@keithadler/frostjs 0.1.0

package/dist/policy/config.js

@@ -0,0 +1,70 @@
+/** Finding and loading the policy file. */
+import fs from "node:fs";
+import path from "node:path";
+import { compile } from "./compile.js";
+import { parsePolicy } from "./parse.js";
+export const POLICY_FILENAME = "frostjs.policy";
+/** The deepest directory containing every input (a file counts as its directory). */
+export function commonAncestor(inputs) {
+    const dirs = inputs.map((p) => {
+        const abs = path.resolve(p);
+        let isDir = false;
+        try {
+            isDir = fs.statSync(abs).isDirectory();
+        }
+        catch {
+            // A missing path is reported by discover(); treat it as a file here.
+        }
+        return isDir ? abs : path.dirname(abs);
+    });
+    if (dirs.length === 0)
+        return process.cwd();
+    let common = dirs[0].split(path.sep);
+    for (const d of dirs.slice(1)) {
+        const parts = d.split(path.sep);
+        let i = 0;
+        while (i < common.length && i < parts.length && common[i] === parts[i])
+            i++;
+        common = common.slice(0, i);
+    }
+    return common.join(path.sep) || path.sep;
+}
+/**
+ * Walk up from `start` looking for frostjs.policy. `stopAt`, when given, is the
+ * last directory searched. Returns the absolute path or null.
+ */
+export function findPolicyFile(start, stopAt) {
+    let dir = path.resolve(start);
+    const stop = stopAt ? path.resolve(stopAt) : null;
+    for (;;) {
+        const candidate = path.join(dir, POLICY_FILENAME);
+        if (fs.existsSync(candidate))
+            return candidate;
+        if (dir === stop)
+            return null;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** Today as YYYY-MM-DD, the form every expiry check uses. */
+export function isoToday() {
+    return new Date().toISOString().slice(0, 10);
+}
+/**
+ * Read and compile a policy file. Throws PolicyError when it cannot be
+ * read as a policy, or a plain Error when the file cannot be read at all.
+ * `shownAs` is the name used in messages, typically relative to the cwd.
+ */
+export function compilePolicyFile(policyFile, today, shownAs = policyFile) {
+    let source;
+    try {
+        source = fs.readFileSync(policyFile, "utf8");
+    }
+    catch (e) {
+        throw new Error(`cannot read policy ${shownAs}: ${e.code ?? e.message}`);
+    }
+    return compile(parsePolicy(source, shownAs), { today });
+}
+//# sourceMappingURL=config.js.map

package/dist/policy/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/policy/config.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5C,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAe;IAC3D,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,KAAa,EAAE,UAAkB,UAAU;IAC/F,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,KAAM,CAA2B,CAAC,IAAI,IAAK,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/policy/csp.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Derive a Content-Security-Policy header from a compiled policy. CSP is
+ * the runtime backstop; this is the build-time gate. Only directives the
+ * policy actually determines are emitted:
+ *
+ *   connect-src  from `may reach` hosts; `may use the network` means *;
+ *                nothing granted means 'none'
+ *   script-src   'self', plus 'unsafe-eval' when code generation is granted,
+ *                plus any `may reach` hosts when dynamic import is granted
+ *   worker-src   'self' plus `may reach` hosts when workers are granted
+ *
+ * Path-scoped grants still count: a header covers the whole page. Expired
+ * grants do not. Forbids narrow nothing here, since CSP cannot express
+ * "everything except"; the build-time gate enforces those.
+ */
+import { type Policy } from "./compile.js";
+/** The Content-Security-Policy header string the policy implies, for the date it was compiled against. */
+export declare function csp(policy: Policy): string;
+//# sourceMappingURL=csp.d.ts.map

package/dist/policy/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/policy/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAgC,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAGzE,0GAA0G;AAC1G,wBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA2B1C"}

