@ploaness/governance 1.0.0 → 1.2.0

package/dist/blocklist-entries.js

@@ -0,0 +1,338 @@
+// What ploaness refuses by name, whatever a manifest declares as its licence.
+//
+// The licence allowlist judges an npm package by the identifier its own manifest carries, and that is
+// the wrong question for three families. A driver is permissively licensed while the only server it can
+// reach is not (the MongoDB driver is Apache 2.0; the MongoDB server is SSPL). A package downloads a
+// binary at install or first run under terms its manifest never mentions (puppeteer fetches Chrome for
+// Testing). And a container image has no manifest at all, so nothing judged it: a compose file could pull
+// MinIO or Redis 8 through a harness that refuses an AGPL npm package. Retired analyzers are also
+// refused when the harness already owns their checks.
+//
+// Every entry names the reason and the replacement, because a refusal that stops a build without saying
+// what to use instead sends the reader to the same search this table already did. Where a project turned
+// non-permissive at a known release, the entry carries that floor and earlier releases are left to the
+// licence gate. No project setting widens or narrows the list: a rule a project can edit is not a rule.
+const MONGODB_REASON = 'the MongoDB server is SSPL, which is not an open-source licence, and this exists only to reach it';
+const MONGODB_REPLACEMENT = 'the postgres image with @payloadcms/db-postgres';
+const REDIS_REASON = 'Redis 7.4 onward is RSALv2, SSPLv1 or AGPLv3, none of which is a permissive open-source licence';
+const REDIS_REPLACEMENT = 'valkey/valkey, which the redis and ioredis clients speak to unchanged';
+const ELASTIC_REASON = 'Elastic binaries are Elastic License 2.0 from 7.11, and this exists only to reach them';
+const ELASTIC_REPLACEMENT = 'opensearchproject/opensearch and opensearchproject/opensearch-dashboards with @opensearch-project/opensearch';
+const MINIO_REASON = 'MinIO is AGPL and its community edition is archived, with no images and no security fixes';
+const OBJECT_STORAGE_REPLACEMENT = 'rustfs/rustfs or chrislusf/seaweedfs';
+const HASHICORP_REASON = 'HashiCorp relicensed to the Business Source License, which is not open source';
+const HASHICORP_REPLACEMENT = 'openbao/openbao for Vault, ghcr.io/opentofu/opentofu for Terraform';
+const PROPRIETARY_DATABASE_REASON = 'a proprietary database server, for which Payload has no adapter';
+const POSTGRES_REPLACEMENT = 'the postgres image';
+const GHOSTSCRIPT_REASON = 'Ghostscript is AGPL, and this is a thin wrapper around it';
+const PDF_REPLACEMENT = 'pdfjs-dist with @napi-rs/canvas';
+const NOTHING_REPLACEMENT = 'nothing; a Payload project has no place for it';
+/** The image repositories ploaness refuses, in the order the report lists them. */
+export const BLOCKED_IMAGES = [
+    { repository: 'mongo', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { repository: 'mongodb/*', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { repository: 'redis', from: '7.4', reason: REDIS_REASON, replacement: REDIS_REPLACEMENT },
+    { repository: 'redis/*', reason: REDIS_REASON, replacement: REDIS_REPLACEMENT },
+    { repository: 'redislabs/*', reason: REDIS_REASON, replacement: REDIS_REPLACEMENT },
+    {
+        repository: 'elasticsearch',
+        from: '7.11',
+        reason: ELASTIC_REASON,
+        replacement: ELASTIC_REPLACEMENT,
+    },
+    { repository: 'kibana', from: '7.11', reason: ELASTIC_REASON, replacement: ELASTIC_REPLACEMENT },
+    {
+        repository: 'logstash',
+        from: '7.11',
+        reason: ELASTIC_REASON,
+        replacement: ELASTIC_REPLACEMENT,
+    },
+    {
+        repository: 'docker.elastic.co/*',
+        from: '7.11',
+        reason: ELASTIC_REASON,
+        replacement: ELASTIC_REPLACEMENT,
+    },
+    { repository: 'minio/*', reason: MINIO_REASON, replacement: OBJECT_STORAGE_REPLACEMENT },
+    { repository: 'quay.io/minio/*', reason: MINIO_REASON, replacement: OBJECT_STORAGE_REPLACEMENT },
+    { repository: 'pgsty/minio', reason: MINIO_REASON, replacement: OBJECT_STORAGE_REPLACEMENT },
+    {
+        repository: 'localstack/*',
+        reason: 'the LocalStack community edition is archived, and the unified image needs an account token and is free ' +
+            'only for non-commercial use',
+        replacement: 'rustfs/rustfs for S3 and motoserver/moto for other AWS APIs',
+    },
+    {
+        repository: 'gresau/localstack-persist',
+        reason: 'a repackaging of the archived LocalStack community edition',
+        replacement: 'rustfs/rustfs for S3 and motoserver/moto for other AWS APIs',
+    },
+    {
+        repository: 'cockroachdb/cockroach',
+        from: '24.3',
+        reason: 'CockroachDB 24.3 onward is under a proprietary licence with mandatory telemetry',
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/vault',
+        from: '1.15',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/consul',
+        from: '1.16',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/nomad',
+        from: '1.6',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/terraform',
