@dzhechkov/harness-core 0.8.46 → 0.8.47

package/dist/retro.d.ts

@@ -1,131 +0,0 @@
-/**
- * `dz retro` — what was done over a day, a week or a month.
- *
- * This module is PURE: no filesystem, no network, and — load-bearing — no clock. The window arrives
- * as a parameter, because a window you cannot pin in a test is a window whose arithmetic errors you
- * cannot catch. MEASURED in this project 2026-08-22: an agent's timestamp was off by a YEAR, the
- * query returned 15 530 "hits" for a "week", and nothing about the output looked wrong.
- *
- * Its second job is refusing. Half of an honest report is declining to answer what the data cannot
- * support, and those refusals live here as behaviour — types that cannot express a quarter, a
- * decision function that names the real span in days, and a three-state section verdict where
- * "the source said nothing" and "the source was not read" can never collapse into one zero.
- *
- * See features/dz-retro/03_adr/ for the decisions and the measurements behind them.
- */
-/** The only horizons this project has the data for. A quarter or a year is NOT SPELLABLE (ADR-001). */
-export type RetroHorizon = 'day' | 'week' | 'month';
-/** Horizons a user may ASK for — recognised so they are refused loudly, never swallowed. */
-export type RefusedHorizon = 'quarter' | 'half-year' | 'year';
-export declare const REFUSED_HORIZONS: readonly RefusedHorizon[];
-export interface RetroWindow {
-    readonly horizon: RetroHorizon;
-    /** Inclusive ISO date (YYYY-MM-DD) of the first day in the window. */
-    readonly startIso: string;
-    /** Inclusive ISO date of the last day — the anchor. */
-    readonly endIso: string;
-    readonly days: number;
-}
-/**
- * The window for a horizon, anchored on an EXPLICIT date. Never reads the clock.
- * `atIso` may be a full timestamp; only its date part is used.
- */
-export declare function retroWindow(horizon: RetroHorizon, atIso: string): RetroWindow;
-/** Is this instant inside the window? Compared in UTC, never as strings (ADR/AM-5). */
-export declare function withinWindow(w: RetroWindow, isoInstant: string): boolean;
-export interface HorizonDecision {
-    readonly action: 'report' | 'refuse';
-    readonly reason: string;
-}
-/**
- * May we report over the requested horizon at all?
- *
- * `spanDays` is the age of the LONGEST record we actually hold. Asking for a year over 174 days of
- * data is not a thin report — it is an invented one, so it is refused and the real span is named.
- */
-export declare function decideHorizon(input: {
-    requested: string;
-    spanDays: number;
-}): HorizonDecision;
-export type SectionStatus = 'full' | 'partial' | 'unavailable';
-export interface SectionVerdict {
-    readonly status: SectionStatus;
-    /** The date this source's records begin — computed from the source itself, never hardcoded. */
-    readonly dataStart: string | null;
-    readonly note: string;
-}
-/**
- * Does this source cover the whole window?
- *
- * `dataStart: null` means the source was NOT READ — a different fact from "read, and empty".
- * Collapsing the two is how a report says "nothing happened" about a week it could not see.
- */
-export declare function sectionStatus(input: {
-    dataStart: string | null;
-    windowStart: string;
-}): SectionVerdict;
-export interface ForbiddenMetric {
-    readonly name: string;
-    /** The measurement that disqualifies it. A bare ban decays into a word list. */
-    readonly reason: string;
-}
-/**
- * Measures of the INSTRUMENT, not of the work (ADR-003). Each will be proposed again precisely
- * because each is a one-liner to compute, so each carries the measurement that refutes it.
