@cosmicdrift/kumiko-guards 0.362.0 → 0.364.0

package/src/check-outdated.ts

@@ -0,0 +1,234 @@
+// Deprecated-dependency check over ONE repo.
+//
+// Default: fails on any installed direct dependency whose npm registry metadata marks the
+// installed version `deprecated`. General outdated listing is Renovate's job; `--report`
+// adds deprecated transitive packages and a major-lag warning list (never blocking).
+// Single-repo by design: declared dependencies are the scanned repo's root and workspace
+// members; installed packages come from node_modules of the repo, its members and ancestors.
+import { parseDependencyCli } from "./_lib/dependency-cli";
+import {
+  collectDeclaredSpecsByName,
+  collectDirectDependencies,
+  collectRootOverrides,
+} from "./_lib/direct-dependencies";
+import { collectInstalledPackages, type InstalledPackage } from "./_lib/installed-packages";
+import {
+  createBunInfoClient,
+  findMajorLagWarning,
+  mapWithConcurrency,
+  memoizeRegistryClient,
+  type RegistryClient,
+} from "./_lib/npm-registry";
+
+const REGISTRY_CONCURRENCY = 10;
+
+type NameAndVersion = { readonly name: string; readonly version: string };
+
+export type DeprecatedPackage = NameAndVersion & { readonly message: string };
+
+export type UnresolvedPackage = NameAndVersion & { readonly reason: string };
+
+export type DeprecationScan = {
+  readonly deprecated: DeprecatedPackage[];
+  readonly unresolved: UnresolvedPackage[];
+};
+
+export async function findDeprecatedPackages(
+  packages: readonly NameAndVersion[],
+  registry: RegistryClient,
+): Promise<DeprecationScan> {
+  const unique = [...new Map(packages.map((pkg) => [`${pkg.name}@${pkg.version}`, pkg])).values()];
+  const lookups = await mapWithConcurrency(unique, REGISTRY_CONCURRENCY, async (pkg) => ({
+    pkg,
+    lookup: await registry.deprecation(pkg.name, pkg.version),
+  }));
+  const deprecated: DeprecatedPackage[] = [];
+  const unresolved: UnresolvedPackage[] = [];
+  for (const { pkg, lookup } of lookups) {
+    if (lookup.kind === "deprecated") deprecated.push({ ...pkg, message: lookup.message });
+    else if (lookup.kind === "unknown") unresolved.push({ ...pkg, reason: lookup.reason });
+  }
+  return { deprecated, unresolved };
+}
+
+function printUnresolved(
+  scope: string,
+  unresolved: readonly UnresolvedPackage[],
+  total: number,
+): void {
+  console.error(
+    `\n  WARNING: deprecation status UNKNOWN for ${unresolved.length} of ${total} ${scope} — the registry did not answer, so these were NOT checked (re-run once the registry is reachable):`,
+  );
+  for (const pkg of unresolved.slice(0, 10)) {
+    console.error(`    ${pkg.name}@${pkg.version}  — ${pkg.reason}`);
+  }
+  if (unresolved.length > 10) console.error(`    … and ${unresolved.length - 10} more`);
+}
+
+// A spec that is not a plain semver range (workspace:, catalog:, a git URL, "latest") has nothing to compare against; matching it by name alone can only over-report, never hide a deprecated package.
+function isComparableRange(spec: string): boolean {
+  return /^[\d~^><=]/.test(spec.trim());
+}
+
+export function isDeclaredInstall(installedVersion: string, declaredSpec: string): boolean {
+  if (!isComparableRange(declaredSpec)) return true;
+  return Bun.semver.satisfies(installedVersion, declaredSpec);
+}
+
+export function selectDirectInstalledPackages<T extends NameAndVersion>(
+  installed: readonly T[],
+  declaredSpecs: ReadonlyMap<string, readonly string[]>,
+  overrides: ReadonlyMap<string, string> = new Map(),
+): T[] {
+  const byName = new Map<string, T[]>();
+  for (const pkg of installed) {
+    if (!declaredSpecs.has(pkg.name)) continue;
+    const group = byName.get(pkg.name);
+    if (group) group.push(pkg);
+    else byName.set(pkg.name, [pkg]);
+  }
+
+  const keep = new Set<T>();
+  for (const [name, group] of byName) {
+    const specs = declaredSpecs.get(name) ?? [];
+    const matching = group.filter((pkg) =>
+      specs.some((spec) => isDeclaredInstall(pkg.version, spec)),
+    );
+    if (matching.length > 0) {
+      for (const pkg of matching) keep.add(pkg);
+      continue;
+    }
+    // A root `overrides` block can pin a direct dependency outside its declared range; keep the instances matching the pin, or all of them (fail-safe) if there is no pin or nothing satisfies it.
+    const override = overrides.get(name);
+    const pinned =
+      override === undefined ? [] : group.filter((pkg) => isDeclaredInstall(pkg.version, override));
+    for (const pkg of pinned.length > 0 ? pinned : group) keep.add(pkg);
+  }
+
+  return installed.filter((pkg) => keep.has(pkg));
+}
+
+async function printMajorLagReport(
+  repoRoot: string,
+  registry: RegistryClient,
+  nowMs: number,
+): Promise<void> {
+  const direct = collectDirectDependencies(repoRoot);
