ecdsa-scan 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ecdsa.com
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,303 @@
+# `ecdsa-scan`
+
+[![npm version](https://img.shields.io/npm/v/ecdsa-scan.svg)](https://www.npmjs.com/package/ecdsa-scan)
+[![license: MIT](https://img.shields.io/badge/license-MIT-emerald.svg)](./LICENSE)
+[![node >=20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org)
+
+Static analysis for code that creates and checks **digital signatures**.
+
+Secret scanners already find committed keys. This tool looks for the layer above
+that: the places where signature code is *subtly wrong* — a JWT verified without
+pinning the algorithm, a P-256 key generated in a file that derives Ethereum
+addresses, an `r‖s` signature built by hand without padding, a verification whose
+boolean result is thrown away.
+
+It is **read-only** (it never rewrites your files), has **zero dependencies**,
+needs **no build step**, and runs on Node 20+.
+
+```
+$ ecdsa scan ./src
+
+src/auth/session.ts
+  42:18  confirmed  jwt-verify-missing-algorithms  JWT verified without an explicit algorithm allow-list
+      │ const claims = jwt.verify(token, publicKey);
+      `jwt.verify(token, publicKey)` does not pass `algorithms`, so the token header
+      decides how the signature is checked.
+      Why it matters: A JWT names its own algorithm in the header, so a verifier that
+      does not pin the accepted algorithms lets the token choose how it is checked …
+      Fix:
+        jwt.verify(token, publicKey, { algorithms: ["ES256"] })
+      Reference: https://datatracker.ietf.org/doc/html/rfc8725#section-3.1
+
+Summary 214 files scanned, 3 findings (1 confirmed, 2 advisory)
+Exit code 1: 1 confirmed finding.
+```
+
+## Install and run
+
+```bash
+# no install
+npx ecdsa-scan .
+
+# from a clone of this repository
+node cli/src/index.js scan .
+
+# global (installs two equivalent binaries: `ecdsa-scan` and `ecdsa`)
+npm install -g ecdsa-scan && ecdsa scan .
+```
+
+## Usage
+
+```
+ecdsa scan [path]            scan a directory or a single file (default: .)
+ecdsa rules                  list the rules and their default confidence
+ecdsa --help | --version
+
+--json                       machine-readable report on stdout
+--sarif [file]               write SARIF 2.1.0 (default: ecdsa-scan.sarif, "-" for stdout)
+--min-confidence <level>     confirmed | suspected | advisory   (default: advisory)
+--ignore <glob>              skip paths matching a glob; repeatable
+--no-color                   plain output (also honours NO_COLOR)
+```
+
+Examples:
+
+```bash
+ecdsa scan ./src --min-confidence suspected
+ecdsa scan . --ignore "**/*.test.ts" --ignore examples
+ecdsa scan . --sarif results.sarif        # upload to GitHub Code Scanning
+ecdsa scan . --json | jq '.inventory'     # the CBOM seed
+ecdsa scan . --json | jq '.findings[] | select(.confidence=="confirmed")'
+```
+
+**Languages:** JavaScript, TypeScript, Python, Go (`.js .mjs .cjs .jsx .ts .tsx
+.mts .cts .py .go`), plus key files (`.pem .key .p8 .p12 .pfx .jks`, `id_rsa`,
+`id_ecdsa`, …).
+**Skipped automatically:** `node_modules`, `.git`, `dist`, `build`, `out`,
+`vendor`, `.next`, `.venv`, `__pycache__`, `target`, `coverage` and similar.
+
+### Exit codes
+
+| Code | Meaning |
+|---|---|
+| `0` | no **confirmed** findings (suspected/advisory findings do not fail a build) |
+| `1` | at least one confirmed finding — use this to gate CI |
+| `2` | usage error, or the path could not be read |
+
+### Three levels of confidence
+
+Findings are graded, and the grade is the contract with you:
+
+| Level | Meaning | What to do |
+|---|---|---|
+| **confirmed** | The pattern is a defect regardless of surrounding code. | Fix it. |
+| **suspected** | Very likely wrong; the surrounding code decides. | Read the finding, then fix or dismiss. |
+| **advisory** | Worth a look. Legitimate code matches here. | Treat as a question, not a verdict. |
+
+Some rules move a finding between levels based on context — a private key in a
+`test/fixtures/` path is reported as advisory rather than confirmed, and a
+`jwt.decode()` whose result feeds a role check is upgraded from advisory to
+suspected.