- */
-export declare const FORBIDDEN_METRICS: readonly ForbiddenMetric[];
-export interface Delivery {
-    readonly slug: string;
-    readonly createdIso: string;
-    /** 'unique' carries a grade; 'ambiguous' and 'none' are facts about the report, not gaps. */
-    readonly gradeStatus: 'unique' | 'ambiguous' | 'none' | 'no-report';
-    readonly grade: string | null;
-}
-export interface Publish {
-    readonly pkg: string;
-    readonly version: string;
-    readonly iso: string;
-}
-export interface GuardRun {
-    readonly iso: string;
-    readonly verdict: string;
-    readonly rules: readonly string[];
-}
-export interface ReuseFacts {
-    readonly dataStart: string | null;
-    readonly eventsInWindow: number;
-    readonly lessonsEverRecalled: number;
-    readonly lessonsTotal: number;
-}
-export interface SourceFacts<T> {
-    readonly dataStart: string | null;
-    readonly items: readonly T[];
-}
-export interface RetroFacts {
-    readonly window: RetroWindow;
-    /** The longest record we hold, in days — what `decideHorizon` judges against. */
-    readonly spanDays: number;
-    /** `null` means NOT READ. An empty `items` means read-and-empty. The type keeps them apart. */
-    readonly deliveries: SourceFacts<Delivery> | null;
-    readonly publishes: SourceFacts<Publish> | null;
-    readonly guard: SourceFacts<GuardRun> | null;
-    readonly reuse: ReuseFacts | null;
-    /** Feature dirs on disk that git has never seen — the report is blind to them, and says so. */
-    readonly uncommittedSlugs: readonly string[];
-}
-export interface RetroSection {
-    readonly id: 'deliveries' | 'publishes' | 'discipline' | 'reuse';
-    readonly title: string;
-    readonly verdict: SectionVerdict;
-    readonly lines: readonly string[];
-}
-export interface RetroReport {
-    readonly window: RetroWindow;
-    readonly spanDays: number;
-    readonly sections: readonly RetroSection[];
-    readonly caveats: readonly string[];
-}
-export declare function buildRetro(facts: RetroFacts): RetroReport;
-/** The human rendering. `--json` prints the SAME `RetroReport` — one structure, two spellings (FR-6). */
-export declare function renderRetro(report: RetroReport): string[];
-//# sourceMappingURL=retro.d.ts.map

package/dist/retro.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"retro.d.ts","sourceRoot":"","sources":["../src/retro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,uGAAuG;AACvG,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAE9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAqC,CAAC;AAK5F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAO7E;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAMxE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAqB7F;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAStG;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAOvD,CAAC;AAIF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,EAAE,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC;IACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,YAAY,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAQD,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAkFzD;AAQD,yGAAyG;AACzG,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAazD"}

package/dist/retro.js

@@ -1,207 +0,0 @@
-/**
- * `dz retro` — what was done over a day, a week or a month.
- *
- * This module is PURE: no filesystem, no network, and — load-bearing — no clock. The window arrives
- * as a parameter, because a window you cannot pin in a test is a window whose arithmetic errors you
- * cannot catch. MEASURED in this project 2026-08-22: an agent's timestamp was off by a YEAR, the
- * query returned 15 530 "hits" for a "week", and nothing about the output looked wrong.
- *
- * Its second job is refusing. Half of an honest report is declining to answer what the data cannot
- * support, and those refusals live here as behaviour — types that cannot express a quarter, a
- * decision function that names the real span in days, and a three-state section verdict where
- * "the source said nothing" and "the source was not read" can never collapse into one zero.
- *
- * See features/dz-retro/03_adr/ for the decisions and the measurements behind them.
- */
-export const REFUSED_HORIZONS = ['quarter', 'half-year', 'year'];
-const HORIZON_DAYS = { day: 1, week: 7, month: 30 };
-const REFUSED_DAYS = { quarter: 90, 'half-year': 182, year: 365 };
-const DAY_MS = 86_400_000;
-function isoDay(value) {
-    return value.slice(0, 10);
-}
-/**
- * The window for a horizon, anchored on an EXPLICIT date. Never reads the clock.
- * `atIso` may be a full timestamp; only its date part is used.
