@ploaness/governance 1.7.0 → 1.8.0

package/dist/license-allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license-allowlist.d.ts","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAmKA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,YAAY,MAAM,KAAG,OAQrD,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAGD,eAAO,MAAM,qBAAqB,GAAI,UAAU,SAAS,eAAe,EAAE,KAAG,SAAS,eAAe,EACP,CAAA"}
+{"version":3,"file":"license-allowlist.d.ts","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAoLA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,YAAY,MAAM,KAAG,OAAiE,CAAA;AAEvH,gDAAgD;AAChD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,eAAe,GAAG,SAAS,CAAA;AAErE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,YAAY,MAAM,KAAG,YAKnD,CAAA;AAED,uFAAuF;AACvF,eAAO,MAAM,cAAc,EAAE;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACiB,CAAA;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAGD,eAAO,MAAM,qBAAqB,GAAI,UAAU,SAAS,eAAe,EAAE,KAAG,SAAS,eAAe,EACP,CAAA"}

package/dist/license-allowlist.js

@@ -73,12 +73,14 @@ const ALLOWED = new Set([...PERMISSIVE, ...WEAK_COPYLEFT]);
 // least three ways. The allowlist is matched on a folded id so a casing difference is not a licence
 // decision. A `WITH` exception (`GPL-2.0 WITH Classpath-exception-2.0`) names the same licence plus a
 // grant, so the licence half decides; a `+` suffix means "or later", which is the same licence too.
-const ALLOWED_FOLDED = new Set([...ALLOWED].map((id) => id.toLowerCase()));
+const folded = (ids) => new Set(ids.map((id) => id.toLowerCase()));
+const ALLOWED_FOLDED = folded([...ALLOWED]);
+const PERMISSIVE_FOLDED = folded(PERMISSIVE);
 // Anchored on a single space run rather than a nested quantifier: `\s+WITH\s+(?:\S.*)?$` backtracks
 // super-linearly on a long id, and an expression comes from a registry rather than from this repository.
 const WITH_EXCEPTION = /\sWITH\s[\s\S]*$/i;
 const OR_LATER = /\+$/;
-const isAllowedId = (id) => ALLOWED_FOLDED.has(id.trim().replace(WITH_EXCEPTION, '').replace(OR_LATER, '').toLowerCase());
+const acceptsIdIn = (accepted) => (id) => accepted.has(id.trim().replace(WITH_EXCEPTION, '').replace(OR_LATER, '').toLowerCase());
 // The operators, lowest precedence first. SPDX binds AND more tightly than OR, so a correct evaluator
 // splits on OR before AND - and the ONLY correct order is that one. Splitting on AND first, after
 // stripping the parentheses, turned `(MIT OR Apache-2.0) AND ISC` into the operands
@@ -132,6 +134,17 @@ const unwrap = (expression) => {
         ? unwrap(trimmed.slice(1, -1))
         : trimmed;
 };
+const matchesPolicy = (expression, isAccepted) => {
+    const clean = unwrap(expression);
+    const alternatives = splitOutside(clean, OR);
+    if (alternatives.length > 1) {
+        return alternatives.some((part) => matchesPolicy(part, isAccepted));
+    }
+    const conjuncts = splitOutside(clean, AND);
+    return conjuncts.length > 1
+        ? conjuncts.every((part) => matchesPolicy(part, isAccepted))
+        : isAccepted(clean);
+};
 /**
  * Evaluate an SPDX licence expression against the policy.
  *
@@ -140,15 +153,21 @@ const unwrap = (expression) => {
  * @param expression the declared licence, which may be a compound SPDX expression.
  * @returns whether the policy permits it.
  */
-export const isLicenseAllowed = (expression) => {
-    const clean = unwrap(expression);
-    const alternatives = splitOutside(clean, OR);
-    if (alternatives.length > 1) {
-        return alternatives.some((part) => isLicenseAllowed(part));
+export const isLicenseAllowed = (expression) => matchesPolicy(expression, acceptsIdIn(ALLOWED_FOLDED));
+/**
+ * Classify a declared licence by the least restrictive way the policy admits it. An expression that a
+ * permissive choice satisfies is permissive, even when a copyleft alternative is also offered.
+ * @param expression the declared licence.
+ * @returns the class the policy places it in.
+ */
+export const licenseClassOf = (expression) => {
+    if (matchesPolicy(expression, acceptsIdIn(PERMISSIVE_FOLDED))) {
+        return 'permissive';
     }
-    const conjuncts = splitOutside(clean, AND);
-    return conjuncts.length > 1 ? conjuncts.every((part) => isLicenseAllowed(part)) : isAllowedId(clean);
+    return isLicenseAllowed(expression) ? 'weak-copyleft' : 'refused';
 };
+/** The license identifiers the policy admits, by group, for a reader of the policy. */
+export const LICENSE_POLICY = { permissive: PERMISSIVE, weakCopyleft: WEAK_COPYLEFT };
 // Return the packages whose license is not permitted by policy; an empty array means a clean tree.
 export const findLicenseViolations = (packages) => packages.filter((package_) => !isLicenseAllowed(package_.license));
 //# sourceMappingURL=license-allowlist.js.map

