@aws/nx-plugin 1.0.0-rc.2 → 1.0.0-rc.21

package/src/license/dependency-check/collectors/npm-collector.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectNpmDependencies = void 0;
+const tslib_1 = require("tslib");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const fs_1 = require("fs");
+const licenseChecker = tslib_1.__importStar(require("license-checker-rseidelsohn"));
+const path_1 = require("path");
+const NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;
+const splitNameVersion = (identifier) => {
+    const match = identifier.match(NAME_VERSION_RE);
+    if (!match) {
+        return { name: identifier, version: '0.0.0' };
+    }
+    return { name: match[1], version: match[2] };
+};
+const flattenLicense = (raw) => {
+    if (!raw)
+        return '';
+    if (Array.isArray(raw)) {
+        if (raw.length === 0)
+            return '';
+        if (raw.length === 1)
+            return raw[0];
+        return `(${raw.join(' OR ')})`;
+    }
+    return raw;
+};
+const collectNpmDependencies = async (options) => {
+    const nodeModules = (0, path_1.join)(options.start, 'node_modules');
+    if (!(0, fs_1.existsSync)(nodeModules)) {
+        return [];
+    }
+    const exclude = new Set();
+    const projectPackageJson = (0, path_1.join)(options.start, 'package.json');
+    if ((0, fs_1.existsSync)(projectPackageJson)) {
+        try {
+            const pkg = JSON.parse((0, fs_1.readFileSync)(projectPackageJson, 'utf-8'));
+            if (pkg.name)
+                exclude.add(pkg.name);
+        }
+        catch {
+            // ignore
+        }
+    }
+    const packages = await new Promise((resolve, reject) => {
+        licenseChecker.init({
+            start: options.start,
+            excludePrivatePackages: true,
+        }, (err, results) => {
+            if (err)
+                reject(err);
+            else
+                resolve(results);
+        });
+    });
+    const out = [];
+    for (const [identifier, info] of Object.entries(packages)) {
+        const { name, version } = splitNameVersion(identifier);
+        if (exclude.has(name))
+            continue;
+        out.push({
+            name,
+            version,
+            rawLicense: flattenLicense(info.licenses),
+            path: info.path,
+        });
+    }
+    return out;
+};
+exports.collectNpmDependencies = collectNpmDependencies;
+//# sourceMappingURL=npm-collector.js.map

package/src/license/dependency-check/collectors/npm-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,2BAA8C;AAC9C,oFAA8D;AAC9D,+BAA4B;AAa5B,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,gBAAgB,GAAG,CACvB,UAAkB,EACiB,EAAE;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAyC,EAAU,EAAE;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,OAA4B,EACF,EAAE;IAC5B,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,kBAAkB,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,IAAA,eAAU,EAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAE/D,CAAC;YACF,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClB,cAAc,CAAC,IAAI,CACjB;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,sBAAsB,EAAE,IAAI;SAC7B,EACD,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YACf,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,OAAO;YACP,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAjDW,QAAA,sBAAsB,0BAiDjC"}

package/src/license/dependency-check/collectors/python-collector.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export interface PythonDependency {
+    name: string;
+    version: string;
+    rawLicense: string;
+}
+export interface PythonCollectorOptions {
+    start: string;
+    excludePackages?: string[];
+}
+/**
+ * Discover Python project names in the workspace (from pyproject.toml files)
+ * so they can be excluded from the license check.
+ */
+export declare const findWorkspacePyProjectNames: (start: string) => Promise<string[]>;
+/**
+ * Collect Python dependency licenses by invoking `uvx pip-licenses` against
+ * each discovered virtual environment.
+ */
+export declare const collectPythonDependencies: (options: PythonCollectorOptions) => Promise<PythonDependency[]>;

