@keithadler/frostjs 0.1.0

package/dist/extract/target.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Static resolution of a network destination from an argument expression.
+ *
+ * Frost's rule: a literal that closes the authority fixes the host, and
+ * nothing after the slash can move it. `"https://api.example.com/items/" + id`
+ * reaches api.example.com. `"https://" + host` reaches nobody we can name,
+ * so it resolves to null and the policy treats it as unknown.
+ *
+ * Relative URLs resolve to "same-origin". `data:` and `blob:` URLs resolve to
+ * their scheme.
+ */
+import type { AnyNode } from "./ast.js";
+/** The target of a relative URL: the document's own origin. */
+export declare const SAME_ORIGIN = "same-origin";
+/** The known leading text of an expression, or null if it does not start with a literal. */
+export declare function leadingLiteral(raw: AnyNode): {
+    text: string;
+    complete: boolean;
+} | null;
+/**
+ * How a string is interpreted when it has no scheme. A `url` (fetch,
+ * WebSocket...) is relative to the document; a `specifier` (import) is a
+ * path only when it starts with `/`, `./` or `../`, and otherwise a bare
+ * package name resolved by the bundler or import map.
+ */
+export type TargetKind = "url" | "specifier";
+/**
+ * Resolve a URL-ish string, or a known prefix of one, to a host.
+ * Returns null when the host cannot be fixed from what is known.
+ */
+export declare function resolveTarget(text: string, complete?: boolean, kind?: TargetKind): string | null;
+/** Resolve the destination of an argument expression, or null. */
+export declare function resolveTargetOf(arg: AnyNode | undefined, kind?: TargetKind): string | null;
+//# sourceMappingURL=target.d.ts.map

package/dist/extract/target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../src/extract/target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAIxC,+DAA+D;AAC/D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4BvF;AAKD;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,WAAW,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,UAAO,EAAE,IAAI,GAAE,UAAkB,GAAG,MAAM,GAAG,IAAI,CAqBpG;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,GAAE,UAAkB,GAAG,MAAM,GAAG,IAAI,CAKjG"}

package/dist/extract/target.js

@@ -0,0 +1,81 @@
+import { FOLDED } from "./annotations.js";
+import { unwrap } from "./typescript.js";
+/** The target of a relative URL: the document's own origin. */
+export const SAME_ORIGIN = "same-origin";
+/** The known leading text of an expression, or null if it does not start with a literal. */
+export function leadingLiteral(raw) {
+    const node = unwrap(raw);
+    switch (node.type) {
+        case "Literal":
+            return typeof node["value"] === "string" ? { text: node["value"], complete: true } : null;
+        case "Identifier": {
+            // A const bound to a string literal, folded by the scope analysis.
+            const v = node[FOLDED];
+            return typeof v === "string" ? { text: v, complete: true } : null;
+        }
+        case "TemplateLiteral": {
+            const quasis = node["quasis"];
+            const exprs = node["expressions"];
+            const first = quasis[0]?.["value"]?.cooked ?? "";
+            return { text: first, complete: exprs.length === 0 };
+        }
+        case "BinaryExpression": {
+            if (node["operator"] !== "+")
+                return null;
+            const left = leadingLiteral(node["left"]);
+            if (left === null)
+                return null;
+            if (!left.complete)
+                return left;
+            const right = leadingLiteral(node["right"]);
+            if (right === null)
+                return { text: left.text, complete: false };
+            return { text: left.text + right.text, complete: right.complete };
+        }
+        default:
+            return null;
+    }
+}
+const ABSOLUTE = /^([a-z][a-z0-9+.-]*):/i;
+const AUTHORITY = /^(?:[a-z][a-z0-9+.-]*:)?\/\/(?:[^/?#@\s]*@)?([^/?#:\s]+)(?::\d+)?(?=[/?#]|$)/i;
+/**
+ * Resolve a URL-ish string, or a known prefix of one, to a host.
+ * Returns null when the host cannot be fixed from what is known.
+ */
+export function resolveTarget(text, complete = true, kind = "url") {
+    const t = text.trim();
+    if (t === "")
+        return null;
+    const m = AUTHORITY.exec(t);
+    if (m) {
+        // A prefix that ends inside the host cannot be trusted; `"https://api" + rest` might be api.evil.com.
+        const host = m[1];
+        const closed = complete || t.length > m[0].length;
+        return closed ? host.toLowerCase() : null;
+    }
+    if (t.startsWith("//"))
+        return null; // scheme-relative with an unfinished host
+    const scheme = ABSOLUTE.exec(t);
+    if (scheme) {
+        const s = scheme[1].toLowerCase();
+        if (s === "data" || s === "blob" || s === "javascript")
+            return `${s}:`;
+        if (s === "node" || s === "file")
+            return "bare"; // local to the runtime, not a network destination
+        return null; // some other scheme with no authority we understand
+    }
+    // No scheme and no authority.
+    if (kind === "url")
+        return SAME_ORIGIN;
+    return t.startsWith("/") || t.startsWith("./") || t.startsWith("../") ? SAME_ORIGIN : "bare";
+}
+/** Resolve the destination of an argument expression, or null. */
+export function resolveTargetOf(arg, kind = "url") {
+    if (!arg)
+        return null;
+    const lit = leadingLiteral(arg);
+    if (lit === null)
+        return null;
+    return resolveTarget(lit.text, lit.complete, kind);
+}
+//# sourceMappingURL=target.js.map

