gitsieve 0.1.0

package/dist/config.js

@@ -0,0 +1,161 @@
+import { readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { CHANNELS, isChannel } from "./types.js";
+export class ConfigError extends Error {
+}
+/**
+ * The terms file lists the exact strings you are trying to keep out of public
+ * view. Committing it into the repository being published would publish them.
+ * Keep it outside the repo, or pass --allow-terms-in-repo and accept that.
+ */
+export function assertTermsFileOutsideRepo(configPath, repoRoot) {
+    const rel = relative(resolve(repoRoot), resolve(configPath));
+    const inside = rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+    if (inside) {
+        throw new ConfigError(`terms file ${configPath} is inside the repository being scanned.\n` +
+            `It contains the strings you are trying not to publish. Move it outside the repo, ` +
+            `or pass --allow-terms-in-repo if the terms are genuinely not sensitive.`);
+    }
+}
+function asArray(value, field) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new ConfigError(`${field} must be an array`);
+    return value;
+}
+function parseTerm(raw, index) {
+    if (typeof raw === "string") {
+        if (raw.length === 0)
+            throw new ConfigError(`terms[${index}] is an empty string`);
+        return { id: raw, value: raw };
+    }
+    if (typeof raw !== "object" || raw === null) {
+        throw new ConfigError(`terms[${index}] must be a string or an object`);
+    }
+    const term = raw;
+    const value = term["value"];
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ConfigError(`terms[${index}].value must be a non-empty string`);
+    }
+    const id = typeof term["id"] === "string" && term["id"] ? term["id"] : value;
+    const wholeWord = term["wholeWord"];
+    if (wholeWord !== undefined &&
+        !["auto", "always", "never"].includes(String(wholeWord))) {
+        throw new ConfigError(`terms[${index}].wholeWord must be auto, always or never`);
+    }
+    const channels = asArray(term["channels"], `terms[${index}].channels`);
+    for (const channel of channels) {
+        if (!isChannel(channel)) {
+            throw new ConfigError(`terms[${index}].channels contains "${String(channel)}"; valid channels are ${CHANNELS.join(", ")}`);
+        }
+    }
+    return {
+        id,
+        value,
+        ...(wholeWord ? { wholeWord: wholeWord } : {}),
+        ...(term["caseSensitive"] !== undefined
+            ? { caseSensitive: Boolean(term["caseSensitive"]) }
+            : {}),
+        ...(channels.length > 0
+            ? { channels: channels }
+            : {}),
+        ...(typeof term["note"] === "string" ? { note: term["note"] } : {}),
+    };
+}
+function parseSuppression(raw, index) {
+    if (typeof raw !== "object" || raw === null) {
+        throw new ConfigError(`suppress[${index}] must be an object`);
+    }
+    const entry = raw;
+    const termId = entry["termId"];
+    const reason = entry["reason"];
+    if (typeof termId !== "string" || !termId) {
+        throw new ConfigError(`suppress[${index}].termId is required`);
+    }
+    // A suppression without a reason is an unexplained hole in the audit.
+    if (typeof reason !== "string" || !reason) {
+        throw new ConfigError(`suppress[${index}].reason is required; say why this is not a leak`);
+    }
+    if (entry["value"] !== undefined || entry["term"] !== undefined) {
+        throw new ConfigError(`suppress[${index}] must reference a term by id, never by value; a suppression file that repeats the sensitive string is itself a leak`);
+    }
+    const channel = entry["channel"];
+    if (channel !== undefined && !isChannel(channel)) {
+        throw new ConfigError(`suppress[${index}].channel is not a valid channel`);
+    }
+    return {
+        termId,
+        reason,
+        ...(channel ? { channel } : {}),
+        ...(typeof entry["path"] === "string" ? { path: entry["path"] } : {}),
+        ...(typeof entry["pathPrefix"] === "string"
+            ? { pathPrefix: entry["pathPrefix"] }
+            : {}),
+    };
+}
+function parseControl(raw, index) {
+    if (typeof raw !== "object" || raw === null) {
