@ploaness/governance 1.1.0 → 1.3.0

package/dist/axe-coverage.js

@@ -1,23 +1,7 @@
-// What a project's own specifications say about a route, and whether one of them scans it.
-//
-// Two rules ask this same question of two different things. `admin-view-coverage` asks it of a custom
-// admin view, which sits inside the `/admin` prefix the pinned sweep skips; `route-coverage` asks it
-// of an application route the anonymous link crawl never reached. Neither can be answered by ploaness
-// itself - it cannot sign in, and it cannot press the button that creates a record - so both answer it
-// the same way: the project is required to have written the scan somewhere a check can see.
-//
-// It is one module rather than two copies because the load-bearing part is easy to omit and expensive
-// to omit. `routeText` strips import specifiers before any route is searched for, and the comment on
-// `MODULE_SPECIFIER` records what happened without it: `@/lib/calendar/interval` contains `/calendar`,
-// so every unit spec of a `calendar` module looked like a test driving the view, and one that also
-// imported the shared axe helper then answered for a view nothing scans. A second copy that forgot
-// that line would ship the same false pass again.
-import { stripComments } from './source-text.js';
-// What proves a file reaches axe. The builder's class name covers the Playwright and WebdriverIO
-// packages alike, the scoped package name covers a bare import, and `axe.run` covers the browser
-// script form. A project driving axe some fourth way is asked to say so rather than assumed to have
-// nothing.
-const AXE_MARKERS = ['AxeBuilder', '@axe-core', 'axe.run'];
+import path from 'node:path';
+import { maskLiterals, stripComments, withoutComments } from './source-text.js';
+// Recognize axe identifiers in code, excluding comments, strings, and regex literals.
+const AXE_MARKERS = ['AxeBuilder', 'axe.run'];
 const REGEX_METACHARACTERS = /[$()*+.?[\\\]^{|}]/gu;
 const escaped = (text) => text.replaceAll(REGEX_METACHARACTERS, String.raw `\$&`);
 // An import specifier is a path too, and `@/lib/calendar/interval` contains `/calendar`. Read as a
@@ -27,24 +11,7 @@ const escaped = (text) => text.replaceAll(REGEX_METACHARACTERS, String.raw `\$&`
 // removed before the search; `importedSources` reads the specifiers from the original text, where
 // they still are.
 const MODULE_SPECIFIER = /\b(?:from|import)\s*(?:\(\s*)?['"][^'"]*['"]/gu;
-// A regular expression literal, read loosely. `stripComments` blanks one along with the comments,
-// because a `//` inside a pattern would otherwise open a comment that never closes - correct for a
-// lexer, and fatal here: `page.waitForURL(/\/welcome$/u)` is how a Playwright specification names the
-// address it is waiting for, and blanking it made the commonest idiom in the file invisible. So the
-// literals are put back, extracted from the original text and searched alongside it.
-//
-// The pattern admits a little more than a real literal does - a division written with spaces around
-// it can look like one - which only ever adds text to search, never removes it. What it costs is
-// narrow and worth naming: a route spelled as a regular expression INSIDE a comment is no longer told
-// apart from one in code, and will answer for its page. Refusing regular expressions altogether was
-// the alternative, and it fails the ordinary case to close a hole nobody falls into by accident.
-const REGEX_LITERAL = /(?<![\w)\]])\/(?![/*])(?:\\.|\[(?:\\.|[^\]\\])*\]|[^/\\\n[])+\/[dgimsuvy]*/gu;
-// Comments go first, because a route named in one explaining why a page is NOT scanned would
-// otherwise answer for that page.
-const routeText = (source) => [
-    stripComments(source).replaceAll(MODULE_SPECIFIER, ''),
-    ...(source.match(REGEX_LITERAL) ?? []),
-].join('\n');
+const routeText = (source) => withoutComments(source).replaceAll(MODULE_SPECIFIER, '');
 /**
  * Whether a specification names one route.
  *
@@ -69,26 +36,26 @@ export const containsRoute = (source, route) => new RegExp(String.raw `${escaped
  * @returns true when the text builds a URL below that prefix.
  */
 export const containsBuiltRoute = (source, prefix) => routeText(source).includes(`${prefix === '/' ? '' : prefix}/\${`);
-const carriesAxe = (source) => AXE_MARKERS.some((marker) => source.includes(marker));
+const carriesAxe = (source) => AXE_MARKERS.some((marker) => maskLiterals(source).includes(marker));
 const RELATIVE_IMPORT = /\bfrom\s*['"](\.[^'"]*)['"]/gu;
-// Resolved by the tail of the specifier rather than by walking the filesystem, because this module
-// takes plain values and owns no path resolver. `../helpers/accessibility` matches
-// `tests/helpers/accessibility.ts`, which is the shape every project writes; a specifier that resolves
-// somewhere genuinely different would have to end in the same segments to be confused with it.