package/dist/extract/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../src/extract/target.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,mEAAmE;YACnE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAc,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAc,CAAC;YAC/C,MAAM,KAAK,GAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAqC,EAAE,MAAM,IAAI,EAAE,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC;YACrD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAChE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAC1C,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAUlG;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAQ,GAAG,IAAI,EAAE,OAAmB,KAAK;IACnF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC;QACN,sGAAsG;QACtG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC;QACvE,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,kDAAkD;QACnG,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACnE,CAAC;IACD,8BAA8B;IAC9B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IACvC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,GAAwB,EAAE,OAAmB,KAAK;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/extract/typescript.d.ts

@@ -0,0 +1,12 @@
+/**
+ * What TypeScript and JSX add to the tree, and how the walkers treat it.
+ * Type positions are never references: nothing in a type annotation runs.
+ * `declare` statements describe globals rather than create bindings. JSX
+ * element and attribute names are not identifiers.
+ */
+import type { AnyNode } from "./ast.js";
+/** True for a subtree that contributes no runtime code: types, signatures, `declare`, `import type`. */
+export declare function isTypeOnly(node: AnyNode): boolean;
+/** Strip `as`, `!`, `satisfies`, parentheses and the like. */
+export declare function unwrap(node: AnyNode): AnyNode;
+//# sourceMappingURL=typescript.d.ts.map

package/dist/extract/typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript.d.ts","sourceRoot":"","sources":["../../src/extract/typescript.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAyBxC,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgBjD;AAYD,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAI7C"}

package/dist/extract/typescript.js

@@ -0,0 +1,56 @@
+const TYPE_LEVEL = new Set([
+    "TSTypeAnnotation",
+    "TSInterfaceDeclaration",
+    "TSTypeAliasDeclaration",
+    "TSDeclareFunction",
+    "TSImportType",
+    "TSIndexSignature",
+    "TSPropertySignature",
+    "TSMethodSignature",
+    "TSCallSignatureDeclaration",
+    "TSConstructSignatureDeclaration",
+    "TSTypeParameterDeclaration",
+    "TSTypeParameterInstantiation",
+    "TSAbstractMethodDefinition",
+    "TSAbstractPropertyDefinition",
+    "TSAbstractAccessorProperty",
+    "TSInterfaceBody",
+    "TSInterfaceHeritage",
+    "TSClassImplements",
+    "TSExportAssignment",
+    "TSNamespaceExportDeclaration",
+]);
+/** True for a subtree that contributes no runtime code: types, signatures, `declare`, `import type`. */
+export function isTypeOnly(node) {
+    const t = node.type;
+    if (t.startsWith("TSType") || TYPE_LEVEL.has(t))
+        return true;
+    if (node["declare"] === true)
+        return true;
+    if ((t === "ImportDeclaration" || t === "ExportNamedDeclaration" || t === "ExportAllDeclaration") &&
+        node["exportKind"] === "type")
+        return true;
+    if (t === "ImportDeclaration" && node["importKind"] === "type")
+        return true;
+    if ((t === "ImportSpecifier" || t === "ExportSpecifier") &&
+        (node["importKind"] === "type" || node["exportKind"] === "type"))
+        return true;
+    return false;
+}
+/** Expression wrappers TypeScript adds around a value: the value is the `expression` child. */
+const VALUE_WRAPPERS = new Set([
+    "TSAsExpression",
+    "TSSatisfiesExpression",
+    "TSNonNullExpression",
+    "TSTypeAssertion",
+    "TSInstantiationExpression",
+    "ParenthesizedExpression",
+]);
+/** Strip `as`, `!`, `satisfies`, parentheses and the like. */
+export function unwrap(node) {
+    let n = node;
+    while (VALUE_WRAPPERS.has(n.type))
+        n = n["expression"];
+    return n;
+}
+//# sourceMappingURL=typescript.js.map

