@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/license/dependency-check/collectors/npm-collector.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm-collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,2BAA8C;AAC9C,oFAA8D;AAC9D,+BAA4B;AAa5B,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,gBAAgB,GAAG,CACvB,UAAkB,EACiB,EAAE;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,GAAyC,EAAU,EAAE;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,OAA4B,EACF,EAAE;IAC5B,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,kBAAkB,GAAG,IAAA,WAAI,EAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,IAAA,eAAU,EAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAE/D,CAAC;YACF,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClB,cAAc,CAAC,IAAI,CACjB;YACE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,sBAAsB,EAAE,IAAI;SAC7B,EACD,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YACf,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,OAAO;YACP,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAjDW,QAAA,sBAAsB,0BAiDjC"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: flattenLicense(info.licenses),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","rawLicense","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA,OAAO,MAAMI,yBAAyB,OACpCC;IAEA,MAAMC,cAAcd,KAAKa,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAClB,WAAWiB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBlB,KAAKa,QAAQE,KAAK,EAAE;IAC/C,IAAIlB,WAAWqB,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAACvB,aAAaoB,oBAAoB;YAGxD,IAAIC,IAAId,IAAI,EAAEW,QAAQM,GAAG,CAACH,IAAId,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMkB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACR3B,eAAe4B,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAAC5B,YAAY6B,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAElB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIa,QAAQmB,GAAG,CAAC9B,OAAO;QACvB0B,IAAIK,IAAI,CAAC;YACP/B;YACAC;YACA+B,YAAY9B,eAAeyB,KAAKM,QAAQ;YACxCC,MAAMP,KAAKO,IAAI;QACjB;IACF;IACA,OAAOR;AACT,EAAE"}

package/src/license/dependency-check/collectors/python-collector.js

@@ -1,121 +1,120 @@
-"use strict";
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.collectPythonDependencies = exports.findWorkspacePyProjectNames = void 0;
-const tslib_1 = require("tslib");
-const toml_1 = tslib_1.__importDefault(require("@iarna/toml"));
-const child_process_1 = require("child_process");
-const fast_glob_1 = require("fast-glob");
-const fs_1 = require("fs");
-const path_1 = require("path");
-const py_1 = require("../../../utils/py");
-const isUsable = (value) => !!value && value !== 'UNKNOWN';
+ */ import TOML from "@iarna/toml";
+import { execSync } from "child_process";
+import fastGlob from "fast-glob";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { uvxCommand } from "../../../utils/py.js";
+const isUsable = (value)=>!!value && value !== 'UNKNOWN';
+// Package names and interpreter paths are interpolated into a shell command, so
+// only accept the characters PEP 508 permits in a name, and paths without shell
+// metacharacters.
+const isSafePackageName = (name)=>/^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/.test(name);
+const isSafePath = (path)=>!/[^\w./\\:@+-]/.test(path);
 // Priority: License-Expression (PEP 639) > License-Metadata (legacy) > License-Classifier (deprecated classifiers)
-const pickLicense = (entry) => {
-    if (isUsable(entry['License-Expression']))
-        return entry['License-Expression'];
-    if (isUsable(entry['License-Metadata']))
-        return entry['License-Metadata'];
-    if (isUsable(entry['License-Classifier']))
-        return entry['License-Classifier'];
+const pickLicense = (entry)=>{
+    if (isUsable(entry['License-Expression'])) return entry['License-Expression'];
+    if (isUsable(entry['License-Metadata'])) return entry['License-Metadata'];
+    if (isUsable(entry['License-Classifier'])) return entry['License-Classifier'];
     return '';
 };
 /**
  * Discover Python project names in the workspace (from pyproject.toml files)
  * so they can be excluded from the license check.
- */
-const findWorkspacePyProjectNames = async (start) => {
-    const tomlFiles = await (0, fast_glob_1.glob)(['**/pyproject.toml'], {
+ */ export const findWorkspacePyProjectNames = async (start)=>{
+    const tomlFiles = await fastGlob([
+        '**/pyproject.toml'
+    ], {
         cwd: start,
-        ignore: ['**/node_modules/**', '**/.venv/**', '**/venv/**', '**/dist/**'],
+        ignore: [
+            '**/node_modules/**',
+            '**/.venv/**',
+            '**/venv/**',
+            '**/dist/**'
+        ],
         deep: 4,
-        suppressErrors: true,
+        suppressErrors: true
     });
     const names = [];
-    for (const tomlFile of tomlFiles) {
+    for (const tomlFile of tomlFiles){
         try {
-            const content = (0, fs_1.readFileSync)((0, path_1.join)(start, tomlFile), 'utf-8');
-            const parsed = toml_1.default.parse(content);
+            const content = readFileSync(join(start, tomlFile), 'utf-8');
+            const parsed = TOML.parse(content);
             const name = parsed.project?.name;
-            if (typeof name === 'string')
-                names.push(name);
-        }
-        catch {
-            // skip unreadable or malformed files
+            if (typeof name === 'string' && isSafePackageName(name)) names.push(name);
+        } catch  {
+        // skip unreadable or malformed files
         }
     }
     return names;
 };
-exports.findWorkspacePyProjectNames = findWorkspacePyProjectNames;
-const findVenvPythons = async (start) => {
+const findVenvPythons = async (start)=>{
     const patterns = [
         '**/.venv/bin/python',
         '**/venv/bin/python',
         '**/.venv/Scripts/python.exe',
-        '**/venv/Scripts/python.exe',
+        '**/venv/Scripts/python.exe'
     ];
-    const candidates = await (0, fast_glob_1.glob)(patterns, {
+    const candidates = await fastGlob(patterns, {
         cwd: start,
         ignore: [
             '**/node_modules/**',
             '**/.nx/**',
             '**/dist/**',
             '**/build/**',
-            '**/.git/**',
+            '**/.git/**'
         ],
         deep: 6,
-        suppressErrors: true,
+        suppressErrors: true
     });
-    const pythons = candidates.map((c) => (0, path_1.join)(start, c));
+    const pythons = candidates.map((c)=>join(start, c));
     if (process.env.UV_PROJECT_ENVIRONMENT) {
-        const envPython = (0, path_1.join)(process.env.UV_PROJECT_ENVIRONMENT, process.platform === 'win32' ? 'Scripts/python.exe' : 'bin/python');
-        if ((0, fs_1.existsSync)(envPython)) {
+        const envPython = join(process.env.UV_PROJECT_ENVIRONMENT, process.platform === 'win32' ? 'Scripts/python.exe' : 'bin/python');
+        if (existsSync(envPython)) {
             pythons.push(envPython);
         }
     }
-    return pythons.filter((p) => (0, fs_1.existsSync)(p));
+    return pythons.filter((p)=>existsSync(p) && isSafePath(p));
 };
 /**
  * Collect Python dependency licenses by invoking `uvx pip-licenses` against
  * each discovered virtual environment.
