@keithadler/frostjs 0.1.0

package/dist/report/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/report/github.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAoC,KAAK,MAAM,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAW5F,+FAA+F;AAC/F,wBAAgB,MAAM,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CAsBrG"}

package/dist/report/github.js

@@ -0,0 +1,31 @@
+import { denialMessage, describeUse, text } from "./text.js";
+/** Escape a message per the workflow-command rules: % first, then newlines. */
+function escapeData(s) {
+    return s.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+/** Escape a property value: as a message, plus colons and commas. */
+function escapeProperty(s) {
+    return escapeData(s).replace(/:/g, "%3A").replace(/,/g, "%2C");
+}
+/** `--format github`: one workflow command per denial or unknown use, then the text report. */
+export function github(decisions, totals, opts = {}) {
+    const lines = [];
+    for (const d of decisions) {
+        if (d.verdict !== "denied" && d.verdict !== "unknown")
+            continue;
+        const { use } = d;
+        const subject = describeUse(use.capability, use.target);
+        const kind = d.verdict === "denied" ? "error" : "warning";
+        const title = d.verdict === "denied" ? `frostjs: ${use.capability} denied` : `frostjs: ${use.capability} ${use.confidence}`;
+        const message = d.verdict === "denied"
+            ? denialMessage(d)
+            : `${subject} ${use.confidence} (not failing the build): ${use.expression}`;
+        lines.push(`::${kind} file=${escapeProperty(use.file)},line=${use.line},col=${use.column},title=${escapeProperty(title)}::${escapeData(message)}`);
+    }
+    for (const w of opts.warnings ?? []) {
+        lines.push(`::warning title=${escapeProperty("frostjs: grant expiring")}::${escapeData(w)}`);
+    }
+    const body = lines.length ? lines.join("\n") + "\n" : "";
+    return body + text(decisions, totals, opts);
+}
+//# sourceMappingURL=github.js.map

package/dist/report/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/report/github.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAiC,MAAM,WAAW,CAAC;AAE5F,+EAA+E;AAC/E,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AACD,qEAAqE;AACrE,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,MAAM,CAAC,SAA8B,EAAE,MAAc,EAAE,OAAoB,EAAE;IAC3F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,MAAM,KAAK,GACT,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,UAAU,SAAS,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAChH,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,KAAK,QAAQ;YACpB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,GAAG,OAAO,IAAI,GAAG,CAAC,UAAU,6BAA6B,GAAG,CAAC,UAAU,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,SAAS,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,UAAU,cAAc,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,EAAE,CACvI,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,mBAAmB,cAAc,CAAC,yBAAyB,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/report/json.d.ts

@@ -0,0 +1,44 @@
+/**
+ * JSON output. The schema is versioned; bump SCHEMA_VERSION on any
+ * incompatible change and say so in the changelog.
+ */
+import type { Decision, Policy, Verdict } from "../policy/index.js";
+/** Bumped on any incompatible change to JsonReport. */
+export declare const SCHEMA_VERSION = 1;
+export interface JsonRule {
+    line: number;
+    text: string;
+    hint: string;
+}
+export interface JsonDecision {
+    file: string;
+    line: number;
+    column: number;
+    capability: string;
+    target: string | null;
+    expression: string;
+    confidence: string;
+    verdict: string;
+    reason: string | null;
+    rule: JsonRule | null;
+}
+/** The document `--format json` prints. `schema` is SCHEMA_VERSION; `frostjs` is the tool version. */
+export interface JsonReport {
+    schema: number;
+    frostjs: string;
+    policy: {
+        file: string;
+        name: string;
+    };
+    /** Files analyzed. */
+    files: number;
+    /** Count of decisions by verdict. */
+    summary: Record<Verdict, number>;
+    /** Expiry warnings from the policy. */
+    warnings: string[];
+    /** Every use, including allowed ones. */
+    decisions: JsonDecision[];
+}
+/** `--format json`: the JsonReport, pretty-printed. */
+export declare function json(decisions: readonly Decision[], files: number, policy: Policy): string;
+//# sourceMappingURL=json.d.ts.map

package/dist/report/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/report/json.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGpE,uDAAuD;AACvD,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;CACvB;AAED,sGAAsG;AACtG,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,uCAAuC;IACvC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,yCAAyC;IACzC,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAkCD,uDAAuD;AACvD,wBAAgB,IAAI,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1F"}