+  console.log(`\n  Major-lag report (${direct.length} direct dependencies):`);
+
+  const warnings = await mapWithConcurrency(direct, REGISTRY_CONCURRENCY, async (dep) => {
+    const release = await registry.latestRelease(dep.name);
+    if (!release) return null;
+    const current = dep.version.replace(/^[\^~>=<]+/, "");
+    return findMajorLagWarning(dep.name, current, release, 12, nowMs);
+  });
+
+  const hits = warnings.filter((w) => w !== null);
+  if (hits.length === 0) {
+    console.log("    No direct dependencies with major lag >12 months.");
+  } else {
+    console.log("\n  WARN: major version lag >12 months (not blocking):");
+    for (const hit of hits) {
+      console.log(
+        `    ${hit.name}  ${hit.current} → latest ${hit.latest} (since ${hit.latestPublished})`,
+      );
+    }
+  }
+}
+
+/** Prints the direct-dependency verdict; returns true when it must fail the run. */
+function reportDirectScan(scan: DeprecationScan, directChecked: number): boolean {
+  if (scan.deprecated.length > 0) {
+    console.error("\n  DEPRECATED direct dependencies (blocking):\n");
+    for (const dep of scan.deprecated) {
+      console.error(`    ${dep.name}@${dep.version}  — ${dep.message}`);
+    }
+    console.error(
+      "\n  Replace each deprecated package or upgrade to a version that is not deprecated.",
+    );
+  } else if (scan.unresolved.length === 0) {
+    console.log("  No deprecated direct dependencies found.");
+  }
+  if (scan.unresolved.length > 0) {
+    printUnresolved("direct dependencies", scan.unresolved, directChecked);
+  }
+  // Partial registry gaps stay a warning (npm answers 503 under load); a run that checked nothing must not pass.
+  const nothingChecked = directChecked > 0 && scan.unresolved.length === directChecked;
+  if (nothingChecked) {
+    console.error(
+      "  outdated: nothing checked — no direct dependency got a registry answer. Re-run once the registry is reachable.",
+    );
+  }
+  return scan.deprecated.length > 0 || nothingChecked;
+}
+
+async function printTransitiveReport(
+  installed: readonly InstalledPackage[],
+  directScan: DeprecationScan,
+  registry: RegistryClient,
+): Promise<void> {
+  const allScan = await findDeprecatedPackages(installed, registry);
+  if (allScan.unresolved.length > directScan.unresolved.length) {
+    printUnresolved("installed packages", allScan.unresolved, countUnique(installed));
+  }
+  const transitive = allScan.deprecated.filter(
+    (dep) => !directScan.deprecated.some((d) => d.name === dep.name && d.version === dep.version),
+  );
+  if (transitive.length > 0) {
+    console.log(`\n  WARN: ${transitive.length} deprecated transitive package(s) (Renovate):`);
+    for (const dep of transitive.slice(0, 15)) {
+      console.log(`    ${dep.name}@${dep.version}  — ${dep.message}`);
+    }
+    if (transitive.length > 15) console.log(`    … and ${transitive.length - 15} more`);
+  }
+}
+
+export async function runOutdatedCheck(options: {
+  readonly repoRoot: string;
+  readonly reportMode: boolean;
+  readonly installed?: readonly InstalledPackage[];
+  readonly registry?: RegistryClient;
+  readonly nowMs?: number;
+}): Promise<number> {
+  const installed = options.installed ?? collectInstalledPackages(options.repoRoot);
+  if (installed.length === 0) {
+    console.error(
+      `  outdated: nothing scanned — no installed packages found for ${options.repoRoot} (run \`bun install\`).`,
+    );
+    return 1;
+  }
+  const registry = memoizeRegistryClient(options.registry ?? createBunInfoClient(options.repoRoot));
+  const directInstalled = selectDirectInstalledPackages(
+    installed,
+    collectDeclaredSpecsByName(options.repoRoot),
+    collectRootOverrides(options.repoRoot),
+  );
+
+  console.log(
+    `Outdated check: ${directInstalled.length} direct dependencies (${installed.length} installed total).`,
+  );
+
+  const directScan = await findDeprecatedPackages(directInstalled, registry);
+  const blocking = reportDirectScan(directScan, countUnique(directInstalled));
+
+  if (options.reportMode) {
+    await printTransitiveReport(installed, directScan, registry);
+    await printMajorLagReport(options.repoRoot, registry, options.nowMs ?? Date.now());
+  }
+
+  return blocking ? 1 : 0;
+}
+
+function countUnique(packages: readonly NameAndVersion[]): number {
+  return new Set(packages.map((pkg) => `${pkg.name}@${pkg.version}`)).size;
+}
+
+export async function runOutdatedCli(
+  argv: readonly string[],
+  cwd: string = process.cwd(),
+): Promise<number> {
+  const invocation = parseDependencyCli("outdated", argv, cwd);
+  if (!invocation.ok) return invocation.exitCode;
+  // Unlike licenses/security, `--report` only adds sections: a deprecated direct dependency still exits 1.
+  return runOutdatedCheck({ repoRoot: invocation.repoRoot, reportMode: invocation.reportOnly });
+}

