@ploaness/governance 1.0.0

package/dist/install-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-policy.js","sourceRoot":"","sources":["../src/install-policy.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,uGAAuG;AACvG,uFAAuF;AACvF,EAAE;AACF,yGAAyG;AACzG,sGAAsG;AACtG,UAAU;AACV,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,WAAW;IACX,aAAa;IACb,qBAAqB;IACrB,mBAAmB;CACpB,CAAA;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAW,uBAAuB,CAAA;AAErD,uGAAuG;AACvG,MAAM,cAAc,GAAsB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;AAUvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAqB,EAA4B,EAAE,CAC/E,aAAa,CAAC,OAAO,CAAC,CAAC,GAAW,EAA4B,EAAE,CAC9D,sBAAsB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,GAAG,CAC5C,CAAC,CAAC,WAAW,EAAE,SAAS,CAA4B,EAAiB,EAAE,CAAC,CAAC;IACvE,GAAG;IACH,WAAW;IACX,SAAS;CACV,CAAC,CACH,CACF,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,aAAqB,EACrB,WAAoB,EACX,EAAE;IACX,IAAI,mBAAmB,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;AAC5E,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAoB,EAAqB,EAAE;IAChF,MAAM,WAAW,GAAY,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAA;IACjF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;AAClG,CAAC,CAAA"}

package/dist/json-shapes.d.ts

@@ -0,0 +1,86 @@
+/** A parsed document, or the reason it could not be parsed. */
+export interface ParsedJson {
+    readonly value: unknown;
+    /** Undefined when the text parsed; the parser's own message otherwise. */
+    readonly problem: string | undefined;
+}
+/**
+ * Parse JSON that may carry comments and trailing commas.
+ *
+ * `tsconfig.json` legally carries both, and so does a Biome config - which meant the rules that judge
+ * them threw a SyntaxError out of a pure function on a project scaffolded by `create-payload-app`. The
+ * gate that caught it is a precondition, so the whole run halted saying only that the gate "could not
+ * run". Comments are stripped by the same reader the source rules use rather than by a second regex,
+ * because the hard part is not finding `//` but knowing when it is inside a string.
+ * @param text the document to read.
+ * @returns the parsed value, or the reason it could not be parsed.
+ */
+export declare const parseJsonc: (text: string) => ParsedJson;
+/**
+ * Whether a parsed value can be read as an object with string keys.
+ * @param raw the value to narrow, typically a fragment of a parsed manifest.
+ * @returns whether it is a non-null object.
+ */
+export declare const isRecord: (raw: unknown) => raw is Record<string, unknown>;
+/**
+ * Read a parsed value as an object, or as an empty one when it is not.
+ *
+ * A malformed value yields no keys rather than an error, so a typo in a manifest leaves a rule reading
+ * its defaults instead of failing the whole run. Every default in this package is the strict end of its
+ * setting, which is what makes that safe.
+ * @param raw the value to read.
+ * @returns the value narrowed to an object, or an empty object.
+ */
+export declare const asRecord: (raw: unknown) => Record<string, unknown>;
+/**
+ * Read a parsed value as an object of strings, dropping every key whose value is not one.
+ * @param raw the value to read.
+ * @returns the string-valued keys of the value, or an empty object.
+ */
+export declare const asStringRecord: (raw: unknown) => Record<string, string>;
+/**
+ * Whether a parsed value is an array of values still to be narrowed.
+ *
+ * `Array.isArray` alone narrows an `unknown` to `any[]`, which hands every element back untyped and
+ * puts the narrowing beyond the compiler's reach again one step later. This says the same thing and
+ * leaves each element `unknown`, so the caller has to state what it expects.
+ * @param raw the value to narrow.
+ * @returns whether it is an array.
+ */
+export declare const isArray: (raw: unknown) => raw is readonly unknown[];
+/**
+ * Read a parsed value as text, or as the empty string when it is not text.
+ * @param raw the value to read.
+ * @returns the string, or an empty one.