package/dist/report/json.js

@@ -0,0 +1,40 @@
+import { VERSION } from "../version.js";
+/** Bumped on any incompatible change to JsonReport. */
+export const SCHEMA_VERSION = 1;
+function buildJson(decisions, files, policy) {
+    const summary = {
+        allowed: 0,
+        denied: 0,
+        unknown: 0,
+        suppressed: 0,
+        baselined: 0,
+        unchanged: 0,
+    };
+    for (const d of decisions)
+        summary[d.verdict]++;
+    return {
+        schema: SCHEMA_VERSION,
+        frostjs: VERSION,
+        policy: { file: policy.file, name: policy.name },
+        files,
+        summary,
+        warnings: [...policy.warnings],
+        decisions: decisions.map((d) => ({
+            file: d.use.file,
+            line: d.use.line,
+            column: d.use.column,
+            capability: d.use.capability,
+            target: d.use.target,
+            expression: d.use.expression,
+            confidence: d.use.confidence,
+            verdict: d.verdict,
+            reason: d.reason,
+            rule: d.rule ? { line: d.rule.line, text: d.rule.text, hint: d.rule.hint } : null,
+        })),
+    };
+}
+/** `--format json`: the JsonReport, pretty-printed. */
+export function json(decisions, files, policy) {
+    return JSON.stringify(buildJson(decisions, files, policy), null, 2) + "\n";
+}
+//# sourceMappingURL=json.js.map

package/dist/report/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/report/json.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,uDAAuD;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAoChC,SAAS,SAAS,CAAC,SAA8B,EAAE,KAAa,EAAE,MAAc;IAC9E,MAAM,OAAO,GAA4B;QACvC,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;KACb,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAChD,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YAC5B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YACpB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;SAClF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,IAAI,CAAC,SAA8B,EAAE,KAAa,EAAE,MAAc;IAChF,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7E,CAAC"}

package/dist/report/sarif.d.ts

@@ -0,0 +1,10 @@
+/**
+ * SARIF 2.1.0 for code scanning. One rule per capability code seen. Denied
+ * uses are errors, unknown uses are warnings, baselined uses are errors
+ * marked baselineState "unchanged", suppressed uses carry an in-source
+ * suppression. Uses the policy did not flag are not results.
+ */
+import type { Decision } from "../policy/index.js";
+/** `--format sarif`: a SARIF 2.1.0 log with one rule per capability code seen. */
+export declare function sarif(decisions: readonly Decision[]): string;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/report/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,oBAAoB,CAAC;AAY5D,kFAAkF;AAClF,wBAAgB,KAAK,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,GAAG,MAAM,CAmD5D"}

package/dist/report/sarif.js

@@ -0,0 +1,64 @@
+import { denialMessage, describeUse } from "./text.js";
+import { VERSION } from "../version.js";
+const LEVEL = {
+    denied: "error",
+    unknown: "warning",
+    baselined: "error",
+    unchanged: "note",
+    suppressed: "note",
+};
+/** `--format sarif`: a SARIF 2.1.0 log with one rule per capability code seen. */
+export function sarif(decisions) {
+    const reported = decisions.filter((d) => d.verdict !== "allowed");
+    const ruleIds = [...new Set(reported.map((d) => d.use.capability))].sort();
+    const rules = ruleIds.map((id) => ({
+        id,
+        name: id.replace(/[.-](\w)/g, (_, c) => c.toUpperCase()).replace(/^\w/, (c) => c.toUpperCase()),
+        shortDescription: { text: `Use of the ${id} capability` },
+        helpUri: "https://github.com/keithadler/frostjs#capabilities-recognized-so-far",
+    }));
+    const results = reported.map((d) => {
+        const carried = d.verdict === "baselined" || d.verdict === "unchanged";
+        const subject = describeUse(d.use.capability, d.use.target);
+        const message = d.verdict === "denied" || carried ? denialMessage(d) : `${subject} ${d.use.confidence}: ${d.use.expression}`;
+        const r = {
+            ruleId: d.use.capability,
+            ruleIndex: ruleIds.indexOf(d.use.capability),
+            level: LEVEL[d.verdict],
+            message: { text: message },
+            locations: [
+                {
+                    physicalLocation: {
+                        artifactLocation: { uri: d.use.file.replace(/\\/g, "/"), uriBaseId: "%SRCROOT%" },
+                        region: { startLine: d.use.line, startColumn: d.use.column },
+                    },
+                },
+            ],
+            properties: { confidence: d.use.confidence, target: d.use.target, verdict: d.verdict },
+        };
+        if (carried)
+            r["baselineState"] = "unchanged";
+        if (d.verdict === "suppressed")
+            r["suppressions"] = [{ kind: "inSource" }];
+        return r;
+    });
+    const log = {
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "frostjs",
+                        version: VERSION,
+                        informationUri: "https://github.com/keithadler/frostjs",
+                        rules,
+                    },
+                },
+                results,
+            },
+        ],
+    };
+    return JSON.stringify(log, null, 2) + "\n";
+}
+//# sourceMappingURL=sarif.js.map