package/src/check-runtime-isolation.ts

@@ -221,7 +221,9 @@ if (import.meta.main) {
   if (args.includes("--write-baseline")) {
     const root = resolveRepoRoots()[0];
     if (!root) {
-      console.error("No repo root resolved — nothing to baseline.");
+      console.error(
+        "No repo root resolved — nothing to baseline. Run it from inside a repo checkout.",
+      );
       process.exit(1);
     }
     const { allViolations } = scanRoot(root);

package/src/check-security.ts

@@ -0,0 +1,182 @@
+// Security check: `bun audit` over the lockfile of ONE repo.
+//
+// Single-repo by design: audits the bun.lock in the scanned repo's root. A repo without its
+// own bun.lock falls back to the nearest ancestor's (a parent workspace), announced loudly.
+// Critical/high advisories block unless covered by a short-lived exception; so does any
+// exception expiring within EXPIRY_BLOCK_DAYS. Exceptions merge the bundled
+// dependency-security-exceptions.json with an optional file of the same name in the repo root
+// (and in the ancestor holding the lockfile, when that is not the repo root).
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parseDependencyCli } from "./_lib/dependency-cli";
+import { expiryEndMs, findExpiringSoon, loadExceptionEntries } from "./_lib/dependency-exceptions";
+import {
+  type AuditAdvisory,
+  evaluateSecurity,
+  parseAuditReport,
+  type RawAuditReport,
+  runBunAudit,
+  type SecurityEvaluation,
+  type SecurityException,
+} from "./_lib/security-audit";
+
+export const SECURITY_EXCEPTIONS_FILE = "dependency-security-exceptions.json";
+
+// Block a PR while there is still runway to act, not on the day the advisory re-blocks;
+// the 30-day console warning is invisible in green CI logs.
+export const EXPIRY_BLOCK_DAYS = 14;
+
+export function loadSecurityExceptions(
+  roots: readonly string[],
+  bundledDir?: string,
+): SecurityException[] {
+  return loadExceptionEntries({
+    filename: SECURITY_EXCEPTIONS_FILE,
+    roots,
+    bundledDir,
+    parse: (field) => ({
+      advisory: field("advisory"),
+      package: field("package"),
+      reason: field("reason"),
+      reviewedBy: field("reviewedBy"),
+      expires: field("expires"),
+    }),
+  }).filter((exception) => {
+    const hasDate = expiryEndMs(exception.expires) !== undefined;
+    if (!hasDate) {
+      console.warn(
+        `  WARN: security exception ${exception.advisory} dropped, expires "${exception.expires}" is not a YYYY-MM-DD date. Set expires to a date like 2026-12-31.`,
+      );
+    }
+    return hasDate;
+  });
+}
+
+/** Directory whose bun.lock `bun audit` runs against: the repo root, else the nearest ancestor with one. */
+export function findLockfileDir(repoRoot: string): string | undefined {
+  for (let dir = repoRoot; ; dir = dirname(dir)) {
+    if (existsSync(join(dir, "bun.lock"))) return dir;
+    if (dirname(dir) === dir) return undefined;
+  }
+}
+
+export function shouldBlock(
+  evaluation: Pick<SecurityEvaluation, "blocking">,
+  expiringUrgent: readonly SecurityException[],
+): boolean {
+  return evaluation.blocking.length > 0 || expiringUrgent.length > 0;
+}
+
+function printReport(
+  evaluation: SecurityEvaluation,
+  exceptions: readonly SecurityException[],
+  expiringUrgent: readonly SecurityException[],
+  nowMs: number,
+): void {
+  const { counts, blocking, warnings, suppressed } = evaluation;
+  const total = counts.critical + counts.high + counts.moderate + counts.low + counts.info;
+  console.log(
+    `  ${total} advisories — critical: ${counts.critical}  high: ${counts.high}  moderate: ${counts.moderate}  low: ${counts.low}`,
+  );
+
+  if (blocking.length > 0) {
