@ploaness/governance 1.7.0 → 1.9.0

package/dist/compliance-report-assets.d.ts

@@ -0,0 +1,20 @@
+/** One embedded typeface file. */
+export interface EmbeddedFont {
+    readonly family: string;
+    readonly style: 'normal' | 'italic';
+    /** The weight range a variable font covers, such as `200 900`. */
+    readonly weight: string;
+    /** The WOFF2 file, base64-encoded. */
+    readonly data: string;
+}
+/**
+ * The `@font-face` rules for the embedded typefaces, so the document reads the same with no font installed.
+ * @param fonts the typefaces.
+ * @returns the CSS rules.
+ */
+export declare const fontFaces: (fonts: readonly EmbeddedFont[]) => string;
+/** The report's stylesheet: the screen layout with its contents panel, then the A4 print layout. */
+export declare const REPORT_STYLE: string;
+/** Table filtering, sorting and the embedded downloads. The document reads completely without it. */
+export declare const REPORT_SCRIPT: string;
+//# sourceMappingURL=compliance-report-assets.d.ts.map

package/dist/compliance-report-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report-assets.d.ts","sourceRoot":"","sources":["../src/compliance-report-assets.ts"],"names":[],"mappings":"AAEA,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAA;IACnC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,SAAS,YAAY,EAAE,KAAG,MAO9C,CAAA;AAEb,oGAAoG;AACpG,eAAO,MAAM,YAAY,EAAE,MAoL1B,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,aAAa,EAAE,MA4B3B,CAAA"}

package/dist/compliance-report-assets.js

@@ -0,0 +1,223 @@
+// The stylesheet, typefaces and script the compliance report inlines, kept apart from the markup that uses them.
+/**
+ * The `@font-face` rules for the embedded typefaces, so the document reads the same with no font installed.
+ * @param fonts the typefaces.
+ * @returns the CSS rules.
+ */
+export const fontFaces = (fonts) => fonts
+    .map((font) => `@font-face{font-family:"${font.family}";font-style:${font.style};font-weight:${font.weight};` +
+    `font-display:block;src:url(data:font/woff2;base64,${font.data}) format("woff2")}`)
+    .join('');
+/** The report's stylesheet: the screen layout with its contents panel, then the A4 print layout. */
+export const REPORT_STYLE = String.raw `
+:root{color-scheme:light;--ink:#1b1f26;--ink-strong:#0a0d12;--muted:#4d5560;--accent:#1b3a6b;--accent-deep:#16315c;
+--rule:#d5dae1;--hair:#e2e6ec;--grid:#c3cfe0;--panel:#f6f8fa;--stripe:#f9fafc;--code-bg:#f3f6fb;--code-edge:#b4c1d4;
+--good:#166a2f;--good-bg:#edf4ef;--bad:#ae2a20;--bad-bg:#f9eeec;--warn:#8a5a00;--warn-bg:#fbf5e6;
+--permissive:#1b3a6b;--weak:#b7791f;--refused:#ae2a20;--other:#9aa6b8;
+--serif:"Source Serif 4",Charter,Georgia,"Times New Roman",serif;
+--display:"Playfair Display","Iowan Old Style",Georgia,serif;
+--mono:"Source Code Pro",SFMono-Regular,Menlo,Consolas,monospace}
+*{box-sizing:border-box}
+html{-webkit-text-size-adjust:100%;background:#fff;font-size:16px}
+body{margin:0;padding:0 0 0 22rem;background:#fff;color:var(--ink);font-family:var(--serif);font-size:17px;
+line-height:1.6;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility;font-kerning:normal;
+font-feature-settings:"lnum" 1}
+table,code,.mono,#toc,.count,.adnum{font-feature-settings:"lnum" 1,"tnum" 1}
+#header,#content,#footer{max-width:58.5em;margin-left:auto;margin-right:auto;padding-left:1.6em;padding-right:1.6em}
+#header{padding-top:48px}
+#header>h1{margin:0;padding:1.1rem 0 0;border-top:6px solid var(--accent);font-family:var(--display);font-size:3em;
+font-weight:600;line-height:1.12;letter-spacing:-.015em;color:var(--ink-strong);hyphens:none;text-align:left}
+#header::after{content:"";display:block;margin-top:.69rem;border-top:1px solid var(--rule)}
+#content{margin-top:1.25em;margin-bottom:1.25em}
+p{margin:0 0 .9em;text-align:justify;text-justify:inter-word;hyphens:auto;letter-spacing:-.01em}
+table p,#toc p{text-align:left;hyphens:manual;letter-spacing:normal}
+a{color:var(--accent);text-decoration:none;border-bottom:1px solid rgba(27,58,107,.5);
+transition:color .12s ease,border-color .12s ease,background-color .12s ease}
+a:hover{color:var(--ink-strong);border-bottom-color:var(--ink-strong);background:rgba(27,58,107,.08)}
+code{margin:0 .09em;padding:.06em .36em;font-family:var(--mono);font-size:.86em;color:var(--accent);
+background:var(--code-bg);border:1px solid var(--code-edge);white-space:nowrap}
+td code,.ids code{white-space:normal;overflow-wrap:anywhere}
+.nowrap code,code.nowrap{white-space:nowrap;overflow-wrap:normal}
+.mono{font-family:var(--mono);font-size:.86em}
+h2,h3,#toctitle{font-family:var(--display);color:var(--accent);font-weight:600;line-height:1.22;hyphens:none;
+text-align:left;font-style:normal}
+h2{display:flex;gap:.3em;margin:40px 0 .8rem;padding-top:.8rem;border-top:3px solid var(--accent);font-size:1.9em;