package/dist/license-allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"license-allowlist.js","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,oGAAoG;AACpG,sEAAsE;AACtE,0EAA0E;AAE1E,6FAA6F;AAC7F,wGAAwG;AACxG,qFAAqF;AAErF,mFAAmF;AACnF,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,UAAU,GAAsB;IACpC,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,SAAS;IACT,eAAe;IACf,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,cAAc;IACd,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAA;AAED,gGAAgG;AAChG,8FAA8F;AAC9F,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,aAAa,GAAsB;IACvC,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,SAAS;CACV,CAAA;AAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC,CAAA;AAEvF,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC/G,oGAAoG;AACpG,yGAAyG;AACzG,MAAM,cAAc,GAAW,mBAAmB,CAAA;AAClD,MAAM,QAAQ,GAAW,KAAK,CAAA;AAE9B,MAAM,WAAW,GAAG,CAAC,EAAU,EAAW,EAAE,CAC1C,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAE/F,sGAAsG;AACtG,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,EAAE,GAAW,MAAM,CAAA;AACzB,MAAM,GAAG,GAAW,OAAO,CAAA;AAQ3B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE;IAC7D,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,KAAK,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC9C,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAoB,EAAE;AACzD,wEAAwE;AACxE,sFAAsF;AACtF,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CACd,CAAC,KAAuB,EAAE,SAAiB,EAAoB,EAAE;IAC/D,MAAM,KAAK,GAAW,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC,EACD,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CACxB,CAAA;AAEH,iGAAiG;AACjG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AAEvE,sGAAsG;AACtG,qGAAqG;AACrG,kFAAkF;AAClF,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE,CAC9E,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KACpD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAEpF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE;IAC/E,MAAM,MAAM,GAAsB,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,IAAI,GAAsB,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC/E,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CACpG,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,qGAAqG;AACrG,8FAA8F;AAC9F,+FAA+F;AAC/F,uGAAuG;AACvG,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE;IAClD,MAAM,IAAI,GAAqB,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE;IAC5C,MAAM,OAAO,GAAW,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAW,EAAE;IAC9D,MAAM,KAAK,GAAW,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,YAAY,GAAsB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,SAAS,GAAsB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AACvH,CAAC,CAAA;AAOD,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAoC,EAA8B,EAAE,CACxG,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAyB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"license-allowlist.js","sourceRoot":"","sources":["../src/license-allowlist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,oGAAoG;AACpG,sEAAsE;AACtE,0EAA0E;AAE1E,6FAA6F;AAC7F,wGAAwG;AACxG,qFAAqF;AAErF,mFAAmF;AACnF,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,UAAU,GAAsB;IACpC,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,cAAc;IACd,cAAc;IACd,cAAc;IACd,SAAS;IACT,eAAe;IACf,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,cAAc;IACd,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;CACP,CAAA;AAED,gGAAgG;AAChG,8FAA8F;AAC9F,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,EAAE;AACF,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,aAAa,GAAsB;IACvC,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,UAAU;IACV,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,SAAS;CACV,CAAA;AAED,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,UAAU,EAAE,GAAG,aAAa,CAAC,CAAC,CAAA;AAEvF,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,MAAM,GAAG,CAAC,GAAsB,EAAuB,EAAE,CAC7D,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC5D,MAAM,cAAc,GAAwB,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAA;AAChE,MAAM,iBAAiB,GAAwB,MAAM,CAAC,UAAU,CAAC,CAAA;AACjE,oGAAoG;AACpG,yGAAyG;AACzG,MAAM,cAAc,GAAW,mBAAmB,CAAA;AAClD,MAAM,QAAQ,GAAW,KAAK,CAAA;AAE9B,MAAM,WAAW,GACf,CAAC,QAA6B,EAAE,EAAE,CAClC,CAAC,EAAU,EAAW,EAAE,CACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AAE3F,sGAAsG;AACtG,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,EAAE,GAAW,MAAM,CAAA;AACzB,MAAM,GAAG,GAAW,OAAO,CAAA;AAQ3B,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE;IAC7D,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,KAAK,GAAG,CAAC,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC9C,CAAC,CAAA;AAED,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAoB,EAAE;AACzD,wEAAwE;AACxE,sFAAsF;AACtF,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CACd,CAAC,KAAuB,EAAE,SAAiB,EAAoB,EAAE;IAC/D,MAAM,KAAK,GAAW,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACvD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC,EACD,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CACxB,CAAA;AAEH,iGAAiG;AACjG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AAEvE,sGAAsG;AACtG,qGAAqG;AACrG,kFAAkF;AAClF,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE,CAC9E,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;KACpD,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAEpF,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,QAAgB,EAAqB,EAAE;IAC/E,MAAM,MAAM,GAAsB,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,IAAI,GAAsB,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAC/E,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CACpG,CAAA;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,qGAAqG;AACrG,8FAA8F;AAC9F,+FAA+F;AAC/F,uGAAuG;AACvG,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE;IAClD,MAAM,IAAI,GAAqB,eAAe,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAA;AAC9C,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAU,EAAE;IAC5C,MAAM,OAAO,GAAW,UAAU,CAAC,IAAI,EAAE,CAAA;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAA;AACb,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,UAAkB,EAAE,UAAmC,EAAW,EAAE;IACzF,MAAM,KAAK,GAAW,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,YAAY,GAAsB,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;IACtF,CAAC;IACD,MAAM,SAAS,GAAsB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAkB,EAAW,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAA;AAKvH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAgB,EAAE;IACjE,IAAI,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC,CAAA;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAGvB,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAO3D,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAoC,EAA8B,EAAE,CACxG,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAyB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/dist/license-inventory.d.ts

@@ -0,0 +1,25 @@
+/** One package of the resolved set as the licence inventory reports it. */
+export interface InventoryPackage {
+    readonly name: string;
+    /** Every installed version. A directory dependency has none, because pnpm reports its version as null. */
+    readonly versions: readonly string[];
+    readonly license: string;
+    /** The installed package directories, where the licence files the package ships are found. */
+    readonly paths: readonly string[];
+    readonly homepage: string | undefined;
+}
+/**
+ * Read the stdout of `pnpm licenses list --json`: packages grouped by their declared licence.
+ * @param json the command's stdout.
+ * @returns every reported package, or undefined when the text is not that inventory.
+ */
+export declare const parseLicenseInventory: (json: string) => readonly InventoryPackage[] | undefined;
+/** The coordinate a package version is identified by across the inventory, the SBOM and the report. */
+export declare const coordinateOf: (name: string, version: string) => string;
+/**
+ * Index the declared licence of every installed package version.
+ * @param packages the parsed inventory.
+ * @returns the licence by `name@version`; a directory dependency without a version is absent.
+ */
+export declare const licensesByCoordinate: (packages: readonly InventoryPackage[]) => ReadonlyMap<string, string>;
+//# sourceMappingURL=license-inventory.d.ts.map

package/dist/license-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-inventory.d.ts","sourceRoot":"","sources":["../src/license-inventory.ts"],"names":[],"mappings":"AAGA,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0GAA0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CACtC;AAoBD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,SAAS,gBAAgB,EAAE,GAAG,SASlF,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,MAA8B,CAAA;AAE3F;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,SAAS,gBAAgB,EAAE,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAQpG,CAAA"}

package/dist/license-inventory.js

@@ -0,0 +1,41 @@
+// The licence inventory pnpm reports for the resolved set, read into one shape every consumer shares.
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+const strings = (raw) => isArray(raw) ? raw.filter((entry) => typeof entry === 'string') : [];
+const asInventoryPackage = (raw, group) => {
+    const entry = asRecord(raw);
+    const homepage = asText(entry['homepage']);
+    // The group key is the licence pnpm grouped the entry under; the entry repeats it, and the entry wins
+    // when both are present because it is the value read from the package itself.
+    const license = asText(entry['license']);
+    return {
+        name: asText(entry['name']),
+        versions: strings(entry['versions']),
+        license: license.length > 0 ? license : group,
+        paths: strings(entry['paths']),
+        homepage: homepage.length > 0 ? homepage : undefined,
+    };
+};
+/**
+ * Read the stdout of `pnpm licenses list --json`: packages grouped by their declared licence.
+ * @param json the command's stdout.
+ * @returns every reported package, or undefined when the text is not that inventory.
+ */
+export const parseLicenseInventory = (json) => {
+    const inventory = parseJsonc(json).value;
+    if (!isRecord(inventory) || isArray(inventory)) {
+        return undefined;
+    }
+    return Object.entries(inventory).flatMap(([group, entries]) => (isArray(entries) ? entries : []).map((entry) => asInventoryPackage(entry, group)));
+};
+/** The coordinate a package version is identified by across the inventory, the SBOM and the report. */
+export const coordinateOf = (name, version) => `${name}@${version}`;
+/**
+ * Index the declared licence of every installed package version.
+ * @param packages the parsed inventory.
+ * @returns the licence by `name@version`; a directory dependency without a version is absent.
+ */
+export const licensesByCoordinate = (packages) => new Map(packages.flatMap((entry) => entry.versions.map((version) => [
+    coordinateOf(entry.name, version),
+    entry.license,
+])));
+//# sourceMappingURL=license-inventory.js.map