package/dist/policy/csp.js

@@ -0,0 +1,47 @@
+/**
+ * Derive a Content-Security-Policy header from a compiled policy. CSP is
+ * the runtime backstop; this is the build-time gate. Only directives the
+ * policy actually determines are emitted:
+ *
+ *   connect-src  from `may reach` hosts; `may use the network` means *;
+ *                nothing granted means 'none'
+ *   script-src   'self', plus 'unsafe-eval' when code generation is granted,
+ *                plus any `may reach` hosts when dynamic import is granted
+ *   worker-src   'self' plus `may reach` hosts when workers are granted
+ *
+ * Path-scoped grants still count: a header covers the whole page. Expired
+ * grants do not. Forbids narrow nothing here, since CSP cannot express
+ * "everything except"; the build-time gate enforces those.
+ */
+import { isExpired, matchesCapability } from "./compile.js";
+import { SAME_ORIGIN } from "../extract/target.js";
+/** The Content-Security-Policy header string the policy implies, for the date it was compiled against. */
+export function csp(policy) {
+    const rules = policy.rules.filter((r) => r.verb === "may" && !isExpired(r, policy.today));
+    const granted = (capability) => rules.some((r) => matchesCapability(r.capability, capability));
+    const directives = [];
+    // connect-src
+    const net = rules.filter((r) => matchesCapability(r.capability, "network.fetch"));
+    const anyDestination = net.some((r) => r.hosts.length === 0);
+    const hosts = [...new Set(net.flatMap((r) => r.hosts.map((h) => (h === SAME_ORIGIN ? "'self'" : h))))];
+    if (anyDestination)
+        directives.push("connect-src *");
+    else if (hosts.length > 0)
+        directives.push(`connect-src ${hosts.join(" ")}`);
+    else
+        directives.push("connect-src 'none'");
+    /** 'self' plus every reachable host, or * when any destination is granted. */
+    const selfAndHosts = () => ["'self'", ...(anyDestination ? ["*"] : hosts.filter((h) => h !== "'self'"))].join(" ");
+    // script-src
+    let script = "'self'";
+    if (granted("codegen.eval") || granted("codegen.function"))
+        script += " 'unsafe-eval'";
+    if (granted("network.import"))
+        script += selfAndHosts().slice("'self'".length);
+    directives.push(`script-src ${script}`);
+    // worker-src
+    if (granted("worker.dedicated") || granted("worker.service"))
+        directives.push(`worker-src ${selfAndHosts()}`);
+    return directives.join("; ");
+}
+//# sourceMappingURL=csp.js.map

package/dist/policy/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../src/policy/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAe,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,0GAA0G;AAC1G,MAAM,UAAU,GAAG,CAAC,MAAc;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,CAAC,UAAkB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAChH,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,cAAc;IACd,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,IAAI,cAAc;QAAE,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;SAChD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;;QACxE,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAE3C,8EAA8E;IAC9E,MAAM,YAAY,GAAG,GAAW,EAAE,CAChC,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE1F,aAAa;IACb,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC;IACvF,IAAI,OAAO,CAAC,gBAAgB,CAAC;QAAE,MAAM,IAAI,YAAY,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/E,UAAU,CAAC,IAAI,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;IAExC,aAAa;IACb,IAAI,OAAO,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,YAAY,EAAE,EAAE,CAAC,CAAC;IAE9G,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/policy/glob.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Path globs for policy scoping. Deliberately small: `*` within a segment,
+ * `**` across segments, `?` one character. Patterns and paths are compared
+ * with forward slashes. A pattern with no slash matches the basename at any
+ * depth (gitignore style); a plain path with no glob characters also
+ * matches everything beneath it, so `in "src/legacy"` reads naturally.
+ */
+/** Escape a string for literal use inside a RegExp. */
+export declare function escapeRegExp(s: string): string;
+/** True when `file` (a path relative to the policy directory) matches the glob. */
+export declare function matchesGlob(pattern: string, file: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/policy/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../src/policy/glob.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,uDAAuD;AACvD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CASlE"}

package/dist/policy/glob.js

@@ -0,0 +1,63 @@
+/**
+ * Path globs for policy scoping. Deliberately small: `*` within a segment,
+ * `**` across segments, `?` one character. Patterns and paths are compared
+ * with forward slashes. A pattern with no slash matches the basename at any
+ * depth (gitignore style); a plain path with no glob characters also
+ * matches everything beneath it, so `in "src/legacy"` reads naturally.
+ */
+const cache = new Map();
+/** Escape a string for literal use inside a RegExp. */
+export function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** True when `file` (a path relative to the policy directory) matches the glob. */
+export function matchesGlob(pattern, file) {
+    const pat = normalize(pattern);
+    const path = normalize(file);
+    let rx = cache.get(pat);
+    if (!rx) {
+        rx = toRegExp(pat);
+        cache.set(pat, rx);
+    }
+    return rx.test(path);
+}
+function normalize(p) {
+    let s = p.replace(/\\/g, "/");
+    while (s.startsWith("./"))
+        s = s.slice(2);
+    return s.replace(/\/+$/, "");
+}
+function toRegExp(pat) {
+    const hasGlob = /[*?]/.test(pat);
+    const anyDepth = !pat.includes("/");
+    let out = "";
+    for (let i = 0; i < pat.length; i++) {
+        const ch = pat[i];
+        if (ch === "*") {
+            if (pat[i + 1] === "*") {
+                // `**/` matches zero or more whole segments; a trailing `**` matches the rest.
+                if (pat[i + 2] === "/") {
+                    out += "(?:.*/)?";
+                    i += 2;
+                }
+                else {
+                    out += ".*";
+                    i += 1;
+                }
+            }
+            else {
+                out += "[^/]*";
+            }
+        }
+        else if (ch === "?") {
+            out += "[^/]";
+        }
+        else {
+            out += escapeRegExp(ch);
+        }
+    }
+    const prefix = anyDepth ? "^(?:.*/)?" : "^";
+    const suffix = hasGlob ? "$" : "(?:/.*)?$";
+    return new RegExp(prefix + out + suffix);
+}
+//# sourceMappingURL=glob.js.map

