@mirasen/license-gate 1.0.0

package/dist/graph/load.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Graph layer — owns filesystem and Arborist concerns.
+ * Knows nothing about policy.
+ */
+import Arborist from '@npmcli/arborist';
+/**
+ * Load the installed dependency graph from the **selected project root**.
+ * The selected project root is whatever the caller passes in (typically
+ * `--cwd <path>` from the CLI, or the `cwd` option in the programmatic API);
+ * when omitted it defaults to `process.cwd()`. license-gate never walks
+ * upward to rescue a wrong working directory — `package.json` must exist
+ * directly at the selected project root, otherwise `LicenseGateConfigError`.
+ *
+ * Returns the Arborist `tree` (the root Node). Iterate `tree.inventory.values()`
+ * for the flat list of unique installed copies.
+ */
+export declare function loadInstalledGraph(cwd?: string): Promise<Arborist.Node>;

package/dist/graph/load.js

@@ -0,0 +1,35 @@
+/**
+ * Graph layer — owns filesystem and Arborist concerns.
+ * Knows nothing about policy.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import Arborist from '@npmcli/arborist';
+import { LicenseGateConfigError } from '../types.js';
+/**
+ * Load the installed dependency graph from the **selected project root**.
+ * The selected project root is whatever the caller passes in (typically
+ * `--cwd <path>` from the CLI, or the `cwd` option in the programmatic API);
+ * when omitted it defaults to `process.cwd()`. license-gate never walks
+ * upward to rescue a wrong working directory — `package.json` must exist
+ * directly at the selected project root, otherwise `LicenseGateConfigError`.
+ *
+ * Returns the Arborist `tree` (the root Node). Iterate `tree.inventory.values()`
+ * for the flat list of unique installed copies.
+ */
+export async function loadInstalledGraph(cwd = process.cwd()) {
+    const pkgJsonPath = resolve(cwd, 'package.json');
+    if (!existsSync(pkgJsonPath)) {
+        throw new LicenseGateConfigError({ kind: 'missing-package-json', cwd }, `license-gate: no package.json at the selected project root ${cwd}. license-gate never walks upward — pass --cwd <path> to point at a different project root, or run from the npm project root directly.`);
+    }
+    const nodeModulesPath = resolve(cwd, 'node_modules');
+    if (!existsSync(nodeModulesPath)) {
+        throw new LicenseGateConfigError({ kind: 'missing-node-modules', cwd }, `license-gate: no node_modules at the selected project root ${cwd}. Install dependencies first (e.g. \`npm ci\`).`);
+    }
+    // Canonicalise the cwd before handing it to Arborist so that subsequent
+    // realpath comparisons (workspace path matching, dedup) line up. Arborist
+    // itself returns canonicalised realpaths internally.
+    const canonical = realpathSync(cwd);
+    const arb = new Arborist({ path: canonical });
+    return arb.loadActual();
+}

package/dist/graph/narrow.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Workspace narrowing.
+ *
+ * `--workspace` always operates on a tree already loaded from the selected
+ * project root (`--cwd <path>` if provided, otherwise `process.cwd()`). We
+ * never re-invoke Arborist with a workspace path. Given the loaded tree, we
+ * resolve the workspace node by name (via `tree.workspaces`) or by path
+ * (relative paths resolved against the selected project root, then matched
+ * to `node.path`/`node.realpath`), and narrow the evaluation set to the
+ * workspace plus everything reachable via `node.edgesOut → edge.to`,
+ * deduped by realpath.
+ *
+ * We deliberately do NOT prefix-filter by realpath, because hoisted
+ * dependencies live under the project root and would be missed.
+ */
+import type Arborist from '@npmcli/arborist';
+/** Result of resolving a workspace within the loaded tree, plus the narrowed
+ *  evaluation set (workspace node + reachable deps, deduplicated by realpath). */
+export type NarrowedTree = {
+    workspaceNode: Arborist.Node;
+    evaluationSet: Arborist.Node[];
+};
+/** Narrow the loaded tree to one workspace + its reachable graph. */
+export declare function narrowToWorkspace(tree: Arborist.Node, query: string, cwd: string): NarrowedTree;