+ */
+export declare const asText: (raw: unknown) => string;
+/**
+ * Read a parsed value as text, or as undefined when it is not text.
+ *
+ * Distinct from `asText` because the two answer different questions. An empty string is a value a rule
+ * compares against; `undefined` says the value was never declared, which is how a caller states that a
+ * rule has nothing to apply. Collapsing the two would turn "ploaness pins no package manager" into
+ * "ploaness requires the package manager to be the empty string".
+ * @param raw the value to read.
+ * @returns the string, or undefined.
+ */
+export declare const asOptionalText: (raw: unknown) => string | undefined;
+/**
+ * Read one key of a parsed value.
+ * @param raw the value holding the key.
+ * @param key the key to read.
+ * @returns the value at that key, or undefined when the value is not an object.
+ */
+export declare const readKey: (raw: unknown, key: string) => unknown;
+/**
+ * Every package a manifest declares, whichever block it sits in.
+ *
+ * Three modules asked this question and three of them answered it, which is the shape of a drift rather
+ * than of a helper: the CLI's preflight copy read the versions as unknowns and its freshness copy read
+ * them as strings, so the two disagreed about what a manifest declaring a non-string version had said.
+ * It lives here because the question is about the shape of a parsed manifest and not about any one rule.
+ * @param packageJson the parsed manifest.
+ * @returns the declared name-to-version pairs, a devDependency winning a name declared in both blocks.
+ */
+export declare const declaredDependencies: (packageJson: unknown) => Record<string, string>;
+//# sourceMappingURL=json-shapes.d.ts.map

package/dist/json-shapes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-shapes.d.ts","sourceRoot":"","sources":["../src/json-shapes.ts"],"names":[],"mappings":"AAYA,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,UASzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAC5B,CAAA;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAA+B,CAAA;AAK7F;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CACM,CAAA;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,SAAS,OAAO,EAAwB,CAAA;AAEtF;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,KAAK,OAAO,KAAG,MAA8C,CAAA;AAEpF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,OAAO,KAAG,MAAM,GAAG,SACZ,CAAA;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAAI,KAAK,OAAO,EAAE,KAAK,MAAM,KAAG,OAA6B,CAAA;AAEjF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAI,aAAa,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAY/E,CAAA"}

package/dist/json-shapes.js

@@ -0,0 +1,124 @@
+// Narrowing a parsed manifest, which arrives as `unknown` and has to be read as an object.
+//
+// Six modules each carried their own copy of these two functions, and every copy narrowed with a type
+// ASSERTION. That is the wrong instrument twice over: an assertion is a claim the compiler accepts
+// without checking, and `type-coverage --strict` counts each one as untyped, which is what put a 100%
+// score out of reach here. A user-defined type guard says exactly the same thing and IS checked, so the
+// narrowing survives a refactor that changes the shape underneath it.
+//
+// An array narrows to a record, as it did before: `typeof [] === 'object'`, and a manifest key holding
+// an array is read by whichever caller cares, not refused here.
+import { maskLiterals, stripComments } from './source-text.js';
+// A trailing comma is legal in JSONC and in nothing `JSON.parse` accepts, so it is removed after the
+// comments are, when a comma followed only by whitespace and a closing bracket can be recognised.
+const TRAILING_COMMA = /,(?=\s*[\]}])/g;
+// Located on a mask rather than on the document, and removed from the document by offset. Run over the
+// text itself the pattern reads inside a string too, and a glob such as `{ts,}` in a Biome `includes`
+// lost the comma it declared - a silent edit to a parsed value, in the reader every wiring rule uses.
+// Removed from the end backwards so each remaining offset still names the character it named.
+const withoutTrailingCommas = (text) => [...maskLiterals(text).matchAll(TRAILING_COMMA)]
+    .map((match) => match.index)
+    .reduceRight((current, at) => current.slice(0, at) + current.slice(at + 1), text);
+/**
+ * Parse JSON that may carry comments and trailing commas.