+
+## Rules
+
+14 defect rules and one inventory collector. `ecdsa rules` prints the same list.
+
+| Rule | Default | Severity | What it finds |
+|---|---|---|---|
+| `jwt-verify-missing-algorithms` | confirmed | high | `jwt.verify` / `jwtVerify` without `algorithms:`, PyJWT `decode` without `algorithms=`, `jwt.Parse` without `WithValidMethods`; also empty or `"none"` lists |
+| `jwt-decode-without-verification` | suspected | high | `jwt.decode`, `decodeJwt`, `jwtDecode`, PyJWT `verify_signature: False` — upgraded when role/user/permission identifiers follow the call |
+| `jwt-alg-from-token` | confirmed | high | The algorithm list is built from the token's own header (`algorithms: [header.alg]`, `get_unverified_header`) |
+| `curve-mixing` | advisory | medium | A P-256 key created in Ethereum/Bitcoin code (suspected); secp256k1 and P-256 handled in one module (advisory) |
+| `signature-encoding` | suspected | medium | `r`/`s` concatenated without zero-padding to the field size; Node `crypto.sign`/`verify` without `dsaEncoding` in JWS code (advisory) |
+| `secp256k1-low-s` | advisory | low | secp256k1 signing/verification with no mention of low-S canonicalisation |
+| `insecure-nonce-source` | confirmed | high | `Math.random()` / Python `random` / `math/rand` next to key or nonce material (confirmed); caller-supplied `k`, `extraEntropy`, `deterministic: false` (suspected) |
+| `hardcoded-private-key` | confirmed | high | PEM private key blocks in source; 64-hex literals assigned to `privateKey`/`secret`/`signingKey`-style names (suspected) |
+| `key-file-outside-tests` | suspected | high | `.pem`/`.key`/`.p12`/`id_ecdsa` files with private key material outside `test/`, `fixtures/`, `examples/` |
+| `non-constant-time-comparison` | suspected | medium | Signatures/MACs/digests compared with `==`, `===`, `.equals()`, `bytes.Equal` instead of a constant-time helper |
+| `unchecked-verification-result` | suspected | high | Boolean-returning verification (`crypto.verify`, `ecdsa.VerifyASN1`, …) called as a bare statement |
+| `weak-signature-hash` | confirmed | high | SHA-1/MD5 in a signing path (`createSign("sha1")`, `hashes.SHA1()`, `x509.SHA1WithRSA`); SHA-1 digests elsewhere in signing code (advisory) |
+| `unvalidated-public-key-point` | advisory | medium | Public keys built from raw x/y coordinates with no on-curve check; hand-rolled curve arithmetic |
+| `tls-verification-disabled` | confirmed | high | `rejectUnauthorized: false`, `NODE_TLS_REJECT_UNAUTHORIZED=0`, `verify=False` on HTTP clients, `ssl.CERT_NONE`, `InsecureSkipVerify: true` |
+| `crypto-inventory` | — | — | Not a defect rule: collects libraries, algorithms, curves and signing operations per file |
+
+Every finding carries a plain-English explanation, a fix example and a link to
+the relevant RFC or guidance.
+
+### Inventory (the CBOM seed)
+
+`--json` includes an `inventory` section: which crypto libraries, algorithms,
+curves and signing operations appear in which files. This is the raw material
+for a cryptographic bill of materials, and for answering "where do we depend on
+ECDSA?" before the NIST 2030/2035 deadlines.
+
+```json
+{
+  "inventory": {
+    "libraries": [{ "name": "jose", "detail": "npm", "files": ["src/auth/jwt.ts"] }],
+    "algorithms": [{ "name": "ES256", "files": ["src/auth/jwt.ts"] }],
+    "curves": [{ "name": "P-256", "files": ["src/auth/jwt.ts"] }],
+    "operations": [{ "name": "verify", "files": ["src/auth/jwt.ts"] }]
+  }
+}
+```
+
+## GitHub Action
+
+A complete workflow: scan on every push and pull request, publish the findings
+to GitHub Code Scanning as pull-request annotations.