+    console.error("\n  BLOCKING vulnerabilities:\n");
+    for (const adv of blocking) {
+      console.error(
+        `    [${adv.severity.toUpperCase()}]  ${adv.package}  ${adv.advisoryId}  ${adv.title}`,
+      );
+    }
+  }
+
+  if (warnings.length > 0) {
+    console.log("\n  WARN (moderate, not blocking):");
+    for (const adv of warnings) {
+      console.log(`    [MODERATE]  ${adv.package}  ${adv.advisoryId}  ${adv.title}`);
+    }
+  }
+
+  if (suppressed.length > 0) {
+    console.log(`\n  Suppressed via exception (${suppressed.length}):`);
+    for (const adv of suppressed.slice(0, 10)) {
+      console.log(`    [${adv.severity}]  ${adv.package}  ${adv.advisoryId}`);
+    }
+    if (suppressed.length > 10) console.log(`    … and ${suppressed.length - 10} more`);
+  }
+
+  if (expiringUrgent.length > 0) {
+    console.error(
+      `\n  BLOCKING: security exceptions expire within ${EXPIRY_BLOCK_DAYS} days — bump the dependency or re-review the exception now:`,
+    );
+    for (const ex of expiringUrgent) {
+      console.error(`    ${ex.package}  ${ex.advisory}  expires=${ex.expires}`);
+    }
+  }
+
+  const urgentKeys = new Set(expiringUrgent.map((ex) => `${ex.package}|${ex.advisory}`));
+  const expiringSoon = findExpiringSoon(exceptions, 30, nowMs).filter(
+    (ex) => !urgentKeys.has(`${ex.package}|${ex.advisory}`),
+  );
+  if (expiringSoon.length > 0) {
+    console.log("\n  WARN: security exceptions expire within 30 days — re-review:");
+    for (const ex of expiringSoon) {
+      console.log(`    ${ex.package}  ${ex.advisory}  expires=${ex.expires}`);
+    }
+  }
+
+  if (shouldBlock(evaluation, expiringUrgent)) {
+    console.error(
+      `\n  Fix dependencies or add short-lived exceptions in ${SECURITY_EXCEPTIONS_FILE} in the repo root\n`,
+    );
+  }
+}
+
+export async function runSecurityCheck(options: {
+  readonly repoRoot: string;
+  readonly reportOnly: boolean;
+  readonly runAudit?: (lockfileDir: string) => Promise<RawAuditReport>;
+  readonly exceptions?: readonly SecurityException[];
+  readonly nowMs?: number;
+}): Promise<number> {
+  const nowMs = options.nowMs ?? Date.now();
+  const lockfileDir = findLockfileDir(options.repoRoot);
+  if (lockfileDir === undefined) {
+    console.error(
+      `  security: no bun.lock found in ${options.repoRoot} or any ancestor — nothing to audit. Run bun install to create bun.lock.`,
+    );
+    return 1;
+  }
+  if (lockfileDir !== options.repoRoot) {
+    console.warn(
+      `  WARN: ${options.repoRoot} has no bun.lock — auditing ${lockfileDir}/bun.lock instead (it may cover more than this repo).`,
+    );
+  }
+
+  const exceptions = options.exceptions ?? loadSecurityExceptions([options.repoRoot, lockfileDir]);
+  console.log(`Security audit: scanning ${lockfileDir} …`);
+  const raw = await (options.runAudit ?? runBunAudit)(lockfileDir);
+  const advisories: AuditAdvisory[] = parseAuditReport(raw);
+
+  const evaluation = evaluateSecurity(advisories, exceptions, nowMs);
+  const expiringUrgent = findExpiringSoon(exceptions, EXPIRY_BLOCK_DAYS, nowMs);
+  printReport(evaluation, exceptions, expiringUrgent, nowMs);
+
+  if (options.reportOnly) return 0;
+  return shouldBlock(evaluation, expiringUrgent) ? 1 : 0;
+}
+
+export async function runSecurityCli(
+  argv: readonly string[],
+  cwd: string = process.cwd(),
+): Promise<number> {
+  const invocation = parseDependencyCli("security", argv, cwd);
+  if (!invocation.ok) return invocation.exitCode;
+  try {
+    return await runSecurityCheck({
+      repoRoot: invocation.repoRoot,
+      reportOnly: invocation.reportOnly,
+    });
+  } catch (err) {
+    console.error("Security check failed:", err);
+    return 1;
+  }
+}

