@aws/nx-plugin 1.0.0-rc.4 → 1.0.0-rc.5

package/src/license/dependency-check/check.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatReport = exports.runCheck = void 0;
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const evaluator_1 = require("./evaluator");
+const collector_1 = require("./collectors/collector");
+const utils_1 = require("../../utils/config/utils");
+const findException = (exceptions, name, version) => {
+    if (!exceptions)
+        return undefined;
+    return exceptions.find((e) => e && e.package === name && (!e.version || e.version === version));
+};
+const runCheck = async (options) => {
+    const { projectRoot, config } = options;
+    const collectors = options.collectors ?? collector_1.DEFAULT_COLLECTORS;
+    const evaluator = (0, evaluator_1.createEvaluator)({ allow: config.allow });
+    const allDeps = await Promise.all(collectors.map((c) => c.collect({ workspaceRoot: projectRoot })));
+    const dependencies = [];
+    for (const deps of allDeps) {
+        for (const dep of deps) {
+            const exception = findException(config.exceptions, dep.name, dep.version);
+            const license = exception?.spdx ?? dep.rawLicense;
+            const status = exception ? 'PRE_APPROVED' : evaluator.evaluate(license);
+            config.onDependency?.({ package: dep.name, spdx: license });
+            dependencies.push({
+                name: dep.name,
+                version: dep.version,
+                ecosystem: dep.ecosystem,
+                rawLicense: dep.rawLicense,
+                status,
+                exception,
+            });
+        }
+    }
+    const pass = !dependencies.some((d) => d.status === 'NOT_APPROVED' || d.status === 'UNKNOWN');
+    return { pass, dependencies };
+};
+exports.runCheck = runCheck;
+const formatReport = (result, options) => {
+    const groups = new Map();
+    for (const dep of result.dependencies) {
+        if (dep.status === 'PRE_APPROVED')
+            continue;
+        const arr = groups.get(dep.status) ?? [];
+        arr.push(dep);
+        groups.set(dep.status, arr);
+    }
+    if (groups.size === 0) {
+        const total = result.dependencies.length;
+        return `License check passed (${total} dependencies inspected).`;
+    }
+    const failing = [
+        ...(groups.get('NOT_APPROVED') ?? []),
+        ...(groups.get('UNKNOWN') ?? []),
+    ];
+    const lines = ['License check failed:', ''];
+    for (const status of ['NOT_APPROVED', 'UNKNOWN']) {
+        const deps = groups.get(status);
+        if (!deps || deps.length === 0)
+            continue;
+        lines.push(`  ${status}:`);
+        for (const dep of deps) {
+            const license = dep.rawLicense || '(no license declared)';
+            lines.push(`    - ${dep.name}@${dep.version} [${dep.ecosystem}] ${license}`);
+        }
+        lines.push('');
+    }
+    const collectors = options?.collectors ?? collector_1.DEFAULT_COLLECTORS;
+    const activeEcosystems = new Set(result.dependencies.map((d) => d.ecosystem));
+    const traceCommands = collectors.filter((c) => {
+        if (!c.traceCommand)
+            return false;
+        const eco = c.name === 'python' ? 'pypi' : c.name;
+        return activeEcosystems.has(eco);
+    });
+    if (traceCommands.length > 0) {
+        lines.push('To trace the dependency chain:');
+        for (const c of traceCommands) {
+            lines.push(`  ${c.name}: ${c.traceCommand}`);
+        }
+        lines.push('');
+    }
+    lines.push(`To fix, add exceptions to license.dependencies.exceptions in ${utils_1.AWS_NX_PLUGIN_CONFIG_FILE_NAME}:`);
+    lines.push('');
+    lines.push('  exceptions: [');
+    for (const dep of failing) {
+        lines.push(`    { package: '${dep.name}', reason: '<your reason>' },`);
+    }
+    lines.push('  ]');
+    lines.push('');
+    const uniqueLicenses = [
+        ...new Set(failing
+            .filter((d) => d.rawLicense && d.status === 'NOT_APPROVED')
+            .map((d) => d.rawLicense)),
+    ];
+    if (uniqueLicenses.length > 0) {
+        lines.push('Or add the license to license.dependencies.allow if it should be broadly permitted:');
+        lines.push('');
+        lines.push('  allow: [');
+        for (const lic of uniqueLicenses) {
+            lines.push(`    { spdxId: '${lic}', fullName: '${lic}', aliases: [] },`);
+        }
+        lines.push('  ]');
+    }
+    return lines.join('\n');
+};
+exports.formatReport = formatReport;
+//# sourceMappingURL=check.js.map