+letter-spacing:-.005em}
+h3{display:flex;gap:.3em;margin:27px 0 .55rem;padding-bottom:.35em;border-bottom:1px solid var(--hair);
+font-size:1.36em}
+h2 .adnum,h3 .adnum{flex:0 0 auto;letter-spacing:.02em}
+h3 .adnum{font-weight:700;font-size:.86em;align-self:center}
+.admonitionblock{margin:0 0 1.25em}
+.admonitionblock>table{width:100%;border:0;border-collapse:separate;background:none}
+.admonitionblock td.icon{width:3.25em;padding:.5625em .7em .5625em .625em;text-align:center;vertical-align:middle}
+.admonitionblock td.icon svg{display:inline-block;width:1.6em;height:1.6em;vertical-align:middle}
+.admonitionblock td.content{padding:.5625em 1.25em .5625em 1em;border-left:2px solid var(--rule);
+vertical-align:middle;
+text-align:justify;hyphens:auto;letter-spacing:-.01em}
+.admonitionblock td.content p{margin:0;letter-spacing:-.01em}
+.admonitionblock td.content ul{margin:.3em 0 0;padding-left:1.2em}
+.admonitionblock .title{font-family:var(--display);font-weight:600;color:var(--accent-deep)}
+.icon-warning{color:var(--bad)}
+.icon-ok{color:var(--good)}
+.icon-fail{color:var(--bad)}
+.table-wrap{overflow-x:auto;margin:0 0 1.5em}
+table.tableblock{width:100%;border-collapse:collapse;border-spacing:0;background:transparent;margin:0;font-size:1em;
+line-height:1.3;border-left:1px solid var(--rule);border-right:1px solid var(--rule);
+border-bottom:2px solid var(--accent)}
+table.tableblock th,table.tableblock td{padding:.55em .75em;border:solid var(--rule);border-width:0 1px;
+vertical-align:middle;text-align:left;overflow-wrap:break-word}
+table.tableblock th{font-family:var(--display);font-weight:700;color:var(--accent);border-color:var(--grid);
+border-top:2px solid var(--accent);border-bottom:1px solid var(--accent);white-space:nowrap}
+table.tableblock tbody tr:first-child td{border-top:2px solid var(--accent)}
+table.tableblock thead+tbody tr:first-child td{border-top:0}
+table.tableblock tbody tr+tr td{border-top:1px solid var(--hair)}
+table.tableblock tbody tr:nth-child(even){background:var(--stripe)}
+table.tableblock.facts td{vertical-align:middle}
+table.tableblock.facts tbody tr:nth-child(even){background:none}
+table.tableblock.facts td:first-child{width:50%;text-align:right}
+table.tableblock.compact{font-size:.88em}
+th[data-sort]{cursor:pointer;user-select:none}
+th[aria-sort=ascending]::after{content:" \25B4"}
+th[aria-sort=descending]::after{content:" \25BE"}
+.nowrap{white-space:nowrap}
+.empty{color:var(--muted);font-style:italic;text-align:left}
+.stack{display:flex;height:12px;background:var(--hair);margin:.5em 0 .6em}
+.stack i{display:block;height:100%}
+.seg-permissive,.fill-permissive{background:var(--permissive)}
+.seg-weak-copyleft,.fill-weak-copyleft{background:var(--weak)}
+.seg-refused,.fill-refused{background:var(--refused)}
+.fill-other{background:var(--other)}
+.legend{display:flex;flex-wrap:wrap;gap:.2em 1.6em;margin:0 0 1em;padding:0;list-style:none;font-size:.9em;
+color:var(--muted)}
+.legend li::before{content:"";display:inline-block;width:.75em;height:.75em;margin-right:.45em;vertical-align:-.05em}
+.key-permissive::before{background:var(--permissive)}
+.key-weak-copyleft::before{background:var(--weak)}
+.key-refused::before{background:var(--refused)}
+.bars{display:grid;grid-template-columns:minmax(9em,max-content) 1fr max-content;gap:.35em 1em;align-items:center;
+margin:.4em 0 1em;font-size:.94em}
+.bars .label{overflow-wrap:anywhere}
+.bars .track{display:block;height:8px;background:var(--hair)}
+.bars .fill{display:block;height:100%}
+.bars .count{color:var(--muted);text-align:right}
+.sev,.chip{display:inline-block;padding:0 .45em;border:1px solid;font-family:var(--serif);font-size:.82em;
+font-weight:600;letter-spacing:.02em;line-height:1.5;white-space:nowrap}
+.sev{text-transform:capitalize;color:#3c434e;border-color:#c3cbd6;background:#f3f5f8}
+.sev-critical{color:#fff;background:#7a1c15;border-color:#7a1c15}
+.sev-high{color:var(--bad);background:var(--bad-bg);border-color:#e3b7b2}
+.sev-moderate{color:var(--warn);background:var(--warn-bg);border-color:#e6cf9a}
+.sev-low{color:var(--accent);background:var(--code-bg);border-color:var(--code-edge)}
+.chip-permissive{color:var(--accent);background:var(--code-bg);border-color:var(--code-edge)}
+.chip-weak-copyleft{color:var(--warn);background:var(--warn-bg);border-color:#e6cf9a}
+.chip-refused{color:var(--bad);background:var(--bad-bg);border-color:#e3b7b2}
+.statements{margin:.3em 0 1em;padding:0;list-style:none}
+.statements li{position:relative;padding:.1em 0 .55em 1.75em;text-align:justify;hyphens:auto;letter-spacing:-.01em}
+.statements li::before{position:absolute;left:.1em;top:.1em;font-weight:700}
+.statements li.pass::before{content:"\2713";color:var(--good)}
+.statements li.fail::before{content:"\2717";color:var(--bad)}
