@ploaness/governance 1.1.0 → 1.2.0

package/dist/blocklist.js

@@ -0,0 +1,187 @@
+// The refusal rule: whether an image reference, an installed package, or a Dockerfile install line
+// names something in `blocklist-entries.ts`, and the one place freshness has to defer to it.
+//
+// A reference is matched on its repository after normalisation, because the same image is written
+// `mongo`, `docker.io/mongo`, `library/mongo`, and `docker.io/library/mongo`, and a list keyed on the
+// spelling would refuse one of them and pull the other. The tag decides only where an entry carries a
+// floor: a tag below the floor is the permissive release line and is left to the licence gate, and a
+// tag that cannot be placed against the floor - `latest`, none, `7` against a floor of `7.4`, an
+// `-alpine` suffix on a floating major - is refused, because a tag that may resolve past the floor
+// tomorrow is not a proof that it sits below it today.
+import { BLOCKED_IMAGES, BLOCKED_PACKAGES, BLOCKED_SYSTEM_PACKAGES, } from './blocklist-entries.js';
+import { systemPackagesInDockerfile } from './container-images.js';
+import { parseVersion } from './dependency-freshness.js';
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+import { isLicenseAllowed } from './license-allowlist.js';
+const DOCKER_HUB_HOSTS = new Set(['docker.io', 'index.docker.io']);
+const OFFICIAL_NAMESPACE = 'library';
+const LOCAL_HOST = 'localhost';
+const MUTABLE_TAG = 'latest';
+const WILDCARD = '*';
+const NUMERIC_COMPONENTS = /^v?(?<components>\d+(?:\.\d+)*)/;
+// A reference is a name-and-tag and at most one digest after the `@`.
+const REFERENCE_PARTS = 2;
+// A first path segment is a registry host when it carries a dot or a port, or is `localhost`; a Docker
+// Hub namespace never does. The rule the docker CLI itself applies.
+const isRegistryHost = (segment) => segment.includes('.') || segment.includes(':') || segment === LOCAL_HOST;
+const splitHost = (segments) => {
+    const [first] = segments;
+    if (first === undefined || segments.length === 1 || !isRegistryHost(first)) {
+        return { host: undefined, path: segments };
+    }
+    return { host: DOCKER_HUB_HOSTS.has(first) ? undefined : first, path: segments.slice(1) };
+};
+const normaliseRepository = (name) => {
+    const { host, path } = splitHost(name.toLowerCase().split('/'));
+    if (host !== undefined) {
+        return [host, ...path].join('/');
+    }
+    return (path.length > 1 && path[0] === OFFICIAL_NAMESPACE ? path.slice(1) : path).join('/');
+};
+/**
+ * Split an image reference as a Dockerfile, a workflow, or a compose model writes it.
+ * @param raw the reference, such as `docker.io/library/redis:7.4.1@sha256:...`.
+ * @returns the normalised repository, and the tag and digest when present.
+ */
+export const parseImageReference = (raw) => {
+    const [nameAndTag = '', digest] = raw.split('@', REFERENCE_PARTS);
+    const lastSlash = nameAndTag.lastIndexOf('/');
+    const colon = nameAndTag.lastIndexOf(':');
+    const hasTag = colon > lastSlash;
+    return {
+        raw,
+        repository: normaliseRepository(hasTag ? nameAndTag.slice(0, colon) : nameAndTag),
+        tag: hasTag ? nameAndTag.slice(colon + 1) : undefined,
+        digest,
+    };
+};
+/**
+ * Whether a reference may resolve to a different image tomorrow: no digest, and no tag or `latest`.
+ * @param raw the reference as written.
+ * @returns true when nothing in the reference pins what is pulled.
+ */
+export const isMutableImageReference = (raw) => {
+    const reference = parseImageReference(raw);
+    return (reference.digest === undefined && (reference.tag === undefined || reference.tag === MUTABLE_TAG));
+};
+const matchesPattern = (pattern, name) => pattern.endsWith(WILDCARD)
+    ? name.startsWith(pattern.slice(0, -WILDCARD.length))
+    : name === pattern;
+const compareCore = (one, other) => one.major - other.major || one.minor - other.minor || one.patch - other.patch;
+const componentCount = (version) => (NUMERIC_COMPONENTS.exec(version)?.groups?.['components'] ?? '').split('.').filter(Boolean).length;
+// Undecidable is refused: a version that cannot be placed against the floor is not below it.
+const reachesFloor = (version, floor) => {
+    const parsed = version === undefined ? undefined : parseVersion(version);
+    const floorParsed = parseVersion(floor);
+    if (version === undefined || parsed === undefined || floorParsed === undefined) {
+        return true;
+    }
+    return componentCount(version) < componentCount(floor) || compareCore(parsed, floorParsed) >= 0;
+};
+const isAllowedTag = (entry, tag) => entry.allowedTag !== undefined && tag !== undefined && entry.allowedTag.test(tag);
+const refusalOf = (subject, entry) => ({
+    subject,
+    reason: entry.reason,
+    replacement: entry.replacement,
+});
+/**
+ * Whether an image reference names a refused repository at a refused tag.
+ * @param raw the reference as written.
+ * @returns the refusal, or undefined when the image is not one ploaness refuses.
+ */
+export const refuseImage = (raw) => {
+    const reference = parseImageReference(raw);
+    const entry = BLOCKED_IMAGES.find((candidate) => matchesPattern(candidate.repository, reference.repository));
+    if (entry === undefined || isAllowedTag(entry, reference.tag)) {
+        return undefined;
+    }
+    return entry.from !== undefined && !reachesFloor(reference.tag, entry.from)
+        ? undefined
+        : refusalOf(raw, entry);
+};
+/**
+ * Whether an installed package at a version is one ploaness refuses.
+ * @param name the package name.
+ * @param version the resolved version.
+ * @returns the refusal, or undefined when the package is not one ploaness refuses at that version.
+ */
+export const refusePackage = (name, version) => {
+    const entry = BLOCKED_PACKAGES.find((candidate) => matchesPattern(candidate.name, name));
+    if (entry === undefined) {
+        return undefined;
+    }
+    return entry.from !== undefined && !reachesFloor(version, entry.from)
+        ? undefined
+        : refusalOf(`${name}@${version}`, entry);
+};
+/**
+ * The refused system packages a Dockerfile installs.
+ * @param text the Dockerfile body.
+ * @returns one refusal per refused package, in file order.
+ */
+export const refuseSystemPackages = (text) => systemPackagesInDockerfile(text).flatMap((name) => {
+    const entry = BLOCKED_SYSTEM_PACKAGES.find((candidate) => candidate.name === name);
+    return entry === undefined ? [] : [refusalOf(name, entry)];
+});
+/**
+ * The resolved set as `pnpm licenses list --json` reports it: grouped by licence, each entry carrying
+ * the name and the versions installed.
+ * @param json the command's stdout.
+ * @returns every installed package, or undefined when the text is not that inventory.
+ */
+export const packagesInLicenseInventory = (json) => {
+    const inventory = parseJsonc(json).value;
+    if (!isRecord(inventory) || isArray(inventory)) {
+        return undefined;
+    }
+    return Object.values(inventory).flatMap((group) => (isArray(group) ? group : []).map((entry) => {
+        const versions = asRecord(entry)['versions'];
+        return {
+            name: asText(asRecord(entry)['name']),
+            versions: (isArray(versions) ? versions : []).map((raw) => asText(raw)),
+        };
+    }));
+};
+/**
+ * The refusals across an installed set.
+ * @param packages the resolved set.
+ * @returns one refusal per refused name and version, in inventory order.
+ */
+export const refuseInstalledPackages = (packages) => packages.flatMap((entry) => entry.versions.flatMap((version) => {
+    const refusal = refusePackage(entry.name, version);
+    return refusal === undefined ? [] : [refusal];
+}));
+// The one place the freshness bound defers to this rule. A package whose newest major is refused here,
+// or is licensed outside the allowlist, would otherwise fall two majors behind and be failed for not
+// upgrading into the very release the licence gate would then refuse.
+const refusedLatestNote = (status) => {
+    const refusal = refusePackage(status.name, status.latest);
+    const newest = `${status.name}: the newest release ${status.latest}`;
+    if (refusal !== undefined) {
+        return `${newest} is refused (${refusal.reason}), so freshness stops short of it`;
+    }
+    const licence = status.latestLicense;
+    return licence === undefined || isLicenseAllowed(licence)
+        ? undefined
+        : `${newest} is licensed ${licence}, outside the allowlist, so freshness stops short of it`;
+};
+/**
+ * Split the declared coordinates into those freshness may measure and those whose newest release is
+ * refused, which freshness must not demand.
+ * @param statuses every declared coordinate with what the registry answered for it.
+ * @returns the measurable statuses, and the refused ones with the note the report prints.
+ */
+export const scopeFreshness = (statuses) => statuses.reduce((scope, status) => {
+    const note = refusedLatestNote(status);
+    return note === undefined
+        ? { ...scope, measurable: [...scope.measurable, status] }
+        : { ...scope, refused: [...scope.refused, { status, note }] };
+}, { measurable: [], refused: [] });
+/**
+ * The refusals of a repository's own JSON summary, kept exported so the CLI prints the same words.
+ * @param refusal one refusal.
+ * @param location the file or inventory that carries the subject.
+ * @returns one finding line.
+ */
+export const describeRefusal = (refusal, location) => `${location}: ${refusal.subject} - ${refusal.reason}; use ${refusal.replacement}`;
+//# sourceMappingURL=blocklist.js.map