- */
-const collectPythonDependencies = async (options) => {
+ */ export const collectPythonDependencies = async (options)=>{
     const pythons = await findVenvPythons(options.start);
-    if (pythons.length === 0)
-        return [];
+    if (pythons.length === 0) return [];
     const seen = new Map();
-    const ignoreFlag = options.excludePackages?.length
-        ? ` --ignore-packages ${options.excludePackages.join(' ')}`
-        : '';
-    const cmd = (0, py_1.uvxCommand)('pip-licenses', `--format json --from all${ignoreFlag}`);
-    for (const python of pythons) {
+    const excluded = options.excludePackages?.filter(isSafePackageName) ?? [];
+    const ignoreFlag = excluded.length ? ` --ignore-packages ${excluded.join(' ')}` : '';
+    const cmd = uvxCommand('pip-licenses', `--format json --from all${ignoreFlag}`);
+    for (const python of pythons){
         try {
-            const output = (0, child_process_1.execSync)(`${cmd} --python ${python}`, {
+            const output = execSync(`${cmd} --python ${python}`, {
                 cwd: options.start,
                 encoding: 'utf-8',
-                stdio: ['pipe', 'pipe', 'pipe'],
-                timeout: 60_000,
+                stdio: [
+                    'pipe',
+                    'pipe',
+                    'pipe'
+                ],
+                timeout: 60_000
             });
             const entries = JSON.parse(output);
-            for (const entry of entries) {
+            for (const entry of entries){
                 const key = `${entry.Name}@${entry.Version}`;
-                if (seen.has(key))
-                    continue;
+                if (seen.has(key)) continue;
                 seen.set(key, {
                     name: entry.Name,
                     version: entry.Version,
-                    rawLicense: pickLicense(entry),
+                    rawLicense: pickLicense(entry)
                 });
             }
-        }
-        catch {
-            // If pip-licenses fails for this venv, skip it
+        } catch  {
+        // If pip-licenses fails for this venv, skip it
         }
     }
     return Array.from(seen.values());
 };
-exports.collectPythonDependencies = collectPythonDependencies;
+
 //# sourceMappingURL=python-collector.js.map

package/src/license/dependency-check/collectors/python-collector.js.map

@@ -1 +1 @@
-{"version":3,"file":"python-collector.js","sourceRoot":"","sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/python-collector.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;AAEH,+DAA+B;AAC/B,iDAAyC;AACzC,yCAA6C;AAC7C,2BAA8C;AAC9C,+BAA4B;AAC5B,0CAA+C;AAqB/C,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAmB,EAAE,CAC9D,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC;AAEjC,mHAAmH;AACnH,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAU,EAAE;IACtD,IAAI,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC9E,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,2BAA2B,GAAG,KAAK,EAC9C,KAAa,EACM,EAAE;IACrB,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAQ,EAAC,CAAC,mBAAmB,CAAC,EAAE;QACtD,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,CAAC,oBAAoB,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;QACzE,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,cAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,IAAI,GAAI,MAAM,CAAC,OAAoC,EAAE,IAAI,CAAC;YAChE,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AArBW,QAAA,2BAA2B,+BAqBtC;AAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAqB,EAAE;IACjE,MAAM,QAAQ,GAAG;QACf,qBAAqB;QACrB,oBAAoB;QACpB,6BAA6B;QAC7B,4BAA4B;KAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,IAAA,gBAAQ,EAAC,QAAQ,EAAE;QAC1C,GAAG,EAAE,KAAK;QACV,MAAM,EAAE;YACN,oBAAoB;YACpB,WAAW;YACX,YAAY;YACZ,aAAa;YACb,YAAY;SACb;QACD,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,WAAI,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAA,WAAI,EACpB,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAClC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CACnE,CAAC;QACF,IAAI,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,OAA+B,EACF,EAAE;IAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM;QAChD,CAAC,CAAC,sBAAsB,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC3D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,IAAA,eAAU,EACpB,cAAc,EACd,2BAA2B,UAAU,EAAE,CACxC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,GAAG,GAAG,aAAa,MAAM,EAAE,EAAE;gBACnD,GAAG,EAAE,OAAO,CAAC,KAAK;gBAClB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAuB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC;AAxCW,QAAA,yBAAyB,6BAwCpC"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/python-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\n\nimport TOML from '@iarna/toml';\nimport { execSync } from 'child_process';\nimport fastGlob from 'fast-glob';\nimport { existsSync, readFileSync } from 'fs';\nimport { join } from 'path';\nimport { uvxCommand } from '../../../utils/py.js';\n\nexport interface PythonDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n}\n\nexport interface PythonCollectorOptions {\n  start: string;\n  excludePackages?: string[];\n}\n\ninterface PipLicensesEntry {\n  Name: string;\n  Version: string;\n  'License-Expression': string;\n  'License-Metadata': string;\n  'License-Classifier': string;\n}\n\nconst isUsable = (value: string | undefined): value is string =>\n  !!value && value !