+.statements.verdict{margin:1.2em 0 1.4em;font-size:1.15em;line-height:1.4}
+.statements.verdict li{padding-bottom:.45em;text-align:left;hyphens:manual}
+.status-open{color:var(--bad);background:var(--bad-bg);border-color:#e3b7b2}
+.status-mitigated{color:var(--good);background:var(--good-bg);border-color:#a9cdb4}
+a.plain,a.plain:hover{border:0;background:none}
+.plan{margin:0 0 1.6em}
+.plan>.title{margin:0;font-family:var(--display);font-weight:600;font-size:1.05em;color:var(--accent);text-align:left}
+.plan-subject{margin:.15em 0 .5em;font-style:italic;color:var(--muted);text-align:left}
+table.tableblock.facts.plan td:first-child{width:26%;text-align:left;vertical-align:top}
+table.tableblock.facts.plan td{vertical-align:top;text-align:left}
+.ids{display:flex;flex-wrap:wrap;gap:.45em;margin:.2em 0 1.2em;padding:0;list-style:none}
+.ids li{max-width:100%}
+.downloads{display:flex;flex-wrap:wrap;gap:.6em;margin:0 0 .9em}
+button{font-family:var(--serif);font-size:.9em;font-weight:600;padding:.35em 1em;border:1px solid var(--accent);
+background:var(--accent);color:#fff;cursor:pointer}
+button+button{background:#fff;color:var(--accent)}
+.controls{display:flex;flex-wrap:wrap;gap:.6em;align-items:center;margin:0 0 .9em}
+.controls input,.controls select{font:inherit;font-size:.9em;padding:.35em .6em;border:1px solid #b9c2cf;
+background:#fff;color:var(--ink)}
+.controls input{flex:1 1 15em}
+.controls output{color:var(--muted);font-size:.85em}
+.notice{margin:0 0 1.4em}
+.notice>.title{margin:0;font-family:var(--display);font-weight:600;font-size:1.02em;color:var(--accent);text-align:left;
+overflow-wrap:anywhere}
+.notice-packages{margin:.1em 0 .5em;font-size:.82em;font-style:italic;color:var(--muted);text-align:left;
+overflow-wrap:anywhere}
+.license-text{padding:.7em 1em .2em;background:var(--panel);border-left:2px solid var(--rule);font-size:.84em;
+line-height:1.5;overflow-wrap:anywhere}
+.license-text p{margin:0 0 .65em}
+.license-text p.ragged{text-align:left;hyphens:manual}
+.digest{font-family:var(--mono);font-size:.84em;color:var(--accent);word-break:break-all}
+.license-text hr{margin:1.1em 0;border:0;border-top:1px solid var(--rule)}
+.license-entry p{margin:0;text-align:left;hyphens:manual}
+.license-entry p+p{margin-top:.1em}
+.license-entry{margin:0 0 .65em}
+.license-heading{font-family:var(--display);font-weight:700;font-size:1.08em;color:var(--accent)}
+#toc{position:fixed;top:0;left:0;bottom:0;z-index:1000;width:22rem;overflow-y:auto;padding:16.4px 1.35em 3em 1.5em;
+background:var(--panel);border-right:1px solid var(--hair);scrollbar-width:thin;text-align:left}
+#toctitle{margin:0 0 1.2em;padding-bottom:.7em;border-bottom:1px solid var(--hair);font-size:1em;
+font-variant:all-small-caps;letter-spacing:.12em;color:var(--accent-deep)}
+#toc ul{margin:0 0 .5em .125em;padding:0;list-style:none;font-size:.87rem;line-height:1.6}
+#toc ul ul{margin:0 0 0 .2em;padding-left:.8em;border-left:1px solid #c6cedb}
+#toc li{margin-top:.14em}
+#toc .sectlevel1>li{margin-top:.75em}
+#toc .sectlevel1>li:first-child{margin-top:0}
+#toc a{display:flex;gap:.25em;padding:.06em 0;border:0;color:#3c434e;line-height:1.32}
+#toc a:hover{color:var(--accent-deep);background:none}
+#toc .sectlevel1>li>a{color:var(--accent-deep);font-weight:600}
+#toc .leader,#toc .page{display:none}
+#footer{margin-top:3em;padding-top:1.5em;padding-bottom:3em;border-top:1px solid var(--hair);color:var(--muted);
+font-size:.85em}
+@media (max-width:1100px){body{padding-left:0}#toc{position:static;width:auto;border-right:0;
+border-bottom:1px solid var(--hair);padding:1.2rem 1.4rem;margin:1.2em 0}}
+@media (max-width:640px){body{font-size:16px}#header>h1{font-size:2.2em}h2{font-size:1.55em}h3{font-size:1.2em}
+.bars{grid-template-columns:1fr max-content}.bars .track{grid-column:1 / -1}}
+@page{size:A4;margin:16mm 16mm 18mm;
+@bottom-center{content:counter(page);font:8.5pt "Source Serif 4",Georgia,serif;color:#1b1f26;
+border-top:1px solid #e2e6ec;vertical-align:middle}}
+@media print{html{font-size:12px}body{padding:0;font-size:10pt;line-height:1.45;print-color-adjust:exact;
+-webkit-print-color-adjust:exact}#header,#content,#footer{max-width:none;padding:0}#header{padding-top:0}
+#header>h1{border-top:0;padding:0;text-align:center;font-size:30pt;line-height:1.15}#header::after{display:none}
+#toc{position:static;width:auto;padding:0;margin:14pt 0 0;background:none;border:0}
+#toctitle{font-size:18pt;font-variant:normal;letter-spacing:0;color:var(--accent);border:0;padding:0;margin:0 0 8pt}
+#toc ul{font-size:10pt;margin:0;line-height:1.5}#toc ul ul{border:0;margin-left:1.2em;padding-left:0}
+#toc a{color:var(--ink);font-weight:400}#toc .sectlevel1>li>a{color:var(--ink);font-weight:400}
+#toc .sectlevel1>li{margin-top:.15em}#toc li{margin-top:.15em}