- */
-export function retroWindow(horizon, atIso) {
-    const end = isoDay(atIso);
-    const endMs = Date.parse(`${end}T00:00:00.000Z`);
-    if (Number.isNaN(endMs))
-        throw new Error(`retroWindow: not an ISO date: ${JSON.stringify(atIso)}`);
-    const days = HORIZON_DAYS[horizon];
-    const startMs = endMs - (days - 1) * DAY_MS;
-    return { horizon, startIso: new Date(startMs).toISOString().slice(0, 10), endIso: end, days };
-}
-/** Is this instant inside the window? Compared in UTC, never as strings (ADR/AM-5). */
-export function withinWindow(w, isoInstant) {
-    const t = Date.parse(isoInstant);
-    if (Number.isNaN(t))
-        return false;
-    const from = Date.parse(`${w.startIso}T00:00:00.000Z`);
-    const to = Date.parse(`${w.endIso}T00:00:00.000Z`) + DAY_MS;
-    return t >= from && t < to;
-}
-/**
- * May we report over the requested horizon at all?
- *
- * `spanDays` is the age of the LONGEST record we actually hold. Asking for a year over 174 days of
- * data is not a thin report — it is an invented one, so it is refused and the real span is named.
- */
-export function decideHorizon(input) {
-    const req = input.requested.trim().toLowerCase();
-    const span = Number.isFinite(input.spanDays) ? Math.max(0, Math.floor(input.spanDays)) : 0;
-    if (req in HORIZON_DAYS) {
-        const need = HORIZON_DAYS[req];
-        if (span < need) {
-            return {
-                action: 'refuse',
-                reason: `a ${req} needs ${need} day(s) of records and we hold ${span} — reporting it would invent the difference`,
-            };
-        }
-        return { action: 'report', reason: `${req}: ${need} day(s) against ${span} day(s) of records` };
-    }
-    if (REFUSED_HORIZONS.includes(req)) {
-        const need = REFUSED_DAYS[req];
-        return {
-            action: 'refuse',
-            reason: `a ${req} needs about ${need} days of records and the longest record here spans ${span} day(s) — there is exactly one complete quarter, so a quarter-over-quarter comparison is arithmetically impossible and a year would be fabrication`,
-        };
-    }
-    return { action: 'refuse', reason: `unknown horizon ${JSON.stringify(input.requested)} — use --day, --week or --month` };
-}
-/**
- * Does this source cover the whole window?
- *
- * `dataStart: null` means the source was NOT READ — a different fact from "read, and empty".
- * Collapsing the two is how a report says "nothing happened" about a week it could not see.
- */
-export function sectionStatus(input) {
-    if (input.dataStart === null) {
-        return { status: 'unavailable', dataStart: null, note: 'source not read — this section says nothing, which is not the same as zero' };
-    }
-    const start = isoDay(input.dataStart);
-    if (start <= isoDay(input.windowStart)) {
-        return { status: 'full', dataStart: start, note: `records cover the whole window (from ${start})` };
-    }
-    return { status: 'partial', dataStart: start, note: `records only begin ${start}, inside the window — everything before that is unknown, not absent` };
-}
-/**
- * Measures of the INSTRUMENT, not of the work (ADR-003). Each will be proposed again precisely
- * because each is a one-liner to compute, so each carries the measurement that refutes it.