+ *
+ * `tsconfig.json` legally carries both, and so does a Biome config - which meant the rules that judge
+ * them threw a SyntaxError out of a pure function on a project scaffolded by `create-payload-app`. The
+ * gate that caught it is a precondition, so the whole run halted saying only that the gate "could not
+ * run". Comments are stripped by the same reader the source rules use rather than by a second regex,
+ * because the hard part is not finding `//` but knowing when it is inside a string.
+ * @param text the document to read.
+ * @returns the parsed value, or the reason it could not be parsed.
+ */
+export const parseJsonc = (text) => {
+    try {
+        return {
+            value: JSON.parse(withoutTrailingCommas(stripComments(text))),
+            problem: undefined,
+        };
+    }
+    catch (error) {
+        return { value: undefined, problem: error instanceof Error ? error.message : String(error) };
+    }
+};
+/**
+ * Whether a parsed value can be read as an object with string keys.
+ * @param raw the value to narrow, typically a fragment of a parsed manifest.
+ * @returns whether it is a non-null object.
+ */
+export const isRecord = (raw) => typeof raw === 'object' && raw !== null;
+/**
+ * Read a parsed value as an object, or as an empty one when it is not.
+ *
+ * A malformed value yields no keys rather than an error, so a typo in a manifest leaves a rule reading
+ * its defaults instead of failing the whole run. Every default in this package is the strict end of its
+ * setting, which is what makes that safe.
+ * @param raw the value to read.
+ * @returns the value narrowed to an object, or an empty object.
+ */
+export const asRecord = (raw) => (isRecord(raw) ? raw : {});
+const isStringEntry = (entry) => typeof entry[1] === 'string';
+/**
+ * Read a parsed value as an object of strings, dropping every key whose value is not one.
+ * @param raw the value to read.
+ * @returns the string-valued keys of the value, or an empty object.
+ */
+export const asStringRecord = (raw) => Object.fromEntries(Object.entries(asRecord(raw)).filter(isStringEntry));
+/**
+ * Whether a parsed value is an array of values still to be narrowed.
+ *
+ * `Array.isArray` alone narrows an `unknown` to `any[]`, which hands every element back untyped and
+ * puts the narrowing beyond the compiler's reach again one step later. This says the same thing and
+ * leaves each element `unknown`, so the caller has to state what it expects.
+ * @param raw the value to narrow.
+ * @returns whether it is an array.
+ */
+export const isArray = (raw) => Array.isArray(raw);
+/**
+ * Read a parsed value as text, or as the empty string when it is not text.
+ * @param raw the value to read.
+ * @returns the string, or an empty one.
+ */
+export const asText = (raw) => (typeof raw === 'string' ? raw : '');
+/**
+ * Read a parsed value as text, or as undefined when it is not text.
+ *
+ * Distinct from `asText` because the two answer different questions. An empty string is a value a rule
+ * compares against; `undefined` says the value was never declared, which is how a caller states that a
+ * rule has nothing to apply. Collapsing the two would turn "ploaness pins no package manager" into
+ * "ploaness requires the package manager to be the empty string".
+ * @param raw the value to read.
+ * @returns the string, or undefined.
+ */
+export const asOptionalText = (raw) => typeof raw === 'string' ? raw : undefined;
+/**
+ * Read one key of a parsed value.
+ * @param raw the value holding the key.
+ * @param key the key to read.
+ * @returns the value at that key, or undefined when the value is not an object.
+ */
+export const readKey = (raw, key) => asRecord(raw)[key];
+/**
+ * Every package a manifest declares, whichever block it sits in.
+ *
+ * Three modules asked this question and three of them answered it, which is the shape of a drift rather
+ * than of a helper: the CLI's preflight copy read the versions as unknowns and its freshness copy read
+ * them as strings, so the two disagreed about what a manifest declaring a non-string version had said.
+ * It lives here because the question is about the shape of a parsed manifest and not about any one rule.
+ * @param packageJson the parsed manifest.