+        throw new ConfigError(`controls[${index}] must be an object`);
+    }
+    const entry = raw;
+    const value = entry["value"];
+    const channel = entry["channel"];
+    if (typeof value !== "string" || !value) {
+        throw new ConfigError(`controls[${index}].value must be a non-empty string`);
+    }
+    if (!isChannel(channel)) {
+        throw new ConfigError(`controls[${index}].channel must be one of ${CHANNELS.join(", ")}`);
+    }
+    return {
+        value,
+        channel,
+        ...(typeof entry["note"] === "string" ? { note: entry["note"] } : {}),
+    };
+}
+export function parseConfig(json) {
+    if (typeof json !== "object" || json === null) {
+        throw new ConfigError("config must be a JSON object");
+    }
+    const raw = json;
+    const terms = asArray(raw["terms"], "terms").map(parseTerm);
+    const seen = new Set();
+    for (const term of terms) {
+        if (seen.has(term.id))
+            throw new ConfigError(`duplicate term id "${term.id}"`);
+        seen.add(term.id);
+    }
+    return {
+        terms,
+        suppress: asArray(raw["suppress"], "suppress").map(parseSuppression),
+        controls: asArray(raw["controls"], "controls").map(parseControl),
+        secrets: raw["secrets"] === undefined ? true : Boolean(raw["secrets"]),
+        ...(typeof raw["maxBlobBytes"] === "number"
+            ? { maxBlobBytes: raw["maxBlobBytes"] }
+            : {}),
+    };
+}
+export function loadConfig(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new ConfigError(`cannot read terms file ${path}: ${error.message}`);
+    }
+    try {
+        return parseConfig(JSON.parse(text));
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            throw error;
+        throw new ConfigError(`${path} is not valid JSON: ${error.message}`);
+    }
+}
+export const EMPTY_CONFIG = {
+    terms: [],
+    suppress: [],
+    controls: [],
+    secrets: true,
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQjD,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,QAAgB;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CACnB,cAAc,UAAU,4CAA4C;YAClE,mFAAmF;YACnF,yEAAyE,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,KAAa;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAClB,MAAM,IAAI,WAAW,CAAC,SAAS,KAAK,sBAAsB,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,SAAS,KAAK,iCAAiC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,GAA8B,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,WAAW,CAAC,SAAS,KAAK,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,SAAS,KAAK,2CAA2C,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,KAAK,YAAY,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CACnB,SAAS,KAAK,wBAAwB,MAAM,CAAC,OAAO,CAAC,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,KAAK;QACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAgC,EAAE;YAChD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,KAAa;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,YAAY,KAAK,qBAAqB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,WAAW,CAAC,YAAY,KAAK,sBAAsB,CAAC,CAAC;IACjE,CAAC;IACD,sEAAsE;IACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,WAAW,CACnB,YAAY,KAAK,kDAAkD,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CACnB,YAAY,KAAK,sHAAsH,CACxI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,YAAY,KAAK,kCAAkC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,MAAM;QACN,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,KAAa;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,YAAY,KAAK,qBAAqB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,WAAW,CACnB,YAAY,KAAK,oCAAoC,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CACnB,YAAY,KAAK,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,WAAW,CAAC,sBAAsB,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACpE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAChE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtE,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,0BAA0B,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,KAAK,CAAC;QAC9C,MAAM,IAAI,WAAW,CACnB,GAAG,IAAI,uBAAwB,KAAe,CAAC,OAAO,EAAE,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAW;IAClC,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,IAAI;CACd,CAAC"}