package/src/license/dependency-check/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/check.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,2CAA8C;AAC9C,sDAA8E;AAC9E,oDAA0E;AAc1E,MAAM,aAAa,GAAG,CACpB,UAAkD,EAClD,IAAY,EACZ,OAAe,EACuB,EAAE;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CACxE,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,QAAQ,GAAG,KAAK,EAC3B,OAAwB,EACF,EAAE;IACxB,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,8BAAkB,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAA,2BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,CACjE,CAAC;IAEF,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,SAAS,EAAE,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC;YAClD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5D,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAC7D,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC,CAAC;AAnCW,QAAA,QAAQ,YAmCnB;AAMK,MAAM,YAAY,GAAG,CAC1B,MAAmB,EACnB,OAA6B,EACrB,EAAE;IACV,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;YAAE,SAAS;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;QACzC,OAAO,yBAAyB,KAAK,2BAA2B,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;KACjC,CAAC;IAEF,MAAM,KAAK,GAAa,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,CAAC,cAAc,EAAE,SAAS,CAAU,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACzC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,uBAAuB,CAAC;YAC1D,KAAK,CAAC,IAAI,CACR,SAAS,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,8BAAkB,CAAC;IAC7D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,gEAAgE,sCAA8B,GAAG,CAClG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,IAAI,+BAA+B,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,OAAO;aACJ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAC5B;KACF,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,qFAAqF,CACtF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,GAAG,mBAAmB,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC;AAjFW,QAAA,YAAY,gBAiFvB"}

package/src/license/dependency-check/collectors/collector.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export interface CollectedDependency {
+    name: string;
+    version: string;
+    rawLicense: string;
+    ecosystem: string;
+    path?: string;
+}
+export interface LicenseCollector {
+    name: string;
+    traceCommand?: string;
+    collect(options: {
+        workspaceRoot: string;
+    }): Promise<CollectedDependency[]>;
+}
+export declare const npmCollector: () => LicenseCollector;
+export declare const pythonCollector: () => LicenseCollector;
+export declare const DEFAULT_COLLECTORS: LicenseCollector[];

package/src/license/dependency-check/collectors/collector.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_COLLECTORS = exports.pythonCollector = exports.npmCollector = void 0;
+const npmCollector = () => ({
+    name: 'npm',
+    get traceCommand() {
+        const { existsSync } = require('fs');
+        const { join } = require('path');
+        const { workspaceRoot } = require('@nx/devkit');
+        if (existsSync(join(workspaceRoot, 'yarn.lock')))
+            return 'yarn why <package>';
+        if (existsSync(join(workspaceRoot, 'bun.lockb')))
+            return 'bun pm why <package>';
+        if (existsSync(join(workspaceRoot, 'package-lock.json')))
+            return 'npm why <package>';
+        return 'pnpm why <package>';
+    },
+    async collect({ workspaceRoot }) {
+        const { collectNpmDependencies } = await Promise.resolve().then(() => __importStar(require('./npm-collector')));
+        return (await collectNpmDependencies({ start: workspaceRoot })).map((d) => ({ ...d, ecosystem: 'npm' }));
+    },
+});
+exports.npmCollector = npmCollector;
+const pythonCollector = () => ({
+    name: 'python',
+    traceCommand: 'uv tree --invert --package <package>',
+    async collect({ workspaceRoot }) {
+        const { collectPythonDependencies } = await Promise.resolve().then(() => __importStar(require('./python-collector')));
+        const { findWorkspacePyProjectNames } = await Promise.resolve().then(() => __importStar(require('./python-collector')));
+        const excludePackages = await findWorkspacePyProjectNames(workspaceRoot);
+        return (await collectPythonDependencies({ start: workspaceRoot, excludePackages })).map((d) => ({ ...d, ecosystem: 'pypi' }));
+    },
+});
+exports.pythonCollector = pythonCollector;
+exports.DEFAULT_COLLECTORS = [
+    (0, exports.npmCollector)(),
+    (0, exports.pythonCollector)(),
+];
+//# sourceMappingURL=collector.js.map