package/dist/license-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-inventory.js","sourceRoot":"","sources":["../src/license-inventory.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAalF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAqB,EAAE,CAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEhG,MAAM,kBAAkB,GAAG,CAAC,GAAY,EAAE,KAAa,EAAoB,EAAE;IAC3E,MAAM,KAAK,GAA4B,QAAQ,CAAC,GAAG,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAW,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAClD,sGAAsG;IACtG,8EAA8E;IAC9E,MAAM,OAAO,GAAW,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IAChD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACrD,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAA2C,EAAE;IAC7F,MAAM,SAAS,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CACtC,CAAC,CAAC,KAAK,EAAE,OAAO,CAA6B,EAA+B,EAAE,CAC5E,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAc,EAAoB,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAChH,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAqC,EAA+B,EAAE,CACzG,IAAI,GAAG,CACL,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAuB,EAA0C,EAAE,CACnF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAA6B,EAAE,CAAC;IACjE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;IACjC,KAAK,CAAC,OAAO;CACd,CAAC,CACH,CACF,CAAA"}

package/dist/pdf-outline.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Map each bookmark title of a PDF to the page it points at.
+ * @param pdf the PDF bytes, read as Latin-1 text.
+ * @returns the 1-based page number by bookmark title; empty when the structure is not recognised.
+ */
+export declare const outlinePages: (pdf: string) => ReadonlyMap<string, number>;
+//# sourceMappingURL=pdf-outline.d.ts.map

package/dist/pdf-outline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-outline.d.ts","sourceRoot":"","sources":["../src/pdf-outline.ts"],"names":[],"mappings":"AAmEA;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAqBpE,CAAA"}

package/dist/pdf-outline.js

@@ -0,0 +1,69 @@
+// Read the page each bookmark of a Chromium-printed PDF points at. The browser cannot number a table of
+// contents while it paginates, so the report is printed once, its bookmarks are read here, and the
+// numbers are written into the contents before the final print. Only the uncompressed object syntax
+// Chromium writes is read; anything else yields no numbers rather than wrong ones.
+const OBJECT_HEADER = /(\d{1,10}) 0 obj\b/u;
+const KIDS = /\/Kids\s*\[([^\]]*)\]/u;
+const REFERENCE = /(\d{1,10}) 0 R\b/gu;
+const CATALOG = /\/Type\s{0,4}\/Catalog\b/u;
+const PAGES_ROOT = /\/Pages\s{1,4}(\d{1,10}) 0 R/u;
+const TITLE = /\/Title\s*(\((?:\\.|[^\\)])*\)|<[0-9A-Fa-f\s]*>)/u;
+const DESTINATION = /\/Dest\s{0,4}\[\s{0,4}(\d{1,10}) 0 R/u;
+const OCTAL = /^[0-7]{1,3}/u;
+const ESCAPES = { n: '\n', r: '\r', t: '\t', b: '\b', f: '\f' };
+const HEX_RADIX = 16;
+const OCTAL_RADIX = 8;
+const UTF16_UNIT = 4;
+const BOM = 'FEFF';
+// Each object runs to its `endobj`. Its dictionary is what precedes any stream, which keeps the binary
+// stream data out of every pattern below.
+const objectsOf = (pdf) => new Map(pdf.split('endobj').flatMap((chunk) => {
+    const header = OBJECT_HEADER.exec(chunk);
+    if (header === null) {
+        return [];
+    }
+    const body = chunk.slice(header.index + header[0].length);
+    const stream = body.indexOf('stream');
+    return [[header[1] ?? '', stream === -1 ? body : body.slice(0, stream)]];
+}));
+const referencesIn = (text) => [...text.matchAll(REFERENCE)].map((match) => match[1] ?? '');
+// A page-tree node lists its kids; a kid without kids of its own is a page. Depth-first order is page order.
+const pagesUnder = (node, objects, seen) => {
+    const kids = KIDS.exec(objects.get(node) ?? '')?.[1];
+    if (kids === undefined || seen.has(node)) {
+        return [node];
+    }
+    const visited = new Set([...seen, node]);
+    return referencesIn(kids).flatMap((kid) => pagesUnder(kid, objects, visited));
+};
+const literalString = (body) => body.replaceAll(/\\([0-7]{1,3}|[\s\S])/gu, (_whole, escaped) => OCTAL.test(escaped) ? String.fromCodePoint(Number.parseInt(escaped, OCTAL_RADIX)) : (ESCAPES[escaped] ?? escaped));
+const hexString = (body) => {
+    const hex = body.replaceAll(/\s/gu, '').toUpperCase();
+    const units = hex.startsWith(BOM) ? hex.slice(BOM.length) : hex;
+    return Array.from({ length: Math.floor(units.length / UTF16_UNIT) }, (_unused, index) => String.fromCodePoint(Number.parseInt(units.slice(index * UTF16_UNIT, (index + 1) * UTF16_UNIT), HEX_RADIX))).join('');
+};
+const decodeTitle = (raw) => raw.startsWith('(') ? literalString(raw.slice(1, -1)) : hexString(raw.slice(1, -1));
+/**
+ * Map each bookmark title of a PDF to the page it points at.
+ * @param pdf the PDF bytes, read as Latin-1 text.
+ * @returns the 1-based page number by bookmark title; empty when the structure is not recognised.
+ */
+export const outlinePages = (pdf) => {
+    const objects = objectsOf(pdf);
+    const root = [...objects.values()]
+        .map((body) => (CATALOG.test(body) ? PAGES_ROOT.exec(body)?.[1] : undefined))
+        .find((found) => found !== undefined);
+    if (root === undefined) {
+        return new Map();
+    }
+    const order = new Map(pagesUnder(root, objects, new Set()).map((page, index) => [
+        page,
+        index + 1,
+    ]));
+    return new Map([...objects.values()].flatMap((body) => {
+        const title = TITLE.exec(body)?.[1];
+        const page = order.get(DESTINATION.exec(body)?.[1] ?? '');
+        return title === undefined || page === undefined ? [] : [[decodeTitle(title), page]];
+    }));
+};
+//# sourceMappingURL=pdf-outline.js.map

package/dist/pdf-outline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-outline.js","sourceRoot":"","sources":["../src/pdf-outline.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,mGAAmG;AACnG,oGAAoG;AACpG,mFAAmF;AAEnF,MAAM,aAAa,GAAW,qBAAqB,CAAA;AACnD,MAAM,IAAI,GAAW,wBAAwB,CAAA;AAC7C,MAAM,SAAS,GAAW,oBAAoB,CAAA;AAC9C,MAAM,OAAO,GAAW,2BAA2B,CAAA;AACnD,MAAM,UAAU,GAAW,+BAA+B,CAAA;AAC1D,MAAM,KAAK,GAAW,mDAAmD,CAAA;AACzE,MAAM,WAAW,GAAW,uCAAuC,CAAA;AACnE,MAAM,KAAK,GAAW,cAAc,CAAA;AACpC,MAAM,OAAO,GAAqC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AACjG,MAAM,SAAS,GAAW,EAAE,CAAA;AAC5B,MAAM,WAAW,GAAW,CAAC,CAAA;AAC7B,MAAM,UAAU,GAAW,CAAC,CAAA;AAC5B,MAAM,GAAG,GAAW,MAAM,CAAA;AAE1B,uGAAuG;AACvG,0CAA0C;AAC1C,MAAM,SAAS,GAAG,CAAC,GAAW,EAA+B,EAAE,CAC7D,IAAI,GAAG,CACL,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAa,EAA0C,EAAE;IACpF,MAAM,MAAM,GAA2B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,MAAM,GAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AAC1E,CAAC,CAAC,CACH,CAAA;AAEH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAqB,EAAE,CACvD,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAEvF,6GAA6G;AAC7G,MAAM,UAAU,GAAG,CACjB,IAAY,EACZ,OAAoC,EACpC,IAAyB,EACN,EAAE;IACrB,MAAM,IAAI,GAAuB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IACD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC7D,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAW,EAAqB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAC1G,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC,MAAc,EAAE,OAAe,EAAU,EAAE,CACrF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAClH,CAAA;AAEH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE;IACzC,MAAM,GAAG,GAAW,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC7D,MAAM,KAAK,GAAW,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,EAAE,CAAC,OAAgB,EAAE,KAAa,EAAU,EAAE,CAC/G,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC,CAC5G,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAW,EAAU,EAAE,CAC1C,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAErF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAA+B,EAAE;IACvE,MAAM,OAAO,GAAgC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAuB,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,IAAY,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;SACxG,IAAI,CAAC,CAAC,KAAyB,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAgC,IAAI,GAAG,CAChD,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,KAAa,EAA6B,EAAE,CAAC;QACnG,IAAI;QACJ,KAAK,GAAG,CAAC;KACV,CAAC,CACH,CAAA;IACD,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAA0C,EAAE;QACrF,MAAM,KAAK,GAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,IAAI,GAAuB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC7E,OAAO,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IACtF,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAA"}