package/dist/report/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/report/sarif.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,KAAK,GAAsE;IAC/E,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM;CACnB,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,KAAK,CAAC,SAA8B;IAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,EAAE;QACF,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvG,gBAAgB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE;QACzD,OAAO,EAAE,sEAAsE;KAChF,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/G,MAAM,CAAC,GAA4B;YACjC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YACxB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YAC5C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAsC,CAAC;YACtD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC1B,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;wBACjF,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;qBAC7D;iBACF;aACF;YACD,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;SACvF,CAAC;QACF,IAAI,OAAO;YAAE,CAAC,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;QAC9C,IAAI,CAAC,CAAC,OAAO,KAAK,YAAY;YAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG;QACV,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,uCAAuC;wBACvD,KAAK;qBACN;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7C,CAAC"}

package/dist/report/summary.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A plain-English reading of a policy for someone who does not write
+ * JavaScript. Says what the code may do, what it may not, and that
+ * everything else is denied, which the policy file leaves implicit.
+ */
+import { type Policy } from "../policy/index.js";
+/** The plain-English reading of a policy, for the date it was compiled against. */
+export declare function summary(policy: Policy): string;
+//# sourceMappingURL=summary.d.ts.map

package/dist/report/summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.d.ts","sourceRoot":"","sources":["../../src/report/summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAa,KAAK,MAAM,EAAa,MAAM,oBAAoB,CAAC;AAwBvE,mFAAmF;AACnF,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA+B9C"}

package/dist/report/summary.js

@@ -0,0 +1,67 @@
+/**
+ * A plain-English reading of a policy for someone who does not write
+ * JavaScript. Says what the code may do, what it may not, and that
+ * everything else is denied, which the policy file leaves implicit.
+ */
+import { isExpired } from "../policy/index.js";
+import { CAPABILITY_PHRASES, FAMILIES } from "../policy/vocabulary.js";
+import { SAME_ORIGIN } from "../extract/target.js";
+/** The friendliest phrase for a code: the first vocabulary entry that maps to it. */
+function phraseFor(code) {
+    if (code === "*")
+        return "everything";
+    for (const [phrase, c] of CAPABILITY_PHRASES)
+        if (c === code)
+            return phrase;
+    return code;
+}
+function describe(r, today) {
+    const parts = [];
+    if (r.hosts.length > 0) {
+        parts.push(`reach ${r.hosts.map((h) => (h === SAME_ORIGIN ? "its own origin" : h)).join(", ")}`);
+    }
+    else
+        parts.push(`use ${phraseFor(r.capability)}`);
+    if (r.paths.length > 0)
+        parts.push(`only in ${r.paths.join(", ")}`);
+    if (r.until !== null)
+        parts.push(isExpired(r, today) ? `expired ${r.until}` : `until ${r.until}`);
+    let s = parts.join(", ");
+    s += ` (line ${r.line})`;
+    if (r.hint)
+        s += ` - ${r.hint}`;
+    return s;
+}
+/** The plain-English reading of a policy, for the date it was compiled against. */
+export function summary(policy) {
+    const { today } = policy;
+    const lines = [];
+    lines.push(`Policy "${policy.name}" (${policy.file})`);
+    lines.push("");
+    const may = policy.rules.filter((r) => r.verb === "may");
+    const forbid = policy.rules.filter((r) => r.verb === "forbid" && r.capability !== "*");
+    lines.push("This code may:");
+    if (may.length === 0)
+        lines.push("  - nothing; every capability is denied");
+    for (const r of may)
+        lines.push(`  - ${describe(r, today)}`);
+    lines.push("");
+    if (forbid.length > 0) {
+        lines.push("It may not, even where a broader grant would allow it:");
+        for (const r of forbid)
+            lines.push(`  - ${describe(r, today)}`);
+        lines.push("");
+    }
+    const granted = new Set(may.map((r) => (r.capability === "*" ? "*" : r.capability.split(".")[0])));
+    const untouched = granted.has("*") ? [] : FAMILIES.filter((f) => !granted.has(f));
+    if (untouched.length > 0) {
+        lines.push(`Everything else is denied. In particular this code may not use: ${untouched.map(phraseFor).join(", ")}.`);
+    }
+    else {
+        lines.push("Everything not listed above is denied.");
+    }
+    for (const w of policy.warnings)
+        lines.push(`Warning: ${w}`);
+    return lines.join("\n") + "\n";
+}
+//# sourceMappingURL=summary.js.map