+
+```yaml
+# .github/workflows/ecdsa-scan.yml
+name: ecdsa-scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  security-events: write           # required by upload-sarif
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: ECDSA signature scan
+        run: npx ecdsa-scan . --sarif ecdsa.sarif
+        continue-on-error: true    # keep the upload step running on findings
+
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: ecdsa.sarif
+```
+
+Confidence maps to SARIF levels: confirmed → `error`, suspected → `warning`,
+advisory → `note`. Each rule ships its explanation, fix and reference in the
+SARIF `help` field, so the annotation in a pull request is self-contained.
+
+To fail the job on confirmed findings instead of only annotating, drop
+`continue-on-error` — the scanner exits `1` when a confirmed finding exists.
+A ready-made composite action lives in [`action.yml`](./action.yml).
+
+## Pre-commit
+
+With [pre-commit](https://pre-commit.com):
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: local
+    hooks:
+      - id: ecdsa-scan
+        name: ecdsa-scan (signature defects)
+        entry: npx --yes ecdsa-scan
+        args: ["--min-confidence", "suspected"]
+        language: system
+        pass_filenames: false      # the scanner walks the tree itself
+```
+
+Or as a plain Git hook:
+
+```bash
+# .git/hooks/pre-commit
+#!/bin/sh
+npx --yes ecdsa-scan . || exit 1
+```
+
+Only **confirmed** findings exit non-zero, so a pre-commit hook blocks real
+defects without nagging about advisory matches.
+
+## How it works
+
+1. Walk the tree, skipping dependency and build directories.
+2. For each file build three views of the source, all with identical byte
+   offsets: the raw text; a copy with **comments blanked**; and a copy with the
+   **contents of strings, template literals, regexes and JSX prose blanked** too.
+3. Run every rule that applies to the file's language. Rules match structure
+   against the masked views (so documentation and code samples never become
+   findings) and read literal values from the raw view when the value is the
+   point — a PEM header, `createSign("sha1")`, a curve name.
+4. Sort, de-duplicate and format.
+
+There is no parser and no type information. That is a deliberate trade-off: the
+tool runs on any repository instantly, in any state, without installing its
+dependencies or compiling anything.
+
+## Limitations — read this
+
+This is pattern matching over text, not program analysis. Specifically:
+
+- **False positives happen.** A module that legitimately supports several curves
+  matches `curve-mixing`; a signature-debugging tool legitimately calls
+  `jwt.decode`. That is why every rule has a confidence level, why only
+  *confirmed* findings fail the build, and why advisory findings are phrased as
+  questions.
+- **False negatives happen, and they are worse.** Anything indirect is invisible:
+  a wrapper function (`verifyToken()` defined in another file), an algorithm read
+  from configuration, a key type decided at runtime, a defect expressed through
+  a library this tool has never heard of.
+- **Weak randomness is only partly detectable.** A biased nonce produced by a
+  custom PRNG three modules away looks exactly like correct code. Statistical
+  nonce problems are found by looking at *signatures*, not at source.
+- **No cross-file analysis, no data flow, no taint tracking.** Each file is
+  judged on its own.
+- **Comment and literal masking is heuristic.** Unusual formatting (a regex the
+  lexer misreads, a template literal containing real logic in `${…}`) can hide a
+  finding.
+- **It does not check your cryptography is correct** — only that certain
+  well-known mistakes are absent. Passing this scan is not an audit, and no
+  finding count implies a security level.
+
+Treat the output as a prioritised reading list for a human reviewer.
+
+## Development
+
+```bash
+node --test test/*.test.js     # 78 tests, no dependencies
+node src/index.js scan ..      # dogfood: scan the repository above
+```
+
+`test/fixtures/bad/` holds a defective example per rule and
+`test/fixtures/good/` the corrected version of the same code; the suite asserts
+that every rule fires on the first and stays silent on the second. The `.pem`
+fixtures contain placeholder text, not usable keys.