package/dist/sbom-policy.d.ts

@@ -16,6 +16,23 @@ export interface SbomManifest {
 export declare const sbomInputProblems: (manifests: readonly SbomManifest[], lock: unknown, installed: unknown, workspace?: unknown) => readonly string[];
 /** Preserve declared per-workspace usage without guessing transitive usage from source imports. */
 export declare const sbomWithWorkspaceRoles: (bom: unknown, manifests: readonly SbomManifest[]) => unknown;
+/**
+ * The CycloneDX licence choice for one declared licence.
+ * @param license the licence the installed package declares.
+ * @returns an SPDX expression when the text is one, otherwise a named licence.
+ */
+export declare const cycloneLicenseOf: (license: string) => readonly unknown[];
+/**
+ * Record the licence each installed package declares on its SBOM component.
+ *
+ * The generator runs offline and without the installation, so it cannot read a licence itself. The
+ * values come from the same installed manifests the licence gate judges, which keeps the inventory and
+ * the verdict on one source; a component the installation does not report keeps whatever it carried.
+ * @param bom the generated CycloneDX document.
+ * @param licenses the declared licence by `name@version`.
+ * @returns the document with the licences recorded.
+ */
+export declare const sbomWithDeclaredLicenses: (bom: unknown, licenses: ReadonlyMap<string, string>) => unknown;
 /** Additional completeness checks after the generator's pinned CycloneDX schema validation. */
 export declare const sbomProblems: (bom: unknown) => readonly string[];
 //# sourceMappingURL=sbom-policy.d.ts.map

package/dist/sbom-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-policy.d.ts","sourceRoot":"","sources":["../src/sbom-policy.ts"],"names":[],"mappings":"AAIA,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAAI,YAAY,SAAS,MAAM,EAAE,KAAG,aAAa,GAAG,SAqBlF,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,MAWnD,CAAA;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAsDD,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,GAC5B,WAAW,SAAS,YAAY,EAAE,EAClC,MAAM,OAAO,EACb,WAAW,OAAO,EAClB,YAAW,OAAY,KACtB,SAAS,MAAM,EAkBjB,CAAA;AA4BD,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,GAAI,KAAK,OAAO,EAAE,WAAW,SAAS,YAAY,EAAE,KAAG,OAsBzF,CAAA;AAwBD,+FAA+F;AAC/F,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,SAAS,MAAM,EA+B1D,CAAA"}
+{"version":3,"file":"sbom-policy.d.ts","sourceRoot":"","sources":["../src/sbom-policy.ts"],"names":[],"mappings":"AAKA,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAAI,YAAY,SAAS,MAAM,EAAE,KAAG,aAAa,GAAG,SAqBlF,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,MAWnD,CAAA;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAsDD,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,GAC5B,WAAW,SAAS,YAAY,EAAE,EAClC,MAAM,OAAO,EACb,WAAW,OAAO,EAClB,YAAW,OAAY,KACtB,SAAS,MAAM,EAkBjB,CAAA;AA4BD,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,GAAI,KAAK,OAAO,EAAE,WAAW,SAAS,YAAY,EAAE,KAAG,OAsBzF,CAAA;AA8CD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,MAAM,KAAG,SAAS,OAAO,EAGlE,CAAA;AAoBD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,OAAO,EAAE,UAAU,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,OAQ9F,CAAA;AAwBD,+FAA+F;AAC/F,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,SAAS,MAAM,EA+B1D,CAAA"}

package/dist/sbom-policy.js

@@ -1,6 +1,7 @@
 // A release inventory is evidence only when its inputs, components and graph are accounted for.
 import path from 'node:path';
-import { asRecord, isArray, isRecord, readKey } from './json-shapes.js';
+import { asRecord, asText, isArray, isRecord, readKey } from './json-shapes.js';
+import { coordinateOf } from './license-inventory.js';
 const OPTION_PAIR = 2;
 /** Parse the deliberately small release-inventory command grammar. */
 export const parseSbomArguments = (arguments_) => {
@@ -135,6 +136,80 @@ export const sbomWithWorkspaceRoles = (bom, manifests) => {
         },
     };
 };
+// An SPDX expression is ids joined by AND, OR and WITH, optionally grouped. Anything else - `UNLICENSED`,
+// `SEE LICENSE IN LICENSE.md`, a free-text name - is recorded as a named licence, so the CycloneDX
+// document never claims an expression the declared text is not.
+const SPDX_ID = /^[A-Za-z0-9][A-Za-z0-9.-]*\+?$/u;
+const SPDX_SEPARATORS = /([()])|\s+/u;
+const SPDX_OPERATORS = new Set(['AND', 'OR', 'WITH']);
+const NOT_AN_EXPRESSION = new Set(['UNLICENSED', 'UNKNOWN', 'NONE', 'NOASSERTION']);
+const isOperand = (part) => SPDX_ID.test(part) && !SPDX_OPERATORS.has(part) && !NOT_AN_EXPRESSION.has(part.toUpperCase());
+const PAIR = 2;
+const depthChange = (part) => {
+    if (part === '(') {
+        return 1;
+    }
+    return part === ')' ? -1 : 0;
+};
+// Parentheses must balance, and between them the parts must alternate operand, operator, operand: four
+// words in a row are a sentence, not an expression.
+const isBalanced = (parts) => {
+    const depths = parts.reduce((seen, part) => [...seen, (seen.at(-1) ?? 0) + depthChange(part)], [0]);
+    return depths.every((depth) => depth >= 0) && depths.at(-1) === 0;
+};
+const isSpdxExpression = (license) => {
+    const parts = license
+        .split(SPDX_SEPARATORS)
+        .filter((part) => part !== undefined && part.length > 0);
+    const terms = parts.filter((part) => part !== '(' && part !== ')');
+    return (terms.length % PAIR === 1 &&
+        isBalanced(parts) &&
+        terms.every((part, index) => index % PAIR === 0 ? isOperand(part) : SPDX_OPERATORS.has(part)));
+};
+/**
+ * The CycloneDX licence choice for one declared licence.
+ * @param license the licence the installed package declares.
+ * @returns an SPDX expression when the text is one, otherwise a named licence.
+ */
+export const cycloneLicenseOf = (license) => {
+    const declared = license.trim();
+    return [isSpdxExpression(declared) ? { expression: declared } : { license: { name: declared } }];
+};
+const componentCoordinate = (component) => {
+    const group = asText(readKey(component, 'group'));
+    const name = asText(readKey(component, 'name'));
+    return coordinateOf(group.length > 0 ? `${group}/${name}` : name, asText(readKey(component, 'version')));
+};
+const withDeclaredLicense = (component, licenses) => {
+    const nested = readKey(component, 'components');
+    const license = licenses.get(componentCoordinate(component));
+    return {
+        ...asRecord(component),
+        ...(license !== undefined && license.trim().length > 0 && { licenses: cycloneLicenseOf(license) }),
+        ...(isArray(nested) && {
+            components: nested.map((child) => withDeclaredLicense(child, licenses)),
+        }),
+    };
+};
+/**
+ * Record the licence each installed package declares on its SBOM component.
+ *
+ * The generator runs offline and without the installation, so it cannot read a licence itself. The
+ * values come from the same installed manifests the licence gate judges, which keeps the inventory and
+ * the verdict on one source; a component the installation does not report keeps whatever it carried.
+ * @param bom the generated CycloneDX document.
+ * @param licenses the declared licence by `name@version`.
+ * @returns the document with the licences recorded.
+ */
+export const sbomWithDeclaredLicenses = (bom, licenses) => {
+    const components = readKey(bom, 'components');
+    return {
+        ...asRecord(bom),
+        ...(isArray(components) && {
+            components: components.map((component) => withDeclaredLicense(component, licenses)),
+        }),
+    };
+};
 const bomPartsOf = (bom) => {
     const components = readKey(bom, 'components');
     const dependencies = readKey(bom, 'dependencies');