package/dist/blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../src/blocklist.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6FAA6F;AAC7F,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,mGAAmG;AACnG,uDAAuD;AAEvD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,uBAAuB,GAIxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAA6C,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAmBzD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;AACvF,MAAM,kBAAkB,GAAW,SAAS,CAAA;AAC5C,MAAM,UAAU,GAAW,WAAW,CAAA;AACtC,MAAM,WAAW,GAAW,QAAQ,CAAA;AACpC,MAAM,QAAQ,GAAW,GAAG,CAAA;AAC5B,MAAM,kBAAkB,GAAW,iCAAiC,CAAA;AACpE,sEAAsE;AACtE,MAAM,eAAe,GAAW,CAAC,CAAA;AAEjC,uGAAuG;AACvG,oEAAoE;AACpE,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,UAAU,CAAA;AAQ1E,MAAM,SAAS,GAAG,CAAC,QAA2B,EAAkB,EAAE;IAChE,MAAM,CAAC,KAAK,CAAC,GAAoC,QAAQ,CAAA;IACzD,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE;IACnD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAmB,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAkB,EAAE;IACjE,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,CAAC,GAAoC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAClG,MAAM,SAAS,GAAW,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrD,MAAM,KAAK,GAAW,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,MAAM,GAAY,KAAK,GAAG,SAAS,CAAA;IACzC,OAAO;QACL,GAAG;QACH,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACjF,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;KACP,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9D,MAAM,SAAS,GAAmB,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,WAAW,CAAC,CACjG,CAAA;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,IAAY,EAAW,EAAE,CAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,IAAI,KAAK,OAAO,CAAA;AAEtB,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,KAAoB,EAAU,EAAE,CACvE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;AAE/E,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE,CACjD,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;AAEpG,6FAA6F;AAC7F,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAE,KAAa,EAAW,EAAE;IAC3E,MAAM,MAAM,GACV,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,WAAW,GAA8B,YAAY,CAAC,KAAK,CAAC,CAAA;IAClE,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAmB,EAAE,GAAuB,EAAW,EAAE,CAC7E,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEnF,MAAM,SAAS,GAAG,CAChB,OAAe,EACf,KAA2D,EAClD,EAAE,CAAC,CAAC;IACb,OAAO;IACP,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,WAAW,EAAE,KAAK,CAAC,WAAW;CAC/B,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAuB,EAAE;IAC9D,MAAM,SAAS,GAAmB,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,KAAK,GAA6B,cAAc,CAAC,IAAI,CAAC,CAAC,SAAuB,EAAW,EAAE,CAC/F,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAC3D,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAuB,EAAE;IAClF,MAAM,KAAK,GAA+B,gBAAgB,CAAC,IAAI,CAC7D,CAAC,SAAyB,EAAW,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAC7E,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAsB,EAAE,CACvE,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAsB,EAAE;IAC5E,MAAM,KAAK,GAAqC,uBAAuB,CAAC,IAAI,CAC1E,CAAC,SAA+B,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CACtE,CAAA;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAC5D,CAAC,CAAC,CAAA;AAQJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,IAAY,EAC6B,EAAE;IAC3C,MAAM,SAAS,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAc,EAA+B,EAAE,CACtF,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAc,EAAoB,EAAE;QACrE,MAAM,QAAQ,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;QACrD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAY,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACzF,CAAA;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAqC,EACjB,EAAE,CACtB,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAuB,EAAsB,EAAE,CAC/D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAe,EAAsB,EAAE;IAC7D,MAAM,OAAO,GAAwB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC,CAAC,CACH,CAAA;AAeH,uGAAuG;AACvG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAsB,EAAE;IACzE,MAAM,OAAO,GAAwB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAW,GAAG,MAAM,CAAC,IAAI,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAA;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,gBAAgB,OAAO,CAAC,MAAM,mCAAmC,CAAA;IACnF,CAAC;IACD,MAAM,OAAO,GAAuB,MAAM,CAAC,aAAa,CAAA;IACxD,OAAO,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,MAAM,gBAAgB,OAAO,yDAAyD,CAAA;AAC/F,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAqC,EAAkB,EAAE,CACtF,QAAQ,CAAC,MAAM,CACb,CAAC,KAAqB,EAAE,MAAwB,EAAkB,EAAE;IAClE,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACjE,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAU,EAAE,CAC5E,GAAG,QAAQ,KAAK,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,WAAW,EAAE,CAAA"}

