@ploaness/governance 1.7.0 → 1.8.0

package/dist/compliance-report-outline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report-outline.d.ts","sourceRoot":"","sources":["../src/compliance-report-outline.ts"],"names":[],"mappings":"AAqGA;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,KAAG,MAA8D,CAAA;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,KAAG,MAE0B,CAAA;AAO7E;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,MAYpB,CAAA;AAEf;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,IAAI,MAAM,KAAG,MAA4C,CAAA;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,WAAW,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAQ9F,CAAA"}

package/dist/compliance-report-outline.js

@@ -0,0 +1,124 @@
+// The report's numbered outline: one definition that both the headings and the table of contents read,
+// so a section can never be numbered one way in the text and another in the contents.
+const OUTLINE = [
+    {
+        id: 'summary',
+        title: 'Executive summary',
+        subsections: [
+            { id: 'key-figures', title: 'Key figures' },
+            { id: 'license-classes', title: 'License classes' },
+            { id: 'common-licenses', title: 'Most common licenses' },
+            { id: 'severities', title: 'Advisories by severity' },
+            { id: 'findings', title: 'Findings' },
+        ],
+    },
+    {
+        id: 'policy',
+        title: 'License policy',
+        subsections: [
+            { id: 'policy-permissive', title: 'Permissive licenses' },
+            { id: 'policy-weak-copyleft', title: 'Weak copyleft licenses' },
+            { id: 'policy-outside', title: 'Licenses outside the policy' },
+        ],
+    },
+    {
+        id: 'copyleft',
+        title: 'Copyleft and policy review',
+        subsections: [
+            { id: 'review-weak-copyleft', title: 'Weak copyleft' },
+            { id: 'review-outside', title: 'Outside the policy' },
+        ],
+    },
+    {
+        id: 'vulnerabilities',
+        title: 'Known vulnerabilities',
+        subsections: [
+            { id: 'advisories-open', title: 'Unresolved at or above the threshold' },
+            { id: 'advisories-excused', title: 'Excused by a recorded exception' },
+            { id: 'advisories-stale', title: 'Exceptions that no longer match' },
+            { id: 'advisories-below', title: 'Below the threshold' },
+        ],
+    },
+    { id: 'inventory', title: 'Package inventory', subsections: [] },
+    {
+        id: 'notices',
+        title: 'Third-party notices',
+        subsections: [
+            { id: 'notices-missing', title: 'Packages without a license file' },
+            { id: 'notices-texts', title: 'License texts' },
+        ],
+    },
+    {
+        id: 'provenance',
+        title: 'Provenance and reproduction',
+        subsections: [
+            { id: 'provenance-source', title: 'Source' },
+            { id: 'provenance-scope', title: 'Scope' },
+        ],
+    },
+];
+const NUMBERED = new Map(OUTLINE.flatMap((section, index) => {
+    const number = String(index + 1);
+    return [
+        [section.id, { number, title: section.title }],
+        ...section.subsections.map((entry, position) => [
+            entry.id,
+            { number: `${number}.${String(position + 1)}`, title: entry.title },
+        ]),
+    ];
+}));
+const numberedOf = (id) => {
+    const found = NUMBERED.get(id);
+    if (found === undefined) {
+        throw new Error(`the report outline has no entry "${id}"`);
+    }
+    return found;
+};
+const headingText = (entry) => `<span class="adnum">${entry.number}.</span><span class="adtext">${entry.title}</span>`;
+/**
+ * A numbered subsection heading.
+ * @param id the outline entry.
+ * @returns the heading element.
+ */
+export const subheading = (id) => `<h3 id="${id}">${headingText(numberedOf(id))}</h3>`;
+/**
+ * A numbered top-level section.
+ * @param id the outline section.
+ * @param body the section's markup after its heading.
+ * @returns the section element.
+ */
+export const section = (id, body) => `<section class="sect1" id="${id}" aria-labelledby="${id}-title">` +
+    `<h2 id="${id}-title">${headingText(numberedOf(id))}</h2>${body}</section>`;
+// The leader and page slots are filled only in print, where the contents list carries page numbers.
+const tocLink = (id) => `<a href="#${id}">${headingText(numberedOf(id))}<span class="leader"></span><span class="page" data-for="${id}">` +
+    '</span></a>';
+/**
+ * The table of contents, read from the same outline as the headings.
+ * @returns the contents navigation.
+ */
+export const tableOfContents = () => '<nav id="toc" aria-labelledby="toctitle"><div id="toctitle">Table of Contents</div><ul class="sectlevel1">' +
+    OUTLINE.map((entry) => `<li>${tocLink(entry.id)}` +
+        (entry.subsections.length > 0
+            ? `<ul class="sectlevel2">${entry.subsections
+                .map((child) => `<li>${tocLink(child.id)}</li>`)
+                .join('')}</ul>`
+            : '') +
+        '</li>').join('') +
+    '</ul></nav>';
+/**
+ * The cross-reference text for a section, such as "section 3".