+
+### Adding a rule
+
+Create `src/rules/<id>.js` exporting one object and register it in
+`src/rules/index.js`:
+
+```js
+export default {
+  id: "my-rule",              // kebab-case; becomes the SARIF ruleId
+  title: "One line, human",
+  severity: "high",           // high | medium | low
+  confidence: "suspected",    // default level for this rule's findings
+  languages: ["js", "ts", "python", "go"],
+  why: "Two or three sentences: what is wrong and why it matters.",
+  fix: "A short corrected snippet.",
+  docs: "https://…",          // RFC or authoritative guidance
+  match(ctx) {
+    return [...ctx.matchAll(/pattern/g)]
+      .filter((m) => !ctx.isMasked(m.index))
+      .map((m) => ({ index: m.index, message: "What is wrong here." }));
+  },
+};
+```
+
+The context gives you `ctx.text` (raw), `ctx.code` (comments blanked),
+`ctx.structure` (literals blanked), `ctx.isMasked(index)`, `ctx.matchAll`,
+`ctx.findCalls`, `ctx.window`, `ctx.lineOf` and `ctx.isTestPath`. Add fixtures
+under `test/fixtures/bad/` and `test/fixtures/good/` and a row in the `CASES`
+table in `test/rules.test.js` — the suite fails if a rule has no fixture.
+
+Prefer a lower confidence over a louder rule: a scanner people mute is worth
+nothing.

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "ecdsa-scan",
+  "version": "0.1.0",
+  "description": "Static analysis for digital-signature code: JWT algorithm confusion, curve mix-ups, signature-encoding bugs, weak nonces, hardcoded keys and disabled certificate checks.",
+  "license": "MIT",
+  "type": "module",
+  "homepage": "https://ecdsa.com/scanner",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@bitbucket.org/hub2026/ecdsa.git",
+    "directory": "cli"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "bin": {
+    "ecdsa-scan": "src/index.js",
+    "ecdsa": "src/index.js"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.js",
+    "scan": "node ./src/index.js scan"
+  },
+  "keywords": [
+    "ecdsa",
+    "jwt",
+    "signature",
+    "static-analysis",
+    "security",
+    "linter",
+    "sarif",
+    "cbom",
+    "cryptography",
+    "secp256k1",
+    "p-256",
+    "post-quantum"
+  ]
+}

package/src/index.js

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+// ecdsa scan — static analysis for digital-signature code.
+//
+// Read-only by design: the scanner opens files and writes nothing except the
+// report you ask for (--sarif writes the report file itself).
+
+import { existsSync, realpathSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { CONFIDENCE_LEVELS, filterByConfidence, scan } from "./scan.js";
+import { formatJson, formatSarif, formatText, TOOL_VERSION } from "./report.js";
+import { defectRules, rules as allRules } from "./rules/index.js";
+
+const DEFAULT_SARIF_PATH = "ecdsa-scan.sarif";
+
+const OPTIONS = {
+  json: { type: "boolean", default: false },
+  sarif: { type: "string" },
+  "min-confidence": { type: "string", default: "advisory" },
+  ignore: { type: "string", multiple: true, default: [] },
+  "no-color": { type: "boolean", default: false },
+  help: { type: "boolean", short: "h", default: false },
+  version: { type: "boolean", short: "v", default: false },
+};
+
+function helpText() {
+  return `ecdsa-scan — find digital-signature defects in source code
+
+USAGE
+  ecdsa-scan [path]            scan a directory or a single file (default: .)