package/src/license/dependency-check/collectors/python-collector.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectPythonDependencies = exports.findWorkspacePyProjectNames = void 0;
+const tslib_1 = require("tslib");
+const toml_1 = tslib_1.__importDefault(require("@iarna/toml"));
+const child_process_1 = require("child_process");
+const fast_glob_1 = require("fast-glob");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const py_1 = require("../../../utils/py");
+const isUsable = (value) => !!value && value !== 'UNKNOWN';
+// Priority: License-Expression (PEP 639) > License-Metadata (legacy) > License-Classifier (deprecated classifiers)
+const pickLicense = (entry) => {
+    if (isUsable(entry['License-Expression']))
+        return entry['License-Expression'];
+    if (isUsable(entry['License-Metadata']))
+        return entry['License-Metadata'];
+    if (isUsable(entry['License-Classifier']))
+        return entry['License-Classifier'];
+    return '';
+};
+/**
+ * Discover Python project names in the workspace (from pyproject.toml files)
+ * so they can be excluded from the license check.
+ */
+const findWorkspacePyProjectNames = async (start) => {
+    const tomlFiles = await (0, fast_glob_1.glob)(['**/pyproject.toml'], {
+        cwd: start,
+        ignore: ['**/node_modules/**', '**/.venv/**', '**/venv/**', '**/dist/**'],
+        deep: 4,
+        suppressErrors: true,
+    });
+    const names = [];
+    for (const tomlFile of tomlFiles) {
+        try {
+            const content = (0, fs_1.readFileSync)((0, path_1.join)(start, tomlFile), 'utf-8');
+            const parsed = toml_1.default.parse(content);
+            const name = parsed.project?.name;
+            if (typeof name === 'string')
+                names.push(name);
+        }
+        catch {
+            // skip unreadable or malformed files
+        }
+    }
+    return names;
+};
+exports.findWorkspacePyProjectNames = findWorkspacePyProjectNames;
+const findVenvPythons = async (start) => {
+    const patterns = [
+        '**/.venv/bin/python',
+        '**/venv/bin/python',
+        '**/.venv/Scripts/python.exe',
+        '**/venv/Scripts/python.exe',
+    ];
+    const candidates = await (0, fast_glob_1.glob)(patterns, {
+        cwd: start,
+        ignore: [
+            '**/node_modules/**',
+            '**/.nx/**',
+            '**/dist/**',
+            '**/build/**',
+            '**/.git/**',
+        ],
+        deep: 6,
+        suppressErrors: true,
+    });
+    const pythons = candidates.map((c) => (0, path_1.join)(start, c));
+    if (process.env.UV_PROJECT_ENVIRONMENT) {
+        const envPython = (0, path_1.join)(process.env.UV_PROJECT_ENVIRONMENT, process.platform === 'win32' ? 'Scripts/python.exe' : 'bin/python');
+        if ((0, fs_1.existsSync)(envPython)) {
+            pythons.push(envPython);
+        }
+    }
+    return pythons.filter((p) => (0, fs_1.existsSync)(p));
+};
+/**
+ * Collect Python dependency licenses by invoking `uvx pip-licenses` against
+ * each discovered virtual environment.
+ */
+const collectPythonDependencies = async (options) => {
+    const pythons = await findVenvPythons(options.start);
+    if (pythons.length === 0)
+        return [];
+    const seen = new Map();
+    const ignoreFlag = options.excludePackages?.length
+        ? ` --ignore-packages ${options.excludePackages.join(' ')}`
+        : '';
+    const cmd = (0, py_1.uvxCommand)('pip-licenses', `--format json --from all${ignoreFlag}`);
+    for (const python of pythons) {
+        try {
+            const output = (0, child_process_1.execSync)(`${cmd} --python ${python}`, {
+                cwd: options.start,
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout: 60_000,
+            });
+            const entries = JSON.parse(output);
+            for (const entry of entries) {
+                const key = `${entry.Name}@${entry.Version}`;
+                if (seen.has(key))
+                    continue;
+                seen.set(key, {
+                    name: entry.Name,
+                    version: entry.Version,
+                    rawLicense: pickLicense(entry),
+                });
+            }
+        }
+        catch {
+            // If pip-licenses fails for this venv, skip it
+        }
+    }
+    return Array.from(seen.values());
+};
+exports.collectPythonDependencies = collectPythonDependencies;
+//# sourceMappingURL=python-collector.js.map

package/src/license/dependency-check/collectors/python-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/python-collector.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;AAEH,+DAA+B;AAC/B,iDAAyC;AACzC,yCAA6C;AAC7C,2BAA8C;AAC9C,+BAA4B;AAC5B,0CAA+C;AAqB/C,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAmB,EAAE,CAC9D,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;AAEjC,mHAAmH;AACnH,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAU,EAAE;IACtD,IAAI,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,2BAA2B,GAAG,KAAK,EAC9C,KAAa,EACM,EAAE;IACrB,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAQ,EAAC,CAAC,mBAAmB,CAAC,EAAE;QACtD,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,CAAC,oBAAoB,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;QACzE,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,cAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAoC,EAAE,IAAI,CAAC;YAChE,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AArBW,QAAA,2BAA2B,+BAqBtC;AAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAqB,EAAE;IACjE,MAAM,QAAQ,GAAG;QACf,qBAAqB;QACrB,oBAAoB;QACpB,6BAA6B;QAC7B,4BAA4B;KAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,IAAA,gBAAQ,EAAC,QAAQ,EAAE;QAC1C,GAAG,EAAE,KAAK;QACV,MAAM,EAAE;YACN,oBAAoB;YACpB,WAAW;YACX,YAAY;YACZ,aAAa;YACb,YAAY;SACb;QACD,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,WAAI,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAA,WAAI,EACpB,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAClC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CACnE,CAAC;QACF,IAAI,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,OAA+B,EACF,EAAE;IAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM;QAChD,CAAC,CAAC,sBAAsB,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,IAAA,eAAU,EACpB,cAAc,EACd,2BAA2B,UAAU,EAAE,CACxC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,GAAG,GAAG,aAAa,MAAM,EAAE,EAAE;gBACnD,GAAG,EAAE,OAAO,CAAC,KAAK;gBAClB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAuB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC;AAxCW,QAAA,yBAAyB,6BAwCpC"}