== 'UNKNOWN';\n\n// Package names and interpreter paths are interpolated into a shell command, so\n// only accept the characters PEP 508 permits in a name, and paths without shell\n// metacharacters.\nconst isSafePackageName = (name: string): boolean =>\n  /^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/.test(name);\n\nconst isSafePath = (path: string): boolean => !/[^\\w./\\\\:@+-]/.test(path);\n\n// Priority: License-Expression (PEP 639) > License-Metadata (legacy) > License-Classifier (deprecated classifiers)\nconst pickLicense = (entry: PipLicensesEntry): string => {\n  if (isUsable(entry['License-Expression'])) return entry['License-Expression'];\n  if (isUsable(entry['License-Metadata'])) return entry['License-Metadata'];\n  if (isUsable(entry['License-Classifier'])) return entry['License-Classifier'];\n  return '';\n};\n\n/**\n * Discover Python project names in the workspace (from pyproject.toml files)\n * so they can be excluded from the license check.\n */\nexport const findWorkspacePyProjectNames = async (\n  start: string,\n): Promise<string[]> => {\n  const tomlFiles = await fastGlob(['**/pyproject.toml'], {\n    cwd: start,\n    ignore: ['**/node_modules/**', '**/.venv/**', '**/venv/**', '**/dist/**'],\n    deep: 4,\n    suppressErrors: true,\n  });\n  const names: string[] = [];\n  for (const tomlFile of tomlFiles) {\n    try {\n      const content = readFileSync(join(start, tomlFile), 'utf-8');\n      const parsed = TOML.parse(content);\n      const name = (parsed.project as TOML.JsonMap | undefined)?.name;\n      if (typeof name === 'string' && isSafePackageName(name)) names.push(name);\n    } catch {\n      // skip unreadable or malformed files\n    }\n  }\n  return names;\n};\n\nconst findVenvPythons = async (start: string): Promise<string[]> => {\n  const patterns = [\n    '**/.venv/bin/python',\n    '**/venv/bin/python',\n    '**/.venv/Scripts/python.exe',\n    '**/venv/Scripts/python.exe',\n  ];\n\n  const candidates = await fastGlob(patterns, {\n    cwd: start,\n    ignore: [\n      '**/node_modules/**',\n      '**/.nx/**',\n      '**/dist/**',\n      '**/build/**',\n      '**/.git/**',\n    ],\n    deep: 6,\n    suppressErrors: true,\n  });\n\n  const pythons = candidates.map((c) => join(start, c));\n\n  if (process.env.UV_PROJECT_ENVIRONMENT) {\n    const envPython = join(\n      process.env.UV_PROJECT_ENVIRONMENT,\n      process.platform === 'win32' ? 'Scripts/python.exe' : 'bin/python',\n    );\n    if (existsSync(envPython)) {\n      pythons.push(envPython);\n    }\n  }\n\n  return pythons.filter((p) => existsSync(p) && isSafePath(p));\n};\n\n/**\n * Collect Python dependency licenses by invoking `uvx pip-licenses` against\n * each discovered virtual environment.\n */\nexport const collectPythonDependencies = async (\n  options: PythonCollectorOptions,\n): Promise<PythonDependency[]> => {\n  const pythons = await findVenvPythons(options.start);\n  if (pythons.length === 0) return [];\n\n  const seen = new Map<string, PythonDependency>();\n  const excluded = options.excludePackages?.filter(isSafePackageName) ?? [];\n  const ignoreFlag = excluded.length\n    ? ` --ignore-packages ${excluded.join(' ')}`\n    : '';\n  const cmd = uvxCommand(\n    'pip-licenses',\n    `--format json --from all${ignoreFlag}`,\n  );\n\n  for (const python of pythons) {\n    try {\n      const output = execSync(`${cmd} --python ${python}`, {\n        cwd: options.start,\n        encoding: 'utf-8',\n        stdio: ['pipe', 'pipe', 'pipe'],\n        timeout: 60_000,\n      });\n\n      const entries: PipLicensesEntry[] = JSON.parse(output);\n      for (const entry of entries) {\n        const key = `${entry.Name}@${entry.Version}`;\n        if (seen.has(key)) continue;\n        seen.set(key, {\n          name: entry.Name,\n          version: entry.Version,\n          rawLicense: pickLicense(entry),\n        });\n      }\n    } catch {\n      // If pip-licenses fails for this venv, skip it\n    }\n  }\n\n  return