+ * @returns the declared name-to-version pairs, a devDependency winning a name declared in both blocks.
+ */
+export const declaredDependencies = (packageJson) => ({
+    ...asStringRecord(readKey(packageJson, 'dependencies')),
+    ...asStringRecord(readKey(packageJson, 'devDependencies')),
+    // Optional dependencies are INSTALLED dependencies whose absence is tolerated, so every rule about a
+    // declared version applies to them: a range still floats, a pin still has to match, and a Payload
+    // package still has to agree with its family. Left out, they were the one block a project could put a
+    // stale version in and have nothing notice - which is where a real consumer's platform-specific image
+    // packages sat, still naming the sharp release the project had just moved off.
+    //
+    // `peerDependencies` are deliberately NOT here. A peer is a requirement on the consumer's tree rather
+    // than a version this package installs, and a range is the correct way to express one.
+    ...asStringRecord(readKey(packageJson, 'optionalDependencies')),
+});
+//# sourceMappingURL=json-shapes.js.map

package/dist/json-shapes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-shapes.js","sourceRoot":"","sources":["../src/json-shapes.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,sGAAsG;AACtG,mGAAmG;AACnG,sGAAsG;AACtG,wGAAwG;AACxG,sEAAsE;AACtE,EAAE;AACF,uGAAuG;AACvG,gEAAgE;AAChE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAS9D,qGAAqG;AACrG,kGAAkG;AAClG,MAAM,cAAc,GAAW,gBAAgB,CAAA;AAE/C,uGAAuG;AACvG,sGAAsG;AACtG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAU,EAAE,CACrD,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;KAC7C,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KACpD,WAAW,CACV,CAAC,OAAe,EAAE,EAAU,EAAU,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EACrF,IAAI,CACL,CAAA;AAEL;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAc,EAAE;IACrD,IAAI,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,OAAO,EAAE,SAAS;SACnB,CAAA;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC9F,CAAC;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAkC,EAAE,CACvE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAA2B,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAE7F,MAAM,aAAa,GAAG,CAAC,KAAwB,EAA6B,EAAE,CAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAA;AAE9B;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAY,EAA0B,EAAE,CACrE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;AAEzE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAY,EAA6B,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAEtF;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAEpF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAY,EAAsB,EAAE,CACjE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,GAAW,EAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;AAEjF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAoB,EAA0B,EAAE,CAAC,CAAC;IACrF,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACvD,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAC1D,qGAAqG;IACrG,kGAAkG;IAClG,sGAAsG;IACtG,sGAAsG;IACtG,+EAA+E;IAC/E,EAAE;IACF,sGAAsG;IACtG,uFAAuF;IACvF,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;CAChE,CAAC,CAAA"}

package/dist/license-allowlist.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Evaluate an SPDX licence expression against the policy.
+ *
+ * An OR passes when ANY operand does, because the consumer may choose that operand; an AND requires
+ * every one; a parenthesised group is evaluated as a unit rather than flattened away.
+ * @param expression the declared licence, which may be a compound SPDX expression.
+ * @returns whether the policy permits it.
+ */
+export declare const isLicenseAllowed: (expression: string) => boolean;
+export interface LicensedPackage {
+    readonly name: string;
+    readonly license: string;
+}
+export declare const findLicenseViolations: (packages: readonly LicensedPackage[]) => readonly LicensedPackage[];
+//# sourceMappingURL=license-allowlist.d.ts.map

package/dist/license-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-allowlist.d.ts","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAsKA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,YAAY,MAAM,KAAG,OAWrD,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAGD,eAAO,MAAM,qBAAqB,GAChC,UAAU,SAAS,eAAe,EAAE,KACnC,SAAS,eAAe,EACmE,CAAA"}

package/dist/license-allowlist.js

@@ -0,0 +1,157 @@
+import { escapeForRegex } from './text-escapes.js';
+// License allowlist policy for dependencies. The pure logic - the allowlist and the SPDX-expression
+// evaluator - lives here so it is unit-tested; the `licenses` gate in
+// packages/cli/src/checks/dependencies.ts shells out to pnpm and reports.