package/dist/controls.d.ts

@@ -0,0 +1,16 @@
+import type { Corpus } from "./corpus.js";
+import type { Channel, ControlSpec, ControlResult, Warning } from "./types.js";
+export interface DerivedControls {
+    controls: ControlSpec[];
+    /** Channels that hold data but yielded no control: a hard problem. */
+    underivable: Channel[];
+    /** Channels that are simply empty in this repository. */
+    empty: Channel[];
+}
+export declare function deriveControls(corpus: Corpus): DerivedControls;
+export interface ControlVerification {
+    results: ControlResult[];
+    failures: ControlResult[];
+    warnings: Warning[];
+}
+export declare function verifyControls(corpus: Corpus, derived: ControlSpec[], supplied?: ControlSpec[]): ControlVerification;

package/dist/controls.js

@@ -0,0 +1,161 @@
+import { compileTerm, findMatches } from "./matcher.js";
+/**
+ * The rule this tool is built around: never report a zero from a scanner you
+ * have not just watched find something.
+ *
+ * For each channel we take a string that provably exists in that channel --
+ * a word from a real file, a real path segment, a word from a real commit
+ * message, a real author address -- and push it through the same term pipeline
+ * the audit uses. If any of those comes back with zero matches, the scanner is
+ * not reading that channel and its "no findings" means nothing.
+ */
+const CONTROL_CHANNELS = [
+    "contents",
+    "paths",
+    "messages",
+    "identities",
+    "refs",
+];
+function unitsFor(corpus, channel) {
+    return corpus.units.filter((unit) => unit.channel === channel);
+}
+/** Longest ASCII word in a string, subject to a length window. */
+function longestWord(text, min, max) {
+    const words = text.match(/[A-Za-z0-9_]{2,}/g);
+    if (!words)
+        return null;
+    let best = null;
+    for (const word of words) {
+        if (word.length < min || word.length > max)
+            continue;
+        if (!best || word.length > best.length)
+            best = word;
+    }
+    return best;
+}
+function deriveForContents(units) {
+    // Deterministic: sort by location so the same repo derives the same control.
+    const sorted = [...units].sort((a, b) => a.location.localeCompare(b.location));
+    for (const unit of sorted) {
+        const word = longestWord(unit.text.slice(0, 200_000), 8, 40);
+        if (word)
+            return word;
+    }
+    return null;
+}
+function deriveForPaths(units) {
+    let best = null;
+    for (const unit of units) {
+        for (const segment of unit.text.split("/")) {
+            const word = longestWord(segment, 3, 40);
+            if (word && (!best || word.length > best.length))
+                best = word;
+        }
+    }
+    return best;
+}
+function deriveForMessages(units) {
+    let best = null;
+    for (const unit of units) {
+        const word = longestWord(unit.text, 4, 40);
+        if (word && (!best || word.length > best.length))
+            best = word;
+    }
+    return best;
+}
+function deriveForIdentities(units) {
+    for (const unit of units) {
+        const email = unit.text.match(/<([^>\s]+)>/);
+        if (email?.[1])
+            return email[1];
+        const word = longestWord(unit.text, 3, 40);
+        if (word)
+            return word;
+    }
+    return null;
+}
+function deriveForRefs(units) {
+    let best = null;
+    for (const unit of units) {
+        for (const segment of unit.text.split("/")) {
+            const word = longestWord(segment, 3, 40);
+            if (word && (!best || word.length > best.length))
+                best = word;
+        }
+    }
+    return best;
+}
+const DERIVERS = {
+    contents: deriveForContents,
+    paths: deriveForPaths,
+    messages: deriveForMessages,
+    identities: deriveForIdentities,
+    refs: deriveForRefs,
+};
+export function deriveControls(corpus) {
+    const controls = [];
+    const underivable = [];
+    const empty = [];
+    for (const channel of CONTROL_CHANNELS) {
+        const units = unitsFor(corpus, channel);
+        if (units.length === 0) {
+            empty.push(channel);
+            continue;
+        }
+        const value = DERIVERS[channel](units);
+        if (!value) {
+            underivable.push(channel);
+            continue;
+        }
+        controls.push({
+            value,
+            channel,
+            note: `derived from this repository's own ${channel}`,
+        });
+    }
+    return { controls, underivable, empty };
+}
+export function verifyControls(corpus, derived, supplied = []) {
+    const results = [];
+    const failures = [];
+    const warnings = [];
+    const all = [
+        ...derived.map((spec) => ({ spec, derived: true })),
+        ...supplied.map((spec) => ({ spec, derived: false })),
+    ];
+    for (const { spec, derived: isDerived } of all) {
+        // Same compile path, same match path as a real term. A control that took a
+        // shortcut around the matcher would verify nothing.
+        const compiled = compileTerm({
+            id: `control:${spec.channel}`,
+            value: spec.value,
+            caseSensitive: true,
+        });
+        let matches = 0;
+        for (const unit of corpus.units) {
+            if (unit.channel !== spec.channel)
+                continue;
+            matches += findMatches(compiled.regex, unit.text).length;
+            if (matches > 0 && isDerived)
+                break; // one hit is proof enough
+        }
+        const result = {
+            value: spec.value,
+            channel: spec.channel,
+            derived: isDerived,
+            matches,
+            ...(spec.note ? { note: spec.note } : {}),
+        };
+        results.push(result);
+        if (matches === 0)
+            failures.push(result);
+    }
+    if (results.length === 0) {
+        warnings.push({
+            code: "no-controls",
+            message: "no control strings could be established; nothing verified the scanner",
+        });
+    }
+    return { results, failures, warnings };
+}
+//# sourceMappingURL=controls.js.map

