gitsieve 0.1.0

package/dist/git.js

@@ -0,0 +1,214 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+export class GitError extends Error {
+}
+const FIELD_SEP = "\u0000";
+const RECORD_SEP = "\u001e";
+const LOG_FORMAT = "--format=%H%x00%an%x00%ae%x00%cn%x00%ce%x00%B%x1e";
+export class RealGitRepo {
+    root;
+    includeReflog;
+    constructor(root, options = {}) {
+        this.root = root;
+        this.includeReflog = options.includeReflog ?? true;
+    }
+    run(args, input) {
+        const result = spawnSync("git", args, {
+            cwd: this.root,
+            input,
+            maxBuffer: 512 * 1024 * 1024,
+        });
+        if (result.error)
+            throw new GitError(`git ${args[0]}: ${result.error.message}`);
+        if (result.status !== 0) {
+            throw new GitError(`git ${args.join(" ")} exited ${result.status}: ${result.stderr.toString().trim()}`);
+        }
+        return result.stdout;
+    }
+    tryRun(args) {
+        try {
+            return this.run(args);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** `--all` plus, by default, `--reflog`: an amended commit is still on disk. */
+    historyArgs() {
+        return this.includeReflog ? ["--all", "--reflog"] : ["--all"];
+    }
+    isShallow() {
+        const out = this.tryRun(["rev-parse", "--is-shallow-repository"]);
+        return out?.toString().trim() === "true";
+    }
+    refNames() {
+        const out = this.tryRun(["for-each-ref", "--format=%(refname)"]);
+        if (!out)
+            return [];
+        return out.toString("utf8").split("\n").filter(Boolean);
+    }
+    commits() {
+        const out = this.tryRun([
+            "log",
+            ...this.historyArgs(),
+            "--no-color",
+            LOG_FORMAT,
+        ]);
+        if (!out)
+            return [];
+        const seen = new Set();
+        const commits = [];
+        for (const record of out.toString("utf8").split(RECORD_SEP)) {
+            const trimmed = record.replace(/^\n+/, "");
+            if (!trimmed)
+                continue;
+            const fields = trimmed.split(FIELD_SEP);
+            if (fields.length < 6)
+                continue;
+            const sha = fields[0].trim();
+            if (!/^[0-9a-f]{7,64}$/.test(sha) || seen.has(sha))
+                continue;
+            seen.add(sha);
+            commits.push({
+                sha,
+                authorName: fields[1],
+                authorEmail: fields[2],
+                committerName: fields[3],
+                committerEmail: fields[4],
+                message: fields[5],
+            });
+        }
+        return commits;
+    }
+    /**
+     * `-m` is load-bearing: without it, a path introduced only by a merge commit
+     * ("evil merge") never appears in the output. See docs/decisions/0001.
+     */
+    paths() {
+        const paths = new Set();
+        const log = this.tryRun([
+            "log",
+            ...this.historyArgs(),
+            "-m",
+            "--name-only",
+            "--no-color",
+            "--pretty=format:",
+        ]);
+        if (log) {
+            for (const line of log.toString("utf8").split("\n")) {
+                const path = line.trim();
+                if (path)
+                    paths.add(path);
+            }
+        }
+        // Belt and braces: the full tree at each ref tip, directories included.
+        for (const ref of this.refNames()) {
+            const tree = this.tryRun(["ls-tree", "-r", "-t", "--name-only", ref]);
+            if (!tree)
+                continue;
+            for (const line of tree.toString("utf8").split("\n")) {
+                const path = line.trim();
+                if (path)
+                    paths.add(path);
+            }
+        }
+        return [...paths];
+    }
+    objects() {
+        const listed = this.tryRun([
+            "rev-list",
+            "--objects",
+            ...this.historyArgs(),
+        ]);
+        if (!listed)
+            return [];
+        const pathBySha = new Map();
+        const shas = [];
+        for (const line of listed.toString("utf8").split("\n")) {
+            if (!line)
+                continue;
+            const space = line.indexOf(" ");
+            const sha = space === -1 ? line : line.slice(0, space);
+            if (!/^[0-9a-f]{7,64}$/.test(sha))
+                continue;
+            if (pathBySha.has(sha))
+                continue;
+            shas.push(sha);
+            pathBySha.set(sha, space === -1 ? "" : line.slice(space + 1));
+        }
+        if (shas.length === 0)
+            return [];
+        const check = this.run(["cat-file", "--batch-check"], Buffer.from(shas.join("\n") + "\n", "utf8"));
+        const objects = [];
+        for (const line of check.toString("utf8").split("\n")) {
+            if (!line)
+                continue;
+            const [sha, type, size] = line.split(" ");
+            if (!sha || !type)
+                continue;
+            if (type !== "blob" &&
+                type !== "tree" &&
+                type !== "commit" &&
+                type !== "tag")
+                continue;
+            const path = pathBySha.get(sha);
+            objects.push({
