@ploaness/governance 1.5.0 → 1.7.0

package/dist/release-age.js

@@ -7,9 +7,7 @@ export const RELEASE_AGE_FLOOR_HOURS = 24;
  * @param age the publication instant and the instant to measure it against.
  * @returns the floored hours, or `undefined` when the publication instant is unknown.
  */
-export const hoursPublished = (age) => age.publishedAt === undefined
-    ? undefined
-    : Math.floor((age.now - age.publishedAt) / MILLISECONDS_PER_HOUR);
+export const hoursPublished = (age) => age.publishedAt === undefined ? undefined : Math.floor((age.now - age.publishedAt) / MILLISECONDS_PER_HOUR);
 /**
  * Whether pnpm would refuse this release for being younger than the floor.
  * @param age the publication instant and the instant to measure it against.

package/dist/release-age.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-age.js","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,MAAM,qBAAqB,GAAW,SAAS,CAAA;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAW,EAAE,CAAA;AAUjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAsB,EAAE,CACpE,GAAG,CAAC,WAAW,KAAK,SAAS;IAC3B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,qBAAqB,CAAC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAe,EAAW,EAAE;IAC7D,MAAM,KAAK,GAAuB,cAAc,CAAC,GAAG,CAAC,CAAA;IACrD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,uBAAuB,CAAA;AAC/D,CAAC,CAAA"}
+{"version":3,"file":"release-age.js","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,MAAM,qBAAqB,GAAW,SAAS,CAAA;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAW,EAAE,CAAA;AAUjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAsB,EAAE,CACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,qBAAqB,CAAC,CAAA;AAE7G;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAe,EAAW,EAAE;IAC7D,MAAM,KAAK,GAAuB,cAAc,CAAC,GAAG,CAAC,CAAA;IACrD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,uBAAuB,CAAA;AAC/D,CAAC,CAAA"}

package/dist/route-coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-coverage.d.ts","sourceRoot":"","sources":["../src/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiD,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAAE,KAAK,aAAa,EAAgC,MAAM,gBAAgB,CAAA;AAqBjF,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAA;IACjD,mDAAmD;IACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,UAAU,EAAE,CAAA;CAC1C;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA4DD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,SAAS,YAAY,EAMvE,CAAA"}
+{"version":3,"file":"route-coverage.d.ts","sourceRoot":"","sources":["../src/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrH,OAAO,EAAE,KAAK,aAAa,EAAgC,MAAM,gBAAgB,CAAA;AAqBjF,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAA;IACjD,mDAAmD;IACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,UAAU,EAAE,CAAA;CAC1C;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAuED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,SAAS,YAAY,EAMvE,CAAA"}

package/dist/route-coverage.js

@@ -1,7 +1,8 @@
-import { containsBuiltRoute, containsRoute, reachesAxe } from './axe-coverage.js';
+import { containsBuiltRoute, containsRoute, reachesAxe, reachesLayoutScan } from './axe-coverage.js';
 import { matchesRoute, staticPrefixOf } from './route-map.js';
-const REMEDIES = 'link it from a page the crawl reaches, scan it in a specification of your own with axe, or ' +
-    'declare it in `ploaness.accessibilitySkipRoutes` with the reason it is out of scope';
+const REMEDIES = 'link it from a page the crawl reaches, scan it in a specification of your own with ' +
+    '`expectSweptPage(page)` from `ploaness/a11y`, or declare it in `ploaness.accessibilitySkipRoutes` ' +
+    'with the reason it is out of scope';
 // The same plain prefix test the crawl itself applies in `toRoute`, deliberately. A stricter one -
 // requiring the prefix to end on a segment boundary - would report a route the crawl was told to skip
 // and did skip, which is a finding about the harness disagreeing with itself.
@@ -31,9 +32,8 @@ const unsweptRoute = (sweep, route) => {
             },
         ];
     }
-    return driving.some((spec) => reachesAxe(spec, sweep.everyFile))
-        ? []
-        : [
+    if (!driving.some((spec) => reachesAxe(spec, sweep.everyFile))) {
+        return [
             {
                 file: route.file,
                 route: route.route,
@@ -42,6 +42,18 @@ const unsweptRoute = (sweep, route) => {
                     `nothing scans it with axe, so this page has no accessibility coverage: ${REMEDIES}`,
             },
         ];
+    }
+    return driving.some((spec) => reachesLayoutScan(spec, sweep.everyFile))
+        ? []
+        : [
+            {
+                file: route.file,
+                route: route.route,
+                rule: 'route-unmeasured',
+                reason: `the sweep never reached "${route.route}". A specification scans it with axe but ` +
+                    `nothing measures its layout, so this page has no layout coverage: ${REMEDIES}`,
+            },
+        ];
 };
 /**
  * The declared pages the sweep did not cover and nothing else scans.

package/dist/route-coverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-coverage.js","sourceRoot":"","sources":["../src/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAmB,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAAsB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAyCjF,MAAM,QAAQ,GACZ,6FAA6F;IAC7F,qFAAqF,CAAA;AAEvF,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAW,EAAE,CACxE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAEtE,sGAAsG;AACtG,sGAAsG;AACtG,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAW,EAAE,CACtE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7F,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AAE7F,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAW,EAAE,CACrE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AAE5F,qGAAqG;AACrG,uGAAuG;AACvG,sFAAsF;AACtF,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,KAAoB,EAAW,EAAE,CACrE,KAAK,CAAC,SAAS;IACb,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;AAE7C,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAkB,EAAE;IAC/E,MAAM,OAAO,GAA0B,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CACtF,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CACxB,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,eAAe;gBACrB,MAAM,EACJ,0CAA0C,KAAK,CAAC,KAAK,oCAAoC;oBACzF,8DAA8D,QAAQ,EAAE;aAC3E;SACF,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACnF,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EACJ,0CAA0C,KAAK,CAAC,KAAK,mCAAmC;oBACxF,0EAA0E,QAAQ,EAAE;aACvF;SACF,CAAA;AACP,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAiB,EAA2B,EAAE,CAC9E,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAoB,EAAkB,EAAE;IACpE,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACnE,CAAC,CAAC,CAAA"}
+{"version":3,"file":"route-coverage.js","sourceRoot":"","sources":["../src/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAmB,MAAM,mBAAmB,CAAA;AACrH,OAAO,EAAsB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAyCjF,MAAM,QAAQ,GACZ,qFAAqF;IACrF,oGAAoG;IACpG,oCAAoC,CAAA;AAEtC,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAW,EAAE,CACxE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAEtE,sGAAsG;AACtG,sGAAsG;AACtG,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAW,EAAE,CACtE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7F,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AAE7F,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAW,EAAE,CACrE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AAE5F,qGAAqG;AACrG,uGAAuG;AACvG,sFAAsF;AACtF,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,KAAoB,EAAW,EAAE,CACrE,KAAK,CAAC,SAAS;IACb,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;AAE7C,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAkB,EAAE;IAC/E,MAAM,OAAO,GAA0B,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACjH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,eAAe;gBACrB,MAAM,EACJ,0CAA0C,KAAK,CAAC,KAAK,oCAAoC;oBACzF,8DAA8D,QAAQ,EAAE;aAC3E;SACF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO;YACL;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EACJ,0CAA0C,KAAK,CAAC,KAAK,mCAAmC;oBACxF,0EAA0E,QAAQ,EAAE;aACvF;SACF,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1F,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EACJ,4BAA4B,KAAK,CAAC,KAAK,2CAA2C;oBAClF,qEAAqE,QAAQ,EAAE;aAClF;SACF,CAAA;AACP,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAiB,EAA2B,EAAE,CAC9E,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAoB,EAAkB,EAAE;IACpE,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACnE,CAAC,CAAC,CAAA"}

