@ploaness/governance 1.1.0 → 1.3.0

package/dist/checkov-policy.js

@@ -0,0 +1,105 @@
+import { AWS_CHECKS } from './checkov-checks-aws.js';
+import { AZURE_CHECKS } from './checkov-checks-azure.js';
+import { GOOGLE_CHECKS, SMALL_CLOUD_CHECKS } from './checkov-checks-google.js';
+/** The checks enabled at error severity, each confirmed present in the pinned image. */
+export const CHECKOV_CHECKS = [
+    ...AWS_CHECKS,
+    ...AZURE_CHECKS,
+    ...GOOGLE_CHECKS,
+    ...SMALL_CLOUD_CHECKS,
+];
+/**
+ * The value of checkov's `--check` flag.
+ *
+ * Read from the catalogue rather than written out, so the list that runs and the list that carries the
+ * reasons cannot drift. An empty value would run EVERY check rather than none, which is why the spec
+ * beside this asserts the catalogue is not empty.
+ * @returns the enabled identifiers, comma separated.
+ */
+export const checkovCheckList = () => CHECKOV_CHECKS.map((check) => check.id).join(',');
+// The tally checkov prints after a scan. Its compact output spends several lines on each failed check
+// and a few on headers, so counting lines would report defects that are not there.
+const FAILED_CHECKS = /Failed checks: (?<count>\d+)/;
+/**
+ * How many checks checkov reports as failed.
+ * @param output the analyzer's output for a scan that found at least one resource.
+ * @returns the tally, or undefined when the output carries none - which a caller treats as a run that
+ * did not complete rather than as a clean one.
+ */
+export const failedCheckCount = (output) => {
+    const count = FAILED_CHECKS.exec(output)?.groups?.['count'];
+    return count === undefined ? undefined : Number(count);
+};
+/**
+ * The checks that can apply to a set of providers.
+ * @param providers provider names as the resource types spell them.
+ * @returns every enabled check bound to one of them.
+ */
+export const checksFor = (providers) => CHECKOV_CHECKS.filter((check) => providers.includes(check.provider));
+/**
+ * Every provider this harness knows to have no enabled check, and why. A provider on neither this map
+ * nor the catalogue is refused: the harness cannot tell whether the analyzer covers it and does not
+ * guess. The `unsupported` entries were confirmed absent from the pinned image with `--list`, and are
+ * re-confirmed when the pin moves.
+ */
+export const PROVIDERS_WITHOUT_CHECKS = new Map([
+    // Declares no cloud resource, so there is nothing for an analyzer to judge.
+    ['random', 'utility'],
+    ['null', 'utility'],
+    ['local', 'utility'],
+    ['tls', 'utility'],
+    ['time', 'utility'],
+    ['archive', 'utility'],
+    ['external', 'utility'],
+    ['http', 'utility'],
+    ['template', 'utility'],
+    ['cloudinit', 'utility'],
+    ['terraform', 'utility'],
+    // The pinned image ships no check for these. A project on one of them is judged by the pattern
+    // rules alone, and the summary says so.
+    ['hcloud', 'unsupported'],
+    ['cloudflare', 'unsupported'],
+    ['vercel', 'unsupported'],
+    ['fly', 'unsupported'],
+    ['render', 'unsupported'],
+    ['scaleway', 'unsupported'],
+    ['ovh', 'unsupported'],
+    ['vultr', 'unsupported'],
+    ['upcloud', 'unsupported'],
+    ['exoscale', 'unsupported'],
+    ['mongodbatlas', 'unsupported'],
+    ['neon', 'unsupported'],
+    ['helm', 'unsupported'],
+    // Azure's sibling providers. `azapi` binds no check at all. `azuread` binds exactly one,
+    // `CKV_AZURE_249`, whose regular expression over an OIDC subject rejects a value that arrives through
+    // a variable - so it failed the rubric, and nothing is enabled for the provider.
+    ['azapi', 'unsupported'],
+    ['azuread', 'audited'],
+]);
+/**
+ * The providers at least one enabled check binds to.
+ *
+ * Derived from the catalogue rather than declared beside it, so a cloud cannot be listed as curated
+ * with nothing enabled for it.
+ * @returns the provider names.
+ */
+export const curatedProviders = () => new Set(CHECKOV_CHECKS.map((check) => check.provider));
+const standingOf = (provider, curated) => curated.has(provider) ? 'curated' : (PROVIDERS_WITHOUT_CHECKS.get(provider) ?? 'unclassified');
+/**
+ * Sort the providers a tree declares by what the gate does about each.
+ * @param detected provider names, in any order and with any repetition.
+ * @returns each provider once, in its standing, ordered so a report reads the same on every machine.
+ */
+export const classifyProviders = (detected) => {
+    const curated = curatedProviders();
+    const unique = [...new Set(detected)].toSorted((left, right) => left.localeCompare(right));
+    const standing = (wanted) => unique.filter((provider) => standingOf(provider, curated) === wanted);
+    return {
+        curated: standing('curated'),
+        utility: standing('utility'),
+        unsupported: standing('unsupported'),
+        audited: standing('audited'),
+        unclassified: standing('unclassified'),
+    };
+};
+//# sourceMappingURL=checkov-policy.js.map

package/dist/checkov-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-policy.js","sourceRoot":"","sources":["../src/checkov-policy.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,GAAG,UAAU;IACb,GAAG,YAAY;IACf,GAAG,aAAa;IAChB,GAAG,kBAAkB;CACtB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEzE,sGAAsG;AACtG,mFAAmF;AACnF,MAAM,aAAa,GAAW,8BAA8B,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAsB,EAAE;IACrE,MAAM,KAAK,GAAuB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;IAC/E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAA4B,EAA2B,EAAE,CACjF,cAAc,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;AAS7F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA0C,IAAI,GAAG,CAGpF;IACA,4EAA4E;IAC5E,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,CAAC,OAAO,EAAE,SAAS,CAAC;IACpB,CAAC,KAAK,EAAE,SAAS,CAAC;IAClB,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,+FAA+F;IAC/F,wCAAwC;IACxC,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,YAAY,EAAE,aAAa,CAAC;IAC7B,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,KAAK,EAAE,aAAa,CAAC;IACtB,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,KAAK,EAAE,aAAa,CAAC;IACtB,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,SAAS,EAAE,aAAa,CAAC;IAC1B,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,CAAC,MAAM,EAAE,aAAa,CAAC;IACvB,CAAC,MAAM,EAAE,aAAa,CAAC;IACvB,yFAAyF;IACzF,sGAAsG;IACtG,iFAAiF;IACjF,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,SAAS,EAAE,SAAS,CAAC;CACvB,CAAC,CAAA;AAaF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAwB,EAAE,CACxD,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;AAE9E,MAAM,UAAU,GAAG,CACjB,QAAgB,EAChB,OAA4B,EACE,EAAE,CAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,CAAA;AAEhG;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAA0B,EAAE;IACvF,MAAM,OAAO,GAAwB,gBAAgB,EAAE,CAAA;IACvD,MAAM,MAAM,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAC/D,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CACnE,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,MAAoC,EAAqB,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAA;IACxF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5B,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC;QACpC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5B,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC;KACvC,CAAA;AACH,CAAC,CAAA"}