+                sha,
+                type,
+                size: Number(size ?? 0),
+                ...(path ? { path } : {}),
+            });
+        }
+        return objects;
+    }
+    readObjects(shas) {
+        const out = new Map();
+        const batchSize = 64;
+        for (let i = 0; i < shas.length; i += batchSize) {
+            const chunk = shas.slice(i, i + batchSize);
+            const raw = this.run(["cat-file", "--batch"], Buffer.from(chunk.join("\n") + "\n", "utf8"));
+            parseBatch(raw, out);
+        }
+        return out;
+    }
+    workingTreeFile(relativePath) {
+        try {
+            return readFileSync(join(this.root, relativePath), "utf8");
+        }
+        catch {
+            return null;
+        }
+    }
+    remoteFetchSpecs() {
+        const out = this.tryRun(["config", "--get-all", "remote.origin.fetch"]);
+        if (!out)
+            return [];
+        return out.toString("utf8").split("\n").filter(Boolean);
+    }
+}
+/**
+ * `git cat-file --batch` frames each object as
+ *   "<sha> <type> <size>\n" + <size bytes> + "\n"
+ * and a missing object as "<sha> missing\n".
+ */
+export function parseBatch(raw, into) {
+    let cursor = 0;
+    while (cursor < raw.length) {
+        const newline = raw.indexOf(0x0a, cursor);
+        if (newline === -1)
+            break;
+        const header = raw.subarray(cursor, newline).toString("utf8");
+        cursor = newline + 1;
+        const parts = header.split(" ");
+        if (parts.length < 3)
+            continue; // "<sha> missing"
+        const sha = parts[0];
+        const size = Number(parts[2]);
+        if (!Number.isFinite(size))
+            break;
+        into.set(sha, raw.subarray(cursor, cursor + size));
+        cursor += size + 1;
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,OAAO,QAAS,SAAQ,KAAK;CAAG;AAuCtC,MAAM,SAAS,GAAG,QAAQ,CAAC;AAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC;AAC5B,MAAM,UAAU,GAAG,mDAAmD,CAAC;AAMvE,MAAM,OAAO,WAAW;IACb,IAAI,CAAS;IACL,aAAa,CAAU;IAExC,YAAY,IAAY,EAAE,UAA0B,EAAE;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;IACrD,CAAC;IAEO,GAAG,CAAC,IAAc,EAAE,KAAc;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YACpC,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,KAAK;YACL,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;SAC7B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK;YACd,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAEO,MAAM,CAAC,IAAc;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,gFAAgF;IACxE,WAAW;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,SAAS;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IAC3C,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACtB,KAAK;YACL,GAAG,IAAI,CAAC,WAAW,EAAE;YACrB,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG;gBACH,UAAU,EAAE,MAAM,CAAC,CAAC,CAAE;gBACtB,WAAW,EAAE,MAAM,CAAC,CAAC,CAAE;gBACvB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAE;gBACzB,cAAc,EAAE,MAAM,CAAC,CAAC,CAAE;gBAC1B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACtB,KAAK;YACL,GAAG,IAAI,CAAC,WAAW,EAAE;YACrB,IAAI;YACJ,aAAa;YACb,YAAY;YACZ,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzB,IAAI,IAAI;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzB,IAAI,IAAI;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,OAAO;QACL,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,UAAU;YACV,WAAW;YACX,GAAG,IAAI,CAAC,WAAW,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,CAAC,UAAU,EAAE,eAAe,CAAC,EAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAC5C,CAAC;QACF,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC5B,IACE,IAAI,KAAK,MAAM;gBACf,IAAI,KAAK,MAAM;gBACf,IAAI,KAAK,QAAQ;gBACjB,IAAI,KAAK,KAAK;gBAEd,SAAS;YACX,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG;gBACH,IAAI;gBACJ,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,WAAW,CAAC,IAAc;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,CAAC,UAAU,EAAE,SAAS,CAAC,EACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAC7C,CAAC;YACF,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,eAAe,CAAC,YAAoB;QAClC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,gBAAgB;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAyB;IAC/D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,MAAM;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,kBAAkB;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+export { scan } from "./scan.js";
+export type { ScanOptions } from "./scan.js";
+export { buildCorpus } from "./corpus.js";
+export type { Corpus, TextUnit } from "./corpus.js";
+export { deriveControls, verifyControls } from "./controls.js";
+export { preflight, isDenyAllIgnoreFile } from "./preflight.js";
+export { compileTerm, findMatches, shouldUseWordBoundary } from "./matcher.js";
+export { SECRET_PATTERNS } from "./secrets.js";
+export { loadConfig, parseConfig, assertTermsFileOutsideRepo, ConfigError, EMPTY_CONFIG, } from "./config.js";
+export { RealGitRepo, GitError } from "./git.js";
+export type { GitRepo, CommitMeta, ObjectMeta } from "./git.js";
+export { formatReport, formatJson, exitCodeFor, EXIT_OK, EXIT_FINDINGS, EXIT_UNTRUSTED, EXIT_USAGE, } from "./report.js";
+export { main, parseArgs } from "./cli.js";
+export * from "./types.js";