package/dist/policy/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../src/policy/glob.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExC,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,+EAA+E;gBAC/E,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACvB,GAAG,IAAI,UAAU,CAAC;oBAClB,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,GAAG,IAAI,IAAI,CAAC;oBACZ,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,IAAI,MAAM,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IAC3C,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The policy stage: parse a frostjs.policy, compile it, and decide each
+ * CapabilityUse. Everything outside this directory imports from here.
+ */
+import type { CapabilityUse, Confidence } from "../extract/capability.js";
+import { type Policy, type Reason } from "./compile.js";
+import type { Rule } from "./parse.js";
+export { compile, isExpired, matchesCapability, type Policy, type Evaluation, type Reason } from "./compile.js";
+export { parsePolicy, PolicyError, type ParsedPolicy, type Rule } from "./parse.js";
+export { commonAncestor, compilePolicyFile, findPolicyFile, isoToday, POLICY_FILENAME } from "./config.js";
+export { matchesGlob } from "./glob.js";
+export { csp } from "./csp.js";
+export type { Confidence } from "../extract/capability.js";
+/**
+ * What became of a use. `allowed` and `denied` come from the policy;
+ * `unknown` is a use below the confidence floor (listed, never failing);
+ * `suppressed` has an inline `frostjs: ignore`; `baselined` is on record in
+ * the baseline file; `unchanged` sits outside the lines a `--changed-since`
+ * diff touched. Only `denied` fails the build.
+ */
+export type Verdict = "allowed" | "denied" | "unknown" | "suppressed" | "baselined" | "unchanged";
+export interface Decision {
+    use: CapabilityUse;
+    verdict: Verdict;
+    reason: Reason | null;
+    /** The policy rule that decided it, or null for the implicit deny or for unknown. */
+    rule: Rule | null;
+}
+/** The policy used when no frostjs.policy exists: nothing is granted. */
+export declare const DENY_ALL: Policy;
+/** Confidence tiers, lowest first. */
+export declare const CONFIDENCE_ORDER: readonly Confidence[];
+/** Uses below this confidence are reported as unknown and never fail the build. */
+export declare const DEFAULT_MIN_CONFIDENCE: Confidence;
+export interface DecideOptions {
+    /** Map a use's reported path to the path the policy's globs should see. */
+    scopePath?: (use: CapabilityUse) => string;
+    minConfidence?: Confidence;
+}
+/**
+ * Decide every use against the policy. Allowed uses are allowed at any
+ * confidence; a denied use is then suppressed, unknown (below the floor),
+ * or denied. An unregistered vendored file is denied whatever the policy
+ * says, since no grant can admit a hash nobody reviewed.
+ */
+export declare function decide(uses: readonly CapabilityUse[], policy: Policy, opts?: DecideOptions): Decision[];
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAW,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,MAAM,EAAE,KAAK,UAAU,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,CAAC;AAElG,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qFAAqF;IACrF,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;CACnB;AAED,yEAAyE;AACzE,eAAO,MAAM,QAAQ,EAAE,MAGtB,CAAC;AAEF,sCAAsC;AACtC,eAAO,MAAM,gBAAgB,EAAE,SAAS,UAAU,EAAwC,CAAC;AAC3F,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,EAAE,UAAuB,CAAC;AAE7D,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,MAAM,CAAC;IAC3C,aAAa,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,QAAQ,EAAE,CAU3G"}