package/dist/container-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-failure.d.ts","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAmBA,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,aAAa,CAAA;AAEjB,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,EAAE,MAAY,CAAA;AAyG5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAalB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAOlB,CAAA"}
+{"version":3,"file":"container-failure.d.ts","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAEA,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,aAAa,CAAA;AAEjB,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,EAAE,MAAY,CAAA;AAyG5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAC/B,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAalB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,YAAY,YAAY,KACvB,aAAa,GAAG,SAOlB,CAAA"}

package/dist/container-failure.js

@@ -1,21 +1,4 @@
-// Why a containerised gate failed, told apart from what its analyzer reported.
-//
-// `docker run` passes the container's own exit code through, so a gate that reads every non-zero exit as
-// the tool's verdict reads a failure of Docker as a finding. The consequence was not cosmetic: a Docker
-// Hub pull-rate limit - 100 anonymous pulls per six hours per IP, which several teams behind one CI
-// egress reach - made the secret scan announce that it had found a secret in the git history. That is the
-// one verdict a project cannot dismiss on its own judgement, and the worst thing this harness can say. A
-// registry outage, an unreachable network, and a digest the registry no longer serves all landed the same
-// way.
-//
-// Two classifiers rather than one, and the split is the actual repair. `classifyImageFailure` reads
-// markers out of the output because it judges `docker image inspect` and `docker pull`, whose every byte
-// docker wrote. `classifyContainerExit` judges a run of the analyzer, whose output carries content the
-// PROJECT authored - a commit message, a Dockerfile, a workflow - so it reads the exit code and nothing
-// else. Matching `no such host` against a commit message would invert the same bug rather than fix it.
-//
-// The rules are pure so they are exercised against captured `docker` output rather than against a live
-// daemon: every branch below describes a failure that is expensive or impossible to stage on demand.
+// Distinguish unavailable container infrastructure from analyzer findings so each failure names the right repair.
 /** The exit code a shell reports for a command it cannot find. */
 export const COMMAND_NOT_FOUND = 127;
 // `docker run` reserves these for a failure of docker itself, distinct from whatever the container exits

package/dist/container-failure.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-failure.js","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,oGAAoG;AACpG,0GAA0G;AAC1G,yGAAyG;AACzG,0GAA0G;AAC1G,OAAO;AACP,EAAE;AACF,oGAAoG;AACpG,yGAAyG;AACzG,uGAAuG;AACvG,wGAAwG;AACxG,uGAAuG;AACvG,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AAwBrG,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAE5C,yGAAyG;AACzG,yGAAyG;AACzG,2GAA2G;AAC3G,6FAA6F;AAC7F,MAAM,oBAAoB,GAAW,GAAG,CAAA;AACxC,MAAM,0BAA0B,GAAW,GAAG,CAAA;AAQ9C,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE;QACN,MAAM,EAAE,sDAAsD;QAC9D,QAAQ,EAAE,CAAC,gFAAgF,CAAC;KAC7F;IACD,UAAU,EAAE;QACV,MAAM,EAAE,kDAAkD;QAC1D,QAAQ,EAAE,CAAC,kFAAkF,CAAC;KAC/F;IACD,WAAW,EAAE;QACX,MAAM,EACJ,yFAAyF;QAC3F,QAAQ,EAAE;YACR,8GAA8G;YAC9G,+DAA+D;YAC/D,yDAAyD;SAC1D;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,mEAAmE;QAC3E,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gGAAgG;SACjG;KACF;IACD,eAAe,EAAE;QACf,MAAM,EAAE,qDAAqD;QAC7D,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gDAAgD;SACjD;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,wCAAwC;QAChD,QAAQ,EAAE,CAAC,+EAA+E,CAAC;KAC5F;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IAC5E,IAAI;IACJ,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ;CACjC,CAAC,CAAA;AAEF,yGAAyG;AACzG,qGAAqG;AACrG,mCAAmC;AACnC,EAAE;AACF,wGAAwG;AACxG,kGAAkG;AAClG,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,qBAAqB;AACrB,MAAM,OAAO,GAAiE;IAC5E,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IACxE;QACE,YAAY;QACZ;YACE,qCAAqC;YACrC,8BAA8B;YAC9B,sBAAsB;YACtB,8BAA8B;SAC/B;KACF;IACD,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC5E;QACE,aAAa;QACb;YACE,UAAU;YACV,cAAc;YACd,aAAa;YACb,eAAe;YACf,oBAAoB;YACpB,wBAAwB;YACxB,sCAAsC;SACvC;KACF;IACD;QACE,iBAAiB;QACjB;YACE,kBAAkB;YAClB,qBAAqB;YACrB,2BAA2B;YAC3B,6BAA6B;SAC9B;KACF;CACF,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,QAAQ,GAAW,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;IACxD,MAAM,OAAO,GAAgE,OAAO,CAAC,IAAI,CACvF,CAAC,CAAC,EAAE,OAAO,CAAkD,EAAW,EAAE,CACxE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACvE,CAAA;IACD,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,KAAK,oBAAoB,IAAI,UAAU,CAAC,IAAI,KAAK,0BAA0B;QAC/F,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC;QACjC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"container-failure.js","sourceRoot":"","sources":["../src/container-failure.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAwBlH,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAE5C,yGAAyG;AACzG,yGAAyG;AACzG,2GAA2G;AAC3G,6FAA6F;AAC7F,MAAM,oBAAoB,GAAW,GAAG,CAAA;AACxC,MAAM,0BAA0B,GAAW,GAAG,CAAA;AAQ9C,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE;QACN,MAAM,EAAE,sDAAsD;QAC9D,QAAQ,EAAE,CAAC,gFAAgF,CAAC;KAC7F;IACD,UAAU,EAAE;QACV,MAAM,EAAE,kDAAkD;QAC1D,QAAQ,EAAE,CAAC,kFAAkF,CAAC;KAC/F;IACD,WAAW,EAAE;QACX,MAAM,EACJ,yFAAyF;QAC3F,QAAQ,EAAE;YACR,8GAA8G;YAC9G,+DAA+D;YAC/D,yDAAyD;SAC1D;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,mEAAmE;QAC3E,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gGAAgG;SACjG;KACF;IACD,eAAe,EAAE;QACf,MAAM,EAAE,qDAAqD;QAC7D,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gDAAgD;SACjD;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,wCAAwC;QAChD,QAAQ,EAAE,CAAC,+EAA+E,CAAC;KAC5F;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAiB,EAAE,CAAC,CAAC;IAC5E,IAAI;IACJ,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ;CACjC,CAAC,CAAA;AAEF,yGAAyG;AACzG,qGAAqG;AACrG,mCAAmC;AACnC,EAAE;AACF,wGAAwG;AACxG,kGAAkG;AAClG,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,qBAAqB;AACrB,MAAM,OAAO,GAAiE;IAC5E,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IACxE;QACE,YAAY;QACZ;YACE,qCAAqC;YACrC,8BAA8B;YAC9B,sBAAsB;YACtB,8BAA8B;SAC/B;KACF;IACD,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC5E;QACE,aAAa;QACb;YACE,UAAU;YACV,cAAc;YACd,aAAa;YACb,eAAe;YACf,oBAAoB;YACpB,wBAAwB;YACxB,sCAAsC;SACvC;KACF;IACD;QACE,iBAAiB;QACjB;YACE,kBAAkB;YAClB,qBAAqB;YACrB,2BAA2B;YAC3B,6BAA6B;SAC9B;KACF;CACF,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,QAAQ,GAAW,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;IACxD,MAAM,OAAO,GAAgE,OAAO,CAAC,IAAI,CACvF,CAAC,CAAC,EAAE,OAAO,CAAkD,EAAW,EAAE,CACxE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACvE,CAAA;IACD,OAAO,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,UAAwB,EACG,EAAE;IAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,KAAK,oBAAoB,IAAI,UAAU,CAAC,IAAI,KAAK,0BAA0B;QAC/F,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC;QACjC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA"}