package/src/check-single-runtime-instance.ts

@@ -37,9 +37,15 @@ function readRuntimeMarker(rootAbsPath: string, packageName: string): string | u
     const pkgPath = join(dir, "node_modules", packageName, "package.json");
     if (existsSync(pkgPath)) {
       try {
-        const marker = (
-          JSON.parse(readFileSync(pkgPath, "utf8")) as { kumiko?: { runtime?: unknown } }
-        ).kumiko?.runtime; // @cast-boundary package-json
+        const manifest: unknown = JSON.parse(readFileSync(pkgPath, "utf8"));
+        const kumikoBlock =
+          typeof manifest === "object" && manifest !== null && "kumiko" in manifest
+            ? manifest.kumiko
+            : undefined;
+        const marker =
+          typeof kumikoBlock === "object" && kumikoBlock !== null && "runtime" in kumikoBlock
+            ? kumikoBlock.runtime
+            : undefined;
         return typeof marker === "string" && ALL_RUNTIMES.has(marker) ? marker : undefined;
       } catch {
         return undefined;
@@ -103,7 +109,7 @@ export const check: RepoCheck = {
         violations.push({
           file: "bun.lock",
           line: 1,
-          message: `bun.lock could not be parsed (${root.name}): ${lock.detail}`,
+          message: `bun.lock could not be parsed (${root.name}): ${lock.detail}. Regenerate bun.lock with bun install.`,
         });
         continue;
       }

package/src/cli.ts

@@ -4,7 +4,11 @@
 // runners already use in their own `if (import.meta.main)` blocks — including
 // flags, which each runner's own *Cli function validates and applies so this
 // bin and the direct `bun run-*.ts` invocation can never drift apart.
+import { DEPENDENCY_CHECK_FLAGS } from "./_lib/dependency-cli";
 import { buildGuardKitInventory, cliFlagsError } from "./_lib/guard-kit";
+import { runLicensesCli } from "./check-licenses";
+import { runOutdatedCli } from "./check-outdated";
+import { runSecurityCli } from "./check-security";
 import { COMMENT_LANG_FLAGS, runCommentLangCli } from "./guard-comment-lang";
 import {
   PUBLIC_EXPORTS_CHANGELOG_FLAGS,
@@ -20,6 +24,9 @@ const SUBCOMMANDS = [
   "checks",
   "comment-lang",
   "public-exports-changelog",
+  "licenses",
+  "security",
+  "outdated",
   "list",
 ] as const;
 type Subcommand = (typeof SUBCOMMANDS)[number];
@@ -30,16 +37,19 @@ const SUBCOMMAND_FLAGS: Record<Subcommand, readonly string[]> = {
   checks: REPO_CHECK_FLAGS,
   "comment-lang": [...COMMENT_LANG_FLAGS, "--base=<ref>"],
   "public-exports-changelog": PUBLIC_EXPORTS_CHANGELOG_FLAGS,
+  licenses: DEPENDENCY_CHECK_FLAGS,
+  security: DEPENDENCY_CHECK_FLAGS,
+  outdated: DEPENDENCY_CHECK_FLAGS,
   list: [],
 };
 