package/dist/route-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-map.d.ts","sourceRoot":"","sources":["../src/route-map.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AA8CD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAG3D,CAAA;AAyBH;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MACoC,CAAA;AAEpF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,aAAa,GAAG,SAsB9D,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAC3B,OAAO,SAAS,MAAM,EAAE,EACxB,SAAS,MAAM,KACd,SAAS,aAAa,EAaxB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAK9C,CAAA;AAkCD;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,OACL,CAAA"}
+{"version":3,"file":"route-map.d.ts","sourceRoot":"","sources":["../src/route-map.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAiCD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAC8C,CAAA;AAuB5G;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MACoC,CAAA;AAEpF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,aAAa,GAAG,SAiB9D,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,SAAS,MAAM,EAAE,EAAE,SAAS,MAAM,KAAG,SAAS,aAAa,EAalG,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAK9C,CAAA;AAiCD;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,OACL,CAAA"}

package/dist/route-map.js

@@ -1,21 +1,10 @@
 // Map Next.js route files to URL patterns for comparison with actual crawl results.
 // Next.js reads a page from any of these; `pageExtensions` can add more, which is one of the reasons
 // the module comment above declines to guess at a configured project.
-const PAGE_FILES = new Set([
-    'page.tsx',
-    'page.ts',
-    'page.jsx',
-    'page.js',
-    'page.mdx',
-]);
+const PAGE_FILES = new Set(['page.tsx', 'page.ts', 'page.jsx', 'page.js', 'page.mdx']);
 // A root layout is required of a Next.js application and of nothing else, so it is what tells an app
 // directory apart from a directory that happens to be called `app`.
-const ROOT_LAYOUTS = new Set([
-    'layout.tsx',
-    'layout.ts',
-    'layout.jsx',
-    'layout.js',
-]);
+const ROOT_LAYOUTS = new Set(['layout.tsx', 'layout.ts', 'layout.jsx', 'layout.js']);
 // `src/app` first, because that is where a Payload application puts it and where a stray top-level
 // `app/` is least likely to be mistaken for one.
 const APP_ROOTS = ['src/app', 'app'];
@@ -87,9 +76,7 @@ export const declaredRouteOf = (file) => {
     const addressed = directories.filter((segment) => !(isRouteGroup(segment) || isParallelSlot(segment)));
     return {
         file,
-        route: addressed.length === 0
-            ? ROOT_ROUTE
-            : `${SEGMENT_SEPARATOR}${addressed.join(SEGMENT_SEPARATOR)}`,
+        route: addressed.length === 0 ? ROOT_ROUTE : `${SEGMENT_SEPARATOR}${addressed.join(SEGMENT_SEPARATOR)}`,
         isDynamic: addressed.some((segment) => isDynamicSegment(segment)),
     };
 };

