@keithadler/frostjs 0.1.0

package/dist/changed.d.ts

@@ -0,0 +1,15 @@
+export interface LineRange {
+    start: number;
+    /** Inclusive. */
+    end: number;
+}
+/** Canonical absolute file path (see canonical) -> changed line ranges on the new side, or "all" for an untracked file. */
+export type ChangedLines = Map<string, LineRange[] | "all">;
+/**
+ * Lines changed since `ref` in the repository containing `cwd`. Throws
+ * outside a repository or when git cannot diff against the ref.
+ */
+export declare function changedLines(ref: string, cwd: string): ChangedLines;
+/** True when the line of `file` (any spelling of its absolute path) was added or modified. */
+export declare function isChanged(changed: ChangedLines, file: string, line: number): boolean;
+//# sourceMappingURL=changed.d.ts.map

package/dist/changed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed.d.ts","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2HAA2H;AAC3H,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC;AA6B5D;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAoCnE;AAED,8FAA8F;AAC9F,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF"}

package/dist/changed.js

@@ -0,0 +1,93 @@
+/**
+ * Changed-lines-only mode. Asks git which lines of which files differ from
+ * a ref, so a PR check can fail only on uses the PR introduced or touched.
+ * Untracked files count as entirely changed. Parsing the unified diff with
+ * zero context keeps it to the hunk headers.
+ */
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * One spelling for a path, so git's output and the caller's paths agree:
+ * symlinks resolved (macOS temp dirs), Windows short names expanded
+ * (RUNNER~1), drive letter case settled. Falls back to path.resolve when
+ * the path does not exist.
+ */
+function canonical(p) {
+    try {
+        return fs.realpathSync.native(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+function git(args, cwd) {
+    return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+/** The git repository containing `cwd`, or null outside one. */
+function repoRoot(cwd) {
+    try {
+        return git(["rev-parse", "--show-toplevel"], cwd).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Lines changed since `ref` in the repository containing `cwd`. Throws
+ * outside a repository or when git cannot diff against the ref.
+ */
+export function changedLines(ref, cwd) {
+    // The ref comes from the command line, often from a CI variable. It must
+    // never be read as a git option: `--output=<file>` would write a file.
+    if (ref === "" || ref.startsWith("-"))
+        throw new Error(`--changed-since needs a git ref, not '${ref}'`);
+    const top = repoRoot(cwd);
+    if (top === null)
+        throw new Error("--changed-since needs a git repository");
+    const root = canonical(top);
+    const out = new Map();
+    let diff;
+    try {
+        diff = git(["diff", "-U0", "--no-color", "--no-ext-diff", "--end-of-options", ref, "--"], root);
+    }
+    catch (e) {
+        const msg = e.stderr?.trim() || e.message;
+        throw new Error(`git diff against ${ref} failed: ${msg.split("\n")[0]}`);
+    }
+    let current = null;
+    for (const line of diff.split("\n")) {
+        if (line.startsWith("+++ ")) {
+            const name = line.slice(4).trim();
+            current = name === "/dev/null" ? null : canonical(path.resolve(root, name.replace(/^b\//, "")));
+            if (current !== null && !out.has(current))
+                out.set(current, []);
+        }
+        else if (line.startsWith("@@") && current !== null) {
+            const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+            if (!m)
+                continue;
+            const start = Number(m[1]);
+            const count = m[2] === undefined ? 1 : Number(m[2]);
+            if (count === 0)
+                continue; // pure deletion
+            const ranges = out.get(current);
+            if (Array.isArray(ranges))
+                ranges.push({ start, end: start + count - 1 });
+        }
+    }
+    const untracked = git(["ls-files", "--others", "--exclude-standard", "-z"], root).split("\0").filter(Boolean);
+    for (const f of untracked)
+        out.set(canonical(path.resolve(root, f)), "all");
+    return out;
+}
+/** True when the line of `file` (any spelling of its absolute path) was added or modified. */
+export function isChanged(changed, file, line) {
+    const ranges = changed.get(canonical(file));
+    if (ranges === undefined)
+        return false;
+    if (ranges === "all")
+        return true;
+    return ranges.some((r) => line >= r.start && line <= r.end);
+}
+//# sourceMappingURL=changed.js.map

package/dist/changed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed.js","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B;;;;;GAKG;AACH,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,IAAc,EAAE,GAAW;IACtC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,gEAAgE;AAChE,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAW;IACnD,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAiB,IAAI,GAAG,EAAE,CAAC;IAEpC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAClG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAI,CAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAK,CAAW,CAAC,OAAO,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS,CAAC,gBAAgB;YAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9G,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,SAAS,CAAC,OAAqB,EAAE,IAAY,EAAE,IAAY;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC"}