package/dist/index.js

@@ -0,0 +1,12 @@
+export { scan } from "./scan.js";
+export { buildCorpus } from "./corpus.js";
+export { deriveControls, verifyControls } from "./controls.js";
+export { preflight, isDenyAllIgnoreFile } from "./preflight.js";
+export { compileTerm, findMatches, shouldUseWordBoundary } from "./matcher.js";
+export { SECRET_PATTERNS } from "./secrets.js";
+export { loadConfig, parseConfig, assertTermsFileOutsideRepo, ConfigError, EMPTY_CONFIG, } from "./config.js";
+export { RealGitRepo, GitError } from "./git.js";
+export { formatReport, formatJson, exitCodeFor, EXIT_OK, EXIT_FINDINGS, EXIT_UNTRUSTED, EXIT_USAGE, } from "./report.js";
+export { main, parseArgs } from "./cli.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EACL,YAAY,EACZ,UAAU,EACV,WAAW,EACX,OAAO,EACP,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3C,cAAc,YAAY,CAAC"}

package/dist/matcher.d.ts

@@ -0,0 +1,34 @@
+import type { TermSpec } from "./types.js";
+export interface Match {
+    index: number;
+    line: number;
+    /** The matched text plus a little surrounding context. Redact before printing. */
+    context: string;
+}
+export interface CompiledTerm {
+    spec: TermSpec;
+    regex: RegExp;
+    wholeWord: boolean;
+}
+/**
+ * Terms are literals, so every regex metacharacter is escaped. The `u` flag is
+ * deliberately not used: under `u`, an escaped non-syntax character is a syntax
+ * error, which would make escaping user input harder rather than safer. Hangul,
+ * Kana and Han are all in the BMP, so UTF-16 matching is exact for them.
+ */
+export declare function escapeLiteral(value: string): string;
+/**
+ * `\b` is defined against [A-Za-z0-9_]. Wrapping a Hangul term in `\b` asserts
+ * a word character sits next to it, so the term matches only by accident.
+ * Boundaries are therefore applied only when the term's own first and last
+ * characters are ASCII word characters.
+ */
+export declare function shouldUseWordBoundary(spec: TermSpec): boolean;
+export declare function compileTerm(spec: TermSpec): CompiledTerm;
+export declare function findMatches(regex: RegExp, text: string): Match[];
+export declare function lineNumberAt(text: string, index: number): number;
+/**
+ * Reports name the term and its location; they do not repeat the secret. A
+ * report pasted into a CI log or a ticket must not become the leak.
+ */
+export declare function redact(context: string): string;