package/dist/route-map.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-map.js","sourceRoot":"","sources":["../src/route-map.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAYpF,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAS;IACtD,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC,CAAA;AAEF,qGAAqG;AACrG,oEAAoE;AACpE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS;IACxD,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;CACZ,CAAC,CAAA;AAEF,mGAAmG;AACnG,iDAAiD;AACjD,MAAM,SAAS,GAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AAEvD,MAAM,UAAU,GAAW,GAAG,CAAA;AAE9B,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAErC,sGAAsG;AACtG,uGAAuG;AACvG,kGAAkG;AAClG,qGAAqG;AACrG,mFAAmF;AACnF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;IAC3D,MAAM,MAAM,GAAW,GAAG,IAAI,GAAG,iBAAiB,EAAE,CAAA;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACtF,MAAM,SAAS,GAAsB,QAAQ,CAAC,MAAM,CAClD,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CACrD,CAAA;IACD,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAsB,EAAE,CACxE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CACvC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAChE,CAAA;AAEH,sGAAsG;AACtG,uGAAuG;AACvG,qEAAqE;AACrE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEnG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,yCAAyC;AACzC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAClD,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEnD,iGAAiG;AACjG,uGAAuG;AACvG,oGAAoG;AACpG,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAE5E,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAEvE,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAW,EAAE,CACpD,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CACvD,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAA6B,EAAE;IACzE,MAAM,KAAK,GAAsB,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,WAAW,GAAsB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzD,IACE,WAAW,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,EAC7F,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAsB,WAAW,CAAC,MAAM,CACrD,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAClF,CAAA;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EACH,SAAS,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,GAAG,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;QAChE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;KACnF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAwB,EACxB,OAAe,EACW,EAAE;IAC5B,MAAM,MAAM,GAAW,GAAG,OAAO,GAAG,iBAAiB,EAAE,CAAA;IACvD,MAAM,QAAQ,GAA6B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAmB,EAAE;QACzF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAA8B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACnF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,KAAoB,EAAE,KAAa,EAAW,EAAE,CAC/C,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAoB,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAC/F,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE;IACtD,MAAM,QAAQ,GAAsB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAW,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IAChG,MAAM,IAAI,GAAsB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAChF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAA;AAC/F,CAAC,CAAA;AAED,uGAAuG;AACvG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAqB,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC;KACnB,KAAK,CAAC,iBAAiB,CAAC;KACxB,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;AAEzD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEpG,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAW,EAAE,CACtD,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAEvD,uGAAuG;AACvG,oGAAoG;AACpG,sGAAsG;AACtG,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAE,MAAyB,EAAW,EAAE;IACzF,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAe,EAAW,EAAE,CACtE,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"route-map.js","sourceRoot":"","sources":["../src/route-map.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAYpF,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAS,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;AAEnH,qGAAqG;AACrG,oEAAoE;AACpE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAS,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAA;AAEjH,mGAAmG;AACnG,iDAAiD;AACjD,MAAM,SAAS,GAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AAEvD,MAAM,UAAU,GAAW,GAAG,CAAA;AAE9B,MAAM,iBAAiB,GAAW,GAAG,CAAA;AAErC,sGAAsG;AACtG,uGAAuG;AACvG,kGAAkG;AAClG,qGAAqG;AACrG,mFAAmF;AACnF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;IAC3D,MAAM,MAAM,GAAW,GAAG,IAAI,GAAG,iBAAiB,EAAE,CAAA;IACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACtF,MAAM,SAAS,GAAsB,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1G,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAsB,EAAE,CACxE,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAE5G,sGAAsG;AACtG,uGAAuG;AACvG,qEAAqE;AACrE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEnG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,yCAAyC;AACzC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEtG,iGAAiG;AACjG,uGAAuG;AACvG,oGAAoG;AACpG,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAE5E,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAEvE,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEvG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CACvD,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAA6B,EAAE;IACzE,MAAM,KAAK,GAAsB,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,WAAW,GAAsB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAsB,WAAW,CAAC,MAAM,CACrD,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAClF,CAAA;IACD,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvG,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;KACnF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAwB,EAAE,OAAe,EAA4B,EAAE;IACtG,MAAM,MAAM,GAAW,GAAG,OAAO,GAAG,iBAAiB,EAAE,CAAA;IACvD,MAAM,QAAQ,GAA6B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAmB,EAAE;QACzF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAA8B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACnF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,KAAoB,EAAE,KAAa,EAAW,EAAE,CAC/C,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAoB,EAAW,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAC/F,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE;IACtD,MAAM,QAAQ,GAAsB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAW,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;IAChG,MAAM,IAAI,GAAsB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAChF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAA;AAC/F,CAAC,CAAA;AAED,uGAAuG;AACvG,kFAAkF;AAClF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAqB,EAAE,CACtD,eAAe,CAAC,KAAK,CAAC;KACnB,KAAK,CAAC,iBAAiB,CAAC;KACxB,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;AAEzD,MAAM,UAAU,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAEpG,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAE9G,uGAAuG;AACvG,oGAAoG;AACpG,sGAAsG;AACtG,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAE,MAAyB,EAAW,EAAE;IACzF,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAe,EAAW,EAAE,CACtE,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/dist/run-plan.d.ts

@@ -17,6 +17,10 @@ export interface PlanStep {
     /** The member's path, or undefined for a repository-scope gate. */
     readonly member: string | undefined;
 }
+/** Record only a successful build of the particular member in this invocation. */
+export declare const recordBuildSuccess: (built: ReadonlySet<string>, step: PlanStep, isSuccess: boolean) => ReadonlySet<string>;
+/** Report-only execution must not test an old artifact after the current build failed. */
+export declare const canRunBuiltBrowser: (step: PlanStep, isRuntime: boolean, built: ReadonlySet<string>) => boolean;
 /**
  * Expand the gate registry into the ordered invocations one run performs.
  *

package/dist/run-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-plan.d.ts","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAEA,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE5D,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAuBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GACpB,OAAO,SAAS,cAAc,EAAE,EAChC,SAAS,SAAS,gBAAgB,EAAE,EACpC,YAAY,OAAO,KAClB,SAAS,QAAQ,EAGgE,CAAA"}
+{"version":3,"file":"run-plan.d.ts","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAEA,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;AAE5D,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAED,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,GAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,EAC1B,MAAM,QAAQ,EACd,WAAW,OAAO,KACjB,WAAW,CAAC,MAAM,CACyF,CAAA;AAE9G,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,GAAI,MAAM,QAAQ,EAAE,WAAW,OAAO,EAAE,OAAO,WAAW,CAAC,MAAM,CAAC,KAAG,OACN,CAAA;AAa9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GACpB,OAAO,SAAS,cAAc,EAAE,EAChC,SAAS,SAAS,gBAAgB,EAAE,EACpC,YAAY,OAAO,KAClB,SAAS,QAAQ,EAGgE,CAAA"}

package/dist/run-plan.js

@@ -1,10 +1,12 @@
 // Expand gates in registry order across their applicable members; tree verification remains last.
+/** Record only a successful build of the particular member in this invocation. */
+export const recordBuildSuccess = (built, step, isSuccess) => isSuccess && step.gateId === 'build' && step.member !== undefined ? new Set([...built, step.member]) : built;
+/** Report-only execution must not test an old artifact after the current build failed. */
+export const canRunBuiltBrowser = (step, isRuntime, built) => !isRuntime || step.gateId !== 'e2e' || (step.member !== undefined && built.has(step.member));
 // A package-scope gate asks about every member; a payload-scope gate asks only about the members that
 // are Payload applications. Derived from what the member declares rather than from anything it opts
 // into, so a project cannot silence the Payload rules by describing itself differently.
-const membersFor = (gate, members) => gate.scope === 'payload'
-    ? members.filter((member) => member.isPayload)
-    : members;
+const membersFor = (gate, members) => gate.scope === 'payload' ? members.filter((member) => member.isPayload) : members;
 const stepsFor = (gate, members) => gate.scope === 'repository'
     ? [{ gateId: gate.id, member: undefined }]
     : membersFor(gate, members).map((member) => ({ gateId: gate.id, member: member.path }));