package/dist/container-files.d.ts

@@ -17,6 +17,22 @@ export declare const isDockerfile: (file: string) => boolean;
  * @returns true when the file identifies a compose project.
  */
 export declare const isComposeFile: (file: string) => boolean;
+/**
+ * Whether a tracked path is a GitHub Actions workflow.
+ * @param file the repo-relative path.
+ * @returns true for a YAML file directly under `.github/workflows`.
+ */
+export declare const isWorkflowFile: (file: string) => boolean;
+/**
+ * Every workflow the repository tracks.
+ *
+ * Discovered from the working tree rather than listed, for the reason `scripts/verify.sh` records about
+ * its own shell scripts: an enumeration is correct only at the moment it is written, and a workflow
+ * added later would be a workflow nothing reads.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @returns the workflows, ordered so a report reads the same on every machine.
+ */
+export declare const workflowsIn: (tracked: readonly string[]) => readonly string[];
 /**
  * Every Dockerfile the repository tracks.
  * @param tracked the repo-relative paths of the tracked files.

package/dist/container-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-files.d.ts","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AASA,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAqBD;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,OAG3C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,OAAuD,CAAA;AAMpG;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAGO,CAAA;AAEjF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,cAAc,EAcrF,CAAA"}
+{"version":3,"file":"container-files.d.ts","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAqBD;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,OAG3C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,OAAuD,CAAA;AASpG;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAG8B,CAAA;AAE5E;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAGS,CAAA;AAEjF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAGO,CAAA;AAEjF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,SAAS,MAAM,EAAE,KAAG,SAAS,cAAc,EAcrF,CAAA"}

package/dist/container-files.js

@@ -1,11 +1,4 @@
-// Which files in a tracked tree are container definitions, and which directories hold a compose project.
-//
-// Discovery is stated here for both kinds at once, because stating it for only one is how the two halves
-// drifted. The Dockerfile half already walked the tracked tree - a project may keep a Dockerfile in any
-// directory, and a hard-coded path would silently skip the ones it did not anticipate - while the compose
-// half looked at the repository root and nowhere else. A Payload project that keeps its application in a
-// member directory keeps its compose file beside it, so the gate linted that member's Dockerfile and
-// reported a pass having validated no compose project at all.
+// Identify container definitions and compose projects from the working-tree inventory.
 // Sliced rather than split, so neither helper carries a case that cannot happen. `lastIndexOf`
 // returns -1 for a bare basename, which makes these the whole string and the empty string - the two
 // answers a repository-root file wants - without a fallback no input could reach.
@@ -40,6 +33,28 @@ export const isComposeFile = (file) => COMPOSE_BASENAMES.includes(basenameOf(fil
 // Where a name sits in compose's own precedence. Only ever asked of a file `isComposeFile` accepted,
 // so the -1 `indexOf` returns for anything else is unreachable rather than meaningful.
 const precedenceOf = (file) => COMPOSE_BASENAMES.indexOf(basenameOf(file));
+const WORKFLOW_DIRECTORY = '.github/workflows/';
+const WORKFLOW_SUFFIXES = ['.yml', '.yaml'];
+/**
+ * Whether a tracked path is a GitHub Actions workflow.
+ * @param file the repo-relative path.
+ * @returns true for a YAML file directly under `.github/workflows`.
+ */
+export const isWorkflowFile = (file) => file.startsWith(WORKFLOW_DIRECTORY) &&
+    !file.slice(WORKFLOW_DIRECTORY.length).includes('/') &&
+    WORKFLOW_SUFFIXES.some((suffix) => file.endsWith(suffix));
+/**
+ * Every workflow the repository tracks.
+ *
+ * Discovered from the working tree rather than listed, for the reason `scripts/verify.sh` records about
+ * its own shell scripts: an enumeration is correct only at the moment it is written, and a workflow
+ * added later would be a workflow nothing reads.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @returns the workflows, ordered so a report reads the same on every machine.
+ */
+export const workflowsIn = (tracked) => tracked
+    .filter((file) => isWorkflowFile(file))
+    .toSorted((left, right) => left.localeCompare(right));
 /**
  * Every Dockerfile the repository tracks.
  * @param tracked the repo-relative paths of the tracked files.