package/dist/cli/args.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Command-line parsing and the help text. Every flag here has a usage line
+ * in the README and a test; keep the three in step.
+ */
+import { type Confidence } from "../policy/index.js";
+/** The subcommand, `check` being the bare `frostjs <paths>` form. */
+type Command = "check" | "init" | "csp" | "summary" | "vendor-add" | "registry-sync" | "sri";
+export interface ParsedArgs {
+    command: Command;
+    version: boolean;
+    help: boolean;
+    exclude: string[];
+    exitZero: boolean;
+    policy: string | null;
+    today: string | null;
+    minConfidence: Confidence | null;
+    baseline: string | null;
+    updateBaseline: boolean;
+    changedSince: string | null;
+    format: Format;
+    paths: string[];
+}
+declare const FORMATS: readonly ["text", "json", "sarif", "github", "html"];
+type Format = (typeof FORMATS)[number];
+/** A flag or argument the CLI cannot accept; the message is printed with the help text. */
+export declare class UsageError extends Error {
+}
+/**
+ * Parse argv (without node and script name). The first token may be a
+ * subcommand; `--` ends option parsing; `--name=value` and `--name value`
+ * are both accepted. Throws UsageError.
+ */
+export declare function parseArgs(argv: readonly string[]): ParsedArgs;
+/** The `--help` text, also printed after a usage error. */
+export declare const HELP = "usage: frostjs [options] <paths...>\n       frostjs init [paths...]\n       frostjs csp [--policy <file>]\n       frostjs summary [--policy <file>]\n       frostjs vendor add <files...>\n       frostjs registry sync\n       frostjs sri [--format text|json|html] [paths...]\n\nDeny-by-default capability linter for JavaScript.\n\ncommands:\n  (default)            analyze the given paths against the policy\n  frostjs init         write a starter frostjs.policy in the current\n                       directory granting exactly what the code under the\n                       paths (default .) does today, with a note on each\n                       grant saying where; read it and delete what should\n                       not be allowed\n  frostjs csp           print the Content-Security-Policy header the policy\n                       implies, and nothing else, for the deploy step\n  frostjs summary       print a plain-English reading of the policy for a\n                       reviewer who does not write JavaScript\n  frostjs vendor add    analyze third-party files once, print the capability\n                       set found, and record it with the file's SHA-384 in\n                       .frostjs/registry.json beside the policy\n  frostjs registry sync after a dependency bump: re-admit vendored files\n                       whose capability set did not change, refuse and show\n                       the difference for those that gained one, prune\n                       entries whose file is gone, record the lockfile hash\n  frostjs sri           print Subresource Integrity values for registered\n                       vendored files (text: path and hash; json: a map;\n                       html: script tags), so the browser enforces the same\n                       hashes the registry reviewed\n\noptions:\n  -h, --help           show this help and exit\n  -V, --version        print the version and exit\n  --exclude <name>     skip directories with this name (repeatable);\n                       node_modules, dist, build, coverage and .git are\n                       always skipped\n  --exit-zero          report findings but always exit 0\n  --policy <file>      use this policy instead of searching for frostjs.policy\n  --today <date>       treat this YYYY-MM-DD as today when checking expiry\n  --min-confidence <c> lowest confidence that can fail the build:\n                       certain, probable (default) or possible; uses below\n                       it are listed as unknown\n  --baseline <file>    denials recorded in this file do not fail the build\n  --update-baseline    write every current denial into the baseline file\n                       and exit 0; use once to adopt frostjs on a codebase\n  --changed-since <ref>  fail only on uses in lines changed since the git\n                       ref (e.g. origin/main); untracked files count whole\n  --format <f>         text (default), json (versioned schema), sarif\n                       (2.1.0, one rule per capability), or github\n                       (inline PR annotations followed by the text report);\n                       html only with frostjs sri\n\npolicy:\n  frostjs.policy is searched for in the directory shared by all the given\n  paths, then in each parent directory. The nearest one wins. Path globs in\n  a policy are relative to the policy file's directory. With no policy, every\n  capability is denied.\n\nexit codes:\n  0  no denied capability uses\n  1  at least one denied capability use\n  2  usage or input error (bad flag, missing path, syntax error)\n";
+export {};
+//# sourceMappingURL=args.d.ts.map

package/dist/cli/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEvE,qEAAqE;AACrE,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,KAAK,CAAC;AAE7F,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,QAAA,MAAM,OAAO,sDAAuD,CAAC;AACrE,KAAK,MAAM,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvC,2FAA2F;AAC3F,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAkH7D;AAED,2DAA2D;AAC3D,eAAO,MAAM,IAAI,ygHAiEhB,CAAC"}