package/dist/controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controls.js","sourceRoot":"","sources":["../src/controls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGxD;;;;;;;;;GASG;AAEH,MAAM,gBAAgB,GAAc;IAClC,UAAU;IACV,OAAO;IACP,UAAU;IACV,YAAY;IACZ,MAAM;CACP,CAAC;AAEF,SAAS,QAAQ,CAAC,MAAc,EAAE,OAAgB;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;YAAE,SAAS;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,6EAA6E;IAC7E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CACrC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,IAAI,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAiB;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,IAAI,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,QAAQ,GAA0D;IACtE,QAAQ,EAAE,iBAAiB;IAC3B,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,mBAAmB;IAC/B,IAAI,EAAE,aAAa;CACpB,CAAC;AAUF,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,MAAM,KAAK,GAAc,EAAE,CAAC;IAE5B,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK;YACL,OAAO;YACP,IAAI,EAAE,sCAAsC,OAAO,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAQD,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,OAAsB,EACtB,WAA0B,EAAE;IAE5B,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,GAAG,GAA8C;QACrD,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC;QAC/C,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,QAAQ,GAAG,WAAW,CAAC;YAC3B,EAAE,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YAC5C,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACzD,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS;gBAAE,MAAM,CAAC,0BAA0B;QACjE,CAAC;QACD,MAAM,MAAM,GAAkB;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,SAAS;YAClB,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,OAAO,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,OAAO,EACL,uEAAuE;SAC1E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC"}

package/dist/corpus.d.ts

@@ -0,0 +1,34 @@
+import type { GitRepo } from "./git.js";
+import type { Channel, Warning } from "./types.js";
+export interface TextUnit {
+    channel: Channel;
+    /** Human-readable place, e.g. "src/a.ts (blob 1a2b3c4)". */
+    location: string;
+    /** Repository path, when the unit has one. Used by suppressions. */
+    path?: string;
+    text: string;
+}
+export interface Corpus {
+    units: TextUnit[];
+    warnings: Warning[];
+    /**
+     * Reasons the corpus is known to be incomplete. Any entry here makes the
+     * whole run untrusted: an incomplete scan that returns zero is exactly the
+     * failure this tool exists to prevent.
+     */
+    integrityProblems: string[];
+    stats: {
+        commits: number;
+        refs: number;
+        paths: number;
+        objects: number;
+        blobsRead: number;
+        bytesScanned: number;
+    };
+}
+export interface BuildCorpusOptions {
+    maxBlobBytes?: number;
+}
+/** A blob with a NUL byte near its start is not source text. */
+export declare function looksBinary(buffer: Buffer): boolean;
+export declare function buildCorpus(repo: GitRepo, options?: BuildCorpusOptions): Corpus;