+// The two groups are arrays rather than sets so the allowlist can be assembled with a single
+// constructor call. Merging two sets would want `Set.prototype.union`, which the ES2023 lib target does
+// not carry, and a lint fix that reaches for it produces code that does not compile.
+// Permissive licenses: no copyleft obligations, safe for an MIT-licensed template.
+// Three entries are here for a reason the identifier does not show. `PSF-2.0` and `Python-2.0` are the
+// same terms under two names, which is not a distinction a consumer can act on: `argparse` - reached
+// through `js-yaml`, so present in almost every tree rather than chosen - shipped 3.0.0 as the second
+// and 3.0.1 as the first. `EDL-1.0` carries the Eclipse name but is the BSD-3-Clause text, so it
+// belongs beside BSD rather than beside EPL. `X11` is a separate SPDX id from `MIT` for the same
+// terms, and a package that picks it is not asking for anything MIT does not already grant.
+const PERMISSIVE = [
+    '0BSD',
+    'AFL-2.1',
+    'AFL-3.0',
+    'Apache-2.0',
+    'Artistic-2.0',
+    'BSD-2-Clause',
+    'BSD-3-Clause',
+    'BSL-1.0',
+    'BlueOak-1.0.0',
+    'CC-BY-3.0',
+    'CC-BY-4.0',
+    'CC0-1.0',
+    'EDL-1.0',
+    'ISC',
+    'MIT',
+    'MIT-0',
+    'MulanPSL-2.0',
+    'NCSA',
+    'OFL-1.1',
+    'PSF-2.0',
+    'PostgreSQL',
+    'Python-2.0',
+    'UPL-1.0',
+    'Unicode-3.0',
+    'Unicode-DFS-2016',
+    'Unlicense',
+    'W3C',
+    'WTFPL',
+    'X11',
+    'Zlib',
+];
+// Weak copyleft, permitted only as UNMODIFIED dependencies: the file-level (MPL, EPL, CDDL) and
+// dynamic-linking (LGPL) copyleft does not reach this project's own source. Each id is listed
+// explicitly so it stays a conscious decision. Strong copyleft (GPL, AGPL) is deliberately absent and
+// therefore rejected, and so is a license that restricts the field of use - `Hippocratic-2.1` reads as
+// an ethical licence and is not an open-source one, which is a distinction only this list records.
+//
+// The bare `LGPL-2.1` and `LGPL-3.0` are DEPRECATED SPDX ids, and they are here because a policy
+// admits a license rather than a spelling of one: listing `-only` and `-or-later` while omitting the
+// form most packages actually write rejected the licence this list was written to permit. The `+`
+// suffix reaches the bare id too, so `LGPL-3.0+` resolves here rather than nowhere.
+const WEAK_COPYLEFT = [
+    'CDDL-1.0',
+    'CDDL-1.1',
+    'EPL-1.0',
+    'EPL-2.0',
+    'LGPL-2.1',
+    'LGPL-2.1-only',
+    'LGPL-2.1-or-later',
+    'LGPL-3.0',
+    'LGPL-3.0-only',
+    'LGPL-3.0-or-later',
+    'MPL-1.1',
+    'MPL-2.0',
+];
+const ALLOWED = new Set([...PERMISSIVE, ...WEAK_COPYLEFT]);
+// SPDX ids are case-insensitive in the registries that emit them, and `Apache-2.0` arrives spelled at
+// least three ways. The allowlist is matched on a folded id so a casing difference is not a licence
+// decision. A `WITH` exception (`GPL-2.0 WITH Classpath-exception-2.0`) names the same licence plus a
+// grant, so the licence half decides; a `+` suffix means "or later", which is the same licence too.
+const ALLOWED_FOLDED = new Set([...ALLOWED].map((id) => id.toLowerCase()));
+// Anchored on a single space run rather than a nested quantifier: `\s+WITH\s+(?:\S.*)?$` backtracks
+// super-linearly on a long id, and an expression comes from a registry rather than from this repository.