package/dist/sbom-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom-policy.js","sourceRoot":"","sources":["../src/sbom-policy.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAQvE,MAAM,WAAW,GAAW,CAAC,CAAA;AAE7B,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAA6B,EAA6B,EAAE;IAC7F,IAAI,UAAU,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAmE,KAAK,CAAC,IAAI,CACtF,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,WAAW,EAAE,EAC3C,CAAC,CAAC,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAC7F,CAAA;IACD,IACE,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CACpB,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAClH,EACD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IACjH,MAAM,OAAO,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IAC7G,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACjG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAA;AACtD,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC3D,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aAC9E,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC7D,CAAC,CAAA;AAQD,MAAM,iBAAiB,GAAsB,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAA;AAExG,MAAM,aAAa,GAAW,OAAO,CAAA;AACrC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAE/G,iGAAiG;AACjG,mGAAmG;AACnG,MAAM,eAAe,GAAG,CAAC,QAAiB,EAAE,MAAe,EAAE,QAAgB,EAAW,EAAE;IACxF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,MAAM,KAAK,QAAQ,CAAA;IAC5B,CAAC;IACD,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,QAAQ,CAAA;IAC5B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,YAAY,GAAW,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/D,OAAO,CACL,CAAC,cAAc,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAC/F,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAsB,EAAE,IAAa,EAAqB,EAAE;IACpF,MAAM,SAAS,GAAY,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACrD,MAAM,SAAS,GAA4B,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAY,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,sCAAsC,QAAQ,CAAC,IAAI,gCAAgC,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,KAAa,EAAqB,EAAE;QACpE,MAAM,QAAQ,GAA4B,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;QACxF,MAAM,WAAW,GAA4B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC/E,MAAM,KAAK,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;YACvD,MAAM,SAAS,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,MAAM,GAAY,WAAW,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAY,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtF,MAAM,eAAe,GAAY,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAC7D,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC/D,OAAO,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,6EAA6E,CAAC,CAAA;QAC9G,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAkC,EAClC,IAAa,EACb,SAAkB,EAClB,YAAqB,EAAE,EACJ,EAAE;IACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,8DAA8D,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,6CAA6C,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,SAAS,GAAY,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,KAAK,CACrE,CAAC,GAAW,EAAW,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CACjH,CAAA;IACD,OAAO;QACL,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5D,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mFAAmF,CAAC,CAAC;QAC1F,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8EAA8E,CAAC,CAAC;QACtG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAsB,EAAqB,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;KACtG,CAAA;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,UAA8B,EAAsB,EAAE,CAC3E,UAAU,CAAC,OAAO,CAAC,CAAC,SAAkB,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAY,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACxD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CAAC,YAAgC,EAAE,UAA+B,EAAqB,EAAE,CAC7G,YAAY,CAAC,OAAO,CAAC,CAAC,UAAmB,EAAqB,EAAE;IAC9D,MAAM,SAAS,GAAY,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAY,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC1D,MAAM,OAAO,GACX,OAAO,SAAS,KAAK,QAAQ;QAC7B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC;QACjB,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IACjG,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEJ,MAAM,mBAAmB,GAAG,CAAC,YAAgC,EAAE,UAA+B,EAAqB,EAAE;IACnH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IACpH,OAAO,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM;QAC1C,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,kFAAkF,CAAC,CAAA;AAC1F,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAY,EAAE,SAAkC,EAAW,EAAE;IAClG,MAAM,QAAQ,GAA4B,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5E,MAAM,UAAU,GAAY,QAAQ,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,KAAK,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAsB,EAAW,EAAE,CAAC,CAAC;QACpF,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAa,EAAwC,EAAE,CAAC;YAC7E,KAAK;YACL,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SAC5D,CAAC,CACH;KACF,CAAC,CAAC,CAAA;IACH,OAAO;QACL,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChB,QAAQ,EAAE;YACR,GAAG,QAAQ;YACX,UAAU,EAAE;gBACV,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,EAAE,IAAI,EAAE,4CAA4C,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;aACrF;SACF;KACF,CAAA;AACH,CAAC,CAAA;AAQD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAwB,EAAE;IACxD,MAAM,UAAU,GAAY,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACtD,MAAM,YAAY,GAAY,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAY,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAA;IACpE,IACE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,WAAW;QACzC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,KAAK;QACrC,CAAC,OAAO,CAAC,UAAU,CAAC;QACpB,CAAC,OAAO,CAAC,YAAY,CAAC;QACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,EACf,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAyB,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,4DAA4D,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAA;IAChD,MAAM,OAAO,GAAuB,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAA;IACxE,MAAM,UAAU,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;IAC1G,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CACjE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAW,EAAW,EAAE;QACpE,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,CAAC,CAAC,CACH,CAAA;IACD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAC9C,UAAU,CAAC,MAAM,CAAC,CAAC,SAAkB,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAC9F,CAAA;IACD,MAAM,YAAY,GAAY,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC1D,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC;QAC1E,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC3C,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC7C,GAAG,mBAAmB,CAAC,YAAY,EAAE,WAAW,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,UAAU,CAAC;YACxF,CAAC,CAAC,CAAC,+CAA+C,CAAC;YACnD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"sbom-policy.js","sourceRoot":"","sources":["../src/sbom-policy.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAQrD,MAAM,WAAW,GAAW,CAAC,CAAA;AAE7B,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAA6B,EAA6B,EAAE;IAC7F,IAAI,UAAU,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAmE,KAAK,CAAC,IAAI,CACtF,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,WAAW,EAAE,EAC3C,CAAC,CAAC,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAC7F,CAAA;IACD,IACE,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CACpB,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAClH,EACD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IACjH,MAAM,OAAO,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IAC7G,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACjG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAA;AACtD,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC3D,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAU,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,IAAI,CAAC,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;aAC9E,GAAG,CAAC,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC7D,CAAC,CAAA;AAQD,MAAM,iBAAiB,GAAsB,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAA;AAExG,MAAM,aAAa,GAAW,OAAO,CAAA;AACrC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAE/G,iGAAiG;AACjG,mGAAmG;AACnG,MAAM,eAAe,GAAG,CAAC,QAAiB,EAAE,MAAe,EAAE,QAAgB,EAAW,EAAE;IACxF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,MAAM,KAAK,QAAQ,CAAA;IAC5B,CAAC;IACD,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,QAAQ,CAAA;IAC5B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,YAAY,GAAW,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/D,OAAO,CACL,CAAC,cAAc,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAC/F,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAsB,EAAE,IAAa,EAAqB,EAAE;IACpF,MAAM,SAAS,GAAY,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACrD,MAAM,SAAS,GAA4B,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAY,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,sCAAsC,QAAQ,CAAC,IAAI,gCAAgC,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,KAAa,EAAqB,EAAE;QACpE,MAAM,QAAQ,GAA4B,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;QACxF,MAAM,WAAW,GAA4B,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC/E,MAAM,KAAK,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QACtG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE;YACvD,MAAM,SAAS,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,MAAM,GAAY,WAAW,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAY,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACtF,MAAM,eAAe,GAAY,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAC7D,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC/D,OAAO,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,6EAA6E,CAAC,CAAA;QAC9G,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,SAAkC,EAClC,IAAa,EACb,SAAkB,EAClB,YAAqB,EAAE,EACJ,EAAE;IACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,8DAA8D,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,6CAA6C,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,SAAS,GAAY,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,KAAK,CACrE,CAAC,GAAW,EAAW,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CACjH,CAAA;IACD,OAAO;QACL,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5D,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mFAAmF,CAAC,CAAC;QAC1F,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8EAA8E,CAAC,CAAC;QACtG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAsB,EAAqB,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;KACtG,CAAA;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,UAA8B,EAAsB,EAAE,CAC3E,UAAU,CAAC,OAAO,CAAC,CAAC,SAAkB,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAY,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACxD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,CAAC,YAAgC,EAAE,UAA+B,EAAqB,EAAE,CAC7G,YAAY,CAAC,OAAO,CAAC,CAAC,UAAmB,EAAqB,EAAE;IAC9D,MAAM,SAAS,GAAY,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAY,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC1D,MAAM,OAAO,GACX,OAAO,SAAS,KAAK,QAAQ;QAC7B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC;QACjB,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IACjG,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEJ,MAAM,mBAAmB,GAAG,CAAC,YAAgC,EAAE,UAA+B,EAAqB,EAAE;IACnH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IACpH,OAAO,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM;QAC1C,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,kFAAkF,CAAC,CAAA;AAC1F,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAY,EAAE,SAAkC,EAAW,EAAE;IAClG,MAAM,QAAQ,GAA4B,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5E,MAAM,UAAU,GAAY,QAAQ,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,KAAK,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,QAAsB,EAAW,EAAE,CAAC,CAAC;QACpF,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAa,EAAwC,EAAE,CAAC;YAC7E,KAAK;YACL,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SAC5D,CAAC,CACH;KACF,CAAC,CAAC,CAAA;IACH,OAAO;QACL,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChB,QAAQ,EAAE;YACR,GAAG,QAAQ;YACX,UAAU,EAAE;gBACV,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,EAAE,IAAI,EAAE,4CAA4C,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;aACrF;SACF;KACF,CAAA;AACH,CAAC,CAAA;AAED,0GAA0G;AAC1G,mGAAmG;AACnG,gEAAgE;AAChE,MAAM,OAAO,GAAW,iCAAiC,CAAA;AACzD,MAAM,eAAe,GAAW,aAAa,CAAA;AAC7C,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAC1E,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;AAExG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;AAE/F,MAAM,IAAI,GAAW,CAAC,CAAA;AAEtB,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE;IAC3C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9B,CAAC,CAAA;AAED,uGAAuG;AACvG,oDAAoD;AACpD,MAAM,UAAU,GAAG,CAAC,KAAwB,EAAW,EAAE;IACvD,MAAM,MAAM,GAAsB,KAAK,CAAC,MAAM,CAC5C,CAAC,IAAuB,EAAE,IAAY,EAAqB,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAC/G,CAAC,CAAC,CAAC,CACJ,CAAA;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AACpF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAW,EAAE;IACpD,MAAM,KAAK,GAAsB,OAAO;SACrC,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACnF,MAAM,KAAK,GAAsB,KAAK,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAA;IACtG,OAAO,CACL,KAAK,CAAC,MAAM,GAAG,IAAI,KAAK,CAAC;QACzB,UAAU,CAAC,KAAK,CAAC;QACjB,KAAK,CAAC,KAAK,CAAC,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE,CACnD,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAChE,CACF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAsB,EAAE;IACtE,MAAM,QAAQ,GAAW,OAAO,CAAC,IAAI,EAAE,CAAA;IACvC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;AAClG,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,SAAkB,EAAU,EAAE;IACzD,MAAM,KAAK,GAAW,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACzD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;IACvD,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;AAC1G,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,SAAkB,EAAE,QAAqC,EAAW,EAAE;IACjG,MAAM,MAAM,GAAY,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACxD,MAAM,OAAO,GAAuB,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAA;IAChF,OAAO;QACL,GAAG,QAAQ,CAAC,SAAS,CAAC;QACtB,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YACrB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SAC1F,CAAC;KACH,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAY,EAAE,QAAqC,EAAW,EAAE;IACvG,MAAM,UAAU,GAAY,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACtD,OAAO;QACL,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;YACzB,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAkB,EAAW,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;SACtG,CAAC;KACH,CAAA;AACH,CAAC,CAAA;AAQD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAwB,EAAE;IACxD,MAAM,UAAU,GAAY,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IACtD,MAAM,YAAY,GAAY,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAY,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAA;IACpE,IACE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,WAAW;QACzC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,KAAK;QACrC,CAAC,OAAO,CAAC,UAAU,CAAC;QACpB,CAAC,OAAO,CAAC,YAAY,CAAC;QACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,EACf,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAqB,EAAE;IAC9D,MAAM,KAAK,GAAyB,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,4DAA4D,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,KAAK,CAAA;IAChD,MAAM,OAAO,GAAuB,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAA;IACxE,MAAM,UAAU,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;IAC1G,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CACjE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAW,EAAW,EAAE;QACpE,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IACtD,CAAC,CAAC,CACH,CAAA;IACD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAC9C,UAAU,CAAC,MAAM,CAAC,CAAC,SAAkB,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAC9F,CAAA;IACD,MAAM,YAAY,GAAY,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAC1D,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;YAChD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC;QAC1E,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC3C,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC7C,GAAG,mBAAmB,CAAC,YAAY,EAAE,WAAW,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,UAAU,CAAC;YACxF,CAAC,CAAC,CAAC,+CAA+C,CAAC;YACnD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC,CAAA"}