package/dist/container-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-files.js","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,0GAA0G;AAC1G,yGAAyG;AACzG,qGAAqG;AACrG,8DAA8D;AAU9D,+FAA+F;AAC/F,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE/F,4EAA4E;AAC5E,EAAE;AACF,yGAAyG;AACzG,0GAA0G;AAC1G,2FAA2F;AAC3F,MAAM,iBAAiB,GAAsB;IAC3C,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,oBAAoB;CACrB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IACpD,MAAM,IAAI,GAAW,UAAU,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAChG,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAEpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAC7E,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;KACrD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA0B,EAA6B,EAAE;IACzF,MAAM,KAAK,GAAsB,OAAO,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAChF,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SAC5E,OAAO,CAAC,CAAC,SAAiB,EAA6B,EAAE;IACxD,gGAAgG;IAChG,kGAAkG;IAClG,2FAA2F;IAC3F,KAAK;SACF,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAClE,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;SAC3F,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAA;AACL,CAAC,CAAA"}
+{"version":3,"file":"container-files.js","sourceRoot":"","sources":["../src/container-files.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAUvF,+FAA+F;AAC/F,oGAAoG;AACpG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE/F,4EAA4E;AAC5E,EAAE;AACF,yGAAyG;AACzG,0GAA0G;AAC1G,2FAA2F;AAC3F,MAAM,iBAAiB,GAAsB;IAC3C,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,oBAAoB;CACrB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IACpD,MAAM,IAAI,GAAW,UAAU,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAA;AAChG,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAEpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAE1F,MAAM,kBAAkB,GAAW,oBAAoB,CAAA;AACvD,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;IACnC,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;IACpD,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAC3E,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACvD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAqB,EAAE,CAC7E,OAAO;KACJ,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;KACrD,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA0B,EAA6B,EAAE;IACzF,MAAM,KAAK,GAAsB,OAAO,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAChF,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SAC5E,OAAO,CAAC,CAAC,SAAiB,EAA6B,EAAE;IACxD,gGAAgG;IAChG,kGAAkG;IAClG,2FAA2F;IAC3F,KAAK;SACF,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAClE,QAAQ,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;SAC3F,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAChE,CAAA;AACL,CAAC,CAAA"}

package/dist/container-images.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Join backslash-continued lines, so a `RUN` split across lines reads as the one command it is.
+ * @param text the file body.
+ * @returns one entry per logical line.
+ */
+export declare const logicalLines: (text: string) => readonly string[];
+/**
+ * The images a Dockerfile pulls: every `FROM` that names a registry image rather than an earlier stage.
+ * @param text the Dockerfile body.
+ * @returns the references in file order, with `ARG` defaults substituted.
+ */
+export declare const imageReferencesInDockerfile: (text: string) => readonly string[];
+/**
+ * The system packages a Dockerfile installs through the base image's package manager.
+ * @param text the Dockerfile body.
+ * @returns every package name after an install verb, in file order.
+ */
+export declare const systemPackagesInDockerfile: (text: string) => readonly string[];
+/**
+ * The images a GitHub Actions workflow pulls: service containers, job containers, and Docker actions.
+ * @param text the workflow body.
+ * @returns the references in file order.
+ */
+export declare const imageReferencesInWorkflow: (text: string) => readonly string[];
+/** One service of a compose model and the image it pulls. */
+export interface ComposeImage {
+    readonly service: string;
+    readonly image: string;
+}
+/**
+ * The images a rendered compose model pulls. A service with a `build` is judged through its Dockerfile,
+ * and its `image` is only the name the build is tagged with.
+ * @param json the output of `docker compose config --format json`.
+ * @returns the pulled images by service name, or undefined when the text is not a compose model.
+ */
+export declare const imageReferencesInComposeModel: (json: string) => readonly ComposeImage[] | undefined;
+/**
+ * Whether a reference still carries a variable nothing substituted, so no rule can say what it pulls.
+ * @param reference the reference as read.
+ * @returns true when a `$` remains in it.
+ */
+export declare const hasUnresolvedVariable: (reference: string) => boolean;
+//# sourceMappingURL=container-images.d.ts.map

package/dist/container-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-images.d.ts","sourceRoot":"","sources":["../src/container-images.ts"],"names":[],"mappings":"AAuCA;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EACX,CAAA;AAmEhD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAK5D,CAAA;AAed;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAQrE,CAAA;AASJ;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,MAAM,MAAM,KAAG,SAAS,MAAM,EAOlE,CAAA;AAEN,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GACxC,MAAM,MAAM,KACX,SAAS,YAAY,EAAE,GAAG,SAc5B,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,KAAG,OAAkC,CAAA"}