package/dist/policy/index.js

@@ -0,0 +1,34 @@
+import { compile } from "./compile.js";
+export { compile, isExpired, matchesCapability } from "./compile.js";
+export { parsePolicy, PolicyError } from "./parse.js";
+export { commonAncestor, compilePolicyFile, findPolicyFile, isoToday, POLICY_FILENAME } from "./config.js";
+export { matchesGlob } from "./glob.js";
+export { csp } from "./csp.js";
+/** The policy used when no frostjs.policy exists: nothing is granted. */
+export const DENY_ALL = compile({ file: "(no policy)", name: "deny-all", rules: [], vendored: [], ignore: [] }, { today: "1970-01-01" });
+/** Confidence tiers, lowest first. */
+export const CONFIDENCE_ORDER = ["possible", "probable", "certain"];
+/** Uses below this confidence are reported as unknown and never fail the build. */
+export const DEFAULT_MIN_CONFIDENCE = "probable";
+/**
+ * Decide every use against the policy. Allowed uses are allowed at any
+ * confidence; a denied use is then suppressed, unknown (below the floor),
+ * or denied. An unregistered vendored file is denied whatever the policy
+ * says, since no grant can admit a hash nobody reviewed.
+ */
+export function decide(uses, policy, opts = {}) {
+    const floor = CONFIDENCE_ORDER.indexOf(opts.minConfidence ?? DEFAULT_MIN_CONFIDENCE);
+    return uses.map((use) => {
+        if (use.capability === "vendor.unregistered")
+            return { use, verdict: "denied", reason: "unregistered", rule: null };
+        const e = policy.evaluate(opts.scopePath ? { ...use, file: opts.scopePath(use) } : use);
+        if (e.verdict === "allowed")
+            return { use, verdict: "allowed", reason: e.reason, rule: e.rule };
+        if (use.suppressed)
+            return { use, verdict: "suppressed", reason: null, rule: null };
+        if (CONFIDENCE_ORDER.indexOf(use.confidence) < floor)
+            return { use, verdict: "unknown", reason: null, rule: null };
+        return { use, verdict: "denied", reason: e.reason, rule: e.rule };
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAA4B,MAAM,cAAc,CAAC;AAGjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAA6C,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAgC,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAoB/B,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAW,OAAO,CACrC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAC9E,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;AAEF,sCAAsC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3F,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAe,UAAU,CAAC;AAQ7D;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAA8B,EAAE,MAAc,EAAE,OAAsB,EAAE;IAC7F,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,UAAU,KAAK,qBAAqB;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACpH,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxF,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChG,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACpF,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/policy/parse.d.ts

@@ -0,0 +1,51 @@
+export type Verb = "may" | "forbid";
+export interface Rule {
+    verb: Verb;
+    /** Capability code or family, or "*" for everything. */
+    capability: string;
+    /** For `may reach` / `forbid reaching`: host patterns. Empty means any destination. */
+    hosts: string[];
+    /** Path globs the rule is scoped to; empty means everywhere. */
+    paths: string[];
+    /** ISO date (YYYY-MM-DD) after which a `may` rule no longer grants, or null. */
+    until: string | null;
+    /** The trailing comment, if any. */
+    hint: string;
+    /** 1-based line in the policy file, for reports. */
+    line: number;
+    /** The rule text as written, trimmed, without its comment. */
+    text: string;
+}
+export interface ParsedPolicy {
+    file: string;
+    name: string;
+    rules: Rule[];
+    /** Globs, relative to the policy directory, of third-party files checked by fingerprint rather than analyzed. */
+    vendored: string[];
+    /** Globs, relative to the policy directory, of files not analyzed at all (generated bundles, fixtures). */
+    ignore: string[];
+}
+/**
+ * A policy that cannot be read. The message carries file, line, the source
+ * line with a caret under the column, and what to try instead.
+ */
+export declare class PolicyError extends Error {
+    readonly file: string;
+    readonly line: number;
+    /** 1-based. */
+    readonly column: number;
+    readonly detail: string;
+    readonly source: string;
+    readonly tryInstead?: string | undefined;
+    constructor(file: string, line: number, 
+    /** 1-based. */
+    column: number, detail: string, source: string, tryInstead?: string | undefined);
+}
+/**
+ * Parse a policy file's text. Throws PolicyError at the first line that
+ * cannot be read; `file` is used only in messages.
+ */
+export declare function parsePolicy(text: string, file: string): ParsedPolicy;
+/** Year, month (0-based) and day of a validated YYYY-MM-DD string. */
+export declare function ymd(s: string): [number, number, number];
+//# sourceMappingURL=parse.d.ts.map

package/dist/policy/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/policy/parse.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,IAAI,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEpC,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gEAAgE;IAChE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,iHAAiH;IACjH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2GAA2G;IAC3G,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAElB,IAAI,EAAE,MAAM;aACZ,IAAI,EAAE,MAAM;IAC5B,eAAe;aACC,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;aACd,MAAM,EAAE,MAAM;aACd,UAAU,CAAC,EAAE,MAAM;gBANnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;IAC5B,eAAe;IACC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,YAAA;CAQtC;AAiCD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAsCpE;AAkLD,sEAAsE;AACtE,wBAAgB,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAGvD"}