-const matchesFile = (specifier, filePath) => {
-    const tail = specifier.replace(/^(?:\.\.?\/)+/u, '');
-    return ['.ts', '.tsx', '/index.ts', '/index.tsx'].some((suffix) => filePath.endsWith(`${tail}${suffix}`));
+// Resolve from the importing file, without accessing the filesystem. All candidates were already read.
+const matchesFile = (specifier, importer, candidate) => {
+    const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(importer), specifier));
+    const stem = resolved.replace(/\.[cm]?jsx?$/u, '');
+    return [
+        resolved,
+        ...['.ts', '.tsx', '.mts', '.cts', '/index.ts', '/index.tsx'].map((suffix) => `${stem}${suffix}`),
+    ].includes(candidate);
 };
-const importedSources = (spec, everyFile) => [...spec.source.matchAll(RELATIVE_IMPORT)].flatMap((match) => everyFile.filter((candidate) => matchesFile(match[1] ?? '', candidate.path)));
+const importedSources = (spec, everyFile) => [...stripComments(spec.source).matchAll(RELATIVE_IMPORT)].flatMap((match) => everyFile.filter((candidate) => matchesFile(match[1] ?? '', spec.path, candidate.path)));
 /**
  * Whether a specification scans with axe, directly or through a helper it imports.
  *
- * One hop, deliberately. A spec that scans through a helper is the ordinary arrangement and has to be
- * recognised; a chain deeper than that is a project hiding its own scan from itself, and following it
- * would trade a rule anyone can predict for one nobody can.
+ * This is static source evidence through at most one helper import. It does not establish execution;
+ * the end-to-end suite must run the scan.
  * @param spec the specification being judged.
  * @param everyFile every file it may import a scan from, the specifications included.
- * @returns true when running that spec reaches axe.
+ * @returns true when the source names axe directly or through an imported helper.
  */
 export const reachesAxe = (spec, everyFile) => carriesAxe(spec.source) ||
     importedSources(spec, everyFile).some((imported) => carriesAxe(imported.source));

package/dist/axe-coverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"axe-coverage.js","sourceRoot":"","sources":["../src/axe-coverage.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,sGAAsG;AACtG,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,4FAA4F;AAC5F,EAAE;AACF,sGAAsG;AACtG,qGAAqG;AACrG,uGAAuG;AACvG,mGAAmG;AACnG,mGAAmG;AACnG,kDAAkD;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAQhD,iGAAiG;AACjG,iGAAiG;AACjG,oGAAoG;AACpG,WAAW;AACX,MAAM,WAAW,GAAsB,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;AAE7E,MAAM,oBAAoB,GAAW,sBAAsB,CAAA;AAE3D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAA;AAEhG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,kBAAkB;AAClB,MAAM,gBAAgB,GAAW,gDAAgD,CAAA;AAEjF,kGAAkG;AAClG,mGAAmG;AACnG,sGAAsG;AACtG,oGAAoG;AACpG,qFAAqF;AACrF,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,sGAAsG;AACtG,oGAAoG;AACpG,iGAAiG;AACjG,MAAM,aAAa,GACjB,8EAA8E,CAAA;AAEhF,6FAA6F;AAC7F,kCAAkC;AAClC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAU,EAAE,CAC3C;IACE,aAAa,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC;IACtD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;CACvC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEd;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAa,EAAW,EAAE,CACtE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,MAAc,EAAW,EAAE,CAC5E,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAA;AAEnE,MAAM,UAAU,GAAG,CAAC,MAAc,EAAW,EAAE,CAC7C,WAAW,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAExE,MAAM,eAAe,GAAW,+BAA+B,CAAA;AAE/D,mGAAmG;AACnG,mFAAmF;AACnF,uGAAuG;AACvG,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAW,EAAE;IACnE,MAAM,IAAI,GAAW,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;IAC5D,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CACjF,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CACtB,IAAgB,EAChB,SAAgC,EACT,EAAE,CACzB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAsB,EAAgB,EAAE,CAC1F,SAAS,CAAC,MAAM,CAAC,CAAC,SAAqB,EAAW,EAAE,CAClD,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAC5C,CACF,CAAA;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,SAAgC,EAAW,EAAE,CACxF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IACvB,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,QAAoB,EAAW,EAAE,CACtE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC5B,CAAA"}