package/dist/container-images.js

@@ -0,0 +1,157 @@
+// Where a repository names the container images it pulls, read into plain references.
+//
+// Three files name an image: a Dockerfile in its `FROM` lines, a workflow in the `image:` of a service
+// or job container and in a `docker://` action, and a compose file in `services.*.image`. The compose
+// half is read from the model `docker compose config --format json` renders rather than from the YAML,
+// because compose interpolates `${VARIABLE}` from the `.env` beside the file and resolves the override
+// files it merges, and a reader of the source text would judge a reference the daemon never pulls.
+//
+// The Dockerfile and workflow readers are line readers over a known syntax, in the spirit of
+// `yaml-blocks.ts`: what has to be recognised is one keyword and the token after it.
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+import { withoutQuotes } from './yaml-blocks.js';
+const CONTINUATION = /\\\r?\n/g;
+// A keyword, horizontal space, then a value that starts with a non-space: the value pattern cannot
+// exchange characters with the space run before it, which is what keeps the match linear.
+const FROM_LINE = /^[ \t]*FROM[ \t]+(?<rest>\S.*)$/i;
+const ARG_LINE = /^[ \t]*ARG[ \t]+(?<name>[A-Z_]\w*)=(?<value>\S+)/i;
+const RUN_LINE = /^[ \t]*RUN[ \t]+(?<rest>\S.*)$/i;
+const COMMENT_LINE = /^[ \t]*#/;
+// A base image every multi-stage build may start from that no registry serves.
+const SCRATCH = 'scratch';
+const STAGE_KEYWORD = 'as';
+const PLATFORM_OPTION = '--';
+// The install verbs of the package managers a base image ships. `apt-get install`, `apk add`, and the
+// Red Hat family; pip and npm are language installs and judged elsewhere.
+const INSTALL_VERB = /\b(?:apt-get|apt|apk|dnf|microdnf|yum|zypper)[ \t]+(?:install|add)\b/;
+const COMMAND_SEPARATOR = /&&|\|\||;|\|/;
+// What ends a package name in an install token: apt's `=version` and `/suite`, apk's `=version` and
+// `~version`. dnf's `-version` is indistinguishable from a hyphenated name and is left alone.
+const PACKAGE_NAME_END = /[=/~]/;
+const OPTION_PREFIX = '-';
+const WORKFLOW_IMAGE = /^[ \t]*(?:-[ \t]*)?image:[ \t]*(?<value>[^\s#][^#]*)/;
+const WORKFLOW_CONTAINER = /^[ \t]*container:[ \t]*(?<value>[^\s#{]+)/;
+const WORKFLOW_DOCKER_ACTION = /uses:[ \t]*['"]?docker:\/\/(?<value>[^\s'"]+)/;
+/**
+ * Join backslash-continued lines, so a `RUN` split across lines reads as the one command it is.
+ * @param text the file body.
+ * @returns one entry per logical line.
+ */
+export const logicalLines = (text) => text.replaceAll(CONTINUATION, ' ').split('\n');
+const contentLines = (text) => logicalLines(text).filter((line) => !COMMENT_LINE.test(line));
+const readFrom = (rest) => {
+    const tokens = (rest ?? '')
+        .trim()
+        .split(/[ \t]+/)
+        .filter((token) => !token.startsWith(PLATFORM_OPTION));
+    const [first, keyword, stage] = tokens;
+    const reference = first ?? '';
+    if (reference.length === 0) {
+        return undefined;
+    }
+    return { reference, stage: keyword?.toLowerCase() === STAGE_KEYWORD ? stage : undefined };
+};
+// `FROM node:${NODE_VERSION}` is the common way to state a version once, and the ARG that gives it a
+// default is the only place the value lives. Both spellings of a reference are substituted; an ARG with
+// no default leaves the variable in place, and the rule reports it as a reference it cannot judge.
+const substituteArguments = (reference, defaults) => [...defaults].reduce((resolved, [name, value]) => resolved
+    .replaceAll(`\${${name}}`, () => value)
+    .replaceAll(`$${name}`, () => value), reference);
+const recordArgument = (walk, line) => {
+    const found = ARG_LINE.exec(line);
+    if (found?.groups === undefined) {
+        return undefined;
+    }
+    const defaults = new Map([
+        ...walk.defaults,
+        [found.groups['name'] ?? '', withoutQuotes(found.groups['value'] ?? '')],
+    ]);
+    return { ...walk, defaults };
+};
+const recordFrom = (walk, line) => {
+    const from = readFrom(FROM_LINE.exec(line)?.groups?.['rest']);
+    if (from === undefined) {
+        return walk;
+    }
+    const reference = substituteArguments(from.reference, walk.defaults);
+    const isRegistryImage = reference !== SCRATCH && !walk.stages.has(reference);
+    return {
+        defaults: walk.defaults,
+        stages: from.stage === undefined ? walk.stages : new Set([...walk.stages, from.stage]),
+        references: isRegistryImage ? [...walk.references, reference] : walk.references,
+    };
+};
+/**
+ * The images a Dockerfile pulls: every `FROM` that names a registry image rather than an earlier stage.
+ * @param text the Dockerfile body.
+ * @returns the references in file order, with `ARG` defaults substituted.
+ */
+export const imageReferencesInDockerfile = (text) => contentLines(text).reduce((walk, line) => recordArgument(walk, line) ?? recordFrom(walk, line), { defaults: new Map(), stages: new Set(), references: [] }).references;
+const packagesInCommand = (command) => {
+    const verb = INSTALL_VERB.exec(command);
+    if (verb === null) {
+        return [];
+    }
+    return command
+        .slice(verb.index + verb[0].length)
+        .trim()
+        .split(/[ \t]+/)
+        .filter((token) => token.length > 0 && !token.startsWith(OPTION_PREFIX))
+        .map((token) => token.split(PACKAGE_NAME_END)[0] ?? '');
+};
+/**
+ * The system packages a Dockerfile installs through the base image's package manager.
+ * @param text the Dockerfile body.
+ * @returns every package name after an install verb, in file order.
+ */
+export const systemPackagesInDockerfile = (text) => contentLines(text).flatMap((line) => {
+    const rest = RUN_LINE.exec(line)?.groups?.['rest'];
+    return rest === undefined
+        ? []
+        : rest
+            .split(COMMAND_SEPARATOR)
+            .flatMap((command) => packagesInCommand(command));
+});
+const workflowReferenceIn = (line) => {
+    const found = WORKFLOW_DOCKER_ACTION.exec(line) ?? WORKFLOW_IMAGE.exec(line) ?? WORKFLOW_CONTAINER.exec(line);
+    const value = found?.groups?.['value'];
+    return value === undefined ? undefined : withoutQuotes(value.trim());
+};
+/**
+ * The images a GitHub Actions workflow pulls: service containers, job containers, and Docker actions.
+ * @param text the workflow body.
+ * @returns the references in file order.
+ */
+export const imageReferencesInWorkflow = (text) => text
+    .split('\n')
+    .filter((line) => !COMMENT_LINE.test(line))
+    .flatMap((line) => {
+    const reference = workflowReferenceIn(line);
+    return reference === undefined || reference.length === 0 ? [] : [reference];
+});
+/**
+ * The images a rendered compose model pulls. A service with a `build` is judged through its Dockerfile,
+ * and its `image` is only the name the build is tagged with.
+ * @param json the output of `docker compose config --format json`.
+ * @returns the pulled images by service name, or undefined when the text is not a compose model.
+ */
+export const imageReferencesInComposeModel = (json) => {
+    const model = parseJsonc(json).value;
+    if (!isRecord(model) || isArray(model) || !isRecord(model['services'])) {
+        return undefined;
+    }
+    return Object.entries(model['services'])
+        .flatMap(([service, definition]) => {
+        const image = asText(asRecord(definition)['image']);
+        const isBuilt = asRecord(definition)['build'] !== undefined;
+        return isBuilt || image.length === 0 ? [] : [{ service, image }];
+    })
+        .toSorted((one, other) => one.service.localeCompare(other.service));
+};
+/**
+ * Whether a reference still carries a variable nothing substituted, so no rule can say what it pulls.
+ * @param reference the reference as read.
+ * @returns true when a `$` remains in it.
+ */
+export const hasUnresolvedVariable = (reference) => reference.includes('$');
+//# sourceMappingURL=container-images.js.map

