ts";
+export interface LossyText {
+    readonly bytes: number;
+    readonly text: string;
+}
+export declare function cachedLossyText(fs: Fs, path: string): Promise<Result<LossyText>>;

package/dist/kernel/read-cache.js

@@ -0,0 +1,27 @@
+const caches = new WeakMap();
+const decoder = new TextDecoder("utf-8", { fatal: false });
+export function cachedLossyText(fs, path) {
+    let perFs = caches.get(fs);
+    if (perFs === undefined) {
+        perFs = new Map();
+        caches.set(fs, perFs);
+    }
+    const hit = perFs.get(path);
+    if (hit !== undefined) {
+        return hit;
+    }
+    const pending = fs.read(path).then((loaded) => {
+        if (!loaded.ok) {
+            return loaded;
+        }
+        return {
+            ok: true,
+            value: {
+                bytes: loaded.value.length,
+                text: decoder.decode(loaded.value),
+            },
+        };
+    });
+    perFs.set(path, pending);
+    return pending;
+}

package/dist/kernel/redact.d.ts

@@ -0,0 +1 @@
+export declare function redactSecrets(text: string): string;

package/dist/kernel/redact.js

@@ -0,0 +1,206 @@
+// SPEC §4.7.1 detectors, implemented here in the kernel so engine, audit,
+// adapters and generator can redact without importing security (§3.3).
+// Every match is replaced by its first 4 characters plus its length;
+// env references, placeholders and fixture paths are left unchanged.
+const KNOWN_FORMATS = [
+    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bghp_[A-Za-z0-9]{36,}\b/g,
+    /\bgho_[A-Za-z0-9]{36,}\b/g,
+    /\bghs_[A-Za-z0-9]{36,}\b/g,
+    /\bghu_[A-Za-z0-9]{36,}\b/g,
+    /\bghr_[A-Za-z0-9]{36,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g,
+    /\bglpat-[A-Za-z0-9_-]{20,}/g,
+    /\bxox[abposr]-[A-Za-z0-9-]{8,}/g,
+    /\b[rs]k_live_[A-Za-z0-9]{16,}/g,
+    /\bAIza[A-Za-z0-9_-]{35}\b/g,
+    /\bnpm_[A-Za-z0-9]{36}\b/g,
+    /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+];
+// Keyword-first half of the assignment detector (SPEC §4.7.1): the same
+// keyword alternation the old `["']?([A-Za-z0-9_.$-]*...)` pattern used,
+// run alone so the engine can use a literal search instead of backtracking
+// the leading name-character run at every position.
+const KEYWORD_PATTERN = /secret|token|passw(?:or)?d|api[_-]?key|private[_-]?key|client[_-]?secret/gi;
+// Sticky tail of an assignment match, anchored at the end of the keyword:
+// the optional quote, separator and value run of the original pattern,
+// split so the value (group 2) stays available for the entropy check.
+const ASSIGNMENT_MID = /["']?\s*[:=]\s*["']?/y;
+const ASSIGNMENT_VALUE = /[^\s"'`;,]+/y;
+const ALLOW_PATTERNS = [
+    /process\.env\.[A-Za-z_][A-Za-z0-9_]*/g,
+    /\$\{[A-Za-z_][A-Za-z0-9_]*\}/g,
+    /\$[A-Za-z_][A-Za-z0-9_]*/g,
+    /os\.environ\s*\[[^\]\n]*\]/g,
+];
+const PLACEHOLDER_PATTERN = /^(?:x+|changeme|example|your[-_].*|<.*>)$/i;
+function allowSpans(text) {
+    const spans = [];
+    for (const pattern of ALLOW_PATTERNS) {
+        pattern.lastIndex = 0;
+        let match = pattern.exec(text);
+        while (match !== null) {
+            spans.push({
+                start: match.index,
+                end: match.index + match[0].length,
+                replacement: match[0],
+            });
+            match = pattern.exec(text);
+        }
+    }
+    return spans;
+}
+// The `[A-Za-z0-9_.$-]` name class of the assignment detector as char
+// codes, for the backward scan to the start of the name run.
+function isNameChar(code) {
+    return ((code >= 0x30 && code <= 0x39) ||
+        (code >= 0x41 && code <= 0x5a) ||
+        (code >= 0x61 && code <= 0x7a) ||
+        code === 0x24 ||
+        code === 0x2e ||
+        code === 0x2d ||
+        code === 0x5f);
+}
+function isQuote(value) {
+    return value === '"' || value === "'";
+}
+function redact(match) {
+    return `${match.slice(0, 4)}…(${match.length})`;
+}
+function shannonPerChar(value) {
+    const counts = new Map();
+    for (const char of value) {
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const probability = count / value.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+function isAllowedSecret(candidate) {
+    return PLACEHOLDER_PATTERN.test(candidate);
+}
+function assignmentSpans(text) {
+    const spans = [];
+    // Keyword-first scan: the original leading `[A-Za-z0-9_.$-]*` made the
+    // engine backtrack over every long run of name characters (quadratic on
+    // inputs like 65KB of `a`). Anchoring each attempt at a keyword keeps
+    // every scan over disjoint input. The original pattern also allowed