+#toc .leader{display:block;flex:1 1 auto;margin:0 .15em .28em .3em;border-bottom:1px dotted #9aa3b0}
+#toc .page{display:inline;text-align:right}#toc .page:empty,#toc .leader:has(+ .page:empty){display:none}
+#content{margin-top:16pt}h2{border-top:0;padding-top:0;margin-top:20pt;break-after:avoid}h3{border-bottom:0;
+padding-bottom:0;break-after:avoid}.controls,.downloads{display:none}.table-wrap{overflow:visible}
+a{color:inherit;border:0}table.tableblock{font-size:8.6pt}table.tableblock th,table.tableblock td{padding:.3em .5em}
+tr,.admonitionblock,table.facts,.plan{break-inside:avoid}.notice>.title,.notice-packages{break-after:avoid}
+.notice{break-inside:avoid}
+.license-text{columns:2;column-gap:7mm;font-size:7.4pt;line-height:1.35;background:none;border:0;padding:0}
+#footer{margin-top:16pt;padding:6pt 0 0}}
+`;
+/** Table filtering, sorting and the embedded downloads. The document reads completely without it. */
+export const REPORT_SCRIPT = `
+(function(){
+var data=JSON.parse(document.getElementById('report-data').textContent);
+function save(name,type,text){var blob=new Blob([text],{type:type});var link=document.createElement('a');
+link.href=URL.createObjectURL(blob);link.download=name;document.body.appendChild(link);link.click();
+setTimeout(function(){URL.revokeObjectURL(link.href);link.remove();},0);}
+document.querySelectorAll('[data-download]').forEach(function(button){button.hidden=false;
+button.addEventListener('click',function(){var key=button.getAttribute('data-download');
+save(button.getAttribute('data-file'),key==='sbom'?'application/vnd.cyclonedx+json':'text/csv',data[key]);});});
+var table=document.getElementById('inventory-table');if(!table){return;}
+var body=table.tBodies[0];var rows=Array.prototype.slice.call(body.rows);
+var search=document.getElementById('filter-text');var scope=document.getElementById('filter-scope');
+var kind=document.getElementById('filter-class');var shown=document.getElementById('filter-count');
+function apply(){var needle=search.value.trim().toLowerCase();var visible=0;rows.forEach(function(row){
+var match=(!needle||row.textContent.toLowerCase().indexOf(needle)>=0)&&(!scope.value||row.dataset.scope===scope.value)
+&&(!kind.value||row.dataset.class===kind.value);row.hidden=!match;if(match){visible++;}});
+shown.textContent=visible+' of '+rows.length+' package versions';}
+[search,scope,kind].forEach(function(control){control.addEventListener('input',apply);});
+table.querySelectorAll('th[data-sort]').forEach(function(header,index){header.tabIndex=0;
+function sort(){var ascending=header.getAttribute('aria-sort')!=='ascending';
+table.querySelectorAll('th').forEach(function(other){other.removeAttribute('aria-sort');});
+header.setAttribute('aria-sort',ascending?'ascending':'descending');
+rows.sort(function(left,right){var a=left.cells[index].textContent;var b=right.cells[index].textContent;
+return (ascending?1:-1)*a.localeCompare(b,undefined,{numeric:true,sensitivity:'base'});});
+rows.forEach(function(row){body.appendChild(row);});}
+header.addEventListener('click',sort);header.addEventListener('keydown',function(event){
+if(event.key==='Enter'||event.key===' '){event.preventDefault();sort();}});});
+apply();})();
+`;
+//# sourceMappingURL=compliance-report-assets.js.map

package/dist/compliance-report-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report-assets.js","sourceRoot":"","sources":["../src/compliance-report-assets.ts"],"names":[],"mappings":"AAAA,iHAAiH;AAYjH;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAU,EAAE,CAClE,KAAK;KACF,GAAG,CACF,CAAC,IAAkB,EAAU,EAAE,CAC7B,2BAA2B,IAAI,CAAC,MAAM,gBAAgB,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,MAAM,GAAG;IAC9F,qDAAqD,IAAI,CAAC,IAAI,oBAAoB,CACrF;KACA,IAAI,CAAC,EAAE,CAAC,CAAA;AAEb,oGAAoG;AACpG,MAAM,CAAC,MAAM,YAAY,GAAW,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoL7C,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,aAAa,GAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BpC,CAAA"}

package/dist/compliance-report-html.d.ts

@@ -0,0 +1,18 @@
+import type { ComplianceReport } from './compliance-report.js';
+import { type EmbeddedFont } from './compliance-report-assets.js';
+/** What the report carries besides its own markup. */
+export interface ReportAttachments {
+    /** The CycloneDX document as written, so its SHA-256 matches the one the report prints. */
+    readonly sbom: string;
+    /** The typefaces the report is set in, embedded so it reads the same on every machine. */
+    readonly fonts: readonly EmbeddedFont[];
+}
+/**
+ * Render the compliance report as one self-contained HTML document.
+ * @param report the assembled report.
+ * @param attachments the exact bytes the report carries, and the typefaces it is set in.
+ * @param fileStem the file name, without extension, downloads are offered under.
+ * @returns the complete document.