+        from: '1.6',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/packer',
+        from: '1.10',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'redpandadata/*',
+        reason: 'Redpanda is under the Business Source License, which is not open source',
+        replacement: 'apache/kafka or nats',
+    },
+    {
+        repository: 'vectorized/*',
+        reason: 'Redpanda is under the Business Source License, which is not open source',
+        replacement: 'apache/kafka or nats',
+    },
+    {
+        repository: 'timescale/timescaledb',
+        allowedTag: /-oss(?:-|$)/,
+        reason: 'the default Timescale images carry Timescale License code, which is not open source',
+        replacement: 'a tag ending in -oss, or the postgres image',
+    },
+    {
+        repository: 'timescale/timescaledb-ha',
+        allowedTag: /-oss(?:-|$)/,
+        reason: 'the default Timescale images carry Timescale License code, which is not open source',
+        replacement: 'a tag ending in -oss, or the postgres image',
+    },
+    {
+        repository: 'getsentry/*',
+        from: '23.11',
+        reason: 'self-hosted Sentry is under the Functional Source License, which is not open source',
+        replacement: 'glitchtip/glitchtip, or Sentry as a service through the MIT @sentry SDKs',
+    },
+    {
+        repository: 'n8nio/*',
+        reason: 'n8n is under the Sustainable Use License, which is not open source',
+        replacement: NOTHING_REPLACEMENT,
+    },
+    {
+        repository: 'directus/directus',
+        reason: 'Directus is under the Business Source License, which is not open source',
+        replacement: 'Payload',
+    },
+    {
+        repository: 'mcr.microsoft.com/mssql/*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'container-registry.oracle.com/database/*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'gvenzl/oracle-*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'ibmcom/db2',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'icr.io/db2_community/*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'ghcr.io/apollographql/router',
+        reason: 'the Apollo Router is Elastic License 2.0, which is not open source',
+        replacement: '@graphql-hive/gateway or @graphql-mesh',
+    },
+    {
+        repository: 'bitnami/*',
+        reason: 'the Bitnami catalogue was deleted in 2025, so a tag here cannot be pulled reproducibly',
+        replacement: 'the upstream official image of the same service',
+    },
+    {
+        repository: 'bitnamilegacy/*',
+        reason: 'the Bitnami legacy images are frozen with unfixed vulnerabilities',
+        replacement: 'the upstream official image of the same service',
+    },
+    {
+        repository: 'bitnamisecure/*',
+        reason: 'the Bitnami secure images publish only a latest tag, so a pull cannot be pinned',
+        replacement: 'the upstream official image of the same service',
+    },
+    {
+        repository: 'dxflrs/garage',
+        reason: 'Garage is AGPL, and a permissively licensed object store exists',
+        replacement: OBJECT_STORAGE_REPLACEMENT,
+    },
+    {
+        repository: 'citusdata/citus',
+        reason: 'Citus is AGPL, and plain PostgreSQL serves a Payload project',
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'grafana/grafana',
+        reason: 'Grafana is AGPL, and a permissively licensed dashboard exists',
+        replacement: 'persesdev/perses',
+    },
+    {
+        repository: 'grafana/loki',
+        reason: 'Loki is AGPL, and a permissively licensed log store exists',
+        replacement: 'victoriametrics/victoria-logs',
+    },
+    {
+        repository: 'grafana/tempo',
+        reason: 'Tempo is AGPL, and a permissively licensed trace store exists',
+        replacement: 'jaegertracing/jaeger',
+    },
+    {
+        repository: 'grafana/mimir',
+        reason: 'Mimir is AGPL, and a permissively licensed metrics store exists',
+        replacement: 'prom/prometheus or victoriametrics/victoria-metrics',
+    },
+    {
+        repository: 'plausible/*',
+        reason: 'Plausible is AGPL, and a permissively licensed analytics service exists',
+        replacement: 'ghcr.io/umami-software/umami',
+    },
+    {
+        repository: 'metabase/metabase',
+        reason: 'Metabase is AGPL',
+        replacement: NOTHING_REPLACEMENT,
+    },
+];
+/** The npm packages ploaness refuses, in the order the report lists them. */
+export const BLOCKED_PACKAGES = [
+    {
+        name: 'eslint-plugin-jsx-a11y',
+        reason: 'the retired JSX accessibility analyzer duplicates checks owned by the ploaness Oxlint gate',
+        replacement: 'the harness-owned oxlint gate; remove the legacy plugin dependency',
+    },
+    {
+        name: '@payloadcms/db-mongodb',
+        reason: MONGODB_REASON,
+        replacement: '@payloadcms/db-postgres',
+    },
+    { name: 'mongodb', reason: MONGODB_REASON, replacement: '@payloadcms/db-postgres' },
+    { name: 'mongoose', reason: MONGODB_REASON, replacement: '@payloadcms/db-postgres' },
+    {
+        name: 'mongodb-memory-server*',
+        reason: 'downloads the SSPL MongoDB server binary at install time',