+ * @param id the outline entry.
+ * @returns the reference text.
+ */
+export const sectionReference = (id) => `section ${numberedOf(id).number}`;
+/**
+ * The page of every outline entry, from the bookmarks of a printed report. A bookmark is titled with the
+ * heading's text, which starts with the entry's number, so the number is what is matched.
+ * @param bookmarks the page by bookmark title, as read from the PDF.
+ * @returns the page number by outline id, for every entry found.
+ */
+export const contentsPages = (bookmarks) => new Map([...NUMBERED].flatMap(([id, entry]) => {
+    const page = [...bookmarks].find(([title]) => title.startsWith(`${entry.number}.${entry.title}`))?.[1];
+    return page === undefined ? [] : [[id, page]];
+}));
+//# sourceMappingURL=compliance-report-outline.js.map

package/dist/compliance-report-outline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report-outline.js","sourceRoot":"","sources":["../src/compliance-report-outline.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,sFAAsF;AAatF,MAAM,OAAO,GAA8B;IACzC;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;YAC3C,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE;YACnD,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,sBAAsB,EAAE;YACxD,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,EAAE;YACrD,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;SACtC;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE;YACzD,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,wBAAwB,EAAE;YAC/D,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,6BAA6B,EAAE;SAC/D;KACF;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,eAAe,EAAE;YACtD,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE;SACtD;KACF;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,sCAAsC,EAAE;YACxE,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,iCAAiC,EAAE;YACtE,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,iCAAiC,EAAE;YACpE,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE;SACzD;KACF;IACD,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,EAAE,EAAE;IAChE;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,iCAAiC,EAAE;YACnE,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE;SAChD;KACF;IACD;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC5C,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C;KACF;CACF,CAAA;AAOD,MAAM,QAAQ,GAAkC,IAAI,GAAG,CACrD,OAAO,CAAC,OAAO,CAAC,CAAC,OAAuB,EAAE,KAAa,EAA4C,EAAE;IACnG,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IACxC,OAAO;QACL,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAE,QAAgB,EAA+B,EAAE,CAAC;YACjG,KAAK,CAAC,EAAE;YACR,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;SACpE,CAAC;KACH,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,EAAU,EAAY,EAAE;IAC1C,MAAM,KAAK,GAAyB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAU,EAAE,CAC9C,uBAAuB,KAAK,CAAC,MAAM,gCAAgC,KAAK,CAAC,KAAK,SAAS,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;AAEtG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,IAAY,EAAU,EAAE,CAC1D,8BAA8B,EAAE,sBAAsB,EAAE,UAAU;IAClE,WAAW,EAAE,WAAW,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAA;AAE7E,oGAAoG;AACpG,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CACrC,aAAa,EAAE,KAAK,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,4DAA4D,EAAE,IAAI;IACjH,aAAa,CAAA;AAEf;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAW,EAAE,CAC1C,4GAA4G;IAC5G,OAAO,CAAC,GAAG,CACT,CAAC,KAAqB,EAAU,EAAE,CAChC,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;QAC1B,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,0BAA0B,KAAK,CAAC,WAAW;iBACxC,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC;iBACrE,IAAI,CAAC,EAAE,CAAC,OAAO;YACpB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CACV,CAAC,IAAI,CAAC,EAAE,CAAC;IACV,aAAa,CAAA;AAEf;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,WAAW,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAsC,EAA+B,EAAE,CACnG,IAAI,GAAG,CACL,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAA8B,EAA0C,EAAE;IACzG,MAAM,IAAI,GAAuB,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAA4B,EAAW,EAAE,CACnG,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CACnD,EAAE,CAAC,CAAC,CAAC,CAAA;IACN,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAA;AAC/C,CAAC,CAAC,CACH,CAAA"}

package/dist/compliance-report.d.ts

@@ -0,0 +1,136 @@
+import { LICENSE_POLICY, type LicenseClass } from './license-allowlist.js';
+import { type InventoryPackage } from './license-inventory.js';
+import { type VulnerabilityClassification } from './vulnerability-policy.js';
+/** One licence file a package ships, as read from its installed directory. */
+export interface NoticeFile {
+    readonly name: string;
+    readonly text: string;
+}
+/** The licence files one installed package version ships. */
+export interface PackageNotices {
+    readonly coordinate: string;
+    readonly files: readonly NoticeFile[];
+}
+/** Where the report's source stands. */
+export interface ReportSource {
+    readonly commit: string;
+    readonly isDirty: boolean;