package/dist/run-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-plan.js","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAyBlG,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AACxF,MAAM,UAAU,GAAG,CACjB,IAAoB,EACpB,OAAoC,EACP,EAAE,CAC/B,IAAI,CAAC,KAAK,KAAK,SAAS;IACtB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;IACzE,CAAC,CAAC,OAAO,CAAA;AAEb,MAAM,QAAQ,GAAG,CACf,IAAoB,EACpB,OAAoC,EACf,EAAE,CACvB,IAAI,CAAC,KAAK,KAAK,YAAY;IACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAC3B,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CACnF,CAAA;AAEP;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAgC,EAChC,OAAoC,EACpC,UAAmB,EACE,EAAE,CACvB,KAAK;KACF,MAAM,CAAC,CAAC,IAAoB,EAAW,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KACzE,OAAO,CAAC,CAAC,IAAoB,EAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"run-plan.js","sourceRoot":"","sources":["../src/run-plan.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAyBlG,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAA0B,EAC1B,IAAc,EACd,SAAkB,EACG,EAAE,CACvB,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAE9G,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAc,EAAE,SAAkB,EAAE,KAA0B,EAAW,EAAE,CAC5G,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAE9F,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AACxF,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAE,OAAoC,EAA+B,EAAE,CAC7G,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAwB,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAE9G,MAAM,QAAQ,GAAG,CAAC,IAAoB,EAAE,OAAoC,EAAuB,EAAE,CACnG,IAAI,CAAC,KAAK,KAAK,YAAY;IACzB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAwB,EAAY,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAEvH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAgC,EAChC,OAAoC,EACpC,UAAmB,EACE,EAAE,CACvB,KAAK;KACF,MAAM,CAAC,CAAC,IAAoB,EAAW,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;KACzE,OAAO,CAAC,CAAC,IAAoB,EAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA"}

package/dist/run-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-policy.d.ts","sourceRoot":"","sources":["../src/run-policy.ts"],"names":[],"mappings":"AAcA,0DAA0D;AAC1D,MAAM,WAAW,QAAQ;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,QAAQ,KAAG,OACqB,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAC5B,cAAc,SAAS,MAAM,EAAE,EAC/B,aAAa,SAAS,MAAM,EAAE,EAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,KACpC,OAKA,CAAA"}
+{"version":3,"file":"run-policy.d.ts","sourceRoot":"","sources":["../src/run-policy.ts"],"names":[],"mappings":"AAcA,0DAA0D;AAC1D,MAAM,WAAW,QAAQ;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,QAAQ,KAAG,OAAwE,CAAA;AAElH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAC5B,cAAc,SAAS,MAAM,EAAE,EAC/B,aAAa,SAAS,MAAM,EAAE,EAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,KACpC,OAIA,CAAA"}

package/dist/run-policy.js

@@ -32,6 +32,5 @@ export const endsRun = (point) => point.isFailure && (point.isEnforced || point.
  * @param isCode whether a path is a code file.
  * @returns true when at least one code file sits under a declared source root.
  */
-export const carriesSourceCode = (trackedPaths, sourceRoots, isCode) => trackedPaths.some((filePath) => isCode(filePath) &&
-    sourceRoots.some((root) => filePath.startsWith(`${root}/`)));
+export const carriesSourceCode = (trackedPaths, sourceRoots, isCode) => trackedPaths.some((filePath) => isCode(filePath) && sourceRoots.some((root) => filePath.startsWith(`${root}/`)));
 //# sourceMappingURL=run-policy.js.map

package/dist/run-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-policy.js","sourceRoot":"","sources":["../src/run-policy.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,0FAA0F;AAC1F,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,kDAAkD;AAClD,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAY/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAe,EAAW,EAAE,CAClD,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,YAA+B,EAC/B,WAA8B,EAC9B,MAAqC,EAC5B,EAAE,CACX,YAAY,CAAC,IAAI,CACf,CAAC,QAAgB,EAAW,EAAE,CAC5B,MAAM,CAAC,QAAQ,CAAC;IAChB,WAAW,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAC/E,CAAA"}
+{"version":3,"file":"run-policy.js","sourceRoot":"","sources":["../src/run-policy.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,0FAA0F;AAC1F,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,kDAAkD;AAClD,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAY/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAe,EAAW,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;AAElH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,YAA+B,EAC/B,WAA8B,EAC9B,MAAqC,EAC5B,EAAE,CACX,YAAY,CAAC,IAAI,CACf,CAAC,QAAgB,EAAW,EAAE,CAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CACnG,CAAA"}

package/dist/sbom-policy.d.ts

@@ -0,0 +1,21 @@
+/** Files whose bytes a release inventory accompanies, and where its two reports are written. */
+export interface SbomArguments {
+    readonly artifacts: readonly string[];
+    readonly output: string;
+}
+/** Parse the deliberately small release-inventory command grammar. */
+export declare const parseSbomArguments: (arguments_: readonly string[]) => SbomArguments | undefined;
+/** Stable structural comparison of lockfile documents, independent of YAML key ordering. */
+export declare const canonicalInventory: (value: unknown) => string;
+/** A workspace manifest, addressed the same way as a pnpm lockfile importer. */
+export interface SbomManifest {
+    readonly path: string;
+    readonly packageJson: unknown;
+}
+/** Reject a stale install or a manifest-only approximation before invoking the generator. */
+export declare const sbomInputProblems: (manifests: readonly SbomManifest[], lock: unknown, installed: unknown, workspace?: unknown) => readonly string[];
+/** Preserve declared per-workspace usage without guessing transitive usage from source imports. */
+export declare const sbomWithWorkspaceRoles: (bom: unknown, manifests: readonly SbomManifest[]) => unknown;
+/** Additional completeness checks after the generator's pinned CycloneDX schema validation. */
+export declare const sbomProblems: (bom: unknown) => readonly string[];
+//# sourceMappingURL=sbom-policy.d.ts.map

package/dist/sbom-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-policy.d.ts","sourceRoot":"","sources":["../src/sbom-policy.ts"],"names":[],"mappings":"AAIA,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAAI,YAAY,SAAS,MAAM,EAAE,KAAG,aAAa,GAAG,SAqBlF,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,MAWnD,CAAA;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAsDD,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,GAC5B,WAAW,SAAS,YAAY,EAAE,EAClC,MAAM,OAAO,EACb,WAAW,OAAO,EAClB,YAAW,OAAY,KACtB,SAAS,MAAM,EAkBjB,CAAA;AA4BD,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,GAAI,KAAK,OAAO,EAAE,WAAW,SAAS,YAAY,EAAE,KAAG,OAsBzF,CAAA;AAwBD,+FAA+F;AAC/F,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,SAAS,MAAM,EA+B1D,CAAA"}