+        replacement: '@payloadcms/db-postgres against the compose database',
+    },
+    { name: '@mongodb-js/*', reason: MONGODB_REASON, replacement: '@payloadcms/db-postgres' },
+    {
+        name: 'mongodb-client-encryption',
+        reason: MONGODB_REASON,
+        replacement: '@payloadcms/db-postgres',
+    },
+    {
+        name: '@elastic/elasticsearch',
+        reason: ELASTIC_REASON,
+        replacement: '@opensearch-project/opensearch',
+    },
+    {
+        name: '@elastic/eui',
+        reason: 'Elastic UI is dual-licensed SSPL and Elastic License 2.0, neither of which is permissive',
+        replacement: '@payloadcms/ui',
+    },
+    { name: 'elastic-apm-node', reason: ELASTIC_REASON, replacement: '@opentelemetry/sdk-node' },
+    {
+        name: 'puppeteer',
+        reason: 'downloads Chrome for Testing under Google terms, which are not open source',
+        replacement: 'playwright, or puppeteer-core pointed at the Chromium Playwright installs',
+    },
+    { name: 'pdf2pic', reason: GHOSTSCRIPT_REASON, replacement: PDF_REPLACEMENT },
+    { name: 'node-gs', reason: GHOSTSCRIPT_REASON, replacement: PDF_REPLACEMENT },
+    { name: 'ghostscript4js', reason: GHOSTSCRIPT_REASON, replacement: PDF_REPLACEMENT },
+    { name: 'mupdf', reason: 'MuPDF is AGPL', replacement: PDF_REPLACEMENT },
+    {
+        name: 'n8n',
+        reason: 'n8n is under the Sustainable Use License, which is not open source',
+        replacement: NOTHING_REPLACEMENT,
+    },
+    {
+        name: 'n8n-*',
+        reason: 'an n8n extension serves only the Sustainable Use License host',
+        replacement: NOTHING_REPLACEMENT,
+    },
+    {
+        name: 'directus',
+        reason: 'Directus is under the Business Source License, which is not open source',
+        replacement: 'payload',
+    },
+    { name: 'mssql', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    { name: 'tedious', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    { name: 'oracledb', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    { name: 'ibm_db', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    {
+        name: 'ua-parser-js',
+        from: '2.0.0',
+        reason: 'ua-parser-js 2 is AGPL with a paid exemption',
+        replacement: 'ua-parser-js 1, or bowser',
+    },
+    {
+        name: 'mapbox-gl',
+        from: '2.0.0',
+        reason: 'Mapbox GL JS 2 onward is under proprietary Mapbox terms',
+        replacement: 'maplibre-gl',
+    },
+    {
+        name: 'tinymce',
+        from: '7.0.0',
+        reason: 'TinyMCE 7 onward is GPL or commercial',
+        replacement: '@payloadcms/richtext-lexical',
+    },
+    {
+        name: '@ckeditor/*',
+        reason: 'CKEditor 5 is GPL or commercial',
+        replacement: '@payloadcms/richtext-lexical',
+    },
+    {
+        name: 'highcharts',
+        reason: 'Highcharts is under a proprietary licence',
+        replacement: 'chart.js or echarts',
+    },
+    {
+        name: '@apollo/gateway',
+        from: '2.0.0',
+        reason: 'Apollo Gateway 2 onward is Elastic License 2.0, which is not open source',
+        replacement: '@graphql-hive/gateway',
+    },
+];
+/** The system packages a Dockerfile may not install. */
+export const BLOCKED_SYSTEM_PACKAGES = [
+    { name: 'ghostscript', reason: 'Ghostscript is AGPL', replacement: PDF_REPLACEMENT },
+    { name: 'mupdf', reason: 'MuPDF is AGPL', replacement: PDF_REPLACEMENT },
+    { name: 'mupdf-tools', reason: 'MuPDF is AGPL', replacement: PDF_REPLACEMENT },
+    { name: 'mongodb-org', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { name: 'mongodb-org-server', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { name: 'mongodb-mongosh', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+];
+//# sourceMappingURL=blocklist-entries.js.map

package/dist/blocklist-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist-entries.js","sourceRoot":"","sources":["../src/blocklist-entries.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,qGAAqG;AACrG,uGAAuG;AACvG,0GAA0G;AAC1G,kGAAkG;AAClG,sDAAsD;AACtD,EAAE;AACF,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,wGAAwG;AAkCxG,MAAM,cAAc,GAClB,mGAAmG,CAAA;AACrG,MAAM,mBAAmB,GAAW,iDAAiD,CAAA;AAErF,MAAM,YAAY,GAChB,iGAAiG,CAAA;AACnG,MAAM,iBAAiB,GACrB,uEAAuE,CAAA;AAEzE,MAAM,cAAc,GAClB,wFAAwF,CAAA;AAC1F,MAAM,mBAAmB,GACvB,8GAA8G,CAAA;AAEhH,MAAM,YAAY,GAChB,2FAA2F,CAAA;AAC7F,MAAM,0BAA0B,GAAW,sCAAsC,CAAA;AAEjF,MAAM,gBAAgB,GACpB,+EAA+E,CAAA;AACjF,MAAM,qBAAqB,GACzB,oEAAoE,CAAA;AAEtE,MAAM,2BAA2B,GAC/B,iEAAiE,CAAA;AACnE,MAAM,oBAAoB,GAAW,oBAAoB,CAAA;AAEzD,MAAM,kBAAkB,GAAW,2DAA2D,CAAA;AAC9F,MAAM,eAAe,GAAW,iCAAiC,CAAA;AAEjE,MAAM,mBAAmB,GAAW,gDAAgD,CAAA;AAEpF,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACjF,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACrF,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE;IAC1F,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE;IAC/E,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE;IACnF;QACE,UAAU,EAAE,eAAe;QAC3B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;KACjC;IACD,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAChG;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,UAAU,EAAE,qBAAqB;QACjC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;KACjC;IACD,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACxF,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAChG,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC5F;QACE,UAAU,EAAE,cAAc;QAC1B,MAAM,EACJ,yGAAyG;YACzG,6BAA6B;QAC/B,WAAW,EAAE,6DAA6D;KAC3E;IACD;QACE,UAAU,EAAE,2BAA2B;QACvC,MAAM,EAAE,4DAA4D;QACpE,WAAW,EAAE,6DAA6D;KAC3E;IACD;QACE,UAAU,EAAE,uBAAuB;QACnC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,iFAAiF;QACzF,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,kBAAkB;QAC9B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,qBAAqB;QACjC,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,kBAAkB;QAC9B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,UAAU,EAAE,uBAAuB;QACnC,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,qFAAqF;QAC7F,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,UAAU,EAAE,0BAA0B;QACtC,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,qFAAqF;QAC7F,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,qFAAqF;QAC7F,WAAW,EAAE,0EAA0E;KACxF;IACD;QACE,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,oEAAoE;QAC5E,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,UAAU,EAAE,mBAAmB;QAC/B,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,SAAS;KACvB;IACD;QACE,UAAU,EAAE,2BAA2B;QACvC,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,0CAA0C;QACtD,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,8BAA8B;QAC1C,MAAM,EAAE,oEAAoE;QAC5E,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,UAAU,EAAE,WAAW;QACvB,MAAM,EACJ,wFAAwF;QAC1F,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,mEAAmE;QAC3E,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,iFAAiF;QACzF,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,iEAAiE;QACzE,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,8DAA8D;QACtE,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,4DAA4D;QACpE,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,iEAAiE;QACzE,WAAW,EAAE,qDAAqD;KACnE;IACD;QACE,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,UAAU,EAAE,mBAAmB;QAC/B,MAAM,EAAE,kBAAkB;QAC1B,WAAW,EAAE,mBAAmB;KACjC;CACF,CAAA;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EACJ,4FAA4F;QAC9F,WAAW,EAAE,oEAAoE;KAClF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,yBAAyB;KACvC;IACD,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACnF,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACpF;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,0DAA0D;QAClE,WAAW,EAAE,sDAAsD;KACpE;IACD,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACzF;QACE,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EACJ,0FAA0F;QAC5F,WAAW,EAAE,gBAAgB;KAC9B;IACD,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC5F;QACE,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,4EAA4E;QACpF,WAAW,EAAE,2EAA2E;KACzF;IACD,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE;IAC7E,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE;IAC7E,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE;IACpF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IACxE;QACE,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,oEAAoE;QAC5E,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,SAAS;KACvB;IACD,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IACzE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IAC3E,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IAC5E,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IAC1E;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,8CAA8C;QACtD,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,yDAAyD;QACjE,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,uCAAuC;QAC/C,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,iCAAiC;QACzC,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,2CAA2C;QACnD,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,0EAA0E;QAClF,WAAW,EAAE,uBAAuB;KACrC;CACF,CAAA;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,WAAW,EAAE,eAAe,EAAE;IACpF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IACxE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IAC9E,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACjF,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACxF,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;CACtF,CAAA"}

package/dist/blocklist.d.ts

@@ -0,0 +1,91 @@
+import { type DependencyStatus } from './dependency-freshness.js';
+/** One refusal, ready to be printed beside the file that carries the subject. */
+export interface Refusal {
+    /** The reference, the `name@version`, or the system package as written. */
+    readonly subject: string;
+    readonly reason: string;
+    readonly replacement: string;
+}
+/** An image reference split into the parts the rule reads. */
+export interface ImageReference {
+    readonly raw: string;
+    /** The repository in the normalised form `blocklist-entries.ts` uses. */
+    readonly repository: string;
+    readonly tag: string | undefined;
+    readonly digest: string | undefined;
+}
+/**
+ * Split an image reference as a Dockerfile, a workflow, or a compose model writes it.