package/src/license/dependency-check/evaluator.d.ts

@@ -0,0 +1,9 @@
+import type { AllowlistEntry, LicenseStatus } from './types';
+export interface EvaluatorOptions {
+    allow: AllowlistEntry[];
+}
+interface Evaluator {
+    evaluate(rawLicense: string | undefined | null): LicenseStatus;
+}
+export declare const createEvaluator: (options: EvaluatorOptions) => Evaluator;
+export {};

package/src/license/dependency-check/evaluator.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEvaluator = void 0;
+const tslib_1 = require("tslib");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const spdx_satisfies_1 = tslib_1.__importDefault(require("spdx-satisfies"));
+const isUnknownToken = (raw) => {
+    if (!raw)
+        return true;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return true;
+    if (trimmed.toUpperCase() === 'UNKNOWN')
+        return true;
+    if (trimmed.toLowerCase().startsWith('custom:'))
+        return true;
+    if (trimmed.toLowerCase().startsWith('see license in'))
+        return true;
+    return false;
+};
+/**
+ * Strip the trailing `*` that license-checker adds when a license is guessed
+ * from file content rather than declared in package.json metadata.
+ */
+const normalise = (raw) => {
+    let s = raw.trim();
+    if (s.endsWith('*'))
+        s = s.slice(0, -1).trim();
+    return s;
+};
+/**
+ * Build a flat list of valid SPDX IDs from the allowlist for use with
+ * spdx-satisfies. Entries that aren't parseable as SPDX identifiers are
+ * excluded (they're still matched via the alias lookup).
+ */
+const buildSpdxIds = (allow) => {
+    const ids = [];
+    for (const entry of allow) {
+        if (!entry.spdxId)
+            continue;
+        try {
+            (0, spdx_satisfies_1.default)(entry.spdxId, [entry.spdxId]);
+            ids.push(entry.spdxId);
+        }
+        catch {
+            // Not a valid SPDX identifier — skip for spdx-satisfies, still
+            // matched via alias lookup
+        }
+    }
+    return ids;
+};
+/**
+ * Build a case-insensitive lookup for matching by full name or alias
+ * (for licenses that aren't valid SPDX but appear in package metadata).
+ */
+const buildAliasLookup = (allow) => {
+    const m = new Map();
+    for (const e of allow) {
+        if (e.spdxId)
+            m.set(e.spdxId.toLowerCase(), true);
+        if (e.fullName)
+            m.set(e.fullName.toLowerCase(), true);
+        for (const a of e.aliases ?? []) {
+            if (a)
+                m.set(a.toLowerCase(), true);
+        }
+    }
+    return m;
+};
+const evaluateToken = (token, spdxIds, aliasLookup) => {
+    const cleaned = normalise(token);
+    if (isUnknownToken(cleaned))
+        return 'UNKNOWN';
+    // Try spdx-satisfies for valid SPDX expressions
+    try {
+        if ((0, spdx_satisfies_1.default)(cleaned, spdxIds))
+            return 'PRE_APPROVED';
+    }
+    catch {
+        // Not a valid SPDX expression — fall through to alias matching
+    }
+    // Fall back to alias/fullName matching for non-SPDX strings
+    if (aliasLookup.has(cleaned.toLowerCase()))
+        return 'PRE_APPROVED';
+    return 'NOT_APPROVED';
+};
+const createEvaluator = (options) => {
+    const spdxIds = buildSpdxIds(options.allow);
+    const aliasLookup = buildAliasLookup(options.allow);
+    return {
+        evaluate(rawLicense) {
+            if (!rawLicense || rawLicense.trim().length === 0)
+                return 'UNKNOWN';
+            const normalised = normalise(rawLicense);
+            if (isUnknownToken(normalised))
+                return 'UNKNOWN';
+            // Python tooling emits "Apache Software License; BSD License" — split and treat as OR
+            if (normalised.includes(';')) {
+                const parts = normalised
+                    .split(';')
+                    .map((p) => p.trim())
+                    .filter((p) => p.length > 0);
+                if (parts.length > 1) {
+                    for (const part of parts) {
+                        const status = evaluateToken(part, spdxIds, aliasLookup);
+                        if (status === 'PRE_APPROVED')
+                            return 'PRE_APPROVED';
+                    }
+                    if (parts.every((p) => isUnknownToken(normalise(p))))
+                        return 'UNKNOWN';
+                    return 'NOT_APPROVED';
+                }
+            }
+            return evaluateToken(normalised, spdxIds, aliasLookup);
+        },
+    };
+};
+exports.createEvaluator = createEvaluator;
+//# sourceMappingURL=evaluator.js.map