package/dist/extract/typescript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript.js","sourceRoot":"","sources":["../../src/extract/typescript.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,kBAAkB;IAClB,wBAAwB;IACxB,wBAAwB;IACxB,mBAAmB;IACnB,cAAc;IACd,kBAAkB;IAClB,qBAAqB;IACrB,mBAAmB;IACnB,4BAA4B;IAC5B,iCAAiC;IACjC,4BAA4B;IAC5B,8BAA8B;IAC9B,4BAA4B;IAC5B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,8BAA8B;CAC/B,CAAC,CAAC;AAEH,wGAAwG;AACxG,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1C,IACE,CAAC,CAAC,KAAK,mBAAmB,IAAI,CAAC,KAAK,wBAAwB,IAAI,CAAC,KAAK,sBAAsB,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,KAAK,MAAM;QAE7B,OAAO,IAAI,CAAC;IACd,IAAI,CAAC,KAAK,mBAAmB,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5E,IACE,CAAC,CAAC,KAAK,iBAAiB,IAAI,CAAC,KAAK,iBAAiB,CAAC;QACpD,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC;QAEhE,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;IACrB,iBAAiB;IACjB,2BAA2B;IAC3B,yBAAyB;CAC1B,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAY,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/extract/walk.d.ts

@@ -0,0 +1,14 @@
+import { type Node } from "./ast.js";
+export interface Visit {
+    node: Node;
+    /** Nearest ancestor first. */
+    ancestors: readonly Node[];
+    /** True when this node is (inside) a binding position: a declared name, parameter, pattern, or import. */
+    binding: boolean;
+}
+/**
+ * Pre-order walk of the tree, skipping type-only subtrees. `Visit.ancestors`
+ * is a live array (nearest first) that is only valid during the callback.
+ */
+export declare function walk(root: Node, visit: (v: Visit) => void): void;
+//# sourceMappingURL=walk.d.ts.map

package/dist/extract/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/extract/walk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC;AAG3D,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,8BAA8B;IAC9B,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC;IAC3B,0GAA0G;IAC1G,OAAO,EAAE,OAAO,CAAC;CAClB;AAoCD;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAyBhE"}