+const WITH_EXCEPTION = /\sWITH\s[\s\S]*$/i;
+const OR_LATER = /\+$/;
+const isAllowedId = (id) => ALLOWED_FOLDED.has(id.trim().replace(WITH_EXCEPTION, '').replace(OR_LATER, '').toLowerCase());
+// The operators, lowest precedence first. SPDX binds AND more tightly than OR, so a correct evaluator
+// splits on OR before AND - and the ONLY correct order is that one. Splitting on AND first, after
+// stripping the parentheses, turned `(MIT OR Apache-2.0) AND ISC` into the operands
+// `MIT OR Apache-2.0` and `ISC`, and then failed the first as though it were an unknown id: every
+// mixed expression was reported as a licence violation whatever it actually said.
+const OR = ' OR ';
+const AND = ' AND ';
+const stepDepth = (depth, character) => {
+    if (character === '(') {
+        return depth + 1;
+    }
+    return character === ')' ? depth - 1 : depth;
+};
+// Both figures come from one walk, because the two questions below are about the same characters: how
+// far a fragment leaves the parentheses open, and whether it ever closed a group it had not opened.
+const walkParentheses = (text) => 
+// Only the two parentheses are counted, and neither of them decomposes.
+// eslint-disable-next-line @typescript-eslint/no-misused-spread -- see the note above
+[...text].reduce((state, character) => {
+    const depth = stepDepth(state.depth, character);
+    return { depth, lowest: Math.min(state.lowest, depth) };
+}, { depth: 0, lowest: 0 });
+// How far a fragment leaves the parentheses open, so an operator inside a group is not split on.
+const balanceOf = (text) => walkParentheses(text).depth;
+// Where the operator occurs at parenthesis depth zero, which is the only place it separates operands.
+// An occurrence inside a group belongs to that group: in `(MIT OR Apache-2.0) AND ISC` the OR is the
+// group's own, and splitting on it would produce operands the author never wrote.
+const splitPoints = (expression, operator) => [...expression.matchAll(new RegExp(escapeForRegex(operator), 'g'))]
+    .map((match) => match.index)
+    .filter((index) => balanceOf(expression.slice(0, index)) === 0);
+const splitOutside = (expression, operator) => {
+    const points = splitPoints(expression, operator);
+    const ends = [...points, expression.length];
+    return [0, ...points.map((point) => point + operator.length)].map((start, index) => expression.slice(start, ends[index] ?? expression.length));
+};
+// Whether the outer parentheses enclose the WHOLE expression, rather than opening one group and closing
+// a different one. A net balance of zero does not answer that, and answering it that way was wrong in
+// both directions: `(MIT) OR (ISC)` also nets to zero, and stripping its outer characters left
+// `MIT) OR (ISC`, where the early `)` drives the running depth negative so no operator sits at depth
+// zero any more. Such an expression was then read as one unrecognised id and rejected - while
+// `(MIT OR GPL-3.0-only) AND (GPL-3.0-only OR AGPL-3.0-only)` split at two ORs that were never
+// top-level, found `MIT` among the pieces, and passed. The lowest depth the inner text reaches is what
+// separates the two cases.
+const isWhollyEnclosed = (inner) => {
+    const walk = walkParentheses(inner);
+    return walk.depth === 0 && walk.lowest === 0;
+};
+const unwrap = (expression) => {
+    const trimmed = expression.trim();
+    return trimmed.startsWith('(') && trimmed.endsWith(')') && isWhollyEnclosed(trimmed.slice(1, -1))
+        ? unwrap(trimmed.slice(1, -1))
+        : trimmed;
+};
+/**
+ * Evaluate an SPDX licence expression against the policy.
+ *
+ * An OR passes when ANY operand does, because the consumer may choose that operand; an AND requires
+ * every one; a parenthesised group is evaluated as a unit rather than flattened away.