package/dist/report/summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary.js","sourceRoot":"","sources":["../../src/report/summary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAA0B,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,qFAAqF;AACrF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC;IACtC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,kBAAkB;QAAE,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAO,EAAE,KAAa;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;;QAAM,KAAK,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI;QAAE,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IAEvF,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,mEAAmE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}

package/dist/report/text.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The default, human-readable report, and the wording of a denial that
+ * every other format reuses so the same use reads the same everywhere.
+ */
+import type { Decision } from "../policy/index.js";
+export interface Totals {
+    /** Files analyzed, for the summary line. */
+    files: number;
+}
+export interface TextOptions {
+    /** Expiry warnings from the compiled policy, printed before the summary. */
+    warnings?: readonly string[];
+}
+/** A capability plus its destination when one is known: `network.fetch to api.example.com`. */
+export declare function describeUse(capability: string, target: string | null): string;
+/**
+ * Why a use was denied, in the words of the policy line that did it:
+ *
+ *   denied by default (no rule grants it)
+ *   denied by "forbid cookies" (line 4): consent banner owns these
+ *   denied (grant expired 2026-08-30) by "may use the cache until 2026-08-30" (line 5)
+ *   denied (destination cannot be read) by "may reach "api.example.com"" (line 2), which names hosts
+ *
+ * An unregistered vendored file has no capability or expression to show,
+ * so its whole message is the sentence `vendored file is not in the
+ * registry; review it with: frostjs vendor add lib/x.js`; see denialMessage.
+ */
+export declare function denialText(d: Decision): string;
+/** The message for a denied (or baselined, or unchanged) use, without the position: subject, reason, expression. */
+export declare function denialMessage(d: Decision): string;
+/** One report line for a denied (or baselined, or unchanged) use. */
+export declare function denialLine(d: Decision): string;
+/** One report line for a use below the confidence floor. */
+export declare function unknownLine(d: Decision): string;
+/** One line per denial, unknowns in their own section, warnings, then a summary. */
+export declare function text(decisions: readonly Decision[], totals: Totals, opts?: TextOptions): string;
+//# sourceMappingURL=text.d.ts.map

package/dist/report/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/report/text.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnD,MAAM,WAAW,MAAM;IACrB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAID,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAe9C;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAIjD;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAG9C;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAG/C;AAED,oFAAoF;AACpF,wBAAgB,IAAI,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,MAAM,CAwBnG"}