package/dist/matcher.js

@@ -0,0 +1,75 @@
+/**
+ * Terms are literals, so every regex metacharacter is escaped. The `u` flag is
+ * deliberately not used: under `u`, an escaped non-syntax character is a syntax
+ * error, which would make escaping user input harder rather than safer. Hangul,
+ * Kana and Han are all in the BMP, so UTF-16 matching is exact for them.
+ */
+export function escapeLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * `\b` is defined against [A-Za-z0-9_]. Wrapping a Hangul term in `\b` asserts
+ * a word character sits next to it, so the term matches only by accident.
+ * Boundaries are therefore applied only when the term's own first and last
+ * characters are ASCII word characters.
+ */
+export function shouldUseWordBoundary(spec) {
+    if (spec.wholeWord === "always")
+        return true;
+    if (spec.wholeWord === "never")
+        return false;
+    const first = spec.value.at(0);
+    const last = spec.value.at(-1);
+    const wordy = /^[A-Za-z0-9_]$/;
+    return Boolean(first && last && wordy.test(first) && wordy.test(last));
+}
+export function compileTerm(spec) {
+    if (spec.value.length === 0) {
+        throw new Error(`term "${spec.id}" has an empty value`);
+    }
+    const wholeWord = shouldUseWordBoundary(spec);
+    const body = escapeLiteral(spec.value);
+    const source = wholeWord ? `\\b${body}\\b` : body;
+    const flags = spec.caseSensitive ? "g" : "gi";
+    return { spec, regex: new RegExp(source, flags), wholeWord };
+}
+const MAX_MATCHES_PER_UNIT = 200;
+export function findMatches(regex, text) {
+    const matches = [];
+    const search = new RegExp(regex.source, regex.flags.includes("g") ? regex.flags : regex.flags + "g");
+    search.lastIndex = 0;
+    let hit;
+    while ((hit = search.exec(text)) !== null) {
+        matches.push({
+            index: hit.index,
+            line: lineNumberAt(text, hit.index),
+            context: contextAt(text, hit.index, hit[0].length),
+        });
+        if (hit[0].length === 0)
+            search.lastIndex += 1;
+        if (matches.length >= MAX_MATCHES_PER_UNIT)
+            break;
+    }
+    return matches;
+}
+export function lineNumberAt(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++) {
+        if (text.charCodeAt(i) === 10)
+            line += 1;
+    }
+    return line;
+}
+function contextAt(text, index, length) {
+    const start = Math.max(0, index - 24);
+    const end = Math.min(text.length, index + length + 24);
+    return text.slice(start, end).replace(/\s+/g, " ").trim();
+}
+/**
+ * Reports name the term and its location; they do not repeat the secret. A
+ * report pasted into a CI log or a ticket must not become the leak.
+ */
+export function redact(context) {
+    return `<${context.length} chars, redacted; rerun with --show-matches>`;
+}
+//# sourceMappingURL=matcher.js.map

package/dist/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../src/matcher.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,gBAAgB,CAAC;IAC/B,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,IAAY;IACrD,MAAM,OAAO,GAAY,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAC5D,CAAC;IACF,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,IAAI,GAA2B,CAAC;IAChC,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;YACnC,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,IAAI,oBAAoB;YAAE,MAAM;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,OAAe;IACpC,OAAO,IAAI,OAAO,CAAC,MAAM,8CAA8C,CAAC;AAC1E,CAAC"}

package/dist/preflight.d.ts

@@ -0,0 +1,21 @@
+import type { GitRepo } from "./git.js";
+import type { Warning } from "./types.js";
+export interface Preflight {
+    warnings: Warning[];
+    /** Reasons the scan cannot be trusted no matter what it finds. */
+    blockers: string[];
+}
+/**
+ * A `.gitignore` whose first effective rule ignores everything, followed by
+ * negations, is a whitelist. It is a normal thing to write and a hazard to
+ * audit with: every tool that honours `.gitignore` -- ripgrep, ugrep with
+ * `--ignore-files`, most editor search -- will silently skip almost the whole
+ * repository and report a clean result.
+ */
+export declare function isDenyAllIgnoreFile(text: string): boolean;
+export interface PreflightOptions {
+    allowShallow?: boolean;
+    /** Paths of ignore files to inspect, relative to the repo root. */
+    ignoreFiles?: string[];
+}
+export declare function preflight(repo: GitRepo, options?: PreflightOptions): Preflight;