package/dist/vulnerability-policy.d.ts

@@ -10,6 +10,8 @@ export interface Advisory {
     readonly title: string;
     /** Alternative identifiers the advisory is also known by, such as its CVEs. */
     readonly aliases: readonly string[];
+    /** Where the database publishes the advisory, when the record names it. */
+    readonly url?: string;
 }
 /** A recorded exception for an advisory the repository cannot reach. */
 export interface VulnerabilityException {
@@ -54,6 +56,28 @@ export declare const effectiveSeverity: (declared: string | undefined) => string
  * @returns true when the advisory is at or above the threshold.
  */
 export declare const reachesThreshold: (advisory: Advisory, threshold: string) => boolean;
+/** An advisory a recorded exception excuses, with the exception that excuses it. */
+export interface SuppressedAdvisory {
+    readonly advisory: Advisory;
+    readonly exception: VulnerabilityException;
+    /** Whether ploaness answers for the exception rather than the project. */
+    readonly isHarnessException: boolean;
+}
+/** Every reported advisory, sorted by what the policy decided about it. */
+export interface VulnerabilityClassification extends VulnerabilityReport {
+    readonly suppressed: readonly SuppressedAdvisory[];
+    readonly belowThreshold: readonly Advisory[];
+}
+/**
+ * Sort the advisories the database reported by what the policy decides about each one.
+ * @param advisories every advisory reported for the resolved set.
+ * @param exceptions the recorded exceptions.
+ * @param declaredSeverity the project's declared severity, or undefined.
+ * @param harnessExceptions the advisories ploaness answers for in its own chain.
+ * @returns the advisories that stand, the ones an exception excuses, the ones below the threshold, and
+ * the project exceptions that suppress nothing.
+ */
+export declare const classifyVulnerabilities: (advisories: readonly Advisory[], exceptions: readonly VulnerabilityException[], declaredSeverity: string | undefined, harnessExceptions?: readonly VulnerabilityException[]) => VulnerabilityClassification;
 /**
  * Judge the advisories the database reported against the recorded exceptions.
  * @param advisories every advisory reported for the resolved set.

package/dist/vulnerability-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vulnerability-policy.d.ts","sourceRoot":"","sources":["../src/vulnerability-policy.ts"],"names":[],"mappings":"AAEA,8DAA8D;AAC9D,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAoD,CAAA;AAEhG,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,EAAE,MAAmB,CAAA;AAElD,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,sBAAsB,EAU/D,CAAA;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,QAAQ,EAAE,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAOD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,MAOhE,CAAA;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU,QAAQ,EAAE,WAAW,MAAM,KAAG,OAGxE,CAAA;AAKD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC/B,YAAY,SAAS,QAAQ,EAAE,EAC/B,YAAY,SAAS,sBAAsB,EAAE,EAC7C,kBAAkB,MAAM,GAAG,SAAS,EAIpC,oBAAmB,SAAS,sBAAsB,EAAO,KACxD,mBAqCF,CAAA"}
+{"version":3,"file":"vulnerability-policy.d.ts","sourceRoot":"","sources":["../src/vulnerability-policy.ts"],"names":[],"mappings":"AAEA,8DAA8D;AAC9D,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAoD,CAAA;AAEhG,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,EAAE,MAAmB,CAAA;AAElD,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,sBAAsB,EAU/D,CAAA;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,QAAQ,EAAE,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAOD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,MAOhE,CAAA;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAU,QAAQ,EAAE,WAAW,MAAM,KAAG,OAGxE,CAAA;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAA;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CACrC;AAED,2EAA2E;AAC3E,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,cAAc,EAAE,SAAS,QAAQ,EAAE,CAAA;CAC7C;AAeD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAClC,YAAY,SAAS,QAAQ,EAAE,EAC/B,YAAY,SAAS,sBAAsB,EAAE,EAC7C,kBAAkB,MAAM,GAAG,SAAS,EAIpC,oBAAmB,SAAS,sBAAsB,EAAO,KACxD,2BAuCF,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC/B,YAAY,SAAS,QAAQ,EAAE,EAC/B,YAAY,SAAS,sBAAsB,EAAE,EAC7C,kBAAkB,MAAM,GAAG,SAAS,EACpC,oBAAmB,SAAS,sBAAsB,EAAO,KACxD,mBAYF,CAAA"}

package/dist/vulnerability-policy.js

@@ -59,26 +59,37 @@ export const reachesThreshold = (advisory, threshold) => {
     return (severity === NOT_RANKED ? UNKNOWN_SEVERITY_RANK : severity) >= rank(threshold);
 };
 const identifiersOf = (advisory) => [advisory.id, ...advisory.aliases].map((identifier) => identifier.toUpperCase());
+const exceptionFor = (advisory, exceptions) => {
+    const identifiers = identifiersOf(advisory);
+    return exceptions.find((exception) => identifiers.includes(exception.advisory.toUpperCase()));
+};
 /**
- * Judge the advisories the database reported against the recorded exceptions.
+ * Sort the advisories the database reported by what the policy decides about each one.
  * @param advisories every advisory reported for the resolved set.
  * @param exceptions the recorded exceptions.
  * @param declaredSeverity the project's declared severity, or undefined.
  * @param harnessExceptions the advisories ploaness answers for in its own chain.
- * @returns the advisories that stand, and the exceptions that suppress nothing.
+ * @returns the advisories that stand, the ones an exception excuses, the ones below the threshold, and
+ * the project exceptions that suppress nothing.
  */
-export const judgeVulnerabilities = (advisories, exceptions, declaredSeverity, 
+export const classifyVulnerabilities = (advisories, exceptions, declaredSeverity, 
 // Defaulted to none rather than to the shipped list: a pure rule whose behaviour depends on a module
 // constant is one a spec cannot state the inputs of, and the strict end is the right default anyway.
 // The CLI injects HARNESS_EXCEPTIONS, which is the one place that knows it is judging a real project.
 harnessExceptions = []) => {
     const threshold = effectiveSeverity(declaredSeverity);
-    const excused = new Set([...harnessExceptions, ...exceptions].map((exception) => exception.advisory.toUpperCase()));
     const atThreshold = advisories.filter((advisory) => reachesThreshold(advisory, threshold));
-    const matched = new Set(atThreshold.flatMap((advisory) => identifiersOf(advisory).filter((identifier) => excused.has(identifier))));
+    const suppressed = atThreshold.flatMap((advisory) => {
+        const harness = exceptionFor(advisory, harnessExceptions);
+        const exception = harness ?? exceptionFor(advisory, exceptions);
+        return exception === undefined ? [] : [{ advisory, exception, isHarnessException: harness !== undefined }];
+    });
+    const matched = new Set(atThreshold.flatMap((advisory) => identifiersOf(advisory)));
     return {
         threshold,
-        unsuppressed: atThreshold.filter((advisory) => !identifiersOf(advisory).some((identifier) => excused.has(identifier))),
+        unsuppressed: atThreshold.filter((advisory) => !suppressed.some((entry) => entry.advisory === advisory)),
+        suppressed,
+        belowThreshold: advisories.filter((advisory) => !reachesThreshold(advisory, threshold)),
         // An entry that excuses nothing has outlived its advisory. Reporting it is the vulnerability-domain
         // twin of failing on a lint suppression that no longer suppresses anything.
         // The project's own entries only. Whether a HARNESS entry still suppresses anything is a property
@@ -93,4 +104,20 @@ harnessExceptions = []) => {
             'or the advisory withdrawn, so remove the entry'),
     };
 };
+/**
+ * Judge the advisories the database reported against the recorded exceptions.
+ * @param advisories every advisory reported for the resolved set.
+ * @param exceptions the recorded exceptions.
+ * @param declaredSeverity the project's declared severity, or undefined.
+ * @param harnessExceptions the advisories ploaness answers for in its own chain.
+ * @returns the advisories that stand, and the exceptions that suppress nothing.
+ */
+export const judgeVulnerabilities = (advisories, exceptions, declaredSeverity, harnessExceptions = []) => {
+    const classification = classifyVulnerabilities(advisories, exceptions, declaredSeverity, harnessExceptions);
+    return {
+        threshold: classification.threshold,
+        unsuppressed: classification.unsuppressed,
+        deadEntries: classification.deadEntries,
+    };
+};
 //# sourceMappingURL=vulnerability-policy.js.map