package/dist/container-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-failure.d.ts","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAmBA,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,aAAa,CAAA;AAEjB,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,EAAE,MAAY,CAAA;AAyG5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAalB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAOlB,CAAA"}
+{"version":3,"file":"container-failure.d.ts","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAEA,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,aAAa,CAAA;AAEjB,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,EAAE,MAAY,CAAA;AAyG5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAalB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAOlB,CAAA"}

package/dist/container-failure.js

@@ -1,21 +1,4 @@
-// Why a containerised gate failed, told apart from what its analyzer reported.
-//
-// `docker run` passes the container's own exit code through, so a gate that reads every non-zero exit as
-// the tool's verdict reads a failure of Docker as a finding. The consequence was not cosmetic: a Docker
-// Hub pull-rate limit - 100 anonymous pulls per six hours per IP, which several teams behind one CI
-// egress reach - made the secret scan announce that it had found a secret in the git history. That is the
-// one verdict a project cannot dismiss on its own judgement, and the worst thing this harness can say. A
-// registry outage, an unreachable network, and a digest the registry no longer serves all landed the same
-// way.
-//
-// Two classifiers rather than one, and the split is the actual repair. `classifyImageFailure` reads
-// markers out of the output because it judges `docker image inspect` and `docker pull`, whose every byte
-// docker wrote. `classifyContainerExit` judges a run of the analyzer, whose output carries content the
-// PROJECT authored - a commit message, a Dockerfile, a workflow - so it reads the exit code and nothing
-// else. Matching `no such host` against a commit message would invert the same bug rather than fix it.
-//
-// The rules are pure so they are exercised against captured `docker` output rather than against a live
-// daemon: every branch below describes a failure that is expensive or impossible to stage on demand.
+// Distinguish unavailable container infrastructure from analyzer findings so each failure names the right repair.
 /** The exit code a shell reports for a command it cannot find. */
 export const COMMAND_NOT_FOUND = 127;
 // `docker run` reserves these for a failure of docker itself, distinct from whatever the container exits