package/dist/extract/walk.js

@@ -0,0 +1,70 @@
+import { isNode } from "./ast.js";
+import { isTypeOnly } from "./typescript.js";
+/**
+ * Child keys that introduce bindings rather than references. An Identifier
+ * reached through one of these keys names something; it does not use it.
+ */
+const BINDING_KEYS = {
+    VariableDeclarator: new Set(["id"]),
+    FunctionDeclaration: new Set(["id", "params"]),
+    FunctionExpression: new Set(["id", "params"]),
+    ArrowFunctionExpression: new Set(["params"]),
+    ClassDeclaration: new Set(["id"]),
+    ClassExpression: new Set(["id"]),
+    CatchClause: new Set(["param"]),
+    ImportSpecifier: new Set(["local", "imported"]),
+    ImportDefaultSpecifier: new Set(["local"]),
+    ImportNamespaceSpecifier: new Set(["local"]),
+    ExportSpecifier: new Set(["exported"]),
+    LabeledStatement: new Set(["label"]),
+    BreakStatement: new Set(["label"]),
+    ContinueStatement: new Set(["label"]),
+    TSEnumDeclaration: new Set(["id"]),
+    TSEnumMember: new Set(["id"]),
+    TSModuleDeclaration: new Set(["id"]),
+    TSParameterProperty: new Set(["parameter"]),
+};
+/** Non-computed keys are names, not references, under these parents. */
+const NAME_KEYS = {
+    MemberExpression: "property",
+    Property: "key",
+    MethodDefinition: "key",
+    PropertyDefinition: "key",
+    AccessorProperty: "key",
+};
+/**
+ * Pre-order walk of the tree, skipping type-only subtrees. `Visit.ancestors`
+ * is a live array (nearest first) that is only valid during the callback.
+ */
+export function walk(root, visit) {
+    const ancestors = [];
+    const go = (node, binding) => {
+        if (isTypeOnly(node))
+            return;
+        visit({ node, ancestors, binding });
+        ancestors.unshift(node);
+        const bindingKeys = BINDING_KEYS[node.type];
+        const nameKey = NAME_KEYS[node.type];
+        for (const key of Object.keys(node)) {
+            if (key === "type" || key === "start" || key === "end")
+                continue;
+            const value = node[key];
+            const childBinding = binding || (bindingKeys?.has(key) ?? false);
+            // A non-computed property name is never a reference; skip it outright.
+            if (key === nameKey && node["computed"] !== true && isNode(value) && value.type === "Identifier") {
+                continue;
+            }
+            if (Array.isArray(value)) {
+                for (const item of value)
+                    if (isNode(item))
+                        go(item, childBinding);
+            }
+            else if (isNode(value)) {
+                go(value, childBinding);
+            }
+        }
+        ancestors.shift();
+    };
+    go(root, false);
+}
+//# sourceMappingURL=walk.js.map

package/dist/extract/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../src/extract/walk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA2B,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAU7C;;;GAGG;AACH,MAAM,YAAY,GAAwC;IACxD,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACnC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAChC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/B,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,sBAAsB,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,wBAAwB,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5C,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACpC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAClC,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACpC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;CAC5C,CAAC;AAEF,wEAAwE;AACxE,MAAM,SAAS,GAA2B;IACxC,gBAAgB,EAAE,UAAU;IAC5B,QAAQ,EAAE,KAAK;IACf,gBAAgB,EAAE,KAAK;IACvB,kBAAkB,EAAE,KAAK;IACzB,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,IAAI,CAAC,IAAU,EAAE,KAAyB;IACxD,MAAM,SAAS,GAAW,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,IAAa,EAAE,OAAgB,EAAQ,EAAE;QACnD,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;YACjE,uEAAuE;YACvE,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjG,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,IAAI,MAAM,CAAC,IAAI,CAAC;wBAAE,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;IACF,EAAE,CAAC,IAAe,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { VERSION } from "./version.js";
+export { run, type Io } from "./cli/run.js";
+export { default as eslintPlugin, capabilityRule } from "./eslint.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { VERSION } from "./version.js";
+export { run } from "./cli/run.js";
+export { default as eslintPlugin, capabilityRule } from "./eslint.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,GAAG,EAAW,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/init.d.ts

@@ -0,0 +1,10 @@
+import type { CapabilityUse } from "./extract/capability.js";
+/**
+ * The text of a starter policy for these uses. `uses` carry paths relative
+ * to the directory the policy will live in. Only certain and probable uses
+ * count; possible ones never fail a build and are left for the person.
+ */
+export declare function starterPolicy(name: string, uses: readonly CapabilityUse[], today: string): string;
+/** A policy name from the directory it lives in. */
+export declare function policyNameFor(dir: string): string;
+//# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAsB7D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAyCjG;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/init.js