+ * @param expression the declared licence, which may be a compound SPDX expression.
+ * @returns whether the policy permits it.
+ */
+export const isLicenseAllowed = (expression) => {
+    const clean = unwrap(expression);
+    const alternatives = splitOutside(clean, OR);
+    if (alternatives.length > 1) {
+        return alternatives.some((part) => isLicenseAllowed(part));
+    }
+    const conjuncts = splitOutside(clean, AND);
+    if (conjuncts.length > 1) {
+        return conjuncts.every((part) => isLicenseAllowed(part));
+    }
+    return isAllowedId(clean);
+};
+// Return the packages whose license is not permitted by policy; an empty array means a clean tree.
+export const findLicenseViolations = (packages) => packages.filter((package_) => !isLicenseAllowed(package_.license));
+//# sourceMappingURL=license-allowlist.js.map

package/dist/license-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-allowlist.js","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,oGAAoG;AACpG,sEAAsE;AACtE,0EAA0E;AAE1E,6FAA6F;AAC7F,wGAAwG;AACxG,qFAAqF;AAErF,mFAAmF;AACnF,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,UAAU,GAAsB;IACpC,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,SAAS;IACT,eAAe;IACf,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,cAAc;IACd,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAA;AAED,gGAAgG;AAChG,8FAA8F;AAC9F,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,aAAa,GAAsB;IACvC,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,SAAS;CACV,CAAA;AAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC,CAAA;AAEvF,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,cAAc,GAAwB,IAAI,GAAG,CACjD,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAC3D,CAAA;AACD,oGAAoG;AACpG,yGAAyG;AACzG,MAAM,cAAc,GAAW,mBAAmB,CAAA;AAClD,MAAM,QAAQ,GAAW,KAAK,CAAA;AAE9B,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAC1C,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAE/F,sGAAsG;AACtG,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,EAAE,GAAW,MAAM,CAAA;AACzB,MAAM,GAAG,GAAW,OAAO,CAAA;AAQ3B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE;IAC7D,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,KAAK,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC9C,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAoB,EAAE;AACzD,wEAAwE;AACxE,sFAAsF;AACtF,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CACd,CAAC,KAAuB,EAAE,SAAiB,EAAoB,EAAE;IAC/D,MAAM,KAAK,GAAW,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC,EACD,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CACxB,CAAA;AAEH,iGAAiG;AACjG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AAEvE,sGAAsG;AACtG,qGAAqG;AACrG,kFAAkF;AAClF,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE,CAC9E,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KACpD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAEpF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE;IAC/E,MAAM,MAAM,GAAsB,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,IAAI,GAAsB,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC/E,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CACvC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAC5D,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,qGAAqG;AACrG,8FAA8F;AAC9F,+FAA+F;AAC/F,uGAAuG;AACvG,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE;IAClD,MAAM,IAAI,GAAqB,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE;IAC5C,MAAM,OAAO,GAAW,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAW,EAAE;IAC9D,MAAM,KAAK,GAAW,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,YAAY,GAAsB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,SAAS,GAAsB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAOD,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,QAAoC,EACR,EAAE,CAC9B,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAyB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/dist/network-policy.d.ts

@@ -0,0 +1,69 @@
+/** The sentence of the governing standard this module decides, quoted back in every refusal. */
+export declare const NETWORK_RULE: string;
+/** Which runtime entry point asked. Each reaches its verdict differently, so it is data, not a flag. */
+export type NetworkApi = 'connect' | 'lookup' | 'resolve' | 'fetch';
+/** One attempted reach, normalised from whichever entry point a test called. */
+export interface NetworkAttempt {
+    readonly api: NetworkApi;
+    /** The host as the caller wrote it, or undefined for a unix socket, which is not a network at all. */
+    readonly host: string | undefined;
+    /** What a refusal names, for example `127.0.0.1:5432` or `https://api.example.com/v1`. */
+    readonly destination: string;
+}
+/** One entry of `os.networkInterfaces()`, narrowed to the single field this module reads. */
+export interface NetworkInterfaceAddress {
+    readonly address: string;
+}
+/** The resolver entry points, every one of which queries a nameserver rather than reading a hosts file. */
+export declare const RESOLVER_METHODS: readonly string[];
+/**
+ * The addresses that name this machine, read out of an `os.networkInterfaces()` result.