package/dist/container-failure.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-failure.js","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,oGAAoG;AACpG,0GAA0G;AAC1G,yGAAyG;AACzG,0GAA0G;AAC1G,OAAO;AACP,EAAE;AACF,oGAAoG;AACpG,yGAAyG;AACzG,uGAAuG;AACvG,wGAAwG;AACxG,uGAAuG;AACvG,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AAwBrG,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAE5C,yGAAyG;AACzG,yGAAyG;AACzG,2GAA2G;AAC3G,6FAA6F;AAC7F,MAAM,oBAAoB,GAAW,GAAG,CAAA;AACxC,MAAM,0BAA0B,GAAW,GAAG,CAAA;AAQ9C,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE;QACN,MAAM,EAAE,sDAAsD;QAC9D,QAAQ,EAAE,CAAC,gFAAgF,CAAC;KAC7F;IACD,UAAU,EAAE;QACV,MAAM,EAAE,kDAAkD;QAC1D,QAAQ,EAAE,CAAC,kFAAkF,CAAC;KAC/F;IACD,WAAW,EAAE;QACX,MAAM,EACJ,yFAAyF;QAC3F,QAAQ,EAAE;YACR,8GAA8G;YAC9G,+DAA+D;YAC/D,yDAAyD;SAC1D;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,mEAAmE;QAC3E,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gGAAgG;SACjG;KACF;IACD,eAAe,EAAE;QACf,MAAM,EAAE,qDAAqD;QAC7D,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gDAAgD;SACjD;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,wCAAwC;QAChD,QAAQ,EAAE,CAAC,+EAA+E,CAAC;KAC5F;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IAC5E,IAAI;IACJ,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ;CACjC,CAAC,CAAA;AAEF,yGAAyG;AACzG,qGAAqG;AACrG,mCAAmC;AACnC,EAAE;AACF,wGAAwG;AACxG,kGAAkG;AAClG,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,qBAAqB;AACrB,MAAM,OAAO,GAAiE;IAC5E,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IACxE;QACE,YAAY;QACZ;YACE,qCAAqC;YACrC,8BAA8B;YAC9B,sBAAsB;YACtB,8BAA8B;SAC/B;KACF;IACD,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC5E;QACE,aAAa;QACb;YACE,UAAU;YACV,cAAc;YACd,aAAa;YACb,eAAe;YACf,oBAAoB;YACpB,wBAAwB;YACxB,sCAAsC;SACvC;KACF;IACD;QACE,iBAAiB;QACjB;YACE,kBAAkB;YAClB,qBAAqB;YACrB,2BAA2B;YAC3B,6BAA6B;SAC9B;KACF;CACF,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,QAAQ,GAAW,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;IACxD,MAAM,OAAO,GAAgE,OAAO,CAAC,IAAI,CACvF,CAAC,CAAC,EAAE,OAAO,CAAkD,EAAW,EAAE,CACxE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACvE,CAAA;IACD,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,KAAK,oBAAoB,IAAI,UAAU,CAAC,IAAI,KAAK,0BAA0B;QAC/F,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC;QACjC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"container-failure.js","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAwBlH,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAE5C,yGAAyG;AACzG,yGAAyG;AACzG,2GAA2G;AAC3G,6FAA6F;AAC7F,MAAM,oBAAoB,GAAW,GAAG,CAAA;AACxC,MAAM,0BAA0B,GAAW,GAAG,CAAA;AAQ9C,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE;QACN,MAAM,EAAE,sDAAsD;QAC9D,QAAQ,EAAE,CAAC,gFAAgF,CAAC;KAC7F;IACD,UAAU,EAAE;QACV,MAAM,EAAE,kDAAkD;QAC1D,QAAQ,EAAE,CAAC,kFAAkF,CAAC;KAC/F;IACD,WAAW,EAAE;QACX,MAAM,EACJ,yFAAyF;QAC3F,QAAQ,EAAE;YACR,8GAA8G;YAC9G,+DAA+D;YAC/D,yDAAyD;SAC1D;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,mEAAmE;QAC3E,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gGAAgG;SACjG;KACF;IACD,eAAe,EAAE;QACf,MAAM,EAAE,qDAAqD;QAC7D,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gDAAgD;SACjD;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,wCAAwC;QAChD,QAAQ,EAAE,CAAC,+EAA+E,CAAC;KAC5F;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IAC5E,IAAI;IACJ,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ;CACjC,CAAC,CAAA;AAEF,yGAAyG;AACzG,qGAAqG;AACrG,mCAAmC;AACnC,EAAE;AACF,wGAAwG;AACxG,kGAAkG;AAClG,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,qBAAqB;AACrB,MAAM,OAAO,GAAiE;IAC5E,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IACxE;QACE,YAAY;QACZ;YACE,qCAAqC;YACrC,8BAA8B;YAC9B,sBAAsB;YACtB,8BAA8B;SAC/B;KACF;IACD,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC5E;QACE,aAAa;QACb;YACE,UAAU;YACV,cAAc;YACd,aAAa;YACb,eAAe;YACf,oBAAoB;YACpB,wBAAwB;YACxB,sCAAsC;SACvC;KACF;IACD;QACE,iBAAiB;QACjB;YACE,kBAAkB;YAClB,qBAAqB;YACrB,2BAA2B;YAC3B,6BAA6B;SAC9B;KACF;CACF,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,QAAQ,GAAW,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;IACxD,MAAM,OAAO,GAAgE,OAAO,CAAC,IAAI,CACvF,CAAC,CAAC,EAAE,OAAO,CAAkD,EAAW,EAAE,CACxE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACvE,CAAA;IACD,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,KAAK,oBAAoB,IAAI,UAAU,CAAC,IAAI,KAAK,0BAA0B;QAC/F,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC;QACjC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA"}

package/dist/container-files.d.ts

@@ -17,6 +17,22 @@ export declare const isDockerfile: (file: string) => boolean;
  * @returns true when the file identifies a compose project.
  */
 export declare const isComposeFile: (file: string) => boolean;
+/**
+ * Whether a tracked path is a GitHub Actions workflow.
+ * @param file the repo-relative path.
+ * @returns true for a YAML file directly under `.github/workflows`.
+ */
+export declare const isWorkflowFile: (file: string) => boolean;
+/**
+ * Every workflow the repository tracks.
+ *
+ * Discovered from the working tree rather than listed, for the reason `scripts/verify.sh` records about
+ * its own shell scripts: an enumeration is correct only at the moment it is written, and a workflow
+ * added later would be a workflow nothing reads.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @returns the workflows, ordered so a report reads the same on every machine.
+ */
+export declare const workflowsIn: (tracked: readonly string[]) => readonly string[];
 /**
  * Every Dockerfile the repository tracks.
  * @param tracked the repo-relative paths of the tracked files.