- */
-export const FORBIDDEN_METRICS = [
-    { name: 'commit count', reason: 'this project mandates a commit per logical change; 1318 commits over 66 active days measures compliance with that rule, not output (MEASURED 2026-08-22)' },
-    { name: 'lines changed', reason: 'generated artifacts dominate — 352 of 1318 commits are docs, and one pipeline run writes 8-10 files before a line of product code exists' },
-    { name: 'token spend', reason: 'self-declared an estimate, once wrong sixfold, covers 17 days, and 20 of 86 ledger rows carry no number by construction' },
-    { name: 'learning event volume', reason: '640 in May against 10454 in August, but the sources are post-edit and post-command hooks: the curve measures when hooks were installed' },
-    { name: 'inventory counts', reason: 'skills, packages and tests only ever grow, so they can only ever flatter' },
-    { name: 'learned lesson count', reason: 'already refuted by this project’s own dz compounding: 54% of the pool has never been read by anyone' },
-];
-function emptyOrUnavailable(v, emptyLine) {
-    return v.status === 'unavailable'
-        ? ['not read — this section cannot say anything about this window']
-        : [emptyLine];
-}
-export function buildRetro(facts) {
-    const ws = facts.window.startIso;
-    const sections = [];
-    // 1. Deliveries
-    {
-        const v = sectionStatus({ dataStart: facts.deliveries?.dataStart ?? null, windowStart: ws });
-        const items = (facts.deliveries?.items ?? []).filter((d) => withinWindow(facts.window, d.createdIso));
-        const graded = items.filter((d) => d.gradeStatus === 'unique');
-        const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous');
-        const ungraded = items.filter((d) => d.gradeStatus === 'none' || d.gradeStatus === 'no-report');
-        const lines = items.length === 0
-            ? emptyOrUnavailable(v, 'no feature directories were created in this window')
-            : [
-                `${items.length} feature director${items.length === 1 ? 'y' : 'ies'} created`,
-                `${graded.length} carry a grade an independent review stated unambiguously${graded.length > 0 ? `: ${tally(graded.map((d) => d.grade))}` : ''}`,
-                `${ambiguous.length} have a report that states MORE THAN ONE grade — reported as ambiguous, never guessed`,
-                `${ungraded.length} have no letter grade in their report, or no report at all`,
-                'cadence is not value: this counts deliveries, not what they were worth',
-            ];
-        sections.push({ id: 'deliveries', title: 'Deliveries', verdict: v, lines });
-    }
-    // 2. Publishes
-    {
-        const v = sectionStatus({ dataStart: facts.publishes?.dataStart ?? null, windowStart: ws });
-        const items = (facts.publishes?.items ?? []).filter((p) => withinWindow(facts.window, p.iso));
-        const pkgs = new Set(items.map((p) => p.pkg));
-        const lines = items.length === 0
-            ? emptyOrUnavailable(v, 'no versions were accepted by the registry in this window')
-            : [
-                `${items.length} version(s) accepted by the registry across ${pkgs.size} package(s)`,
-                'timestamps are the registry’s own — this is the one record here nobody local can backdate',
-            ];
-        sections.push({ id: 'publishes', title: 'Publishes', verdict: v, lines });
-    }
-    // 3. Discipline — DESCRIBES, never compares (ADR-004)
-    {
-        const v = sectionStatus({ dataStart: facts.guard?.dataStart ?? null, windowStart: ws });
-        const runs = (facts.guard?.items ?? []).filter((g) => withinWindow(facts.window, g.iso));
-        const byVerdict = new Map();
-        const byRule = new Map();
-        for (const r of runs) {
-            byVerdict.set(r.verdict, (byVerdict.get(r.verdict) ?? 0) + 1);
-            for (const rule of r.rules)
-                byRule.set(rule, (byRule.get(rule) ?? 0) + 1);
-        }
-        const lines = runs.length === 0
-            ? emptyOrUnavailable(v, 'no gate runs were recorded in this window')
-            : [
-                `${runs.length} gate run(s): ${[...byVerdict.entries()].map(([k, n]) => `${k} ${n}`).join(', ')}`,
-                byRule.size === 0
-                    ? 'no rule was violated in this window'
-                    : `violations by rule: ${[...byRule.entries()].sort((a, b) => b[1] - a[1]).map(([k, n]) => `${k} ${n}`).join(', ')}`,
-            ];
-        // The caveat is NOT optional and NOT conditional: it is the whole honesty of the section.