package/dist/graph/narrow.js

@@ -0,0 +1,114 @@
+/**
+ * Workspace narrowing.
+ *
+ * `--workspace` always operates on a tree already loaded from the selected
+ * project root (`--cwd <path>` if provided, otherwise `process.cwd()`). We
+ * never re-invoke Arborist with a workspace path. Given the loaded tree, we
+ * resolve the workspace node by name (via `tree.workspaces`) or by path
+ * (relative paths resolved against the selected project root, then matched
+ * to `node.path`/`node.realpath`), and narrow the evaluation set to the
+ * workspace plus everything reachable via `node.edgesOut → edge.to`,
+ * deduped by realpath.
+ *
+ * We deliberately do NOT prefix-filter by realpath, because hoisted
+ * dependencies live under the project root and would be missed.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { LicenseGateConfigError } from '../types.js';
+/** Walk through a Link to its target Node; non-link nodes pass through.
+ *  Narrowing gap: DefinitelyTyped types `target` on the base `Node` class as
+ *  required, but it is only meaningful when `isLink === true`. */
+function followLink(node) {
+    return node.isLink && node.target ? node.target : node;
+}
+function canonical(p) {
+    try {
+        return existsSync(p) ? realpathSync(p) : p;
+    }
+    catch {
+        return p;
+    }
+}
+/** Find a workspace node in the loaded tree.
+ *  Authoritative source: `tree.workspaces` Map<name, absolutePath>. We then
+ *  match the chosen path back to a Node either via inventory realpath or by
+ *  walking children. */
+function resolveWorkspaceNode(tree, query, cwd) {
+    const workspacesMap = tree.workspaces;
+    if (!workspacesMap || workspacesMap.size === 0) {
+        throw new LicenseGateConfigError({
+            kind: 'invalid-workspace',
+            query,
+            reason: 'project does not declare npm workspaces'
+        }, `license-gate: --workspace was used but the project at ${cwd} does not declare any workspaces in package.json.`);
+    }
+    // Build `name -> canonical path` for matching.
+    const byName = new Map();
+    for (const [name, path] of workspacesMap.entries()) {
+        byName.set(name, canonical(path));
+    }
+    // Resolve query → target absolute (canonical) path.
+    let targetPath;
+    if (byName.has(query)) {
+        targetPath = byName.get(query);
+    }
+    else {
+        const cwdCanon = canonical(cwd);
+        const queryAbs = canonical(isAbsolute(query) ? query : resolve(cwdCanon, query));
+        for (const [, p] of byName.entries()) {
+            if (p === queryAbs) {
+                targetPath = p;
+                break;
+            }
+        }
+    }
+    if (!targetPath) {
+        throw new LicenseGateConfigError({
+            kind: 'invalid-workspace',
+            query,
+            reason: 'workspace not found by name or path'
+        }, `license-gate: workspace "${query}" was not found in the project at ${cwd}.`);
+    }
+    // Find the matching Node — first try inventory; fall back to children.
+    for (const node of tree.inventory.values()) {
+        if (node.realpath === targetPath)
+            return node;
+    }
+    for (const child of tree.children.values()) {
+        const target = followLink(child);
+        if (target.realpath === targetPath)
+            return target;
+    }
+    throw new LicenseGateConfigError({
+        kind: 'invalid-workspace',
+        query,
+        reason: 'workspace path resolved but no matching tree node found'
+    }, `license-gate: workspace "${query}" resolves to ${targetPath} but no installed node matches.`);
+}
+/** BFS from a workspace node along edgesOut, collecting reachable nodes
+ *  (deduplicated by realpath). */
+function reachableFrom(start) {
+    const seen = new Map();
+    const queue = [start];
+    while (queue.length > 0) {
+        const node = queue.shift();
+        const target = followLink(node);
+        if (seen.has(target.realpath))
+            continue;
+        seen.set(target.realpath, target);
+        if (target.edgesOut) {
+            for (const edge of target.edgesOut.values()) {
+                if (edge.to)
+                    queue.push(edge.to);
+            }
+        }
+    }
+    return Array.from(seen.values());
+}
+/** Narrow the loaded tree to one workspace + its reachable graph. */
+export function narrowToWorkspace(tree, query, cwd) {
+    const workspaceNode = resolveWorkspaceNode(tree, query, cwd);
+    const evaluationSet = reachableFrom(workspaceNode);
+    return { workspaceNode, evaluationSet };
+}