package/dist/container-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-files.d.ts","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AASA,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAqBD;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,OAG3C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,OAAuD,CAAA;AAMpG;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAGO,CAAA;AAEjF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,cAAc,EAcrF,CAAA"}
+{"version":3,"file":"container-files.d.ts","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAqBD;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,OAG3C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,OAAuD,CAAA;AASpG;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAG8B,CAAA;AAE5E;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAGS,CAAA;AAEjF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAGO,CAAA;AAEjF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,cAAc,EAcrF,CAAA"}

package/dist/container-files.js

@@ -1,11 +1,4 @@
-// Which files in a tracked tree are container definitions, and which directories hold a compose project.
-//
-// Discovery is stated here for both kinds at once, because stating it for only one is how the two halves
-// drifted. The Dockerfile half already walked the tracked tree - a project may keep a Dockerfile in any
-// directory, and a hard-coded path would silently skip the ones it did not anticipate - while the compose
-// half looked at the repository root and nowhere else. A Payload project that keeps its application in a
-// member directory keeps its compose file beside it, so the gate linted that member's Dockerfile and
-// reported a pass having validated no compose project at all.
+// Identify container definitions and compose projects from the working-tree inventory.
 // Sliced rather than split, so neither helper carries a case that cannot happen. `lastIndexOf`
 // returns -1 for a bare basename, which makes these the whole string and the empty string - the two
 // answers a repository-root file wants - without a fallback no input could reach.
@@ -40,6 +33,28 @@ export const isComposeFile = (file) => COMPOSE_BASENAMES.includes(basenameOf(fil
 // Where a name sits in compose's own precedence. Only ever asked of a file `isComposeFile` accepted,
 // so the -1 `indexOf` returns for anything else is unreachable rather than meaningful.
 const precedenceOf = (file) => COMPOSE_BASENAMES.indexOf(basenameOf(file));
+const WORKFLOW_DIRECTORY = '.github/workflows/';
+const WORKFLOW_SUFFIXES = ['.yml', '.yaml'];
+/**
+ * Whether a tracked path is a GitHub Actions workflow.
+ * @param file the repo-relative path.
+ * @returns true for a YAML file directly under `.github/workflows`.
+ */
+export const isWorkflowFile = (file) => file.startsWith(WORKFLOW_DIRECTORY) &&
+    !file.slice(WORKFLOW_DIRECTORY.length).includes('/') &&
+    WORKFLOW_SUFFIXES.some((suffix) => file.endsWith(suffix));
+/**
+ * Every workflow the repository tracks.
+ *
+ * Discovered from the working tree rather than listed, for the reason `scripts/verify.sh` records about
+ * its own shell scripts: an enumeration is correct only at the moment it is written, and a workflow
+ * added later would be a workflow nothing reads.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @returns the workflows, ordered so a report reads the same on every machine.
+ */
+export const workflowsIn = (tracked) => tracked
+    .filter((file) => isWorkflowFile(file))
+    .toSorted((left, right) => left.localeCompare(right));
 /**
  * Every Dockerfile the repository tracks.
  * @param tracked the repo-relative paths of the tracked files.

package/dist/container-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-files.js","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,0GAA0G;AAC1G,yGAAyG;AACzG,qGAAqG;AACrG,8DAA8D;AAU9D,+FAA+F;AAC/F,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE/F,4EAA4E;AAC5E,EAAE;AACF,yGAAyG;AACzG,0GAA0G;AAC1G,2FAA2F;AAC3F,MAAM,iBAAiB,GAAsB;IAC3C,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,oBAAoB;CACrB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IACpD,MAAM,IAAI,GAAW,UAAU,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAChG,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAEpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAC7E,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;KACrD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA0B,EAA6B,EAAE;IACzF,MAAM,KAAK,GAAsB,OAAO,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAChF,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SAC5E,OAAO,CAAC,CAAC,SAAiB,EAA6B,EAAE;IACxD,gGAAgG;IAChG,kGAAkG;IAClG,2FAA2F;IAC3F,KAAK;SACF,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAClE,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;SAC3F,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAA;AACL,CAAC,CAAA"}
+{"version":3,"file":"container-files.js","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAUvF,+FAA+F;AAC/F,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE/F,4EAA4E;AAC5E,EAAE;AACF,yGAAyG;AACzG,0GAA0G;AAC1G,2FAA2F;AAC3F,MAAM,iBAAiB,GAAsB;IAC3C,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,oBAAoB;CACrB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IACpD,MAAM,IAAI,GAAW,UAAU,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAChG,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAEpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAE1F,MAAM,kBAAkB,GAAW,oBAAoB,CAAA;AACvD,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;IACnC,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IACpD,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAC3E,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACvD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAC7E,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;KACrD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA0B,EAA6B,EAAE;IACzF,MAAM,KAAK,GAAsB,OAAO,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAChF,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SAC5E,OAAO,CAAC,CAAC,SAAiB,EAA6B,EAAE;IACxD,gGAAgG;IAChG,kGAAkG;IAClG,2FAA2F;IAC3F,KAAK;SACF,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAClE,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;SAC3F,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAA;AACL,CAAC,CAAA"}

package/dist/container-images.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Join backslash-continued lines, so a `RUN` split across lines reads as the one command it is.
+ * @param text the file body.
+ * @returns one entry per logical line.
+ */
+export declare const logicalLines: (text: string) => readonly string[];
+/**
+ * The images a Dockerfile pulls: every `FROM` that names a registry image rather than an earlier stage.
+ * @param text the Dockerfile body.
+ * @returns the references in file order, with `ARG` defaults substituted.
+ */
+export declare const imageReferencesInDockerfile: (text: string) => readonly string[];
+/**
+ * The system packages a Dockerfile installs through the base image's package manager.
+ * @param text the Dockerfile body.
+ * @returns every package name after an install verb, in file order.
+ */
+export declare const systemPackagesInDockerfile: (text: string) => readonly string[];
+/**
+ * The images a GitHub Actions workflow pulls: service containers, job containers, and Docker actions.
+ * @param text the workflow body.
+ * @returns the references in file order.
+ */
+export declare const imageReferencesInWorkflow: (text: string) => readonly string[];
+/** One service of a compose model and the image it pulls. */
+export interface ComposeImage {
+    readonly service: string;
+    readonly image: string;
+}
+/**
+ * The images a rendered compose model pulls. A service with a `build` is judged through its Dockerfile,
+ * and its `image` is only the name the build is tagged with.
+ * @param json the output of `docker compose config --format json`.
+ * @returns the pulled images by service name, or undefined when the text is not a compose model.
+ */
+export declare const imageReferencesInComposeModel: (json: string) => readonly ComposeImage[] | undefined;
+/**
+ * Whether a reference still carries a variable nothing substituted, so no rule can say what it pulls.
+ * @param reference the reference as read.
+ * @returns true when a `$` remains in it.
+ */
+export declare const hasUnresolvedVariable: (reference: string) => boolean;
+//# sourceMappingURL=container-images.d.ts.map