package/dist/sbom-policy.js

@@ -0,0 +1,180 @@
+// A release inventory is evidence only when its inputs, components and graph are accounted for.
+import path from 'node:path';
+import { asRecord, isArray, isRecord, readKey } from './json-shapes.js';
+const OPTION_PAIR = 2;
+/** Parse the deliberately small release-inventory command grammar. */
+export const parseSbomArguments = (arguments_) => {
+    if (arguments_.length % OPTION_PAIR !== 0) {
+        return undefined;
+    }
+    const pairs = Array.from({ length: arguments_.length / OPTION_PAIR }, (_, index) => [arguments_[index * OPTION_PAIR], arguments_[index * OPTION_PAIR + 1]]);
+    if (pairs.some(([key = '', value]) => !['--artifact', '--output'].includes(key) || value === undefined || value.length === 0 || value.startsWith('-'))) {
+        return undefined;
+    }
+    const artifacts = pairs.filter(([key]) => key === '--artifact').map(([, value = '']) => value);
+    const outputs = pairs.filter(([key]) => key === '--output').map(([, value = '']) => value);
+    return artifacts.length === 0 || new Set(artifacts).size !== artifacts.length || outputs.length > 1
+        ? undefined
+        : { artifacts, output: outputs[0] ?? 'dist/sbom' };
+};
+/** Stable structural comparison of lockfile documents, independent of YAML key ordering. */
+export const canonicalInventory = (value) => {
+    if (isArray(value)) {
+        return `[${value.map((entry) => canonicalInventory(entry)).join(',')}]`;
+    }
+    if (isRecord(value)) {
+        return `{${Object.keys(value)
+            .sort((left, right) => left.localeCompare(right, 'en'))
+            .map((key) => `${JSON.stringify(key)}:${canonicalInventory(value[key])}`)
+            .join(',')}}`;
+    }
+    return value === undefined ? 'null' : JSON.stringify(value);
+};
+const DEPENDENCY_GROUPS = ['dependencies', 'devDependencies', 'optionalDependencies'];
+const FILE_PROTOCOL = 'file:';
+const isAbsolutePath = (value) => path.posix.isAbsolute(value) || path.win32.isAbsolute(value);
+// pnpm addresses a relative archive override from the workspace root, but writes each importer's
+// specifier relative to that member. Compare their lexical targets without reading the filesystem.
+const matchesOverride = (override, locked, importer) => {
+    if (typeof override !== 'string' || !override.startsWith(FILE_PROTOCOL)) {
+        return locked === override;
+    }
+    const target = override.slice(FILE_PROTOCOL.length);
+    if (isAbsolutePath(target)) {
+        return locked === override;
+    }
+    if (typeof locked !== 'string' || !locked.startsWith(FILE_PROTOCOL)) {
+        return false;
+    }
+    const memberTarget = locked.slice(FILE_PROTOCOL.length);
+    return (!isAbsolutePath(memberTarget) &&
+        path.posix.normalize(path.posix.join(importer, memberTarget)) === path.posix.normalize(target));
+};
+const manifestProblems = (manifest, lock) => {
+    const importers = readKey(lock, 'importers');
+    const overrides = asRecord(readKey(lock, 'overrides'));
+    const importer = readKey(importers, manifest.path);
+    if (!isRecord(importer)) {
+        return [`pnpm-lock.yaml has no importer for ${manifest.path}; install with the pinned pnpm`];
+    }
+    return DEPENDENCY_GROUPS.flatMap((group) => {
+        const declared = asRecord(readKey(manifest.packageJson, group));
+        const lockedGroup = asRecord(readKey(importer, group));
+        const names = [...new Set([...Object.keys(declared), ...Object.keys(lockedGroup)])];
+        return names.flatMap((name) => {
+            const specifier = declared[name];
+            const locked = lockedGroup[name];
+            const override = overrides[name] ?? overrides[`${name}@${String(specifier)}`];
+            const lockedSpecifier = readKey(locked, 'specifier');
+            const isMatched = override === undefined
+                ? lockedSpecifier === specifier
+                : matchesOverride(override, lockedSpecifier, manifest.path);
+            return isMatched && Object.hasOwn(declared, name)
+                ? []
+                : [`${manifest.path}: ${name} does not match its frozen lockfile specifier; install with the pinned pnpm`];
+        });
+    });
+};
+/** Reject a stale install or a manifest-only approximation before invoking the generator. */
+export const sbomInputProblems = (manifests, lock, installed, workspace = {}) => {
+    if (!isRecord(lock) || (String(lock['lockfileVersion']) !== '9.0' && String(lock['lockfileVersion']) !== '9')) {
+        return ['SBOM generation requires a supported pnpm lockfile version 9'];
+    }
+    if (!isRecord(installed)) {
+        return ['the installed pnpm lock snapshot is missing'];
+    }
+    const isMatched = ['importers', 'packages', 'snapshots'].every((key) => canonicalInventory(readKey(lock, key)) === canonicalInventory(readKey(installed, key)));
+    return [
+        ...(canonicalInventory(asRecord(readKey(lock, 'overrides'))) ===
+            canonicalInventory(asRecord(readKey(workspace, 'overrides')))
+            ? []
+            : ['workspace overrides differ from the frozen lockfile; install with the pinned pnpm']),
+        ...(isMatched ? [] : ['the installed pnpm lock snapshot differs; run pnpm install --frozen-lockfile']),
+        ...manifests.flatMap((manifest) => manifestProblems(manifest, lock)),
+    ];
+};
+const allComponents = (components) => components.flatMap((component) => {
+    const nested = readKey(component, 'components');
+    return [component, ...(isArray(nested) ? allComponents(nested) : [])];
+});
+const graphProblems = (dependencies, references) => dependencies.flatMap((dependency) => {
+    const reference = readKey(dependency, 'ref');
+    const children = readKey(dependency, 'dependsOn');
+    const isValid = typeof reference === 'string' &&
+        references.has(reference) &&
+        isArray(children) &&
+        children.every((child) => typeof child === 'string' && references.has(child));
+    return isValid ? [] : ['the SBOM contains an invalid dependency reference'];
+});
+const missingGraphEntries = (dependencies, references) => {
+    const declared = new Set(dependencies.map((entry) => readKey(entry, 'ref')));
+    return declared.size === dependencies.length &&
+        [...references].every((reference) => declared.has(reference))
+        ? []
+        : ['the SBOM does not explicitly account for every component in its dependency graph'];
+};
+/** Preserve declared per-workspace usage without guessing transitive usage from source imports. */
+export const sbomWithWorkspaceRoles = (bom, manifests) => {
+    const metadata = asRecord(readKey(bom, 'metadata'));
+    const properties = metadata['properties'];
+    const roles = manifests.map((manifest) => ({
+        path: manifest.path,
+        dependencies: Object.fromEntries(DEPENDENCY_GROUPS.map((group) => [
+            group,
+            Object.keys(asRecord(readKey(manifest.packageJson, group))),
+        ])),
+    }));
+    return {
+        ...asRecord(bom),
+        metadata: {
+            ...metadata,
+            properties: [
+                ...(isArray(properties) ? properties : []),
+                { name: 'ploaness:direct-workspace-dependency-roles', value: JSON.stringify(roles) },
+            ],
+        },
+    };
+};
+const bomPartsOf = (bom) => {
+    const components = readKey(bom, 'components');
+    const dependencies = readKey(bom, 'dependencies');
+    const root = readKey(readKey(bom, 'metadata'), 'component');
+    if (readKey(bom, 'bomFormat') !== 'CycloneDX' ||
+        readKey(bom, 'specVersion') !== '1.6' ||
+        !isArray(components) ||
+        !isArray(dependencies) ||
+        !isRecord(root)) {
+        return undefined;
+    }
+    return { components, dependencies, root };
+};
+/** Additional completeness checks after the generator's pinned CycloneDX schema validation. */
+export const sbomProblems = (bom) => {
+    const parts = bomPartsOf(bom);
+    if (parts === undefined) {
+        return ['the generator returned no complete CycloneDX 1.6 inventory'];
+    }
+    const { root, components, dependencies } = parts;
+    const entries = allComponents([root, ...components]);
+    const references = entries.map((entry) => readKey(entry, 'bom-ref'));
+    const isValid = entries.every((entry) => ['name', 'version', 'bom-ref', 'purl'].every((key) => {
+        const value = readKey(entry, key);
+        return typeof value === 'string' && value.length > 0;
+    }));
+    const references_ = new Set(references.filter((reference) => typeof reference === 'string'));
+    const compositions = readKey(bom, 'compositions');
+    return [
+        ...(isValid && references_.size === entries.length
+            ? []
+            : ['the SBOM has missing identities or duplicate component references']),
+        ...(dependencies.length === 0
+            ? ['the SBOM contains no dependency graph']
+            : graphProblems(dependencies, references_)),
+        ...missingGraphEntries(dependencies, references_),
+        ...(isArray(compositions) &&
+            compositions.some((entry) => readKey(entry, 'aggregate') !== 'complete')
+            ? ['the generator reports an incomplete inventory']
+            : []),
+    ];
+};
+//# sourceMappingURL=sbom-policy.js.map