+{"version":3,"file":"axe-coverage.js","sourceRoot":"","sources":["../src/axe-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAQ/E,sFAAsF;AACtF,MAAM,WAAW,GAAsB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;AAEhE,MAAM,oBAAoB,GAAW,sBAAsB,CAAA;AAE3D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAA;AAEhG,mGAAmG;AACnG,oGAAoG;AACpG,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,kBAAkB;AAClB,MAAM,gBAAgB,GAAW,gDAAgD,CAAA;AAEjF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAU,EAAE,CAC3C,eAAe,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;AAE1D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAa,EAAW,EAAE,CACtE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,MAAc,EAAW,EAAE,CAC5E,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAA;AAEnE,MAAM,UAAU,GAAG,CAAC,MAAc,EAAW,EAAE,CAC7C,WAAW,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAEtF,MAAM,eAAe,GAAW,+BAA+B,CAAA;AAE/D,uGAAuG;AACvG,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAE,SAAiB,EAAW,EAAE;IACtF,MAAM,QAAQ,GAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CACzD,CAAA;IACD,MAAM,IAAI,GAAW,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IAC1D,OAAO;QACL,QAAQ;QACR,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,GAAG,CAC/D,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAC/C;KACF,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AACvB,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CACtB,IAAgB,EAChB,SAAgC,EACT,EAAE,CACzB,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC/D,CAAC,KAAsB,EAAgB,EAAE,CACvC,SAAS,CAAC,MAAM,CAAC,CAAC,SAAqB,EAAW,EAAE,CAClD,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CACvD,CACJ,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,SAAgC,EAAW,EAAE,CACxF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IACvB,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,QAAoB,EAAW,EAAE,CACtE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC5B,CAAA"}

package/dist/blocklist-entries.d.ts

@@ -0,0 +1,36 @@
+/** One image repository ploaness refuses, and what a project pulls instead. */
+export interface BlockedImage {
+    /**
+     * The repository in normalised form: no `docker.io/`, no `library/`, a registry host kept for any
+     * other registry. A trailing `*` matches every repository under that prefix.
+     */
+    readonly repository: string;
+    /** The first tag the refusal applies to, when the repository was once permissively licensed. */
+    readonly from?: string;
+    /** A tag pattern that stays allowed, for a repository publishing an open-source variant beside the default. */
+    readonly allowedTag?: RegExp;
+    readonly reason: string;
+    readonly replacement: string;
+}
+/** One npm package ploaness refuses, and what a project depends on instead. */
+export interface BlockedPackage {
+    /** The package name; a trailing `*` matches every name under that prefix, `@scope/*` a whole scope. */
+    readonly name: string;
+    /** The first version the refusal applies to, when the package was once permissively licensed. */
+    readonly from?: string;
+    readonly reason: string;
+    readonly replacement: string;
+}
+/** One system package ploaness refuses in a Dockerfile install line. */
+export interface BlockedSystemPackage {
+    readonly name: string;
+    readonly reason: string;
+    readonly replacement: string;
+}
+/** The image repositories ploaness refuses, in the order the report lists them. */
+export declare const BLOCKED_IMAGES: readonly BlockedImage[];
+/** The npm packages ploaness refuses, in the order the report lists them. */
+export declare const BLOCKED_PACKAGES: readonly BlockedPackage[];
+/** The system packages a Dockerfile may not install. */
+export declare const BLOCKED_SYSTEM_PACKAGES: readonly BlockedSystemPackage[];
+//# sourceMappingURL=blocklist-entries.d.ts.map

package/dist/blocklist-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist-entries.d.ts","sourceRoot":"","sources":["../src/blocklist-entries.ts"],"names":[],"mappings":"AAeA,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,+GAA+G;IAC/G,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iGAAiG;IACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAkCD,mFAAmF;AACnF,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAwMjD,CAAA;AAED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAmGrD,CAAA;AAED,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAOlE,CAAA"}

package/dist/blocklist-entries.js

@@ -0,0 +1,338 @@
+// What ploaness refuses by name, whatever a manifest declares as its licence.
+//
+// The licence allowlist judges an npm package by the identifier its own manifest carries, and that is
+// the wrong question for three families. A driver is permissively licensed while the only server it can
+// reach is not (the MongoDB driver is Apache 2.0; the MongoDB server is SSPL). A package downloads a
+// binary at install or first run under terms its manifest never mentions (puppeteer fetches Chrome for
+// Testing). And a container image has no manifest at all, so nothing judged it: a compose file could pull
+// MinIO or Redis 8 through a harness that refuses an AGPL npm package. Retired analyzers are also
+// refused when the harness already owns their checks.
+//
+// Every entry names the reason and the replacement, because a refusal that stops a build without saying
+// what to use instead sends the reader to the same search this table already did. Where a project turned
+// non-permissive at a known release, the entry carries that floor and earlier releases are left to the
+// licence gate. No project setting widens or narrows the list: a rule a project can edit is not a rule.