package/dist/graph/record.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Map an Arborist Node to a flat InstalledPackageRecord.
+ * Pure: no fs reads, no Arborist methods called here beyond field access.
+ */
+import type Arborist from '@npmcli/arborist';
+import { type InstalledPackageRecord, type LicenseCouldNotDetermine } from '../types.js';
+/** Narrowing gap: DefinitelyTyped types `Node.package` as the broad
+ *  `PackageJson` shape from `@npm/types`; we narrow to the four fields we
+ *  actually read (license, repository, author, plus name/version fall-through). */
+type ArboristPackageJson = {
+    name?: string;
+    version?: string;
+    license?: unknown;
+    licenses?: unknown;
+    repository?: unknown;
+    author?: unknown;
+};
+/**
+ * Convert an absolute filesystem path into the path we expose in public
+ * records and reports: relative to the selected project root, POSIX-style
+ * separators, and `"."` when the path equals the project root.
+ *
+ * Centralised here so reporters and the public API never see absolute local
+ * paths — those would leak `/Users/<name>/...` style strings into JSON
+ * artifacts, CI logs, and collected reports.
+ */
+export declare function toExposedPath(absolutePath: string, projectRoot: string): string;
+/** Detect the license string from a package.json. v1 is non-inferential:
+ *  only a non-empty trimmed string in `license` is accepted; everything else
+ *  (missing, empty, object, array) maps to the sentinel. */
+export declare function detectLicense(pkg: ArboristPackageJson | undefined): string | LicenseCouldNotDetermine;
+/** Build an InstalledPackageRecord from an Arborist Node.
+ *
+ *  `projectRoot` is the selected project root (canonicalised) and is used
+ *  to convert the node's absolute realpath to the relative POSIX-style path
+ *  that the record exposes. */
+export declare function nodeToRecord(node: Arborist.Node, projectRoot: string): InstalledPackageRecord;
+export {};

package/dist/graph/record.js

@@ -0,0 +1,112 @@
+/**
+ * Map an Arborist Node to a flat InstalledPackageRecord.
+ * Pure: no fs reads, no Arborist methods called here beyond field access.
+ */
+import { relative, sep } from 'node:path';
+import { LICENSE_COULD_NOT_DETERMINE } from '../types.js';
+/** Read the package manifest off a Node, narrowed to our four fields. */
+function manifestOf(node) {
+    // Cast bridges the broad DefinitelyTyped manifest to our narrow shape.
+    return node.package;
+}
+/**
+ * Convert an absolute filesystem path into the path we expose in public
+ * records and reports: relative to the selected project root, POSIX-style
+ * separators, and `"."` when the path equals the project root.
+ *
+ * Centralised here so reporters and the public API never see absolute local
+ * paths — those would leak `/Users/<name>/...` style strings into JSON
+ * artifacts, CI logs, and collected reports.
+ */
+export function toExposedPath(absolutePath, projectRoot) {
+    const rel = relative(projectRoot, absolutePath);
+    if (rel === '' || rel === '.')
+        return '.';
+    // Normalise platform separators to POSIX `/` for stable cross-platform output.
+    return sep === '/' ? rel : rel.split(sep).join('/');
+}
+/** Detect the license string from a package.json. v1 is non-inferential:
+ *  only a non-empty trimmed string in `license` is accepted; everything else
+ *  (missing, empty, object, array) maps to the sentinel. */
+export function detectLicense(pkg) {
+    if (!pkg)
+        return LICENSE_COULD_NOT_DETERMINE;
+    const raw = pkg.license;
+    if (typeof raw !== 'string')
+        return LICENSE_COULD_NOT_DETERMINE;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return LICENSE_COULD_NOT_DETERMINE;
+    return trimmed;
+}
+/** Extract a repository URL string when it is directly available without
+ *  inference. `repository` may be a string or `{type, url}`; we keep the URL
+ *  as-is when present, but never derive one from anywhere else. */
+function extractRepository(pkg) {
+    if (!pkg)
+        return undefined;
+    const repo = pkg.repository;
+    if (typeof repo === 'string')
+        return repo;
+    if (repo && typeof repo === 'object' && 'url' in repo) {
+        const url = repo.url;
+        if (typeof url === 'string')
+            return url;
+    }
+    return undefined;
+}
+function extractAuthor(pkg) {
+    if (!pkg)
+        return {};
+    const author = pkg.author;
+    if (typeof author === 'string') {
+        return parseAuthorString(author);
+    }
+    if (author && typeof author === 'object') {
+        const obj = author;
+        const publisher = typeof obj.name === 'string' ? obj.name : undefined;
+        const email = typeof obj.email === 'string' ? obj.email : undefined;
+        return { publisher, email };
+    }
+    return {};
+}
+function parseAuthorString(author) {
+    const trimmed = author.trim();
+    if (!trimmed.endsWith('>')) {
+        return { publisher: trimmed || undefined };
+    }
+    const openIndex = trimmed.lastIndexOf('<');
+    // Require both parts to be clearly present: "Name <email@x>".
+    if (openIndex <= 0) {
+        return { publisher: trimmed || undefined };
+    }
+    const publisher = trimmed.slice(0, openIndex).trim();
+    const email = trimmed.slice(openIndex + 1, -1).trim();
+    if (!publisher || !email) {
+        return { publisher: trimmed || undefined };
+    }
+    return { publisher, email };
+}
+/** Build an InstalledPackageRecord from an Arborist Node.
+ *
+ *  `projectRoot` is the selected project root (canonicalised) and is used
+ *  to convert the node's absolute realpath to the relative POSIX-style path
+ *  that the record exposes. */
+export function nodeToRecord(node, projectRoot) {
+    const pkg = manifestOf(node);
+    const name = pkg?.name ?? node.name ?? '';
+    const version = pkg?.version ?? node.version ?? '';
+    const license = detectLicense(pkg);
+    const repository = extractRepository(pkg);
+    const { publisher, email } = extractAuthor(pkg);
+    return {
+        name,
+        version,
+        packageId: `${name}@${version}`,
+        path: toExposedPath(node.realpath, projectRoot),
+        license,
+        repository,
+        publisher,
+        email
+    };
+}