package/src/license/dependency-check/collectors/collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/collector.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBI,MAAM,YAAY,GAAG,GAAqB,EAAE,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK;IACX,IAAI,YAAY;QACd,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAC9C,OAAO,oBAAoB,CAAC;QAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAC9C,OAAO,sBAAsB,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;YACtD,OAAO,mBAAmB,CAAC;QAC7B,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;QAC7B,MAAM,EAAE,sBAAsB,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;QACnE,OAAO,CAAC,MAAM,sBAAsB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AApBU,QAAA,YAAY,gBAoBtB;AAEI,MAAM,eAAe,GAAG,GAAqB,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,sCAAsC;IACpD,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;QAC7B,MAAM,EAAE,yBAAyB,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;QACzE,MAAM,EAAE,2BAA2B,EAAE,GAAG,wDAAa,oBAAoB,GAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,aAAa,CAAC,CAAC;QACzE,OAAO,CACL,MAAM,yBAAyB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAC3E,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC,CAAC;AAXU,QAAA,eAAe,mBAWzB;AAEU,QAAA,kBAAkB,GAAuB;IACpD,IAAA,oBAAY,GAAE;IACd,IAAA,uBAAe,GAAE;CAClB,CAAC"}

package/src/license/dependency-check/collectors/npm-collector.d.ts

@@ -0,0 +1,10 @@
+export interface NpmDependency {
+    name: string;
+    version: string;
+    rawLicense: string;
+    path?: string;
+}
+export interface NpmCollectorOptions {
+    start: string;
+}
+export declare const collectNpmDependencies: (options: NpmCollectorOptions) => Promise<NpmDependency[]>;

package/src/license/dependency-check/collectors/npm-collector.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectNpmDependencies = void 0;
+const tslib_1 = require("tslib");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const licenseChecker = tslib_1.__importStar(require("license-checker-rseidelsohn"));
+const NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;
+const splitNameVersion = (identifier) => {
+    const match = identifier.match(NAME_VERSION_RE);
+    if (!match) {
+        return { name: identifier, version: '0.0.0' };
+    }
+    return { name: match[1], version: match[2] };
+};
+const flattenLicense = (raw) => {
+    if (!raw)
+        return '';
+    if (Array.isArray(raw)) {
+        if (raw.length === 0)
+            return '';
+        if (raw.length === 1)
+            return raw[0];
+        return `(${raw.join(' OR ')})`;
+    }
+    return raw;
+};
+const collectNpmDependencies = async (options) => {
+    const nodeModules = (0, path_1.join)(options.start, 'node_modules');
+    if (!(0, fs_1.existsSync)(nodeModules)) {
+        return [];
+    }
+    const exclude = new Set();
+    const projectPackageJson = (0, path_1.join)(options.start, 'package.json');
+    if ((0, fs_1.existsSync)(projectPackageJson)) {
+        try {
+            const pkg = JSON.parse((0, fs_1.readFileSync)(projectPackageJson, 'utf-8'));
+            if (pkg.name)
+                exclude.add(pkg.name);
+        }
+        catch {
+            // ignore
+        }
+    }
+    const packages = await new Promise((resolve, reject) => {
+        licenseChecker.init({
+            start: options.start,
+            excludePrivatePackages: true,
+        }, (err, results) => {
+            if (err)
+                reject(err);
+            else
+                resolve(results);
+        });
+    });
+    const out = [];
+    for (const [identifier, info] of Object.entries(packages)) {
+        const { name, version } = splitNameVersion(identifier);
+        if (exclude.has(name))
+            continue;
+        out.push({
+            name,
+            version,
+            rawLicense: flattenLicense(info.licenses),
+            path: info.path,
+        });
+    }
+    return out;
+};
+exports.collectNpmDependencies = collectNpmDependencies;
+//# sourceMappingURL=npm-collector.js.map

package/src/license/dependency-check/collectors/npm-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,2BAA8C;AAC9C,+BAA4B;AAC5B,oFAA8D;AAa9D,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,gBAAgB,GAAG,CACvB,UAAkB,EACiB,EAAE;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAyC,EAAU,EAAE;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,OAA4B,EACF,EAAE;IAC5B,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,kBAAkB,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,IAAA,eAAU,EAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAE/D,CAAC;YACF,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClB,cAAc,CAAC,IAAI,CACjB;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,sBAAsB,EAAE,IAAI;SAC7B,EACD,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YACf,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,OAAO;YACP,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAjDW,QAAA,sBAAsB,0BAiDjC"}