+ * @param raw the reference, such as `docker.io/library/redis:7.4.1@sha256:...`.
+ * @returns the normalised repository, and the tag and digest when present.
+ */
+export declare const parseImageReference: (raw: string) => ImageReference;
+/**
+ * Whether a reference may resolve to a different image tomorrow: no digest, and no tag or `latest`.
+ * @param raw the reference as written.
+ * @returns true when nothing in the reference pins what is pulled.
+ */
+export declare const isMutableImageReference: (raw: string) => boolean;
+/**
+ * Whether an image reference names a refused repository at a refused tag.
+ * @param raw the reference as written.
+ * @returns the refusal, or undefined when the image is not one ploaness refuses.
+ */
+export declare const refuseImage: (raw: string) => Refusal | undefined;
+/**
+ * Whether an installed package at a version is one ploaness refuses.
+ * @param name the package name.
+ * @param version the resolved version.
+ * @returns the refusal, or undefined when the package is not one ploaness refuses at that version.
+ */
+export declare const refusePackage: (name: string, version: string) => Refusal | undefined;
+/**
+ * The refused system packages a Dockerfile installs.
+ * @param text the Dockerfile body.
+ * @returns one refusal per refused package, in file order.
+ */
+export declare const refuseSystemPackages: (text: string) => readonly Refusal[];
+/** One package of the resolved set, at every version the install carries. */
+export interface InstalledPackage {
+    readonly name: string;
+    readonly versions: readonly string[];
+}
+/**
+ * The resolved set as `pnpm licenses list --json` reports it: grouped by licence, each entry carrying
+ * the name and the versions installed.
+ * @param json the command's stdout.
+ * @returns every installed package, or undefined when the text is not that inventory.
+ */
+export declare const packagesInLicenseInventory: (json: string) => readonly InstalledPackage[] | undefined;
+/**
+ * The refusals across an installed set.
+ * @param packages the resolved set.
+ * @returns one refusal per refused name and version, in inventory order.
+ */
+export declare const refuseInstalledPackages: (packages: readonly InstalledPackage[]) => readonly Refusal[];
+/** A declared coordinate whose newest release the freshness bound may not demand. */
+export interface RefusedLatest {
+    readonly status: DependencyStatus;
+    /** Why the newest release is out of reach, in the words the report prints. */
+    readonly note: string;
+}
+/** The statuses freshness measures, and the ones whose newest release it may not point at. */
+export interface FreshnessScope {
+    readonly measurable: readonly DependencyStatus[];
+    readonly refused: readonly RefusedLatest[];
+}
+/**
+ * Split the declared coordinates into those freshness may measure and those whose newest release is
+ * refused, which freshness must not demand.
+ * @param statuses every declared coordinate with what the registry answered for it.
+ * @returns the measurable statuses, and the refused ones with the note the report prints.
+ */
+export declare const scopeFreshness: (statuses: readonly DependencyStatus[]) => FreshnessScope;
+/**
+ * The refusals of a repository's own JSON summary, kept exported so the CLI prints the same words.
+ * @param refusal one refusal.
+ * @param location the file or inventory that carries the subject.
+ * @returns one finding line.
+ */
+export declare const describeRefusal: (refusal: Refusal, location: string) => string;
+//# sourceMappingURL=blocklist.d.ts.map

package/dist/blocklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../src/blocklist.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,gBAAgB,EAAoC,MAAM,2BAA2B,CAAA;AAInG,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAsCD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,KAAG,cAWjD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,OAKrD,CAAA;AAoCD;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAO,GAAG,SAWnD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,OAAO,GAAG,SAUvE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,KAAG,SAAS,OAAO,EAMhE,CAAA;AAEJ,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACrC,MAAM,MAAM,KACX,SAAS,gBAAgB,EAAE,GAAG,SAchC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAClC,UAAU,SAAS,gBAAgB,EAAE,KACpC,SAAS,OAAO,EAMhB,CAAA;AAEH,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;CAC3C;AAiBD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,cASpE,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,EAAE,UAAU,MAAM,KAAG,MACc,CAAA"}

package/dist/blocklist.js

@@ -0,0 +1,187 @@
+// The refusal rule: whether an image reference, an installed package, or a Dockerfile install line
+// names something in `blocklist-entries.ts`, and the one place freshness has to defer to it.