package/dist/graph/scope.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Build a resolved evaluation scope from the installed graph. This module owns
+ * the BFS/dedup logic that touches Arborist Node fields, so callers in
+ * `commands/` only see project-owned `InstalledPackageRecord` values —
+ * Arborist types do not leak past this boundary.
+ */
+import type { CollectedRecord, InstalledPackageRecord } from '../types.js';
+export type ResolvedScope = {
+    /** Records to evaluate (root excluded when full project mode). */
+    evaluationRecords: InstalledPackageRecord[];
+    /** All records including the project root (for collect output). */
+    allCollectedRecords: CollectedRecord[];
+    skippedProjectRoot: InstalledPackageRecord | null;
+};
+/** Resolve the scope for a command: load the graph, optionally narrow to a
+ *  workspace, and return project-owned records (no Arborist values escape).
+ *  All exposed `record.path` values are relative to the selected project root
+ *  (`opts.cwd`, canonicalised) — see `toExposedPath`. */
+export declare function resolveScope(opts: {
+    cwd: string;
+    workspace: string | null;
+}): Promise<ResolvedScope>;

package/dist/graph/scope.js

@@ -0,0 +1,88 @@
+/**
+ * Build a resolved evaluation scope from the installed graph. This module owns
+ * the BFS/dedup logic that touches Arborist Node fields, so callers in
+ * `commands/` only see project-owned `InstalledPackageRecord` values —
+ * Arborist types do not leak past this boundary.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import { loadInstalledGraph } from './load.js';
+import { narrowToWorkspace } from './narrow.js';
+import { nodeToRecord } from './record.js';
+function canonical(p) {
+    try {
+        return existsSync(p) ? realpathSync(p) : p;
+    }
+    catch {
+        return p;
+    }
+}
+/** Resolve the scope for a command: load the graph, optionally narrow to a
+ *  workspace, and return project-owned records (no Arborist values escape).
+ *  All exposed `record.path` values are relative to the selected project root
+ *  (`opts.cwd`, canonicalised) — see `toExposedPath`. */
+export async function resolveScope(opts) {
+    const tree = await loadInstalledGraph(opts.cwd);
+    // Canonicalise the selected project root once so it lines up with
+    // Arborist's realpaths (which are themselves canonicalised). This is the
+    // base for every exposed relative path.
+    const projectRoot = canonical(opts.cwd);
+    const allInventory = Array.from(tree.inventory.values());
+    let evaluationNodes;
+    let skippedProjectRoot = null;
+    if (opts.workspace) {
+        const { evaluationSet } = narrowToWorkspace(tree, opts.workspace, opts.cwd);
+        evaluationNodes = evaluationSet;
+    }
+    else {
+        // Full project: skip the root, evaluate everything else.
+        evaluationNodes = [];
+        for (const node of allInventory) {
+            if (node.isRoot) {
+                skippedProjectRoot = nodeToRecord(node, projectRoot);
+                continue;
+            }
+            evaluationNodes.push(node);
+        }
+    }
+    // Deduplicate by realpath (in case BFS visits links + targets).