+const MONGODB_REASON = 'the MongoDB server is SSPL, which is not an open-source licence, and this exists only to reach it';
+const MONGODB_REPLACEMENT = 'the postgres image with @payloadcms/db-postgres';
+const REDIS_REASON = 'Redis 7.4 onward is RSALv2, SSPLv1 or AGPLv3, none of which is a permissive open-source licence';
+const REDIS_REPLACEMENT = 'valkey/valkey, which the redis and ioredis clients speak to unchanged';
+const ELASTIC_REASON = 'Elastic binaries are Elastic License 2.0 from 7.11, and this exists only to reach them';
+const ELASTIC_REPLACEMENT = 'opensearchproject/opensearch and opensearchproject/opensearch-dashboards with @opensearch-project/opensearch';
+const MINIO_REASON = 'MinIO is AGPL and its community edition is archived, with no images and no security fixes';
+const OBJECT_STORAGE_REPLACEMENT = 'rustfs/rustfs or chrislusf/seaweedfs';
+const HASHICORP_REASON = 'HashiCorp relicensed to the Business Source License, which is not open source';
+const HASHICORP_REPLACEMENT = 'openbao/openbao for Vault, ghcr.io/opentofu/opentofu for Terraform';
+const PROPRIETARY_DATABASE_REASON = 'a proprietary database server, for which Payload has no adapter';
+const POSTGRES_REPLACEMENT = 'the postgres image';
+const GHOSTSCRIPT_REASON = 'Ghostscript is AGPL, and this is a thin wrapper around it';
+const PDF_REPLACEMENT = 'pdfjs-dist with @napi-rs/canvas';
+const NOTHING_REPLACEMENT = 'nothing; a Payload project has no place for it';
+/** The image repositories ploaness refuses, in the order the report lists them. */
+export const BLOCKED_IMAGES = [
+    { repository: 'mongo', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { repository: 'mongodb/*', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { repository: 'redis', from: '7.4', reason: REDIS_REASON, replacement: REDIS_REPLACEMENT },
+    { repository: 'redis/*', reason: REDIS_REASON, replacement: REDIS_REPLACEMENT },
+    { repository: 'redislabs/*', reason: REDIS_REASON, replacement: REDIS_REPLACEMENT },
+    {
+        repository: 'elasticsearch',
+        from: '7.11',
+        reason: ELASTIC_REASON,
+        replacement: ELASTIC_REPLACEMENT,
+    },
+    { repository: 'kibana', from: '7.11', reason: ELASTIC_REASON, replacement: ELASTIC_REPLACEMENT },
+    {
+        repository: 'logstash',
+        from: '7.11',
+        reason: ELASTIC_REASON,
+        replacement: ELASTIC_REPLACEMENT,
+    },
+    {
+        repository: 'docker.elastic.co/*',
+        from: '7.11',
+        reason: ELASTIC_REASON,
+        replacement: ELASTIC_REPLACEMENT,
+    },
+    { repository: 'minio/*', reason: MINIO_REASON, replacement: OBJECT_STORAGE_REPLACEMENT },
+    { repository: 'quay.io/minio/*', reason: MINIO_REASON, replacement: OBJECT_STORAGE_REPLACEMENT },
+    { repository: 'pgsty/minio', reason: MINIO_REASON, replacement: OBJECT_STORAGE_REPLACEMENT },
+    {
+        repository: 'localstack/*',
+        reason: 'the LocalStack community edition is archived, and the unified image needs an account token and is free ' +
+            'only for non-commercial use',
+        replacement: 'rustfs/rustfs for S3 and motoserver/moto for other AWS APIs',
+    },
+    {
+        repository: 'gresau/localstack-persist',
+        reason: 'a repackaging of the archived LocalStack community edition',
+        replacement: 'rustfs/rustfs for S3 and motoserver/moto for other AWS APIs',
+    },
+    {
+        repository: 'cockroachdb/cockroach',
+        from: '24.3',
+        reason: 'CockroachDB 24.3 onward is under a proprietary licence with mandatory telemetry',
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/vault',
+        from: '1.15',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/consul',
+        from: '1.16',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/nomad',
+        from: '1.6',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/terraform',
+        from: '1.6',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'hashicorp/packer',
+        from: '1.10',
+        reason: HASHICORP_REASON,
+        replacement: HASHICORP_REPLACEMENT,
+    },
+    {
+        repository: 'redpandadata/*',
+        reason: 'Redpanda is under the Business Source License, which is not open source',
+        replacement: 'apache/kafka or nats',
+    },
+    {
+        repository: 'vectorized/*',
+        reason: 'Redpanda is under the Business Source License, which is not open source',
+        replacement: 'apache/kafka or nats',
+    },
+    {
+        repository: 'timescale/timescaledb',
+        allowedTag: /-oss(?:-|$)/,
+        reason: 'the default Timescale images carry Timescale License code, which is not open source',
+        replacement: 'a tag ending in -oss, or the postgres image',
+    },
+    {
+        repository: 'timescale/timescaledb-ha',
+        allowedTag: /-oss(?:-|$)/,
+        reason: 'the default Timescale images carry Timescale License code, which is not open source',
+        replacement: 'a tag ending in -oss, or the postgres image',
+    },
+    {