package/dist/corpus.js

@@ -0,0 +1,121 @@
+const DEFAULT_MAX_BLOB_BYTES = 2 * 1024 * 1024;
+function short(sha) {
+    return sha.slice(0, 7);
+}
+/** A blob with a NUL byte near its start is not source text. */
+export function looksBinary(buffer) {
+    const window = buffer.subarray(0, Math.min(buffer.length, 8000));
+    return window.includes(0);
+}
+export function buildCorpus(repo, options = {}) {
+    const maxBlobBytes = options.maxBlobBytes ?? DEFAULT_MAX_BLOB_BYTES;
+    const units = [];
+    const warnings = [];
+    const integrityProblems = [];
+    // --- refs -----------------------------------------------------------------
+    const refs = repo.refNames();
+    for (const ref of refs) {
+        units.push({ channel: "refs", location: ref, text: ref });
+    }
+    // --- paths ----------------------------------------------------------------
+    const paths = repo.paths();
+    for (const path of paths) {
+        units.push({ channel: "paths", location: path, path, text: path });
+    }
+    // --- commit messages and identities ---------------------------------------
+    const commits = repo.commits();
+    for (const commit of commits) {
+        units.push({
+            channel: "messages",
+            location: `commit ${short(commit.sha)}`,
+            text: commit.message,
+        });
+        units.push({
+            channel: "identities",
+            location: `commit ${short(commit.sha)}`,
+            text: `author ${commit.authorName} <${commit.authorEmail}>\n` +
+                `committer ${commit.committerName} <${commit.committerEmail}>`,
+        });
+    }
+    // --- object contents ------------------------------------------------------
+    const objects = repo.objects();
+    const readable = [];
+    for (const object of objects) {
+        if (object.type !== "blob" && object.type !== "tag")
+            continue;
+        if (object.size > maxBlobBytes) {
+            warnings.push({
+                code: "blob-too-large",
+                message: `${object.path ?? short(object.sha)} is ${object.size} bytes; contents not scanned (raise --max-blob-bytes)`,
+            });
+            continue;
+        }
+        readable.push(object);
+    }
+    const bytes = repo.readObjects(readable.map((o) => o.sha));
+    let blobsRead = 0;
+    let bytesScanned = 0;
+    let missing = 0;
+    let truncated = 0;
+    for (const object of readable) {
+        const buffer = bytes.get(object.sha);
+        if (!buffer) {
+            missing += 1;
+            continue;
+        }
+        if (buffer.length !== object.size) {
+            truncated += 1;
+            continue;
+        }
+        if (looksBinary(buffer))
+            continue;
+        blobsRead += 1;
+        bytesScanned += buffer.length;
+        const text = buffer.toString("utf8");
+        if (object.type === "tag") {
+            units.push({
+                channel: "messages",
+                location: `tag object ${short(object.sha)}`,
+                text,
+            });
+        }
+        else {
+            units.push({
+                channel: "contents",
+                location: `${object.path ?? "(unnamed)"} (blob ${short(object.sha)})`,
+                ...(object.path ? { path: object.path } : {}),
+                text,
+            });
+        }
+    }
+    // Silence is the enemy. If git listed an object and we could not read it,
+    // say so and mark the run untrusted rather than scanning what is left.
+    if (missing > 0) {
+        integrityProblems.push(`${missing} of ${readable.length} objects were listed by git but returned no content`);
+    }
+    if (truncated > 0) {
+        integrityProblems.push(`${truncated} of ${readable.length} objects returned a different byte count than git reported`);
+    }
+    // Cross-checks between channels. A repository cannot have refs but no
+    // commits, or blobs but no paths; if it appears to, a channel was dropped.
+    if (refs.length > 0 && commits.length === 0) {
+        integrityProblems.push(`git listed ${refs.length} refs but no commits; the messages and identities channels were not read`);
+    }
+    if (readable.length > 0 && paths.length === 0) {
+        integrityProblems.push(`git listed ${readable.length} readable objects but no paths; the paths channel was not read`);
+    }
+    return {
+        units,
+        warnings,
+        integrityProblems,
+        stats: {
+            commits: commits.length,
+            refs: refs.length,
+            paths: paths.length,
+            objects: objects.length,
+            blobsRead,
+            bytesScanned,
+        },
+    };
+}
+//# sourceMappingURL=corpus.js.map