+//
+// A reference is matched on its repository after normalisation, because the same image is written
+// `mongo`, `docker.io/mongo`, `library/mongo`, and `docker.io/library/mongo`, and a list keyed on the
+// spelling would refuse one of them and pull the other. The tag decides only where an entry carries a
+// floor: a tag below the floor is the permissive release line and is left to the licence gate, and a
+// tag that cannot be placed against the floor - `latest`, none, `7` against a floor of `7.4`, an
+// `-alpine` suffix on a floating major - is refused, because a tag that may resolve past the floor
+// tomorrow is not a proof that it sits below it today.
+import { BLOCKED_IMAGES, BLOCKED_PACKAGES, BLOCKED_SYSTEM_PACKAGES, } from './blocklist-entries.js';
+import { systemPackagesInDockerfile } from './container-images.js';
+import { parseVersion } from './dependency-freshness.js';
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+import { isLicenseAllowed } from './license-allowlist.js';
+const DOCKER_HUB_HOSTS = new Set(['docker.io', 'index.docker.io']);
+const OFFICIAL_NAMESPACE = 'library';
+const LOCAL_HOST = 'localhost';
+const MUTABLE_TAG = 'latest';
+const WILDCARD = '*';
+const NUMERIC_COMPONENTS = /^v?(?<components>\d+(?:\.\d+)*)/;
+// A reference is a name-and-tag and at most one digest after the `@`.
+const REFERENCE_PARTS = 2;
+// A first path segment is a registry host when it carries a dot or a port, or is `localhost`; a Docker
+// Hub namespace never does. The rule the docker CLI itself applies.
+const isRegistryHost = (segment) => segment.includes('.') || segment.includes(':') || segment === LOCAL_HOST;
+const splitHost = (segments) => {
+    const [first] = segments;
+    if (first === undefined || segments.length === 1 || !isRegistryHost(first)) {
+        return { host: undefined, path: segments };
+    }
+    return { host: DOCKER_HUB_HOSTS.has(first) ? undefined : first, path: segments.slice(1) };
+};
+const normaliseRepository = (name) => {
+    const { host, path } = splitHost(name.toLowerCase().split('/'));
+    if (host !== undefined) {
+        return [host, ...path].join('/');
+    }
+    return (path.length > 1 && path[0] === OFFICIAL_NAMESPACE ? path.slice(1) : path).join('/');
+};
+/**
+ * Split an image reference as a Dockerfile, a workflow, or a compose model writes it.
+ * @param raw the reference, such as `docker.io/library/redis:7.4.1@sha256:...`.
+ * @returns the normalised repository, and the tag and digest when present.
+ */
+export const parseImageReference = (raw) => {
+    const [nameAndTag = '', digest] = raw.split('@', REFERENCE_PARTS);
+    const lastSlash = nameAndTag.lastIndexOf('/');
+    const colon = nameAndTag.lastIndexOf(':');
+    const hasTag = colon > lastSlash;
+    return {
+        raw,
+        repository: normaliseRepository(hasTag ? nameAndTag.slice(0, colon) : nameAndTag),
+        tag: hasTag ? nameAndTag.slice(colon + 1) : undefined,
+        digest,
+    };
+};
+/**
+ * Whether a reference may resolve to a different image tomorrow: no digest, and no tag or `latest`.
+ * @param raw the reference as written.
+ * @returns true when nothing in the reference pins what is pulled.
+ */
+export const isMutableImageReference = (raw) => {
+    const reference = parseImageReference(raw);
+    return (reference.digest === undefined && (reference.tag === undefined || reference.tag === MUTABLE_TAG));
+};
+const matchesPattern = (pattern, name) => pattern.endsWith(WILDCARD)
+    ? name.startsWith(pattern.slice(0, -WILDCARD.length))
+    : name === pattern;
+const compareCore = (one, other) => one.major - other.major || one.minor - other.minor || one.patch - other.patch;
+const componentCount = (version) => (NUMERIC_COMPONENTS.exec(version)?.groups?.['components'] ?? '').split('.').filter(Boolean).length;
+// Undecidable is refused: a version that cannot be placed against the floor is not below it.