-        lines.push('a rule missing from this list was either never violated or did not yet exist — the log records a rule only when it fires, so it cannot tell those apart');
-        lines.push('this section describes the window; it deliberately computes no comparison between periods');
-        sections.push({ id: 'discipline', title: 'Discipline', verdict: v, lines });
-    }
-    // 4. Knowledge reuse
-    {
-        const v = sectionStatus({ dataStart: facts.reuse?.dataStart ?? null, windowStart: ws });
-        const r = facts.reuse;
-        const lines = r === null || r.lessonsTotal === 0
-            ? emptyOrUnavailable(v, 'no lessons are stored, so there is nothing to reuse')
-            : [
-                `${r.eventsInWindow} recall event(s) in this window`,
-                `${r.lessonsEverRecalled} of ${r.lessonsTotal} stored lessons have ever been read (${Math.round((r.lessonsEverRecalled / r.lessonsTotal) * 100)}%)`,
-                'this is a ratio with a hostile denominator: storing more unread lessons makes it worse, not better',
-            ];
-        sections.push({ id: 'reuse', title: 'Knowledge reuse', verdict: v, lines });
-    }
-    const caveats = [];
-    if (facts.uncommittedSlugs.length > 0) {
-        caveats.push(`${facts.uncommittedSlugs.length} feature director${facts.uncommittedSlugs.length === 1 ? 'y is' : 'ies are'} not committed yet and therefore invisible to this report: ${facts.uncommittedSlugs.join(', ')}`);
-    }
-    caveats.push('none of the following is computed here, and each carries the measurement that disqualifies it: ' + FORBIDDEN_METRICS.map((m) => m.name).join(', '));
-    return { window: facts.window, spanDays: facts.spanDays, sections, caveats };
-}
-function tally(values) {
-    const m = new Map();
-    for (const v of values)
-        m.set(v, (m.get(v) ?? 0) + 1);
-    return [...m.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1)).map(([k, n]) => `${k}×${n}`).join(' ');
-}
-/** The human rendering. `--json` prints the SAME `RetroReport` — one structure, two spellings (FR-6). */
-export function renderRetro(report) {
-    const out = [];
-    out.push(`dz retro — ${report.window.horizon}: ${report.window.startIso} … ${report.window.endIso} (${report.window.days} day(s))`);
-    out.push(`records held: ${report.spanDays} day(s)`);
-    for (const s of report.sections) {
-        out.push('');
-        out.push(`${s.title}  [${s.verdict.status}]${s.verdict.dataStart !== null ? ` · records from ${s.verdict.dataStart}` : ''}`);
-        out.push(`  ${s.verdict.note}`);
-        for (const l of s.lines)
-            out.push(`  · ${l}`);
-    }
-    out.push('');
-    for (const c of report.caveats)
-        out.push(`! ${c}`);
-    return out;
-}
-//# sourceMappingURL=retro.js.map

package/dist/retro.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"retro.js","sourceRoot":"","sources":["../src/retro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,MAAM,CAAC,MAAM,gBAAgB,GAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAE5F,MAAM,YAAY,GAA2C,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC5F,MAAM,YAAY,GAA6C,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAW5G,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAqB,EAAE,KAAa;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,CAAc,EAAE,UAAkB;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,MAAM,CAAC;IAC5D,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC7B,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAA8C;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAmB,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,KAAK,GAAG,UAAU,IAAI,kCAAkC,IAAI,6CAA6C;aAClH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,mBAAmB,IAAI,oBAAoB,EAAE,CAAC;IAClG,CAAC;IACD,IAAK,gBAAsC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAqB,CAAC,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,KAAK,GAAG,gBAAgB,IAAI,sDAAsD,IAAI,oJAAoJ;SACnP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,iCAAiC,EAAE,CAAC;AAC3H,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwD;IACpF,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,4EAA4E,EAAE,CAAC;IACxI,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,wCAAwC,KAAK,GAAG,EAAE,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,KAAK,qEAAqE,EAAE,CAAC;AACzJ,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,0JAA0J,EAAE;IAC5L,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,0IAA0I,EAAE;IAC7K,