+        repository: 'getsentry/*',
+        from: '23.11',
+        reason: 'self-hosted Sentry is under the Functional Source License, which is not open source',
+        replacement: 'glitchtip/glitchtip, or Sentry as a service through the MIT @sentry SDKs',
+    },
+    {
+        repository: 'n8nio/*',
+        reason: 'n8n is under the Sustainable Use License, which is not open source',
+        replacement: NOTHING_REPLACEMENT,
+    },
+    {
+        repository: 'directus/directus',
+        reason: 'Directus is under the Business Source License, which is not open source',
+        replacement: 'Payload',
+    },
+    {
+        repository: 'mcr.microsoft.com/mssql/*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'container-registry.oracle.com/database/*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'gvenzl/oracle-*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'ibmcom/db2',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'icr.io/db2_community/*',
+        reason: PROPRIETARY_DATABASE_REASON,
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'ghcr.io/apollographql/router',
+        reason: 'the Apollo Router is Elastic License 2.0, which is not open source',
+        replacement: '@graphql-hive/gateway or @graphql-mesh',
+    },
+    {
+        repository: 'bitnami/*',
+        reason: 'the Bitnami catalogue was deleted in 2025, so a tag here cannot be pulled reproducibly',
+        replacement: 'the upstream official image of the same service',
+    },
+    {
+        repository: 'bitnamilegacy/*',
+        reason: 'the Bitnami legacy images are frozen with unfixed vulnerabilities',
+        replacement: 'the upstream official image of the same service',
+    },
+    {
+        repository: 'bitnamisecure/*',
+        reason: 'the Bitnami secure images publish only a latest tag, so a pull cannot be pinned',
+        replacement: 'the upstream official image of the same service',
+    },
+    {
+        repository: 'dxflrs/garage',
+        reason: 'Garage is AGPL, and a permissively licensed object store exists',
+        replacement: OBJECT_STORAGE_REPLACEMENT,
+    },
+    {
+        repository: 'citusdata/citus',
+        reason: 'Citus is AGPL, and plain PostgreSQL serves a Payload project',
+        replacement: POSTGRES_REPLACEMENT,
+    },
+    {
+        repository: 'grafana/grafana',
+        reason: 'Grafana is AGPL, and a permissively licensed dashboard exists',
+        replacement: 'persesdev/perses',
+    },
+    {
+        repository: 'grafana/loki',
+        reason: 'Loki is AGPL, and a permissively licensed log store exists',
+        replacement: 'victoriametrics/victoria-logs',
+    },
+    {
+        repository: 'grafana/tempo',
+        reason: 'Tempo is AGPL, and a permissively licensed trace store exists',
+        replacement: 'jaegertracing/jaeger',
+    },
+    {
+        repository: 'grafana/mimir',
+        reason: 'Mimir is AGPL, and a permissively licensed metrics store exists',
+        replacement: 'prom/prometheus or victoriametrics/victoria-metrics',
+    },
+    {
+        repository: 'plausible/*',
+        reason: 'Plausible is AGPL, and a permissively licensed analytics service exists',
+        replacement: 'ghcr.io/umami-software/umami',
+    },
+    {
+        repository: 'metabase/metabase',
+        reason: 'Metabase is AGPL',
+        replacement: NOTHING_REPLACEMENT,
+    },
+];
+/** The npm packages ploaness refuses, in the order the report lists them. */
+export const BLOCKED_PACKAGES = [
+    {
+        name: 'eslint-plugin-jsx-a11y',
+        reason: 'the retired JSX accessibility analyzer duplicates checks owned by the ploaness Oxlint gate',
+        replacement: 'the harness-owned oxlint gate; remove the legacy plugin dependency',
+    },
+    {
+        name: '@payloadcms/db-mongodb',
+        reason: MONGODB_REASON,
+        replacement: '@payloadcms/db-postgres',
+    },
+    { name: 'mongodb', reason: MONGODB_REASON, replacement: '@payloadcms/db-postgres' },
+    { name: 'mongoose', reason: MONGODB_REASON, replacement: '@payloadcms/db-postgres' },
+    {
+        name: 'mongodb-memory-server*',
+        reason: 'downloads the SSPL MongoDB server binary at install time',
+        replacement: '@payloadcms/db-postgres against the compose database',
+    },
+    { name: '@mongodb-js/*', reason: MONGODB_REASON, replacement: '@payloadcms/db-postgres' },
+    {
+        name: 'mongodb-client-encryption',
+        reason: MONGODB_REASON,
+        replacement: '@payloadcms/db-postgres',
+    },
+    {
+        name: '@elastic/elasticsearch',
+        reason: ELASTIC_REASON,
+        replacement: '@opensearch-project/opensearch',
+    },
+    {
+        name: '@elastic/eui',
+        reason: 'Elastic UI is dual-licensed SSPL and Elastic License 2.0, neither of which is permissive',
+        replacement: '@payloadcms/ui',
+    },
+    { name: 'elastic-apm-node', reason: ELASTIC_REASON, replacement: '@opentelemetry/sdk-node' },
+    {
+        name: 'puppeteer',