package/dist/cli/args.js

@@ -0,0 +1,200 @@
+/**
+ * Command-line parsing and the help text. Every flag here has a usage line
+ * in the README and a test; keep the three in step.
+ */
+import { CONFIDENCE_ORDER } from "../policy/index.js";
+const FORMATS = ["text", "json", "sarif", "github", "html"];
+/** A flag or argument the CLI cannot accept; the message is printed with the help text. */
+export class UsageError extends Error {
+}
+/**
+ * Parse argv (without node and script name). The first token may be a
+ * subcommand; `--` ends option parsing; `--name=value` and `--name value`
+ * are both accepted. Throws UsageError.
+ */
+export function parseArgs(argv) {
+    const out = {
+        command: "check",
+        version: false,
+        help: false,
+        exclude: [],
+        exitZero: false,
+        policy: null,
+        today: null,
+        minConfidence: null,
+        baseline: null,
+        updateBaseline: false,
+        changedSince: null,
+        format: "text",
+        paths: [],
+    };
+    let positionalOnly = false;
+    let first = true;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (first) {
+            first = false;
+            if (arg === "csp" || arg === "summary" || arg === "sri" || arg === "init") {
+                out.command = arg;
+                continue;
+            }
+            if (arg === "registry") {
+                const sub = argv[i + 1];
+                if (sub !== "sync")
+                    throw new UsageError(`frostjs registry needs a subcommand: sync${sub ? ` (got '${sub}')` : ""}`);
+                out.command = "registry-sync";
+                i++;
+                continue;
+            }
+            if (arg === "vendor") {
+                const sub = argv[i + 1];
+                if (sub !== "add")
+                    throw new UsageError(`frostjs vendor needs a subcommand: add${sub ? ` (got '${sub}')` : ""}`);
+                out.command = "vendor-add";
+                i++;
+                continue;
+            }
+        }
+        if (positionalOnly) {
+            out.paths.push(arg);
+            continue;
+        }
+        const eq = arg.indexOf("=");
+        const name = arg.startsWith("--") && eq > 0 ? arg.slice(0, eq) : arg;
+        const takeValue = () => {
+            if (eq > 0 && arg.startsWith("--"))
+                return arg.slice(eq + 1);
+            const next = argv[++i];
+            if (next === undefined)
+                throw new UsageError(`${name} needs a value`);
+            return next;
+        };
+        switch (name) {
+            case "--":
+                positionalOnly = true;
+                break;
+            case "--version":
+            case "-V":
+                out.version = true;
+                break;
+            case "--help":
+            case "-h":
+                out.help = true;
+                break;
+            case "--exclude":
+                out.exclude.push(takeValue());
+                break;
+            case "--exit-zero":
+                out.exitZero = true;
+                break;
+            case "--policy":
+                out.policy = takeValue();
+                break;
+            case "--min-confidence": {
+                const v = takeValue();
+                if (!CONFIDENCE_ORDER.includes(v)) {
+                    throw new UsageError("--min-confidence must be certain, probable or possible");
+                }
+                out.minConfidence = v;
+                break;
+            }
+            case "--baseline":
+                out.baseline = takeValue();
+                break;
+            case "--update-baseline":
+                out.updateBaseline = true;
+                break;
+            case "--changed-since":
+                out.changedSince = takeValue();
+                break;
+            case "--format": {
+                const v = takeValue();
+                if (!FORMATS.includes(v))
+                    throw new UsageError(`--format must be one of ${FORMATS.join(", ")}`);
+                out.format = v;
+                break;
+            }
+            case "--today": {
+                const v = takeValue();
+                if (!/^\d{4}-\d{2}-\d{2}$/.test(v))
+                    throw new UsageError("--today must be a date like 2026-12-01");
+                out.today = v;
+                break;
+            }
+            default:
+                if (arg.startsWith("-")) {
+                    throw new UsageError(`unknown option: ${arg}`);
+                }
+                out.paths.push(arg);
+        }
+    }
+    return out;
+}
+/** The `--help` text, also printed after a usage error. */
+export const HELP = `usage: frostjs [options] <paths...>
+       frostjs init [paths...]
+       frostjs csp [--policy <file>]
+       frostjs summary [--policy <file>]
+       frostjs vendor add <files...>
+       frostjs registry sync
+       frostjs sri [--format text|json|html] [paths...]
+
+Deny-by-default capability linter for JavaScript.
+
+commands:
+  (default)            analyze the given paths against the policy
+  frostjs init         write a starter frostjs.policy in the current
+                       directory granting exactly what the code under the
+                       paths (default .) does today, with a note on each
+                       grant saying where; read it and delete what should
+                       not be allowed
+  frostjs csp           print the Content-Security-Policy header the policy
+                       implies, and nothing else, for the deploy step
+  frostjs summary       print a plain-English reading of the policy for a
+                       reviewer who does not write JavaScript
+  frostjs vendor add    analyze third-party files once, print the capability
+                       set found, and record it with the file's SHA-384 in
+                       .frostjs/registry.json beside the policy
+  frostjs registry sync after a dependency bump: re-admit vendored files
+                       whose capability set did not change, refuse and show
+                       the difference for those that gained one, prune
+                       entries whose file is gone, record the lockfile hash
+  frostjs sri           print Subresource Integrity values for registered
+                       vendored files (text: path and hash; json: a map;
+                       html: script tags), so the browser enforces the same
+                       hashes the registry reviewed
+
+options:
+  -h, --help           show this help and exit
+  -V, --version        print the version and exit
+  --exclude <name>     skip directories with this name (repeatable);
+                       node_modules, dist, build, coverage and .git are
+                       always skipped
+  --exit-zero          report findings but always exit 0
+  --policy <file>      use this policy instead of searching for frostjs.policy
+  --today <date>       treat this YYYY-MM-DD as today when checking expiry
+  --min-confidence <c> lowest confidence that can fail the build:
+                       certain, probable (default) or possible; uses below
+                       it are listed as unknown
+  --baseline <file>    denials recorded in this file do not fail the build
+  --update-baseline    write every current denial into the baseline file
+                       and exit 0; use once to adopt frostjs on a codebase
+  --changed-since <ref>  fail only on uses in lines changed since the git
+                       ref (e.g. origin/main); untracked files count whole
+  --format <f>         text (default), json (versioned schema), sarif
+                       (2.1.0, one rule per capability), or github
+                       (inline PR annotations followed by the text report);
+                       html only with frostjs sri
+
+policy:
+  frostjs.policy is searched for in the directory shared by all the given
+  paths, then in each parent directory. The nearest one wins. Path globs in
+  a policy are relative to the policy file's directory. With no policy, every
+  capability is denied.
+
+exit codes:
+  0  no denied capability uses
+  1  at least one denied capability use
+  2  usage or input error (bad flag, missing path, syntax error)
+`;
+//# sourceMappingURL=args.js.map