package/dist/report/text.js

@@ -0,0 +1,81 @@
+import { SAME_ORIGIN } from "../extract/target.js";
+const plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+/** A capability plus its destination when one is known: `network.fetch to api.example.com`. */
+export function describeUse(capability, target) {
+    return target !== null && target !== SAME_ORIGIN ? `${capability} to ${target}` : capability;
+}
+/**
+ * Why a use was denied, in the words of the policy line that did it:
+ *
+ *   denied by default (no rule grants it)
+ *   denied by "forbid cookies" (line 4): consent banner owns these
+ *   denied (grant expired 2026-08-30) by "may use the cache until 2026-08-30" (line 5)
+ *   denied (destination cannot be read) by "may reach "api.example.com"" (line 2), which names hosts
+ *
+ * An unregistered vendored file has no capability or expression to show,
+ * so its whole message is the sentence `vendored file is not in the
+ * registry; review it with: frostjs vendor add lib/x.js`; see denialMessage.
+ */
+export function denialText(d) {
+    const { rule, reason, use } = d;
+    if (reason === "unregistered")
+        return `vendored file is not in the registry; review it with: frostjs vendor add ${use.file}`;
+    if (rule === null)
+        return "denied by default (no rule grants it)";
+    const where = `"${rule.text}" (line ${rule.line})`;
+    const hint = rule.hint ? `: ${rule.hint}` : "";
+    switch (reason) {
+        case "expired":
+            return `denied (grant expired ${rule.until}) by ${where}${hint}`;
+        case "unknown destination":
+            return `denied (destination cannot be read) by ${where}, which names hosts${hint}`;
+        default:
+            return `denied by ${where}${hint}`;
+    }
+}
+/** The message for a denied (or baselined, or unchanged) use, without the position: subject, reason, expression. */
+export function denialMessage(d) {
+    const { use } = d;
+    if (d.reason === "unregistered")
+        return denialText(d);
+    return `${describeUse(use.capability, use.target)} ${denialText(d)}: ${use.expression}`;
+}
+/** One report line for a denied (or baselined, or unchanged) use. */
+export function denialLine(d) {
+    const { use } = d;
+    return `${use.file}:${use.line}:${use.column}: ${denialMessage(d)}`;
+}
+/** One report line for a use below the confidence floor. */
+export function unknownLine(d) {
+    const { use } = d;
+    return `${use.file}:${use.line}:${use.column}: ${describeUse(use.capability, use.target)} ${use.confidence}: ${use.expression}`;
+}
+/** One line per denial, unknowns in their own section, warnings, then a summary. */
+export function text(decisions, totals, opts = {}) {
+    const denied = decisions.filter((d) => d.verdict === "denied");
+    const unknown = decisions.filter((d) => d.verdict === "unknown");
+    const count = (verdict) => decisions.filter((d) => d.verdict === verdict).length;
+    const warnings = opts.warnings ?? [];
+    const lines = denied.map(denialLine);
+    if (unknown.length > 0) {
+        if (lines.length > 0)
+            lines.push("");
+        lines.push("unknown (not failing the build):", ...unknown.map(unknownLine));
+    }
+    if (warnings.length > 0) {
+        if (lines.length > 0)
+            lines.push("");
+        lines.push(...warnings.map((w) => `warning: ${w}`));
+    }
+    if (lines.length > 0)
+        lines.push("");
+    let summary = `${plural(totals.files, "file")}, ${denied.length} denied, ${unknown.length} unknown`;
+    for (const verdict of ["suppressed", "baselined", "unchanged"]) {
+        const n = count(verdict);
+        if (n > 0)
+            summary += `, ${n} ${verdict}`;
+    }
+    lines.push(summary);
+    return lines.join("\n") + "\n";
+}
+//# sourceMappingURL=text.js.map

package/dist/report/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/report/text.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAYnD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,IAAY,EAAU,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAExF,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAE,MAAqB;IACnE,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,UAAU,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,CAAW;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,cAAc;QAC3B,OAAO,4EAA4E,GAAG,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,uCAAuC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,GAAG,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,yBAAyB,IAAI,CAAC,KAAK,QAAQ,KAAK,GAAG,IAAI,EAAE,CAAC;QACnE,KAAK,qBAAqB;YACxB,OAAO,0CAA0C,KAAK,sBAAsB,IAAI,EAAE,CAAC;QACrF;YACE,OAAO,aAAa,KAAK,GAAG,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,aAAa,CAAC,CAAW;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,CAAW;IACpC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,CAAW;IACrC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC;AAClI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,IAAI,CAAC,SAA8B,EAAE,MAAc,EAAE,OAAoB,EAAE;IACzF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAa,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAErC,IAAI,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,UAAU,CAAC;IACpG,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC"}