+        reason: 'downloads Chrome for Testing under Google terms, which are not open source',
+        replacement: 'playwright, or puppeteer-core pointed at the Chromium Playwright installs',
+    },
+    { name: 'pdf2pic', reason: GHOSTSCRIPT_REASON, replacement: PDF_REPLACEMENT },
+    { name: 'node-gs', reason: GHOSTSCRIPT_REASON, replacement: PDF_REPLACEMENT },
+    { name: 'ghostscript4js', reason: GHOSTSCRIPT_REASON, replacement: PDF_REPLACEMENT },
+    { name: 'mupdf', reason: 'MuPDF is AGPL', replacement: PDF_REPLACEMENT },
+    {
+        name: 'n8n',
+        reason: 'n8n is under the Sustainable Use License, which is not open source',
+        replacement: NOTHING_REPLACEMENT,
+    },
+    {
+        name: 'n8n-*',
+        reason: 'an n8n extension serves only the Sustainable Use License host',
+        replacement: NOTHING_REPLACEMENT,
+    },
+    {
+        name: 'directus',
+        reason: 'Directus is under the Business Source License, which is not open source',
+        replacement: 'payload',
+    },
+    { name: 'mssql', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    { name: 'tedious', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    { name: 'oracledb', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    { name: 'ibm_db', reason: PROPRIETARY_DATABASE_REASON, replacement: 'pg' },
+    {
+        name: 'ua-parser-js',
+        from: '2.0.0',
+        reason: 'ua-parser-js 2 is AGPL with a paid exemption',
+        replacement: 'ua-parser-js 1, or bowser',
+    },
+    {
+        name: 'mapbox-gl',
+        from: '2.0.0',
+        reason: 'Mapbox GL JS 2 onward is under proprietary Mapbox terms',
+        replacement: 'maplibre-gl',
+    },
+    {
+        name: 'tinymce',
+        from: '7.0.0',
+        reason: 'TinyMCE 7 onward is GPL or commercial',
+        replacement: '@payloadcms/richtext-lexical',
+    },
+    {
+        name: '@ckeditor/*',
+        reason: 'CKEditor 5 is GPL or commercial',
+        replacement: '@payloadcms/richtext-lexical',
+    },
+    {
+        name: 'highcharts',
+        reason: 'Highcharts is under a proprietary licence',
+        replacement: 'chart.js or echarts',
+    },
+    {
+        name: '@apollo/gateway',
+        from: '2.0.0',
+        reason: 'Apollo Gateway 2 onward is Elastic License 2.0, which is not open source',
+        replacement: '@graphql-hive/gateway',
+    },
+];
+/** The system packages a Dockerfile may not install. */
+export const BLOCKED_SYSTEM_PACKAGES = [
+    { name: 'ghostscript', reason: 'Ghostscript is AGPL', replacement: PDF_REPLACEMENT },
+    { name: 'mupdf', reason: 'MuPDF is AGPL', replacement: PDF_REPLACEMENT },
+    { name: 'mupdf-tools', reason: 'MuPDF is AGPL', replacement: PDF_REPLACEMENT },
+    { name: 'mongodb-org', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { name: 'mongodb-org-server', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+    { name: 'mongodb-mongosh', reason: MONGODB_REASON, replacement: MONGODB_REPLACEMENT },
+];
+//# sourceMappingURL=blocklist-entries.js.map

package/dist/blocklist-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist-entries.js","sourceRoot":"","sources":["../src/blocklist-entries.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,qGAAqG;AACrG,uGAAuG;AACvG,0GAA0G;AAC1G,kGAAkG;AAClG,sDAAsD;AACtD,EAAE;AACF,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,wGAAwG;AAkCxG,MAAM,cAAc,GAClB,mGAAmG,CAAA;AACrG,MAAM,mBAAmB,GAAW,iDAAiD,CAAA;AAErF,MAAM,YAAY,GAChB,iGAAiG,CAAA;AACnG,MAAM,iBAAiB,GACrB,uEAAuE,CAAA;AAEzE,MAAM,cAAc,GAClB,wFAAwF,CAAA;AAC1F,MAAM,mBAAmB,GACvB,8GAA8G,CAAA;AAEhH,MAAM,YAAY,GAChB,2FAA2F,CAAA;AAC7F,MAAM,0BAA0B,GAAW,sCAAsC,CAAA;AAEjF,MAAM,gBAAgB,GACpB,+EAA+E,CAAA;AACjF,MAAM,qBAAqB,GACzB,oEAAoE,CAAA;AAEtE,MAAM,2BAA2B,GAC/B,iEAAiE,CAAA;AACnE,MAAM,oBAAoB,GAAW,oBAAoB,CAAA;AAEzD,MAAM,kBAAkB,GAAW,2DAA2D,CAAA;AAC9F,MAAM,eAAe,GAAW,iCAAiC,CAAA;AAEjE,MAAM,mBAAmB,GAAW,gDAAgD,CAAA;AAEpF,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACjF,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACrF,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE;IAC1F,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE;IAC/E,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE;IACnF;QACE,UAAU,EAAE,eAAe;QAC3B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;KACjC;IACD,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAChG;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,UAAU,EAAE,qBAAqB;QACjC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,mBAAmB;KACjC;IACD,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACxF,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAChG,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC5F;QACE,UAAU,EAAE,cAAc;QAC1B,MAAM,EACJ,yGAAyG;YACzG,6BAA6B;QAC/B,WAAW,EAAE,6DAA6D;KAC3E;IACD;QACE,UAAU,EAAE,2BAA2B;QACvC,MAAM,EAAE,4DAA4D;QACpE,WAAW,EAAE,6DAA6D;KAC3E;IACD;QACE,UAAU,EAAE,uBAAuB;QACnC,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,iFAAiF;QACzF,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,kBAAkB;QAC9B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