 function isSubcommand(value: string): value is Subcommand {
-  return (SUBCOMMANDS as readonly string[]).includes(value);
+  return SUBCOMMANDS.some((subcommand) => subcommand === value);
 }
 
 function printHelp(): void {
   console.log(
-    "Usage: kumiko-guards [guards|ui|checks|comment-lang|public-exports-changelog|list] [flags]",
+    "Usage: kumiko-guards [guards|ui|checks|comment-lang|public-exports-changelog|licenses|security|outdated|list] [flags]",
   );
   console.log();
   for (const sub of SUBCOMMANDS) {
@@ -91,6 +101,17 @@ function printInventory(flags: readonly string[]): void {
   console.log(JSON.stringify(inventory));
 }
 
+const STANDALONE_SUBCOMMANDS: Record<
+  string,
+  (flags: readonly string[]) => number | Promise<number>
+> = {
+  "comment-lang": runCommentLangCli,
+  "public-exports-changelog": runPublicExportsChangelogCli,
+  licenses: (flags) => runLicensesCli(flags),
+  security: (flags) => runSecurityCli(flags),
+  outdated: (flags) => runOutdatedCli(flags),
+};
+
 async function main(): Promise<void> {
   const { subcommand, flags } = parseInvocation(process.argv);
 
@@ -101,14 +122,10 @@ async function main(): Promise<void> {
   }
 
   // Not part of the no-subcommand run: comment-lang needs a baseline or a git base ref,
-  // public-exports-changelog only applies to the kumiko-framework repo.
-  if (subcommand === "comment-lang") {
-    process.exit(runCommentLangCli(flags));
-  }
-
-  if (subcommand === "public-exports-changelog") {
-    process.exit(await runPublicExportsChangelogCli(flags));
-  }
+  // public-exports-changelog only applies to the kumiko-framework repo, and
+  // licenses/security/outdated call the npm registry or `bun audit` (network).
+  const standalone = subcommand === undefined ? undefined : STANDALONE_SUBCOMMANDS[subcommand];
+  if (standalone) process.exit(await standalone(flags));
 