@@ -0,0 +1,79 @@
+/**
+ * `frostjs init`: write a starter policy that grants exactly what the code
+ * does today, so the first run passes and every later change is a
+ * visible decision. The generated file is meant to be read and pruned:
+ * each grant says where it is used, a capability used in only a few files
+ * is scoped to them, and an unreadable network destination is called out
+ * rather than quietly widened to the whole network.
+ */
+import path from "node:path";
+import { CAPABILITY_PHRASES } from "./policy/vocabulary.js";
+/** Scope a grant to its files when it is used in no more than this many. */
+const SCOPE_UP_TO = 3;
+/** The friendliest phrase for a code, else the code. */
+function phraseFor(code) {
+    for (const [phrase, c] of CAPABILITY_PHRASES)
+        if (c === code)
+            return phrase;
+    return code;
+}
+function where(files) {
+    const shown = files.slice(0, SCOPE_UP_TO);
+    const more = files.length - shown.length;
+    return `used in ${shown.join(", ")}${more > 0 ? ` and ${more} more` : ""}`;
+}
+function scope(files) {
+    return files.length <= SCOPE_UP_TO ? ` in ${files.map((f) => `"${f}"`).join(", ")}` : "";
+}
+/**
+ * The text of a starter policy for these uses. `uses` carry paths relative
+ * to the directory the policy will live in. Only certain and probable uses
+ * count; possible ones never fail a build and are left for the person.
+ */
+export function starterPolicy(name, uses, today) {
+    const counted = uses.filter((u) => u.confidence !== "possible" && !u.suppressed);
+    const lines = [
+        `policy "${name}"`,
+        `-- Written by frostjs init on ${today} from what the code does today.`,
+        "-- Every line below is a grant. Delete the ones that should not be",
+        "-- allowed and the build will start refusing them. Add an expiry",
+        "-- (until YYYY-MM-DD) to anything that is meant to go away.",
+        "",
+    ];
+    // Network: known destinations become `may reach`; anything unreadable
+    // needs `may use the network`, which the hint says how to narrow.
+    const net = counted.filter((u) => u.capability.startsWith("network."));
+    if (net.length > 0) {
+        const hosts = [...new Set(net.map((u) => u.target).filter((t) => t !== null))].sort();
+        const unknown = net.filter((u) => u.target === null);
+        const netFiles = [...new Set(net.map((u) => u.file))].sort();
+        if (unknown.length === 0) {
+            lines.push(`may reach ${hosts.map((h) => `"${h}"`).join(", ")}${scope(netFiles)}   -- ${where(netFiles)}`);
+        }
+        else {
+            const hint = `${unknown.length} ${unknown.length === 1 ? "use" : "uses"} whose destination cannot be read; narrow this to: may reach ${hosts.length ? hosts.map((h) => `"${h}"`).join(", ") : '"host"'}`;
+            lines.push(`may use the network${scope(netFiles)}   -- ${hint}`);
+        }
+    }
+    // Everything else: one grant per member code, scoped when used in few files.
+    const byCode = new Map();
+    for (const u of counted) {
+        if (u.capability.startsWith("network."))
+            continue;
+        if (!byCode.has(u.capability))
+            byCode.set(u.capability, new Set());
+        byCode.get(u.capability).add(u.file);
+    }
+    for (const [code, fileSet] of [...byCode].sort(([a], [b]) => a.localeCompare(b))) {
+        const files = [...fileSet].sort();
+        lines.push(`may use ${phraseFor(code)}${scope(files)}   -- ${where(files)}`);
+    }
+    if (lines.length === 6)
+        lines.push("-- Nothing found: the code uses no capability frostjs recognizes. Every grant is off.");
+    return lines.join("\n") + "\n";
+}
+/** A policy name from the directory it lives in. */
+export function policyNameFor(dir) {
+    return path.basename(path.resolve(dir)) || "project";
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,wDAAwD;AACxD,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,kBAAkB;QAAE,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACzC,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,KAAK,CAAC,KAAwB;IACrC,OAAO,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAA8B,EAAE,KAAa;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjF,MAAM,KAAK,GAAa;QACtB,WAAW,IAAI,GAAG;QAClB,iCAAiC,KAAK,iCAAiC;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,6DAA6D;QAC7D,EAAE;KACH,CAAC;IAEF,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnG,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,gEAAgE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzM,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC;AACvD,CAAC"}