package/dist/container-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-images.d.ts","sourceRoot":"","sources":["../src/container-images.ts"],"names":[],"mappings":"AAuCA;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EACX,CAAA;AAmEhD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAK5D,CAAA;AAed;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAQrE,CAAA;AASJ;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAOlE,CAAA;AAEN,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GACxC,MAAM,MAAM,KACX,SAAS,YAAY,EAAE,GAAG,SAc5B,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,KAAG,OAAkC,CAAA"}

package/dist/container-images.js

@@ -0,0 +1,157 @@
+// Where a repository names the container images it pulls, read into plain references.
+//
+// Three files name an image: a Dockerfile in its `FROM` lines, a workflow in the `image:` of a service
+// or job container and in a `docker://` action, and a compose file in `services.*.image`. The compose
+// half is read from the model `docker compose config --format json` renders rather than from the YAML,
+// because compose interpolates `${VARIABLE}` from the `.env` beside the file and resolves the override
+// files it merges, and a reader of the source text would judge a reference the daemon never pulls.
+//
+// The Dockerfile and workflow readers are line readers over a known syntax, in the spirit of
+// `yaml-blocks.ts`: what has to be recognised is one keyword and the token after it.
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+import { withoutQuotes } from './yaml-blocks.js';
+const CONTINUATION = /\\\r?\n/g;
+// A keyword, horizontal space, then a value that starts with a non-space: the value pattern cannot
+// exchange characters with the space run before it, which is what keeps the match linear.
+const FROM_LINE = /^[ \t]*FROM[ \t]+(?<rest>\S.*)$/i;
+const ARG_LINE = /^[ \t]*ARG[ \t]+(?<name>[A-Z_]\w*)=(?<value>\S+)/i;
+const RUN_LINE = /^[ \t]*RUN[ \t]+(?<rest>\S.*)$/i;
+const COMMENT_LINE = /^[ \t]*#/;
+// A base image every multi-stage build may start from that no registry serves.
+const SCRATCH = 'scratch';
+const STAGE_KEYWORD = 'as';
+const PLATFORM_OPTION = '--';
+// The install verbs of the package managers a base image ships. `apt-get install`, `apk add`, and the
+// Red Hat family; pip and npm are language installs and judged elsewhere.
+const INSTALL_VERB = /\b(?:apt-get|apt|apk|dnf|microdnf|yum|zypper)[ \t]+(?:install|add)\b/;
+const COMMAND_SEPARATOR = /&&|\|\||;|\|/;
+// What ends a package name in an install token: apt's `=version` and `/suite`, apk's `=version` and
+// `~version`. dnf's `-version` is indistinguishable from a hyphenated name and is left alone.
+const PACKAGE_NAME_END = /[=/~]/;
+const OPTION_PREFIX = '-';
+const WORKFLOW_IMAGE = /^[ \t]*(?:-[ \t]*)?image:[ \t]*(?<value>[^\s#][^#]*)/;
+const WORKFLOW_CONTAINER = /^[ \t]*container:[ \t]*(?<value>[^\s#{]+)/;
+const WORKFLOW_DOCKER_ACTION = /uses:[ \t]*['"]?docker:\/\/(?<value>[^\s'"]+)/;
+/**
+ * Join backslash-continued lines, so a `RUN` split across lines reads as the one command it is.
+ * @param text the file body.
+ * @returns one entry per logical line.
+ */
+export const logicalLines = (text) => text.replaceAll(CONTINUATION, ' ').split('\n');
+const contentLines = (text) => logicalLines(text).filter((line) => !COMMENT_LINE.test(line));
+const readFrom = (rest) => {
+    const tokens = (rest ?? '')
+        .trim()
+        .split(/[ \t]+/)
+        .filter((token) => !token.startsWith(PLATFORM_OPTION));
+    const [first, keyword, stage] = tokens;
+    const reference = first ?? '';
+    if (reference.length === 0) {
+        return undefined;
+    }
+    return { reference, stage: keyword?.toLowerCase() === STAGE_KEYWORD ? stage : undefined };
+};
+// `FROM node:${NODE_VERSION}` is the common way to state a version once, and the ARG that gives it a
+// default is the only place the value lives. Both spellings of a reference are substituted; an ARG with
+// no default leaves the variable in place, and the rule reports it as a reference it cannot judge.
+const substituteArguments = (reference, defaults) => [...defaults].reduce((resolved, [name, value]) => resolved
+    .replaceAll(`\${${name}}`, () => value)
+    .replaceAll(`$${name}`, () => value), reference);
+const recordArgument = (walk, line) => {
+    const found = ARG_LINE.exec(line);
+    if (found?.groups === undefined) {
+        return undefined;
+    }
+    const defaults = new Map([
+        ...walk.defaults,
+        [found.groups['name'] ?? '', withoutQuotes(found.groups['value'] ?? '')],
+    ]);
+    return { ...walk, defaults };
+};
+const recordFrom = (walk, line) => {
+    const from = readFrom(FROM_LINE.exec(line)?.groups?.['rest']);
+    if (from === undefined) {
+        return walk;
+    }
+    const reference = substituteArguments(from.reference, walk.defaults);
+    const isRegistryImage = reference !== SCRATCH && !walk.stages.has(reference);
+    return {
+        defaults: walk.defaults,
+        stages: from.stage === undefined ? walk.stages : new Set([...walk.stages, from.stage]),
+        references: isRegistryImage ? [...walk.references, reference] : walk.references,
+    };
+};
+/**
+ * The images a Dockerfile pulls: every `FROM` that names a registry image rather than an earlier stage.
+ * @param text the Dockerfile body.
+ * @returns the references in file order, with `ARG` defaults substituted.
+ */
+export const imageReferencesInDockerfile = (text) => contentLines(text).reduce((walk, line) => recordArgument(walk, line) ?? recordFrom(walk, line), { defaults: new Map(), stages: new Set(), references: [] }).references;
+const packagesInCommand = (command) => {
+    const verb = INSTALL_VERB.exec(command);
+    if (verb === null) {
+        return [];
+    }
+    return command
+        .slice(verb.index + verb[0].length)
+        .trim()
+        .split(/[ \t]+/)
+        .filter((token) => token.length > 0 && !token.startsWith(OPTION_PREFIX))
+        .map((token) => token.split(PACKAGE_NAME_END)[0] ?? '');
+};
+/**
+ * The system packages a Dockerfile installs through the base image's package manager.
+ * @param text the Dockerfile body.
+ * @returns every package name after an install verb, in file order.
+ */
+export const systemPackagesInDockerfile = (text) => contentLines(text).flatMap((line) => {
+    const rest = RUN_LINE.exec(line)?.groups?.['rest'];
+    return rest === undefined
+        ? []
+        : rest
+            .split(COMMAND_SEPARATOR)
+            .flatMap((command) => packagesInCommand(command));
+});
+const workflowReferenceIn = (line) => {
+    const found = WORKFLOW_DOCKER_ACTION.exec(line) ?? WORKFLOW_IMAGE.exec(line) ?? WORKFLOW_CONTAINER.exec(line);
+    const value = found?.groups?.['value'];
+    return value === undefined ? undefined : withoutQuotes(value.trim());
+};
+/**
+ * The images a GitHub Actions workflow pulls: service containers, job containers, and Docker actions.
+ * @param text the workflow body.
+ * @returns the references in file order.
+ */
+export const imageReferencesInWorkflow = (text) => text
+    .split('\n')
+    .filter((line) => !COMMENT_LINE.test(line))
+    .flatMap((line) => {
+    const reference = workflowReferenceIn(line);
+    return reference === undefined || reference.length === 0 ? [] : [reference];
+});
+/**
+ * The images a rendered compose model pulls. A service with a `build` is judged through its Dockerfile,
+ * and its `image` is only the name the build is tagged with.
+ * @param json the output of `docker compose config --format json`.
+ * @returns the pulled images by service name, or undefined when the text is not a compose model.
+ */
+export const imageReferencesInComposeModel = (json) => {
+    const model = parseJsonc(json).value;
+    if (!isRecord(model) || isArray(model) || !isRecord(model['services'])) {
+        return undefined;
+    }
+    return Object.entries(model['services'])
+        .flatMap(([service, definition]) => {
+        const image = asText(asRecord(definition)['image']);
+        const isBuilt = asRecord(definition)['build'] !== undefined;
+        return isBuilt || image.length === 0 ? [] : [{ service, image }];
+    })
+        .toSorted((one, other) => one.service.localeCompare(other.service));
+};
+/**
+ * Whether a reference still carries a variable nothing substituted, so no rule can say what it pulls.
+ * @param reference the reference as read.
+ * @returns true when a `$` remains in it.
+ */
+export const hasUnresolvedVariable = (reference) => reference.includes('$');
+//# sourceMappingURL=container-images.js.map