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,yHAAyH,EAAE;IAC1J,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,wIAAwI,EAAE;IACnL,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,0EAA0E,EAAE;IAChH,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,qGAAqG,EAAE;CAChJ,CAAC;AA+DF,SAAS,kBAAkB,CAAC,CAAiB,EAAE,SAAiB;IAC9D,OAAO,CAAC,CAAC,MAAM,KAAK,aAAa;QAC/B,CAAC,CAAC,CAAC,+DAA+D,CAAC;QACnE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,gBAAgB;IAChB,CAAC;QACC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,oDAAoD,CAAC;YAC7E,CAAC,CAAC;gBACE,GAAG,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU;gBAC7E,GAAG,MAAM,CAAC,MAAM,4DAA4D,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzJ,GAAG,SAAS,CAAC,MAAM,uFAAuF;gBAC1G,GAAG,QAAQ,CAAC,MAAM,4DAA4D;gBAC9E,wEAAwE;aACzE,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,eAAe;IACf,CAAC;QACC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,0DAA0D,CAAC;YACnF,CAAC,CAAC;gBACE,GAAG,KAAK,CAAC,MAAM,+CAA+C,IAAI,CAAC,IAAI,aAAa;gBACpF,2FAA2F;aAC5F,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,sDAAsD;IACtD,CAAC;QACC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC;YAC7B,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,2CAA2C,CAAC;YACpE,CAAC,CAAC;gBACE,GAAG,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjG,MAAM,CAAC,IAAI,KAAK,CAAC;oBACf,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACvH,CAAC;QACN,0FAA0F;QAC1F,KAAK,CAAC,IAAI,CAAC,yJAAyJ,CAAC,CAAC;QACtK,KAAK,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;QACxG,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,qBAAqB;IACrB,CAAC;QACC,MAAM,CAAC,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC;YAC9C,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,qDAAqD,CAAC;YAC9E,CAAC,CAAC;gBACE,GAAG,CAAC,CAAC,cAAc,iCAAiC;gBACpD,GAAG,CAAC,CAAC,mBAAmB,OAAO,CAAC,CAAC,YAAY,wCAAwC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,IAAI;gBACnJ,oGAAoG;aACrG,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,oBAAoB,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,8DAA8D,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9N,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,iGAAiG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAElK,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,KAAK,CAAC,MAAyB;IACtC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC;IACpI,GAAG,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,QAAQ,SAAS,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/sbom.d.ts

@@ -1,42 +0,0 @@
-export interface SbomPackage {
-    readonly SPDXID: string;
-    readonly name: string;
-    readonly versionInfo: string;
-    readonly downloadLocation: string;
-    readonly licenseConcluded: string;
-    readonly licenseDeclared: string;
-    readonly externalRefs: readonly {
-        referenceCategory: string;
-        referenceType: string;
-        referenceLocator: string;
-    }[];
-}
-export interface SpdxDocument {
-    readonly spdxVersion: 'SPDX-2.3';
-    readonly dataLicense: 'CC0-1.0';
-    readonly SPDXID: 'SPDXRef-DOCUMENT';
-    readonly name: string;
-    readonly documentNamespace: string;
-    readonly creationInfo: {
-        readonly created: string;
-        readonly creators: readonly string[];
-    };
-    readonly packages: readonly SbomPackage[];
-    readonly relationships: readonly {
-        spdxElementId: string;
-        relationshipType: string;
-        relatedSpdxElement: string;
-    }[];
-}
-/** Build an SPDX-2.3 SBOM document. Pure + deterministic (injected `created`; packages sorted by name+version). */
-export declare function buildSbom(input: {
-    name: string;
-    lock?: unknown;
-    pkg?: unknown;
-    includeDev?: boolean;
-    created: string;
-    namespace?: string;
-}): SpdxDocument;
-/** Shape check for `--validate-only`: returns the problems (empty ⇒ valid SPDX-2.3 skeleton). */
-export declare function validateSbom(doc: unknown): string[];
-//# sourceMappingURL=sbom.d.ts.map

package/dist/sbom.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../src/sbom.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC1F,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,SAAS;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpH;AA+ED,mHAAmH;AACnH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,YAAY,CAwBf;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CASnD"}

package/dist/sbom.js

@@ -1,120 +0,0 @@
-// SPDX-2.3 (Software Package Data Exchange) SBOM (Software Bill of Materials) generator for a pack.