package/src/license/dependency-check/collectors/python-collector.d.ts

@@ -0,0 +1,19 @@
+export interface PythonDependency {
+    name: string;
+    version: string;
+    rawLicense: string;
+}
+export interface PythonCollectorOptions {
+    start: string;
+    excludePackages?: string[];
+}
+/**
+ * Discover Python project names in the workspace (from pyproject.toml files)
+ * so they can be excluded from the license check.
+ */
+export declare const findWorkspacePyProjectNames: (start: string) => Promise<string[]>;
+/**
+ * Collect Python dependency licenses by invoking `uvx pip-licenses` against
+ * each discovered virtual environment.
+ */
+export declare const collectPythonDependencies: (options: PythonCollectorOptions) => Promise<PythonDependency[]>;

package/src/license/dependency-check/collectors/python-collector.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectPythonDependencies = exports.findWorkspacePyProjectNames = void 0;
+const tslib_1 = require("tslib");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const child_process_1 = require("child_process");
+const fast_glob_1 = require("fast-glob");
+const toml_1 = tslib_1.__importDefault(require("@iarna/toml"));
+const py_1 = require("../../../utils/py");
+const isUsable = (value) => !!value && value !== 'UNKNOWN';
+// Priority: License-Expression (PEP 639) > License-Metadata (legacy) > License-Classifier (deprecated classifiers)
+const pickLicense = (entry) => {
+    if (isUsable(entry['License-Expression']))
+        return entry['License-Expression'];
+    if (isUsable(entry['License-Metadata']))
+        return entry['License-Metadata'];
+    if (isUsable(entry['License-Classifier']))
+        return entry['License-Classifier'];
+    return '';
+};
+/**
+ * Discover Python project names in the workspace (from pyproject.toml files)
+ * so they can be excluded from the license check.
+ */
+const findWorkspacePyProjectNames = async (start) => {
+    const tomlFiles = await (0, fast_glob_1.glob)(['**/pyproject.toml'], {
+        cwd: start,
+        ignore: ['**/node_modules/**', '**/.venv/**', '**/venv/**', '**/dist/**'],
+        deep: 4,
+        suppressErrors: true,
+    });
+    const names = [];
+    for (const tomlFile of tomlFiles) {
+        try {
+            const content = (0, fs_1.readFileSync)((0, path_1.join)(start, tomlFile), 'utf-8');
+            const parsed = toml_1.default.parse(content);
+            const name = parsed.project?.name;
+            if (typeof name === 'string')
+                names.push(name);
+        }
+        catch {
+            // skip unreadable or malformed files
+        }
+    }
+    return names;
+};
+exports.findWorkspacePyProjectNames = findWorkspacePyProjectNames;
+const findVenvPythons = async (start) => {
+    const patterns = [
+        '**/.venv/bin/python',
+        '**/venv/bin/python',
+        '**/.venv/Scripts/python.exe',
+        '**/venv/Scripts/python.exe',
+    ];
+    const candidates = await (0, fast_glob_1.glob)(patterns, {
+        cwd: start,
+        ignore: [
+            '**/node_modules/**',
+            '**/.nx/**',
+            '**/dist/**',
+            '**/build/**',
+            '**/.git/**',
+        ],
+        deep: 6,
+        suppressErrors: true,
+    });
+    const pythons = candidates.map((c) => (0, path_1.join)(start, c));
+    if (process.env.UV_PROJECT_ENVIRONMENT) {
+        const envPython = (0, path_1.join)(process.env.UV_PROJECT_ENVIRONMENT, process.platform === 'win32' ? 'Scripts/python.exe' : 'bin/python');
+        if ((0, fs_1.existsSync)(envPython)) {
+            pythons.push(envPython);
+        }
+    }
+    return pythons.filter((p) => (0, fs_1.existsSync)(p));
+};
+/**
+ * Collect Python dependency licenses by invoking `uvx pip-licenses` against
+ * each discovered virtual environment.
+ */
+const collectPythonDependencies = async (options) => {
+    const pythons = await findVenvPythons(options.start);
+    if (pythons.length === 0)
+        return [];
+    const seen = new Map();
+    const ignoreFlag = options.excludePackages?.length
+        ? ` --ignore-packages ${options.excludePackages.join(' ')}`
+        : '';
+    const cmd = (0, py_1.uvxCommand)('pip-licenses', `--format json --from all${ignoreFlag}`);
+    for (const python of pythons) {
+        try {
+            const output = (0, child_process_1.execSync)(`${cmd} --python ${python}`, {
+                cwd: options.start,
+                encoding: 'utf-8',
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout: 60_000,
+            });
+            const entries = JSON.parse(output);
+            for (const entry of entries) {
+                const key = `${entry.Name}@${entry.Version}`;
+                if (seen.has(key))
+                    continue;
+                seen.set(key, {
+                    name: entry.Name,
+                    version: entry.Version,
+                    rawLicense: pickLicense(entry),
+                });
+            }
+        }
+        catch {
+            // If pip-licenses fails for this venv, skip it
+        }
+    }
+    return Array.from(seen.values());
+};
+exports.collectPythonDependencies = collectPythonDependencies;
+//# sourceMappingURL=python-collector.js.map