+    readonly fingerprint: string;
+    readonly lockfileSha256: string;
+}
+/** The SBOM the report embeds. */
+export interface ReportSbom {
+    readonly sha256: string;
+    readonly components: number;
+    readonly generator: string;
+}
+/** Everything the report is built from. */
+export interface ComplianceReportInput {
+    readonly projectName: string;
+    readonly projectDescription: string | undefined;
+    readonly source: ReportSource;
+    readonly generatedAt: string;
+    readonly harnessVersion: string;
+    readonly packages: readonly InventoryPackage[];
+    readonly production: readonly InventoryPackage[];
+    readonly directNames: readonly string[];
+    readonly vulnerabilities: VulnerabilityClassification;
+    readonly advisoryRecords: number;
+    readonly auditedAt: string;
+    readonly sbom: ReportSbom;
+    readonly notices: readonly PackageNotices[];
+}
+/** One installed package version as the report lists it. */
+export interface ReportPackage {
+    readonly name: string;
+    /** Empty for a directory dependency, which pnpm reports without a version. */
+    readonly version: string;
+    readonly license: string;
+    readonly licenseClass: LicenseClass;
+    readonly isProduction: boolean;
+    readonly isDirect: boolean;
+    readonly homepage: string | undefined;
+}
+/** How many package versions declare one licence. */
+export interface LicenseCount {
+    readonly license: string;
+    readonly licenseClass: LicenseClass;
+    readonly count: number;
+}
+/** One licence text and every distributed package version that ships it. */
+export interface NoticeGroup {
+    readonly text: string;
+    readonly fileNames: readonly string[];
+    readonly coordinates: readonly string[];
+}
+/** How many advisories were reported at one severity. */
+export interface SeverityCount {
+    readonly severity: string;
+    readonly count: number;
+}
+/** The assembled report. */
+export interface ComplianceReport {
+    readonly projectName: string;
+    readonly projectDescription: string | undefined;
+    readonly source: ReportSource;
+    readonly generatedAt: string;
+    readonly harnessVersion: string;
+    readonly isCompliant: boolean;
+    /** Why the report is not release evidence; empty when it is. */
+    readonly draftReasons: readonly string[];
+    readonly packages: readonly ReportPackage[];
+    readonly productionCount: number;
+    readonly directCount: number;
+    readonly licenseCounts: readonly LicenseCount[];
+    readonly classCounts: Readonly<Record<LicenseClass, number>>;
+    readonly copyleft: readonly ReportPackage[];
+    readonly refused: readonly ReportPackage[];
+    readonly policy: typeof LICENSE_POLICY;
+    readonly vulnerabilities: VulnerabilityClassification;
+    readonly severityCounts: readonly SeverityCount[];
+    readonly advisoryRecords: number;
+    readonly auditedAt: string;
+    readonly sbom: ReportSbom;
+    readonly notices: readonly NoticeGroup[];
+    /** Distributed package versions whose installed directory carries no licence file. */
+    readonly withoutNotice: readonly string[];
+}
+/**
+ * Reflow a licence file for a proportional column. Words and their order are unchanged; only the
+ * fixed-width line breaks inside a paragraph are removed, and runs of spaces collapse to one.
+ * @param text the licence file as shipped.
+ * @returns the text with paragraphs separated by a blank line and kept line breaks by a newline.
+ */
+export declare const reflowLicenseText: (text: string) => string;
+/**
+ * Assemble the compliance report.
+ * @param input the inventory, the vulnerability classification and the provenance already read.
+ * @returns the report model the renderer prints.
+ */
+export declare const buildComplianceReport: (input: ComplianceReportInput) => ComplianceReport;
+/** Where the compliance report is written unless the command names another directory. */
+export declare const DEFAULT_REPORT_OUTPUT: string;
+/** The file name every compliance report starts with, which is also how a stale one is recognised. */
+export declare const REPORT_FILE_PREFIX: string;
+/**
+ * The report's file name without extension: the project and the commit it describes.
+ * @param projectName the root manifest's name, which may be scoped.
+ * @param commit the source commit.
+ * @returns a name safe on every filesystem.
+ */
+export declare const reportFileStem: (projectName: string, commit: string) => string;
+/**
+ * Parse the compliance report command grammar: no argument, or one output directory.
+ * @param arguments_ the arguments after the command name.
+ * @returns the output directory, or undefined when the arguments are not that grammar.
+ */
+export declare const parseComplianceReportArguments: (arguments_: readonly string[]) => {
+    readonly output: string;
+} | undefined;
+/**
+ * The packages any workspace manifest declares, which is what makes a dependency direct.
+ * @param manifests every workspace manifest, as parsed JSON.
+ * @returns the declared package names, each once.