+  ecdsa-scan rules             list the rules and their default confidence
+  ecdsa-scan --help | --version
+  (installed as both \`ecdsa-scan\` and \`ecdsa\`; \`ecdsa scan [path]\` works too)
+
+OPTIONS
+  --json                       machine-readable report on stdout
+  --sarif [file]               write SARIF 2.1.0 (default: ${DEFAULT_SARIF_PATH}, "-" for stdout)
+  --min-confidence <level>     confirmed | suspected | advisory   (default: advisory)
+  --ignore <glob>              skip paths matching a glob; repeatable
+  --no-color                   plain output (also honours NO_COLOR)
+  -h, --help                   this text
+  -v, --version                print version
+
+CONFIDENCE
+  confirmed   an unambiguous defect — fix it
+  suspected   very likely wrong, but the surrounding code decides
+  advisory    worth a look; expect legitimate matches here
+
+EXIT CODES
+  0   no confirmed findings
+  1   at least one confirmed finding (use this to gate CI)
+  2   usage error, or the path could not be read
+
+EXAMPLES
+  ecdsa scan
+  ecdsa scan ./src --min-confidence suspected
+  ecdsa scan . --ignore "**/*.test.ts" --ignore examples
+  ecdsa scan . --sarif results.sarif      # upload to GitHub Code Scanning
+  ecdsa scan . --json | jq '.inventory'
+
+Languages: JavaScript, TypeScript, Python, Go (plus key files: .pem/.key/.p12).
+Skipped automatically: node_modules, .git, dist, build, vendor, .next, and more.
+Always: static pattern matching. It misses things, and it flags correct code.
+`;
+}
+
+function rulesText() {
+  const lines = ["ID                                  CONFIDENCE  SEVERITY  TITLE"];
+  for (const rule of allRules) {
+    const confidence = rule.kind === "inventory" ? "n/a" : rule.confidence;
+    const severity = rule.kind === "inventory" ? "n/a" : rule.severity;
+    lines.push(`${rule.id.padEnd(35)} ${confidence.padEnd(11)} ${severity.padEnd(9)} ${rule.title}`);
+  }
+  lines.push("");
+  lines.push(`${defectRules.length} defect rules + 1 inventory collector.`);
+  lines.push("Some rules downgrade or upgrade a finding's confidence based on the surrounding code.");
+  return lines.join("\n");
+}
+
+/**
+ * `--sarif` may be used without a value; parseArgs would reject that, so the
+ * default path is injected before parsing.
+ */
+function normalizeArgv(argv) {
+  const out = [];
+  for (let i = 0; i < argv.length; i++) {
+    out.push(argv[i]);
+    if (argv[i] === "--sarif") {
+      const next = argv[i + 1];
+      // `-` means stdout and is a real value; any other flag means the value
+      // was omitted, so the default file name is inserted.
+      if (next === undefined || (next.startsWith("-") && next !== "-")) out.push(DEFAULT_SARIF_PATH);
+    }
+  }
+  return out;
+}
+
+function colorEnabled(values) {
+  if (values["no-color"] || process.env.NO_COLOR) return false;
+  return Boolean(process.stdout.isTTY);
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  let parsed;
+  try {
+    parsed = parseArgs({ args: normalizeArgv(argv), options: OPTIONS, allowPositionals: true });
+  } catch (err) {
+    process.stderr.write(`ecdsa: ${err.message}\n\nRun \`ecdsa --help\`.\n`);
+    return 2;
+  }
+  const { values, positionals } = parsed;
+
+  if (values.version) {
+    process.stdout.write(`${TOOL_VERSION}\n`);
+    return 0;
+  }
+
+  let command = positionals[0] ?? (values.help ? "help" : "scan");
+  let targetArg = positionals[1];
+  // `ecdsa-scan .` / `ecdsa-scan ./src`: an existing path in command position
+  // implies the scan command, so the published binary works without a verb.