   let failed = 0;
   if (subcommand === undefined || subcommand === "guards") {

package/src/dependency-license-exceptions.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "Exceptions for check-licenses.ts. Each exception needs a reason, a reviewer and an expiry date.",
+  "exceptions": [
+    {
+      "package": "lightningcss",
+      "version": "*",
+      "license": "MPL-2.0",
+      "reason": "Transitive Dependency via Expo/Metro CSS-Tooling. MPL-2.0 ist file-level Copyleft — betrifft nur Modifikationen an lightningcss selbst, nicht unseren Code. Nur als Dependency genutzt, nicht modifiziert.",
+      "reviewedBy": "Marc, 2026-04-15",
+      "expires": "2027-04-15"
+    },
+    {
+      "package": "lightningcss-*",
+      "version": "*",
+      "license": "MPL-2.0",
+      "reason": "Platform-Binaries zu lightningcss (darwin-arm64/darwin-x64/linux-x64-gnu/linux-x64-musl/linux-arm64-gnu/linux-arm64-musl/linux-arm-gnueabihf/android-arm64/freebsd-x64/win32-x64-msvc/win32-arm64-msvc). Wildcard-Match — neue Plattform-Binary kommt automatisch durch ohne weiteren Eintrag.",
+      "reviewedBy": "Marc, 2026-04-26",
+      "expires": "2027-04-26"
+    },
+    {
+      "package": "spdx-exceptions",
+      "version": "*",
+      "license": "CC-BY-3.0",
+      "reason": "Transitive Dep via SPDX-License-Tooling selbst. CC-BY-3.0 deckt nur die SPDX-Exception-Daten (eine Liste von License-IDs), keine Code-Verteilung — wir nutzen das Package nur zur Laufzeit für Dep-Scanning, kein Re-Distribute.",
+      "reviewedBy": "Marc, 2026-05-01",
+      "expires": "2027-05-01"
+    },
+    {
+      "package": "@logdna/tail-file",
+      "version": "*",
+      "license": "SEE LICENSE IN LICENSE",
+      "reason": "License-File ist im Package selbst (LICENSE), npm-metadata zeigt nur den Pointer. Apache-2.0 ist die echte Lizenz (siehe node_modules/@logdna/tail-file/LICENSE). Transitive Dep.",
+      "reviewedBy": "Marc, 2026-05-01",
+      "expires": "2027-05-01"
+    },
+    {
+      "package": "spawndamnit",
+      "version": "*",
+      "license": "SEE LICENSE IN LICENSE",
+      "reason": "Transitive Dep via @changesets/cli. License-File im Package: MIT (Copyright James Kyle, Mitautor von Changesets). npm-metadata zeigt nur den Pointer. Pattern wie @logdna/tail-file.",
+      "reviewedBy": "Marc, 2026-05-06",
+      "expires": "2027-05-06"
+    },
+    {
+      "package": "@cosmicdriftgamestudio/*",
+      "version": "*",
+      "license": "UNLICENSED",
+      "reason": "Eigene private CDGS-Workspace-Packages (kumiko-guards, später kumiko-ai-*, kumiko-designer etc.). UNLICENSED = proprietary, kein Public-License-Risk weil intern in der Org bleibt (GH-Packages access:restricted).",
+      "reviewedBy": "Marc, 2026-05-06",
+      "expires": "2030-05-06"
+    },
+    {
+      "package": "@cosmicdrift/*",
+      "version": "*",
+      "license": "BUSL-1.1",
+      "reason": "Eigene Public-Workspace-Packages (kumiko-framework + 6 weitere). Wir sind der Licensor — BUSL-1.1 ist unser eigener Lizenz-Choice für die public NPM-Pakete. Der License-Check denied BUSL-1.1 als generic-Pattern (für Third-Party-Deps korrekt), aber für eigene Packages ist's der designierte Lizenz.",
+      "reviewedBy": "Marc, 2026-05-06",
+      "expires": "2030-05-06"
+    },
+    {
+      "package": "create-kumiko-app",
+      "version": "*",
+      "license": "BUSL-1.1",
+      "reason": "Unscoped Workspace-Paket — `bun create kumiko-app` resolved zu `bunx create-kumiko-app`, daher KEIN @cosmicdrift/-Scope möglich. Analog zur @cosmicdrift/*-Exception unser eigener Lizenz-Choice; eigene Eintrag weil Wildcard-Pattern unscoped Pakete nicht matched.",
+      "reviewedBy": "Marc, 2026-06-21",
+      "expires": "2030-06-21"
+    },
+    {
+      "package": "khroma",
+      "version": "*",
+      "license": "MIT",
+      "reason": "Transitive dep via mermaid (docs). npm metadata reports license=null; package LICENSE is MIT.",
+      "reviewedBy": "Marc, 2026-07-06",
+      "expires": "2027-07-06"
+    }
+  ]
+}

package/src/dependency-security-exceptions.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "Exceptions file for check-security.ts. Each exception needs reason, reviewer, and expiry (max ~30 days).",
+  "exceptions": []
+}

package/src/guard-admin-api.ts

@@ -20,7 +20,7 @@
  */
 
 import * as path from "node:path";
-import { type CallExpression, type Identifier, type SourceFile, SyntaxKind } from "ts-morph";
+import { type CallExpression, type SourceFile, SyntaxKind } from "ts-morph";
 import { findRepoRootFor } from "./_lib/baseline-compare";
 import { ALL_REPO_KINDS, type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
@@ -84,8 +84,8 @@ function isAllowed(relativePath: string): boolean {
 // references to the known function names.
 function getCalleeName(call: CallExpression): string | null {
   const expr = call.getExpression();
-  if (expr.getKind() === SyntaxKind.Identifier) {
-    return (expr as Identifier).getText();
+  if (expr.isKind(SyntaxKind.Identifier)) {
+    return expr.getText();
   }
   if (expr.getKind() === SyntaxKind.PropertyAccessExpression) {
     const name = expr.asKindOrThrow(SyntaxKind.PropertyAccessExpression).getName();