package/dist/corpus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"corpus.js","sourceRoot":"","sources":["../src/corpus.ts"],"names":[],"mappings":"AAmCA,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,UAA8B,EAAE;IAEhC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAa,EAAE,CAAC;IAEvC,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,UAAU,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACvC,IAAI,EAAE,MAAM,CAAC,OAAO;SACrB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,OAAO,EAAE,YAAY;YACrB,QAAQ,EAAE,UAAU,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACvC,IAAI,EACF,UAAU,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,WAAW,KAAK;gBACvD,aAAa,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,cAAc,GAAG;SACjE,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC9D,IAAI,MAAM,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,uDAAuD;aACtH,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,SAAS,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,CAAC;YAAE,SAAS;QAClC,SAAS,IAAI,CAAC,CAAC;QACf,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,cAAc,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC3C,IAAI;aACL,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,UAAU,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;gBACrE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,iBAAiB,CAAC,IAAI,CACpB,GAAG,OAAO,OAAO,QAAQ,CAAC,MAAM,qDAAqD,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,iBAAiB,CAAC,IAAI,CACpB,GAAG,SAAS,OAAO,QAAQ,CAAC,MAAM,4DAA4D,CAC/F,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,iBAAiB,CAAC,IAAI,CACpB,cAAc,IAAI,CAAC,MAAM,0EAA0E,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,iBAAiB,CAAC,IAAI,CACpB,cAAc,QAAQ,CAAC,MAAM,gEAAgE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ;QACR,iBAAiB;QACjB,KAAK,EAAE;YACL,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,SAAS;YACT,YAAY;SACb;KACF,CAAC;AACJ,CAAC"}

package/dist/git.d.ts

@@ -0,0 +1,66 @@
+export declare class GitError extends Error {
+}
+export interface CommitMeta {
+    sha: string;
+    message: string;
+    authorName: string;
+    authorEmail: string;
+    committerName: string;
+    committerEmail: string;
+}
+export interface ObjectMeta {
+    sha: string;
+    type: "blob" | "tree" | "commit" | "tag";
+    size: number;
+    /** Path git associated with the object. Absent for commits and tag objects. */
+    path?: string;
+}
+/**
+ * The surface the scanner uses. It is an interface so that a test can hand the
+ * scanner a deliberately broken git and prove the control check fails loudly
+ * instead of reporting a clean repository.
+ */
+export interface GitRepo {
+    readonly root: string;
+    isShallow(): boolean;
+    refNames(): string[];
+    commits(): CommitMeta[];
+    /** Every path that has existed in any commit on any ref. */
+    paths(): string[];
+    objects(): ObjectMeta[];
+    /** sha -> raw bytes. Only called for objects returned by objects(). */
+    readObjects(shas: string[]): Map<string, Buffer>;
+    /** Working-tree file, or null when absent. Used only for .gitignore checks. */
+    workingTreeFile(relativePath: string): string | null;
+    remoteFetchSpecs(): string[];
+}
+export interface RealGitOptions {
+    includeReflog?: boolean;
+}
+export declare class RealGitRepo implements GitRepo {
+    readonly root: string;
+    private readonly includeReflog;
+    constructor(root: string, options?: RealGitOptions);
+    private run;
+    private tryRun;
+    /** `--all` plus, by default, `--reflog`: an amended commit is still on disk. */
+    private historyArgs;
+    isShallow(): boolean;
+    refNames(): string[];
+    commits(): CommitMeta[];
+    /**
+     * `-m` is load-bearing: without it, a path introduced only by a merge commit
+     * ("evil merge") never appears in the output. See docs/decisions/0001.
+     */
+    paths(): string[];
+    objects(): ObjectMeta[];
+    readObjects(shas: string[]): Map<string, Buffer>;
+    workingTreeFile(relativePath: string): string | null;
+    remoteFetchSpecs(): string[];
+}
+/**
+ * `git cat-file --batch` frames each object as
+ *   "<sha> <type> <size>\n" + <size bytes> + "\n"
+ * and a missing object as "<sha> missing\n".
+ */
+export declare function parseBatch(raw: Buffer, into: Map<string, Buffer>): void;