package/dist/container-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-images.js","sourceRoot":"","sources":["../src/container-images.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,6FAA6F;AAC7F,qFAAqF;AAErF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,MAAM,YAAY,GAAW,UAAU,CAAA;AACvC,mGAAmG;AACnG,0FAA0F;AAC1F,MAAM,SAAS,GAAW,kCAAkC,CAAA;AAC5D,MAAM,QAAQ,GAAW,mDAAmD,CAAA;AAC5E,MAAM,QAAQ,GAAW,iCAAiC,CAAA;AAC1D,MAAM,YAAY,GAAW,UAAU,CAAA;AACvC,+EAA+E;AAC/E,MAAM,OAAO,GAAW,SAAS,CAAA;AACjC,MAAM,aAAa,GAAW,IAAI,CAAA;AAClC,MAAM,eAAe,GAAW,IAAI,CAAA;AAEpC,sGAAsG;AACtG,0EAA0E;AAC1E,MAAM,YAAY,GAAW,sEAAsE,CAAA;AACnG,MAAM,iBAAiB,GAAW,cAAc,CAAA;AAChD,oGAAoG;AACpG,8FAA8F;AAC9F,MAAM,gBAAgB,GAAW,OAAO,CAAA;AACxC,MAAM,aAAa,GAAW,GAAG,CAAA;AAEjC,MAAM,cAAc,GAAW,sDAAsD,CAAA;AACrF,MAAM,kBAAkB,GAAW,2CAA2C,CAAA;AAC9E,MAAM,sBAAsB,GAAW,+CAA+C,CAAA;AAEtF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC9D,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAEhD,MAAM,YAAY,GAAG,CAAC,IAAY,EAAqB,EAAE,CACvD,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAOhF,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAA0B,EAAE;IACpE,MAAM,MAAM,GAAsB,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,IAAI,EAAE;SACN,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,GAAoC,MAAM,CAAA;IACvE,MAAM,SAAS,GAAW,KAAK,IAAI,EAAE,CAAA;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AAC3F,CAAC,CAAA;AAED,qGAAqG;AACrG,wGAAwG;AACxG,mGAAmG;AACnG,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,QAAqC,EAAU,EAAE,CAC/F,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAClB,CAAC,QAAgB,EAAE,CAAC,IAAI,EAAE,KAAK,CAA4B,EAAU,EAAE,CACrE,QAAQ;KACL,UAAU,CAAC,MAAM,IAAI,GAAG,EAAE,GAAW,EAAE,CAAC,KAAK,CAAC;KAC9C,UAAU,CAAC,IAAI,IAAI,EAAE,EAAE,GAAW,EAAE,CAAC,KAAK,CAAC,EAChD,SAAS,CACV,CAAA;AAQH,MAAM,cAAc,GAAG,CAAC,IAAoB,EAAE,IAAY,EAA8B,EAAE;IACxF,MAAM,KAAK,GAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAgC,IAAI,GAAG,CAAiB;QACpE,GAAG,IAAI,CAAC,QAAQ;QAChB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;KACzE,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAkB,EAAE;IACxE,MAAM,IAAI,GAA2B,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACrF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAW,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5E,MAAM,eAAe,GAAY,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrF,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;KAChF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC7E,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CACvB,CAAC,IAAoB,EAAE,IAAY,EAAkB,EAAE,CACrD,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EACtD,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAkB,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CACnF,CAAC,UAAU,CAAA;AAEd,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAqB,EAAE;IAC/D,MAAM,IAAI,GAA2B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAClC,IAAI,EAAE;SACN,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SACxF,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC5E,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IAC7D,MAAM,IAAI,GAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;IACtE,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI;aACD,KAAK,CAAC,iBAAiB,CAAC;aACxB,OAAO,CAAC,CAAC,OAAe,EAAqB,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA;AAEJ,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC/D,MAAM,KAAK,GACT,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjG,MAAM,KAAK,GAAuB,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;IAC1D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;AACtE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC3E,IAAI;KACD,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC3D,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IAC3C,MAAM,SAAS,GAAuB,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC/D,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAQN;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,IAAY,EACyB,EAAE;IACvC,MAAM,KAAK,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;SACrC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAA6B,EAA2B,EAAE;QACtF,MAAM,KAAK,GAAW,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAY,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAA;QACpE,OAAO,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC;SACD,QAAQ,CAAC,CAAC,GAAiB,EAAE,KAAmB,EAAU,EAAE,CAC3D,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CACzC,CAAA;AACL,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA"}