,qBAAqB;QACjC,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,kBAAkB;QAC9B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,UAAU,EAAE,uBAAuB;QACnC,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,qFAAqF;QAC7F,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,UAAU,EAAE,0BAA0B;QACtC,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,qFAAqF;QAC7F,WAAW,EAAE,6CAA6C;KAC3D;IACD;QACE,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,qFAAqF;QAC7F,WAAW,EAAE,0EAA0E;KACxF;IACD;QACE,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,oEAAoE;QAC5E,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,UAAU,EAAE,mBAAmB;QAC/B,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,SAAS;KACvB;IACD;QACE,UAAU,EAAE,2BAA2B;QACvC,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,0CAA0C;QACtD,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,wBAAwB;QACpC,MAAM,EAAE,2BAA2B;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,8BAA8B;QAC1C,MAAM,EAAE,oEAAoE;QAC5E,WAAW,EAAE,wCAAwC;KACtD;IACD;QACE,UAAU,EAAE,WAAW;QACvB,MAAM,EACJ,wFAAwF;QAC1F,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,mEAAmE;QAC3E,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,iFAAiF;QACzF,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,iEAAiE;QACzE,WAAW,EAAE,0BAA0B;KACxC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,8DAA8D;QACtE,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE,kBAAkB;KAChC;IACD;QACE,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,4DAA4D;QACpE,WAAW,EAAE,+BAA+B;KAC7C;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE,sBAAsB;KACpC;IACD;QACE,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,iEAAiE;QACzE,WAAW,EAAE,qDAAqD;KACnE;IACD;QACE,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,UAAU,EAAE,mBAAmB;QAC/B,MAAM,EAAE,kBAAkB;QAC1B,WAAW,EAAE,mBAAmB;KACjC;CACF,CAAA;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EACJ,4FAA4F;QAC9F,WAAW,EAAE,oEAAoE;KAClF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,yBAAyB;KACvC;IACD,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACnF,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACpF;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,0DAA0D;QAClE,WAAW,EAAE,sDAAsD;KACpE;IACD,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACzF;QACE,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,gCAAgC;KAC9C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,MAAM,EACJ,0FAA0F;QAC5F,WAAW,EAAE,gBAAgB;KAC9B;IACD,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC5F;QACE,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,4EAA4E;QACpF,WAAW,EAAE,2EAA2E;KACzF;IACD,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE;IAC7E,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE;IAC7E,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE;IACpF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IACxE;QACE,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,oEAAoE;QAC5E,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,+DAA+D;QACvE,WAAW,EAAE,mBAAmB;KACjC;IACD;QACE,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,yEAAyE;QACjF,WAAW,EAAE,SAAS;KACvB;IACD,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IACzE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IAC3E,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IAC5E,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;IAC1E;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,8CAA8C;QACtD,WAAW,EAAE,2BAA2B;KACzC;IACD;QACE,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,yDAAyD;QACjE,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,uCAAuC;QAC/C,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,iCAAiC;QACzC,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,2CAA2C;QACnD,WAAW,EAAE,qBAAqB;KACnC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,0EAA0E;QAClF,WAAW,EAAE,uBAAuB;KACrC;CACF,CAAA;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,WAAW,EAAE,eAAe,EAAE;IACpF,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IACxE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE;IAC9E,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACjF,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACxF,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE;CACtF,CAAA"}

package/dist/blocklist.d.ts

@@ -0,0 +1,91 @@
+import { type DependencyStatus } from './dependency-freshness.js';
+/** One refusal, ready to be printed beside the file that carries the subject. */
+export interface Refusal {
+    /** The reference, the `name@version`, or the system package as written. */
+    readonly subject: string;
+    readonly reason: string;
+    readonly replacement: string;
+}
+/** An image reference split into the parts the rule reads. */
+export interface ImageReference {
+    readonly raw: string;
+    /** The repository in the normalised form `blocklist-entries.ts` uses. */
+    readonly repository: string;
+    readonly tag: string | undefined;
+    readonly digest: string | undefined;
+}
+/**
+ * Split an image reference as a Dockerfile, a workflow, or a compose model writes it.