+    // Narrowing gap: DefinitelyTyped types `target` on the base Node, but it
+    // is only meaningful when `isLink === true`.
+    const seen = new Set();
+    const dedupedEvaluation = [];
+    for (const n of evaluationNodes) {
+        const target = n.isLink && n.target ? n.target : n;
+        if (target.isRoot && !opts.workspace)
+            continue;
+        if (seen.has(target.realpath))
+            continue;
+        seen.add(target.realpath);
+        dedupedEvaluation.push(target);
+    }
+    const evaluationRecords = dedupedEvaluation.map((n) => nodeToRecord(n, projectRoot));
+    // All collected records (for collect output): include the project root too.
+    // Dedup by realpath here too — `record.path` is now relative and would
+    // collide for legitimately-distinct copies hoisted in different scopes.
+    const collectedSeen = new Set();
+    const allCollectedRecords = [];
+    if (!opts.workspace) {
+        for (const node of allInventory) {
+            if (node.isRoot) {
+                const rec = nodeToRecord(node, projectRoot);
+                allCollectedRecords.push({ ...rec, isProjectRoot: true });
+                collectedSeen.add(node.realpath);
+            }
+        }
+    }
+    for (let i = 0; i < dedupedEvaluation.length; i++) {
+        const realpath = dedupedEvaluation[i].realpath;
+        if (collectedSeen.has(realpath))
+            continue;
+        collectedSeen.add(realpath);
+        allCollectedRecords.push(evaluationRecords[i]);
+    }
+    return {
+        evaluationRecords,
+        allCollectedRecords,
+        skippedProjectRoot
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Public programmatic API for @mirasen/license-gate.
+ *
+ * Use these from custom CI scripts or pre-commit hooks instead of shelling
+ * out to the binary.
+ *
+ * Both `runCheck` and `runCollect` accept an options object and return a
+ * detailed result. The library never calls `process.exit`; the caller
+ * decides what to do with the exit code.
+ *
+ * Public types:
+ *   - InstalledPackageRecord
+ *   - Decision (closed discriminated union)
+ *   - ViolationReason (closed discriminated union — exactly two top-level
+ *     reasons: `license-not-in-allowlist`, `package-not-in-allowlist`)
+ *   - ConfigError + LicenseGateConfigError (thrown for usage/config issues)
+ *   - CheckResult / CollectResult / CollectedRecord
+ */
+export { runCheck } from './commands/check.js';
+export type { CheckOptions, CheckCliResult } from './commands/check.js';
+export { runCollect } from './commands/collect.js';
+export type { CollectOptions, CollectCliResult } from './commands/collect.js';
+export { LICENSE_COULD_NOT_DETERMINE, LicenseGateConfigError } from './types.js';
+export type { AllowedHardList, AllowedPackages, AllowedPackagesRule, CheckResult, CollectedRecord, CollectResult, ConfigError, Decision, InstalledPackageRecord, LicenseCouldNotDetermine, ViolationReason } from './types.js';
+export { renderCheckJson, renderCollectJson } from './report/json.js';
+export type { CheckJsonReport, CollectJsonReport } from './report/json.js';
+export { renderCheckHuman, renderCollectHuman } from './report/human.js';

