param()

$ErrorActionPreference = 'Stop'
$repo = Split-Path -Parent $PSScriptRoot
$gitExe = 'C:\Program Files\Git\cmd\git.exe'
if (-not (Test-Path -LiteralPath $gitExe)) { $gitExe = (Get-Command git.exe).Source }

$tracked = @(& $gitExe -C $repo ls-files)
if ($LASTEXITCODE -ne 0) { throw 'Could not enumerate tracked files for the private-material gate' }

$forbidden = @($tracked | Where-Object {
  $_ -match '(?i)(?:^|/)\.env(?:\..+)?$' -or
  $_ -match '(?i)\.(?:pfx|p12|key|pem|der|jks|keystore|p8|pk8|sc64)$'
})
if ($forbidden.Count -gt 0) {
  throw "Tracked private-key, entitlement, or environment material is forbidden:`n$($forbidden -join "`n")"
}

Write-Host "Private-material gate passed: $($tracked.Count) tracked paths checked"