+ * @param raw the reference, such as `docker.io/library/redis:7.4.1@sha256:...`.
+ * @returns the normalised repository, and the tag and digest when present.
+ */
+export declare const parseImageReference: (raw: string) => ImageReference;
+/**
+ * Whether a reference may resolve to a different image tomorrow: no digest, and no tag or `latest`.
+ * @param raw the reference as written.
+ * @returns true when nothing in the reference pins what is pulled.
+ */
+export declare const isMutableImageReference: (raw: string) => boolean;
+/**
+ * Whether an image reference names a refused repository at a refused tag.
+ * @param raw the reference as written.
+ * @returns the refusal, or undefined when the image is not one ploaness refuses.
+ */
+export declare const refuseImage: (raw: string) => Refusal | undefined;
+/**
+ * Whether an installed package at a version is one ploaness refuses.
+ * @param name the package name.
+ * @param version the resolved version.
+ * @returns the refusal, or undefined when the package is not one ploaness refuses at that version.
+ */
+export declare const refusePackage: (name: string, version: string) => Refusal | undefined;
+/**
+ * The refused system packages a Dockerfile installs.
+ * @param text the Dockerfile body.
+ * @returns one refusal per refused package, in file order.
+ */
+export declare const refuseSystemPackages: (text: string) => readonly Refusal[];
+/** One package of the resolved set, at every version the install carries. */
+export interface InstalledPackage {
+    readonly name: string;
+    readonly versions: readonly string[];
+}
+/**
+ * The resolved set as `pnpm licenses list --json` reports it: grouped by licence, each entry carrying
+ * the name and the versions installed.
+ * @param json the command's stdout.
+ * @returns every installed package, or undefined when the text is not that inventory.
+ */
+export declare const packagesInLicenseInventory: (json: string) => readonly InstalledPackage[] | undefined;
+/**
+ * The refusals across an installed set.
+ * @param packages the resolved set.
+ * @returns one refusal per refused name and version, in inventory order.
+ */
+export declare const refuseInstalledPackages: (packages: readonly InstalledPackage[]) => readonly Refusal[];
+/** A declared coordinate whose newest release the freshness bound may not demand. */
+export interface RefusedLatest {
+    readonly status: DependencyStatus;
+    /** Why the newest release is out of reach, in the words the report prints. */
+    readonly note: string;
+}
+/** The statuses freshness measures, and the ones whose newest release it may not point at. */
+export interface FreshnessScope {
+    readonly measurable: readonly DependencyStatus[];
+    readonly refused: readonly RefusedLatest[];
+}
+/**
+ * Split the declared coordinates into those freshness may measure and those whose newest release is
+ * refused, which freshness must not demand.
+ * @param statuses every declared coordinate with what the registry answered for it.
+ * @returns the measurable statuses, and the refused ones with the note the report prints.
+ */
+export declare const scopeFreshness: (statuses: readonly DependencyStatus[]) => FreshnessScope;
+/**
+ * The refusals of a repository's own JSON summary, kept exported so the CLI prints the same words.
+ * @param refusal one refusal.
+ * @param location the file or inventory that carries the subject.
+ * @returns one finding line.
+ */
+export declare const describeRefusal: (refusal: Refusal, location: string) => string;
+//# sourceMappingURL=blocklist.d.ts.map

package/dist/blocklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../src/blocklist.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,gBAAgB,EAAoC,MAAM,2BAA2B,CAAA;AAInG,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAsCD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,KAAG,cAWjD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,OAKrD,CAAA;AAoCD;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAO,GAAG,SAWnD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,OAAO,GAAG,SAUvE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,KAAG,SAAS,OAAO,EAMhE,CAAA;AAEJ,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACrC,MAAM,MAAM,KACX,SAAS,gBAAgB,EAAE,GAAG,SAchC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAClC,UAAU,SAAS,gBAAgB,EAAE,KACpC,SAAS,OAAO,EAMhB,CAAA;AAEH,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;CAC3C;AAiBD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,cASpE,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,EAAE,UAAU,MAAM,KAAG,MACc,CAAA"}