package/dist/container-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-images.js","sourceRoot":"","sources":["../src/container-images.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,6FAA6F;AAC7F,qFAAqF;AAErF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD,MAAM,YAAY,GAAW,UAAU,CAAA;AACvC,mGAAmG;AACnG,0FAA0F;AAC1F,MAAM,SAAS,GAAW,kCAAkC,CAAA;AAC5D,MAAM,QAAQ,GAAW,mDAAmD,CAAA;AAC5E,MAAM,QAAQ,GAAW,iCAAiC,CAAA;AAC1D,MAAM,YAAY,GAAW,UAAU,CAAA;AACvC,+EAA+E;AAC/E,MAAM,OAAO,GAAW,SAAS,CAAA;AACjC,MAAM,aAAa,GAAW,IAAI,CAAA;AAClC,MAAM,eAAe,GAAW,IAAI,CAAA;AAEpC,sGAAsG;AACtG,0EAA0E;AAC1E,MAAM,YAAY,GAAW,sEAAsE,CAAA;AACnG,MAAM,iBAAiB,GAAW,cAAc,CAAA;AAChD,oGAAoG;AACpG,8FAA8F;AAC9F,MAAM,gBAAgB,GAAW,OAAO,CAAA;AACxC,MAAM,aAAa,GAAW,GAAG,CAAA;AAEjC,MAAM,cAAc,GAAW,sDAAsD,CAAA;AACrF,MAAM,kBAAkB,GAAW,2CAA2C,CAAA;AAC9E,MAAM,sBAAsB,GAAW,+CAA+C,CAAA;AAEtF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC9D,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAEhD,MAAM,YAAY,GAAG,CAAC,IAAY,EAAqB,EAAE,CACvD,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAOhF,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAA0B,EAAE;IACpE,MAAM,MAAM,GAAsB,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,IAAI,EAAE;SACN,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,GAAoC,MAAM,CAAA;IACvE,MAAM,SAAS,GAAW,KAAK,IAAI,EAAE,CAAA;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AAC3F,CAAC,CAAA;AAED,qGAAqG;AACrG,wGAAwG;AACxG,mGAAmG;AACnG,MAAM,mBAAmB,GAAG,CAAC,SAAiB,EAAE,QAAqC,EAAU,EAAE,CAC/F,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAClB,CAAC,QAAgB,EAAE,CAAC,IAAI,EAAE,KAAK,CAA4B,EAAU,EAAE,CACrE,QAAQ;KACL,UAAU,CAAC,MAAM,IAAI,GAAG,EAAE,GAAW,EAAE,CAAC,KAAK,CAAC;KAC9C,UAAU,CAAC,IAAI,IAAI,EAAE,EAAE,GAAW,EAAE,CAAC,KAAK,CAAC,EAChD,SAAS,CACV,CAAA;AAQH,MAAM,cAAc,GAAG,CAAC,IAAoB,EAAE,IAAY,EAA8B,EAAE;IACxF,MAAM,KAAK,GAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAgC,IAAI,GAAG,CAAiB;QACpE,GAAG,IAAI,CAAC,QAAQ;QAChB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;KACzE,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAkB,EAAE;IACxE,MAAM,IAAI,GAA2B,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACrF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAW,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5E,MAAM,eAAe,GAAY,SAAS,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrF,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;KAChF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC7E,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CACvB,CAAC,IAAoB,EAAE,IAAY,EAAkB,EAAE,CACrD,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EACtD,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAkB,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CACnF,CAAC,UAAU,CAAA;AAEd,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAqB,EAAE;IAC/D,MAAM,IAAI,GAA2B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAClC,IAAI,EAAE;SACN,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SACxF,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC5E,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IAC7D,MAAM,IAAI,GAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;IACtE,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI;aACD,KAAK,CAAC,iBAAiB,CAAC;aACxB,OAAO,CAAC,CAAC,OAAe,EAAqB,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA;AAEJ,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC/D,MAAM,KAAK,GACT,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjG,MAAM,KAAK,GAAuB,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;IAC1D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;AACtE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,IAAY,EAAqB,EAAE,CAC3E,IAAI;KACD,KAAK,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC3D,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;IAC3C,MAAM,SAAS,GAAuB,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC/D,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAQN;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,IAAY,EACyB,EAAE;IACvC,MAAM,KAAK,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;SACrC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAA6B,EAA2B,EAAE;QACtF,MAAM,KAAK,GAAW,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAY,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAA;QACpE,OAAO,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC;SACD,QAAQ,CAAC,CAAC,GAAiB,EAAE,KAAmB,EAAU,EAAE,CAC3D,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CACzC,CAAA;AACL,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA"}

package/dist/dependency-freshness.d.ts

@@ -53,6 +53,14 @@ export interface DeclaredCoordinate {
 export interface DependencyStatus extends DeclaredCoordinate {
     /** The latest version published to the registry. */
     readonly latest: string;
+    /**
+     * The licence the registry records for that latest version, when it records one.
+     *
+     * Carried so the blocklist can keep the bound from demanding an upgrade into a release the licence
+     * gate would refuse: a package that changed licence at its newest major is still measured, but never
+     * past the last release a project may install.
+     */
+    readonly latestLicense?: string;
 }
 /** One parsed manifest, with the path a finding will name. */
 export interface ManifestSource {

package/dist/dependency-freshness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-freshness.d.ts","sourceRoot":"","sources":["../src/dependency-freshness.ts"],"names":[],"mappings":"AAqBA,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEvD,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAQD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,aAAa,GAAG,SAW1D,CAAA;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,gBAUnE,CAAA;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAClF,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAA;CACjD;AA6BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,GAAG,SAAS,EACzB,UAAU,gBAAgB,KACzB,SAAS,MAAM,EACkE,CAAA;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,SAAS,cAAc,EAAE,KACnC,SAAS,kBAAkB,EAU3B,CAAA;AAEH,gGAAgG;AAChG,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAA;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAYD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,eAiB/E,CAAA"}
+{"version":3,"file":"dependency-freshness.d.ts","sourceRoot":"","sources":["../src/dependency-freshness.ts"],"names":[],"mappings":"AAKA,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEvD,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAQD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,aAAa,GAAG,SAW1D,CAAA;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,gBAUnE,CAAA;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAClF,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAA;CACjD;AA6BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,GAAG,SAAS,EACzB,UAAU,gBAAgB,KACzB,SAAS,MAAM,EACkE,CAAA;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,SAAS,cAAc,EAAE,KACnC,SAAS,kBAAkB,EAU3B,CAAA;AAEH,gGAAgG;AAChG,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAA;CACpC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAYD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,eAiB/E,CAAA"}

package/dist/dependency-freshness.js

@@ -1,22 +1,6 @@
-// Dependency-freshness policy: the pure, unit-tested logic that reads the coordinates a repository
-// declares and classifies how far each has drifted from its latest published release. The `deps` gate in
-// packages/cli/src/checks/dependencies.ts reads the manifests and asks the registry.
-//
-// Policy: a declared dependency (transitive deps never count) whose current major version is
-// MAJOR_FAIL_THRESHOLD or more behind the latest published major FAILS the build; any lesser lag (a
-// single major behind, or a minor/patch behind) appears in the non-failing update report. The Biome config `$schema`
-// URL version is fed through the same classifier as a pseudo-dependency. There is no exemption list:
-// every declared dependency is MEASURED against the same bar, so a deliberately old pin that falls two
-// majors behind must be bumped or the pin dropped.
-//
-// One thing the bar does not decide is who the build stops. A coordinate an INHERITED manifest declares
-// is measured identically and reported at its real verdict, and it never fails the build: the version
-// belongs to ploaness, the project has no file in which to change it, and a gate that stopped every
-// consumer at once over a pin none of them can edit would be reporting ploaness's defect as theirs.
-// That is a statement about whose repair it is rather than an exemption from the measurement, which is
-// why the verdict survives into the report instead of being softened into an ordinary update.
+// Compare declared coordinates with stable releases and apply the fixed major-version freshness bound.
+import { isHarnessPackage } from './harness-package.js';
 import { declaredDependencies } from './json-shapes.js';
-import { isHarnessPackage } from './version-policy.js';
 /** Major-version gap (`latest.major - current.major`) at or above which the gate FAILS the build. */
 export const MAJOR_FAIL_THRESHOLD = 2;
 // A leading range operator (`^ ~ >= <= = v`) or whitespace is tolerated, then the numeric core is