package/dist/sync.d.ts

@@ -0,0 +1,19 @@
+import { type ParsedFile } from "./extract/ast.js";
+import { type Registry, type RegistryUse } from "./registry.js";
+export interface SyncResult {
+    /** The reconciled registry. `sync` does not write it; the caller does. */
+    registry: Registry;
+    /** What happened, one printable line each, in order. */
+    lines: string[];
+    /** Conditions worth a person's attention that are not findings (no lockfile). */
+    warnings: string[];
+    /** True when something needs a person: a new package, or a bump with new capabilities. */
+    needsReview: boolean;
+}
+/** Directory names a vendored glob reaches into that discovery would otherwise skip. */
+export declare function includesFor(vendored: readonly string[]): string[];
+/** Distinct (capability, target) pairs of at least probable confidence, sorted. */
+export declare function usesOf(parsed: ParsedFile): RegistryUse[];
+/** Reconcile the registry with the vendored files under `policyDir`. See the module comment. */
+export declare function sync(registry: Registry, policyDir: string, vendored: readonly string[], today: string): SyncResult;
+//# sourceMappingURL=sync.d.ts.map

package/dist/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAeA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9D,OAAO,EAIL,KAAK,QAAQ,EAEb,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,QAAQ,CAAC;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0FAA0F;IAC1F,WAAW,EAAE,OAAO,CAAC;CACtB;AAWD,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAOjE;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,EAAE,CAWxD;AAID,gGAAgG;AAChG,wBAAgB,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CA6ElH"}

package/dist/sync.js

@@ -0,0 +1,131 @@
+/**
+ * `frostjs registry sync`: keep the vendored-code registry in step with the
+ * tree after a dependency bump.
+ *
+ * For every vendored file whose hash is unknown, find the previous entry
+ * for the same package. If the new version uses exactly the capability set
+ * the old one did, re-admit it automatically and note the bump. If it uses
+ * anything new, refuse, print the difference, and point at vendor add: a
+ * bump that quietly adds a network destination is the threat this tool
+ * exists to catch. Entries whose file is gone are pruned. The lockfile's
+ * hash is recorded so the next run can say whether anything moved.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { discover } from "./discover/index.js";
+import { parseFile } from "./extract/ast.js";
+import { extract } from "./extract/index.js";
+import { matchesGlob } from "./policy/index.js";
+import { describeUse } from "./report/text.js";
+import { guessPackage, integrityOfFile, lookup, } from "./registry.js";
+const LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb"];
+/** The first lockfile found in `dir`, or null. */
+function findLockfile(dir) {
+    for (const name of LOCKFILES) {
+        const p = path.join(dir, name);
+        if (fs.existsSync(p))
+            return p;
+    }
+    return null;
+}
+/** Directory names a vendored glob reaches into that discovery would otherwise skip. */
+export function includesFor(vendored) {
+    const out = new Set();
+    for (const g of vendored) {
+        const first = g.replace(/^\.\//, "").split("/")[0];
+        if (first && !/[*?]/.test(first))
+            out.add(first);
+    }
+    return [...out];
+}
+/** Distinct (capability, target) pairs of at least probable confidence, sorted. */
+export function usesOf(parsed) {
+    const seen = new Map();
+    for (const u of extract(parsed)) {
+        if (u.confidence === "possible")
+            continue;
+        seen.set(`${u.capability}\0${u.target ?? ""}`, { capability: u.capability, target: u.target });
+    }
+    return [...seen.values()].sort((a, b) => a.capability === b.capability
+        ? (a.target ?? "").localeCompare(b.target ?? "")
+        : a.capability.localeCompare(b.capability));
+}
+const key = (u) => describeUse(u.capability, u.target);
+/** Reconcile the registry with the vendored files under `policyDir`. See the module comment. */
+export function sync(registry, policyDir, vendored, today) {
+    const lines = [];
+    const warnings = [];
+    let needsReview = false;
+    let entries = [...registry.entries];
+    const lockfile = findLockfile(policyDir);
+    let lock;
+    if (lockfile === null) {
+        warnings.push("no lockfile found beside the policy; there is nothing to pin dependency versions to");
+    }
+    else {
+        lock = { path: path.basename(lockfile), integrity: integrityOfFile(lockfile) };
+        if (registry.lockfile && registry.lockfile.integrity === lock.integrity)
+            lines.push(`${lock.path} unchanged since last sync`);
+        else if (registry.lockfile)
+            lines.push(`${lock.path} changed since last sync`);
+    }
+    const files = discover([policyDir], { include: includesFor(vendored) });
+    const present = new Set();
+    for (const file of files) {
+        const rel = path.relative(policyDir, file).split(path.sep).join("/");
+        if (!vendored.some((g) => matchesGlob(g, rel)))
+            continue;
+        const integrity = integrityOfFile(file);
+        present.add(integrity);
+        if (lookup({ version: 1, entries }, integrity) !== null)
+            continue;
+        const pkg = guessPackage(file, policyDir);
+        const previous = entries.filter((e) => e.package === pkg.package).sort((a, b) => b.added.localeCompare(a.added))[0];
+        const parsed = parseFile(file);
+        if (parsed.errors.length > 0) {
+            lines.push(`${rel}: does not parse; not added`);
+            needsReview = true;
+            continue;
+        }
+        const uses = usesOf(parsed);
+        if (!previous) {
+            lines.push(`${rel} (${pkg.package}@${pkg.version}): new package, not in the registry; review it with: frostjs vendor add ${rel}`);
+            needsReview = true;
+            continue;
+        }
+        const before = new Set(previous.uses.map(key));
+        const after = new Set(uses.map(key));
+        const added = [...after].filter((k) => !before.has(k));
+        const removed = [...before].filter((k) => !after.has(k));
+        if (added.length === 0) {
+            const entry = {
+                integrity,
+                package: pkg.package,
+                version: pkg.version,
+                file: rel,
+                uses,
+                added: today,
+            };
+            entries.push(entry);
+            const note = removed.length ? `; no longer uses ${removed.join(", ")}` : "";
+            lines.push(`${rel}: ${pkg.package} ${previous.version} -> ${pkg.version}, capabilities unchanged, re-admitted${note}`);
+        }
+        else {
+            needsReview = true;
+            lines.push(`${rel}: ${pkg.package} ${previous.version} -> ${pkg.version} adds ${added.join(", ")}; NOT admitted`);
+            lines.push(`  review it with: frostjs vendor add ${rel}`);
+        }
+    }
+    // Prune entries whose file is gone and whose hash is nowhere in the tree.
+    const kept = [];
+    for (const e of entries) {
+        const exists = fs.existsSync(path.join(policyDir, e.file));
+        if (exists || present.has(e.integrity))
+            kept.push(e);
+        else
+            lines.push(`${e.file}: gone, ${e.package}@${e.version} removed from the registry`);
+    }
+    entries = kept;
+    return { registry: { version: 1, ...(lock ? { lockfile: lock } : {}), entries }, lines, warnings, needsReview };
+}
+//# sourceMappingURL=sync.js.map