+ */
+export declare const directDependencyNames: (manifests: readonly unknown[]) => readonly string[];
+//# sourceMappingURL=compliance-report.d.ts.map

package/dist/compliance-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report.d.ts","sourceRoot":"","sources":["../src/compliance-report.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAkB,MAAM,wBAAwB,CAAA;AAC1F,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC5E,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,2BAA2B,CAAA;AAElC,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;CACtC;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,2BAA2B,CAAA;IACrD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;CAC5C;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAA;IAC/C,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,OAAO,cAAc,CAAA;IACtC,QAAQ,CAAC,eAAe,EAAE,2BAA2B,CAAA;IACrD,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAA;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;IACxC,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;CAC1C;AAgID;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,MAiBhC,CAAA;AA6CjB;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,qBAAqB,KAAG,gBA2CpE,CAAA;AAED,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,EAAE,MAA0B,CAAA;AAE9D,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,EAAE,MAAiC,CAAA;AAKlE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,MAAM,EAAE,QAAQ,MAAM,KAAG,MAOpE,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,GACzC,YAAY,SAAS,MAAM,EAAE,KAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAShC,CAAA;AASD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,SAAS,OAAO,EAAE,KAAG,SAAS,MAAM,EAMpF,CAAA"}

package/dist/compliance-report.js

@@ -0,0 +1,241 @@
+// The compliance report on open source dependencies: the evidence behind the licence and vulnerability
+// gates, assembled into one model a reviewer outside the project can read. Everything here is derived from
+// values already read.
+import { asRecord, readKey } from './json-shapes.js';
+import { LICENSE_POLICY, licenseClassOf } from './license-allowlist.js';
+import { coordinateOf } from './license-inventory.js';
+import { SEVERITY_ORDER, } from './vulnerability-policy.js';
+const byText = (left, right) => left.localeCompare(right);
+const byName = (left, right) => left.name.localeCompare(right.name) || left.version.localeCompare(right.version);
+// A directory dependency has no version, so it is identified by its name alone.
+const coordinatesOf = (entry) => entry.versions.length === 0
+    ? [entry.name]
+    : entry.versions.map((version) => coordinateOf(entry.name, version));
+const rowsOf = (entry) => (entry.versions.length === 0 ? [''] : entry.versions).map((version) => ({ version, entry }));
+const reportPackages = (input) => {
+    const production = new Set(input.production.flatMap((entry) => coordinatesOf(entry)));
+    const direct = new Set(input.directNames);
+    return input.packages
+        .flatMap((entry) => rowsOf(entry))
+        .map(({ version, entry }) => ({
+        name: entry.name,
+        version,
+        license: entry.license,
+        licenseClass: licenseClassOf(entry.license),
+        isProduction: production.has(version.length > 0 ? coordinateOf(entry.name, version) : entry.name),
+        isDirect: direct.has(entry.name),
+        homepage: entry.homepage,
+    }))
+        .toSorted(byName);
+};
+const countLicenses = (packages) => [...new Set(packages.map((row) => row.license))]
+    .map((license) => ({
+    license,
+    licenseClass: licenseClassOf(license),
+    count: packages.filter((row) => row.license === license).length,
+}))
+    .toSorted((left, right) => right.count - left.count || left.license.localeCompare(right.license));
+const countClasses = (packages) => ({
+    permissive: packages.filter((row) => row.licenseClass === 'permissive').length,
+    'weak-copyleft': packages.filter((row) => row.licenseClass === 'weak-copyleft').length,
+    refused: packages.filter((row) => row.licenseClass === 'refused').length,
+});
+// Every reported advisory, counted by severity from the most severe down, so the summary reads the way a
+// reviewer triages. A severity the scale does not know is counted under its own name rather than dropped.
+const countSeverities = (classification) => {
+    const all = [
+        ...classification.unsuppressed,
+        ...classification.suppressed.map((entry) => entry.advisory),
+        ...classification.belowThreshold,
+    ];
+    const known = SEVERITY_ORDER.toReversed();
+    const unknown = [
+        ...new Set(all
+            .map((advisory) => advisory.severity.toLowerCase())
+            .filter((severity) => !known.includes(severity))),
+    ];
+    return [...unknown, ...known].map((severity) => ({
+        severity,
+        count: all.filter((advisory) => advisory.severity.toLowerCase() === severity).length,
+    }));
+};
+// A line that opens a list item or a copyright statement starts a new line of its own, and so does the line
+// after a heading or a ruled separator. Every other line of a paragraph continues the one before it:
+// licence files are wrapped at a fixed width for a terminal, and keeping those breaks in a proportional
+// column leaves every line ragged. A copyright statement names a year, (c) or the sign, so a sentence that
+// merely wraps before "Copyright Holder" continues.
+const LIST_ITEM = /^(?:[-*+\u{2022}]\s|\(?(?:\d{1,3}|[a-z]|[ivx]{2,4})[.)]\s)/iu;
+const COPYRIGHT_LINE = /^(?:copyright\s+(?:\(c\)|\u{A9}|\d{4})|\u{A9})/iu;
+const PARAGRAPH_BREAK = /\n[ \t]*\n/u;
+// Licence files bundled into a Markdown document quote each licence (`> `) and title it with a heading
+// (`## name`), and list the package's facts as `License: MIT` lines. The markers are markup, not words.