+ *
+ * A test that connects to the box's own routable address is still on the machine it runs on, so those
+ * addresses join the loopback range rather than being refused with everything else.
+ * @param interfaces the interface map, as `os.networkInterfaces()` returns it.
+ * @returns every address it carries, in the canonical spelling {@link isMachineLocalHost} compares against.
+ */
+export declare const localAddresses: (interfaces: Readonly<Record<string, readonly NetworkInterfaceAddress[] | undefined>>) => ReadonlySet<string>;
+/**
+ * Whether a host names the machine the test runs on.
+ *
+ * A name that is not one of the localhost spellings is refused on its face rather than resolved, because
+ * a resolution is itself the thing being refused. That is why a bare service name such as `postgres`,
+ * and a docker gateway such as `host.docker.internal`, do not pass: neither can be shown to be this
+ * machine without asking a nameserver.
+ * @param host the host as the caller wrote it, or undefined when the caller named none.
+ * @param local the addresses this machine carries, from {@link localAddresses}.
+ * @returns true when the reach stays on this machine.
+ */
+export declare const isMachineLocalHost: (host: string | undefined, local: ReadonlySet<string>) => boolean;
+/**
+ * The host a URL names.
+ *
+ * Undefined when the value names no host - a relative path, which under a DOM environment is the page's
+ * own origin and reaches nothing, or a string that is not a URL at all.
+ * @param rawUrl the value a test passed to fetch.
+ * @returns the host, or undefined.
+ */
+export declare const hostOfUrl: (rawUrl: string) => string | undefined;
+/**
+ * Read one `net.Socket.prototype.connect` call, whichever of its three forms the caller used.
+ *
+ * A unix socket reports no host, because a path is not a network: the two ends are the same machine by
+ * construction, and refusing one would break every test that talks to a local service over a socket file.
+ * @param callArguments the arguments the call was made with.
+ * @returns the attempt, normalised.
+ */
+export declare const describeSocketTarget: (callArguments: readonly unknown[]) => NetworkAttempt;
+/**
+ * Decide one attempted reach.
+ *
+ * A resolver query is refused whatever host it names, loopback included. The resolver family bypasses
+ * the hosts file and sends a packet to a nameserver, so `resolve4('localhost')` leaves the machine as
+ * surely as any other name does.
+ * @param attempt the reach to judge.
+ * @param local the addresses this machine carries, from {@link localAddresses}.
+ * @returns undefined when the reach is allowed, or the message a refusal should carry.
+ */
+export declare const findNetworkEscape: (attempt: NetworkAttempt, local: ReadonlySet<string>) => string | undefined;
+//# sourceMappingURL=network-policy.d.ts.map

package/dist/network-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../src/network-policy.ts"],"names":[],"mappings":"AAcA,gGAAgG;AAChG,eAAO,MAAM,YAAY,EAAE,MAAmE,CAAA;AAE9F,wGAAwG;AACxG,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;AAEnE,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,sGAAsG;IACtG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,2GAA2G;AAC3G,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAe7C,CAAA;AA6CD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,YAAY,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC,CAAC,KACnF,WAAW,CAAC,MAAM,CASlB,CAAA;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,GAAG,SAAS,EACxB,OAAO,WAAW,CAAC,MAAM,CAAC,KACzB,OAMF,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAMnD,CAAA;AAuBD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,eAAe,SAAS,OAAO,EAAE,KAAG,cAcxE,CAAA;AAUD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,cAAc,EACvB,OAAO,WAAW,CAAC,MAAM,CAAC,KACzB,MAAM,GAAG,SAKX,CAAA"}