package/dist/policy/compile.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Compile a parsed policy into the ruleset the gate runs. Three rules
+ * decide everything:
+ *
+ * - `forbid` always wins over `may`, whatever the order in the file.
+ * - A grant with `until` stops granting the day after its date; inside the
+ *   warning window it produces a printable warning.
+ * - A host list (`may reach`, `forbid reaching`) matches a known
+ *   destination by pattern. A destination that cannot be read from the
+ *   code cannot be shown to match, so a forbid does not fire on it and a
+ *   grant does not cover it: cannot be shown to be allowed is not allowed.
+ */
+import type { CapabilityUse } from "../extract/capability.js";
+import { type ParsedPolicy, type Rule } from "./parse.js";
+/**
+ * Why a use was allowed or denied. `unregistered` is produced by
+ * `decide()` for vendored files the registry does not know, never by
+ * `compile()`.
+ */
+export type Reason = "granted" | "forbidden" | "expired" | "not granted" | "unknown destination" | "unregistered";
+export interface Evaluation {
+    verdict: "allowed" | "denied";
+    reason: Reason;
+    /** The rule that decided it; null when nothing in the policy applied. */
+    rule: Rule | null;
+}
+export interface Policy {
+    name: string;
+    file: string;
+    /** The date the policy was compiled against, YYYY-MM-DD; expiry and warnings are relative to it. */
+    today: string;
+    rules: readonly Rule[];
+    /** Globs of vendored files, relative to the policy directory. */
+    vendored: readonly string[];
+    /** Globs of files not analyzed at all, relative to the policy directory. */
+    ignore: readonly string[];
+    /** Grants that expire within the warning window, as printable lines. */
+    warnings: readonly string[];
+    /** `use.file` must be relative to the policy file's directory. */
+    evaluate(use: CapabilityUse): Evaluation;
+}
+export interface CompileOptions {
+    /** ISO date, YYYY-MM-DD. Injected so runs are reproducible and testable. */
+    today: string;
+    /** Days before expiry at which a grant starts warning. Default 14. */
+    warnDays?: number;
+}
+/** True when a grant's `until` date is before `today`. ISO strings compare correctly. */
+export declare function isExpired(rule: Rule, today: string): boolean;
+/** Compile a parsed policy against a date. See the module comment for the rules. */
+export declare function compile(parsed: ParsedPolicy, opts: CompileOptions): Policy;
+/** "*" matches all; a family matches itself and its members; a code matches exactly. */
+export declare function matchesCapability(pattern: string, capability: string): boolean;
+/** Host patterns: `*` spans any characters including dots; the match is whole-host and case-insensitive. */
+export declare function matchesHost(pattern: string, host: string): boolean;
+//# sourceMappingURL=compile.d.ts.map

package/dist/policy/compile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.d.ts","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAO,KAAK,YAAY,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAElH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,iEAAiE;IACjE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,CAsD1E;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,4GAA4G;AAC5G,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE"}

