Move SSD path safety helpers to typed Kotlin

ober

e45973afadc540239275a45916ccc7ba0e57c1be

diff --git a/.build.yml b/.build.yml
index 507b963..01284e5 100644
--- a/.build.yml
+++ b/.build.yml
@@ -5,7 +5,7 @@ packages:
   - make=4.4.1-r4
 sources:
   # Build dependency: full immutable commit, mirrored in dependencies.lock.json.
-  - "https://git.sr.ht/~lisp/jerboa#0bcadeaded7a3454bab6088c08aa208cf87a6213"
+  - "https://git.sr.ht/~lisp/jerboa#3ca97777bfaf7f5fe3088b345288221279ec6253"
   # The second source is the build subject selected by the SourceHut submitter.
   - https://git.sr.ht/~lisp/jerboa-android
 tasks:
@@ -14,6 +14,6 @@ tasks:
       test "$(apk info -v chez-scheme)" = chez-scheme-10.3.0-r2
       test "$(apk info -v git)" = git-2.54.0-r0
       test "$(apk info -v make)" = make-4.4.1-r4
-      test "$(git -C ../jerboa rev-parse HEAD)" = 0bcadeaded7a3454bab6088c08aa208cf87a6213
-      test "$(git -C ../jerboa rev-parse 'HEAD^{tree}')" = c48e016b2e63ab1b76452e04b9525ac6604bc87b
+      test "$(git -C ../jerboa rev-parse HEAD)" = 3ca97777bfaf7f5fe3088b345288221279ec6253
+      test "$(git -C ../jerboa rev-parse 'HEAD^{tree}')" = ea0bcbac7405ab38dc9fa9339d5597154ab002b7
       JERBOA="chez --libdirs .:../jerboa/lib --script" make test
diff --git a/dependencies.lock.json b/dependencies.lock.json
index 16fa96d..720287e 100644
--- a/dependencies.lock.json
+++ b/dependencies.lock.json
@@ -11,8 +11,8 @@
   "generator_runtime": {
     "name": "jerboa",
     "repository": "https://git.sr.ht/~lisp/jerboa",
-    "commit": "0bcadeaded7a3454bab6088c08aa208cf87a6213",
-    "tree": "c48e016b2e63ab1b76452e04b9525ac6604bc87b"
+    "commit": "3ca97777bfaf7f5fe3088b345288221279ec6253",
+    "tree": "ea0bcbac7405ab38dc9fa9339d5597154ab002b7"
   },
   "assurance_tools": {
     "osv_scanner": {
diff --git a/scripts/verify-supply-chain.sh b/scripts/verify-supply-chain.sh
index 6b250a8..9e2ad73 100755
--- a/scripts/verify-supply-chain.sh
+++ b/scripts/verify-supply-chain.sh
@@ -3,8 +3,8 @@ set -eu
 
 repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd -P)
 lock="$repo/dependencies.lock.json"
-jerboa_commit=0bcadeaded7a3454bab6088c08aa208cf87a6213 # gitsafe:ignore
-jerboa_tree=c48e016b2e63ab1b76452e04b9525ac6604bc87b # gitsafe:ignore
+jerboa_commit=3ca97777bfaf7f5fe3088b345288221279ec6253 # gitsafe:ignore
+jerboa_tree=ea0bcbac7405ab38dc9fa9339d5597154ab002b7 # gitsafe:ignore
 gradle_sha=20f1b1176237254a6fc204d8434196fa11a4cfb387567519c61556e8710aed78
 jdk_macos_sha=8fa1eff40bb637a33613b2ccb8b12c70dc3661cc22cf8e784943715769a05336
 jdk_linux_sha=d8afc263758141a66e0e3aafc321e783f7016696f4eaea067d340a269037d331
diff --git a/templates/ssd-review.ss b/templates/ssd-review.ss
index 17ad5bd..9c98320 100644
--- a/templates/ssd-review.ss
+++ b/templates/ssd-review.ss
@@ -485,6 +485,26 @@
                 (or (string-contains? lower "exception")
                     (string-contains? lower "rejected")))))))
 
+    (typed-kotlin-file "com/sfb/ssdreview/PathSafety.kt"
+      (typed-library (com sfb ssdreview)
+        (export safePathComponent safeLeaf validSourceKey)
+        (def (safePathComponent (name : String)) : Bool
+          (let ((n (string-length name)))
+            (and (and (>= n 1) (<= n 128))
+                 (and (not (equal? name "."))
+                      (and (not (equal? name ".."))
+                           (string-matches-regex? name "[A-Za-z0-9][A-Za-z0-9._-]*"))))))
+        (def (safeLeaf (name : String)) : Bool
+          (and (safePathComponent name)
+               (or (string-ends-with? name ".json")
+                   (string-ends-with? name ".jsonl"))))
+        (def (validSourceKey (key : String)) : Bool
+          (let ((n (string-length key)))
+            (and (and (>= n 1) (<= n 96))
+                 (and (not (equal? key "."))
+                      (and (not (equal? key ".."))
+                           (string-matches-regex? key "[A-Za-z0-9][A-Za-z0-9._-]*"))))))))
+
     (kotlin-file-lines "com/sfb/ssdreview/BoxTypes.kt"
       (
        "package com.sfb.ssdreview"
@@ -4017,9 +4037,7 @@
        ""
        "    private fun validatedSourceKey(raw: String): String? {"
        "        val key = raw.trim()"
-       "        if (key.length !in 1..MAX_SOURCE_KEY_CHARS) return null"
-       "        if (key == \".\" || key == \"..\") return null"
-       "        return key.takeIf { it.matches(Regex(\"[A-Za-z0-9][A-Za-z0-9._-]*\")) }"
+       "        return key.takeIf { validSourceKey(it) }"
        "    }"
        ""
        "    private fun sha256Hex(bytes: ByteArray): String ="
@@ -4856,14 +4874,6 @@
        "            safeLeaf(parts[1])"
        "    }"
        ""
-       "    private fun safePathComponent(name: String): Boolean ="
-       "        name.length in 1..128 && name != \".\" && name != \"..\" &&"
-       "            name.matches(Regex(\"[A-Za-z0-9][A-Za-z0-9._-]*\"))"
-       ""
-       "    private fun safeLeaf(name: String): Boolean ="
-       "        safePathComponent(name) &&"
-       "            (name.endsWith(\".json\") || name.endsWith(\".jsonl\"))"
-       ""
        "    private fun containedImportPath(name: String): File {"
        "        require(safeEntry(name) && !name.endsWith('/')) { \"Unsafe import path\" }"
        "        val parts = name.split('/')"