+ */
+export declare const renderComplianceReport: (report: ComplianceReport, attachments: ReportAttachments, fileStem: string) => string;
+//# sourceMappingURL=compliance-report-html.d.ts.map

package/dist/compliance-report-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-report-html.d.ts","sourceRoot":"","sources":["../src/compliance-report-html.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAA4D,MAAM,wBAAwB,CAAA;AACxH,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,+BAA+B,CAAA;AA6BzG,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC;AAycD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GACjC,QAAQ,gBAAgB,EACxB,aAAa,iBAAiB,EAC9B,UAAU,MAAM,KACf,MAqBW,CAAA"}

package/dist/compliance-report-html.js

@@ -0,0 +1,350 @@
+// Render the open source software report as one self-contained HTML document: no external asset, so the file is
+// the whole deliverable whether it is opened offline, attached to a message, or printed to PDF.
+import { fontFaces, REPORT_SCRIPT, REPORT_STYLE } from './compliance-report-assets.js';
+import { admonition, CLASS_LABELS, CLASSES, cells, classChip, code, embeddedJson, escapeHtml, facts, formatCount, idList, inventoryCsv, nowrap, packageLink, paragraphs, percentOf, plural, relationLabel, scopeLabel, severityChip, table, versionLabel, } from './compliance-report-markup.js';
+import { section, sectionReference, subheading, tableOfContents } from './compliance-report-outline.js';
+const SHORT_COMMIT = 12;
+const CHART_LICENSES = 10;
+const shortCommit = (commit) => commit.slice(0, SHORT_COMMIT);
+const draftNotice = (report) => report.draftReasons.length === 0
+    ? ''
+    : admonition('warning', `<p>This report is a draft and must not be treated as release evidence. ${report.draftReasons
+        .map((reason) => escapeHtml(reason))
+        .join(' ')}</p>`);
+const statement = (outcome, text) => `<li class="${outcome}">${text}</li>`;
+const verdictOf = (isPassing) => (isPassing ? 'pass' : 'fail');
+// The verb that agrees with a counted subject: "1 package version has", "2 package versions have".
+const agreeing = (count, one, several) => (count === 1 ? one : several);
+const severityOf = (entry) => entry.advisory.severity.toLowerCase();
+const countAt = (entries, severity) => entries.filter((entry) => severityOf(entry) === severity).length;
+// "1 high, 2 low", most severe first, which is the order the advisories are already listed in.
+const severityBreakdown = (entries) => [...new Set(entries.map((entry) => severityOf(entry)))]
+    .map((severity) => `${formatCount(countAt(entries, severity))} ${escapeHtml(severity)}`)
+    .join(', ');
+const licenseStatement = (report) => {
+    const outside = report.classCounts.refused;
+    return statement(verdictOf(outside === 0), outside === 0
+        ? `All ${plural(report.packages.length, 'package version')} have a license within the policy.`
+        : `${plural(outside, 'package version')} ${agreeing(outside, 'has', 'have')} a license outside the policy. ` +
+            `Each is listed in ${sectionReference('review-outside')}.`);
+};
+const openStatement = (report, mitigatedCount) => {
+    const open = report.advisories.filter((entry) => entry.mitigation === undefined);
+    if (open.length > 0) {
+        return statement('fail', `${plural(open.length, 'vulnerability', 'vulnerabilities')} (${severityBreakdown(open)}) ` +
+            `${agreeing(open.length, 'is', 'are')} open, with no mitigation plan. ` +
+            `Each is listed in ${sectionReference('advisories-all')}.`);
+    }
+    return statement('pass', mitigatedCount === 0 ? 'No known vulnerabilities.' : 'No open vulnerabilities.');
+};
+const vulnerabilityStatements = (report) => {
+    const mitigated = report.advisories.filter((entry) => entry.mitigation !== undefined);
+    const stale = report.vulnerabilities.deadEntries.length;
+    return [
+        openStatement(report, mitigated.length),
+        ...(mitigated.length > 0
+            ? [
+                statement('pass', `${plural(mitigated.length, 'vulnerability', 'vulnerabilities')} (${severityBreakdown(mitigated)}) ` +
+                    `${agreeing(mitigated.length, 'is mitigated, with a', 'are mitigated, each with a')} ` +
+                    `mitigation plan in ${sectionReference('advisories-plans')}.`),
+            ]
+            : []),
+        ...(stale > 0
+            ? [
+                statement('fail', `${plural(stale, 'recorded mitigation')} ${agreeing(stale, 'matches', 'match')} no current ` +
+                    `vulnerability. Each is listed in ${sectionReference('advisories-stale')}.`),
+            ]
+            : []),
+    ];
+};
+const verdict = (report) => `<ul class="statements verdict">${[licenseStatement(report), ...vulnerabilityStatements(report)].join('')}</ul>`;
+const preamble = (report) => `<div id="preamble">${draftNotice(report)}${verdict(report)}${facts([
+    ['Project', escapeHtml(report.projectName)],
+    ...(report.projectDescription === undefined
+        ? []
+        : [['Description', escapeHtml(report.projectDescription)]]),
+    ['Source commit', code(report.source.commit)],
+    ['Report generated', escapeHtml(report.generatedAt)],
+    ['Vulnerability data as of', escapeHtml(report.auditedAt)],
+])}</div>`;
+// The verdict precedes the contents, so a reader who opens only the first page reads it.