+    // trailing name characters after the keyword (`aws_secret_access_key`),
+    // so the separator check runs at the end of the name run; the floor
+    // advances past every examined run, keeping the scan linear.
+    KEYWORD_PATTERN.lastIndex = 0;
+    let keyword = KEYWORD_PATTERN.exec(text);
+    let floor = 0;
+    while (keyword !== null) {
+        const keywordStart = keyword.index;
+        const keywordEnd = keywordStart + keyword[0].length;
+        if (keywordStart >= floor) {
+            let nameEnd = keywordEnd;
+            while (nameEnd < text.length && isNameChar(text.charCodeAt(nameEnd))) {
+                nameEnd += 1;
+            }
+            floor = nameEnd;
+            ASSIGNMENT_MID.lastIndex = nameEnd;
+            const mid = ASSIGNMENT_MID.exec(text);
+            if (mid !== null) {
+                ASSIGNMENT_VALUE.lastIndex = ASSIGNMENT_MID.lastIndex;
+                const value = ASSIGNMENT_VALUE.exec(text);
+                if (value !== null) {
+                    let end = ASSIGNMENT_VALUE.lastIndex;
+                    if (isQuote(text[end])) {
+                        end += 1;
+                    }
+                    let start = keywordStart;
+                    while (start > 0 && isNameChar(text.charCodeAt(start - 1))) {
+                        start -= 1;
+                    }
+                    if (start > 0 && isQuote(text[start - 1])) {
+                        start -= 1;
+                    }
+                    const candidate = value[0];
+                    const full = text.slice(start, end);
+                    if (candidate.length >= 20 &&
+                        shannonPerChar(candidate) >= 4 &&
+                        !isAllowedSecret(candidate)) {
+                        spans.push({
+                            start,
+                            end,
+                            replacement: redact(full),
+                        });
+                    }
+                    floor = end;
+                }
+            }
+        }
+        keyword = KEYWORD_PATTERN.exec(text);
+    }
+    return spans;
+}
+function formatSpans(text) {
+    const spans = [];
+    for (const pattern of KNOWN_FORMATS) {
+        pattern.lastIndex = 0;
+        let match = pattern.exec(text);
+        while (match !== null) {
+            const found = match[0];
+            if (!isAllowedSecret(found)) {
+                spans.push({
+                    start: match.index,
+                    end: match.index + found.length,
+                    replacement: redact(found),
+                });
+            }
+            match = pattern.exec(text);
+        }
+    }
+    return spans;
+}
+function mergeSpans(spans) {
+    const sorted = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+    const merged = [];
+    for (const span of sorted) {
+        const last = merged[merged.length - 1];
+        if (last === undefined || span.start >= last.end) {
+            merged.push(span);
+        }
+        else if (span.end > last.end) {
+            merged[merged.length - 1] = { ...last, end: span.end };
+        }
+    }
+    return merged;
+}
+export function redactSecrets(text) {
+    // Both lists are sorted and non-overlapping after merging, so one sweep
+    // each replaces the per-candidate overlap scans (SPEC §4.7.1: the sort
+    // keeps the widest of overlapping candidates first, so the survivor is
+    // unchanged).
+    const allowed = mergeSpans(allowSpans(text));
+    const candidates = [...formatSpans(text), ...assignmentSpans(text)];
+    candidates.sort((a, b) => a.start - b.start || b.end - a.end);
+    const parts = [];
+    let cursor = 0;
+    let allowedIndex = 0;
+    for (const span of candidates) {
+        if (span.start < cursor) {
+            continue;
+        }
+        while (allowedIndex < allowed.length &&
+            (allowed[allowedIndex]?.end ?? 0) <= span.start) {
+            allowedIndex += 1;
+        }
+        const blocker = allowed[allowedIndex];
+        if (blocker !== undefined && blocker.start < span.end) {
+            continue;
+        }
+        parts.push(text.slice(cursor, span.start));
+        parts.push(span.replacement);
+        cursor = span.end;
+    }
+    parts.push(text.slice(cursor));
+    return parts.join("");
+}

package/dist/kernel/repo-root.d.ts

@@ -0,0 +1,3 @@
+import { type Result } from "./result.ts";
+export declare function pathExists(target: string): Promise<boolean>;
+export declare function resolveRepoRoot(startDir: string): Promise<Result<string>>;