-//
-// Ported from `agent-harness-generator/scripts/sbom.mjs` (RuvNet, MIT). Emits an SPDX-2.3 dependency inventory
-// from a `package-lock.json` (npm v1 or v2/v3), falling back to `package.json` dependency ranges when no lockfile
-// is present. PURE: operates over injected JSON + an injected `created` timestamp (no wall-clock → deterministic;
-// packages sorted by name). The CLI (`dz sbom`) reads the files and writes the output.
-/** A valid SPDXID tail is `[a-zA-Z0-9.-]+`; map `@scope/name` → `scope-name`. */
-function spdxId(name) {
-    return 'SPDXRef-Package-' + name.replace(/^@/, '').replace(/[^a-zA-Z0-9.-]+/g, '-');
-}
-/** purl (package URL) for an npm dep: scope becomes a url-encoded namespace. */
-function npmPurl(name, version) {
-    const v = version && version !== 'NOASSERTION' ? `@${version}` : '';
-    if (name.startsWith('@')) {
-        const slash = name.indexOf('/');
-        if (slash > 0) {
-            const scope = encodeURIComponent(name.slice(0, slash)); // %40scope
-            return `pkg:npm/${scope}/${name.slice(slash + 1)}${v}`;
-        }
-    }
-    return `pkg:npm/${name}${v}`;
-}
-function licenseOf(v) {
-    if (typeof v === 'string' && v.length > 0)
-        return v;
-    if (v && typeof v === 'object' && typeof v.type === 'string')
-        return v.type;
-    return 'NOASSERTION';
-}
-/** Extract deps from a lockfile (npm v2/v3 `packages` map, or v1 `dependencies` tree) or a package.json. */
-function extractDeps(input) {
-    const out = new Map();
-    const add = (name, version, license, dev) => {
-        if (!name)
-            return;
-        const key = `${name}@${version}`;
-        if (!out.has(key))
-            out.set(key, { name, version, license, dev });
-    };
-    const lock = input.lock;
-    // npm v2/v3: flat `packages` map keyed by node_modules path ("" = root, skip it).
-    if (lock && lock.packages && typeof lock.packages === 'object') {
-        for (const [path, meta] of Object.entries(lock.packages)) {
-            if (path === '' || !path.includes('node_modules/'))
-                continue;
-            const m = meta;
-            if (m.dev && !input.includeDev)
-                continue;
-            const name = path.slice(path.lastIndexOf('node_modules/') + 'node_modules/'.length);
-            add(name, typeof m.version === 'string' ? m.version : 'NOASSERTION', licenseOf(m.license), !!m.dev);
-        }
-        return [...out.values()];
-    }
-    // npm v1: nested `dependencies` tree.
-    if (lock && lock.dependencies && typeof lock.dependencies === 'object') {
-        const walk = (deps) => {
-            for (const [name, meta] of Object.entries(deps)) {
-                const m = meta;
-                if (m.dev && !input.includeDev)
-                    continue;
-                add(name, typeof m.version === 'string' ? m.version : 'NOASSERTION', licenseOf(m.license), !!m.dev);
-                if (m.dependencies)
-                    walk(m.dependencies);
-            }
-        };
-        walk(lock.dependencies);
-        return [...out.values()];
-    }
-    // fallback: package.json ranges (no resolved versions).