package/src/license/dependency-check/collectors/python-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python-collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/python-collector.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,2BAA8C;AAC9C,+BAA4B;AAC5B,iDAAyC;AACzC,yCAA6C;AAC7C,+DAA+B;AAC/B,0CAA+C;AAqB/C,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAmB,EAAE,CAC9D,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;AAEjC,mHAAmH;AACnH,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAU,EAAE;IACtD,IAAI,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,2BAA2B,GAAG,KAAK,EAC9C,KAAa,EACM,EAAE;IACrB,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAQ,EAAC,CAAC,mBAAmB,CAAC,EAAE;QACtD,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,CAAC,oBAAoB,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;QACzE,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,cAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAoC,EAAE,IAAI,CAAC;YAChE,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AArBW,QAAA,2BAA2B,+BAqBtC;AAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAqB,EAAE;IACjE,MAAM,QAAQ,GAAG;QACf,qBAAqB;QACrB,oBAAoB;QACpB,6BAA6B;QAC7B,4BAA4B;KAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,IAAA,gBAAQ,EAAC,QAAQ,EAAE;QAC1C,GAAG,EAAE,KAAK;QACV,MAAM,EAAE;YACN,oBAAoB;YACpB,WAAW;YACX,YAAY;YACZ,aAAa;YACb,YAAY;SACb;QACD,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,WAAI,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAA,WAAI,EACpB,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAClC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CACnE,CAAC;QACF,IAAI,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,OAA+B,EACF,EAAE;IAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM;QAChD,CAAC,CAAC,sBAAsB,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,IAAA,eAAU,EACpB,cAAc,EACd,2BAA2B,UAAU,EAAE,CACxC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,GAAG,GAAG,aAAa,MAAM,EAAE,EAAE;gBACnD,GAAG,EAAE,OAAO,CAAC,KAAK;gBAClB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAuB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC;AAxCW,QAAA,yBAAyB,6BAwCpC"}

package/src/license/dependency-check/evaluator.d.ts

@@ -0,0 +1,9 @@
+import { AllowlistEntry, LicenseStatus } from './types';
+export interface EvaluatorOptions {
+    allow: AllowlistEntry[];
+}
+interface Evaluator {
+    evaluate(rawLicense: string | undefined | null): LicenseStatus;
+}
+export declare const createEvaluator: (options: EvaluatorOptions) => Evaluator;
+export {};