package/dist/preflight.js

@@ -0,0 +1,52 @@
+/**
+ * A `.gitignore` whose first effective rule ignores everything, followed by
+ * negations, is a whitelist. It is a normal thing to write and a hazard to
+ * audit with: every tool that honours `.gitignore` -- ripgrep, ugrep with
+ * `--ignore-files`, most editor search -- will silently skip almost the whole
+ * repository and report a clean result.
+ */
+export function isDenyAllIgnoreFile(text) {
+    const lines = text
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("#"));
+    const denyAll = new Set(["*", "/*", "**", "**/*", "*/"]);
+    return lines.some((line) => denyAll.has(line));
+}
+export function preflight(repo, options = {}) {
+    const warnings = [];
+    const blockers = [];
+    // 1. A shallow clone holds one commit. `git grep` over it is not a history
+    //    check, however confidently it returns zero.
+    if (repo.isShallow()) {
+        const message = "this is a shallow clone; its history is truncated and a clean result here proves nothing";
+        if (options.allowShallow)
+            warnings.push({ code: "shallow-clone", message });
+        else
+            blockers.push(message);
+    }
+    // 2. A single-branch clone fetches one ref. Other branches are not on disk.
+    const fetchSpecs = repo.remoteFetchSpecs();
+    if (fetchSpecs.length > 0 &&
+        !fetchSpecs.some((spec) => spec.includes("refs/heads/*"))) {
+        warnings.push({
+            code: "single-branch-clone",
+            message: `remote.origin.fetch is ${fetchSpecs.join(", ")}; branches outside that refspec were never fetched`,
+        });
+    }
+    // 3. Deny-everything ignore files.
+    const candidates = options.ignoreFiles ?? [".gitignore", ".git/info/exclude"];
+    for (const path of candidates) {
+        const text = repo.workingTreeFile(path);
+        if (!text)
+            continue;
+        if (isDenyAllIgnoreFile(text)) {
+            warnings.push({
+                code: "deny-all-ignore-file",
+                message: `${path} ignores everything and then re-allows specific paths; any scanner that honours ignore files will skip most of this repository and report it clean`,
+            });
+        }
+    }
+    return { warnings, blockers };
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAQD,MAAM,UAAU,SAAS,CACvB,IAAa,EACb,UAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GACX,0FAA0F,CAAC;QAC7F,IAAI,OAAO,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;;YACvE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC3C,IACE,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EACzD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,0BAA0B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;SAC7G,CAAC,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,IAAI,oJAAoJ;aACrK,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,8 @@
+import type { ScanReport } from "./types.js";
+export declare const EXIT_OK = 0;
+export declare const EXIT_FINDINGS = 1;
+export declare const EXIT_UNTRUSTED = 2;
+export declare const EXIT_USAGE = 3;
+export declare function exitCodeFor(report: ScanReport): number;
+export declare function formatReport(report: ScanReport): string;
+export declare function formatJson(report: ScanReport): string;