+const header = (report) => `<div id="header"><h1>Open Source Software Report</h1>${preamble(report)}${tableOfContents()}</div>`;
+const advisoryLink = (advisory) => advisory.url?.startsWith('https://') === true
+    ? `<a href="${escapeHtml(advisory.url)}" rel="noreferrer noopener">${nowrap(code(advisory.id))}</a>`
+    : nowrap(code(advisory.id));
+const aliasLine = (advisory) => advisory.aliases.length > 0 ? `<br><span class="mono">${escapeHtml(advisory.aliases.join(', '))}</span>` : '';
+const planId = (index) => `plan-${String(index + 1)}`;
+const statusOf = (entry, planIndex) => entry.mitigation === undefined
+    ? '<span class="chip status-open">Open</span>'
+    : `<a class="plain" href="#${planId(planIndex)}"><span class="chip status-mitigated">Mitigated</span></a>`;
+const ADVISORY_HEADINGS = ['Severity', 'Advisory', 'Package', 'Scope', 'Status'];
+const advisoryRow = (entry, mitigated) => {
+    const status = statusOf(entry, mitigated.indexOf(entry));
+    return cells([
+        severityChip(entry.advisory.severity),
+        `${advisoryLink(entry.advisory)}${aliasLine(entry.advisory)}<br>${escapeHtml(entry.advisory.title)}`,
+        escapeHtml(entry.advisory.packageName),
+        nowrap(entry.isProduction ? 'Production' : 'Development'),
+        nowrap(status),
+    ]);
+};
+const plan = (entry, index) => {
+    const addedOn = escapeHtml(entry.mitigation?.addedOn ?? '');
+    const recorded = `<span class="mono">${nowrap(addedOn)}</span>` + (entry.isHarnessMitigation ? ' by the build harness' : '');
+    return (`<div class="plan" id="${planId(index)}"><p class="title">${severityChip(entry.advisory.severity)} ` +
+        `${nowrap(code(entry.advisory.id))} in ${escapeHtml(entry.advisory.packageName)}</p>` +
+        `<p class="plan-subject">${escapeHtml(entry.advisory.title)}</p>` +
+        facts([
+            ['Why it can&#39;t be exploited here', escapeHtml(entry.mitigation?.reason ?? '')],
+            ['Mitigation plan', escapeHtml(entry.mitigation?.mitigation ?? '')],
+            ['Recorded', recorded],
+        ], 'plan') +
+        '</div>');
+};
+const listItem = (text) => `<li>${escapeHtml(text)}</li>`;
+const staleMitigations = (entries) => entries.length > 0
+    ? `<ul>${entries.map((entry) => listItem(entry)).join('')}</ul>`
+    : '<p class="empty">Every recorded mitigation matches a current vulnerability.</p>';
+const vulnerabilities = (report) => {
+    const mitigated = report.advisories.filter((entry) => entry.mitigation !== undefined);
+    return section('vulnerabilities', paragraphs([
+        'Every installed package, development tools included, was checked against the GitHub Advisory Database ' +
+            `at ${escapeHtml(report.auditedAt)}.`,
+        'Each vulnerability is either open, which fails the build, or mitigated, which means the project recorded ' +
+            'why it can&#39;t be exploited here and a mitigation plan.',
+    ]) +
+        subheading('advisories-all') +
+        table(ADVISORY_HEADINGS, report.advisories.map((entry) => advisoryRow(entry, mitigated)), 'No known vulnerability was reported.') +
+        subheading('advisories-plans') +
+        (mitigated.length > 0
+            ? mitigated.map((entry, index) => plan(entry, index)).join('')
+            : '<p class="empty">No vulnerability needs a mitigation plan.</p>') +
+        subheading('advisories-stale') +
+        staleMitigations(report.vulnerabilities.deadEntries));
+};
+const classStack = (report) => {
+    const total = report.packages.length;
+    const share = (licenseClass) => percentOf(report.classCounts[licenseClass], total);
+    const description = CLASSES.map((licenseClass) => `${CLASS_LABELS[licenseClass]} ${share(licenseClass)} percent`).join(', ');
+    return (`<div class="stack" role="img" aria-label="${description}">${CLASSES.map((licenseClass) => `<i class="seg-${licenseClass}" style="width:${share(licenseClass)}%"></i>`).join('')}</div>` +
+        `<ul class="legend">${CLASSES.map((licenseClass) => `<li class="key-${licenseClass}">${CLASS_LABELS[licenseClass]}: ` +
+            `${formatCount(report.classCounts[licenseClass])} (${share(licenseClass)}%)</li>`).join('')}</ul>`);
+};
+const bar = (label, count, largest, tone) => `<span class="label">${escapeHtml(label)}</span><span class="track"><span class="fill fill-${tone}" ` +
+    `style="width:${percentOf(count, largest)}%"></span></span><span class="count">${formatCount(count)}</span>`;
+const licenseBars = (report) => {
+    const shown = report.licenseCounts.slice(0, CHART_LICENSES);
+    const rest = report.licenseCounts.slice(CHART_LICENSES);
+    const largest = shown[0]?.count ?? 0;
+    const restCount = rest.reduce((sum, entry) => sum + entry.count, 0);
+    return `<div class="bars">${[
+        ...shown.map((entry) => bar(entry.license, entry.count, largest, entry.licenseClass)),
+        ...(rest.length > 0 ? [bar(plural(rest.length, 'other license'), restCount, largest, 'other')] : []),
+    ].join('')}</div>`;
+};
+const REVIEW_HEADINGS = ['Package', 'Version', 'License', 'Scope', 'Relation'];
+const reviewRow = (row) => {
+    const version = nowrap(escapeHtml(versionLabel(row)));
+    return cells([
+        packageLink(row),
+        `<span class="mono">${version}</span>`,
+        code(row.license),
+        nowrap(scopeLabel(row)),
+        nowrap(relationLabel(row)),
+    ]);
+};
+const licenses = (report) => {
+    const total = report.packages.length;
+    return section('licenses', paragraphs([
+        `${plural(total, 'package version')} ${agreeing(total, 'is', 'are')} installed, ` +