package/src/license/dependency-check/evaluator.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEvaluator = void 0;
+const tslib_1 = require("tslib");
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const spdx_satisfies_1 = tslib_1.__importDefault(require("spdx-satisfies"));
+const isUnknownToken = (raw) => {
+    if (!raw)
+        return true;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return true;
+    if (trimmed.toUpperCase() === 'UNKNOWN')
+        return true;
+    if (trimmed.toLowerCase().startsWith('custom:'))
+        return true;
+    if (trimmed.toLowerCase().startsWith('see license in'))
+        return true;
+    return false;
+};
+/**
+ * Strip the trailing `*` that license-checker adds when a license is guessed
+ * from file content rather than declared in package.json metadata.
+ */
+const normalise = (raw) => {
+    let s = raw.trim();
+    if (s.endsWith('*'))
+        s = s.slice(0, -1).trim();
+    return s;
+};
+/**
+ * Build a flat list of valid SPDX IDs from the allowlist for use with
+ * spdx-satisfies. Entries that aren't parseable as SPDX identifiers are
+ * excluded (they're still matched via the alias lookup).
+ */
+const buildSpdxIds = (allow) => {
+    const ids = [];
+    for (const entry of allow) {
+        if (!entry.spdxId)
+            continue;
+        try {
+            (0, spdx_satisfies_1.default)(entry.spdxId, [entry.spdxId]);
+            ids.push(entry.spdxId);
+        }
+        catch {
+            // Not a valid SPDX identifier — skip for spdx-satisfies, still
+            // matched via alias lookup
+        }
+    }
+    return ids;
+};
+/**
+ * Build a case-insensitive lookup for matching by full name or alias
+ * (for licenses that aren't valid SPDX but appear in package metadata).
+ */
+const buildAliasLookup = (allow) => {
+    const m = new Map();
+    for (const e of allow) {
+        if (e.spdxId)
+            m.set(e.spdxId.toLowerCase(), true);
+        if (e.fullName)
+            m.set(e.fullName.toLowerCase(), true);
+        for (const a of e.aliases ?? []) {
+            if (a)
+                m.set(a.toLowerCase(), true);
+        }
+    }
+    return m;
+};
+const evaluateToken = (token, spdxIds, aliasLookup) => {
+    const cleaned = normalise(token);
+    if (isUnknownToken(cleaned))
+        return 'UNKNOWN';
+    // Try spdx-satisfies for valid SPDX expressions
+    try {
+        if ((0, spdx_satisfies_1.default)(cleaned, spdxIds))
+            return 'PRE_APPROVED';
+    }
+    catch {
+        // Not a valid SPDX expression — fall through to alias matching
+    }
+    // Fall back to alias/fullName matching for non-SPDX strings
+    if (aliasLookup.has(cleaned.toLowerCase()))
+        return 'PRE_APPROVED';
+    return 'NOT_APPROVED';
+};
+const createEvaluator = (options) => {
+    const spdxIds = buildSpdxIds(options.allow);
+    const aliasLookup = buildAliasLookup(options.allow);
+    return {
+        evaluate(rawLicense) {
+            if (!rawLicense || rawLicense.trim().length === 0)
+                return 'UNKNOWN';
+            const normalised = normalise(rawLicense);
+            if (isUnknownToken(normalised))
+                return 'UNKNOWN';
+            // Python tooling emits "Apache Software License; BSD License" — split and treat as OR
+            if (normalised.includes(';')) {
+                const parts = normalised
+                    .split(';')
+                    .map((p) => p.trim())
+                    .filter((p) => p.length > 0);
+                if (parts.length > 1) {
+                    for (const part of parts) {
+                        const status = evaluateToken(part, spdxIds, aliasLookup);
+                        if (status === 'PRE_APPROVED')
+                            return 'PRE_APPROVED';
+                    }
+                    if (parts.every((p) => isUnknownToken(normalise(p))))
+                        return 'UNKNOWN';
+                    return 'NOT_APPROVED';
+                }
+            }
+            return evaluateToken(normalised, spdxIds, aliasLookup);
+        },
+    };
+};
+exports.createEvaluator = createEvaluator;
+//# sourceMappingURL=evaluator.js.map

package/src/license/dependency-check/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/evaluator.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,4EAA2C;AAW3C,MAAM,cAAc,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE;IACxC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,KAAuB,EAAY,EAAE;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,IAAI,CAAC;YACH,IAAA,wBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAuB,EAAqB,EAAE;IACtE,MAAM,CAAC,GAAG,IAAI,GAAG,EAAgB,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAa,EACb,OAAiB,EACjB,WAA8B,EACf,EAAE;IACjB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,IAAA,wBAAa,EAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,cAAc,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,cAAc,CAAC;IAElE,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAEK,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAa,EAAE;IACtE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO;QACL,QAAQ,CAAC,UAAU;YACjB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEpE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,cAAc,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEjD,sFAAsF;YACtF,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,UAAU;qBACrB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;wBACzD,IAAI,MAAM,KAAK,cAAc;4BAAE,OAAO,cAAc,CAAC;oBACvD,CAAC;oBACD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;wBAClD,OAAO,SAAS,CAAC;oBACnB,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA/BW,QAAA,eAAe,mBA+B1B"}

package/src/license/dependency-check/executor-schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/src/license/dependency-check/executor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ExecutorContext } from '@nx/devkit';
+export type LicenseCheckExecutorSchema = Record<string, never>;
+export default function runLicenseCheckExecutor(_options: LicenseCheckExecutorSchema, _context: ExecutorContext): Promise<{
+    success: boolean;
+}>;