Array.from(seen.values());\n};\n"],"names":["TOML","execSync","fastGlob","existsSync","readFileSync","join","uvxCommand","isUsable","value","isSafePackageName","name","test","isSafePath","path","pickLicense","entry","findWorkspacePyProjectNames","start","tomlFiles","cwd","ignore","deep","suppressErrors","names","tomlFile","content","parsed","parse","project","push","findVenvPythons","patterns","candidates","pythons","map","c","process","env","UV_PROJECT_ENVIRONMENT","envPython","platform","filter","p","collectPythonDependencies","options","length","seen","Map","excluded","excludePackages","ignoreFlag","cmd","python","output","encoding","stdio","timeout","entries","JSON","key","Name","Version","has","set","version","rawLicense","Array","from","values"],"mappings":"AAAA;;;CAGC,GAED,OAAOA,UAAU,cAAc;AAC/B,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,OAAOC,cAAc,YAAY;AACjC,SAASC,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,SAASC,IAAI,QAAQ,OAAO;AAC5B,SAASC,UAAU,QAAQ,uBAAuB;AAqBlD,MAAMC,WAAW,CAACC,QAChB,CAAC,CAACA,SAASA,UAAU;AAEvB,gFAAgF;AAChF,gFAAgF;AAChF,kBAAkB;AAClB,MAAMC,oBAAoB,CAACC,OACzB,6CAA6CC,IAAI,CAACD;AAEpD,MAAME,aAAa,CAACC,OAA0B,CAAC,gBAAgBF,IAAI,CAACE;AAEpE,mHAAmH;AACnH,MAAMC,cAAc,CAACC;IACnB,IAAIR,SAASQ,KAAK,CAAC,qBAAqB,GAAG,OAAOA,KAAK,CAAC,qBAAqB;IAC7E,IAAIR,SAASQ,KAAK,CAAC,mBAAmB,GAAG,OAAOA,KAAK,CAAC,mBAAmB;IACzE,IAAIR,SAASQ,KAAK,CAAC,qBAAqB,GAAG,OAAOA,KAAK,CAAC,qBAAqB;IAC7E,OAAO;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMC,8BAA8B,OACzCC;IAEA,MAAMC,YAAY,MAAMhB,SAAS;QAAC;KAAoB,EAAE;QACtDiB,KAAKF;QACLG,QAAQ;YAAC;YAAsB;YAAe;YAAc;SAAa;QACzEC,MAAM;QACNC,gBAAgB;IAClB;IACA,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,YAAYN,UAAW;QAChC,IAAI;YACF,MAAMO,UAAUrB,aAAaC,KAAKY,OAAOO,WAAW;YACpD,MAAME,SAAS1B,KAAK2B,KAAK,CAACF;YAC1B,MAAMf,OAAQgB,OAAOE,OAAO,EAA+BlB;YAC3D,IAAI,OAAOA,SAAS,YAAYD,kBAAkBC,OAAOa,MAAMM,IAAI,CAACnB;QACtE,EAAE,OAAM;QACN,qCAAqC;QACvC;IACF;IACA,OAAOa;AACT,EAAE;AAEF,MAAMO,kBAAkB,OAAOb;IAC7B,MAAMc,WAAW;QACf;QACA;QACA;QACA;KACD;IAED,MAAMC,aAAa,MAAM9B,SAAS6B,UAAU;QAC1CZ,KAAKF;QACLG,QAAQ;YACN;YACA;YACA;YACA;YACA;SACD;QACDC,MAAM;QACNC,gBAAgB;IAClB;IAEA,MAAMW,UAAUD,WAAWE,GAAG,CAAC,CAACC,IAAM9B,KAAKY,OAAOkB;IAElD,IAAIC,QAAQC,GAAG,CAACC,sBAAsB,EAAE;QACtC,MAAMC,YAAYlC,KAChB+B,QAAQC,GAAG,CAACC,sBAAsB,EAClCF,QAAQI,QAAQ,KAAK,UAAU,uBAAuB;QAExD,IAAIrC,WAAWoC,YAAY;YACzBN,QAAQJ,IAAI,CAACU;QACf;IACF;IAEA,OAAON,QAAQQ,MAAM,CAAC,CAACC,IAAMvC,WAAWuC,MAAM9B,WAAW8B;AAC3D;AAEA;;;CAGC,GACD,OAAO,MAAMC,4BAA4B,OACvCC;IAEA,MAAMX,UAAU,MAAMH,gBAAgBc,QAAQ3B,KAAK;IACnD,IAAIgB,QAAQY,MAAM,KAAK,GAAG,OAAO,EAAE;IAEnC,MAAMC,OAAO,IAAIC;IACjB,MAAMC,WAAWJ,QAAQK,eAAe,EAAER,OAAOhC,sBAAsB,EAAE;IACzE,MAAMyC,aAAaF,SAASH,MAAM,GAC9B,CAAC,mBAAmB,EAAEG,SAAS3C,IAAI,CAAC,MAAM,GAC1C;IACJ,MAAM8C,MAAM7C,WACV,gBACA,CAAC,wBAAwB,EAAE4C,YAAY;IAGzC,KAAK,MAAME,UAAUnB,QAAS;QAC5B,IAAI;YACF,MAAMoB,SAASpD,SAAS,GAAGkD,IAAI,UAAU,EAAEC,QAAQ,EAAE;gBACnDjC,KAAKyB,QAAQ3B,KAAK;gBAClBqC,UAAU;gBACVC,OAAO;oBAAC;oBAAQ;oBAAQ;iBAAO;gBAC/BC,SAAS;YACX;YAEA,MAAMC,UAA8BC,KAAK/B,KAAK,CAAC0B;YAC/C,KAAK,MAAMtC,SAAS0C,QAAS;gBAC3B,MAAME,MAAM,GAAG5C,MAAM6C,IAAI,CAAC,CAAC,EAAE7C,MAAM8C,OAAO,EAAE;gBAC5C,IAAIf,KAAKgB,GAAG,CAACH,MAAM;gBACnBb,KAAKiB,GAAG,CAACJ,KAAK;oBACZjD,MAAMK,MAAM6C,IAAI;oBAChBI,SAASjD,MAAM8C,OAAO;oBACtBI,YAAYnD,YAAYC;gBAC1B;YACF;QACF,EAAE,OAAM;QACN,+CAA+C;QACjD;IACF;IAEA,OAAOmD,MAAMC,IAAI,CAACrB,KAAKsB,MAAM;AAC/B,EAAE"}

package/src/license/dependency-check/evaluator.d.ts

@@ -1,4 +1,4 @@
-import type { AllowlistEntry, LicenseStatus } from './types';
+import type { AllowlistEntry, LicenseStatus } from './types.js';
 export interface EvaluatorOptions {
     allow: AllowlistEntry[];
 }

package/src/license/dependency-check/evaluator.js

@@ -1,53 +1,40 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createEvaluator = void 0;
-const tslib_1 = require("tslib");
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const spdx_satisfies_1 = tslib_1.__importDefault(require("spdx-satisfies"));
-const isUnknownToken = (raw) => {
-    if (!raw)
-        return true;
+ */ import spdxSatisfies from "spdx-satisfies";
+const isUnknownToken = (raw)=>{
+    if (!raw) return true;
     const trimmed = raw.trim();
-    if (!trimmed)
-        return true;
-    if (trimmed.toUpperCase() === 'UNKNOWN')
-        return true;
-    if (trimmed.toLowerCase().startsWith('custom:'))
-        return true;
-    if (trimmed.toLowerCase().startsWith('see license in'))
-        return true;
+    if (!trimmed) return true;
+    if (trimmed.toUpperCase() === 'UNKNOWN') return true;
+    if (trimmed.toLowerCase().startsWith('custom:')) return true;
+    if (trimmed.toLowerCase().startsWith('see license in')) return true;
     return false;
 };
 /**
  * Strip the trailing `*` that license-checker adds when a license is guessed
  * from file content rather than declared in package.json metadata.
- */
-const normalise = (raw) => {
+ */ const normalise = (raw)=>{
     let s = raw.trim();
-    if (s.endsWith('*'))
-        s = s.slice(0, -1).trim();
+    if (s.endsWith('*')) s = s.slice(0, -1).trim();
     return s;
 };
 /**
  * Build a flat list of valid SPDX IDs from the allowlist for use with
  * spdx-satisfies. Entries that aren't parseable as SPDX identifiers are
  * excluded (they're still matched via the alias lookup).