+            `${formatCount(report.productionCount)} in the production dependency graph and ` +
+            `${formatCount(total - report.productionCount)} used only for development and build.`,
+        `Each license is judged against the policy in ${sectionReference('policy')}.`,
+    ]) +
+        subheading('license-classes') +
+        classStack(report) +
+        subheading('common-licenses') +
+        licenseBars(report) +
+        subheading('review-weak-copyleft') +
+        paragraphs([
+            'The policy admits weak copyleft only for components used unmodified. Development components are build, ' +
+                'test and analysis tools that aren&#39;t distributed with the application.',
+        ]) +
+        table(REVIEW_HEADINGS, report.copyleft.map((row) => reviewRow(row)), 'No dependency carries a weak copyleft license.') +
+        subheading('review-outside') +
+        table(REVIEW_HEADINGS, report.refused.map((row) => reviewRow(row)), 'No dependency declares a license outside the policy.'));
+};
+const policy = (report) => section('policy', paragraphs([
+    'The build enforces this policy, rendered from the same definition the license check reads. A license is ' +
+        'identified by its Software Package Data Exchange (SPDX) identifier. In a compound expression, an OR is ' +
+        'satisfied by any admitted alternative, and an AND requires every part.',
+]) +
+    subheading('policy-permissive') +
+    paragraphs([
+        `The policy admits ${plural(report.policy.permissive.length, 'license')} with no copyleft obligation. ` +
+            `Attribution, where the license requires it, is satisfied by ${sectionReference('notices')}.`,
+    ]) +
+    idList(report.policy.permissive) +
+    subheading('policy-weak-copyleft') +
+    paragraphs([
+        `The policy admits ${plural(report.policy.weakCopyleft.length, 'license')} only for dependencies used ` +
+            'unmodified. Their copyleft, whether file-level or library-level, doesn&#39;t extend to the ' +
+            'project&#39;s own source when the component is used as published.',
+    ]) +
+    idList(report.policy.weakCopyleft) +
+    subheading('policy-outside') +
+    paragraphs([
+        'Every other license is outside the policy, including strong copyleft such as the GNU General ' +
+            'Public License, licenses that restrict the field of use, and any package whose license can&#39;t be ' +
+            'resolved. A single such package fails the build.',
+    ]));
+const inventoryRow = (row) => `<tr data-scope="${row.isProduction ? 'production' : 'development'}" data-class="${row.licenseClass}">` +
+    `<td>${packageLink(row)}</td><td class="mono nowrap">${escapeHtml(versionLabel(row))}</td>` +
+    `<td>${code(row.license)}</td><td>${classChip(row.licenseClass)}</td>` +
+    `<td class="nowrap">${scopeLabel(row)}</td><td class="nowrap">${relationLabel(row)}</td></tr>`;
+const classOption = (licenseClass) => `<option value="${licenseClass}">${CLASS_LABELS[licenseClass]}</option>`;
+const inventoryControls = (fileStem) => '<div class="downloads">' +
+    `<button type="button" data-download="sbom" data-file="${escapeHtml(fileStem)}.cdx.json" hidden>` +
+    'Download SBOM (CycloneDX JSON)</button>' +
+    `<button type="button" data-download="csv" data-file="${escapeHtml(fileStem)}.csv" hidden>` +
+    'Download inventory (CSV)</button></div>' +
+    '<div class="controls">' +
+    '<input id="filter-text" type="search" placeholder="Filter by package or license" ' +
+    'aria-label="Filter by package or license">' +
+    '<select id="filter-scope" aria-label="Scope"><option value="">All scopes</option>' +
+    '<option value="production">Production</option><option value="development">Development</option></select>' +
+    '<select id="filter-class" aria-label="License class"><option value="">All license classes</option>' +
+    CLASSES.map((licenseClass) => classOption(licenseClass)).join('') +
+    '</select><output id="filter-count" aria-live="polite"></output></div>';
+const INVENTORY_HEADINGS = ['Package', 'Version', 'License', 'Class', 'Scope', 'Relation'];
+const inventory = (report, fileStem) => section('inventory', paragraphs([
+    `This section lists every installed package version, ${plural(report.packages.length, 'row')}, with the ` +
+        'license its installed manifest declares.',
+    'Scope is production when the version is reachable from a production dependency of any workspace package, ' +
+        'and development otherwise.',
+    'Relation is direct when a workspace manifest declares the package by name.',
+]) +
+    inventoryControls(fileStem) +
+    '<div class="table-wrap"><table class="tableblock" id="inventory-table"><thead><tr>' +
+    INVENTORY_HEADINGS.map((heading) => `<th scope="col" data-sort>${heading}</th>`).join('') +
+    `</tr></thead><tbody>${report.packages.map((row) => inventoryRow(row)).join('')}` +
+    '</tbody></table></div>');
+const LICENSE_HEADING = /^#{1,6}[ \t]+/u;
+const LICENSE_RULE = /^[-=_*~]{3,}$/u;
+// A web or e-mail address cannot break between words, and a copyright statement is a short line of names,
+// so justifying either opens wide gaps. Such a paragraph is set flush left instead.
+const FLUSH_LEFT = /\b(?:https?:\/\/|www\.)\S{20}|<[^<>\s]{1,80}@[^<>\s]{1,80}>|^(?:\(c\)|copyright\b|\u{A9})/iu;
+// A licence block is plain lines, except that a bundle of licences titles each one with a Markdown heading
+// and separates them with a ruled line. Those two are drawn as what they are, not printed as characters.