package/dist/dependency-freshness.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-freshness.js","sourceRoot":"","sources":["../src/dependency-freshness.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,yGAAyG;AACzG,qFAAqF;AACrF,EAAE;AACF,6FAA6F;AAC7F,oGAAoG;AACpG,qHAAqH;AACrH,qGAAqG;AACrG,uGAAuG;AACvG,mDAAmD;AACnD,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,oGAAoG;AACpG,oGAAoG;AACpG,uGAAuG;AACvG,8FAA8F;AAE9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAKtD,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAA;AAU7C,kGAAkG;AAClG,kGAAkG;AAClG,qGAAqG;AACrG,oEAAoE;AACpE,MAAM,eAAe,GAAW,0DAA0D,CAAA;AAE1F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAA6B,EAAE;IACrE,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KAC3B,CAAA;AACH,CAAC,CAAA;AAED,qGAAqG;AACrG,wDAAwD;AACxD,MAAM,WAAW,GAAG,CAAC,IAAmB,EAAE,KAAoB,EAAU,EAAE;IACxE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,MAAc,EAAoB,EAAE;IACrF,MAAM,cAAc,GAA8B,YAAY,CAAC,OAAO,CAAC,CAAA;IACvE,MAAM,aAAa,GAA8B,YAAY,CAAC,MAAM,CAAC,CAAA;IACrE,IAAI,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,GAAG,cAAc,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACvE,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;AACzE,CAAC,CAAA;AAuDD,MAAM,QAAQ,GAAG,CACf,IAAiB,EACjB,YAAgC,EAChC,QAA0B,EACb,EAAE;IACf,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;KAC7C,CAAA;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;SACzD,MAAM,CACL,CAAC,OAAoB,EAAE,IAAY,EAAe,EAAE,CAClD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,EAClE,OAAO,CACR,CAAA;AACL,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAAyB,EACzB,QAA0B,EACP,EAAE,CACrB,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAA;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAoC,EACL,EAAE,CACjC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAwB,EAAiC,EAAE,CAC5E,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAsB,EAAE,CAAC,CAAC;IACnE,IAAI;IACJ,KAAK,EAAE,QAAQ,CAAC,IAAI;IACpB,OAAO;IACP,WAAW,EAAE,QAAQ,CAAC,WAAW;CAClC,CAAC,CACH,CACF,CAAA;AAyBH,oGAAoG;AACpG,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,CAAC,KAAmB,EAAW,EAAE,CACxD,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAA;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAqC,EAAmB,EAAE;IAChG,mGAAmG;IACnG,0CAA0C;IAC1C,MAAM,MAAM,GAA4B,QAAQ,CAAC,GAAG,CAClD,CAAC,MAAwB,EAAgB,EAAE,CAAC,CAAC;QAC3C,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;KAC1D,CAAC,CACH,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,OAAgC,EAA+B,EAAE,CACnF,OAAO,CAAC,OAAO,CAAC,CAAC,KAAmB,EAA+B,EAAE,CACnE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC5E,CAAA;IACH,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9F,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;KAChG,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"dependency-freshness.js","sourceRoot":"","sources":["../src/dependency-freshness.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAEvG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAKvD,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAA;AAU7C,kGAAkG;AAClG,kGAAkG;AAClG,qGAAqG;AACrG,oEAAoE;AACpE,MAAM,eAAe,GAAW,0DAA0D,CAAA;AAE1F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAA6B,EAAE;IACrE,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KAC3B,CAAA;AACH,CAAC,CAAA;AAED,qGAAqG;AACrG,wDAAwD;AACxD,MAAM,WAAW,GAAG,CAAC,IAAmB,EAAE,KAAoB,EAAU,EAAE;IACxE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,MAAc,EAAoB,EAAE;IACrF,MAAM,cAAc,GAA8B,YAAY,CAAC,OAAO,CAAC,CAAA;IACvE,MAAM,aAAa,GAA8B,YAAY,CAAC,MAAM,CAAC,CAAA;IACrE,IAAI,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,GAAG,cAAc,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACvE,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;AACzE,CAAC,CAAA;AA+DD,MAAM,QAAQ,GAAG,CACf,IAAiB,EACjB,YAAgC,EAChC,QAA0B,EACb,EAAE;IACf,IAAI,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAgB;QAC3B,OAAO,EAAE,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;KAC7C,CAAA;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;SACzD,MAAM,CACL,CAAC,OAAoB,EAAE,IAAY,EAAe,EAAE,CAClD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,EAClE,OAAO,CACR,CAAA;AACL,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAAyB,EACzB,QAA0B,EACP,EAAE,CACrB,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,EAAU,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAA;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAAoC,EACL,EAAE,CACjC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAwB,EAAiC,EAAE,CAC5E,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,CAAC,IAAI,EAAE,OAAO,CAA4B,EAAsB,EAAE,CAAC,CAAC;IACnE,IAAI;IACJ,KAAK,EAAE,QAAQ,CAAC,IAAI;IACpB,OAAO;IACP,WAAW,EAAE,QAAQ,CAAC,WAAW;CAClC,CAAC,CACH,CACF,CAAA;AAyBH,oGAAoG;AACpG,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,CAAC,KAAmB,EAAW,EAAE,CACxD,KAAK,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAA;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAqC,EAAmB,EAAE;IAChG,mGAAmG;IACnG,0CAA0C;IAC1C,MAAM,MAAM,GAA4B,QAAQ,CAAC,GAAG,CAClD,CAAC,MAAwB,EAAgB,EAAE,CAAC,CAAC;QAC3C,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;KAC1D,CAAC,CACH,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,OAAgC,EAA+B,EAAE,CACnF,OAAO,CAAC,OAAO,CAAC,CAAC,KAAmB,EAA+B,EAAE,CACnE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC5E,CAAA;IACH,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9F,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;KAChG,CAAA;AACH,CAAC,CAAA"}

package/dist/doc-blocks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doc-blocks.d.ts","sourceRoot":"","sources":["../src/doc-blocks.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQlD,CAAA;AAWD,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAkDD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,SAAS,QAAQ,EAKrE,CAAA"}
+{"version":3,"file":"doc-blocks.d.ts","sourceRoot":"","sources":["../src/doc-blocks.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAQlD,CAAA;AAWD,8EAA8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAkDD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,SAAS,QAAQ,EAKrE,CAAA"}

package/dist/doc-blocks.js

@@ -1,16 +1,4 @@
-// Orphaned documenting comments: a `/** ... */` block whose next non-blank line opens ANOTHER such
-// block, so the first documents nothing and the symbol it was written for carries no doc at all.
-//
-// This cannot be an eslint-plugin-jsdoc rule, and the reason is structural rather than a gap in that
-// plugin. Every rule it ships visits the block ATTACHED to a syntax node, and an orphan is attached to
-// nothing: the parser hands a declaration only the LAST block comment before it and discards the
-// earlier ones as leading trivia. The defect is invisible to the one analyzer that exists for
-// documenting comments, which is why it is a text rule here - the text is the only place it is still
-// visible.
-//
-// It is a real class rather than a hypothetical. Four instances were found in this repository the
-// first time anything looked, each one a doc that had been moved above the wrong symbol and left
-// there, and each one carried the description of a symbol that was then undocumented.
+// Report documenting blocks detached from a declaration by another documenting block.
 // Extensions whose comment syntax this rule understands. A stylesheet shares the delimiters but has
 // no JSDoc, so two adjacent blocks there are two comments rather than one orphan - which is why this
 // list is narrower than CODE_EXTENSIONS.