package/dist/sbom-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-policy.js","sourceRoot":"","sources":["../src/sbom-policy.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAQvE,MAAM,WAAW,GAAW,CAAC,CAAA;AAE7B,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAA6B,EAA6B,EAAE;IAC7F,IAAI,UAAU,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAmE,KAAK,CAAC,IAAI,CACtF,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,WAAW,EAAE,EAC3C,CAAC,CAAC,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAC7F,CAAA;IACD,IACE,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CACpB,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAClH,EACD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IACjH,MAAM,OAAO,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IAC7G,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACjG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAA;AACtD,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC3D,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aAC9E,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC7D,CAAC,CAAA;AAQD,MAAM,iBAAiB,GAAsB,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAA;AAExG,MAAM,aAAa,GAAW,OAAO,CAAA;AACrC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAE/G,iGAAiG;AACjG,mGAAmG;AACnG,MAAM,eAAe,GAAG,CAAC,QAAiB,EAAE,MAAe,EAAE,QAAgB,EAAW,EAAE;IACxF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,MAAM,KAAK,QAAQ,CAAA;IAC5B,CAAC;IACD,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,QAAQ,CAAA;IAC5B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,YAAY,GAAW,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/D,OAAO,CACL,CAAC,cAAc,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAC/F,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAsB,EAAE,IAAa,EAAqB,EAAE;IACpF,MAAM,SAAS,GAAY,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACrD,MAAM,SAAS,GAA4B,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAY,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,sCAAsC,QAAQ,CAAC,IAAI,gCAAgC,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,KAAa,EAAqB,EAAE;QACpE,MAAM,QAAQ,GAA4B,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;QACxF,MAAM,WAAW,GAA4B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC/E,MAAM,KAAK,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;YACvD,MAAM,SAAS,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,MAAM,GAAY,WAAW,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAY,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtF,MAAM,eAAe,GAAY,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAC7D,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC/D,OAAO,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,6EAA6E,CAAC,CAAA;QAC9G,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAkC,EAClC,IAAa,EACb,SAAkB,EAClB,YAAqB,EAAE,EACJ,EAAE;IACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,8DAA8D,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,6CAA6C,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,SAAS,GAAY,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,KAAK,CACrE,CAAC,GAAW,EAAW,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CACjH,CAAA;IACD,OAAO;QACL,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5D,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mFAAmF,CAAC,CAAC;QAC1F,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8EAA8E,CAAC,CAAC;QACtG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAsB,EAAqB,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;KACtG,CAAA;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,UAA8B,EAAsB,EAAE,CAC3E,UAAU,CAAC,OAAO,CAAC,CAAC,SAAkB,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAY,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACxD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CAAC,YAAgC,EAAE,UAA+B,EAAqB,EAAE,CAC7G,YAAY,CAAC,OAAO,CAAC,CAAC,UAAmB,EAAqB,EAAE;IAC9D,MAAM,SAAS,GAAY,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAY,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC1D,MAAM,OAAO,GACX,OAAO,SAAS,KAAK,QAAQ;QAC7B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC;QACjB,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IACjG,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEJ,MAAM,mBAAmB,GAAG,CAAC,YAAgC,EAAE,UAA+B,EAAqB,EAAE;IACnH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IACpH,OAAO,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM;QAC1C,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,kFAAkF,CAAC,CAAA;AAC1F,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAY,EAAE,SAAkC,EAAW,EAAE;IAClG,MAAM,QAAQ,GAA4B,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5E,MAAM,UAAU,GAAY,QAAQ,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,KAAK,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAsB,EAAW,EAAE,CAAC,CAAC;QACpF,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAa,EAAwC,EAAE,CAAC;YAC7E,KAAK;YACL,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SAC5D,CAAC,CACH;KACF,CAAC,CAAC,CAAA;IACH,OAAO;QACL,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChB,QAAQ,EAAE;YACR,GAAG,QAAQ;YACX,UAAU,EAAE;gBACV,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,EAAE,IAAI,EAAE,4CAA4C,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;aACrF;SACF;KACF,CAAA;AACH,CAAC,CAAA;AAQD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAwB,EAAE;IACxD,MAAM,UAAU,GAAY,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACtD,MAAM,YAAY,GAAY,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAY,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAA;IACpE,IACE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,WAAW;QACzC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,KAAK;QACrC,CAAC,OAAO,CAAC,UAAU,CAAC;QACpB,CAAC,OAAO,CAAC,YAAY,CAAC;QACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,EACf,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAyB,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,4DAA4D,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAA;IAChD,MAAM,OAAO,GAAuB,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAA;IACxE,MAAM,UAAU,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;IAC1G,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CACjE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAW,EAAW,EAAE;QACpE,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,CAAC,CAAC,CACH,CAAA;IACD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAC9C,UAAU,CAAC,MAAM,CAAC,CAAC,SAAkB,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAC9F,CAAA;IACD,MAAM,YAAY,GAAY,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC1D,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC;QAC1E,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC3C,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC7C,GAAG,mBAAmB,CAAC,YAAY,EAAE,WAAW,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,UAAU,CAAC;YACxF,CAAC,CAAC,CAAC,+CAA+C,CAAC;YACnD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC,CAAA"}