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,cAAc,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAWD,SAAS,KAAK,CAAC,QAAmB;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,EAAE;gBACb,OAAO,EAAE,CAAC;gBACV,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI;YACxB,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;YACvC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE5C,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,GAAG,EAAE,CAAC;IAEN,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACxD,GAAG,CACD,KAAK,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG;YACvF,GAAG,OAAO,CAAC,OAAO,eAAe,MAAM,EAAE,CAC5C,CAAC;IACJ,CAAC;IACD,GAAG,EAAE,CAAC;IAEN,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YACnC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,GAAG,EAAE,CAAC;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,gBAAgB;YAAE,GAAG,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;QACnE,GAAG,EAAE,CAAC;QACN,GAAG,CACD,yEAAyE,CAC1E,CAAC;QACF,GAAG,CAAC,wDAAwD,CAAC,CAAC;QAC9D,GAAG,EAAE,CAAC;IACR,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CACD,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,MAAM,CAAC,MAAM,sBAAsB,CAClF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CACD,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,OAAO,YAAY,CAClF,CAAC;QACF,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACjD,GAAG,CAAC,iBAAiB,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,mBAAmB,OAAO,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,GAAG,EAAE,CAAC;IAEN,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACnD,GAAG,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,mBAAmB,OAAO,CAAC,CAAC;QAC1E,CAAC;QACD,GAAG,EAAE,CAAC;IACR,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACvB,GAAG,CACD,YAAY,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,UAAU;QACjE,GAAG,CAAC,CAAC,SAAS,kBAAkB,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,YAAY,QAAQ,CAC/E,CAAC;IACF,GAAG,EAAE,CAAC;IAEN,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CACD,kFAAkF,CACnF,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CACD,oBAAoB,MAAM,CAAC,QAAQ,CAAC,MAAM,8CAA8C,CACzF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAC7E,CAAC;AACJ,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,17 @@
+import type { GitRepo } from "./git.js";
+import type { Config, ScanReport, SuppressionSpec } from "./types.js";
+export interface ScanOptions {
+    repo: GitRepo;
+    config: Config;
+    /** Scan a shallow clone anyway, downgrading the blocker to a warning. */
+    allowShallow?: boolean;
+    /** Print the matched text instead of a redaction placeholder. */
+    showMatches?: boolean;
+    maxBlobBytes?: number;
+}
+export declare function suppressionMatches(suppression: SuppressionSpec, finding: {
+    id: string;
+    channel: string;
+    path?: string;
+}): boolean;
+export declare function scan(options: ScanOptions): ScanReport;