-    const pkg = input.pkg;
-    if (pkg) {
-        for (const [name, range] of Object.entries(pkg.dependencies ?? {}))
-            add(name, String(range), 'NOASSERTION', false);
-        if (input.includeDev)
-            for (const [name, range] of Object.entries(pkg.devDependencies ?? {}))
-                add(name, String(range), 'NOASSERTION', true);
-    }
-    return [...out.values()];
-}
-/** Build an SPDX-2.3 SBOM document. Pure + deterministic (injected `created`; packages sorted by name+version). */
-export function buildSbom(input) {
-    const deps = extractDeps({ lock: input.lock, pkg: input.pkg, includeDev: !!input.includeDev })
-        .sort((a, b) => (a.name === b.name ? (a.version < b.version ? -1 : 1) : a.name < b.name ? -1 : 1));
-    const packages = deps.map((d) => ({
-        SPDXID: spdxId(`${d.name}-${d.version}`),
-        name: d.name,
-        versionInfo: d.version,
-        downloadLocation: 'NOASSERTION',
-        licenseConcluded: d.license,
-        licenseDeclared: d.license,
-        externalRefs: [{ referenceCategory: 'PACKAGE-MANAGER', referenceType: 'purl', referenceLocator: npmPurl(d.name, d.version) }],
-    }));
-    return {
-        spdxVersion: 'SPDX-2.3',
-        dataLicense: 'CC0-1.0',
-        SPDXID: 'SPDXRef-DOCUMENT',
-        name: `${input.name}-sbom`,
-        documentNamespace: input.namespace ?? `urn:dz:sbom:${input.name.replace(/^@/, '').replace(/[^a-zA-Z0-9.-]+/g, '-')}`,
-        creationInfo: { created: input.created, creators: ['Tool: dz-sbom'] },
-        packages,
-        relationships: packages.map((p) => ({ spdxElementId: 'SPDXRef-DOCUMENT', relationshipType: 'DESCRIBES', relatedSpdxElement: p.SPDXID })),
-    };
-}
-/** Shape check for `--validate-only`: returns the problems (empty ⇒ valid SPDX-2.3 skeleton). */
-export function validateSbom(doc) {
-    const problems = [];
-    const d = doc;
-    if (!d || typeof d !== 'object')
-        return ['not an object'];
-    if (d.spdxVersion !== 'SPDX-2.3')
-        problems.push('spdxVersion must be SPDX-2.3');
-    if (d.SPDXID !== 'SPDXRef-DOCUMENT')
-        problems.push('SPDXID must be SPDXRef-DOCUMENT');
-    if (!Array.isArray(d.packages))
-        problems.push('packages must be an array');
-    if (!d.creationInfo || typeof d.creationInfo.created !== 'string')
-        problems.push('creationInfo.created missing');
-    return problems;
-}
-//# sourceMappingURL=sbom.js.map

package/dist/sbom.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../src/sbom.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,+GAA+G;AAC/G,kHAAkH;AAClH,kHAAkH;AAClH,uFAAuF;AA8BvF,iFAAiF;AACjF,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,MAAM,CAAC,GAAG,OAAO,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW;YACnE,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,CAAsB,CAAC,IAAI,CAAC;IAC1H,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,KAA6D;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAkG,CAAC;IAEtH,kFAAkF;IAClF,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YAC7D,MAAM,CAAC,GAAG,IAAkF,CAAC;YAC7F,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;gBAAE,SAAS;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpF,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,IAAsG,CAAC;gBACjH,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;oBAAE,SAAS;gBACzC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpG,IAAI,CAAC,CAAC,YAAY;oBAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAuC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAsG,CAAC;IACzH,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACnH,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7I,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,SAAS,CAAC,KAOzB;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;SAC3F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,MAAM,QAAQ,GAAkB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO;QACtB,gBAAgB,EAAE,aAAa;QAC/B,gBAAgB,EAAE,CAAC,CAAC,OAAO;QAC3B,eAAe,EAAE,CAAC,CAAC,OAAO;QAC1B,YAAY,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9H,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO;QAC1B,iBAAiB,EAAE,KAAK,CAAC,SAAS,IAAI,eAAe,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE;QACpH,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE;QACrE,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACzI,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAAE,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjH,OAAO,QAAQ,CAAC;AAClB,CAAC"}