+const QUOTE_MARKERS = /^[ \t]*(?:>[ \t]?)+/u;
+const MARKDOWN_HEADING = /^#{1,6}[ \t]+/u;
+const FIELD_LINE = /^[A-Z][A-Za-z]{1,20}(?: [A-Za-z]{1,20})?:[ \t]/u;
+const SEPARATOR = /^[-=_*~]{3,}$/u;
+const HEADING_LENGTH = 40;
+const LOWERCASE = /\p{Ll}/u;
+const LETTER = /\p{L}/u;
+const HYPHENATED_END = /\p{L}-$/u;
+const LOWERCASE_START = /^\p{Ll}/u;
+// A short line with letters and no lowercase one is a heading such as PREAMBLE, not the start of a sentence.
+const isHeading = (line) => line.length < HEADING_LENGTH && LETTER.test(line) && !LOWERCASE.test(line);
+// The line itself announces something new: a list item, a copyright statement, a field, a heading, a rule.
+const opensLine = (line) => LIST_ITEM.test(line) ||
+    COPYRIGHT_LINE.test(line) ||
+    FIELD_LINE.test(line) ||
+    MARKDOWN_HEADING.test(line) ||
+    SEPARATOR.test(line);
+// The line before it stands alone, so nothing continues it: a field, a rule, a heading.
+const endsLine = (previous) => FIELD_LINE.test(previous) || SEPARATOR.test(previous) || MARKDOWN_HEADING.test(previous) || isHeading(previous);
+const startsLine = (previous, line) => opensLine(line) || endsLine(previous);
+const joinLines = (lines, line) => {
+    const previous = lines.at(-1);
+    if (previous === undefined || startsLine(previous, line)) {
+        return [...lines, line];
+    }
+    // A word broken at a hyphen is rejoined without a space, so `non-` and `exclusive` read `non-exclusive`.
+    const separator = HYPHENATED_END.test(previous) && LOWERCASE_START.test(line) ? '' : ' ';
+    return [...lines.slice(0, -1), `${previous}${separator}${line}`];
+};
+/**
+ * Reflow a licence file for a proportional column. Words and their order are unchanged; only the
+ * fixed-width line breaks inside a paragraph are removed, and runs of spaces collapse to one.
+ * @param text the licence file as shipped.
+ * @returns the text with paragraphs separated by a blank line and kept line breaks by a newline.
+ */
+export const reflowLicenseText = (text) => text
+    .replaceAll('\r\n', '\n')
+    .split('\n')
+    .map((line) => line.replace(QUOTE_MARKERS, ''))
+    .join('\n')
+    .trim()
+    .split(PARAGRAPH_BREAK)
+    .map((block) => block
+    .split('\n')
+    .map((line) => line.trim().replaceAll(/[ \t]+/gu, ' '))
+    .filter((line) => line.length > 0)
+    .reduce((lines, line) => joinLines(lines, line), [])
+    .join('\n'))
+    .filter((block) => block.length > 0)
+    .join('\n\n');
+// Attribution obligations attach to what is distributed, so the notices cover the production graph.
+// Identical texts are printed once; most permissive licences differ only in their copyright line, so
+// the grouping is by the reflowed text rather than by the licence name.
+const groupNotices = (notices, distributed) => {
+    const entries = notices
+        .filter((notice) => distributed.has(notice.coordinate))
+        .flatMap((notice) => notice.files.map((file) => ({
+        text: reflowLicenseText(file.text),
+        fileName: file.name,
+        coordinate: notice.coordinate,
+    })));
+    return [...new Set(entries.map((entry) => entry.text))]
+        .map((text) => {
+        const sharing = entries.filter((entry) => entry.text === text);
+        return {
+            text,
+            fileNames: [...new Set(sharing.map((entry) => entry.fileName))].toSorted(byText),
+            coordinates: [...new Set(sharing.map((entry) => entry.coordinate))].toSorted(byText),
+        };
+    })
+        .toSorted((left, right) => (left.coordinates[0] ?? '').localeCompare(right.coordinates[0] ?? ''));
+};
+const coordinateOfRow = (row) => row.version.length > 0 ? coordinateOf(row.name, row.version) : row.name;
+const draftReasonsOf = (input, isCompliant) => [
+    ...(input.source.isDirty ? ['The working tree has uncommitted changes, so no commit describes this source.'] : []),
+    ...(isCompliant ? [] : ["The dependencies don't satisfy the policy this report states."]),
+];
+/**
+ * Assemble the compliance report.
+ * @param input the inventory, the vulnerability classification and the provenance already read.
+ * @returns the report model the renderer prints.