- */
-const buildSpdxIds = (allow) => {
+ */ const buildSpdxIds = (allow)=>{
     const ids = [];
-    for (const entry of allow) {
-        if (!entry.spdxId)
-            continue;
+    for (const entry of allow){
+        if (!entry.spdxId) continue;
         try {
-            (0, spdx_satisfies_1.default)(entry.spdxId, [entry.spdxId]);
+            spdxSatisfies(entry.spdxId, [
+                entry.spdxId
+            ]);
             ids.push(entry.spdxId);
-        }
-        catch {
-            // Not a valid SPDX identifier — skip for spdx-satisfies, still
-            // matched via alias lookup
+        } catch  {
+        // Not a valid SPDX identifier — skip for spdx-satisfies, still
+        // matched via alias lookup
         }
     }
     return ids;
@@ -55,68 +42,98 @@ const buildSpdxIds = (allow) => {
 /**
  * Build a case-insensitive lookup for matching by full name or alias
  * (for licenses that aren't valid SPDX but appear in package metadata).
- */
-const buildAliasLookup = (allow) => {
+ */ const buildAliasLookup = (allow)=>{
     const m = new Map();
-    for (const e of allow) {
-        if (e.spdxId)
-            m.set(e.spdxId.toLowerCase(), true);
-        if (e.fullName)
-            m.set(e.fullName.toLowerCase(), true);
-        for (const a of e.aliases ?? []) {
-            if (a)
-                m.set(a.toLowerCase(), true);
+    for (const e of allow){
+        if (e.spdxId) m.set(e.spdxId.toLowerCase(), true);
+        if (e.fullName) m.set(e.fullName.toLowerCase(), true);
+        for (const a of e.aliases ?? []){
+            if (a) m.set(a.toLowerCase(), true);
         }
     }
     return m;
 };
-const evaluateToken = (token, spdxIds, aliasLookup) => {
+/**
+ * Split a free-text license list on a separator, treating the operands as
+ * alternatives (OR).
+ *
+ * Commas need care: several allowed license names contain one themselves (e.g.
+ * "Apache License, Version 2.0"), so the string is left intact when it already
+ * resolves as a single license, and fragments are otherwise rejoined
+ * longest-match-first. That keeps "MIT License, Apache License, Version 2.0"
+ * parsing as MIT + Apache rather than three unresolvable fragments.
+ *
+ * Returns `undefined` when the value shouldn't be treated as a list.
+ */ const splitAlternatives = (value, separator, isKnown)=>{
+    if (!value.includes(separator)) return undefined;
+    if (isKnown(value)) return undefined;
+    const parts = value.split(separator).map((p)=>p.trim()).filter((p)=>p.length > 0);
+    if (parts.length < 2) return undefined;
+    // Rejoin fragments that only make sense together, so a license name
+    // containing the separator survives the split. At each position take the
+    // longest run of fragments that forms a known license; failing that, emit the
+    // single fragment and let the caller report it.
+    const merged = [];
+    let i = 0;
+    while(i < parts.length){
+        let matchedTo = -1;
+        let candidate = parts[i];
+        for(let j = i; j < parts.length; j++){
+            if (j > i) candidate = `${candidate}${separator} ${parts[j]}`;
+            if (isKnown(candidate)) matchedTo = j;
+        }
+        if (matchedTo >= 0) {
+            merged.push(parts.slice(i, matchedTo + 1).join(`${separator} `));
+            i = matchedTo + 1;
+        } else {
+            merged.push(parts[i]);
+            i += 1;
+        }
+    }
+    return merged.length > 1 ? merged : undefined;
+};
+const evaluateToken = (token, spdxIds, aliasLookup)=>{
     const cleaned = normalise(token);
-    if (isUnknownToken(cleaned))
-        return 'UNKNOWN';
+    if (isUnknownToken(cleaned)) return 'UNKNOWN';
     // Try spdx-satisfies for valid SPDX expressions
     try {
-        if ((0, spdx_satisfies_1.default)(cleaned, spdxIds))
-            return 'PRE_APPROVED';
-    }
-    catch {
-        // Not a valid SPDX expression — fall through to alias matching
+        if (spdxSatisfies(cleaned, spdxIds)) return 'PRE_APPROVED';
+    } catch  {
+    // Not a valid SPDX expression — fall through to alias matching
     }
     // Fall back to alias/fullName matching for non-SPDX strings
-    if (aliasLookup.has(cleaned.toLowerCase()))
-        return 'PRE_APPROVED';
+    if (aliasLookup.has(cleaned.toLowerCase())) return 'PRE_APPROVED';
     return 'NOT_APPROVED';
 };
-const createEvaluator = (options) => {
+export const createEvaluator = (options)=>{
     const spdxIds = buildSpdxIds(options.allow);
     const aliasLookup = buildAliasLookup(options.allow);
     return {
-        evaluate(rawLicense) {
-            if (!rawLicense || rawLicense.trim().length === 0)
-                return 'UNKNOWN';
+        evaluate (rawLicense) {
+            if (!rawLicense || rawLicense.trim().length === 0) return 'UNKNOWN';
             const normalised = normalise(rawLicense);
-            if (isUnknownToken(normalised))
-                return 'UNKNOWN';
-            // Python tooling emits "Apache Software License; BSD License" — split and treat as OR
-            if (normalised.includes(';')) {
-                const parts = normalised
-                    .split(';')
-                    .map((p) => p.trim())
-                    .filter((p) => p.length > 0);
-                if (parts.length > 1) {
-                    for (const part of parts) {
-                        const status = evaluateToken(part, spdxIds, aliasLookup);
-                        if (status === 'PRE_APPROVED')
-                            return 'PRE_APPROVED';
-                    }
-                    if (parts.every((p) => isUnknownToken(normalise(p))))
-                        return 'UNKNOWN';
-                    return 'NOT_APPROVED';
+            if (isUnknownToken(normalised)) return 'UNKNOWN';
+            // Python tooling emits free-text license lists rather than an SPDX
+            // expression: "Apache Software License; BSD License" (setuptools
+            // classifiers) or "MIT License, Apache License, Version 2.0" (a dual
+            // license declared in one `License:` field). Both mean "any of these
+            // applies", so treat the operands as OR.