package/dist/dependency-freshness.d.ts

@@ -53,6 +53,14 @@ export interface DeclaredCoordinate {
 export interface DependencyStatus extends DeclaredCoordinate {
     /** The latest version published to the registry. */
     readonly latest: string;
+    /**
+     * The licence the registry records for that latest version, when it records one.
+     *
+     * Carried so the blocklist can keep the bound from demanding an upgrade into a release the licence
+     * gate would refuse: a package that changed licence at its newest major is still measured, but never
+     * past the last release a project may install.
+     */
+    readonly latestLicense?: string;
 }
 /** One parsed manifest, with the path a finding will name. */
 export interface ManifestSource {

package/dist/dependency-freshness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-freshness.d.ts","sourceRoot":"","sources":["../src/dependency-freshness.ts"],"names":[],"mappings":"AAqBA,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEvD,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAQD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,aAAa,GAAG,SAW1D,CAAA;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,gBAUnE,CAAA;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAClF,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAA;CACjD;AA6BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,GAAG,SAAS,EACzB,UAAU,gBAAgB,KACzB,SAAS,MAAM,EACkE,CAAA;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,SAAS,cAAc,EAAE,KACnC,SAAS,kBAAkB,EAU3B,CAAA;AAEH,gGAAgG;AAChG,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAA;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAYD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,eAiB/E,CAAA"}
+{"version":3,"file":"dependency-freshness.d.ts","sourceRoot":"","sources":["../src/dependency-freshness.ts"],"names":[],"mappings":"AAKA,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEvD,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAQD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,aAAa,GAAG,SAW1D,CAAA;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,gBAUnE,CAAA;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAClF,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAA;CACjD;AA6BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,GAAG,SAAS,EACzB,UAAU,gBAAgB,KACzB,SAAS,MAAM,EACkE,CAAA;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,SAAS,cAAc,EAAE,KACnC,SAAS,kBAAkB,EAU3B,CAAA;AAEH,gGAAgG;AAChG,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAA;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAYD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,eAiB/E,CAAA"}

package/dist/dependency-freshness.js

@@ -1,22 +1,6 @@
-// Dependency-freshness policy: the pure, unit-tested logic that reads the coordinates a repository
-// declares and classifies how far each has drifted from its latest published release. The `deps` gate in
-// packages/cli/src/checks/dependencies.ts reads the manifests and asks the registry.
-//
-// Policy: a declared dependency (transitive deps never count) whose current major version is
-// MAJOR_FAIL_THRESHOLD or more behind the latest published major FAILS the build; any lesser lag (a
-// single major behind, or a minor/patch behind) appears in the non-failing update report. The Biome config `$schema`
-// URL version is fed through the same classifier as a pseudo-dependency. There is no exemption list:
-// every declared dependency is MEASURED against the same bar, so a deliberately old pin that falls two
-// majors behind must be bumped or the pin dropped.
-//
-// One thing the bar does not decide is who the build stops. A coordinate an INHERITED manifest declares
-// is measured identically and reported at its real verdict, and it never fails the build: the version
-// belongs to ploaness, the project has no file in which to change it, and a gate that stopped every
-// consumer at once over a pin none of them can edit would be reporting ploaness's defect as theirs.
-// That is a statement about whose repair it is rather than an exemption from the measurement, which is
-// why the verdict survives into the report instead of being softened into an ordinary update.
+// Compare declared coordinates with stable releases and apply the fixed major-version freshness bound.
+import { isHarnessPackage } from './harness-package.js';
 import { declaredDependencies } from './json-shapes.js';
-import { isHarnessPackage } from './version-policy.js';
 /** Major-version gap (`latest.major - current.major`) at or above which the gate FAILS the build. */
 export const MAJOR_FAIL_THRESHOLD = 2;
 // A leading range operator (`^ ~ >= <= = v`) or whitespace is tolerated, then the numeric core is