+ */
+export const buildComplianceReport = (input) => {
+    const packages = reportPackages(input);
+    const refused = packages.filter((row) => row.licenseClass === 'refused');
+    const isCompliant = refused.length === 0 &&
+        input.vulnerabilities.unsuppressed.length === 0 &&
+        input.vulnerabilities.deadEntries.length === 0;
+    const distributed = new Set(packages
+        .filter((row) => row.isProduction)
+        .map((row) => coordinateOfRow(row)));
+    const shipped = new Set(input.notices
+        .filter((notice) => notice.files.length > 0)
+        .map((notice) => notice.coordinate));
+    return {
+        projectName: input.projectName,
+        projectDescription: input.projectDescription,
+        source: input.source,
+        generatedAt: input.generatedAt,
+        harnessVersion: input.harnessVersion,
+        isCompliant,
+        draftReasons: draftReasonsOf(input, isCompliant),
+        packages,
+        productionCount: packages.filter((row) => row.isProduction).length,
+        directCount: packages.filter((row) => row.isDirect).length,
+        licenseCounts: countLicenses(packages),
+        classCounts: countClasses(packages),
+        copyleft: packages.filter((row) => row.licenseClass === 'weak-copyleft'),
+        refused,
+        policy: LICENSE_POLICY,
+        vulnerabilities: input.vulnerabilities,
+        severityCounts: countSeverities(input.vulnerabilities),
+        advisoryRecords: input.advisoryRecords,
+        auditedAt: input.auditedAt,
+        sbom: input.sbom,
+        notices: groupNotices(input.notices, distributed),
+        withoutNotice: [...distributed].filter((coordinate) => !shipped.has(coordinate)).toSorted(byText),
+    };
+};
+/** Where the compliance report is written unless the command names another directory. */
+export const DEFAULT_REPORT_OUTPUT = 'dist/compliance';
+/** The file name every compliance report starts with, which is also how a stale one is recognised. */
+export const REPORT_FILE_PREFIX = 'oss-compliance-report-';
+const SHORT_COMMIT_LENGTH = 12;
+const NOT_A_NAME_CHARACTER = /[^a-z0-9]+/u;
+/**
+ * The report's file name without extension: the project and the commit it describes.
+ * @param projectName the root manifest's name, which may be scoped.
+ * @param commit the source commit.
+ * @returns a name safe on every filesystem.
+ */
+export const reportFileStem = (projectName, commit) => {
+    const name = projectName
+        .toLowerCase()
+        .split(NOT_A_NAME_CHARACTER)
+        .filter((part) => part.length > 0)
+        .join('-');
+    return `${REPORT_FILE_PREFIX}${name.length > 0 ? name : 'project'}-${commit.slice(0, SHORT_COMMIT_LENGTH)}`;
+};
+const OUTPUT_OPTION = '--output';
+/**
+ * Parse the compliance report command grammar: no argument, or one output directory.
+ * @param arguments_ the arguments after the command name.
+ * @returns the output directory, or undefined when the arguments are not that grammar.
+ */
+export const parseComplianceReportArguments = (arguments_) => {
+    if (arguments_.length === 0) {
+        return { output: DEFAULT_REPORT_OUTPUT };
+    }
+    const [option, value = '', ...extra] = arguments_;
+    if (option !== OUTPUT_OPTION || extra.length > 0) {
+        return undefined;
+    }
+    return value.length > 0 && !value.startsWith('-') ? { output: value } : undefined;
+};
+const DECLARING_GROUPS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+    'peerDependencies',
+];
+/**
+ * The packages any workspace manifest declares, which is what makes a dependency direct.
+ * @param manifests every workspace manifest, as parsed JSON.
+ * @returns the declared package names, each once.
+ */
+export const directDependencyNames = (manifests) => [
+    ...new Set(manifests.flatMap((manifest) => DECLARING_GROUPS.flatMap((group) => Object.keys(asRecord(readKey(manifest, group)))))),
+];
+//# sourceMappingURL=compliance-report.js.map

package/dist/compliance-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report.js","sourceRoot":"","sources":["../src/compliance-report.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,2GAA2G;AAC3G,uBAAuB;AACvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAqB,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAyB,MAAM,wBAAwB,CAAA;AAC5E,OAAO,EAEL,cAAc,GAGf,MAAM,2BAA2B,CAAA;AA0GlC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;AAEjF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,KAAoB,EAAU,EAAE,CACnE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAElF,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,KAAuB,EAAqB,EAAE,CACnE,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;IACzB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACd,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AAExF,MAAM,MAAM,GAAG,CAAC,KAAuB,EAA6E,EAAE,CACpH,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AAEtG,MAAM,cAAc,GAAG,CAAC,KAA4B,EAA4B,EAAE;IAChF,MAAM,UAAU,GAAwB,IAAI,GAAG,CAC7C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAuB,EAAqB,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAC/F,CAAA;IACD,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAC,QAAQ;SAClB,OAAO,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACnD,GAAG,CACF,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAiB,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjG,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CACH;SACA,QAAQ,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,QAAkC,EAA2B,EAAE,CACpF,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAkB,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KACpE,GAAG,CACF,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC;IAClC,OAAO;IACP,YAAY,EAAE,cAAc,CAAC,OAAO,CAAC;IACrC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM;CACxF,CAAC,CACH;KACA,QAAQ,CACP,CAAC,IAAkB,EAAE,KAAmB,EAAU,EAAE,CAClD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CACxE,CAAA;AAEL,MAAM,YAAY,GAAG,CAAC,QAAkC,EAA0C,EAAE,CAAC,CAAC;IACpG,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,MAAM;IACtG,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,eAAe,CAAC,CAAC,MAAM;IAC9G,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,MAAM;CACjG,CAAC,CAAA;AAEF,yGAAyG;AACzG,0GAA0G;AAC1G,MAAM,eAAe,GAAG,CAAC,cAA2C,EAA4B,EAAE;IAChG,MAAM,GAAG,GAAwB;QAC/B,GAAG,cAAc,CAAC,YAAY;QAC9B,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAyB,EAAY,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;QACzF,GAAG,cAAc,CAAC,cAAc;KACjC,CAAA;IACD,MAAM,KAAK,GAAsB,cAAc,CAAC,UAAU,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAsB;QACjC,GAAG,IAAI,GAAG,CACR,GAAG;aACA,GAAG,CAAC,CAAC,QAAkB,EAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;aACpE,MAAM,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CACpE;KACF,CAAA;IACD,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAC/B,CAAC,QAAgB,EAAiB,EAAE,CAAC,CAAC;QACpC,QAAQ;QACR,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAkB,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,MAAM;KACxG,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED,4GAA4G;AAC5G,qGAAqG;AACrG,wGAAwG;AACxG,2GAA2G;AAC3G,oDAAoD;AACpD,MAAM,SAAS,GAAW,8DAA8D,CAAA;AACxF,MAAM,cAAc,GAAW,kDAAkD,CAAA;AACjF,MAAM,eAAe,GAAW,aAAa,CAAA;AAC7C,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,aAAa,GAAW,sBAAsB,CAAA;AACpD,MAAM,gBAAgB,GAAW,gBAAgB,CAAA;AACjD,MAAM,UAAU,GAAW,iDAAiD,CAAA;AAC5E,MAAM,SAAS,GAAW,gBAAgB,CAAA;AAC1C,MAAM,cAAc,GAAW,EAAE,CAAA;AACjC,MAAM,SAAS,GAAW,SAAS,CAAA;AACnC,MAAM,MAAM,GAAW,QAAQ,CAAA;AAC/B,MAAM,cAAc,GAAW,UAAU,CAAA;AACzC,MAAM,eAAe,GAAW,UAAU,CAAA;AAE1C,6GAA6G;AAC7G,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEvH,2GAA2G;AAC3G,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;IACpB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;IACzB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEtB,wFAAwF;AACxF,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEjH,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAErG,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAqB,EAAE;IAC9E,MAAM,QAAQ,GAAuB,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,yGAAyG;IACzG,MAAM,SAAS,GAAW,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IAChG,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC,CAAA;AAClE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAU,EAAE,CACxD,IAAI;KACD,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;KACxB,KAAK,CAAC,IAAI,CAAC;KACX,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;KAC9D,IAAI,CAAC,IAAI,CAAC;KACV,IAAI,EAAE;KACN,KAAK,CAAC,eAAe,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAC7B,KAAK;KACF,KAAK,CAAC,IAAI,CAAC;KACX,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;KACtE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;KAClD,MAAM,CAAC,CAAC,KAAwB,EAAE,IAAY,EAAqB,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;KACjG,IAAI,CAAC,IAAI,CAAC,CACd;KACA,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;KACpD,IAAI,CAAC,MAAM,CAAC,CAAA;AAQjB,oGAAoG;AACpG,qGAAqG;AACrG,wEAAwE;AACxE,MAAM,YAAY,GAAG,CAAC,OAAkC,EAAE,WAAgC,EAA0B,EAAE;IACpH,MAAM,OAAO,GAA2B,OAAO;SAC5C,MAAM,CAAC,CAAC,MAAsB,EAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SAC/E,OAAO,CAAC,CAAC,MAAsB,EAA0B,EAAE,CAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,CAAC,IAAgB,EAAe,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CACH,CACF,CAAA;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;SACzE,GAAG,CAAC,CAAC,IAAY,EAAe,EAAE;QACjC,MAAM,OAAO,GAA2B,OAAO,CAAC,MAAM,CAAC,CAAC,KAAkB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAC5G,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrG,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1G,CAAA;IACH,CAAC,CAAC;SACD,QAAQ,CAAC,CAAC,IAAiB,EAAE,KAAkB,EAAU,EAAE,CAC1D,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CACtE,CAAA;AACL,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAkB,EAAU,EAAE,CACrD,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;AAEzE,MAAM,cAAc,GAAG,CAAC,KAA4B,EAAE,WAAoB,EAAqB,EAAE,CAAC;IAChG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC;CAC1F,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAA4B,EAAoB,EAAE;IACtF,MAAM,QAAQ,GAA6B,cAAc,CAAC,KAAK,CAAC,CAAA;IAChE,MAAM,OAAO,GAA6B,QAAQ,CAAC,MAAM,CACvD,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAChE,CAAA;IACD,MAAM,WAAW,GACf,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/C,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAA;IAChD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAC9C,QAAQ;SACL,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;SACzD,GAAG,CAAC,CAAC,GAAkB,EAAU,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAC7D,CAAA;IACD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,KAAK,CAAC,OAAO;SACV,MAAM,CAAC,CAAC