+            const isKnown = (token)=>evaluateToken(token, spdxIds, aliasLookup) === 'PRE_APPROVED';
+            for (const separator of [
+                ';',
+                ','
+            ]){
+                const parts = splitAlternatives(normalised, separator, isKnown);
+                if (!parts) continue;
+                for (const part of parts){
+                    if (evaluateToken(part, spdxIds, aliasLookup) === 'PRE_APPROVED') return 'PRE_APPROVED';
                 }
+                if (parts.every((p)=>isUnknownToken(normalise(p)))) return 'UNKNOWN';
+                return 'NOT_APPROVED';
             }
             return evaluateToken(normalised, spdxIds, aliasLookup);
-        },
+        }
     };
 };
-exports.createEvaluator = createEvaluator;
+
 //# sourceMappingURL=evaluator.js.map

package/src/license/dependency-check/evaluator.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/evaluator.ts"],"names":[],"mappings":";;;;AAAA;;;GAGG;AACH,4EAA2C;AAW3C,MAAM,cAAc,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE;IACxC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,KAAuB,EAAY,EAAE;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,IAAI,CAAC;YACH,IAAA,wBAAa,EAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,2BAA2B;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAuB,EAAqB,EAAE;IACtE,MAAM,CAAC,GAAG,IAAI,GAAG,EAAgB,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAa,EACb,OAAiB,EACjB,WAA8B,EACf,EAAE;IACjB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,gDAAgD;IAChD,IAAI,CAAC;QACH,IAAI,IAAA,wBAAa,EAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,cAAc,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,cAAc,CAAC;IAElE,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC;AAEK,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAa,EAAE;IACtE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO;QACL,QAAQ,CAAC,UAAU;YACjB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEpE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,cAAc,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEjD,sFAAsF;YACtF,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,UAAU;qBACrB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;wBACzD,IAAI,MAAM,KAAK,cAAc;4BAAE,OAAO,cAAc,CAAC;oBACvD,CAAC;oBACD,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;wBAClD,OAAO,SAAS,CAAC;oBACnB,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA/BW,QAAA,eAAe,mBA+B1B"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/evaluator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport spdxSatisfies from 'spdx-satisfies';\nimport type { AllowlistEntry, LicenseStatus } from './types.js';\n\nexport interface EvaluatorOptions {\n  allow: AllowlistEntry[];\n}\n\ninterface Evaluator {\n  evaluate(rawLicense: string | undefined | null): LicenseStatus;\n}\n\nconst isUnknownToken = (raw: string): boolean => {\n  if (!raw) return true;\n  const trimmed = raw.trim();\n  if (!trimmed) return true;\n  if (trimmed.toUpperCase() === 'UNKNOWN') return true;\n  if (trimmed.toLowerCase().startsWith('custom:')) return true;\n  if (trimmed.toLowerCase().startsWith('see license in')) return true;\n  return false;\n};\n\n/**\n * Strip the trailing `*` that license-checker adds when a license is guessed\n * from file content rather than declared in package.json metadata.\n */\nconst normalise = (raw: string): string => {\n  let s = raw.trim();\n  if (s.endsWith('*')) s = s.slice(0, -1).trim();\n  return s;\n};\n\n/**\n * Build a flat list of valid SPDX IDs from the allowlist for use with\n * spdx-satisfies. Entries that aren't parseable as SPDX identifiers are\n * excluded (they're still matched via the alias lookup).\n */\nconst buildSpdxIds = (allow: AllowlistEntry[]): string[] => {\n  const ids: string[] = [];\n  for (const entry of allow) {\n    if (!entry.spdxId) continue;\n    try {\n      spdxSatisfies(entry.spdxId, [entry.spdxId]);\n      ids.push(entry.spdxId);\n    } catch {\n      // Not a valid SPDX identifier — skip for spdx-satisfies, still\n      // matched via alias lookup\n    }\n  }\n  return ids;\n};\n\n/**\n * Build a case-insensitive lookup for matching by full name or alias\n * (for licenses that aren't valid SPDX but appear in package metadata).\n */\nconst buildAliasLookup = (allow: AllowlistEntry[]): Map<string, true> => {\n  const m = new Map<string, true>();\n  for (const e of allow) {\n    if (e.spdxId) m.set(e.spdxId.toLowerCase(), true);\n    if (e.fullName) m.set(e.fullName.toLowerCase(), true);\n    for (const a of e.aliases ?? []) {\n      if (a) m.set(a.toLowerCase(), true);\n    }\n  }\n  return m;\n};\n\n/**\n * Split a free-text license list on a separator, treating the operands as\n * alternatives (OR).\n *\n * Commas need care: several allowed license names contain one themselves (e.g.