package/dist/vulnerability-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"vulnerability-policy.js","sourceRoot":"","sources":["../src/vulnerability-policy.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,8DAA8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAEhG,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAW,UAAU,CAAA;AAmBlD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE;QACE,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EACJ,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;QAC5F,OAAO,EAAE,YAAY;KACtB;CACF,CAAA;AASD,uEAAuE;AACvE,MAAM,UAAU,GAAW,CAAC,CAAC,CAAA;AAE7B,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA4B,EAAU,EAAE;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5D,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,oGAAoG;IACpG,2DAA2D;IAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAA;AAC5F,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,qBAAqB,GAAW,cAAc,CAAC,MAAM,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAkB,EAAE,SAAiB,EAAW,EAAE;IACjF,MAAM,QAAQ,GAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAChD,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;AACxF,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAqB,EAAE,CAC9D,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAU,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAA+B,EAC/B,UAA6C,EAC7C,gBAAoC;AACpC,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,oBAAuD,EAAE,EACpC,EAAE;IACvB,MAAM,SAAS,GAAW,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,CAAC,GAAG,iBAAiB,EAAE,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAiC,EAAU,EAAE,CACtF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CACjC,CACF,CAAA;IACD,MAAM,WAAW,GAAwB,UAAU,CAAC,MAAM,CAAC,CAAC,QAAkB,EAAW,EAAE,CACzF,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CACtC,CAAA;IACD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,WAAW,CAAC,OAAO,CAAC,CAAC,QAAkB,EAAqB,EAAE,CAC5D,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CACzF,CACF,CAAA;IACD,OAAO;QACL,SAAS;QACT,YAAY,EAAE,WAAW,CAAC,MAAM,CAC9B,CAAC,QAAkB,EAAW,EAAE,CAC9B,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAC1F;QACD,oGAAoG;QACpG,4EAA4E;QAC5E,kGAAkG;QAClG,2FAA2F;QAC3F,oGAAoG;QACpG,oGAAoG;QACpG,kGAAkG;QAClG,2EAA2E;QAC3E,WAAW,EAAE,UAAU;aACpB,MAAM,CAAC,CAAC,SAAiC,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;aACtG,GAAG,CACF,CAAC,SAAiC,EAAU,EAAE,CAC5C,GAAG,SAAS,CAAC,QAAQ,2DAA2D;YAChF,gDAAgD,CACnD;KACJ,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"vulnerability-policy.js","sourceRoot":"","sources":["../src/vulnerability-policy.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,8DAA8D;AAC9D,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAEhG,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAW,UAAU,CAAA;AAqBlD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE;QACE,QAAQ,EAAE,qBAAqB;QAC/B,MAAM,EACJ,0FAA0F;YAC1F,0FAA0F;YAC1F,8FAA8F;YAC9F,0FAA0F;QAC5F,OAAO,EAAE,YAAY;KACtB;CACF,CAAA;AASD,uEAAuE;AACvE,MAAM,UAAU,GAAW,CAAC,CAAC,CAAA;AAE7B,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA4B,EAAU,EAAE;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC5D,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,oGAAoG;IACpG,2DAA2D;IAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAA;AAC5F,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,qBAAqB,GAAW,cAAc,CAAC,MAAM,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAkB,EAAE,SAAiB,EAAW,EAAE;IACjF,MAAM,QAAQ,GAAW,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAChD,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;AACxF,CAAC,CAAA;AAgBD,MAAM,aAAa,GAAG,CAAC,QAAkB,EAAqB,EAAE,CAC9D,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAU,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AAElG,MAAM,YAAY,GAAG,CACnB,QAAkB,EAClB,UAA6C,EACT,EAAE;IACtC,MAAM,WAAW,GAAsB,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC9D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAiC,EAAW,EAAE,CACpE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CACvD,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,UAA+B,EAC/B,UAA6C,EAC7C,gBAAoC;AACpC,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,oBAAuD,EAAE,EAC5B,EAAE;IAC/B,MAAM,SAAS,GAAW,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAwB,UAAU,CAAC,MAAM,CAAC,CAAC,QAAkB,EAAW,EAAE,CACzF,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CACtC,CAAA;IACD,MAAM,UAAU,GAAkC,WAAW,CAAC,OAAO,CACnE,CAAC,QAAkB,EAAiC,EAAE;QACpD,MAAM,OAAO,GAAuC,YAAY,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QAC7F,MAAM,SAAS,GAAuC,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACnG,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC,CAAA;IAC5G,CAAC,CACF,CAAA;IACD,MAAM,OAAO,GAAwB,IAAI,GAAG,CAC1C,WAAW,CAAC,OAAO,CAAC,CAAC,QAAkB,EAAqB,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CACxF,CAAA;IACD,OAAO;QACL,SAAS;QACT,YAAY,EAAE,WAAW,CAAC,MAAM,CAC9B,CAAC,QAAkB,EAAW,EAAE,CAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAyB,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACxF;QACD,UAAU;QACV,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,QAAkB,EAAW,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1G,oGAAoG;QACpG,4EAA4E;QAC5E,kGAAkG;QAClG,2FAA2F;QAC3F,oGAAoG;QACpG,oGAAoG;QACpG,kGAAkG;QAClG,2EAA2E;QAC3E,WAAW,EAAE,UAAU;aACpB,MAAM,CAAC,CAAC,SAAiC,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;aACtG,GAAG,CACF,CAAC,SAAiC,EAAU,EAAE,CAC5C,GAAG,SAAS,CAAC,QAAQ,2DAA2D;YAChF,gDAAgD,CACnD;KACJ,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,UAA+B,EAC/B,UAA6C,EAC7C,gBAAoC,EACpC,oBAAuD,EAAE,EACpC,EAAE;IACvB,MAAM,cAAc,GAAgC,uBAAuB,CACzE,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,iBAAiB,CAClB,CAAA;IACD,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,YAAY,EAAE,cAAc,CAAC,YAAY;QACzC,WAAW,EAAE,cAAc,CAAC,WAAW;KACxC,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ploaness/governance",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Pure, unit-tested governance rules for ploaness. No filesystem, process, or network access.",
   "license": "MIT",
   "author": "Herman Ciechanowiec <herman@ciechanowiec.eu>",