package/dist/doc-blocks.js.map

@@ -1 +1 @@
-{"version":3,"file":"doc-blocks.js","sourceRoot":"","sources":["../src/doc-blocks.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,qGAAqG;AACrG,uGAAuG;AACvG,iGAAiG;AACjG,8FAA8F;AAC9F,qGAAqG;AACrG,WAAW;AACX,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,sFAAsF;AAEtF,oGAAoG;AACpG,qGAAqG;AACrG,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;CACP,CAAA;AAED,MAAM,QAAQ,GAAW,KAAK,CAAA;AAC9B,MAAM,WAAW,GAAW,IAAI,CAAA;AAEhC,qGAAqG;AACrG,MAAM,aAAa,GAAW,CAAC,CAAC,CAAA;AAEhC,uEAAuE;AACvE,MAAM,UAAU,GAAW,CAAC,CAAA;AAa5B,MAAM,UAAU,GAAc,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAEjE,iGAAiG;AACjG,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAW,EAAE,CACrD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEtD,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,OAAe,EAAE,IAAY,EAAa,EAAE;IACnF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,OAAe,EAAE,IAAY,EAAa,EAAE,CACnF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACzF,CAAC,CAAC,KAAK,CAAA;AAEX,uGAAuG;AACvG,sGAAsG;AACtG,0EAA0E;AAC1E,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAuB,EAAE,CAClE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAgB,EAAE,GAAW,EAAE,KAAa,EAAa,EAAE;IACvE,MAAM,OAAO,GAAW,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,IAAI,GAAW,KAAK,GAAG,UAAU,CAAA;IACvC,OAAO,KAAK,CAAC,IAAI,KAAK,aAAa;QACjC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACrC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,CAAA;AAEvB,qGAAqG;AACrG,uGAAuG;AACvG,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,CAAC,KAAwB,EAAE,OAAe,EAAW,EAAE;IAC/E,MAAM,IAAI,GAAuB,KAAK;SACnC,KAAK,CAAC,OAAO,CAAC;SACd,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AACtD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAuB,EAAE;IACzE,MAAM,KAAK,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1E,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAe,EAAW,EAAE,CAC1D,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CACxC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"doc-blocks.js","sourceRoot":"","sources":["../src/doc-blocks.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,oGAAoG;AACpG,qGAAqG;AACrG,yCAAyC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;CACP,CAAA;AAED,MAAM,QAAQ,GAAW,KAAK,CAAA;AAC9B,MAAM,WAAW,GAAW,IAAI,CAAA;AAEhC,qGAAqG;AACrG,MAAM,aAAa,GAAW,CAAC,CAAC,CAAA;AAEhC,uEAAuE;AACvE,MAAM,UAAU,GAAW,CAAC,CAAA;AAa5B,MAAM,UAAU,GAAc,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAEjE,iGAAiG;AACjG,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAW,EAAE,CACrD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEtD,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,OAAe,EAAE,IAAY,EAAa,EAAE;IACnF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;QAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAgB,EAAE,OAAe,EAAE,IAAY,EAAa,EAAE,CACnF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE;IACzF,CAAC,CAAC,KAAK,CAAA;AAEX,uGAAuG;AACvG,sGAAsG;AACtG,0EAA0E;AAC1E,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAuB,EAAE,CAClE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAgB,EAAE,GAAW,EAAE,KAAa,EAAa,EAAE;IACvE,MAAM,OAAO,GAAW,GAAG,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,IAAI,GAAW,KAAK,GAAG,UAAU,CAAA;IACvC,OAAO,KAAK,CAAC,IAAI,KAAK,aAAa;QACjC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACrC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACzC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,CAAA;AAEvB,qGAAqG;AACrG,uGAAuG;AACvG,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,CAAC,KAAwB,EAAE,OAAe,EAAW,EAAE;IAC/E,MAAM,IAAI,GAAuB,KAAK;SACnC,KAAK,CAAC,OAAO,CAAC;SACd,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AACtD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAuB,EAAE;IACzE,MAAM,KAAK,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1E,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAe,EAAW,EAAE,CAC1D,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CACxC,CAAA;AACH,CAAC,CAAA"}

package/dist/editorconfig-policy.d.ts

@@ -13,6 +13,13 @@ export interface EditorconfigViolation {
     readonly reason: string;
 }
 export declare const parseEditorconfig: (text: string) => EditorconfigRules;
+/**
+ * Decide whether the standard's line cap binds for one file.
+ * @param filePath the repo-relative path.
+ * @param generatedArtefacts the globs the project declares generated.
+ * @returns true for an authored code file; false for prose and for generated output.
+ */
+export declare const isLineCapEnforced: (filePath: string, generatedArtefacts: readonly string[]) => boolean;
 /**
  * Check one file against the committed configuration.
  * @param content the file's decoded content.

package/dist/editorconfig-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"editorconfig-policy.d.ts","sourceRoot":"","sources":["../src/editorconfig-policy.ts"],"names":[],"mappings":"AAaA,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAE,MAAY,CAAA;AAE1C,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA8BD,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,iBAqBhD,CAAA;AA2CD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,EACf,OAAO,iBAAiB,EACxB,sBAAsB,OAAO,KAC5B,SAAS,qBAAqB,EAgBhC,CAAA"}
+{"version":3,"file":"editorconfig-policy.d.ts","sourceRoot":"","sources":["../src/editorconfig-policy.ts"],"names":[],"mappings":"AAIA,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAE,MAAY,CAAA;AAE1C,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA8BD,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,iBAqBhD,CAAA;AA2CD;;;;;GAKG;AAUH,eAAO,MAAM,iBAAiB,GAC5B,UAAU,MAAM,EAChB,oBAAoB,SAAS,MAAM,EAAE,KACpC,OAEqF,CAAA;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GACrC,SAAS,MAAM,EACf,OAAO,iBAAiB,EACxB,sBAAsB,OAAO,KAC5B,SAAS,qBAAqB,EAgBhC,CAAA"}