+const reachesFloor = (version, floor) => {
+    const parsed = version === undefined ? undefined : parseVersion(version);
+    const floorParsed = parseVersion(floor);
+    if (version === undefined || parsed === undefined || floorParsed === undefined) {
+        return true;
+    }
+    return componentCount(version) < componentCount(floor) || compareCore(parsed, floorParsed) >= 0;
+};
+const isAllowedTag = (entry, tag) => entry.allowedTag !== undefined && tag !== undefined && entry.allowedTag.test(tag);
+const refusalOf = (subject, entry) => ({
+    subject,
+    reason: entry.reason,
+    replacement: entry.replacement,
+});
+/**
+ * Whether an image reference names a refused repository at a refused tag.
+ * @param raw the reference as written.
+ * @returns the refusal, or undefined when the image is not one ploaness refuses.
+ */
+export const refuseImage = (raw) => {
+    const reference = parseImageReference(raw);
+    const entry = BLOCKED_IMAGES.find((candidate) => matchesPattern(candidate.repository, reference.repository));
+    if (entry === undefined || isAllowedTag(entry, reference.tag)) {
+        return undefined;
+    }
+    return entry.from !== undefined && !reachesFloor(reference.tag, entry.from)
+        ? undefined
+        : refusalOf(raw, entry);
+};
+/**
+ * Whether an installed package at a version is one ploaness refuses.
+ * @param name the package name.
+ * @param version the resolved version.
+ * @returns the refusal, or undefined when the package is not one ploaness refuses at that version.
+ */
+export const refusePackage = (name, version) => {
+    const entry = BLOCKED_PACKAGES.find((candidate) => matchesPattern(candidate.name, name));
+    if (entry === undefined) {
+        return undefined;
+    }
+    return entry.from !== undefined && !reachesFloor(version, entry.from)
+        ? undefined
+        : refusalOf(`${name}@${version}`, entry);
+};
+/**
+ * The refused system packages a Dockerfile installs.
+ * @param text the Dockerfile body.
+ * @returns one refusal per refused package, in file order.
+ */
+export const refuseSystemPackages = (text) => systemPackagesInDockerfile(text).flatMap((name) => {
+    const entry = BLOCKED_SYSTEM_PACKAGES.find((candidate) => candidate.name === name);
+    return entry === undefined ? [] : [refusalOf(name, entry)];
+});
+/**
+ * The resolved set as `pnpm licenses list --json` reports it: grouped by licence, each entry carrying
+ * the name and the versions installed.
+ * @param json the command's stdout.
+ * @returns every installed package, or undefined when the text is not that inventory.
+ */
+export const packagesInLicenseInventory = (json) => {
+    const inventory = parseJsonc(json).value;
+    if (!isRecord(inventory) || isArray(inventory)) {
+        return undefined;
+    }
+    return Object.values(inventory).flatMap((group) => (isArray(group) ? group : []).map((entry) => {
+        const versions = asRecord(entry)['versions'];
+        return {
+            name: asText(asRecord(entry)['name']),
+            versions: (isArray(versions) ? versions : []).map((raw) => asText(raw)),
+        };
+    }));
+};
+/**
+ * The refusals across an installed set.
+ * @param packages the resolved set.
+ * @returns one refusal per refused name and version, in inventory order.
+ */
+export const refuseInstalledPackages = (packages) => packages.flatMap((entry) => entry.versions.flatMap((version) => {
+    const refusal = refusePackage(entry.name, version);
+    return refusal === undefined ? [] : [refusal];
+}));
+// The one place the freshness bound defers to this rule. A package whose newest major is refused here,
+// or is licensed outside the allowlist, would otherwise fall two majors behind and be failed for not
+// upgrading into the very release the licence gate would then refuse.
+const refusedLatestNote = (status) => {
+    const refusal = refusePackage(status.name, status.latest);
+    const newest = `${status.name}: the newest release ${status.latest}`;
+    if (refusal !== undefined) {
+        return `${newest} is refused (${refusal.reason}), so freshness stops short of it`;
+    }
+    const licence = status.latestLicense;
+    return licence === undefined || isLicenseAllowed(licence)
+        ? undefined
+        : `${newest} is licensed ${licence}, outside the allowlist, so freshness stops short of it`;
+};
+/**
+ * Split the declared coordinates into those freshness may measure and those whose newest release is
+ * refused, which freshness must not demand.
+ * @param statuses every declared coordinate with what the registry answered for it.
+ * @returns the measurable statuses, and the refused ones with the note the report prints.
+ */
+export const scopeFreshness = (statuses) => statuses.reduce((scope, status) => {
+    const note = refusedLatestNote(status);
+    return note === undefined
+        ? { ...scope, measurable: [...scope.measurable, status] }
+        : { ...scope, refused: [...scope.refused, { status, note }] };
+}, { measurable: [], refused: [] });
+/**
+ * The refusals of a repository's own JSON summary, kept exported so the CLI prints the same words.