\n * \"Apache License, Version 2.0\"), so the string is left intact when it already\n * resolves as a single license, and fragments are otherwise rejoined\n * longest-match-first. That keeps \"MIT License, Apache License, Version 2.0\"\n * parsing as MIT + Apache rather than three unresolvable fragments.\n *\n * Returns `undefined` when the value shouldn't be treated as a list.\n */\nconst splitAlternatives = (\n  value: string,\n  separator: string,\n  isKnown: (token: string) => boolean,\n): string[] | undefined => {\n  if (!value.includes(separator)) return undefined;\n  if (isKnown(value)) return undefined;\n\n  const parts = value\n    .split(separator)\n    .map((p) => p.trim())\n    .filter((p) => p.length > 0);\n  if (parts.length < 2) return undefined;\n\n  // Rejoin fragments that only make sense together, so a license name\n  // containing the separator survives the split. At each position take the\n  // longest run of fragments that forms a known license; failing that, emit the\n  // single fragment and let the caller report it.\n  const merged: string[] = [];\n  let i = 0;\n  while (i < parts.length) {\n    let matchedTo = -1;\n    let candidate = parts[i];\n    for (let j = i; j < parts.length; j++) {\n      if (j > i) candidate = `${candidate}${separator} ${parts[j]}`;\n      if (isKnown(candidate)) matchedTo = j;\n    }\n    if (matchedTo >= 0) {\n      merged.push(parts.slice(i, matchedTo + 1).join(`${separator} `));\n      i = matchedTo + 1;\n    } else {\n      merged.push(parts[i]);\n      i += 1;\n    }\n  }\n\n  return merged.length > 1 ? merged : undefined;\n};\n\nconst evaluateToken = (\n  token: string,\n  spdxIds: string[],\n  aliasLookup: Map<string, true>,\n): LicenseStatus => {\n  const cleaned = normalise(token);\n  if (isUnknownToken(cleaned)) return 'UNKNOWN';\n\n  // Try spdx-satisfies for valid SPDX expressions\n  try {\n    if (spdxSatisfies(cleaned, spdxIds)) return 'PRE_APPROVED';\n  } catch {\n    // Not a valid SPDX expression — fall through to alias matching\n  }\n\n  // Fall back to alias/fullName matching for non-SPDX strings\n  if (aliasLookup.has(cleaned.toLowerCase())) return 'PRE_APPROVED';\n\n  return 'NOT_APPROVED';\n};\n\nexport const createEvaluator = (options: EvaluatorOptions): Evaluator => {\n  const spdxIds = buildSpdxIds(options.allow);\n  const aliasLookup = buildAliasLookup(options.allow);\n\n  return {\n    evaluate(rawLicense) {\n      if (!rawLicense || rawLicense.trim().length === 0) return 'UNKNOWN';\n\n      const normalised = normalise(rawLicense);\n      if (isUnknownToken(normalised)) return 'UNKNOWN';\n\n      // Python tooling emits free-text license lists rather than an SPDX\n      // expression: \"Apache Software License; BSD License\" (setuptools\n      // classifiers) or \"MIT License, Apache License, Version 2.0\" (a dual\n      // license declared in one `License:` field). Both mean \"any of these\n      // applies\", so treat the operands as OR.\n      const isKnown = (token: string) =>\n        evaluateToken(token, spdxIds, aliasLookup) === 'PRE_APPROVED';\n      for (const separator of [';', ',']) {\n        const parts = splitAlternatives(normalised, separator, isKnown);\n        if (!parts) continue;\n        for (const part of parts) {\n          if (evaluateToken(part, spdxIds, aliasLookup) === 'PRE_APPROVED')\n            return 'PRE_APPROVED';\n        }\n        if (parts.every((p) => isUnknownToken(normalise(p)))) return 'UNKNOWN';\n        return 'NOT_APPROVED';\n      }\n\n      return evaluateToken(normalised, spdxIds, aliasLookup);\n    },\n  };\n};\n"],"names":["spdxSatisfies","isUnknownToken","raw","trimmed","trim","toUpperCase","toLowerCase","startsWith","normalise","s","endsWith","slice","buildSpdxIds","allow","ids","entry","spdxId","push","buildAliasLookup","m","Map","e","set","fullName","a","aliases","splitAlternatives","value","separator","isKnown","includes","undefined","parts","split","map","p","filter","length","merged","i","matchedTo","candidate","j","join","evaluateToken","token","spdxIds","aliasLookup","cleaned","has","createEvaluator","options","evaluate","rawLicense","normalised","part","every"],"mappings":"AAAA;;;CAGC,GACD,OAAOA,mBAAmB,iBAAiB;AAW3C,MAAMC,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,MAAMC,UAAUD,IAAIE,IAAI;IACxB,IAAI,CAACD,SAAS,OAAO;IACrB,IAAIA,QAAQE,WAAW,OAAO,WAAW,OAAO;IAChD,IAAIF,QAAQG,WAAW,GAAGC,UAAU,CAAC,YAAY,OAAO;IACxD,IAAIJ,QAAQG,WAAW,GAAGC,UAAU,CAAC,mBAAmB,OAAO;IAC/D,OAAO;AACT;AAEA;;;CAGC,GACD,MAAMC,YAAY,CAACN;IACjB,IAAIO,IAAIP,IAAIE,IAAI;IAChB,IAAIK,EAAEC,QAAQ,CAAC,MAAMD,IAAIA,EAAEE,KAAK,CAAC,GAAG,CAAC,GAAGP,IAAI;IAC5C,OAAOK;AACT;AAEA;;;;CAIC,GACD,MAAMG,eAAe,CAACC;IACpB,MAAMC,MAAgB,EAAE;IACxB,KAAK,MAAMC,SAASF,MAAO;QACzB,IAAI,CAACE,MAAMC,MAAM,EAAE;QACnB,IAAI;YACFhB,cAAce,MAAMC,MAAM,EAAE;gBAACD,MAAMC,MAAM;aAAC;YAC1CF,