package/dist/sbom-release.d.ts

@@ -0,0 +1,16 @@
+/** The inventory covers resolved workspace inputs, including tools that never enter a deployed bundle. */
+export declare const SBOM_SCOPE: string;
+/** One release file associated with an inventory, measured from its actual bytes. */
+export interface ReleaseArtifact {
+    readonly path: string;
+    readonly sha256: string;
+}
+/** Evidence supplied independently from Git and the release files. */
+export interface ReleaseEvidence {
+    readonly sourceCommit: string;
+    readonly sbomSha256: string;
+    readonly artifacts: readonly ReleaseArtifact[];
+}
+/** Recovery must preserve the original commit and the bytes originally associated with its SBOM. */
+export declare const releaseInventoryProblems: (metadata: unknown, evidence: ReleaseEvidence) => readonly string[];
+//# sourceMappingURL=sbom-release.d.ts.map

package/dist/sbom-release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-release.d.ts","sourceRoot":"","sources":["../src/sbom-release.ts"],"names":[],"mappings":"AAGA,0GAA0G;AAC1G,eAAO,MAAM,UAAU,EAAE,MAAgE,CAAA;AAEzF,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;CAC/C;AA6BD,oGAAoG;AACpG,eAAO,MAAM,wBAAwB,GAAI,UAAU,OAAO,EAAE,UAAU,eAAe,KAAG,SAAS,MAAM,EActG,CAAA"}

package/dist/sbom-release.js

@@ -0,0 +1,36 @@
+import { isArray, readKey } from './json-shapes.js';
+import { canonicalInventory } from './sbom-policy.js';
+/** The inventory covers resolved workspace inputs, including tools that never enter a deployed bundle. */
+export const SBOM_SCOPE = 'resolved-workspace-dependencies-including-development';
+const artifactList = (raw) => {
+    if (!isArray(raw)) {
+        return undefined;
+    }
+    const items = raw.map((entry) => {
+        const path = readKey(entry, 'path');
+        const sha256 = readKey(entry, 'sha256');
+        return typeof path === 'string' && typeof sha256 === 'string' ? { path, sha256 } : undefined;
+    });
+    return items.every((entry) => entry !== undefined)
+        ? items
+        : undefined;
+};
+const orderedArtifacts = (artifacts) => canonicalInventory(artifacts.toSorted((left, right) => left.path.localeCompare(right.path, 'en')));
+const matchesArtifacts = (artifacts, expected) => artifacts !== undefined && artifacts.length > 0 && orderedArtifacts(artifacts) === orderedArtifacts(expected);
+/** Recovery must preserve the original commit and the bytes originally associated with its SBOM. */
+export const releaseInventoryProblems = (metadata, evidence) => {
+    const artifacts = artifactList(readKey(metadata, 'artifacts'));
+    return [
+        ...(readKey(metadata, 'schemaVersion') === 1 && readKey(metadata, 'scope') === SBOM_SCOPE
+            ? []
+            : ['release inventory metadata has an unsupported schema or scope']),
+        ...(readKey(metadata, 'sourceCommit') === evidence.sourceCommit && readKey(metadata, 'sourceDirty') === false
+            ? []
+            : ['release inventory does not describe the original clean release commit']),
+        ...(readKey(metadata, 'sbomSha256') === evidence.sbomSha256 ? [] : ['release inventory SBOM hash does not match']),
+        ...(matchesArtifacts(artifacts, evidence.artifacts)
+            ? []
+            : ['release inventory artifact hashes do not match the release files']),
+    ];
+};
+//# sourceMappingURL=sbom-release.js.map