+ * @param refusal one refusal.
+ * @param location the file or inventory that carries the subject.
+ * @returns one finding line.
+ */
+export const describeRefusal = (refusal, location) => `${location}: ${refusal.subject} - ${refusal.reason}; use ${refusal.replacement}`;
+//# sourceMappingURL=blocklist.js.map

package/dist/blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../src/blocklist.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6FAA6F;AAC7F,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,mGAAmG;AACnG,uDAAuD;AAEvD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,uBAAuB,GAIxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAA6C,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAmBzD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;AACvF,MAAM,kBAAkB,GAAW,SAAS,CAAA;AAC5C,MAAM,UAAU,GAAW,WAAW,CAAA;AACtC,MAAM,WAAW,GAAW,QAAQ,CAAA;AACpC,MAAM,QAAQ,GAAW,GAAG,CAAA;AAC5B,MAAM,kBAAkB,GAAW,iCAAiC,CAAA;AACpE,sEAAsE;AACtE,MAAM,eAAe,GAAW,CAAC,CAAA;AAEjC,uGAAuG;AACvG,oEAAoE;AACpE,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,UAAU,CAAA;AAQ1E,MAAM,SAAS,GAAG,CAAC,QAA2B,EAAkB,EAAE;IAChE,MAAM,CAAC,KAAK,CAAC,GAAoC,QAAQ,CAAA;IACzD,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE;IACnD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAmB,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAkB,EAAE;IACjE,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,CAAC,GAAoC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAClG,MAAM,SAAS,GAAW,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrD,MAAM,KAAK,GAAW,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,MAAM,GAAY,KAAK,GAAG,SAAS,CAAA;IACzC,OAAO;QACL,GAAG;QACH,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACjF,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;KACP,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9D,MAAM,SAAS,GAAmB,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,WAAW,CAAC,CACjG,CAAA;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,IAAY,EAAW,EAAE,CAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,IAAI,KAAK,OAAO,CAAA;AAEtB,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,KAAoB,EAAU,EAAE,CACvE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;AAE/E,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE,CACjD,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;AAEpG,6FAA6F;AAC7F,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAE,KAAa,EAAW,EAAE;IAC3E,MAAM,MAAM,GACV,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,WAAW,GAA8B,YAAY,CAAC,KAAK,CAAC,CAAA;IAClE,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAmB,EAAE,GAAuB,EAAW,EAAE,CAC7E,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEnF,MAAM,SAAS,GAAG,CAChB,OAAe,EACf,KAA2D,EAClD,EAAE,CAAC,CAAC;IACb,OAAO;IACP,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,WAAW,EAAE,KAAK,CAAC,WAAW;CAC/B,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAuB,EAAE;IAC9D,MAAM,SAAS,GAAmB,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,KAAK,GAA6B,cAAc,CAAC,IAAI,CAAC,CAAC,SAAuB,EAAW,EAAE,CAC/F,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAC3D,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAuB,EAAE;IAClF,MAAM,KAAK,GAA+B,gBAAgB,CAAC,IAAI,CAC7D,CAAC,SAAyB,EAAW,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAC7E,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAsB,EAAE,CACvE,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAsB,EAAE;IAC5E,MAAM,KAAK,GAAqC,uBAAuB,CAAC,IAAI,CAC1E,CAAC,SAA+B,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CACtE,CAAA;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAC5D,CAAC,CAAC,CAAA;AAQJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,IAAY,EAC6B,EAAE;IAC3C,MAAM,SAAS,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAc,EAA+B,EAAE,CACtF,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAc,EAAoB,EAAE;QACrE,MAAM,QAAQ,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;QACrD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAY,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACzF,CAAA;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAqC,EACjB,EAAE,CACtB,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAuB,EAAsB,EAAE,CAC/D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAe,EAAsB,EAAE;IAC7D,MAAM,OAAO,GAAwB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC,CAAC,CACH,CAAA;AAeH,uGAAuG;AACvG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAsB,EAAE;IACzE,MAAM,OAAO,GAAwB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAW,GAAG,MAAM,CAAC,IAAI,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAA;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,gBAAgB,OAAO,CAAC,MAAM,mCAAmC,CAAA;IACnF,CAAC;IACD,MAAM,OAAO,GAAuB,MAAM,CAAC,aAAa,CAAA;IACxD,OAAO,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,MAAM,gBAAgB,OAAO,yDAAyD,CAAA;AAC/F,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAqC,EAAkB,EAAE,CACtF,QAAQ,CAAC,MAAM,CACb,CAAC,KAAqB,EAAE,MAAwB,EAAkB,EAAE;IAClE,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACjE,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAU,EAAE,CAC5E,GAAG,QAAQ,KAAK,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,WAAW,EAAE,CAAA"}