package/dist/scan.js

@@ -0,0 +1,134 @@
+import { buildCorpus } from "./corpus.js";
+import { deriveControls, verifyControls } from "./controls.js";
+import { compileTerm, findMatches, redact } from "./matcher.js";
+import { preflight } from "./preflight.js";
+import { SECRET_PATTERNS } from "./secrets.js";
+import { CHANNELS } from "./types.js";
+export function suppressionMatches(suppression, finding) {
+    if (suppression.termId !== finding.id)
+        return false;
+    if (suppression.channel && suppression.channel !== finding.channel)
+        return false;
+    if (suppression.path && suppression.path !== finding.path)
+        return false;
+    if (suppression.pathPrefix) {
+        if (!finding.path || !finding.path.startsWith(suppression.pathPrefix))
+            return false;
+    }
+    return true;
+}
+function unitsForChannels(corpus, channels) {
+    return corpus.units.filter((unit) => channels.includes(unit.channel));
+}
+export function scan(options) {
+    const { repo, config } = options;
+    const checks = preflight(repo, {
+        allowShallow: options.allowShallow ?? false,
+    });
+    const corpus = buildCorpus(repo, {
+        ...((options.maxBlobBytes ?? config.maxBlobBytes)
+            ? { maxBlobBytes: options.maxBlobBytes ?? config.maxBlobBytes }
+            : {}),
+    });
+    // --- controls first. Everything below is only meaningful if these pass. ---
+    const derived = deriveControls(corpus);
+    const verification = verifyControls(corpus, derived.controls, config.controls ?? []);
+    const untrustedReasons = [...checks.blockers, ...corpus.integrityProblems];
+    for (const failure of verification.failures) {
+        untrustedReasons.push(`control string for the ${failure.channel} channel matched 0 times; ` +
+            `the scanner is not reading ${failure.channel}, so a clean result there means nothing`);
+    }
+    for (const channel of derived.underivable) {
+        untrustedReasons.push(`the ${channel} channel holds data but no control string could be derived from it; ` +
+            `the scanner cannot prove it is reading ${channel}`);
+    }
+    // No controls at all means nothing checked the scanner. "No findings" from a
+    // scanner nobody checked is the exact sentence this tool exists to refuse.
+    if (verification.results.length === 0) {
+        untrustedReasons.push("no control string could be established, so nothing verified that the scanner reads anything at all");
+    }
+    // A channel with nothing in it cannot be verified, and in a repository that
+    // plainly has data an empty channel means the scanner is not reading it.
+    const repositoryHasData = corpus.stats.objects > 0 || corpus.stats.refs > 0;
+    for (const channel of derived.empty) {
+        if (!repositoryHasData)
+            continue;
+        untrustedReasons.push(`the ${channel} channel produced nothing to scan, in a repository with ` +
+            `${corpus.stats.objects} objects and ${corpus.stats.refs} refs; ` +
+            `the scanner cannot prove it is reading ${channel}`);
+    }
+    // --- terms ---------------------------------------------------------------
+    const findings = [];
+    const suppressed = [];
+    const suppressions = config.suppress ?? [];
+    const record = (finding) => {
+        const hit = suppressions.find((s) => suppressionMatches(s, finding));
+        if (hit) {
+            suppressed.push({
+                id: finding.id,
+                channel: finding.channel,
+                location: finding.location,
+                reason: hit.reason,
+            });
+            return;
+        }
+        findings.push(finding);
+    };
+    for (const spec of config.terms) {
+        const compiled = compileTerm(spec);
+        const channels = spec.channels ?? CHANNELS;
+        for (const unit of unitsForChannels(corpus, channels)) {
+            const matches = findMatches(compiled.regex, unit.text);
+            if (matches.length === 0)
+                continue;
+            const first = matches[0];
+            record({
+                kind: "term",
+                id: spec.id,
+                channel: unit.channel,
+                location: unit.location,
+                ...(unit.path ? { path: unit.path } : {}),
+                ...(unit.channel === "contents" ? { line: first.line } : {}),
+                matches: matches.length,
+                sample: options.showMatches ? first.context : redact(first.context),
+            });
+        }
+    }
+    // --- secrets (secondary) --------------------------------------------------
+    if (config.secrets !== false) {
+        for (const pattern of SECRET_PATTERNS) {
+            for (const unit of corpus.units) {
+                const matches = findMatches(pattern.regex, unit.text);
+                if (matches.length === 0)
+                    continue;
+                const first = matches[0];
+                record({
+                    kind: "secret",
+                    id: pattern.id,
+                    channel: unit.channel,
+                    location: unit.location,
+                    ...(unit.path ? { path: unit.path } : {}),
+                    ...(unit.channel === "contents" ? { line: first.line } : {}),
+                    matches: matches.length,
+                    // Never echo a credential, even with --show-matches.
+                    sample: redact(first.context),
+                });
+            }
+        }
+    }
+    return {
+        repo: repo.root,
+        trusted: untrustedReasons.length === 0,
+        untrustedReasons,
+        controls: verification.results,
+        findings,
+        suppressed,
+        warnings: [
+            ...checks.warnings,
+            ...corpus.warnings,
+            ...verification.warnings,
+        ],
+        stats: corpus.stats,
+    };
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAatC,MAAM,UAAU,kBAAkB,CAChC,WAA4B,EAC5B,OAAuD;IAEvD,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QAChE,OAAO,KAAK,CAAC;IACf,IAAI,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC;YACnE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAc,EACd,QAA2B;IAE3B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAoB;IACvC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAEjC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE;QAC7B,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;KAC5C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE;QAC/B,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;YAC/C,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,YAAa,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,cAAc,CACjC,MAAM,EACN,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,QAAQ,IAAI,EAAE,CACtB,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3E,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC5C,gBAAgB,CAAC,IAAI,CACnB,0BAA0B,OAAO,CAAC,OAAO,4BAA4B;YACnE,8BAA8B,OAAO,CAAC,OAAO,yCAAyC,CACzF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,gBAAgB,CAAC,IAAI,CACnB,OAAO,OAAO,sEAAsE;YAClF,0CAA0C,OAAO,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,gBAAgB,CAAC,IAAI,CACnB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,gBAAgB,CAAC,IAAI,CACnB,OAAO,OAAO,0DAA0D;YACtE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS;YACjE,0CAA0C,OAAO,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,UAAU,CAAC,IAAI,CAAC;gBACd,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,CAAC;gBACL,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACnC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;gBAC1B,MAAM,CAAC;oBACL,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,qDAAqD;oBACrD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,gBAAgB,CAAC,MAAM,KAAK,CAAC;QACtC,gBAAgB;QAChB,QAAQ,EAAE,YAAY,CAAC,OAAO;QAC9B,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE;YACR,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,MAAM,CAAC,QAAQ;YAClB,GAAG,YAAY,CAAC,QAAQ;SACzB;QACD,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}