package/dist/index.js

@@ -0,0 +1,23 @@
+/**
+ * Public programmatic API for @mirasen/license-gate.
+ *
+ * Use these from custom CI scripts or pre-commit hooks instead of shelling
+ * out to the binary.
+ *
+ * Both `runCheck` and `runCollect` accept an options object and return a
+ * detailed result. The library never calls `process.exit`; the caller
+ * decides what to do with the exit code.
+ *
+ * Public types:
+ *   - InstalledPackageRecord
+ *   - Decision (closed discriminated union)
+ *   - ViolationReason (closed discriminated union — exactly two top-level
+ *     reasons: `license-not-in-allowlist`, `package-not-in-allowlist`)
+ *   - ConfigError + LicenseGateConfigError (thrown for usage/config issues)
+ *   - CheckResult / CollectResult / CollectedRecord
+ */
+export { runCheck } from './commands/check.js';
+export { runCollect } from './commands/collect.js';
+export { LICENSE_COULD_NOT_DETERMINE, LicenseGateConfigError } from './types.js';
+export { renderCheckJson, renderCollectJson } from './report/json.js';
+export { renderCheckHuman, renderCollectHuman } from './report/human.js';

package/dist/policy/allowed-hard.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Parser for `licenses/allowed-hard.txt`.
+ *
+ * Pure: takes the file contents as a string, returns an `AllowedHardList`.
+ * The actual file read happens in the command layer.
+ *
+ * Rules:
+ *  - one literal accepted license string per line
+ *  - blank lines ignored
+ *  - lines whose first non-whitespace char is `#` are comments
+ *  - leading/trailing whitespace trimmed (parsing convenience only;
+ *    the trimmed value is what gets compared literally)
+ *  - duplicates silently deduped
+ *  - no regex, no glob, no normalisation
+ */
+import type { AllowedHardList } from '../types.js';
+export declare function parseAllowedHard(contents: string): AllowedHardList;

package/dist/policy/allowed-hard.js

@@ -0,0 +1,27 @@
+/**
+ * Parser for `licenses/allowed-hard.txt`.
+ *
+ * Pure: takes the file contents as a string, returns an `AllowedHardList`.
+ * The actual file read happens in the command layer.
+ *
+ * Rules:
+ *  - one literal accepted license string per line
+ *  - blank lines ignored
+ *  - lines whose first non-whitespace char is `#` are comments
+ *  - leading/trailing whitespace trimmed (parsing convenience only;
+ *    the trimmed value is what gets compared literally)
+ *  - duplicates silently deduped
+ *  - no regex, no glob, no normalisation
+ */
+export function parseAllowedHard(contents) {
+    const out = new Set();
+    for (const rawLine of contents.split(/\r?\n/)) {
+        const trimmed = rawLine.trim();
+        if (trimmed.length === 0)
+            continue;
+        if (trimmed.startsWith('#'))
+            continue;
+        out.add(trimmed);
+    }
+    return out;
+}

package/dist/policy/allowed-packages.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Parser for `licenses/allowed-packages.txt`.
+ *
+ * Pure: takes the file contents and a path (for error reporting), returns
+ * either a list of validated rules or throws a `LicenseGateConfigError` with
+ * `kind: 'invalid-package-override-rule'` carrying the offending line.
+ *
+ * Accepted rule forms (and ONLY these):
+ *   1. `@scope/*`                   trusted internal namespace
+ *   2. `package-name@version`       exact installed unscoped package version
+ *   3. `@scope/package@version`     exact installed scoped package version
+ *   4. `package-name@*`             package-name wildcard (any version),
+ *                                   unscoped — narrowly scoped escape hatch
+ *                                   for manually reviewed packages whose
+ *                                   version bumps should not require
+ *                                   re-editing this file.
+ *   5. `@scope/package@*`           package-name wildcard (any version),
+ *                                   scoped — same intent as form 4.
+ *
+ * Everything else is rejected, including:
+ *   - bare `package-name` (no version)
+ *   - bare `@scope/package` (no version, no `*`)
+ *   - semver ranges: `^1.2.3`, `~1.2.3`, `1.x`, `>=1.0.0`, ...
+ *   - `@scope/*@*`, `*@*`
+ *   - regex, generic glob, prefix wildcard, bare `*`
+ *   - any whitespace inside the rule
+ */
+import { type AllowedPackages } from '../types.js';
+export declare function parseAllowedPackages(contents: string, path: string): AllowedPackages;