IAAIG,IAAI,CAACF,MAAMC,MAAM;QACvB,EAAE,OAAM;QACN,+DAA+D;QAC/D,2BAA2B;QAC7B;IACF;IACA,OAAOF;AACT;AAEA;;;CAGC,GACD,MAAMI,mBAAmB,CAACL;IACxB,MAAMM,IAAI,IAAIC;IACd,KAAK,MAAMC,KAAKR,MAAO;QACrB,IAAIQ,EAAEL,MAAM,EAAEG,EAAEG,GAAG,CAACD,EAAEL,MAAM,CAACV,WAAW,IAAI;QAC5C,IAAIe,EAAEE,QAAQ,EAAEJ,EAAEG,GAAG,CAACD,EAAEE,QAAQ,CAACjB,WAAW,IAAI;QAChD,KAAK,MAAMkB,KAAKH,EAAEI,OAAO,IAAI,EAAE,CAAE;YAC/B,IAAID,GAAGL,EAAEG,GAAG,CAACE,EAAElB,WAAW,IAAI;QAChC;IACF;IACA,OAAOa;AACT;AAEA;;;;;;;;;;;CAWC,GACD,MAAMO,oBAAoB,CACxBC,OACAC,WACAC;IAEA,IAAI,CAACF,MAAMG,QAAQ,CAACF,YAAY,OAAOG;IACvC,IAAIF,QAAQF,QAAQ,OAAOI;IAE3B,MAAMC,QAAQL,MACXM,KAAK,CAACL,WACNM,GAAG,CAAC,CAACC,IAAMA,EAAE/B,IAAI,IACjBgC,MAAM,CAAC,CAACD,IAAMA,EAAEE,MAAM,GAAG;IAC5B,IAAIL,MAAMK,MAAM,GAAG,GAAG,OAAON;IAE7B,oEAAoE;IACpE,yEAAyE;IACzE,8EAA8E;IAC9E,gDAAgD;IAChD,MAAMO,SAAmB,EAAE;IAC3B,IAAIC,IAAI;IACR,MAAOA,IAAIP,MAAMK,MAAM,CAAE;QACvB,IAAIG,YAAY,CAAC;QACjB,IAAIC,YAAYT,KAAK,CAACO,EAAE;QACxB,IAAK,IAAIG,IAAIH,GAAGG,IAAIV,MAAMK,MAAM,EAAEK,IAAK;YACrC,IAAIA,IAAIH,GAAGE,YAAY,GAAGA,YAAYb,UAAU,CAAC,EAAEI,KAAK,CAACU,EAAE,EAAE;YAC7D,IAAIb,QAAQY,YAAYD,YAAYE;QACtC;QACA,IAAIF,aAAa,GAAG;YAClBF,OAAOrB,IAAI,CAACe,MAAMrB,KAAK,CAAC4B,GAAGC,YAAY,GAAGG,IAAI,CAAC,GAAGf,UAAU,CAAC,CAAC;YAC9DW,IAAIC,YAAY;QAClB,OAAO;YACLF,OAAOrB,IAAI,CAACe,KAAK,CAACO,EAAE;YACpBA,KAAK;QACP;IACF;IAEA,OAAOD,OAAOD,MAAM,GAAG,IAAIC,SAASP;AACtC;AAEA,MAAMa,gBAAgB,CACpBC,OACAC,SACAC;IAEA,MAAMC,UAAUxC,UAAUqC;IAC1B,IAAI5C,eAAe+C,UAAU,OAAO;IAEpC,gDAAgD;IAChD,IAAI;QACF,IAAIhD,cAAcgD,SAASF,UAAU,OAAO;IAC9C,EAAE,OAAM;IACN,+DAA+D;IACjE;IAEA,4DAA4D;IAC5D,IAAIC,YAAYE,GAAG,CAACD,QAAQ1C,WAAW,KAAK,OAAO;IAEnD,OAAO;AACT;AAEA,OAAO,MAAM4C,kBAAkB,CAACC;IAC9B,MAAML,UAAUlC,aAAauC,QAAQtC,KAAK;IAC1C,MAAMkC,cAAc7B,iBAAiBiC,QAAQtC,KAAK;IAElD,OAAO;QACLuC,UAASC,UAAU;YACjB,IAAI,CAACA,cAAcA,WAAWjD,IAAI,GAAGiC,MAAM,KAAK,GAAG,OAAO;YAE1D,MAAMiB,aAAa9C,UAAU6C;YAC7B,IAAIpD,eAAeqD,aAAa,OAAO;YAEvC,mEAAmE;YACnE,iEAAiE;YACjE,qEAAqE;YACrE,qEAAqE;YACrE,yCAAyC;YACzC,MAAMzB,UAAU,CAACgB,QACfD,cAAcC,OAAOC,SAASC,iBAAiB;YACjD,KAAK,MAAMnB,aAAa;gBAAC;gBAAK;aAAI,CAAE;gBAClC,MAAMI,QAAQN,kBAAkB4B,YAAY1B,WAAWC;gBACvD,IAAI,CAACG,OAAO;gBACZ,KAAK,MAAMuB,QAAQvB,MAAO;oBACxB,IAAIY,cAAcW,MAAMT,SAASC,iBAAiB,gBAChD,OAAO;gBACX;gBACA,IAAIf,MAAMwB,KAAK,CAAC,CAACrB,IAAMlC,eAAeO,UAAU2B,MAAM,OAAO;gBAC7D,OAAO;YACT;YAEA,OAAOS,cAAcU,YAAYR,SAASC;QAC5C;IACF;AACF,EAAE"}

package/src/license/dependency-check/executor.js

@@ -1,43 +1,51 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = runLicenseCheckExecutor;
 /**
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
- */
-const devkit_1 = require("@nx/devkit");
-const utils_1 = require("../../utils/config/utils");
-const check_1 = require("./check");
-const collector_1 = require("./collectors/collector");
-const loadConfig = () => {
-    const config = (0, utils_1.readAwsNxPluginConfigFromDisk)(devkit_1.workspaceRoot);
-    if (!config)
-        return null;
+ */ import { workspaceRoot } from "@nx/devkit";
+import { readAwsNxPluginConfigFromDisk } from "../../utils/config/utils.js";
+import { formatReport, runCheck } from "./check.js";
+import { npmCollector } from "./collectors/collector.js";
+const loadConfig = ()=>{
+    const config = readAwsNxPluginConfigFromDisk(workspaceRoot);
+    if (!config) return null;
     // Dependency checking is enabled by the presence of `license.dependencies`.
     return config.license?.dependencies ?? null;
 };
-async function runLicenseCheckExecutor(_options, _context) {
+export default async function runLicenseCheckExecutor(_options, _context) {
     if (process.env.LICENSE_DEPENDENCY_CHECK === 'skip') {
         console.log('License check skipped via LICENSE_DEPENDENCY_CHECK=skip environment variable.');
-        return { success: true };
+        return {
+            success: true
+        };
     }
     const config = loadConfig();
     if (!config) {
         console.log('License check skipped — not configured.');
-        return { success: true };
+        return {
+            success: true
+        };
     }
-    const collectors = config.collectors ?? [(0, collector_1.npmCollector)()];
-    const result = await (0, check_1.runCheck)({
-        projectRoot: devkit_1.workspaceRoot,
+    const collectors = config.collectors ?? [
+        npmCollector()
+    ];
+    const result = await runCheck({
+        projectRoot: workspaceRoot,
         config,
-        collectors,
+        collectors
+    });
+    const report = formatReport(result, {
+        collectors
     });
-    const report = (0, check_1.formatReport)(result, { collectors });
     if (result.pass) {
         console.log(report);
-        return { success: true };
+        return {
+            success: true
+        };
     }
     console.error(report);
-    return { success: false };
+    return {
+        success: false
+    };
 }
+
 //# sourceMappingURL=executor.js.map