+const licenseLine = (line) => {
+    if (LICENSE_RULE.test(line)) {
+        return '<hr>';
+    }
+    return LICENSE_HEADING.test(line)
+        ? `<p class="license-heading">${escapeHtml(line.replace(LICENSE_HEADING, ''))}</p>`
+        : `<p>${escapeHtml(line)}</p>`;
+};
+const licenseBlock = (block) => {
+    const lines = block.split('\n');
+    const isStructured = lines.some((line) => LICENSE_RULE.test(line) || LICENSE_HEADING.test(line));
+    const alignment = FLUSH_LEFT.test(block) ? ' class="ragged"' : '';
+    return isStructured
+        ? `<div class="license-entry">${lines.map((line) => licenseLine(line)).join('')}</div>`
+        : `<p${alignment}>${lines.map((line) => escapeHtml(line)).join('<br>')}</p>`;
+};
+// The package is what a reader looks for, so it heads the entry. The file names follow, with the number of
+// package versions that share the text when there is more than one.
+const noticeSource = (group) => escapeHtml(group.fileNames.join(', ')) +
+    (group.coordinates.length > 1 ? `, shared by ${plural(group.coordinates.length, 'package version')}` : '');
+const noticeGroup = (group, index) => `<div class="notice" id="notice-${String(index + 1)}">` +
+    `<p class="title">${escapeHtml(group.coordinates.join(', '))}</p>` +
+    `<p class="notice-packages">${noticeSource(group)}</p>` +
+    `<div class="license-text">${group.text
+        .split('\n\n')
+        .map((block) => licenseBlock(block))
+        .join('')}</div></div>`;
+const missingNotices = (report) => report.withoutNotice.length > 0
+    ? paragraphs([
+        'These production package versions ship no license file.',
+        `Their declared license is listed in ${sectionReference('inventory')}, and no text is invented for them.`,
+    ]) + idList(report.withoutNotice)
+    : '<p class="empty">Every production package version ships a license file.</p>';
+const notices = (report) => section('notices', paragraphs([
+    'This section reproduces the license and notice files shipped by each production dependency, from the ' +
+        'installed package.',
+    'The words are unchanged. Only the fixed-width line breaks and the Markdown markers of the original files ' +
+        'are removed so the text reads as paragraphs.',
+    'Identical texts are printed once with every package version that ships them.',
+    'Development dependencies aren&#39;t distributed with the application, so this section doesn&#39;t ' +
+        'reproduce them.',
+]) +
+    subheading('notices-missing') +
+    missingNotices(report) +
+    subheading('notices-texts') +
+    (report.notices.length > 0
+        ? report.notices.map((group, index) => noticeGroup(group, index)).join('')
+        : '<p class="empty">No production dependency ships a license file.</p>'));
+// A digest is read as one value, so it is set in the code face without a chip, which would split in two
+// where the value wraps.
+const digest = (value) => `<span class="digest">${escapeHtml(value)}</span>`;
+const provenance = (report) => section('provenance', paragraphs([
+    'This report is generated by the build, not written by hand.',
+    'It reads the same installed dependency tree, license policy and advisory data that the license and ' +
+        'vulnerability checks of the build use to pass or fail, so the report and the verdict can&#39;t disagree.',
+    'Anyone with the repository can regenerate it from the commit below.',
+]) +
+    subheading('provenance-source') +
+    facts([
+        ['Source commit', code(report.source.commit)],
+        ['Uncommitted changes', report.source.isDirty ? 'Present, so this report is a draft' : 'None'],
+        ['Source fingerprint (SHA-256)', digest(report.source.fingerprint)],
+        ['Lockfile (SHA-256)', digest(report.source.lockfileSha256)],
+        ['SBOM (SHA-256)', digest(report.sbom.sha256)],
+        ['SBOM generator', digest(report.sbom.generator)],
+        ['Report date', escapeHtml(report.generatedAt)],
+        ['Regenerate', code('pnpm exec ploaness compliance-report')],
+    ]) +
+    subheading('provenance-scope') +
+    paragraphs([
+        'The report covers every package the pnpm workspace resolves, for every workspace package, including ' +
+            'development and build tools.',
+        'A license is the one the installed package manifest declares.',
+        'The embedded SBOM lists the same resolved set with its dependency graph.',
+    ]));
+const body = (report, fileStem) => [
+    vulnerabilities(report),
+    licenses(report),
+    policy(report),
+    inventory(report, fileStem),
+    notices(report),
+    provenance(report),
+];
+/**
+ * Render the compliance report as one self-contained HTML document.
+ * @param report the assembled report.
+ * @param attachments the exact bytes the report carries, and the typefaces it is set in.
+ * @param fileStem the file name, without extension, downloads are offered under.
+ * @returns the complete document.
+ */
+export const renderComplianceReport = (report, attachments, fileStem) => [
+    '<!doctype html>',
+    '<html lang="en">',
+    '<head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">',
+    `<title>Open source software report - ${escapeHtml(report.projectName)}</title>`,
+    `<style>${fontFaces(attachments.fonts)}${REPORT_STYLE}</style></head>`,
+    '<body class="article toc2 toc-left">',
+    header(report),
+    '<div id="content">',
+    ...body(report, fileStem),
+    '</div>',
+    `<div id="footer">Report for ${escapeHtml(report.projectName)} at commit ` +
+        `${code(shortCommit(report.source.commit))}, ${escapeHtml(report.generatedAt)}.</div>`,
+    `<script type="application/json" id="report-data">${embeddedJson({
+        sbom: attachments.sbom,
+        csv: inventoryCsv(report.packages),
+    })}</script>`,
+    `<script>${REPORT_SCRIPT}</script>`,
+    '</body></html>',
+    '',
+].join('\n');
+//# sourceMappingURL=compliance-report-html.js.map