+  if (!["scan", "rules", "help"].includes(command) && existsSync(path.resolve(command))) {
+    targetArg = command;
+    command = "scan";
+  }
+  if (command === "help" || values.help) {
+    process.stdout.write(helpText());
+    return 0;
+  }
+  if (command === "rules") {
+    process.stdout.write(`${rulesText()}\n`);
+    return 0;
+  }
+  if (command !== "scan") {
+    process.stderr.write(`ecdsa: unknown command "${command}". Run \`ecdsa --help\`.\n`);
+    return 2;
+  }
+
+  const minConfidence = values["min-confidence"];
+  if (!CONFIDENCE_LEVELS.includes(minConfidence)) {
+    process.stderr.write(
+      `ecdsa: --min-confidence must be one of ${CONFIDENCE_LEVELS.join(", ")} (got "${minConfidence}").\n`
+    );
+    return 2;
+  }
+
+  const target = path.resolve(targetArg ?? ".");
+  let result;
+  try {
+    result = await scan(target, { ignore: values.ignore });
+  } catch (err) {
+    process.stderr.write(`ecdsa: cannot scan ${target}: ${err.message}\n`);
+    return 2;
+  }
+
+  result.findings = filterByConfidence(result.findings, minConfidence);
+  const confirmed = result.findings.filter((f) => f.confidence === "confirmed").length;
+
+  if (values.sarif) {
+    const sarif = formatSarif(result);
+    if (values.sarif === "-") {
+      process.stdout.write(`${sarif}\n`);
+    } else {
+      const sarifPath = path.resolve(values.sarif);
+      try {
+        await writeFile(sarifPath, `${sarif}\n`, "utf8");
+      } catch (err) {
+        process.stderr.write(`ecdsa: cannot write ${sarifPath}: ${err.message}\n`);
+        return 2;
+      }
+      if (!values.json) process.stderr.write(`SARIF written to ${sarifPath}\n`);
+    }
+  }
+
+  if (values.json) {
+    process.stdout.write(`${formatJson(result)}\n`);
+  } else if (values.sarif !== "-") {
+    process.stdout.write(
+      `${formatText(result, { color: colorEnabled(values), width: process.stdout.columns ?? 100 })}\n`
+    );
+  }
+
+  return confirmed > 0 ? 1 : 0;
+}
+
+// Only run when executed directly, so tests can import main(). argv[1] is
+// resolved through realpath because npm installs the bin as a symlink in
+// node_modules/.bin (and /tmp-style symlinked paths exist too): node resolves
+// the real file for import.meta.url while argv[1] keeps the symlink.
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  try {
+    return import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+  } catch {
+    return false;
+  }
+}
+
+if (isMainModule()) {
+  main().then(
+    (code) => {
+      process.exitCode = code;
+    },
+    (err) => {
+      process.stderr.write(`ecdsa: unexpected failure: ${err?.stack ?? err}\n`);
+      process.exitCode = 2;
+    }
+  );
+}

package/src/lib/glob.js

@@ -0,0 +1,62 @@
+// Minimal glob matching for --ignore. Supports `*`, `**`, `?` and `{a,b}`.
+// Patterns are matched against the path relative to the scan root (always with
+// forward slashes); a pattern without a slash also matches a bare file name,
+// which is what people expect from `--ignore "*.test.js"`.
+
+function toRegExpSource(pattern) {
+  let out = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      if (pattern[i + 1] === "*") {
+        // `**/` swallows any number of directories, including none.
+        if (pattern[i + 2] === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+      continue;
+    }
+    if (ch === "?") {
+      out += "[^/]";
+      continue;
+    }
+    if (ch === "{") {
+      const close = pattern.indexOf("}", i);
+      if (close !== -1) {
+        const options = pattern.slice(i + 1, close).split(",");
+        out += `(?:${options.map((o) => toRegExpSource(o)).join("|")})`;
+        i = close;
+        continue;
+      }
+    }
+    out += ch.replace(/[.+^$()|[\]\\]/g, "\\$&");
+  }
+  return out;
+}
+
+/**
+ * Compile ignore patterns into a predicate over the root-relative posix path.
+ * A pattern also matches everything below a directory it names.
+ */
+export function compileIgnore(patterns) {
+  const compiled = (patterns ?? []).filter(Boolean).map((pattern) => {
+    const clean = pattern.replace(/^\.\//, "").replace(/\/+$/, "");
+    const src = toRegExpSource(clean);
+    return {
+      pattern,
+      bare: !clean.includes("/"),
+      // The pattern itself, or the pattern used as a directory prefix.
+      re: new RegExp(`^(?:${src})(?:/.*)?$`),
+    };
+  });
+  return (relPath) => {
+    const base = relPath.split("/").pop();
+    return compiled.some((c) => c.re.test(relPath) || (c.bare && c.re.test(base)));
+  };
+}