package/dist/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,oBAAoB,CAAC;AAqBvE,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGrE,2FAA2F;AAC3F,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,GAAG,GAAe;QACtB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,EAAE;KACV,CAAC;IACF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,GAAG,KAAK,CAAC;YACd,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,GAAG,KAAK,MAAM;oBAChB,MAAM,IAAI,UAAU,CAAC,4CAA4C,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,OAAO,GAAG,eAAe,CAAC;gBAC9B,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,GAAG,KAAK,KAAK;oBACf,MAAM,IAAI,UAAU,CAAC,yCAAyC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChG,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC;gBAC3B,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACrE,MAAM,SAAS,GAAG,GAAW,EAAE;YAC7B,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI;gBACP,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,WAAW,CAAC;YACjB,KAAK,IAAI;gBACP,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,KAAK,WAAW;gBACd,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,aAAa;gBAChB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,UAAU;gBACb,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,UAAU,CAAC,wDAAwD,CAAC,CAAC;gBACjF,CAAC;gBACD,GAAG,CAAC,aAAa,GAAG,CAAe,CAAC;gBACpC,MAAM;YACR,CAAC;YACD,KAAK,YAAY;gBACf,GAAG,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM;YACR,KAAK,mBAAmB;gBACtB,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,KAAK,iBAAiB;gBACpB,GAAG,CAAC,YAAY,GAAG,SAAS,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC7C,MAAM,IAAI,UAAU,CAAC,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxE,GAAG,CAAC,MAAM,GAAG,CAAW,CAAC;gBACzB,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;gBACnG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;gBACd,MAAM;YACR,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,UAAU,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEnB,CAAC"}

package/dist/cli/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/cli/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":""}

package/dist/cli/main.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { run } from "./run.js";
+const code = run(process.argv.slice(2), {
+    stdout: (s) => process.stdout.write(s),
+    stderr: (s) => process.stderr.write(s),
+});
+process.exitCode = code;
+//# sourceMappingURL=main.js.map

package/dist/cli/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AACH,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC"}

package/dist/cli/run.d.ts

@@ -0,0 +1,9 @@
+export interface Io {
+    stdout: (s: string) => void;
+    stderr: (s: string) => void;
+    /** Directory inputs are resolved against and reported paths are made relative to. Defaults to process.cwd(). */
+    cwd?: string;
+}
+/** Run the CLI against argv (without node and script name) and return the exit code. */
+export declare function run(argv: readonly string[], io: Io): number;
+//# sourceMappingURL=run.d.ts.map

package/dist/cli/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAkDA,MAAM,WAAW,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,gHAAgH;IAChH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wFAAwF;AACxF,wBAAgB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,CAiC3D"}