package/dist/sbom-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-release.js","sourceRoot":"","sources":["../src/sbom-release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,UAAU,GAAW,uDAAuD,CAAA;AAezF,MAAM,YAAY,GAAG,CAAC,GAAY,EAA0C,EAAE;IAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAA6C,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAA+B,EAAE;QAC9G,MAAM,IAAI,GAAY,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAY,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9F,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAkC,EAA4B,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACvG,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,SAAqC,EAAU,EAAE,CACzE,kBAAkB,CAChB,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAqB,EAAE,KAAsB,EAAU,EAAE,CAC3E,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAC1C,CACF,CAAA;AAEH,MAAM,gBAAgB,GAAG,CACvB,SAAiD,EACjD,QAAoC,EAC3B,EAAE,CACX,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AAE/G,oGAAoG;AACpG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAiB,EAAE,QAAyB,EAAqB,EAAE;IAC1G,MAAM,SAAS,GAA2C,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IACtG,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,UAAU;YACvF,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,KAAK,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,KAAK;YAC3G,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,uEAAuE,CAAC,CAAC;QAC9E,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAClH,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;YACjD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC;KAC1E,CAAA;AACH,CAAC,CAAA"}

package/dist/secret-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-policy.d.ts","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA2CD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,SAAS,eAAe,EAAE,KAAG,MAiB7E,CAAA"}
+{"version":3,"file":"secret-policy.d.ts","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA0CD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,SAAS,eAAe,EAAE,KAAG,MAiB7E,CAAA"}

package/dist/secret-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-policy.js","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AASlD,mGAAmG;AACnG,uGAAuG;AACvG,wFAAwF;AACxF,MAAM,eAAe,GAAW,IAAI,CAAA;AACpC,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,qBAAqB,GAAW,CAAC,CAAA;AAEvC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC1C,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAEpE,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACrB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;CACvB,CAAC,CAAA;AAEF,uGAAuG;AACvG,uGAAuG;AACvG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAuB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAW,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAA;IAChE,OAAO,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACpF,CAAC,CAAA;AAED,uGAAuG;AACvG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;AAC9C,iGAAiG;AACjG,sFAAsF;AACtF,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAsC,EAAU,EAAE;IACrF,MAAM,MAAM,GAAW;QACrB,mGAAmG;QACnG,2EAA2E;QAC3E,UAAU;QACV,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,MAAM,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,SAA0B,EAAU,EAAE,CACtF;QACE,gBAAgB;QAChB,kBAAkB,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;QACpD,cAAc,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC,CAAA"}
+{"version":3,"file":"secret-policy.js","sourceRoot":"","sources":["../src/secret-policy.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AASlD,mGAAmG;AACnG,uGAAuG;AACvG,wFAAwF;AACxF,MAAM,eAAe,GAAW,IAAI,CAAA;AACpC,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,qBAAqB,GAAW,CAAC,CAAA;AAEvC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAE/G,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,IAAI,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACrB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;IACtB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC;CACvB,CAAC,CAAA;AAEF,uGAAuG;AACvG,uGAAuG;AACvG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,MAAM,KAAK,GAAuB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAW,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAA;IAChE,OAAO,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACpF,CAAC,CAAA;AAED,uGAAuG;AACvG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;AAC9C,iGAAiG;AACjG,sFAAsF;AACtF,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAEpF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAsC,EAAU,EAAE;IACrF,MAAM,MAAM,GAAW;QACrB,mGAAmG;QACnG,2EAA2E;QAC3E,UAAU;QACV,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,MAAM,MAAM,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,SAA0B,EAAU,EAAE,CACtF;QACE,gBAAgB;QAChB,kBAAkB,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;QACpD,cAAc,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK;QAChE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC,CAAA"}

package/dist/security-headers.d.ts

@@ -0,0 +1,3 @@
+/** Judge the established baseline; this does not attempt complete CSP validation. */
+export declare const securityHeaderProblems: (headers: Readonly<Record<string, string>>) => readonly string[];
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAiBA,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,GAAI,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,SAAS,MAAM,EAUjG,CAAA"}

package/dist/security-headers.js

@@ -0,0 +1,26 @@
+// The existing browser baseline shared by the home check and checks of individual HTML responses.
+const directive = (policy, name) => policy
+    .split(';')
+    .map((part) => part.trim())
+    .find((part) => part === name || part.startsWith(`${name} `));
+const scriptProblems = (policy) => {
+    const sources = directive(policy, 'script-src') ?? directive(policy, 'default-src');
+    return [
+        ...(policy.length === 0 ? ['content-security-policy must be declared'] : []),
+        ...(sources === undefined ? ['constrain script through script-src or default-src'] : []),
+        ...(sources?.includes("'unsafe-inline'") === true ? ["script sources must not allow 'unsafe-inline'"] : []),
+    ];
+};
+/** Judge the established baseline; this does not attempt complete CSP validation. */
+export const securityHeaderProblems = (headers) => {
+    const policy = headers['content-security-policy'] ?? '';
+    return [
+        ...(headers['x-content-type-options'] === 'nosniff' ? [] : ['x-content-type-options must be nosniff']),
+        ...(headers['referrer-policy'] === undefined ? ['referrer-policy must be declared'] : []),
+        ...(headers['x-frame-options'] === undefined && directive(policy, 'frame-ancestors') === undefined
+            ? ['declare a framing decision through x-frame-options or frame-ancestors']
+            : []),
+        ...scriptProblems(policy),
+    ];
+};
+//# sourceMappingURL=security-headers.js.map

package/dist/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,IAAY,EAAsB,EAAE,CACrE,MAAM;KACH,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KAC1C,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;AAElF,MAAM,cAAc,GAAG,CAAC,MAAc,EAAqB,EAAE;IAC3D,MAAM,OAAO,GAAuB,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACvG,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAA;AACH,CAAC,CAAA;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAyC,EAAqB,EAAE;IACrG,MAAM,MAAM,GAAW,OAAO,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAA;IAC/D,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC;QACtG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAAK,SAAS;YAChG,CAAC,CAAC,CAAC,uEAAuE,CAAC;YAC3E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,cAAc,CAAC,MAAM,CAAC;KAC1B,CAAA;AACH,CAAC,CAAA"}

package/dist/settings-layering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-layering.d.ts","sourceRoot":"","sources":["../src/settings-layering.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAAmB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAoEtF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAUxB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAC1B,YAAY,MAAM,EAClB,OAAO,iBAAiB,KACvB,iBAUF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,iBAAiB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,QAGD,CAAA"}
+{"version":3,"file":"settings-layering.d.ts","sourceRoot":"","sources":["../src/settings-layering.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAAmB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AA6EtF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAUxB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,YAAY,MAAM,EAAE,OAAO,iBAAiB,KAAG,iBAQ9E,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,iBAAiB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,QAGD,CAAA"}