package/dist/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../src/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAmB,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,eAAe,EACf,MAAM,GAIP,MAAM,eAAe,CAAC;AAEvB,MAAM,SAAS,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAa3G,kDAAkD;AAClD,SAAS,YAAY,CAAC,GAAW;IAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,QAA2B;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;YAAE,SAAS;QAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC3B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAc,EAAU,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,gGAAgG;AAChG,MAAM,UAAU,IAAI,CAAC,QAAkB,EAAE,SAAiB,EAAE,QAA2B,EAAE,KAAa;IACpG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,IAA0B,CAAC;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACrE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;aAClD,IAAI,QAAQ,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAAE,SAAS;QACzD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,IAAI;YAAE,SAAS;QAElE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,6BAA6B,CAAC,CAAC;YAChD,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CACR,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,2EAA2E,GAAG,EAAE,CACtH,CAAC;YACF,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAkB;gBAC3B,SAAS;gBACT,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,KAAK,EAAE,KAAK;aACb,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,KAAK,CAAC,IAAI,CACR,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,OAAO,GAAG,CAAC,OAAO,wCAAwC,IAAI,EAAE,CAC3G,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,OAAO,GAAG,CAAC,OAAO,SAAS,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClH,KAAK,CAAC,IAAI,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,4BAA4B,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,IAAI,CAAC;IAEf,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAClH,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,OAAO,EAAE,MAAoB,CAAC"}

package/dist/version.js

@@ -0,0 +1,6 @@
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+// Read from package.json so there is exactly one place the version lives.
+const pkg = require("../package.json");
+export const VERSION = pkg.version;
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,0EAA0E;AAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,CAAC,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,CAAC"}