package/src/license/dependency-check/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/evaluator.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,4EAA2C;AAW3C,MAAM,cAAc,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE;IACxC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,KAAuB,EAAY,EAAE;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,IAAI,CAAC;YACH,IAAA,wBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAuB,EAAqB,EAAE;IACtE,MAAM,CAAC,GAAG,IAAI,GAAG,EAAgB,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAa,EACb,OAAiB,EACjB,WAA8B,EACf,EAAE;IACjB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,IAAA,wBAAa,EAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,cAAc,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,cAAc,CAAC;IAElE,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAEK,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAa,EAAE;IACtE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO;QACL,QAAQ,CAAC,UAAU;YACjB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEpE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,cAAc,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEjD,sFAAsF;YACtF,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,UAAU;qBACrB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;wBACzD,IAAI,MAAM,KAAK,cAAc;4BAAE,OAAO,cAAc,CAAC;oBACvD,CAAC;oBACD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;wBAClD,OAAO,SAAS,CAAC;oBACnB,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA/BW,QAAA,eAAe,mBA+B1B"}

package/src/license/dependency-check/executor-schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/src/license/dependency-check/executor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type ExecutorContext } from '@nx/devkit';
+export type LicenseCheckExecutorSchema = Record<string, never>;
+export default function runLicenseCheckExecutor(_options: LicenseCheckExecutorSchema, _context: ExecutorContext): Promise<{
+    success: boolean;
+}>;

package/src/license/dependency-check/executor.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = runLicenseCheckExecutor;
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const devkit_1 = require("@nx/devkit");
+const utils_1 = require("../../utils/config/utils");
+const check_1 = require("./check");
+const collector_1 = require("./collectors/collector");
+const loadConfig = () => {
+    const config = (0, utils_1.readAwsNxPluginConfigFromDisk)(devkit_1.workspaceRoot);
+    if (!config)
+        return null;
+    // Dependency checking is enabled by the presence of `license.dependencies`.
+    return config.license?.dependencies ?? null;
+};
+async function runLicenseCheckExecutor(_options, _context) {
+    if (process.env.LICENSE_DEPENDENCY_CHECK === 'skip') {
+        console.log('License check skipped via LICENSE_DEPENDENCY_CHECK=skip environment variable.');
+        return { success: true };
+    }
+    const config = loadConfig();
+    if (!config) {
+        console.log('License check skipped — not configured.');
+        return { success: true };
+    }
+    const collectors = config.collectors ?? [(0, collector_1.npmCollector)()];
+    const result = await (0, check_1.runCheck)({
+        projectRoot: devkit_1.workspaceRoot,
+        config,
+        collectors,
+    });
+    const report = (0, check_1.formatReport)(result, { collectors });
+    if (result.pass) {
+        console.log(report);
+        return { success: true };
+    }
+    console.error(report);
+    return { success: false };
+}
+//# sourceMappingURL=executor.js.map

package/src/license/dependency-check/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/executor.ts"],"names":[],"mappings":";;AAoBA,0CAkCC;AAtDD;;;GAGG;AACH,uCAAiE;AACjE,oDAAyE;AACzE,mCAAiD;AACjD,sDAA6E;AAK7E,MAAM,UAAU,GAAG,GAAiC,EAAE;IACpD,MAAM,MAAM,GAAG,IAAA,qCAA6B,EAAC,sBAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,4EAA4E;IAC5E,OAAO,MAAM,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;AAC9C,CAAC,CAAC;AAEa,KAAK,UAAU,uBAAuB,CACnD,QAAoC,EACpC,QAAyB;IAEzB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CACT,+EAA+E,CAChF,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAuB,MAAM,CAAC,UAAU,IAAI,CAAC,IAAA,wBAAY,GAAE,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAQ,EAAC;QAC5B,WAAW,EAAE,sBAAa;QAC1B,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAA,oBAAY,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/src/license/dependency-check/pre-approved.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { AllowlistEntry } from './types';
+export declare const PRE_APPROVED_LICENSES: AllowlistEntry[];