package/dist/policy/compile.js

@@ -0,0 +1,78 @@
+import { escapeRegExp, matchesGlob } from "./glob.js";
+import { ymd } from "./parse.js";
+/** True when a grant's `until` date is before `today`. ISO strings compare correctly. */
+export function isExpired(rule, today) {
+    return rule.until !== null && rule.until < today;
+}
+/** Compile a parsed policy against a date. See the module comment for the rules. */
+export function compile(parsed, opts) {
+    const { today } = opts;
+    const warnDays = opts.warnDays ?? 14;
+    const forbids = parsed.rules.filter((r) => r.verb === "forbid" && r.capability !== "*");
+    const grants = parsed.rules.filter((r) => r.verb === "may");
+    const expired = new Set(grants.filter((r) => isExpired(r, today)));
+    const warnings = [];
+    for (const r of grants) {
+        if (r.until === null)
+            continue;
+        const days = daysBetween(today, r.until);
+        if (days < 0 || days > warnDays)
+            continue;
+        const when = days === 0 ? "today" : `in ${days} ${days === 1 ? "day" : "days"}`;
+        warnings.push(`${parsed.file} line ${r.line}: "${r.text}" expires ${when}`);
+    }
+    return {
+        name: parsed.name,
+        file: parsed.file,
+        today,
+        rules: parsed.rules,
+        vendored: parsed.vendored,
+        ignore: parsed.ignore,
+        warnings,
+        evaluate(use) {
+            const target = use.target;
+            const inScope = (r) => matchesCapability(r.capability, use.capability) &&
+                (r.paths.length === 0 || r.paths.some((p) => matchesGlob(p, use.file)));
+            const hostMatches = (r) => r.hosts.length === 0 || (target !== null && r.hosts.some((h) => matchesHost(h, target)));
+            const forbid = forbids.find((r) => inScope(r) && hostMatches(r));
+            if (forbid)
+                return { verdict: "denied", reason: "forbidden", rule: forbid };
+            let expiredGrant = null;
+            let hostListed = null;
+            for (const g of grants) {
+                if (!inScope(g))
+                    continue;
+                if (expired.has(g)) {
+                    expiredGrant ??= g;
+                    continue;
+                }
+                if (!hostMatches(g)) {
+                    if (target === null)
+                        hostListed ??= g;
+                    continue;
+                }
+                return { verdict: "allowed", reason: "granted", rule: g };
+            }
+            if (hostListed)
+                return { verdict: "denied", reason: "unknown destination", rule: hostListed };
+            if (expiredGrant)
+                return { verdict: "denied", reason: "expired", rule: expiredGrant };
+            return { verdict: "denied", reason: "not granted", rule: null };
+        },
+    };
+}
+/** "*" matches all; a family matches itself and its members; a code matches exactly. */
+export function matchesCapability(pattern, capability) {
+    return pattern === "*" || pattern === capability || capability.startsWith(pattern + ".");
+}
+/** Host patterns: `*` spans any characters including dots; the match is whole-host and case-insensitive. */
+export function matchesHost(pattern, host) {
+    const rx = "^" + pattern.toLowerCase().split("*").map(escapeRegExp).join(".*") + "$";
+    return new RegExp(rx).test(host.toLowerCase());
+}
+/** Whole days from `from` to `to`; negative when `to` is in the past. */
+function daysBetween(from, to) {
+    const ms = Date.UTC(...ymd(to)) - Date.UTC(...ymd(from));
+    return Math.round(ms / 86_400_000);
+}
+//# sourceMappingURL=compile.js.map

package/dist/policy/compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,GAAG,EAAgC,MAAM,YAAY,CAAC;AAuC/D,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAAU,EAAE,KAAa;IACjD,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;AACnD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,OAAO,CAAC,MAAoB,EAAE,IAAoB;IAChE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,aAAa,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,QAAQ,CAAC,GAAG;YACV,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,CAAO,EAAW,EAAE,CACnC,iBAAiB,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;gBAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1E,MAAM,WAAW,GAAG,CAAC,CAAO,EAAW,EAAE,CACvC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAE3F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAE5E,IAAI,YAAY,GAAgB,IAAI,CAAC;YACrC,IAAI,UAAU,GAAgB,IAAI,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnB,YAAY,KAAK,CAAC,CAAC;oBACnB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpB,IAAI,MAAM,KAAK,IAAI;wBAAE,UAAU,KAAK,CAAC,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,CAAC;YACD,IAAI,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9F,IAAI,YAAY;gBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,UAAkB;IACnE,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,EAAE,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACrF,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;AACrC,CAAC"}

package/dist/policy/config.d.ts

@@ -0,0 +1,18 @@
+import { type Policy } from "./compile.js";
+export declare const POLICY_FILENAME = "frostjs.policy";
+/** The deepest directory containing every input (a file counts as its directory). */
+export declare function commonAncestor(inputs: readonly string[]): string;
+/**
+ * Walk up from `start` looking for frostjs.policy. `stopAt`, when given, is the
+ * last directory searched. Returns the absolute path or null.
+ */
+export declare function findPolicyFile(start: string, stopAt?: string): string | null;
+/** Today as YYYY-MM-DD, the form every expiry check uses. */
+export declare function isoToday(): string;
+/**
+ * Read and compile a policy file. Throws PolicyError when it cannot be
+ * read as a policy, or a plain Error when the file cannot be read at all.
+ * `shownAs` is the name used in messages, typically relative to the cwd.
+ */
+export declare function compilePolicyFile(policyFile: string, today: string, shownAs?: string): Policy;
+//# sourceMappingURL=config.d.ts.map

package/dist/policy/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/policy/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAGpD,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAEhD,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAoBhE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW5E;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,MAAmB,GAAG,MAAM,CAQzG"}