,MAAsB,EAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,MAAsB,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAC9D,CAAA;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW;QACX,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC;QAChD,QAAQ;QACR,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM;QAC1F,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM;QAClF,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC;QACtC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC;QACnC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAkB,EAAW,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,eAAe,CAAC;QAChG,OAAO;QACP,MAAM,EAAE,cAAc;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC;QACtD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;QACjD,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;KACnH,CAAA;AACH,CAAC,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAW,iBAAiB,CAAA;AAE9D,sGAAsG;AACtG,MAAM,CAAC,MAAM,kBAAkB,GAAW,wBAAwB,CAAA;AAElE,MAAM,mBAAmB,GAAW,EAAE,CAAA;AACtC,MAAM,oBAAoB,GAAW,aAAa,CAAA;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAmB,EAAE,MAAc,EAAU,EAAE;IAC5E,MAAM,IAAI,GAAW,WAAW;SAC7B,WAAW,EAAE;SACb,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,EAAE,CAAA;AAC7G,CAAC,CAAA;AAED,MAAM,aAAa,GAAW,UAAU,CAAA;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,UAA6B,EACY,EAAE;IAC3C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,UAAU,CAAA;IACjD,IAAI,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAsB;IAC1C,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;CACnB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAA6B,EAAqB,EAAE,CAAC;IACzF,GAAG,IAAI,GAAG,CACR,SAAS,CAAC,OAAO,CAAC,CAAC,QAAiB,EAAqB,EAAE,CACzD,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAa,EAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAChH,CACF;CACF,CAAA"}

package/dist/index.d.ts

@@ -15,6 +15,10 @@ export * from './bundle-budget.js';
 export * from './checkov-check.js';
 export * from './checkov-policy.js';
 export * from './commit-message.js';
+export * from './compliance-report.js';
+export * from './compliance-report-assets.js';
+export * from './compliance-report-html.js';
+export { contentsPages } from './compliance-report-outline.js';
 export * from './config-references.js';
 export * from './container-failure.js';
 export * from './container-files.js';
@@ -42,6 +46,7 @@ export * from './layout-defects.js';
 export * from './layout-snapshot.js';
 export * from './layout-text.js';
 export * from './license-allowlist.js';
+export * from './license-inventory.js';
 export * from './network-policy.js';
 export * from './oxlint-policy.js';
 export * from './oxlint-report.js';
@@ -55,6 +60,7 @@ export * from './payload-defaults.js';
 export * from './payload-policy.js';
 export * from './payload-security.js';
 export * from './payload-source.js';
+export * from './pdf-outline.js';
 export * from './production-server.js';
 export * from './relationship-cleanup.js';
 export * from './release-age.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -19,6 +19,10 @@ export * from './bundle-budget.js';
 export * from './checkov-check.js';
 export * from './checkov-policy.js';
 export * from './commit-message.js';
+export * from './compliance-report.js';
+export * from './compliance-report-assets.js';
+export * from './compliance-report-html.js';
+export { contentsPages } from './compliance-report-outline.js';
 export * from './config-references.js';
 export * from './container-failure.js';
 export * from './container-files.js';
@@ -46,6 +50,7 @@ export * from './layout-defects.js';
 export * from './layout-snapshot.js';
 export * from './layout-text.js';
 export * from './license-allowlist.js';
+export * from './license-inventory.js';
 export * from './network-policy.js';
 export * from './oxlint-policy.js';
 export * from './oxlint-report.js';
@@ -59,6 +64,7 @@ export * from './payload-defaults.js';
 export * from './payload-policy.js';
 export * from './payload-security.js';
 export * from './payload-source.js';
+export * from './pdf-outline.js';
 export * from './production-server.js';
 export * from './relationship-cleanup.js';
 export * from './release-age.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,6BAA6B,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAC9D,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/license-allowlist.d.ts

@@ -7,6 +7,20 @@
  * @returns whether the policy permits it.
  */
 export declare const isLicenseAllowed: (expression: string) => boolean;
+/** How the policy admits a declared licence. */
+export type LicenseClass = 'permissive' | 'weak-copyleft' | 'refused';
+/**
+ * Classify a declared licence by the least restrictive way the policy admits it. An expression that a
+ * permissive choice satisfies is permissive, even when a copyleft alternative is also offered.
+ * @param expression the declared licence.
+ * @returns the class the policy places it in.
+ */
+export declare const licenseClassOf: (expression: string) => LicenseClass;
+/** The license identifiers the policy admits, by group, for a reader of the policy. */
+export declare const LICENSE_POLICY: {
+    readonly permissive: readonly string[];
+    readonly weakCopyleft: readonly string[];
+};
 export interface LicensedPackage {
     readonly name: string;
     readonly license: string;